diff --git a/common.gypi b/common.gypi index 5a39e342145ab1..4ca813b9fc8370 100644 --- a/common.gypi +++ b/common.gypi @@ -36,7 +36,7 @@ # Reset this number to 0 on major V8 upgrades. # Increment by one for each non-official patch applied to deps/v8. - 'v8_embedder_string': '-node.37', + 'v8_embedder_string': '-node.38', ##### V8 defaults for Node.js ##### diff --git a/deps/v8/src/compiler/backend/code-generator.cc b/deps/v8/src/compiler/backend/code-generator.cc index 72c5750035a19c..67e2ad74702e53 100644 --- a/deps/v8/src/compiler/backend/code-generator.cc +++ b/deps/v8/src/compiler/backend/code-generator.cc @@ -607,8 +607,8 @@ void CodeGenerator::GetPushCompatibleMoves(Instruction* instr, // then the full gap resolver must be used since optimization with // pushes don't participate in the parallel move and might clobber // values needed for the gap resolve. - if (source.IsStackSlot() && LocationOperand::cast(source).index() >= - first_push_compatible_index) { + if (source.IsAnyStackSlot() && LocationOperand::cast(source).index() >= + first_push_compatible_index) { pushes->clear(); return; } diff --git a/deps/v8/test/mjsunit/regress/wasm/regress-1137608.js b/deps/v8/test/mjsunit/regress/wasm/regress-1137608.js new file mode 100644 index 00000000000000..5011dced2f70ff --- /dev/null +++ b/deps/v8/test/mjsunit/regress/wasm/regress-1137608.js @@ -0,0 +1,46 @@ +// Copyright 2020 the V8 project authors. All rights reserved. +// Use of this source code is governed by a BSD-style license that can be +// found in the LICENSE file. +// +// Flags: --no-liftoff --experimental-wasm-return-call --experimental-wasm-threads + +load("test/mjsunit/wasm/wasm-module-builder.js"); + +(function Regress1137608() { + print(arguments.callee.name); + let builder = new WasmModuleBuilder(); + let sig0 = builder.addType(kSig_i_iii); + let sig1 = builder.addType(makeSig([kWasmF64, kWasmF64, kWasmI32, + kWasmI32, kWasmI32, kWasmF32, kWasmI32, kWasmF64, kWasmI32, kWasmF32, + kWasmI32, kWasmF32, kWasmI32, kWasmF64, kWasmI32], [kWasmI32])); + let main = builder.addFunction("main", sig0) + .addBody([ + kExprI64Const, 0, + kExprF64UConvertI64, + kExprF64Const, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x00, 0x00, + kExprF64Const, 0x30, 0x30, 0x30, 0x00, 0x00, 0x00, 0x00, 0x00, + kExprF64Mul, + kExprI32Const, 0, + kExprF64Const, 0x30, 0x30, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + kExprF64StoreMem, 0x00, 0xb0, 0xe0, 0xc0, 0x81, 0x03, + kExprI32Const, 0, + kExprI32Const, 0, + kExprI32Const, 0, + kExprF32Const, 0x00, 0x00, 0x00, 0x00, + kExprI32Const, 0, + kExprF64Const, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + kExprI32Const, 0, + kExprF32Const, 0x00, 0x00, 0x00, 0x00, + kExprI32Const, 0, + kExprF32Const, 0x00, 0x00, 0x00, 0x00, + kExprI32Const, 0, + kExprF64Const, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + kExprI32Const, 0, + kExprI32Const, 2, + kExprReturnCallIndirect, sig1, kTableZero]).exportFunc(); + builder.addFunction("f", sig1).addBody([kExprI32Const, 0]); + builder.addTable(kWasmAnyFunc, 4, 4); + builder.addMemory(16, 32, false, true); + let module = new WebAssembly.Module(builder.toBuffer()); + let instance = new WebAssembly.Instance(module); +})();