8a3c4d9eec
This fixes a corner case with the matching for a {UBFX} instruction.
According to the ISA reference "UBFX Rd, Rn, #lsb, #width" is only valid
for "#width" in the [1;32-#lsb] range. Specifically a "#width" of 0 is
invalid but was not checked against by the instruction selector.
R=ahaas@chromium.org
TEST=mjsunit/regress/wasm/regress-924905
BUG=chromium:924905
Change-Id: I470671282b215be62dfd147a619a0d317f7cc746
Reviewed-on: https://chromium-review.googlesource.com/c/1435939
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#59096}
19 lines
572 B
JavaScript
19 lines
572 B
JavaScript
// Copyright 2019 the V8 project authors. All rights reserved.
|
|
// Use of this source code is governed by a BSD-style license that can be
|
|
// found in the LICENSE file.
|
|
|
|
load('test/mjsunit/wasm/wasm-constants.js');
|
|
load('test/mjsunit/wasm/wasm-module-builder.js');
|
|
|
|
let builder = new WasmModuleBuilder();
|
|
builder.addFunction("kaboom", kSig_i_v)
|
|
.addBody([
|
|
kExprI32Const, 0,
|
|
kExprI32Const, 0,
|
|
kExprI32And,
|
|
kExprI32Const, 0,
|
|
kExprI32ShrU,
|
|
]).exportFunc();
|
|
let instance = builder.instantiate();
|
|
assertEquals(0, instance.exports.kaboom());
|