Bugs in x64 ICs introduced by array length refactor.

src/x64/stub-cache-x64.cc

 // Copyright 2011 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 3225 matching lines @@
   Label slow, miss_force_generic;
 
   // This stub is meant to be tail-jumped to, the receiver must already
   // have been verified by the caller to not be a smi.
 
   // Check that the key is a smi.
   __ JumpIfNotSmi(rax, &miss_force_generic);
 
   // Check that the index is in range.
   __ movq(rbx, FieldOperand(rdx, JSObject::kElementsOffset));
-  __ cmpl(rax, FieldOperand(rbx, ExternalArray::kLengthOffset));
+  __ SmiToInteger32(rcx, rax);
+  __ cmpq(rax, FieldOperand(rbx, ExternalArray::kLengthOffset));
   // Unsigned comparison catches both negative and too-large values.
   __ j(above_equal, &miss_force_generic);
 
   // rax: index (as a smi)
   // rdx: receiver (JSObject)
   // rcx: untagged index
   // rbx: elements array
   __ movq(rbx, FieldOperand(rbx, ExternalArray::kExternalPointerOffset));
   // rbx: base pointer of external storage
   switch (elements_kind) {
     case JSObject::EXTERNAL_BYTE_ELEMENTS:
-      __ SmiToInteger32(rcx, rax);
       __ movsxbq(rcx, Operand(rbx, rcx, times_1, 0));
       break;
     case JSObject::EXTERNAL_PIXEL_ELEMENTS:
     case JSObject::EXTERNAL_UNSIGNED_BYTE_ELEMENTS:
-      __ SmiToInteger32(rcx, rax);
       __ movzxbq(rcx, Operand(rbx, rcx, times_1, 0));
       break;
     case JSObject::EXTERNAL_SHORT_ELEMENTS:
-      __ movsxwq(rcx, Operand(rbx, rax, times_1, 0));
+      __ movsxwq(rcx, Operand(rbx, rcx, times_2, 0));
       break;
     case JSObject::EXTERNAL_UNSIGNED_SHORT_ELEMENTS:
-      __ movzxwq(rcx, Operand(rbx, rax, times_1, 0));
+      __ movzxwq(rcx, Operand(rbx, rcx, times_2, 0));
       break;
     case JSObject::EXTERNAL_INT_ELEMENTS:
-      __ movsxlq(rcx, Operand(rbx, rax, times_2, 0));
+      __ movsxlq(rcx, Operand(rbx, rcx, times_4, 0));
       break;
     case JSObject::EXTERNAL_UNSIGNED_INT_ELEMENTS:
-      __ movl(rcx, Operand(rbx, rax, times_2, 0));
+      __ movl(rcx, Operand(rbx, rcx, times_4, 0));
       break;
     case JSObject::EXTERNAL_FLOAT_ELEMENTS:
-      __ cvtss2sd(xmm0, Operand(rbx, rax, times_2, 0));
+      __ cvtss2sd(xmm0, Operand(rbx, rcx, times_4, 0));
       break;
     case JSObject::EXTERNAL_DOUBLE_ELEMENTS:
-      __ movsd(xmm0, Operand(rbx, rax, times_4, 0));
+      __ movsd(xmm0, Operand(rbx, rcx, times_8, 0));
       break;
     default:
       UNREACHABLE();
       break;
   }
 
   // rax: index
   // rdx: receiver
   // For integer array types:
   // rcx: value
@@ skipping 79 matching lines @@
   Label slow, miss_force_generic;
 
   // This stub is meant to be tail-jumped to, the receiver must already
   // have been verified by the caller to not be a smi.
 
   // Check that the key is a smi.
   __ JumpIfNotSmi(rcx, &miss_force_generic);
 
   // Check that the index is in range.
   __ movq(rbx, FieldOperand(rdx, JSObject::kElementsOffset));
-  __ cmpl(rcx, FieldOperand(rbx, ExternalArray::kLengthOffset));
+  __ SmiToInteger32(rdi, rcx);  // Untag the index.
+  __ cmpq(rcx, FieldOperand(rbx, ExternalArray::kLengthOffset));
   // Unsigned comparison catches both negative and too-large values.
   __ j(above_equal, &miss_force_generic);
 
   // Handle both smis and HeapNumbers in the fast path. Go to the
   // runtime for all other kinds of values.
   // rax: value
   // rcx: key (a smi)
   // rdx: receiver (a JSObject)
   // rbx: elements array
+  // rdi: untagged key
   Label check_heap_number;
   if (elements_kind == JSObject::EXTERNAL_PIXEL_ELEMENTS) {
     // Float to pixel conversion is only implemented in the runtime for now.
     __ JumpIfNotSmi(rax, &slow);
   } else {
     __ JumpIfNotSmi(rax, &check_heap_number, Label::kNear);
   }
   // No more branches to slow case on this path.  Key and receiver not needed.
   __ SmiToInteger32(rdx, rax);
   __ movq(rbx, FieldOperand(rbx, ExternalArray::kExternalPointerOffset));
   // rbx: base pointer of external storage
   switch (elements_kind) {
     case JSObject::EXTERNAL_PIXEL_ELEMENTS:
-      __ ClampUint8(rdx);
-      __ SmiToInteger32(rdi, rcx);
+      {  // Clamp the value to [0..255].
+        Label done;
+        __ testl(rdx, Immediate(0xFFFFFF00));
+        __ j(zero, &done, Label::kNear);
+        __ setcc(negative, rdx);  // 1 if negative, 0 if positive.
+        __ decb(rdx);  // 0 if negative, 255 if positive.
+        __ bind(&done);
+      }
       __ movb(Operand(rbx, rdi, times_1, 0), rdx);
       break;
     case JSObject::EXTERNAL_BYTE_ELEMENTS:
     case JSObject::EXTERNAL_UNSIGNED_BYTE_ELEMENTS:
-      __ SmiToInteger32(rdi, rcx);
       __ movb(Operand(rbx, rdi, times_1, 0), rdx);
       break;
     case JSObject::EXTERNAL_SHORT_ELEMENTS:
     case JSObject::EXTERNAL_UNSIGNED_SHORT_ELEMENTS:
-      __ movw(Operand(rbx, rcx, times_1, 0), rdx);
+      __ movw(Operand(rbx, rdi, times_2, 0), rdx);
       break;
     case JSObject::EXTERNAL_INT_ELEMENTS:
     case JSObject::EXTERNAL_UNSIGNED_INT_ELEMENTS:
-      __ movl(Operand(rbx, rcx, times_2, 0), rdx);
+      __ movl(Operand(rbx, rdi, times_4, 0), rdx);
       break;
     case JSObject::EXTERNAL_FLOAT_ELEMENTS:
       // Need to perform int-to-float conversion.
       __ cvtlsi2ss(xmm0, rdx);
-      __ movss(Operand(rbx, rcx, times_2, 0), xmm0);
+      __ movss(Operand(rbx, rdi, times_4, 0), xmm0);
       break;
     case JSObject::EXTERNAL_DOUBLE_ELEMENTS:
       // Need to perform int-to-float conversion.
       __ cvtlsi2sd(xmm0, rdx);
-      __ movsd(Operand(rbx, rcx, times_4, 0), xmm0);
+      __ movsd(Operand(rbx, rdi, times_8, 0), xmm0);
       break;
     case JSObject::FAST_ELEMENTS:
     case JSObject::FAST_DOUBLE_ELEMENTS:
     case JSObject::DICTIONARY_ELEMENTS:
     case JSObject::NON_STRICT_ARGUMENTS_ELEMENTS:
       UNREACHABLE();
       break;
   }
   __ ret(0);
 
   // TODO(danno): handle heap number -> pixel array conversion
   if (elements_kind != JSObject::EXTERNAL_PIXEL_ELEMENTS) {
     __ bind(&check_heap_number);
     // rax: value
     // rcx: key (a smi)
     // rdx: receiver (a JSObject)
     // rbx: elements array
+    // rdi: untagged key
     __ CmpObjectType(rax, HEAP_NUMBER_TYPE, kScratchRegister);
     __ j(not_equal, &slow);
     // No more branches to slow case on this path.
 
     // The WebGL specification leaves the behavior of storing NaN and
     // +/-Infinity into integer arrays basically undefined. For more
     // reproducible behavior, convert these to zero.
     __ movsd(xmm0, FieldOperand(rax, HeapNumber::kValueOffset));
     __ movq(rbx, FieldOperand(rbx, ExternalArray::kExternalPointerOffset));
+    // rdi: untagged index
     // rbx: base pointer of external storage
-    // rcx: key
     // top of FPU stack: value
     if (elements_kind == JSObject::EXTERNAL_FLOAT_ELEMENTS) {
       __ cvtsd2ss(xmm0, xmm0);
-      __ movss(Operand(rbx, rcx, times_2, 0), xmm0);
+      __ movss(Operand(rbx, rdi, times_4, 0), xmm0);
       __ ret(0);
     } else if (elements_kind == JSObject::EXTERNAL_DOUBLE_ELEMENTS) {
-      __ movsd(Operand(rbx, rcx, times_4, 0), xmm0);
+      __ movsd(Operand(rbx, rdi, times_8, 0), xmm0);
       __ ret(0);
     } else {
       // Perform float-to-int conversion with truncation (round-to-zero)
       // behavior.
 
       // Convert to int32 and store the low byte/word.
       // If the value is NaN or +/-infinity, the result is 0x80000000,
       // which is automatically zero when taken mod 2^n, n < 32.
       // rdx: value (converted to an untagged integer)
       // rdi: untagged index
       // rbx: base pointer of external storage
       switch (elements_kind) {
-        case JSObject::EXTERNAL_PIXEL_ELEMENTS:
-          __ ClampUint8(rdx);
-          __ cvttsd2si(rdx, xmm0);
-          __ SmiToInteger32(rdi, rcx);
-          __ movb(Operand(rbx, rdi, times_1, 0), rdx);
-          break;
         case JSObject::EXTERNAL_BYTE_ELEMENTS:
         case JSObject::EXTERNAL_UNSIGNED_BYTE_ELEMENTS:
           __ cvttsd2si(rdx, xmm0);
-          __ SmiToInteger32(rdi, rcx);
           __ movb(Operand(rbx, rdi, times_1, 0), rdx);
           break;
         case JSObject::EXTERNAL_SHORT_ELEMENTS:
         case JSObject::EXTERNAL_UNSIGNED_SHORT_ELEMENTS:
           __ cvttsd2si(rdx, xmm0);
-          __ SmiToInteger32(rdi, rcx);
-          __ movw(Operand(rbx, rcx, times_1, 0), rdx);
+          __ movw(Operand(rbx, rdi, times_2, 0), rdx);
           break;
         case JSObject::EXTERNAL_INT_ELEMENTS:
         case JSObject::EXTERNAL_UNSIGNED_INT_ELEMENTS:
           // Convert to int64, so that NaN and infinities become
           // 0x8000000000000000, which is zero mod 2^32.
           __ cvttsd2siq(rdx, xmm0);
-          __ movl(Operand(rbx, rcx, times_2, 0), rdx);
+          __ movl(Operand(rbx, rdi, times_4, 0), rdx);
           break;
+        case JSObject::EXTERNAL_PIXEL_ELEMENTS:
         case JSObject::EXTERNAL_FLOAT_ELEMENTS:
         case JSObject::EXTERNAL_DOUBLE_ELEMENTS:
         case JSObject::FAST_ELEMENTS:
         case JSObject::FAST_DOUBLE_ELEMENTS:
         case JSObject::DICTIONARY_ELEMENTS:
         case JSObject::NON_STRICT_ARGUMENTS_ELEMENTS:
           UNREACHABLE();
           break;
       }
       __ ret(0);
@@ skipping 254 matching lines @@
       masm->isolate()->builtins()->KeyedStoreIC_MissForceGeneric();
   __ jmp(ic_force_generic, RelocInfo::CODE_TARGET);
 }
 
 
 #undef __
 
 } }  // namespace v8::internal
 
 #endif  // V8_TARGET_ARCH_X64