Commit 0efa3fd9 authored by Zhi An Ng's avatar Zhi An Ng Committed by Commit Bot

[wasm-simd][scalar-lowering] Fix lowering of load nodes

We forgot to check if a load's input node (index) has any replacement.
This led to weird cases like I32x4ExtractLane persisting even after
scalar lowering is done, which is incorrect.

This manifested in a crash, where we try to call pextrd with a general
register operand.

With this, we can run all currently checked in performance tests without
crashing.

Bug: chromium:1124885
Change-Id: Ide36ef94ab5f63446c725b9c2eb64be01e7fa6ab
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2562817Reviewed-by: 's avatarBill Budge <bbudge@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71510}
parent 7fd3c94c
......@@ -512,11 +512,20 @@ void SimdScalarLowering::GetIndexNodes(Node* index, Node** new_indices,
int num_lanes = NumLanes(type);
int lane_width = kSimd128Size / num_lanes;
int laneIndex = kLaneOffsets[0] / lane_width;
new_indices[laneIndex] = index;
Node* rep = index;
if (HasReplacement(0, index)) {
// Index nodes are lowered to scalar nodes.
DCHECK_EQ(1, ReplacementCount(index));
rep = GetReplacements(index)[0];
}
new_indices[laneIndex] = rep;
for (int i = 1; i < num_lanes; ++i) {
laneIndex = kLaneOffsets[i * lane_width] / lane_width;
new_indices[laneIndex] = graph()->NewNode(
machine()->Int32Add(), index,
machine()->Int32Add(), rep,
graph()->NewNode(
common()->Int32Constant(static_cast<int>(i) * lane_width)));
}
......@@ -664,9 +673,13 @@ void SimdScalarLowering::LowerLoadTransformOp(Node* node, SimdType type) {
}
} else {
// Load splat, load from the same index for every lane.
Node* rep = HasReplacement(0, index) ? GetReplacements(index)[0] : index;
// Replace first node, we only called ChangeOp above.
reps[0]->ReplaceInput(1, rep);
for (int i = num_lanes - 1; i > 0; --i) {
reps[i] =
graph()->NewNode(load_op, base, index, effect_input, control_input);
graph()->NewNode(load_op, base, rep, effect_input, control_input);
effect_input = reps[i];
}
}
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment