Reviewers: Nico, jochen (traveling), ulan,
Message:
This is blocking the Clang roll. It would be great if someone could review
this,
and ideally help getting it rolled into Chromium too.
Description:
ARM assembler: fix undefined behaviour in fits_shifter
Bit-shifts have undefined behaviour if the shift amount is larger
than the width of the type.
In this case the code would do imm32 >> 32 when rot == 0.
A newer version of Clang unrolled the loop, optimized the first
iteration away, causing the test suite to fail with:
#
# Fatal error in ../src/arm/assembler-arm.cc, line 1212
# Check failed: !rn.is(ip).
#
as well as crashing when running Chromium tests on Android (at least
we think this was the cause, see the bug).
BUG=463436, 444089
LOG=Y
Please review this at https://codereview.chromium.org/979633002/
Base URL: https://chromium.googlesource.com/v8/v8.git@master
Affected files (+2, -1 lines):
M src/arm/assembler-arm.cc
Index: src/arm/assembler-arm.cc
diff --git a/src/arm/assembler-arm.cc b/src/arm/assembler-arm.cc
index
7a091d0deb354d6a8b68b14041de82ae4df08e3f..2bf48e58dc3c9db8ff7b1da910590ecd3ddf3388
100644
--- a/src/arm/assembler-arm.cc
+++ b/src/arm/assembler-arm.cc
@@ -1011,7 +1011,8 @@ static bool fits_shifter(uint32_t imm32,
Instr* instr) {
// imm32 must be unsigned.
for (int rot = 0; rot < 16; rot++) {
- uint32_t imm8 = (imm32 << 2*rot) | (imm32 >> (32 - 2*rot));
+ uint32_t imm8 =
+ rot == 0 ? imm32 : (imm32 << 2 * rot) | (imm32 >> (32 - 2 * rot));
if ((imm8 <= 0xff)) {
*rotate_imm = rot;
*immed_8 = imm8;
--
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
---
You received this message because you are subscribed to the Google Groups "v8-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/d/optout.
