e3caf3f524
This test uses a i64x2.shr_s to shift a v128 with all bits set by 1, resulting in v128 with all bits set (no change). This value is then dropped, and param[2] (3), is returned. Without the fix, -1 is returned, since i64x2.shr_s overwrites the register for param[2] with 0xffffffff. Bug: v8:10752 Bug: chromium:1111522 Change-Id: I0310bf6039be780a6738689069cdbcfa3a24bbdb Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2335779 Commit-Queue: Zhi An Ng <zhin@chromium.org> Reviewed-by: Clemens Backes <clemensb@chromium.org> Cr-Commit-Position: refs/heads/master@{#69233}
27 lines
1.0 KiB
JavaScript
27 lines
1.0 KiB
JavaScript
// Copyright 2020 the V8 project authors. All rights reserved.
|
|
// Use of this source code is governed by a BSD-style license that can be
|
|
// found in the LICENSE file.
|
|
|
|
// Flags: --experimental-wasm-simd
|
|
|
|
load('test/mjsunit/wasm/wasm-module-builder.js');
|
|
|
|
// Regression test to exercise Liftoff's i64x2.shr_s codegen, which back up rcx
|
|
// to a scratch register, and immediately overwrote the backup, then later
|
|
// restoring the incorrect value. See https://crbug.com/v8/10752 and
|
|
// https://crbug.com/1111522 for more.
|
|
const builder = new WasmModuleBuilder();
|
|
// i64x2.shr_s shifts a v128 (with all bits set), by 1, then drops the result.
|
|
// The function returns param 2, which should be unmodified.
|
|
builder.addFunction(undefined, kSig_i_iii).addBodyWithEnd([
|
|
kSimdPrefix, kExprS128Const, ...new Array(16).fill(0xff),
|
|
kExprI32Const, 0x01,
|
|
kSimdPrefix, kExprI64x2ShrS, 0x01,
|
|
kExprDrop,
|
|
kExprLocalGet, 0x02,
|
|
kExprEnd,
|
|
]);
|
|
builder.addExport('main', 0);
|
|
const instance = builder.instantiate();
|
|
assertEquals(3, instance.exports.main(1, 2, 3));
|