v8/test/mjsunit/regress/wasm/regress-7035.js
Clemens Hammacher c7ad5652d3 [Liftoff] Fix register reuse in merge init
When initializing the cache state for a merge, we should never use
registers multiple times. Other code paths leading to the same merge
point might provide different values for the different slots there.

R=ahaas@chromium.org

Bug: v8:7035, v8:6600
Change-Id: I8e409b494af0fdc1a5045ec04571611b97fcaf86
Reviewed-on: https://chromium-review.googlesource.com/754816
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49150}
2017-11-06 17:35:07 +00:00

32 lines
1.1 KiB
JavaScript

// Copyright 2017 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
load('test/mjsunit/wasm/wasm-constants.js');
load('test/mjsunit/wasm/wasm-module-builder.js');
var builder = new WasmModuleBuilder();
builder.addFunction('test', kSig_i_iii)
.addBodyWithEnd([
kExprI32Const, 0x00, // i32.const 0
kExprI32Const, 0x00, // i32.const 0
kExprI32Add, // i32.add -> 0
kExprI32Const, 0x00, // i32.const 0
kExprI32Const, 0x00, // i32.const 0
kExprI32Add, // i32.add -> 0
kExprI32Add, // i32.add -> 0
kExprI32Const, 0x01, // i32.const 1
kExprI32Const, 0x00, // i32.const 0
kExprI32Add, // i32.add -> 1
kExprBlock, 0x7f, // @39 i32
kExprI32Const, 0x00, // i32.const 0
kExprBr, 0x00, // depth=0
kExprEnd, // @90
kExprI32Add, // i32.add -> 1
kExprI32Add, // i32.add -> 1
kExprEnd
])
.exportFunc();
var module = builder.instantiate();
assertEquals(1, module.exports.test());