diff options
Diffstat (limited to 'js/src/jit-test/tests/wasm/regress')
19 files changed, 662 insertions, 0 deletions
diff --git a/js/src/jit-test/tests/wasm/regress/baseline-pop-along-edge.js b/js/src/jit-test/tests/wasm/regress/baseline-pop-along-edge.js new file mode 100644 index 000000000..75768f0d7 --- /dev/null +++ b/js/src/jit-test/tests/wasm/regress/baseline-pop-along-edge.js @@ -0,0 +1,68 @@ +// Bug 1316181 + +load(libdir + "wasm.js"); + +// There are locals with different values here to ensure that the +// get_local at the end picks up the right one even if the stack might +// have become unbalanced by a failure to adjust SP along the branch +// edge. The logic is that we use SP-relative addressing, and if the +// actual SP is not what the compiler thinks it is we will read +// something other than the expected value. + +var o = wasmEvalText( + `(module + (func (result i32) + (local $v0 i32) + (local $v1 i32) + (local $v2 i32) + (local $v3 i32) + (local $v4 i32) + (local $v5 i32) + (local $v6 i32) + (local $v7 i32) + (local $res i32) + (set_local $v0 (i32.const 0xDEADBEEF)) + (set_local $v1 (i32.const 0xFDEADBEE)) + (set_local $v2 (i32.const 0xEFDEADBE)) + (set_local $v3 (i32.const 0xEEFDEADB)) + (set_local $v4 (i32.const 0xBEEFDEAD)) + (set_local $v5 (i32.const 0xDBEEFDEA)) + (set_local $v6 (i32.const 0xADBEEFDE)) + (set_local $v7 (i32.const 0xEADBEEFD)) + (block $b + (set_local $res + (i32.add + (i32.add (i32.const 1) (i32.const 2)) + (i32.add + (i32.add (i32.const 3) (i32.const 4)) + (i32.add + (i32.add (i32.const 5) (i32.const 6)) + (i32.add + (i32.add (i32.const 7) (i32.const 8)) + (i32.add + (i32.add (i32.const 9) (i32.const 10)) + (i32.add + (i32.add (i32.const 11) (i32.const 12)) + (i32.add + (i32.add (i32.const 13) (i32.const 14)) + (i32.add + (i32.add (i32.const 15) (i32.const 16)) + (i32.add + (i32.add (i32.const 17) (i32.const 18)) + (i32.add + (i32.add (i32.const 19) (i32.const 20)) + (i32.add + (i32.add (i32.const 21) (i32.const 22)) + (i32.add + (i32.add (i32.const 23) (i32.const 24)) + (i32.add + (i32.add (i32.const 25) (i32.const 26)) + (i32.add + (i32.add (i32.const 27) (i32.const 28)) + (i32.add + (i32.add (i32.const 29) (i32.const 30)) + (br_if $b (i32.const 31) (i32.const 1))))))))))))))))))) + (return (get_local $v3))) + (export "a" 0))`).exports; + +assertEq(o["a"](), 0xEEFDEADB|0); diff --git a/js/src/jit-test/tests/wasm/regress/brtable-conditionblock-folding.js b/js/src/jit-test/tests/wasm/regress/brtable-conditionblock-folding.js new file mode 100644 index 000000000..a2f9b4e37 --- /dev/null +++ b/js/src/jit-test/tests/wasm/regress/brtable-conditionblock-folding.js @@ -0,0 +1,19 @@ +load(libdir + "wasm.js"); + +assertEq(wasmEvalText(` +(module + (func $f (param $p i32) + block $out + i32.const 0 + if + i32.const 1 + tee_local $p + br_table $out $out + end + end + get_local $p + br_if 0 + ) + (export "f" $f) +) +`).exports.f(42), undefined); diff --git a/js/src/jit-test/tests/wasm/regress/bug1300546.js b/js/src/jit-test/tests/wasm/regress/bug1300546.js new file mode 100644 index 000000000..6ef35dc13 --- /dev/null +++ b/js/src/jit-test/tests/wasm/regress/bug1300546.js @@ -0,0 +1,34 @@ +load(libdir + "wasm.js"); + +setJitCompilerOption('wasm.test-mode', 1); + +try { + wasmEvalText(` + + (module + (type $type0 (func)) + (func $func0 + (nop) + (f64.load offset=59 align=1 (i32.const 0)) + (current_memory) + (current_memory) + (current_memory) + (current_memory) + (current_memory) + (current_memory) + (current_memory) + (current_memory) + (i64.rem_s (i64.const 17) (i64.xor (i64.const 17) (i64.xor (i64.const 17) (i64.xor (i64.xor (i64.const 17) (i64.const 17)) (i64.xor (i64.const 17) (i64.const 17)))))) + + (i64.rem_s + (i64.const 17) + (i64.xor + (i64.rem_s (i64.const 17) (i64.const 17)) + (i64.xor (i64.rem_s (i64.const 17) (i64.const 17)) (i64.xor (i64.const 17) (i64.const 17))))) + ) + (memory 1 1) + ) + + `)(createI64(41)); +} catch(e) { +} diff --git a/js/src/jit-test/tests/wasm/regress/bug1311019.js b/js/src/jit-test/tests/wasm/regress/bug1311019.js new file mode 100644 index 000000000..db977d108 --- /dev/null +++ b/js/src/jit-test/tests/wasm/regress/bug1311019.js @@ -0,0 +1,11 @@ +load(libdir + "wasm.js"); + +new WebAssembly.Module(wasmTextToBinary(`(module + (memory 1) + (func + (i64.trunc_s/f32 (f32.const 6.96875)) + (i32.load8_s (i32.const 0)) + (f32.const -7.66028056e-31) + (unreachable) + ) +)`)); diff --git a/js/src/jit-test/tests/wasm/regress/directives.txt b/js/src/jit-test/tests/wasm/regress/directives.txt new file mode 100644 index 000000000..057bdf4c2 --- /dev/null +++ b/js/src/jit-test/tests/wasm/regress/directives.txt @@ -0,0 +1 @@ +|jit-test| test-also-wasm-baseline diff --git a/js/src/jit-test/tests/wasm/regress/gvn-unremovable-phi.js b/js/src/jit-test/tests/wasm/regress/gvn-unremovable-phi.js new file mode 100644 index 000000000..02b5fed5f --- /dev/null +++ b/js/src/jit-test/tests/wasm/regress/gvn-unremovable-phi.js @@ -0,0 +1,22 @@ +load(libdir + "wasm.js"); + +wasmEvalText(`(module + (type $type0 (func (param i32))) + (func $f (param $p i32) + (local $x i32) (local $y i32) + loop $top + get_local $x + get_local $p + get_local $x + br_if $top + i32.const 1 + tee_local $p + get_local $y + set_local $x + i32.add + call $f + br_if $top + return + end + ) +)`); diff --git a/js/src/jit-test/tests/wasm/regress/misc-control-flow.js b/js/src/jit-test/tests/wasm/regress/misc-control-flow.js new file mode 100644 index 000000000..81d44f278 --- /dev/null +++ b/js/src/jit-test/tests/wasm/regress/misc-control-flow.js @@ -0,0 +1,226 @@ +load(libdir + "wasm.js"); + +wasmFailValidateText(`(module + (func (result i32) (param i32) + (loop (if (i32.const 0) (br 0)) (get_local 0))) + (export "" 0) +)`, /unused values not explicitly dropped by end of block/); + +wasmFailValidateText(`(module + (func (param i32) + (loop (if (i32.const 0) (br 0)) (get_local 0))) + (export "" 0) +)`, /unused values not explicitly dropped by end of block/); + +wasmFailValidateText(`(module + (func (result i32) (param i32) + (loop (if (i32.const 0) (br 0)) (drop (get_local 0)))) + (export "" 0) +)`, mismatchError("void", "i32")); + +assertEq(wasmEvalText(`(module + (func (result i32) (param i32) + (loop (if (i32.const 0) (br 0))) (get_local 0)) + (export "" 0) +)`).exports[""](42), 42); + +wasmEvalText(`(module (func $func$0 + (block (if (i32.const 1) (loop (br_table 0 (br 0))))) + ) +)`); + +wasmEvalText(`(module (func + (loop $out $in (br_table $out $out $in (i32.const 0))) + ) +)`); + +wasmEvalText(`(module (func (result i32) + (select + (block i32 + (drop (block i32 + (br_table + 1 + 0 + (i32.const 1) + (i32.const 0) + ) + )) + (i32.const 2) + ) + (i32.const 3) + (i32.const 4) + ) +)) +`); + +wasmEvalText(`(module + (func (result i32) (param i32) (param i32) (i32.const 0)) + (func (result i32) + (call 0 (i32.const 1) (call 0 (i32.const 2) (i32.const 3))) + (call 0 (unreachable) (i32.const 4)) + ) +)`); + +wasmEvalText(` +(module + + (func + (param i32) (param i32) (param i32) (param i32) + (result i32) + (i32.const 0) + ) + + (func (result i32) + (call 0 + (i32.const 42) + (i32.const 