commit 6d4ba583dff27894f143d54ae6da3b185fbe2803
author Jakob Kummerow <jkummerow@chromium.org> Tue Apr 11 18:39:56 2023
committer V8 LUCI CQ <v8-scoped@luci-project-accounts.iam.gserviceaccount.com> Wed Apr 12 12:32:39 2023
tree 515d921e417f9381a1c4458321a1386cfc75a2da
parent 9f4bea8e781260e7b7a1e3c8ef6598cb52dc1dd4

[arm64] Fix UNREACHABLE in instruction selector

This ports crrev.com/c/4258648 to arm64.

Bug: v8:13700
Change-Id: If00bb492ea54ef5819835e7415294738a7ff3040
Fixed: chromium:1428537
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4416016
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
Auto-Submit: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/main@{#87032}

src/compiler/backend/arm64/instruction-selector-arm64.cc

diff --git a/src/compiler/backend/arm64/instruction-selector-arm64.cc b/src/compiler/backend/arm64/instruction-selector-arm64.cc
index f8cbca8..3afbdc3 100644
--- a/src/compiler/backend/arm64/instruction-selector-arm64.cc
+++ b/src/compiler/backend/arm64/instruction-selector-arm64.cc
@@ -2109,6 +2109,10 @@
         immediate_mode = kLoadStoreImm16;
         break;
       case MachineRepresentation::kWord32:
+      case MachineRepresentation::kWord64:
+        // Since BitcastElider may remove nodes of
+        // IrOpcode::kTruncateInt64ToInt32 and directly use the inputs, values
+        // with kWord64 can also reach this line.
       case MachineRepresentation::kTaggedSigned:
       case MachineRepresentation::kTagged:
         opcode = kArm64Ldrsw;

src/compiler/backend/x64/instruction-selector-x64.cc

diff --git a/src/compiler/backend/x64/instruction-selector-x64.cc b/src/compiler/backend/x64/instruction-selector-x64.cc
index 164b69d..f1f83cc 100644
--- a/src/compiler/backend/x64/instruction-selector-x64.cc
+++ b/src/compiler/backend/x64/instruction-selector-x64.cc
@@ -1713,7 +1713,7 @@
         break;
       case MachineRepresentation::kWord32:
       case MachineRepresentation::kWord64:
-        // While BitcastElider may remove nodes of
+        // Since BitcastElider may remove nodes of
         // IrOpcode::kTruncateInt64ToInt32 and directly use the inputs, values
         // with kWord64 can also reach this line.
       case MachineRepresentation::kTaggedSigned:

test/mjsunit/regress/wasm/regress-13700.js

diff --git a/test/mjsunit/regress/wasm/regress-13700.js b/test/mjsunit/regress/wasm/regress-13700.js
index 03f5fa8..8855d80 100644
--- a/test/mjsunit/regress/wasm/regress-13700.js
+++ b/test/mjsunit/regress/wasm/regress-13700.js
@@ -10,7 +10,7 @@
 let expects = [0n, 1234n, 0n, -1n];
 
 for (let i = 0; i < bases.length; ++i) {
-  var builder = new WasmModuleBuilder();
+  let builder = new WasmModuleBuilder();
   let g0 = builder.addImportedGlobal("mod", "g0", kWasmI64, true);
   builder.addExportOfKind('g0', kExternalGlobal, g0);
 
@@ -22,10 +22,30 @@
       kExprGlobalSet, g0,
     ]).exportAs("trunci64");
 
-  var to_imported = new WebAssembly.Global({value: "i64", mutable: true}, bases[i]);
-  var instance = builder.instantiate({mod: { g0: to_imported }});
+  let to_imported =
+      new WebAssembly.Global({value: 'i64', mutable: true}, bases[i]);
+  let instance = builder.instantiate({mod: { g0: to_imported }});
 
   assertEquals(bases[i], instance.exports.g0.value);
   instance.exports.trunci64();
   assertEquals(expects[i], instance.exports.g0.value);
 }
+
+for (let i = 0; i < bases.length; ++i) {
+  let builder = new WasmModuleBuilder();
+  builder.addMemory(1, 1, true);
+
+  builder.addFunction("trunci64", kSig_l_v).exportFunc().addBody([
+    kExprI32Const, 0,  // address for load: 0
+    kExprI64LoadMem, 0, 0,  // alignment 0, offset 0
+    kExprI32ConvertI64,
+    kExprI64SConvertI32,
+  ]);
+
+  let instance = builder.instantiate();
+
+  let mem = new BigInt64Array(instance.exports.memory.buffer);
+  mem[0] = bases[i];
+  let result = instance.exports.trunci64();
+  assertEquals(result, expects[i]);
+}