v8/test/mjsunit/regress/wasm/regress-1242689.js

Ignoring revisions in .git-blame-ignore-revs. Click here to bypass and see the normal blame view.

34 lines
1.3 KiB
JavaScript
Raw Normal View History

// Copyright 2021 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// This test case is minified from a clusterfuzz generated test. It exercises a
// bug in I64x2ShrS where the codegen was overwriting a input Register
// containing the shift value.
d8.file.execute('test/mjsunit/wasm/wasm-module-builder.js');
const builder = new WasmModuleBuilder();
// Generate function 1 (out of 1).
builder.addFunction("main", kSig_i_v)
.addBodyWithEnd([
// signature: i_iii
// body:
kExprI32Const, 0x00, // i32.const
kSimdPrefix, kExprI8x16Splat, // i8x16.splat
kExprI32Const, 0xee, 0xc6, 0x01, // i32.const, 25454 (0x636e)
kSimdPrefix, kExprI8x16Splat, // i8x16.splat
kSimdPrefix, kExprI8x16ExtractLaneS, 0x00, // i8x16.extract_lane_s
kSimdPrefix, kExprI64x2ShrS, 0x01, // i64x2.shr_s
kSimdPrefix, kExprI8x16ExtractLaneS, 0x00, // i8x16.extract_lane_s
kExprI32Const, 0xee, 0xc6, 0x01, // i32.const, 0x636e
kSimdPrefix, kExprI8x16Splat, // i8x16.splat
kSimdPrefix, kExprI8x16ExtractLaneS, 0x00, // i8x16.extract_lane_s
kExprI32Const, 0x00, // i32.const
kExprSelect, // select
kExprEnd, // end @48
]).exportFunc();
const instance = builder.instantiate();
print(instance.exports.main());