5f1661aad7
One optimization in the machine-operator-reducer did not consider that that word32 shift left instructions only consider the last 5 bits of the shift input. The issue only occurs for WebAssembly because in JavaScript we always add a "& 0xf" on the shift value to the TurboFan graph. For additional background: The JavaScript and WebAssembly spec both say that only the last 5 bits of the shift value are used in the word32-shift-left operation. This means that an "x << 0x29", in the code is actually executed as "x << 0x09". Therefore the changes in this CL are okay because they mask the last 5 bit of the shift value. BUG=chromium:689450 Change-Id: Id92f298ed6d7f1714b109b3f4fbcecd5ac6d30f7 Reviewed-on: https://chromium-review.googlesource.com/439312 Reviewed-by: Ben Titzer <titzer@chromium.org> Commit-Queue: Andreas Haas <ahaas@chromium.org> Cr-Commit-Position: refs/heads/master@{#43245} |
||
---|---|---|
.. | ||
loop-stack-check.js | ||
regress-5860.js | ||
regression-5531.js | ||
regression-5800.js | ||
regression-5884.js | ||
regression-02256.js | ||
regression-02256b.js | ||
regression-02862.js | ||
regression-643595.js | ||
regression-644682.js | ||
regression-647649.js | ||
regression-648079.js | ||
regression-651961.js | ||
regression-654377.js | ||
regression-663994.js | ||
regression-666741.js | ||
regression-667745.js | ||
regression-670683.js | ||
regression-674447.js | ||
regression-680938.js | ||
regression-684858.js | ||
regression-688876.js | ||
regression-689450.js |