Commit 9829378
committed
deps: V8: cherry-pick f44fcbf803ac
Original commit message:
Merged: [wasm][liftoff][ia32] Fix register allocation of CompareExchange
The register that holds the {new_value} for the AtomicCompareExchange8U
has to be a byte register on ia32. There was code to guarantee that, but
after that code there was code that frees the {eax} register, and that
code moved the {new_value} to a different register again. With this CL
we first free {eax}, and then find a byte register for the {new_value}.
R=clemensb@chromium.org
NOTRY=true
NOPRESUBMIT=true
NOTREECHECKS=true
(cherry picked from commit 70a389ac8778064e470a95412d40e17f97898142)
Bug: chromium:1140549
Change-Id: I1679f3f9ab26c5416ea251c7925366ff43336d85
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2491031
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Cr-Original-Commit-Position: refs/heads/master@{#70721}
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2504512
Cr-Commit-Position: refs/branch-heads/8.6@{#38}
Cr-Branched-From: a64aed2333abf49e494d2a5ce24bbd14fff19f60-refs/heads/8.6.395@{#1}
Cr-Branched-From: a626bc036236c9bf92ac7b87dc40c9e538b087e3-refs/heads/master@{#69472}
Refs: v8/v8@f44fcbf
PR-URL: #38275
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Jiawen Geng <technicalcute@gmail.com>
Reviewed-By: Shelley Vohr <codebytere@gmail.com>1 parent fa45d6a commit 9829378
3 files changed
Lines changed: 36 additions & 8 deletions
File tree
- deps/v8
- src/wasm/baseline/ia32
- test/mjsunit/regress/wasm
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
@@ -36,7 +36,7 @@ | |||
| 36 | 36 | ||
| 37 | 37 | # Reset this number to 0 on major V8 upgrades. | |
| 38 | 38 | # Increment by one for each non-official patch applied to deps/v8. | |
| 39 | - 'v8_embedder_string': '-node.54', | ||
| 39 | + 'v8_embedder_string': '-node.55', | ||
| 40 | 40 | ||
| 41 | 41 | ##### V8 defaults for Node.js ##### | |
| 42 | 42 | ||
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
@@ -545,6 +545,16 @@ void LiftoffAssembler::AtomicCompareExchange( | |||
| 545 | 545 | Register expected_reg = is_64_bit_op ? expected.low_gp() : expected.gp(); | |
| 546 | 546 | Register result_reg = expected_reg; | |
| 547 | 547 | ||
| 548 | + // The cmpxchg instruction uses eax to store the old value of the | ||
| 549 | + // compare-exchange primitive. Therefore we have to spill the register and | ||
| 550 | + // move any use to another register. | ||
| 551 | + ClearRegister(eax, {&dst_addr, &value_reg}, | ||
| 552 | + LiftoffRegList::ForRegs(dst_addr, value_reg, expected_reg)); | ||
| 553 | + if (expected_reg != eax) { | ||
| 554 | + mov(eax, expected_reg); | ||
| 555 | + expected_reg = eax; | ||
| 556 | + } | ||
| 557 | + | ||
| 548 | 558 | bool is_byte_store = type.size() == 1; | |
| 549 | 559 | LiftoffRegList pinned = | |
| 550 | 560 | LiftoffRegList::ForRegs(dst_addr, value_reg, expected_reg); | |
@@ -558,13 +568,6 @@ void LiftoffAssembler::AtomicCompareExchange( | |||
| 558 | 568 | pinned.clear(LiftoffRegister(value_reg)); | |
| 559 | 569 | } | |
| 560 | 570 | ||
| 561 | - // The cmpxchg instruction uses eax to store the old value of the | ||
| 562 | - // compare-exchange primitive. Therefore we have to spill the register and | ||
| 563 | - // move any use to another register. | ||
| 564 | - ClearRegister(eax, {&dst_addr, &value_reg}, pinned); | ||
| 565 | - if (expected_reg != eax) { | ||
| 566 | - mov(eax, expected_reg); | ||
| 567 | - } | ||
| 568 | 571 | ||
| 569 | 572 | Operand dst_op = Operand(dst_addr, offset_imm); | |
| 570 | 573 | ||
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
@@ -0,0 +1,25 @@ | |||
| 1 | + // Copyright 2020 the V8 project authors. All rights reserved. | ||
| 2 | + // Use of this source code is governed by a BSD-style license that can be | ||
| 3 | + // found in the LICENSE file. | ||
| 4 | + | ||
| 5 | + // Flags: --wasm-staging | ||
| 6 | + | ||
| 7 | + load('test/mjsunit/wasm/wasm-module-builder.js'); | ||
| 8 | + | ||
| 9 | + const builder = new WasmModuleBuilder(); | ||
| 10 | + builder.addMemory(16, 32, false, true); | ||
| 11 | + builder.addType(makeSig([], [])); | ||
| 12 | + builder.addFunction(undefined, 0 /* sig */) | ||
| 13 | + .addBodyWithEnd([ | ||
| 14 | + // signature: v_v | ||
| 15 | + // body: | ||
| 16 | + kExprI32Const, 0x00, | ||
| 17 | + kExprI32Const, 0x00, | ||
| 18 | + kExprI32Const, 0x00, | ||
| 19 | + kAtomicPrefix, kExprI32AtomicCompareExchange8U, 0x00, 0xc3, 0x01, | ||
| 20 | + kExprDrop, | ||
| 21 | + kExprEnd, // end @193 | ||
| 22 | + ]); | ||
| 23 | + builder.addExport('main', 0); | ||
| 24 | + const instance = builder.instantiate(); | ||
| 25 | + print(instance.exports.main(1, 2, 3)); | ||
0 commit comments