v8/test/mjsunit/regress/wasm/regress-10702.js
Clemens Backes 42b4f15a1e [liftoff] Fix missing stack move
The {operator==} on {VarState} did not check the spill offset, so when
merging stack states, we forgot to move stack values if both source and
destination were stack slots, but at different offsets.
This CL fixes this by removing the {operator==}, because the semantics
(and use) are not clear, and it's only used in one place anyway.
The equality check was mostly redundant, so inlining it also makes the
code smaller and faster.

R=ahaas@chromium.org

Bug: v8:10702
Change-Id: I6c8b2cfd1002274175c9a17d305692e4631fd7dc
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2304574
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68916}
2020-07-17 13:52:28 +00:00

41 lines
1.5 KiB
JavaScript

// Copyright 2020 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
load('test/mjsunit/wasm/wasm-module-builder.js');
const builder = new WasmModuleBuilder();
builder.addGlobal(kWasmI32, 1).init = 35;
builder.addType(makeSig([], [kWasmI32]));
builder.addType(makeSig([kWasmI32, kWasmI32], [kWasmI32]));
// Generate function 1 (out of 3).
builder.addFunction(undefined, 0 /* sig */).addBody([
// signature: i_v
// body:
kExprI32Const, 1, // i32.const
]);
// Generate function 2 (out of 3).
builder.addFunction(undefined, 0 /* sig */).addBody([
// signature: i_v
// body:
kExprI32Const, 0, // i32.const
]);
// Generate function 3 (out of 3).
builder.addFunction(undefined, 1 /* sig */).addBody([
// signature: i_ii
// body:
kExprBlock, kWasmI32, // block @1 i32
kExprF64Const, 0, 0, 0, 0, 0, 0, 0, 0, // f64.const
kExprI32SConvertF64, // i32.trunc_f64_s
kExprCallFunction, 1, // call function #1: i_v
kExprBrIf, 0, // br_if depth=0
kExprGlobalGet, 0, // global.get
kExprCallFunction, 0, // call function #0: i_v
kExprBrIf, 0, // br_if depth=0
kExprI32ShrS, // i32.shr_s
kExprEnd, // end @24
]);
builder.addExport('f', 2);
const instance = builder.instantiate();
assertEquals(35, instance.exports.f(0, 0));