v8/test/mjsunit/regress/wasm/regress-1255354.js
Manos Koukoutos efd42d689f [turbofan] Do not optimize Trap with siblings inside If
Trying to optimize in such case breaks down the optimization, as we
end up with potentially non-eliminatable nodes that depend on the dead
IfTrue/IfFalse node.
Drive-by: Clean up dead nodes with {Kill()}.

Bug: v8:11510, chromium:1255354

Change-Id: Ia89fe6c243974c3c2abac6ad80bd4677a935f637
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3200073
Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
Commit-Queue: Manos Koukoutos <manoskouk@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77211}
2021-10-04 09:31:32 +00:00

27 lines
706 B
JavaScript

// Copyright 2021 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
//
// Flags: --no-liftoff
load("test/mjsunit/wasm/wasm-module-builder.js");
var builder = new WasmModuleBuilder();
builder.addMemory(1, 1, /* exported = */ false);
builder.addFunction("main", kSig_i_i).addBody([
kExprLocalGet, 0,
kExprIf, kWasmI32,
kExprLocalGet, 0,
kExprElse,
kExprI32Const, 42, // value
kExprI32Const, 0, // index
kExprI32StoreMem, 0, 0,
kExprI32Const, 11,
kExprLocalGet, 0,
kExprI32DivS,
kExprEnd
]).exportFunc();
var instance = builder.instantiate({});