AuroraMiddleware/v8
1
0
Fork 0
Code Issues 2 Pull Requests Releases Wiki Activity

[wasm][liftoff] Zero-extend result of atomic.add

Browse Source 
R=clemensb@chromium.org

Fix: chromium:1045737
Change-Id: I0e27b8ff6ab09078a2f63f955e6123e1003ed889
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2020768
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#65998}
This commit is contained in:
Andreas Haas 2020-01-27 12:48:17 +01:00 committed by Commit Bot
parent 6de6fdd034
commit 82b78191ef
2 changed files with 27 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
src/wasm/baseline/x64/liftoff-assembler-x64.h
View File

@ -393,10 +393,12 @@ void LiftoffAssembler::AtomicAdd(Register dst_addr, Register offset_reg,
case StoreType::kI32Store8:
case StoreType::kI64Store8:
xaddb(dst_op, value.gp());
movzxbq(value.gp(), value.gp());
break;
case StoreType::kI32Store16:
case StoreType::kI64Store16:
xaddw(dst_op, value.gp());
movzxwq(value.gp(), value.gp());
break;
case StoreType::kI32Store:
case StoreType::kI64Store32:

25
test/mjsunit/regress/wasm/regress-1045737.js Normal file
View File

@ -0,0 +1,25 @@
// Copyright 2020 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --wasm-staging --liftoff --no-wasm-tier-up
load('test/mjsunit/wasm/wasm-module-builder.js');
(function() {
const builder = new WasmModuleBuilder();
builder.addMemory(16, 32, false, true);
builder.addType(makeSig([kWasmI32, kWasmI32, kWasmI32], [kWasmI32]));
// Generate function 1 (out of 1).
builder.addFunction(undefined, 0 /* sig */).addBodyWithEnd([
// signature: i_iii
// body:
kExprI32Const, 0x00, kExprI64Const, 0xc2, 0xe6, 0x00, kAtomicPrefix,
kExprI64AtomicAdd8U, 0x00, 0xb6, 0x0e, kExprF32SConvertI64,
kExprI32SConvertF32,
kExprEnd, // @14
]);
builder.addExport('main', 0);
const instance = builder.instantiate();
assertEquals(instance.exports.main(1, 2, 3), 0);
})();