AuroraMiddleware/v8
1
0
Fork 0
Code Issues 2 Pull Requests Releases Wiki Activity

X64: Fix bug in left-shift.

Browse Source 
Also changed a few other places that looked suspicious in the same way.
Added more info to failing test case and rewrote incorrect uses of mjsunit "fail" function.

Review URL: http://codereview.chromium.org/155279


git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@2409 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
This commit is contained in:
lrn@chromium.org 2009-07-09 08:00:12 +00:00
parent 32b0e47fa5
commit e3bb851efb
7 changed files with 90 additions and 51 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

17
src/x64/assembler-x64.cc
View File

@ -579,6 +579,23 @@ void Assembler::shift_32(Register dst, int subcode) {
}
void Assembler::shift_32(Register dst, Immediate shift_amount, int subcode) {
EnsureSpace ensure_space(this);
last_pc_ = pc_;
ASSERT(is_uint6(shift_amount.value_)); // illegal shift count
if (shift_amount.value_ == 1) {
emit_optional_rex_32(dst);
emit(0xD1);
emit_modrm(subcode, dst);
} else {
emit_optional_rex_32(dst);
emit(0xC1);
emit_modrm(subcode, dst);
emit(shift_amount.value_);
}
}
void Assembler::bt(const Operand& dst, Register src) {
EnsureSpace ensure_space(this);
last_pc_ = pc_;

12
src/x64/assembler-x64.h
View File

@ -690,11 +690,22 @@ class Assembler : public Malloced {
shift(dst, shift_amount, 0x7);
}
// Shifts dst right, duplicating sign bit, by shift_amount bits.
// Shifting by 1 is handled efficiently.
void sarl(Register dst, Immediate shift_amount) {
shift_32(dst, shift_amount, 0x7);
}
// Shifts dst right, duplicating sign bit, by cl % 64 bits.
void sar(Register dst) {
shift(dst, 0x7);
}
// Shifts dst right, duplicating sign bit, by cl % 64 bits.
void sarl(Register dst) {
shift_32(dst, 0x7);
}
void shl(Register dst, Immediate shift_amount) {
shift(dst, shift_amount, 0x4);
}
@ -1123,6 +1134,7 @@ class Assembler : public Malloced {
Immediate src);
// Emit machine code for a shift operation.
void shift(Register dst, Immediate shift_amount, int subcode);
void shift_32(Register dst, Immediate shift_amount, int subcode);
// Shift dst by cl % 64 bits.
void shift(Register dst, int subcode);
void shift_32(Register dst, int subcode);

14
src/x64/codegen-x64.cc
View File

@ -1292,7 +1292,7 @@ void CodeGenerator::VisitForInStatement(ForInStatement* node) {
node->continue_target()->set_direction(JumpTarget::FORWARD_ONLY);
__ movq(rax, frame_->ElementAt(0)); // load the current count
__ cmpq(rax, frame_->ElementAt(1)); // compare to the array length
__ cmpl(rax, frame_->ElementAt(1)); // compare to the array length
node->break_target()->Branch(above_equal);
// Get the i'th entry of the array.
@ -5109,7 +5109,7 @@ void CodeGenerator::LikelySmiBinaryOperation(Token::Value op,
Label result_ok;
__ shl(answer.reg());
// Check that the *signed* result fits in a smi.
__ cmpq(answer.reg(), Immediate(0xc0000000));
__ cmpl(answer.reg(), Immediate(0xc0000000));
__ j(positive, &result_ok);
ASSERT(kSmiTag == 0);
__ shl(rcx, Immediate(kSmiTagSize));
@ -6675,12 +6675,12 @@ void GenericBinaryOpStub::GenerateSmiCode(MacroAssembler* masm, Label* slow) {
// Move the second operand into register ecx.
__ movq(rcx, rbx);
// Remove tags from operands (but keep sign).
__ sar(rax, Immediate(kSmiTagSize));
__ sar(rcx, Immediate(kSmiTagSize));
__ sarl(rax, Immediate(kSmiTagSize));
__ sarl(rcx, Immediate(kSmiTagSize));
// Perform the operation.
switch (op_) {
case Token::SAR:
__ sar(rax);
__ sarl(rax);
// No checks of result necessary
break;
case Token::SHR:
@ -6691,19 +6691,17 @@ void GenericBinaryOpStub::GenerateSmiCode(MacroAssembler* masm, Label* slow) {
// - 0x40000000: this number would convert to negative when
// Smi tagging these two cases can only happen with shifts
// by 0 or 1 when handed a valid smi.
__ testq(rax, Immediate(0xc0000000));
__ testl(rax, Immediate(0xc0000000));
__ j(not_zero, slow);
break;
case Token::SHL:
__ shll(rax);
// TODO(Smi): Significant change if Smi changes.
// Check that the *signed* result fits in a smi.
// It does, if the 30th and 31st bits are equal, since then
// shifting the SmiTag in at the bottom doesn't change the sign.
ASSERT(kSmiTagSize == 1);
__ cmpl(rax, Immediate(0xc0000000));
__ j(sign, slow);
__ movsxlq(rax, rax); // Extend new sign of eax into rax.
break;
default:
UNREACHABLE();