53) + (call 0 (i32.const 100) (i32.const 13) (i32.const 37) (i32.const 128)) + (return (i32.const 42)) + ) + ) + + (export "" 1) +) +`).exports[""](); + +wasmEvalText(` +(module + (import "check" "one" (param i32)) + (import "check" "two" (param i32) (param i32)) + (func (param i32) (call 0 (get_local 0))) + (func (param i32) (param i32) (call 1 (get_local 0) (get_local 1))) + (func + (call 1 + (i32.const 43) + (block $b i32 + (if (i32.const 1) + (call 0 + (block i32 + (call 0 (i32.const 42)) + (br $b (i32.const 10))))) + (i32.const 44)))) + (export "foo" 4)) +`, { + check: { + one(x) { + assertEq(x, 42); + }, + two(x, y) { + assertEq(x, 43); + assertEq(y, 10); + } + } +}).exports.foo(); + +assertEq(wasmEvalText(`(module (func + (return) + (select + (loop (i32.const 1)) + (loop (i32.const 2)) + (i32.const 3) + ) +) (export "" 0))`).exports[""](), undefined); + +wasmEvalText(`(module (func (result i32) + (return (i32.const 0)) + (select + (loop (i32.const 1)) + (loop (i32.const 2)) + (i32.const 3) + ) +))`); + +wasmEvalText(`(module (func + (block $return + (block $beforeReturn + (loop $out $in + (block $otherTable + (br_table + $return + $return + $otherTable + $beforeReturn + (i32.const 0) + ) + ) + (block $backTop + (br_table + $backTop + $backTop + $beforeReturn + (i32.const 0) + ) + ) + (br $in) + ) + ) + ) +))`); + +wasmFailValidateText( +`(module + (func $func$0 + (select + (if f32 + (i32.const 0) + (f32.const 0) + (i32.const 0) + ) + (if f32 + (i32.const 0) + (f32.const 0) + (i32.const 0) + ) + (i32.const 0) + ) + ) +)`, mismatchError("i32", "f32")); + +wasmEvalText(` +(module + (func (result i32) + (i32.add + (block $outer i32 + (drop (block $middle i32 + (block $inner i32 + (br_table $middle $outer $inner (i32.const 42) (i32.const 1)) + ) + (nop) + )) + (i32.const 0) + ) + (i32.const 13) + ) + ) +) +`); + +wasmFailValidateText(` +(module + (func (result i32) + (loop + (i32.const 0) + (br_table 1 0 (i32.const 15)) + ) + ) +)`, mismatchError("i32", "void")); + +wasmFailValidateText(` +(module + (func (result i32) + (loop i32 + (i32.const 0) + (br_table 1 0 (i32.const 15)) + ) + ) +)`, mismatchError("i32", "void")); + +wasmValidateText(` +(module + (func + (loop + (i32.const 0) + (br_table 1 0 (i32.const 15)) + ) + ) +)`); diff --git a/js/src/jit-test/tests/wasm/regress/movable-traps.js b/js/src/jit-test/tests/wasm/regress/movable-traps.js new file mode 100644 index 000000000..07a980a1e --- /dev/null +++ b/js/src/jit-test/tests/wasm/regress/movable-traps.js @@ -0,0 +1,40 @@ +load(libdir + "wasm.js"); + +let bodies = [ + ` + i32.const 1 + i32.const 0 + i32.div_s + `, + ` + i32.const 1 + i32.const 0 + i32.rem_s + `, + ` + f64.const 1797693134862315708145274e284 + i64.trunc_s/f64 + `, + ` + f32.const 1797693134862315708145274e284 + i32.trunc_s/f32 + ` +]; + +for (let body of bodies) { + wasmFullPass(` + (module + (func $f (param $x i32) (result i32) + loop $top + get_local $x + if + get_local $x + br 2 + end + ${body} + br $top + end + ) + (export "run" $f) + )`, 42, {}, 42); +} diff --git a/js/src/jit-test/tests/wasm/regress/null-metadata-filename.js b/js/src/jit-test/tests/wasm/regress/null-metadata-filename.js new file mode 100644 index 000000000..5d653062a --- /dev/null +++ b/js/src/jit-test/tests/wasm/regress/null-metadata-filename.js @@ -0,0 +1,14 @@ +if (typeof enableSPSProfiling === 'undefined' || !isAsmJSCompilationAvailable()) + quit(); + +evaluate(` +let f = evalReturningScope.bind(null, ''); + +(function(glob, stdlib) { + "use asm"; + var f = stdlib.f; + function _() { f(); } + return _; +})(this, { f })(); +`, { fileName: null }); + diff --git a/js/src/jit-test/tests/wasm/regress/oom-eval.js b/js/src/jit-test/tests/wasm/regress/oom-eval.js new file mode 100644 index 000000000..738a21857 --- /dev/null +++ b/js/src/jit-test/tests/wasm/regress/oom-eval.js @@ -0,0 +1,12 @@ +// |jit-test| slow; allow-oom + +if (typeof oomTest !