v8/test/mjsunit/regress/wasm/regress-7582.js
Clemens Hammacher 2589ea08e3 [Liftoff] Fix conditional spilling
On float comparisons, we need a scratch byte register for the setcc
instruction, and if none is available, we spill. But this spilling code
is skipped if one of the operands is NaN. The cache state is updated
however, so following code assumes that the spill happened.
This CL fixes this by spilling before checking for NaN, such that the
spilling code is always executed.

R=titzer@chromium.org

Bug: v8:7582, v8:6600
Change-Id: I768d8de14e494d3ebea181c1f9f3129a4b005396
Reviewed-on: https://chromium-review.googlesource.com/973961
Reviewed-by: Ben Titzer <titzer@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52162}
2018-03-22 18:45:17 +00:00

49 lines
1.6 KiB
JavaScript

// Copyright 2018 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
load('test/mjsunit/wasm/wasm-constants.js');
load('test/mjsunit/wasm/wasm-module-builder.js');
const builder = new WasmModuleBuilder();
builder.addGlobal(kWasmI32, 1);
sig0 = makeSig([kWasmI32, kWasmI32, kWasmI32], [kWasmI32]);
builder.addFunction(undefined, sig0)
.addBody([
kExprF32Const, 0x01, 0x00, 0x00, 0x00,
kExprF32Const, 0x00, 0x00, 0x00, 0x00,
kExprF32Eq, // --> i32:0
kExprF32Const, 0xc9, 0xc9, 0x69, 0xc9,
kExprF32Const, 0xc9, 0xc9, 0xc9, 0x00,
kExprF32Eq, // --> i32:0 i32:0
kExprIf, kWasmF32,
kExprF32Const, 0x00, 0x00, 0x00, 0x00,
kExprElse, // @32
kExprF32Const, 0x00, 0x00, 0x00, 0x00,
kExprEnd, // --> i32:0 f32:0
kExprF32Const, 0xc9, 0x00, 0x00, 0x00,
kExprF32Const, 0xc9, 0xc9, 0xc9, 0x00,
kExprF32Const, 0xc9, 0xc9, 0xa0, 0x00, // --> i32:0 f32:0 f32 f32 f32
kExprF32Eq, // --> i32:0 f32:0 f32 i32:0
kExprIf, kWasmF32,
kExprF32Const, 0x00, 0x00, 0x00, 0x00,
kExprElse,
kExprF32Const, 0x00, 0x00, 0x00, 0x00,
kExprEnd, // --> i32:0 f32:0 f32 f32:0
kExprF32Eq, // --> i32:0 f32:0 i32:0
kExprIf, kWasmF32,
kExprF32Const, 0x00, 0x00, 0x00, 0x00,
kExprElse,
kExprF32Const, 0x00, 0x00, 0x00, 0x00,
kExprEnd, // --> i32:0 f32:0 f32:0
kExprF32Const, 0xc9, 0xc9, 0xff, 0xff, // --> i32:0 f32:0 f32:0 f32
kExprF32Eq, // --> i32:0 f32:0 i32:0
kExprDrop,
kExprDrop, // --> i32:0
kExprI32Const, 1, // --> i32:0 i32:1
kExprI32GeU, // --> i32:0
]);
builder.addExport('main', 0);
const instance = builder.instantiate();
assertEquals(0, instance.exports.main(1, 2, 3));