82
test/mjsunit/apply.js
View File

@ -38,12 +38,12 @@ assertTrue(this === f0.apply(), "1-0");
assertTrue(this === f0.apply(this), "2a");
assertTrue(this === f0.apply(this, new Array(1)), "2b");
assertTrue(this === f0.apply(this, new Array(2)), "2c");
assertTrue(this === f0.apply(this, new Array(4242)), "2c");
assertTrue(this === f0.apply(this, new Array(4242)), "2d");
assertTrue(this === f0.apply(null), "3a");
assertTrue(this === f0.apply(null, new Array(1)), "3b");
assertTrue(this === f0.apply(null, new Array(2)), "3c");
assertTrue(this === f0.apply(this, new Array(4242)), "2c");
assertTrue(this === f0.apply(this, new Array(4242)), "3d");
assertTrue(this === f0.apply(void 0), "4a");
assertTrue(this === f0.apply(void 0, new Array(1)), "4b");
@ -51,26 +51,26 @@ assertTrue(this === f0.apply(void 0, new Array(2)), "4c");
assertTrue(void 0 === f1.apply(), "1-1");
assertTrue(void 0 === f1.apply(this), "2a");
assertTrue(void 0 === f1.apply(this, new Array(1)), "2b");
assertTrue(void 0 === f1.apply(this, new Array(2)), "2c");
assertTrue(void 0 === f1.apply(this, new Array(4242)), "2c");
assertTrue(42 === f1.apply(this, new Array(42, 43)), "2c");
assertEquals("foo", f1.apply(this, new Array("foo", "bar", "baz", "boo")), "2c");
assertTrue(void 0 === f1.apply(this), "5a");
assertTrue(void 0 === f1.apply(this, new Array(1)), "5b");
assertTrue(void 0 === f1.apply(this, new Array(2)), "5c");
assertTrue(void 0 === f1.apply(this, new Array(4242)), "5d");
assertTrue(42 === f1.apply(this, new Array(42, 43)), "5e");
assertEquals("foo", f1.apply(this, new Array("foo", "bar", "baz", "bo")), "5f");
assertTrue(void 0 === f1.apply(null), "3a");
assertTrue(void 0 === f1.apply(null, new Array(1)), "3b");
assertTrue(void 0 === f1.apply(null, new Array(2)), "3c");
assertTrue(void 0 === f1.apply(null, new Array(4242)), "2c");
assertTrue(42 === f1.apply(null, new Array(42, 43)), "2c");
assertEquals("foo", f1.apply(null, new Array("foo", "bar", "baz", "boo")), "2c");
assertTrue(void 0 === f1.apply(null), "6a");
assertTrue(void 0 === f1.apply(null, new Array(1)), "6b");
assertTrue(void 0 === f1.apply(null, new Array(2)), "6c");
assertTrue(void 0 === f1.apply(null, new Array(4242)), "6d");
assertTrue(42 === f1.apply(null, new Array(42, 43)), "6e");
assertEquals("foo", f1.apply(null, new Array("foo", "bar", "baz", "bo")), "6f");
assertTrue(void 0 === f1.apply(void 0), "4a");
assertTrue(void 0 === f1.apply(void 0, new Array(1)), "4b");
assertTrue(void 0 === f1.apply(void 0, new Array(2)), "4c");
assertTrue(void 0 === f1.apply(void 0, new Array(4242)), "4c");
assertTrue(42 === f1.apply(void 0, new Array(42, 43)), "2c");
assertEquals("foo", f1.apply(void 0, new Array("foo", "bar", "baz", "boo")), "2c");
assertTrue(void 0 === f1.apply(void 0), "7a");
assertTrue(void 0 === f1.apply(void 0, new Array(1)), "7b");
assertTrue(void 0 === f1.apply(void 0, new Array(2)), "7c");
assertTrue(void 0 === f1.apply(void 0, new Array(4242)), "7d");
assertTrue(42 === f1.apply(void 0, new Array(42, 43)), "7e");
assertEquals("foo", f1.apply(void 0, new Array("foo", "bar", "ba", "b")), "7f");
var arr = new Array(42, "foo", "fish", "horse");
function j(a, b, c, d, e, f, g, h, i, j, k, l) {
@ -81,7 +81,7 @@ function j(a, b, c, d, e, f, g, h, i, j, k, l) {
