Implements checks for 53-bit overflow for x64.

runtime/vm/intermediate_language_x64.cc

 // Copyright (c) 2013, the Dart project authors.  Please see the AUTHORS file
 // for details. All rights reserved. Use of this source code is governed by a
 // BSD-style license that can be found in the LICENSE file.
 
 #include "vm/globals.h"  // Needed here to get TARGET_ARCH_X64.
 #if defined(TARGET_ARCH_X64)
 
 #include "vm/intermediate_language.h"
 
 #include "lib/error.h"
 #include "vm/dart_entry.h"
 #include "vm/flow_graph_compiler.h"
 #include "vm/locations.h"
 #include "vm/object_store.h"
 #include "vm/parser.h"
 #include "vm/stack_frame.h"
 #include "vm/stub_code.h"
 #include "vm/symbols.h"
 
 #define __ compiler->assembler()->
 
 namespace dart {
 
 DECLARE_FLAG(int, optimization_counter_threshold);
 DECLARE_FLAG(bool, propagate_ic_data);
+DECLARE_FLAG(bool, throw_on_javascript_int_overflow);
 
 // Generic summary for call instructions that have all arguments pushed
 // on the stack and return the result in a fixed register RAX.
 LocationSummary* Instruction::MakeCallSummary() {
   LocationSummary* result = new LocationSummary(0, 0, LocationSummary::kCall);
   result->set_out(Location::RegisterLocation(RAX));
   return result;
 }
 
 
@@ skipping 2086 matching lines @@
 
   Register temp = locs()->temp(0).reg();
   // Generate stack overflow check.
   __ movq(temp, Immediate(Isolate::Current()->stack_limit_address()));
   __ cmpq(RSP, Address(temp, 0));
   __ j(BELOW_EQUAL, slow_path->entry_label());
   __ Bind(slow_path->exit_label());
 }
 
 
+static void Emit53BitOverflowCheck(FlowGraphCompiler* compiler,
+                                   Label* overflow,
+                                   Register result) {
+  if (FLAG_throw_on_javascript_int_overflow) {

[srdjan, 2013/06/06 21:59:02]

I think that it should be ASSERT(overflow != NULL). There are cases where we can
guarantee that we do not deoptimize (e.g., no 64 bit overflow), but this does
not mean that the range cannot be > 53 bits.

[Ivan Posva, 2013/06/06 22:10:18]

Actually if that flag is set we should just assume we can always overflow and
pass the overflow label.

+    if (overflow != NULL) {
+      __ movq(TMP, result);  // result is a tagged Smi.
+      // Bits 54...64 must be all 0 or all 1. (It would be bit 53, but result
+      // is tagged.)
+      __ shlq(result, Immediate(64 - 54));
+      __ sarq(result, Immediate(64 - 54));
+      __ cmpq(result, TMP);
+      __ j(NOT_EQUAL, overflow);  // 53-bit overflow.
+    }
+  }
+}
+
+
 static void EmitSmiShiftLeft(FlowGraphCompiler* compiler,
                              BinarySmiOpInstr* shift_left) {
   const bool is_truncating = shift_left->is_truncating();
   const LocationSummary& locs = *shift_left->locs();
   Register left = locs.in(0).reg();
   Register result = locs.out().reg();
   ASSERT(left == result);
   Label* deopt = shift_left->CanDeoptimize() ?

[Ivan Posva, 2013/06/06 22:10:18]

For example here we should assume that we can always deopt if 53-bit
verification is enabled, no?

