v8/test/mjsunit/compiler/regress-5158.js
bmeurer 29da5460fc [arm64] We must not overwrite registers for binop results that are used in frame states.
The ARM64 instruction selector can generate code like this

  negs w0, w1
  b.vs deopt

but then reference the old value of w0 in the frame state, which will
obviously lead to wrong results.

R=jarin@chromium.org
BUG=v8:5158

Review-Url: https://codereview.chromium.org/2103793002
Cr-Commit-Position: refs/heads/master@{#37322}
2016-06-28 10:11:13 +00:00

17 lines
366 B
JavaScript

// Copyright 2016 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --allow-natives-syntax
function foo(x) {
x = +x;
return (x > 0) ? x : 0 - x;
}
foo(1);
foo(-1);
foo(0);
%OptimizeFunctionOnNextCall(foo);
assertEquals(2147483648, foo(-2147483648));