48ead1a858
This CL fixes a bug in the code generation for I32AtomicCompareExchange in Liftoff on ia32. The problem is the inconsistency that LiftoffAssembler::PeekToRegister(...) introduces to the cache state. PeekToRegister loads the value from the value stack into a register, but does not pop the value off the stack. When the value was already stored in a register, the use counter of that register gets decreased, even though the value is still on the stack. The problem arises when this register later gets reused, which is necessary unfortunately on ia32. When SpillRegister is called for this register, all stack values that are stored in this register get written to memory. SpillRegister uses the use counter of the register to detect when the register was spilled to all stack slots that were cached by this register. However, as described above, the value stack and the use counter are inconsistent at that moment, so SpillRegister finishes early and does not spill the register to all stack values, and this causes the bug later. With this CL the decrement of the use counter gets delayed until when the value actually gets popped off the stack. R=clemensb@chromium.org Bug: chromium:1145135 Change-Id: I07cb256a7e5135dbce41b246c120650635ad2758 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2602464 Reviewed-by: Clemens Backes <clemensb@chromium.org> Commit-Queue: Andreas Haas <ahaas@chromium.org> Cr-Commit-Position: refs/heads/master@{#72018}
40 lines
1.3 KiB
JavaScript
40 lines
1.3 KiB
JavaScript
// Copyright 2021 the V8 project authors. All rights reserved.
|
|
// Use of this source code is governed by a BSD-style license that can be
|
|
// found in the LICENSE file.
|
|
|
|
// Flags: --wasm-staging
|
|
|
|
load('test/mjsunit/wasm/wasm-module-builder.js');
|
|
|
|
const builder = new WasmModuleBuilder();
|
|
builder.addMemory(1, 1, false, true);
|
|
builder.addGlobal(kWasmI32, 1);
|
|
builder.addFunction(undefined, kSig_v_i)
|
|
.addLocals(kWasmI32, 5)
|
|
.addBody([
|
|
// signature: v_i
|
|
// body:
|
|
kExprGlobalGet, 0x00, // global.get
|
|
kExprI32Const, 0x10, // i32.const
|
|
kExprI32Sub, // i32.sub
|
|
kExprLocalTee, 0x02, // local.tee
|
|
kExprGlobalSet, 0x00, // global.set
|
|
kExprBlock, kWasmStmt, // block @12
|
|
kExprLocalGet, 0x00, // local.get
|
|
kExprI32LoadMem, 0x02, 0x00, // i32.load
|
|
kExprI32Eqz, // i32.eqz
|
|
kExprIf, kWasmStmt, // if @20
|
|
kExprLocalGet, 0x02, // local.get
|
|
kExprI32Const, 0x00, // i32.const
|
|
kExprI32StoreMem, 0x02, 0x0c, // i32.store
|
|
kExprLocalGet, 0x00, // local.get
|
|
kExprI32Const, 0x20, // i32.const
|
|
kExprI32Add, // i32.add
|
|
kExprLocalSet, 0x05, // local.set
|
|
kExprLocalGet, 0x00, // local.get
|
|
kExprI32Const, 0x00, // i32.const
|
|
kExprI32Const, 0x01, // i32.const
|
|
kAtomicPrefix, kExprI32AtomicCompareExchange, 0x02, 0x20, // i32.atomic.cmpxchng32
|
|
]);
|
|
assertThrows(() => builder.toModule(), WebAssembly.CompileError);
|