bug1837686.js (1007B)
1 // A bug in Ion's alias analysis was causing the two `global.get 0`s 2 // to be GVNd together, despite the fact that the call inside the try 3 // block changes the value. In this case, this caused the returned 4 // value to be 7 rather than the correct value 5. 5 6 const wasm = wasmTextToBinary(`(module 7 (global $g (mut i32) (i32.const 0)) 8 (func $f0 9 i32.const 1 10 global.set 0 11 ) 12 (func $f1 (param i32) (param i32) (result i32) 13 global.get 0 14 15 i32.eqz 16 if 17 local.get 0 18 i32.const 1 19 i32.or 20 local.set 0 21 end 22 23 try 24 call $f0 25 26 global.get 0 27 i32.eqz 28 if 29 local.get 0 30 i32.const 2 31 i32.or 32 local.set 0 33 end 34 catch_all 35 i32.const 15 36 local.set 0 37 end 38 local.get 0 39 ) 40 (func (export "test") (result i32) 41 i32.const 4 42 i32.const 0 43 call $f1 44 ) 45 )`); 46 47 const mod = new WebAssembly.Module(wasm); 48 const ins = new WebAssembly.Instance(mod); 49 assertEq(ins.exports.test(), 5);