ARM: Fix bug introduced in 4783 (2.2.15) that caused the

result of 1 << x to be miscalculated for some inputs.
Review URL: http://codereview.chromium.org/2848021

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@4929 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

diff --git a/src/arm/codegen-arm.cc b/src/arm/codegen-arm.cc
index 8e87614..eed880b 100644 (file)
--- a/src/arm/codegen-arm.cc
+++ b/src/arm/codegen-arm.cc
@@ -969,45 +969,20 @@ void DeferredInlineSmiOperation::Generate() {
     case Token::MOD:
     case Token::BIT_OR:
     case Token::BIT_XOR:
-    case Token::BIT_AND: {
-      if (reversed_) {
-        if (tos_register_.is(r0)) {
-          __ mov(r1, Operand(Smi::FromInt(value_)));
-        } else {
-          ASSERT(tos_register_.is(r1));
-          __ mov(r0, Operand(Smi::FromInt(value_)));
-          lhs = r0;
-          rhs = r1;
-        }
-      } else {
-        if (tos_register_.is(r1)) {
-          __ mov(r0, Operand(Smi::FromInt(value_)));
-        } else {
-          ASSERT(tos_register_.is(r0));
-          __ mov(r1, Operand(Smi::FromInt(value_)));
-          lhs = r0;
-          rhs = r1;
-        }
-      }
-      break;
-    }
-
+    case Token::BIT_AND:
     case Token::SHL:
     case Token::SHR:
     case Token::SAR: {
-      if (!reversed_) {
-        if (tos_register_.is(r1)) {
-          __ mov(r0, Operand(Smi::FromInt(value_)));
-        } else {
-          ASSERT(tos_register_.is(r0));
-          __ mov(r1, Operand(Smi::FromInt(value_)));
-          lhs = r0;
-          rhs = r1;
-        }
+      if (tos_register_.is(r1)) {
+        __ mov(r0, Operand(Smi::FromInt(value_)));
       } else {
-        ASSERT(op_ == Token::SHL);
+        ASSERT(tos_register_.is(r0));
         __ mov(r1, Operand(Smi::FromInt(value_)));
       }
+      if (reversed_ == tos_register_.is(r1)) {
+          lhs = r0;
+          rhs = r1;
+      }
       break;
     }
 

diff --git a/test/mjsunit/smi-ops.js b/test/mjsunit/smi-ops.js
index d5bd214..499535c 100644 (file)
--- a/test/mjsunit/smi-ops.js
+++ b/test/mjsunit/smi-ops.js
@@ -685,3 +685,8 @@ assertEquals(24, LeftShiftThreeBy(3));
 assertEquals(24, LeftShiftThreeBy(35));
 assertEquals(24, LeftShiftThreeBy(67));
 assertEquals(24, LeftShiftThreeBy(-29));
+
+// Regression test for a bug in the ARM code generator.  For some register
+// allocations we got the Smi overflow case wrong.
+function f(x, y) { return y +  ( 1 << (x & 31)); }
+assertEquals(-2147483647, f(31, 1));