diff --git a/src/wasm/baseline/x64/liftoff-assembler-x64.h b/src/wasm/baseline/x64/liftoff-assembler-x64.h index 832a88de9a..7130c0328e 100644 --- a/src/wasm/baseline/x64/liftoff-assembler-x64.h +++ b/src/wasm/baseline/x64/liftoff-assembler-x64.h @@ -393,10 +393,12 @@ void LiftoffAssembler::AtomicAdd(Register dst_addr, Register offset_reg, case StoreType::kI32Store8: case StoreType::kI64Store8: xaddb(dst_op, value.gp()); + movzxbq(value.gp(), value.gp()); break; case StoreType::kI32Store16: case StoreType::kI64Store16: xaddw(dst_op, value.gp()); + movzxwq(value.gp(), value.gp()); break; case StoreType::kI32Store: case StoreType::kI64Store32: diff --git a/test/mjsunit/regress/wasm/regress-1045737.js b/test/mjsunit/regress/wasm/regress-1045737.js new file mode 100644 index 0000000000..621fa75ab8 --- /dev/null +++ b/test/mjsunit/regress/wasm/regress-1045737.js @@ -0,0 +1,25 @@ +// Copyright 2020 the V8 project authors. All rights reserved. +// Use of this source code is governed by a BSD-style license that can be +// found in the LICENSE file. + +// Flags: --wasm-staging --liftoff --no-wasm-tier-up + +load('test/mjsunit/wasm/wasm-module-builder.js'); + +(function() { +const builder = new WasmModuleBuilder(); +builder.addMemory(16, 32, false, true); +builder.addType(makeSig([kWasmI32, kWasmI32, kWasmI32], [kWasmI32])); +// Generate function 1 (out of 1). +builder.addFunction(undefined, 0 /* sig */).addBodyWithEnd([ + // signature: i_iii + // body: + kExprI32Const, 0x00, kExprI64Const, 0xc2, 0xe6, 0x00, kAtomicPrefix, + kExprI64AtomicAdd8U, 0x00, 0xb6, 0x0e, kExprF32SConvertI64, + kExprI32SConvertF32, + kExprEnd, // @14 +]); +builder.addExport('main', 0); +const instance = builder.instantiate(); +assertEquals(instance.exports.main(1, 2, 3), 0); +})();