AuroraMiddleware/v8
1
0
Fork 0
Code Issues 2 Pull Requests Releases Wiki Activity

[wasm] Do the default int64-lowering for all non-i64 stores.

Browse Source 
First issue I found with my local fuzzing.

R=titzer@chromium.org
BUG=v8:5884

Review-Url: https://codereview.chromium.org/2656563003
Cr-Commit-Position: refs/heads/master@{#42683}
This commit is contained in:
ahaas 2017-01-26 01:38:13 -08:00 committed by Commit bot
parent b98dd0af92
commit a5e7382d84
2 changed files with 21 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
src/compiler/int64-lowering.cc
View File

@ -237,9 +237,7 @@ void Int64Lowering::LowerNode(Node* node) {
NodeProperties::ChangeOp(node, store_op);
ReplaceNode(node, node, high_node);
} else {
if (HasReplacementLow(node->InputAt(2))) {
node->ReplaceInput(2, GetReplacementLow(node->InputAt(2)));
}
DefaultLowering(node);
}
break;
}

20
test/mjsunit/regress/wasm/regression-5884.js Normal file
View File

@ -0,0 +1,20 @@
// Copyright 2017 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
load('test/mjsunit/wasm/wasm-constants.js');
load('test/mjsunit/wasm/wasm-module-builder.js');
(function() {
var builder = new WasmModuleBuilder();
builder.addMemory(31, 31, false);
builder.addFunction('test', kSig_i_iii)
.addBodyWithEnd([
// body:
kExprI64Const, 0x41, kExprI64Const, 0x41, kExprI64LtS, kExprI32Const,
0x01, kExprI32StoreMem, 0x00, 0x41, kExprUnreachable,
kExprEnd, // @60
])
.exportFunc();
var module = builder.instantiate();
})();