Changeset 246332 in webkit

Timestamp:

Jun 11, 2019, 2:06:45 PM (7 years ago)

Author:

Tadeu Zagallo

Message:

AI BitURShift's result should not be unsigned
​https://bugs.webkit.org/show_bug.cgi?id=198689
<rdar://problem/51550063>

Reviewed by Saam Barati.

JSTests:

• stress/urshift-int32-overflow.js: Added.

(foo.):
(foo):

Source/JavaScriptCore:

Treating BitURShift's result as unsigned in the abstract interpreter incorrectly overflows it.
This breaks the DFG and FTL, since they assume that BitURShift's result is an int32 value, but
get a double constant from AI. Since the result will be converted to unsigned by UInt32ToNumber,
all we have to do is store the result as a signed int32.

• dfg/DFGAbstractInterpreterInlines.h:

Location:

trunk

Files:

• JSTests/ChangeLog (modified) (1 diff)
• JSTests/stress/urshift-int32-overflow.js (added)
• Source/JavaScriptCore/ChangeLog (modified) (1 diff)
• Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h (modified) (1 diff)

trunk/JSTests/ChangeLog

@@ +1 @@
+2019-06-10  Tadeu Zagallo  <tzagallo@apple.com>
+
+        AI BitURShift's result should not be unsigned
+        https://bugs.webkit.org/show_bug.cgi?id=198689
+        <rdar://problem/51550063>
+
+        Reviewed by Saam Barati.
+
+        * stress/urshift-int32-overflow.js: Added.
+        (foo.):
+        (foo):
+
 2019-06-11  Guillaume Emont  <guijemont@igalia.com>
 

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2019-06-10  Tadeu Zagallo  <tzagallo@apple.com>
+
+        AI BitURShift's result should not be unsigned
+        https://bugs.webkit.org/show_bug.cgi?id=198689
+        <rdar://problem/51550063>
+
+        Reviewed by Saam Barati.
+
+        Treating BitURShift's result as unsigned in the abstract interpreter incorrectly overflows it.
+        This breaks the DFG and FTL, since they assume that BitURShift's result is an int32 value, but
+        get a double constant from AI. Since the result will be converted to unsigned by UInt32ToNumber,
+        all we have to do is store the result as a signed int32.
+
+        * dfg/DFGAbstractInterpreterInlines.h:
+
 2019-06-11  Michael Catanzaro  <mcatanzaro@igalia.com>
 

trunk/Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h

@@ -500 +500 @@
                 break;
             case BitRShift:
-                setConstant(node, JSValue(a >> static_cast<uint32_t>(b)));
+                setConstant(node, JSValue(a >> (static_cast<uint32_t>(b) & 0x1f)));
                 break;
             case BitLShift:
-                setConstant(node, JSValue(a << static_cast<uint32_t>(b)));
+                setConstant(node, JSValue(a << (static_cast<uint32_t>(b) & 0x1f)));
                 break;
             case BitURShift:
-                setConstant(node, JSValue(static_cast<uint32_t>(a) >> static_cast<uint32_t>(b)));
+                setConstant(node, JSValue(static_cast<int32_t>(static_cast<uint32_t>(a) >> (static_cast<uint32_t>(b) & 0x1f))));
                 break;
             default: