Reviewers: William Hesse, Description: ARM: Fix bug introduced in 4783 (2.2.15) that caused the result of 1 << x to be miscalculated for some inputs.
Please review this at http://codereview.chromium.org/2848021/show SVN Base: http://v8.googlecode.com/svn/branches/bleeding_edge/ Affected files: M src/arm/codegen-arm.cc M test/mjsunit/smi-ops.js Index: src/arm/codegen-arm.cc =================================================================== --- src/arm/codegen-arm.cc (revision 4928) +++ src/arm/codegen-arm.cc (working copy) @@ -969,45 +969,20 @@ case Token::MOD: case Token::BIT_OR: case Token::BIT_XOR: - case Token::BIT_AND: { - if (reversed_) { - if (tos_register_.is(r0)) { - __ mov(r1, Operand(Smi::FromInt(value_))); - } else { - ASSERT(tos_register_.is(r1)); - __ mov(r0, Operand(Smi::FromInt(value_))); - lhs = r0; - rhs = r1; - } - } else { - if (tos_register_.is(r1)) { - __ mov(r0, Operand(Smi::FromInt(value_))); - } else { - ASSERT(tos_register_.is(r0)); - __ mov(r1, Operand(Smi::FromInt(value_))); - lhs = r0; - rhs = r1; - } - } - break; - } - + case Token::BIT_AND: case Token::SHL: case Token::SHR: case Token::SAR: { - if (!reversed_) { - if (tos_register_.is(r1)) { - __ mov(r0, Operand(Smi::FromInt(value_))); - } else { - ASSERT(tos_register_.is(r0)); - __ mov(r1, Operand(Smi::FromInt(value_))); - lhs = r0; - rhs = r1; - } + if (tos_register_.is(r1)) { + __ mov(r0, Operand(Smi::FromInt(value_))); } else { - ASSERT(op_ == Token::SHL); + ASSERT(tos_register_.is(r0)); __ mov(r1, Operand(Smi::FromInt(value_))); } + if (reversed_ == tos_register_.is(r1)) { + lhs = r0; + rhs = r1; + } break; } Index: test/mjsunit/smi-ops.js =================================================================== --- test/mjsunit/smi-ops.js (revision 4928) +++ test/mjsunit/smi-ops.js (working copy) @@ -685,3 +685,8 @@ assertEquals(24, LeftShiftThreeBy(35)); assertEquals(24, LeftShiftThreeBy(67)); assertEquals(24, LeftShiftThreeBy(-29)); + +// Regression test for a bug in the ARM code generator. For some register +// allocations we got the Smi overflow case wrong. +function f(x, y) { return y + ( 1 << (x & 31)); } +assertEquals(-2147483647, f(31, 1)); -- v8-dev mailing list [email protected] http://groups.google.com/group/v8-dev
