v8/test/mjsunit/regress/wasm/regress-1084151.js
Thibaud Michaud 9d06369496 [liftoff][mv] Fix merge issue in multi-value loops
Registers cannot be used as a merge destination if they have more than
one use, otherwise the merge will unexpectedly affect other uses of that
register.

R=ahaas@chromium.org,clemensb@chromium.org

Bug: chromium:1084151
Change-Id: I0d6ad97c585920357a37d95361e0320d32c71f4b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2208851
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Thibaud Michaud <thibaudm@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67904}
2020-05-19 15:43:50 +00:00

32 lines
793 B
JavaScript

// Copyright 2020 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --experimental-wasm-mv
load("test/mjsunit/wasm/wasm-module-builder.js");
let builder = new WasmModuleBuilder();
let sig_i_iii = builder.addType(kSig_i_iii);
builder.addFunction("main", sig_i_iii)
.addBody([
kExprLocalGet, 1,
kExprLocalGet, 1,
kExprI32Const, 5,
kExprLoop, sig_i_iii,
kExprLocalGet, 1,
kExprBlock, sig_i_iii,
kExprLocalGet, 1,
kExprLocalGet, 2,
kExprBrIf, 1,
kExprDrop,
kExprDrop,
kExprDrop,
kExprEnd,
kExprDrop,
kExprEnd])
.exportAs("main");
let module = new WebAssembly.Module(builder.toBuffer());