AuroraMiddleware/v8
1
0
Fork 0
Code Issues 2 Pull Requests Releases Wiki Activity

[turbofan] Fix arm backend matching of (x >>> 24) & 0xffff.

Browse Source 
We emitted rotation by 24 bits with bitwise and, but that is wrong
because the low 8 bits can wrap around and "leak" into the result.

Bug: chromium:739902
Change-Id: Id49251e89405afb1581b8c60cde808c2d8bf693d
Reviewed-on: https://chromium-review.googlesource.com/645848
Reviewed-by: Martyn Capewell <martyn.capewell@arm.com>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Commit-Queue: Jaroslav Sevcik <jarin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47746}
This commit is contained in:
Jaroslav Sevcik 2017-08-31 15:17:52 +02:00 committed by Commit Bot
parent 6eee80fc95
commit b1c1228981
3 changed files with 41 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
src/compiler/arm/instruction-selector-arm.cc
View File

@ -866,11 +866,18 @@ void InstructionSelector::VisitWord32And(Node* node) {
uint32_t const shift = mshr.right().Value();
if (((shift == 8) || (shift == 16) || (shift == 24)) &&
((value == 0xff) || (value == 0xffff))) {
// Merge SHR into AND by emitting a UXTB or UXTH instruction with a
(value == 0xff)) {
// Merge SHR into AND by emitting a UXTB instruction with a
// bytewise rotation.
Emit((value == 0xff) ? kArmUxtb : kArmUxth,
g.DefineAsRegister(m.node()), g.UseRegister(mshr.left().node()),
Emit(kArmUxtb, g.DefineAsRegister(m.node()),
g.UseRegister(mshr.left().node()),
g.TempImmediate(mshr.right().Value()));
return;
} else if (((shift == 8) || (shift == 16)) && (value == 0xffff)) {
// Merge SHR into AND by emitting a UXTH instruction with a
// bytewise rotation.
Emit(kArmUxth, g.DefineAsRegister(m.node()),
g.UseRegister(mshr.left().node()),
g.TempImmediate(mshr.right().Value()));
return;
} else if (IsSupported(ARMv7) && (width != 0) &&

28
test/mjsunit/compiler/regress-739902.js Normal file
View File

@ -0,0 +1,28 @@
// Copyright 2017 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --allow-natives-syntax
(function() {
function f(x) {
return String.fromCharCode(x >>> 24);
};
var e = 0x41000001;
f(e);
%OptimizeFunctionOnNextCall(f);
assertEquals("A", f(e));
})();
(function() {
function f(x) {
return (x >>> 24) & 0xffff;
};
f(1);
%OptimizeFunctionOnNextCall(f);
assertEquals(0, f(1));
assertEquals(100, f((100 << 24) + 42));
})();

4
test/unittests/compiler/arm/instruction-selector-arm-unittest.cc
View File

@ -3155,7 +3155,7 @@ TEST_F(InstructionSelectorTest, Word32AndWithWord32ShrAnd0xff) {
TEST_F(InstructionSelectorTest, Word32AndWithWord32ShrAnd0xffff) {
TRACED_FORRANGE(int32_t, shr, 1, 3) {
TRACED_FORRANGE(int32_t, shr, 1, 2) {
StreamBuilder m(this, MachineType::Int32(), MachineType::Int32());
Node* const p0 = m.Parameter(0);
Node* const r = m.Word32And(m.Word32Shr(p0, m.Int32Constant(shr * 8)),
@ -3167,7 +3167,7 @@ TEST_F(InstructionSelectorTest, Word32AndWithWord32ShrAnd0xffff) {
ASSERT_EQ(2U, s[0]->InputCount());
EXPECT_EQ(shr * 8, s.ToInt32(s[0]->InputAt(1)));
}
TRACED_FORRANGE(int32_t, shr, 1, 3) {
TRACED_FORRANGE(int32_t, shr, 1, 2) {
StreamBuilder m(this, MachineType::Int32(), MachineType::Int32());
Node* const p0 = m.Parameter(0);
Node* const r = m.Word32And(m.Int32Constant(0xffff),