407cfc02eb
If the destination register of a binop is the same register as the right hand side, we would first move the left hand side into that register (overwriting the value of the rhs), and then use the rhs. This CL fixes this issue and adds a regression test. R=ahaas@chromium.org Bug: v8:6600, v8:7033 Change-Id: Ief90b5bcffc65823037bc57fb00741b2448e6375 Reviewed-on: https://chromium-review.googlesource.com/753462 Commit-Queue: Clemens Hammacher <clemensh@chromium.org> Reviewed-by: Andreas Haas <ahaas@chromium.org> Cr-Commit-Position: refs/heads/master@{#49137}
21 lines
707 B
JavaScript
21 lines
707 B
JavaScript
// Copyright 2017 the V8 project authors. All rights reserved.
|
|
// Use of this source code is governed by a BSD-style license that can be
|
|
// found in the LICENSE file.
|
|
|
|
load('test/mjsunit/wasm/wasm-constants.js');
|
|
load('test/mjsunit/wasm/wasm-module-builder.js');
|
|
|
|
var builder = new WasmModuleBuilder();
|
|
builder.addFunction('test', kSig_i_iii)
|
|
.addBodyWithEnd([
|
|
kExprI32Const, 0x07, // i32.const 7
|
|
kExprI32Const, 0x00, // i32.const 0
|
|
kExprI32Const, 0x00, // i32.const 0
|
|
kExprI32And, // i32.and
|
|
kExprI32And, // i32.and
|
|
kExprEnd, // -
|
|
])
|
|
.exportFunc();
|
|
var module = builder.instantiate();
|
|
assertEquals(0, module.exports.test());
|