       compiler->AddDeoptStub(shift_left->deopt_id(), kDeoptBinarySmiOp) : NULL;
   if (locs.in(1).IsConstant()) {
     const Object& constant = locs.in(1).constant();
     ASSERT(constant.IsSmi());
     // shlq operation masks the count to 6 bits.
     const intptr_t kCountLimit = 0x3F;
     const intptr_t value = Smi::Cast(constant).Value();
     if (value == 0) {
       // No code needed.
     } else if ((value < 0) || (value >= kCountLimit)) {
@@ skipping 11 matching lines @@
         Register temp = locs.temp(0).reg();
         __ movq(temp, left);
         __ shlq(left, Immediate(value));
         __ sarq(left, Immediate(value));
         __ cmpq(left, temp);
         __ j(NOT_EQUAL, deopt);  // Overflow.
       }
       // Shift for result now we know there is no overflow.
       __ shlq(left, Immediate(value));
     }
+    Emit53BitOverflowCheck(compiler, deopt, result);
     return;
   }
 
   // Right (locs.in(1)) is not constant.
   Register right = locs.in(1).reg();
   Range* right_range = shift_left->right()->definition()->range();
   if (shift_left->left()->BindsToConstant() && !is_truncating) {
     // TODO(srdjan): Implement code below for is_truncating().
     // If left is constant, we know the maximal allowed size for right.
     const Object& obj = shift_left->left()->BoundConstant();
     if (obj.IsSmi()) {
       const intptr_t left_int = Smi::Cast(obj).Value();
       if (left_int == 0) {
         __ cmpq(right, Immediate(0));
         __ j(NEGATIVE, deopt);
         return;
       }
       const intptr_t max_right = kSmiBits - Utils::HighestBit(left_int);
       const bool right_needs_check =
           (right_range == NULL) ||
           !right_range->IsWithin(0, max_right - 1);
       if (right_needs_check) {
         __ cmpq(right,
           Immediate(reinterpret_cast<int64_t>(Smi::New(max_right))));
         __ j(ABOVE_EQUAL, deopt);
       }
       __ SmiUntag(right);
       __ shlq(left, right);
     }
+    Emit53BitOverflowCheck(compiler, deopt, result);
     return;
   }
 
   const bool right_needs_check =
       (right_range == NULL) || !right_range->IsWithin(0, (Smi::kBits - 1));
   ASSERT(right == RCX);  // Count must be in RCX
   if (is_truncating) {
     if (right_needs_check) {
       const bool right_may_be_negative =
           (right_range == NULL) ||
@@ skipping 30 matching lines @@
     __ movq(temp, left);
     __ SmiUntag(right);
     // Overflow test (preserve temp and right);
     __ shlq(left, right);
     __ sarq(left, right);
     __ cmpq(left, temp);
     __ j(NOT_EQUAL, deopt);  // Overflow.
     // Shift for result now we know there is no overflow.
     __ shlq(left, right);
   }
+  Emit53BitOverflowCheck(compiler, deopt, result);
 }
 
 
 static bool CanBeImmediate(const Object& constant) {
   return constant.IsSmi() &&
     Immediate(reinterpret_cast<int64_t>(constant.raw())).is_int32();
 }
 
 
 LocationSummary* BinarySmiOpInstr::MakeLocationSummary() const {
@@ skipping 72 matching lines @@
   if (op_kind() == Token::kSHL) {
     EmitSmiShiftLeft(compiler, this);
     return;
   }
 
   ASSERT(!is_truncating());
   Register left = locs()->in(0).reg();
   Register result = locs()->out().reg();
   ASSERT(left == result);
   Label* deopt = NULL;
   if (CanDeoptimize()) {

[Ivan Posva, 2013/06/06 22:10:18]

For example right here.

     deopt = compiler->AddDeoptStub(deopt_id(),
                                    kDeoptBinarySmiOp);
   }
 
   if (locs()->in(1).IsConstant()) {
     const Object& constant = locs()->in(1).constant();
     ASSERT(constant.IsSmi());
     const int64_t imm =
         reinterpret_cast<int64_t>(constant.raw());
     switch (op_kind()) {
@@ skipping 85 matching lines @@
 
         __ sarq(left, Immediate(value));
         __ SmiTag(left);
         break;
       }
 
       default:
         UNREACHABLE();
         break;
     }
+    Emit53BitOverflowCheck(compiler, deopt, result);
     return;
   }  // locs()->in(1).IsConstant().
 