var expect = "42foofishhorse";
for (var i = 0; i < 8; i++)
expect += "undefined";
assertEquals(expect, j.apply(undefined, arr));
assertEquals(expect, j.apply(undefined, arr), "apply to undefined");
assertThrows("f0.apply(this, 1);");
assertThrows("f0.apply(this, 1, 2);");
@ -95,7 +95,7 @@ function f() {
return doo;
}
assertEquals("42foofishhorse", f.apply(this, arr));
assertEquals("42foofishhorse", f.apply(this, arr), "apply to this");
function s() {
var doo = this;
@ -105,7 +105,7 @@ function s() {
return doo;
}
assertEquals("bar42foofishhorse", s.apply("bar", arr));
assertEquals("bar42foofishhorse", s.apply("bar", arr), "apply to string");
function al() {
assertEquals(345, this);
@ -118,19 +118,24 @@ for (var j = 1; j < 0x40000000; j <<= 1) {
a[j - 1] = 42;
assertEquals(42 + j, al.apply(345, a));
} catch (e) {
assertTrue(e.toString().indexOf("Function.prototype.apply") != -1);
assertTrue(e.toString().indexOf("Function.prototype.apply") != -1,
"exception does not contain Function.prototype.apply: " +
e.toString());
for (; j < 0x40000000; j <<= 1) {
var caught = false;
try {
a = new Array(j);
a[j - 1] = 42;
al.apply(345, a);
assertEquals("Shouldn't get", "here");
assertUnreachable("Apply of arrray with length " + a.length +
" should have thrown");
} catch (e) {
assertTrue(e.toString().indexOf("Function.prototype.apply") != -1);
assertTrue(e.toString().indexOf("Function.prototype.apply") != -1,
"exception does not contain Function.prototype.apply [" +
"length = " + j + "]: " + e.toString());
caught = true;
}
assertTrue(caught);
assertTrue(caught, "exception not caught");
}
break;
}
@ -160,8 +165,8 @@ assertEquals(1229, primes.length);
var same_primes = Array.prototype.constructor.apply(Array, primes);
for (var i = 0; i < primes.length; i++)
assertEquals(primes[i], same_primes[i]);
assertEquals(primes.length, same_primes.length);
assertEquals(primes[i], same_primes[i], "prime" + primes[i]);
assertEquals(primes.length, same_primes.length, "prime-length");
Array.prototype["1"] = "sep";
@ -170,15 +175,22 @@ var holey = new Array(3);
holey[0] = "mor";
holey[2] = "er";
assertEquals("morseper", String.prototype.concat.apply("", holey));
assertEquals("morseper", String.prototype.concat.apply("", holey, 1));
assertEquals("morseper", String.prototype.concat.apply("", holey, 1, 2));
assertEquals("morseper", String.prototype.concat.apply("", holey, 1, 2, 3));
assertEquals("morseper", String.prototype.concat.apply("", holey, 1, 2, 3, 4));
assertEquals("morseper", String.prototype.concat.apply("", holey),
"moreseper0");
assertEquals("morseper", String.prototype.concat.apply("", holey, 1),
"moreseper1");
assertEquals("morseper", String.prototype.concat.apply("", holey, 1, 2),
"moreseper2");
assertEquals("morseper", String.prototype.concat.apply("", holey, 1, 2, 3),
"morseper3");
assertEquals("morseper", String.prototype.concat.apply("", holey, 1, 2, 3, 4),
"morseper4");
primes[0] = "";
primes[1] = holey;
assertThrows("String.prototype.concat.apply.apply('foo', primes)");
assertEquals("morseper", String.prototype.concat.apply.apply(String.prototype.concat, primes));
assertEquals("morseper",
String.prototype.concat.apply.apply(String.prototype.concat, primes),
"moreseper-prime");
delete(Array.prototype["1"]);

