GeezerVison is showing github.com — deps: V8: cherry-pick 482e5c7750b3 · nodejs/node@aff53dd
File treeExpand file treeCollapse file tree Open diff view settings test/mjsunit/regress/wasm
Expand file treeCollapse file tree Open diff view settings Collapse file Copy file name to clipboardExpand all lines: common.gypi +1-1Lines changed: 1 addition & 1 deletion | Original file line number | Diff line number | Diff line change |
|---|
| 36 | 36 |
| 37 | 37 | # Reset this number to 0 on major V8 upgrades. | 38 | 38 | # Increment by one for each non-official patch applied to deps/v8. | 39 | | - 'v8_embedder_string': '-node.40', | | 39 | + 'v8_embedder_string': '-node.41', | 40 | 40 |
| 41 | 41 | ##### V8 defaults for Node.js ##### | 42 | 42 |
| |
Collapse file Copy file name to clipboardExpand all lines: deps/v8/src/wasm/baseline/liftoff-assembler.cc +11-4Lines changed: 11 additions & 4 deletions | Original file line number | Diff line number | Diff line change |
|---|
@@ -37,6 +37,7 @@ class StackTransferRecipe { | 37 | 37 |
| 38 | 38 | struct RegisterLoad { | 39 | 39 | enum LoadKind : uint8_t { | | 40 | + kNop, // no-op, used for high fp of a fp pair. | 40 | 41 | kConstant, // load a constant value into a register. | 41 | 42 | kStack, // fill a register from a stack slot. | 42 | 43 | kLowHalfStack, // fill a register from the low half of a stack slot. | @@ -63,6 +64,10 @@ class StackTransferRecipe { | 63 | 64 | return {half == kLowWord ? kLowHalfStack : kHighHalfStack, kWasmI32, | 64 | 65 | offset}; | 65 | 66 | } | | 67 | + static RegisterLoad Nop() { | | 68 | + // ValueType does not matter. | | 69 | + return {kNop, kWasmI32, 0}; | | 70 | + } | 66 | 71 |
| 67 | 72 | private: | 68 | 73 | RegisterLoad(LoadKind kind, ValueType type, int32_t value) | @@ -217,11 +222,11 @@ class StackTransferRecipe { | 217 | 222 | RegisterLoad::HalfStack(stack_offset, kHighWord); | 218 | 223 | } else if (dst.is_fp_pair()) { | 219 | 224 | DCHECK_EQ(kWasmS128, type); | 220 | | - // load_dst_regs_.set above will set both low and high fp regs. | 221 | | - // But unlike gp_pair, we load a kWasm128 in one go in ExecuteLoads. | 222 | | - // So unset the top fp register to skip loading it. | 223 | | - load_dst_regs_.clear(dst.high()); | | 225 | + // Only need register_load for low_gp since we load 128 bits at one go. | | 226 | + // Both low and high need to be set in load_dst_regs_ but when iterating | | 227 | + // over it, both low and high will be cleared, so we won't load twice. | 224 | 228 | *register_load(dst.low()) = RegisterLoad::Stack(stack_offset, type); | | 229 | + *register_load(dst.high()) = RegisterLoad::Nop(); | 225 | 230 | } else { | 226 | 231 | *register_load(dst) = RegisterLoad::Stack(stack_offset, type); | 227 | 232 | } | @@ -318,6 +323,8 @@ class StackTransferRecipe { | 318 | 323 | for (LiftoffRegister dst : load_dst_regs_) { | 319 | 324 | RegisterLoad* load = register_load(dst); | 320 | 325 | switch (load->kind) { | | 326 | + case RegisterLoad::kNop: | | 327 | + break; | 321 | 328 | case RegisterLoad::kConstant: | 322 | 329 | asm_->LoadConstant(dst, load->type == kWasmI64 | 323 | 330 | ? WasmValue(int64_t{load->value}) | |
Collapse file Copy file name to clipboard +56Lines changed: 56 additions & 0 deletions | Original file line number | Diff line number | Diff line change |
|---|
| | 1 | +// Copyright 2021 the V8 project authors. All rights reserved. | | 2 | +// Use of this source code is governed by a BSD-style license that can be | | 3 | +// found in the LICENSE file. | | 4 | + | | 5 | +// Flags: --wasm-staging | | 6 | + | | 7 | +// This is a fuzzer-generated test case that exposed a bug in Liftoff that only | | 8 | +// affects ARM, where the fp register aliasing is different from other archs. | | 9 | +// We were inncorrectly clearing the the high fp register in a LiftoffRegList | | 10 | +// indicating registers to load, hitting a DCHECK. | | 11 | +load('test/mjsunit/wasm/wasm-module-builder.js'); | | 12 | + | | 13 | +const builder = new WasmModuleBuilder(); | | 14 | +builder.addMemory(19, 32, false); | | 15 | +builder.addGlobal(kWasmI32, 0); | | 16 | +builder.addType(makeSig([], [])); | | 17 | +builder.addType(makeSig([kWasmI64, kWasmS128, kWasmF32], [kWasmI32])); | | 18 | +// Generate function 1 (out of 5). | | 19 | +builder.addFunction(undefined, 0 /* sig */) | | 20 | + .addBodyWithEnd([ | | 21 | +// signature: v_v | | 22 | +// body: | | 23 | +kExprI32Const, 0x05, // i32.const | | 24 | +kExprReturn, // return | | 25 | +kExprUnreachable, // unreachable | | 26 | +kExprEnd, // end @5 | | 27 | +]); | | 28 | +// Generate function 4 (out of 5). | | 29 | +builder.addFunction(undefined, 1 /* sig */) | | 30 | + .addBodyWithEnd([ | | 31 | +// signature: i_lsf | | 32 | +// body: | | 33 | +kExprLocalGet, 0x01, // local.get | | 34 | +kExprLocalGet, 0x01, // local.get | | 35 | +kExprGlobalGet, 0x00, // global.get | | 36 | +kExprDrop, // drop | | 37 | +kExprLoop, kWasmStmt, // loop @8 | | 38 | + kExprLoop, 0x00, // loop @10 | | 39 | + kExprI32Const, 0x01, // i32.const | | 40 | + kExprMemoryGrow, 0x00, // memory.grow | | 41 | + kExprI64LoadMem8U, 0x00, 0x70, // i64.load8_u | | 42 | + kExprLoop, 0x00, // loop @19 | | 43 | + kExprCallFunction, 0x00, // call function #0: v_v | | 44 | + kExprEnd, // end @23 | | 45 | + kExprI64Const, 0xf1, 0x24, // i64.const | | 46 | + kExprGlobalGet, 0x00, // global.get | | 47 | + kExprDrop, // drop | | 48 | + kExprBr, 0x00, // br depth=0 | | 49 | + kExprEnd, // end @32 | | 50 | + kExprEnd, // end @33 | | 51 | +kExprI32Const, 0x5b, // i32.const | | 52 | +kExprReturn, // return | | 53 | +kExprEnd, // end @37 | | 54 | +]); | | 55 | +// Instantiation is enough to cause a crash. | | 56 | +const instance = builder.instantiate(); |
|