Changeset 269783 in webkit

Timestamp:

Nov 13, 2020, 9:44:14 AM (6 years ago)

Author:

Adrian Perez de Castro

Message:

Merge r265891 - B3 IntRange is incorrect for negative masks
​https://bugs.webkit.org/show_bug.cgi?id=215536
<rdar://problem/67130430>

Reviewed by Michael Saboff and Robin Morisset.

In the B3 ReduceStrength phase, we compute rangeForMask as (0, mask). This is correct for
positive values, but incorrect when negative. To fix it, we use (INT_MIN & mask, INT_MAX & mask)
as the range for negative masks.

• b3/B3ReduceStrength.cpp:
• b3/testb3.h:
• b3/testb3_1.cpp:

(run):

• b3/testb3_5.cpp:

(testCheckSubBitAnd):

Location:

releases/WebKitGTK/webkit-2.30/Source/JavaScriptCore

Files:

• ChangeLog (modified) (1 diff)
• b3/B3ReduceStrength.cpp (modified) (1 diff)
• b3/testb3.h (modified) (1 diff)
• b3/testb3_1.cpp (modified) (1 diff)
• b3/testb3_5.cpp (modified) (1 diff)

releases/WebKitGTK/webkit-2.30/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2020-08-19  Tadeu Zagallo  <tzagallo@apple.com>
+
+        B3 IntRange is incorrect for negative masks
+        https://bugs.webkit.org/show_bug.cgi?id=215536
+        <rdar://problem/67130430>
+
+        Reviewed by Michael Saboff and Robin Morisset.
+
+        In the B3 ReduceStrength phase, we compute rangeForMask as (0, mask).  This is correct for
+        positive values, but incorrect when negative. To fix it, we use `(INT_MIN & mask, INT_MAX & mask)`
+        as the range for negative masks.
+
+        * b3/B3ReduceStrength.cpp:
+        * b3/testb3.h:
+        * b3/testb3_1.cpp:
+        (run):
+        * b3/testb3_5.cpp:
+        (testCheckSubBitAnd):
+
 2020-09-03  Carlos Garcia Campos  <cgarcia@igalia.com>
 

releases/WebKitGTK/webkit-2.30/Source/JavaScriptCore/b3/B3ReduceStrength.cpp

@@ -124 +124 @@
         if (!(mask + 1))
             return top<T>();
+        if (mask < 0)
+            return IntRange(INT_MIN & mask, mask & INT_MAX);
         return IntRange(0, mask);
     }

releases/WebKitGTK/webkit-2.30/Source/JavaScriptCore/b3/testb3.h

@@ -805 +805 @@
 void testCheckSubBadImm();
 void testCheckSub();
+void testCheckSubBitAnd();
 double doubleSub(double, double);
 void testCheckSub64();

releases/WebKitGTK/webkit-2.30/Source/JavaScriptCore/b3/testb3_1.cpp

@@ -497 +497 @@
     RUN(testCheckSubBadImm());
     RUN(testCheckSub());
+    RUN(testCheckSubBitAnd());
     RUN(testCheckSub64());
     RUN(testCheckSubFold(100, 200));

releases/WebKitGTK/webkit-2.30/Source/JavaScriptCore/b3/testb3_5.cpp

@@ -1124 +1124 @@
     CHECK(invoke<double>(*code, 42, 42) == 0.0);
     CHECK(invoke<double>(*code, -2147483647, 42) == -2147483689.0);
+}
+
+void testCheckSubBitAnd()
+{
+    Procedure proc;
+    if (proc.optLevel() < 1)
+        return;
+    BasicBlock* root = proc.addBlock();
+    Value* zero = root->appendNew<Const32Value>(proc, Origin(), 0);
+    Value* arg1 = root->appendNew<ArgumentRegValue>(proc, Origin(), GPRInfo::argumentGPR0);
+    Value* truncatedArg1 = root->appendNew<Value>(proc, Trunc, Origin(), arg1);
+    Value* minusTwo = root->appendNew<Const32Value>(proc, Origin(), -2);
+    Value* bitAnd = root->appendNew<Value>(proc, BitAnd, Origin(), truncatedArg1, minusTwo);
+    CheckValue* checkSub = root->appendNew<CheckValue>(proc, CheckSub, Origin(), zero, bitAnd);
+    checkSub->setGenerator([&] (CCallHelpers& jit, const StackmapGenerationParams&) {
+        AllowMacroScratchRegisterUsage allowScratch(jit);
+        jit.move(CCallHelpers::TrustedImm32(42), GPRInfo::returnValueGPR);
+        jit.emitFunctionEpilogue();
+        jit.ret();
+    });
+    root->appendNewControlValue(proc, Return, Origin(), checkSub);
+
+    auto code = compileProc(proc);
+
+    CHECK_EQ(invoke<int>(*code, 1), 0);
+    CHECK_EQ(invoke<int>(*code, 2), -2);
+    CHECK_EQ(invoke<int>(*code, 3), -2);
+    CHECK_EQ(invoke<int>(*code, -1), 2);
+    CHECK_EQ(invoke<int>(*code, -2), 2);
+    CHECK_EQ(invoke<int>(*code, -3), 4);
+    CHECK_EQ(invoke<int>(*code, INT_MAX), -(INT_MAX - 1));
+    CHECK_EQ(invoke<int>(*code, INT_MIN), 42);
 }