v8/test/mjsunit/regress/wasm/regress-919308.js
Clemens Hammacher 8518d12200 [Liftoff] Fix sub of the same register
In the degenerate case where we wanted to emit {x = x - x} (where {x}
is any register), ia32 and x64 generated wrong code (producing {-x + -x}
instead). Fix this by special casing this case.

R=ahaas@chromium.org

Bug: chromium:919308
Change-Id: I9cd9818d2a678450ac6530107e7a5cbb625ddb8d
Reviewed-on: https://chromium-review.googlesource.com/c/1405029
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#58731}
2019-01-11 10:57:09 +00:00

38 lines
1.0 KiB
JavaScript

// Copyright 2019 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
load('test/mjsunit/wasm/wasm-constants.js');
load('test/mjsunit/wasm/wasm-module-builder.js');
const builder = new WasmModuleBuilder();
builder.addFunction(undefined, kSig_i_i)
.addLocals({i32_count: 5})
.addBody([
kExprGetLocal, 0, // --> 1
kExprIf, kWasmI32,
kExprGetLocal, 0, // --> 1
kExprElse,
kExprUnreachable,
kExprEnd,
kExprIf, kWasmI32,
kExprGetLocal, 0, // --> 1
kExprElse,
kExprUnreachable,
kExprEnd,
kExprIf, kWasmI32,
kExprI32Const, 0,
kExprGetLocal, 0,
kExprI32Sub, // --> -1
kExprGetLocal, 0,
kExprGetLocal, 0,
kExprI32Sub, // --> 0
kExprI32Sub, // --> -1
kExprElse,
kExprUnreachable,
kExprEnd
]);
builder.addExport('main', 0);
const instance = builder.instantiate();
assertEquals(-1, instance.exports.main(1));