Revision: 4929
Author: erik.co...@gmail.com
Date: Wed Jun 23 06:44:11 2010
Log: ARM: Fix bug introduced in 4783 (2.2.15) that caused the
result of 1 << x to be miscalculated for some inputs.
Review URL: http://codereview.chromium.org/2848021
http://code.google.com/p/v8/source/detail?r=4929

Modified:
 /branches/bleeding_edge/src/arm/codegen-arm.cc
 /branches/bleeding_edge/test/mjsunit/smi-ops.js

=======================================
--- /branches/bleeding_edge/src/arm/codegen-arm.cc      Mon Jun 21 03:34:25 2010
+++ /branches/bleeding_edge/src/arm/codegen-arm.cc      Wed Jun 23 06:44:11 2010
@@ -969,45 +969,20 @@
     case Token::MOD:
     case Token::BIT_OR:
     case Token::BIT_XOR:
-    case Token::BIT_AND: {
-      if (reversed_) {
-        if (tos_register_.is(r0)) {
-          __ mov(r1, Operand(Smi::FromInt(value_)));
-        } else {
-          ASSERT(tos_register_.is(r1));
-          __ mov(r0, Operand(Smi::FromInt(value_)));
-          lhs = r0;
-          rhs = r1;
-        }
-      } else {
-        if (tos_register_.is(r1)) {
-          __ mov(r0, Operand(Smi::FromInt(value_)));
-        } else {
-          ASSERT(tos_register_.is(r0));
-          __ mov(r1, Operand(Smi::FromInt(value_)));
-          lhs = r0;
-          rhs = r1;
-        }
-      }
-      break;
-    }
-
+    case Token::BIT_AND:
     case Token::SHL:
     case Token::SHR:
     case Token::SAR: {
-      if (!reversed_) {
-        if (tos_register_.is(r1)) {
-          __ mov(r0, Operand(Smi::FromInt(value_)));
-        } else {
-          ASSERT(tos_register_.is(r0));
-          __ mov(r1, Operand(Smi::FromInt(value_)));
-          lhs = r0;
-          rhs = r1;
-        }
+      if (tos_register_.is(r1)) {
+        __ mov(r0, Operand(Smi::FromInt(value_)));
       } else {
-        ASSERT(op_ == Token::SHL);
+        ASSERT(tos_register_.is(r0));
         __ mov(r1, Operand(Smi::FromInt(value_)));
       }
+      if (reversed_ == tos_register_.is(r1)) {
+          lhs = r0;
+          rhs = r1;
+      }
       break;
     }

=======================================
--- /branches/bleeding_edge/test/mjsunit/smi-ops.js     Thu May  6 01:15:15 2010
+++ /branches/bleeding_edge/test/mjsunit/smi-ops.js     Wed Jun 23 06:44:11 2010
@@ -685,3 +685,8 @@
 assertEquals(24, LeftShiftThreeBy(35));
 assertEquals(24, LeftShiftThreeBy(67));
 assertEquals(24, LeftShiftThreeBy(-29));
+
+// Regression test for a bug in the ARM code generator.  For some register
+// allocations we got the Smi overflow case wrong.
+function f(x, y) { return y +  ( 1 << (x & 31)); }
+assertEquals(-2147483647, f(31, 1));

--
v8-dev mailing list
v8-dev@googlegroups.com
http://groups.google.com/group/v8-dev

Reply via email to