Changeset 203851 in webkit


Ignore:
Timestamp:
Jul 28, 2016 5:30:32 PM (8 years ago)
Author:
msaboff@apple.com
Message:

ARM64: Fused left shift with a right shift can create NaNs from integers
https://bugs.webkit.org/show_bug.cgi?id=160329

Reviewed by Geoffrey Garen.

When we fuse a left shift and a right shift of integers where the shift amounts
are the same and the size of the quantity being shifted is 8 bits, we rightly
generate a sign extend byte instruction. On ARM64, we were sign extending
to a 64 bit quantity, when we really wanted to sign extend to a 32 bit quantity.

Checking the ARM64 marco assembler and we were extending to 64 bits for all
four combinations of zero / sign and 8 / 16 bits.

  • assembler/MacroAssemblerARM64.h:

(JSC::MacroAssemblerARM64::zeroExtend16To32):
(JSC::MacroAssemblerARM64::signExtend16To32):
(JSC::MacroAssemblerARM64::zeroExtend8To32):
(JSC::MacroAssemblerARM64::signExtend8To32):

  • tests/stress/regress-160329.js: New test added.

(narrow):

Location:
trunk/Source/JavaScriptCore
Files:
1 added
2 edited

Legend:

Unmodified
Added
Removed
  • trunk/Source/JavaScriptCore/ChangeLog

    r203834 r203851  
     12016-07-28  Michael Saboff  <msaboff@apple.com>
     2
     3        ARM64: Fused left shift with a right shift can create NaNs from integers
     4        https://bugs.webkit.org/show_bug.cgi?id=160329
     5
     6        Reviewed by Geoffrey Garen.
     7
     8        When we fuse a left shift and a right shift of integers where the shift amounts
     9        are the same and the size of the quantity being shifted is 8 bits, we rightly
     10        generate a sign extend byte instruction.  On ARM64, we were sign extending
     11        to a 64 bit quantity, when we really wanted to sign extend to a 32 bit quantity.
     12
     13        Checking the ARM64 marco assembler and we were extending to 64 bits for all
     14        four combinations of zero / sign and 8 / 16 bits.
     15       
     16        * assembler/MacroAssemblerARM64.h:
     17        (JSC::MacroAssemblerARM64::zeroExtend16To32):
     18        (JSC::MacroAssemblerARM64::signExtend16To32):
     19        (JSC::MacroAssemblerARM64::zeroExtend8To32):
     20        (JSC::MacroAssemblerARM64::signExtend8To32):
     21        * tests/stress/regress-160329.js: New test added.
     22        (narrow):
     23
    1242016-07-28  Mark Lam  <mark.lam@apple.com>
    225
  • trunk/Source/JavaScriptCore/assembler/MacroAssemblerARM64.h

    r203390 r203851  
    11261126    void zeroExtend16To32(RegisterID src, RegisterID dest)
    11271127    {
    1128         m_assembler.uxth<64>(dest, src);
     1128        m_assembler.uxth<32>(dest, src);
    11291129    }
    11301130
    11311131    void signExtend16To32(RegisterID src, RegisterID dest)
    11321132    {
    1133         m_assembler.sxth<64>(dest, src);
     1133        m_assembler.sxth<32>(dest, src);
    11341134    }
    11351135
     
    11911191    void zeroExtend8To32(RegisterID src, RegisterID dest)
    11921192    {
    1193         m_assembler.uxtb<64>(dest, src);
     1193        m_assembler.uxtb<32>(dest, src);
    11941194    }
    11951195
    11961196    void signExtend8To32(RegisterID src, RegisterID dest)
    11971197    {
    1198         m_assembler.sxtb<64>(dest, src);
     1198        m_assembler.sxtb<32>(dest, src);
    11991199    }
    12001200
Note: See TracChangeset for help on using the changeset viewer.