12
test/mjsunit/array-reduce.js
View File

@ -413,7 +413,7 @@ testReduce("reduceRight", "ArrayWithNonElementPropertiesReduceRight", 6,
try {
[1].reduce("not a function");
fail("Reduce callback not a function not throwing");
assertUnreachable("Reduce callback not a function not throwing");
} catch (e) {
assertTrue(e instanceof TypeError,
"reduce callback not a function not throwing TypeError");
@ -423,7 +423,7 @@ try {
try {
[1].reduceRight("not a function");
fail("ReduceRight callback not a function not throwing");
assertUnreachable("ReduceRight callback not a function not throwing");
} catch (e) {
assertTrue(e instanceof TypeError,
"reduceRight callback not a function not throwing TypeError");
@ -434,7 +434,7 @@ try {
try {
[].reduce(sum);
fail("Reduce no initial value not throwing");
assertUnreachable("Reduce no initial value not throwing");
} catch (e) {
assertTrue(e instanceof TypeError,
"reduce no initial value not throwing TypeError");
@ -444,7 +444,7 @@ try {
try {
[].reduceRight(sum);
fail("ReduceRight no initial value not throwing");
assertUnreachable("ReduceRight no initial value not throwing");
} catch (e) {
assertTrue(e instanceof TypeError,
"reduceRight no initial value not throwing TypeError");
@ -455,7 +455,7 @@ try {
try {
[,,,].reduce(sum);
fail("Reduce sparse no initial value not throwing");
assertUnreachable("Reduce sparse no initial value not throwing");
} catch (e) {
assertTrue(e instanceof TypeError,
"reduce sparse no initial value not throwing TypeError");
@ -465,7 +465,7 @@ try {
try {
[,,,].reduceRight(sum);
fail("ReduceRight sparse no initial value not throwing");
assertUnreachable("ReduceRight sparse no initial value not throwing");
} catch (e) {
assertTrue(e instanceof TypeError,
"reduceRight sparse no initial value not throwing TypeError");

2
test/mjsunit/big-array-literal.js
View File

@ -81,7 +81,7 @@ function testLiteral(size, array_in_middle) {
}
// The sizes to test.
var sizes = [1, 2, 100, 200, 400];
var sizes = [1, 2, 100, 200, 300];
// Run the test.
for (var i = 0; i < sizes.length; i++) {

2
test/mjsunit/regress/regress-244.js
View File

@ -57,7 +57,7 @@ function run() {
var threw = false;
try {
decodeURI(value);
fail(value);
assertUnreachable(value);
} catch (e) {
assertInstanceof(e, URIError);
}