== 'function' || !wasmIsSupported()) { + print('Missing oomTest or wasm support in wasm/regress/oom-eval'); + quit(); +} + +function foo() { + var g = newGlobal(); + g.eval(`o = new WebAssembly.Instance(new WebAssemby.Module(wasmTextToBinary('(module (func) (export "" 0))')));`); +} +oomTest(foo); diff --git a/js/src/jit-test/tests/wasm/regress/oom-init.js b/js/src/jit-test/tests/wasm/regress/oom-init.js new file mode 100644 index 000000000..24719d316 --- /dev/null +++ b/js/src/jit-test/tests/wasm/regress/oom-init.js @@ -0,0 +1,24 @@ +// |jit-test| slow; allow-oom + +if (typeof oomTest !== 'function' || !wasmIsSupported()) + quit(); + +Object.getOwnPropertyNames(this); +s = newGlobal(); +evalcx("\ + /x/;\ + oomTest(function() {\ + this[\"\"];\ + void 0;\ + Object.freeze(this);\ + l(undefined)();\ + O;\ + t;\ + 0;\ + ({e});\ + i;\ + 0;\ + ({ z: p ? 0 : 0});\ + s;\ + });\ +", s); diff --git a/js/src/jit-test/tests/wasm/regress/pass-stack-int64.js b/js/src/jit-test/tests/wasm/regress/pass-stack-int64.js new file mode 100644 index 000000000..0350f5ad8 --- /dev/null +++ b/js/src/jit-test/tests/wasm/regress/pass-stack-int64.js @@ -0,0 +1,17 @@ +load(libdir + "wasm.js"); + +var params = ''; +var locals = ''; +for (let i = 0; i < 20; i++) { + params += '(param i64) '; + locals += `(get_local ${i}) `; +} + +wasmEvalText(` +(module + (func + ${params} + (call 0 ${locals}) + ) +) +`); diff --git a/js/src/jit-test/tests/wasm/regress/regalloc-muli64.js b/js/src/jit-test/tests/wasm/regress/regalloc-muli64.js new file mode 100644 index 000000000..c90cd40e0 --- /dev/null +++ b/js/src/jit-test/tests/wasm/regress/regalloc-muli64.js @@ -0,0 +1,16 @@ +load(libdir + "wasm.js"); + +// Bug 1298808. +assertEq(wasmEvalText(`(module + (func + (result i32) + (i32.wrap/i64 + (i64.mul + ;; Conditions: rhs == lhs, rhs is not a constant. + (i64.add (i64.const 1) (i64.const 10)) + (i64.add (i64.const 1) (i64.const 10)) + ) + ) + ) + (export "" 0) +)`).exports[""](), 121); diff --git a/js/src/jit-test/tests/wasm/regress/reserve-enough.js b/js/src/jit-test/tests/wasm/regress/reserve-enough.js new file mode 100644 index 000000000..4866772b2 --- /dev/null +++ b/js/src/jit-test/tests/wasm/regress/reserve-enough.js @@ -0,0 +1,15 @@ +load(libdir + "wasm.js"); + +// Bug 1281131 - be sure to reserve enough stack space + +wasmEvalText( +`(module + (func $func0 + ${loopy(100)} + (nop)))`); + +function loopy(n) { + if (n == 0) + return "(nop)"; + return `(loop $out${n} $in${n} ${loopy(n-1)})`; +} diff --git a/js/src/jit-test/tests/wasm/regress/reserve-joinreg.js b/js/src/jit-test/tests/wasm/regress/reserve-joinreg.js new file mode 100644 index 000000000..354292a8a --- /dev/null +++ b/js/src/jit-test/tests/wasm/regress/reserve-joinreg.js @@ -0,0 +1,18 @@ +load(libdir + "wasm.js"); + +// Bug 1280933, excerpted from binary test case provided there. + +wasmEvalText( +`(module + (func $func0 (param $arg0 i32) (result i32) (local $var0 i64) + (set_local $var0 (i64.extend_u/i32 (get_local $arg0))) + (i32.wrap/i64 + (i64.add + (block i64 + (loop $label1 $label0 + (drop (block $label2 i64 + (br_table $label2 (i64.const 0) (get_local $arg0)))) + (set_local $var0 (i64.mul (i64.const 2) (get_local $var0)))) + (tee_local $var0 (i64.add (i64.const 4) (get_local $var0)))) + (i64.const 1)))) + (export "" 0))`); diff --git a/js/src/jit-test/tests/wasm/regress/select-any.js b/js/src/jit-test/tests/wasm/regress/select-any.js new file mode 100644 index 000000000..51b589d25 --- /dev/null +++ b/js/src/jit-test/tests/wasm/regress/select-any.js @@ -0,0 +1,31 @@ +load(libdir + "wasm.js"); + +// Bug 1280921 + +var m1 = wasmEvalText( +`(module + (type $type0 (func)) + (func $func0 + (select (unreachable) (return (nop)) (loop (i32.const 1)))) + (export "" 0))`).exports[""]; + +try { + m1(); +} catch (e) { + if (!(e instanceof Error && e.message.match(/unreachable executed/))) + throw e; +} + +var m2 = wasmEvalText( +`(module + (type $type0 (func)) + (func $func0 + (select (i32.const 26) (unreachable) (i32.const 3))) + (export "" 0))`).exports[""]; + +try { + m2(); +} catch (e) { + if (!(e instanceof Error && e.message.match(/unreachable executed/))) + throw e; +} diff --git a/js/src/jit-test/tests/wasm/regress/shift-counts.js b/js/src/jit-test/tests/wasm/regress/shift-counts.js new file mode 100644 index 000000000..33e78ed7d --- /dev/null +++ b/js/src/jit-test/tests/wasm/regress/shift-counts.js @@ -0,0 +1,10 @@ +load(libdir + "wasm.js"); + +// Bug 1280926, extracted from binary + +wasmEvalText( +`(module + (type $type0 (func (result i32))) + (export "" $func0) + (func $func0 (result i32) + (i32.shr_s (i32.const -40) (i32.const 34))))`); diff --git a/js/src/jit-test/tests/wasm/regress/teavm-bugs.js b/js/src/jit-test/tests/wasm/regress/teavm-bugs.js new file mode 100644 index 000000000..d7403eaa0 --- /dev/null +++ b/js/src/jit-test/tests/wasm/regress/teavm-bugs.js @@ -0,0 +1,55 @@ +load(libdir + "wasm.js"); + +// Register allocation issue with LCompareI64AndBranch. +let params = ''; +let locals = ''; +let tests = '(i64.const 0)'; + +for (let i = 15; i --> 0;) { + params += `\n(param i64)`; + locals += `\n(local i64)`; + tests = ` + (if i64 + (i64.eq + (get_local ${i + 8}) + (get_local ${i}) + ) + (get_local ${i + 8}) + ${tests} + )`; +} + +let code = `(module + (func $i64 (result i64) + ${params} ${locals} + ${tests} + ) +)` + +wasmEvalText(code); + +// Bounds check elimination. +assertEq(wasmEvalText(`(module + (memory 1) + (func (param $p i32) (local $l i32) (result i32) + (set_local $l (i32.const 0)) + (if + (get_local $p) + (set_local $l + (i32.add + (get_local $l) + (i32.load8_s (get_local $p)) + ) + ) + ) + (set_local $l + (i32.add + (get_local $l) + (i32.load8_s (get_local $p)) + ) + ) + (get_local $l) + ) + (data (i32.const 0) "\\00\\01\\02\\03\\04\\05\\06\\07\\08\\09\\0a\\0b\\0c\\0d\\0e\\0f") + (export "test" 0) +)`).exports["test"](3), 6); diff --git a/js/src/jit-test/tests/wasm/regress/too-large-frame.js b/js/src/jit-test/tests/wasm/regress/too-large-frame.js new file mode 100644 index 000000000..357cb0149 --- /dev/null +++ b/js/src/jit-test/tests/wasm/regress/too-large-frame.js @@ -0,0 +1,29 @@ +load(libdir + "wasm.js"); + +// Bug 1280934, equivalent test case. + +try { + +wasmEvalText( +`(module + (func $func0 (result i32) ${locals()} + (i32.const 0)) + (export "" 0))`); + +} catch (e) { + // The wasm baseline compiler throws OOM on too-large frames, so + // handle that. + if (!String(e).match(/out of memory/)) + throw e; +} + +// The wasm baseline compiler cuts off frames at 256KB at the moment; +// the test case for bug 1280934 constructed a frame around 512KB so +// duplicate that here. + +function locals() { + var s = ""; + for ( var i=0 ; i < 64000 ; i++ ) + s += "(local f64)\n"; + return s; +} |