v8/test/mjsunit/regress/wasm/regress-917412.js
Clemens Hammacher 20b6330037 [Liftoff] Keep consistent register mapping in non-merged regions
We currently de-duplicate used registers also in regions which do not
need merging. In those regions though it can never happen that we need
to pass different values from any merge input. Apart from introducing
unnecessary register moves, this also causes a DCHECK to fail, because
we might later want to merge back different registers into one.

Assume this initial stack state (where each letter is a register):
[A B B C]
If in any child block the two Bs get de-duplicated so something like
[A B D C]
then we run into trouble when merging back this state into the parent
state, because both B and D would need to be put into B.
In this case we can statically infer that B and D must hold the same
value anyway, but having this situation does not make much sense in the
first place, so the DCHECK fires correctly.

R=titzer@chromium.org

Bug: v8:8423, chromium:917412
Change-Id: I24c36b062e04a134cf7051725afab98126753f31
Reviewed-on: https://chromium-review.googlesource.com/c/1392190
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#58522}
2019-01-03 14:37:48 +00:00

35 lines
857 B
JavaScript

// Copyright 2018 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
load('test/mjsunit/wasm/wasm-constants.js');
load('test/mjsunit/wasm/wasm-module-builder.js');
const builder = new WasmModuleBuilder();
const sig = builder.addType(makeSig([kWasmI32, kWasmI64], []));
builder.addFunction(undefined, sig)
.addBody([
kExprI32Const, 0,
kExprIf, kWasmI32,
kExprI32Const, 0,
kExprElse,
kExprI32Const, 1,
kExprEnd,
kExprTeeLocal, 0,
kExprGetLocal, 0,
kExprLoop, kWasmStmt,
kExprI64Const, 0x80, 0x80, 0x80, 0x70,
kExprSetLocal, 0x01,
kExprI32Const, 0x00,
kExprIf, kWasmI32,
kExprI32Const, 0x00,
kExprElse,
kExprI32Const, 0x00,
kExprEnd,
kExprBrIf, 0x00,
kExprUnreachable,
kExprEnd,
kExprUnreachable,
]);
builder.instantiate();