v8/test/mjsunit/regress/wasm/regress-1236958.js
Manos Koukoutos 16d9a1eb38 [wasm-gc] Fix array.new_with_rtt within loop
Since array.new_with_rtt implicitly introduces a loop, we should mark
any loop including this instruction as non-innermost.

Bug: chromium:1236958
Change-Id: I2d92b5fdba748df0e4ac1d6cbc524428b1042578
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3080574
Commit-Queue: Manos Koukoutos <manoskouk@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#76178}
2021-08-09 17:22:42 +00:00

24 lines
695 B
JavaScript

// Copyright 2021 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --experimental-wasm-gc
d8.file.execute('test/mjsunit/wasm/wasm-module-builder.js');
var builder = new WasmModuleBuilder();
let array = builder.addArray(kWasmI64, true);
builder.addFunction('test', kSig_v_v)
.addBody([kExprLoop, kWasmVoid,
kExprI64Const, 15,
kExprI32Const, 12,
kGCPrefix, kExprRttCanon, array,
kGCPrefix, kExprArrayNewWithRtt, array,
kExprDrop,
kExprEnd])
.exportFunc();
builder.instantiate();