5f1661aad7
One optimization in the machine-operator-reducer did not consider that that word32 shift left instructions only consider the last 5 bits of the shift input. The issue only occurs for WebAssembly because in JavaScript we always add a "& 0xf" on the shift value to the TurboFan graph. For additional background: The JavaScript and WebAssembly spec both say that only the last 5 bits of the shift value are used in the word32-shift-left operation. This means that an "x << 0x29", in the code is actually executed as "x << 0x09". Therefore the changes in this CL are okay because they mask the last 5 bit of the shift value. BUG=chromium:689450 Change-Id: Id92f298ed6d7f1714b109b3f4fbcecd5ac6d30f7 Reviewed-on: https://chromium-review.googlesource.com/439312 Reviewed-by: Ben Titzer <titzer@chromium.org> Commit-Queue: Andreas Haas <ahaas@chromium.org> Cr-Commit-Position: refs/heads/master@{#43245}
26 lines
759 B
JavaScript
26 lines
759 B
JavaScript
// Copyright 2017 the V8 project authors. All rights reserved.
|
|
// Use of this source code is governed by a BSD-style license that can be
|
|
// found in the LICENSE file.
|
|
|
|
load('test/mjsunit/wasm/wasm-constants.js');
|
|
load('test/mjsunit/wasm/wasm-module-builder.js');
|
|
|
|
(function() {
|
|
var builder = new WasmModuleBuilder();
|
|
builder.addMemory(16, 32, false);
|
|
builder.addFunction('test', kSig_i_i)
|
|
.addBodyWithEnd([
|
|
kExprGetLocal, 0x00,
|
|
kExprI32Const, 0x29,
|
|
kExprI32Shl,
|
|
kExprI32Const, 0x18,
|
|
kExprI32ShrS,
|
|
kExprI32Const, 0x18,
|
|
kExprI32Shl,
|
|
kExprEnd,
|
|
])
|
|
.exportFunc();
|
|
var module = builder.instantiate();
|
|
assertEquals(0, module.exports.test(16));
|
|
})();
|