AuroraMiddleware/v8
1
0
Fork 0
Code Issues 2 Pull Requests Releases Wiki Activity

[asm.js] Fix fall-back case in MultiplicativeExpression.

Browse Source 
This fixes the fall-back case when parsing a multiplicative expression
where the lookahead found a '-' token followed by an unsigned token, but
no '*' token is following. We cannot rewind both tokens, but still need
to make sure that a full multiplicative expression is parsed.

R=clemensh@chromium.org
TEST=mjsunit/regress/regress-8377
BUG=v8:8377

Change-Id: I20ce6267445b32bdaf03f41f11d9ef4be66cb636
Reviewed-on: https://chromium-review.googlesource.com/c/1304317
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57084}
This commit is contained in:
Michael Starzinger 2018-10-29 13:20:52 +01:00 committed by Commit Bot
parent 6e0706bcc0
commit 9195ca990c
2 changed files with 34 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
src/asmjs/asm-parser.cc
View File

@ -1642,6 +1642,7 @@ AsmType* AsmJsParser::UnaryExpression() {
// 6.8.8 MultiplicativeExpression
AsmType* AsmJsParser::MultiplicativeExpression() {
AsmType* a;
uint32_t uvalue;
if (CheckForUnsignedBelow(0x100000, &uvalue)) {
if (Check('*')) {
@ -1654,8 +1655,10 @@ AsmType* AsmJsParser::MultiplicativeExpression() {
current_function_builder_->EmitI32Const(value);
current_function_builder_->Emit(kExprI32Mul);
return AsmType::Intish();
} else {
scanner_.Rewind();
RECURSEn(a = UnaryExpression());
}
scanner_.Rewind();
} else if (Check('-')) {
if (CheckForUnsignedBelow(0x100000, &uvalue)) {
int32_t value = -static_cast<int32_t>(uvalue);
@ -1669,12 +1672,14 @@ AsmType* AsmJsParser::MultiplicativeExpression() {
current_function_builder_->Emit(kExprI32Mul);
return AsmType::Intish();
}
return AsmType::Signed();
a = AsmType::Signed();
} else {
scanner_.Rewind();
RECURSEn(a = UnaryExpression());
}
scanner_.Rewind();
} else {
RECURSEn(a = UnaryExpression());
}
AsmType* a;
RECURSEn(a = UnaryExpression());
for (;;) {
if (Check('*')) {
uint32_t uvalue;

24
test/mjsunit/regress/regress-8377.js Normal file
View File

@ -0,0 +1,24 @@
// Copyright 2018 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --allow-natives-syntax
function Module(global, env, buffer) {
"use asm";
function test1() {
var x = 0;
x = -1 / 1 | 0;
return x | 0;
}
function test2() {
var x = 0;
x = (-1 / 1) | 0;
return x | 0;
}
return { test1: test1, test2: test2 };
};
let module = Module(this);
assertEquals(-1, module.test1());
assertEquals(-1, module.test2());
assertTrue(%IsAsmWasmCode(Module));