 
   if (locs()->in(1).IsStackSlot()) {
     const Address& right = locs()->in(1).ToStackSlotAddress();
     switch (op_kind()) {
       case Token::kADD: {
         __ addq(left, right);
         if (deopt != NULL) __ j(OVERFLOW, deopt);
@@ skipping 22 matching lines @@
       }
       case Token::kBIT_XOR: {
         // No overflow check.
         __ xorq(left, right);
         break;
       }
       default:
         UNREACHABLE();
         break;
     }
+    Emit53BitOverflowCheck(compiler, deopt, result);
     return;
   }  // locs()->in(1).IsStackSlot().
 
   // if locs()->in(1).IsRegister.
   Register right = locs()->in(1).reg();
   switch (op_kind()) {
     case Token::kADD: {
       __ addq(left, right);
       if (deopt != NULL) __ j(OVERFLOW, deopt);
       break;
@@ skipping 109 matching lines @@
     case Token::kAND: {
       // Flow graph builder has dissected this operation to guarantee correct
       // behavior (short-circuit evaluation).
       UNREACHABLE();
       break;
     }
     default:
       UNREACHABLE();
       break;
   }
+  Emit53BitOverflowCheck(compiler, deopt, result);
 }
 
 
 LocationSummary* CheckEitherNonSmiInstr::MakeLocationSummary() const {
   intptr_t left_cid = left()->Type()->ToCid();
   intptr_t right_cid = right()->Type()->ToCid();
   ASSERT((left_cid != kDoubleCid) && (right_cid != kDoubleCid));
   const intptr_t kNumInputs = 2;
   const bool need_temp = (left_cid != kSmiCid) && (right_cid != kSmiCid);
   const intptr_t kNumTemps = need_temp ? 1 : 0;
@@ skipping 1098 matching lines @@
   ASSERT(result != temp);
   __ movsd(value_double, FieldAddress(value_obj, Double::value_offset()));
   __ cvttsd2siq(result, value_double);
   // Overflow is signalled with minint.
   Label do_call, done;
   // Check for overflow and that it fits into Smi.
   __ movq(temp, result);
   __ shlq(temp, Immediate(1));
   __ j(OVERFLOW, &do_call, Assembler::kNearJump);
   __ SmiTag(result);
+  Emit53BitOverflowCheck(compiler, &do_call, result);
   __ jmp(&done);
   __ Bind(&do_call);
   ASSERT(instance_call()->HasICData());
   const ICData& ic_data = *instance_call()->ic_data();
   ASSERT((ic_data.NumberOfChecks() == 1));
   const Function& target = Function::ZoneHandle(ic_data.GetTargetAt(0));
 
   const intptr_t kNumberOfArguments = 1;
   __ pushq(value_obj);
   compiler->GenerateStaticCall(deopt_id(),
@@ skipping 25 matching lines @@
   Register temp = locs()->temp(0).reg();
 
   __ cvttsd2siq(result, value);
   // Overflow is signalled with minint.
   Label do_call, done;
   // Check for overflow and that it fits into Smi.
   __ movq(temp, result);
   __ shlq(temp, Immediate(1));
   __ j(OVERFLOW, deopt);
   __ SmiTag(result);
+  Emit53BitOverflowCheck(compiler, deopt, result);
 }
 
 
 LocationSummary* DoubleToDoubleInstr::MakeLocationSummary() const {
   const intptr_t kNumInputs = 1;
   const intptr_t kNumTemps = 0;
   LocationSummary* result =
       new LocationSummary(kNumInputs, kNumTemps, LocationSummary::kNoCall);
   result->set_in(0, Location::RequiresFpuRegister());
   result->set_out(Location::RequiresFpuRegister());
@@ skipping 597 matching lines @@
                          PcDescriptors::kOther,
                          locs());
   __ Drop(2);  // Discard type arguments and receiver.
 }
 
 }  // namespace dart
 
 #undef __
 
 #endif  // defined TARGET_ARCH_X64