Fixes javascript integer overflow check.

runtime/vm/intermediate_language_x64.cc

 // Copyright (c) 2013, the Dart project authors.  Please see the AUTHORS file
 // for details. All rights reserved. Use of this source code is governed by a
 // BSD-style license that can be found in the LICENSE file.
 
 #include "vm/globals.h"  // Needed here to get TARGET_ARCH_X64.
 #if defined(TARGET_ARCH_X64)
 
 #include "vm/intermediate_language.h"
 
 #include "lib/error.h"
@@ skipping 2133 matching lines @@
     intptr_t threshold =
         FLAG_optimization_counter_threshold * (loop_depth() + 1);
     __ cmpq(FieldAddress(temp, Function::usage_counter_offset()),
             Immediate(threshold));
     __ j(GREATER_EQUAL, slow_path->entry_label());
   }
   __ Bind(slow_path->exit_label());
 }
 
 
-static void Emit53BitOverflowCheck(FlowGraphCompiler* compiler,
+static void Emit54BitOverflowCheck(FlowGraphCompiler* compiler,
                                    Label* overflow,
                                    Register result) {
   if (FLAG_throw_on_javascript_int_overflow) {
     ASSERT(overflow != NULL);
     __ movq(TMP, result);  // result is a tagged Smi.
-    // Bits 54...64 must be all 0 or all 1. (It would be bit 53, but result
+    // Bits 55...64 must be all 0 or all 1. (It would be bit 54, but result
     // is tagged.)
-    __ shlq(result, Immediate(64 - 54));
-    __ sarq(result, Immediate(64 - 54));
+    __ shlq(result, Immediate(64 - 55));
+    __ sarq(result, Immediate(64 - 55));
     __ cmpq(result, TMP);
-    __ j(NOT_EQUAL, overflow);  // 53-bit overflow.
+    __ j(NOT_EQUAL, overflow);  // 54-bit overflow.
+    __ cmpq(result, Immediate(-0x1FFFFFFFFFFFFF-1));
+    __ j(EQUAL, overflow);  // The most negative 54-bit int is also disallowed.
   }
 }
 
 
 static void EmitSmiShiftLeft(FlowGraphCompiler* compiler,
                              BinarySmiOpInstr* shift_left) {
   const bool is_truncating = shift_left->is_truncating();
   const LocationSummary& locs = *shift_left->locs();
   Register left = locs.in(0).reg();
   Register result = locs.out().reg();
@@ skipping 23 matching lines @@
         Register temp = locs.temp(0).reg();
         __ movq(temp, left);
         __ shlq(left, Immediate(value));
         __ sarq(left, Immediate(value));
         __ cmpq(left, temp);
         __ j(NOT_EQUAL, deopt);  // Overflow.
       }
       // Shift for result now we know there is no overflow.
       __ shlq(left, Immediate(value));
     }
-    Emit53BitOverflowCheck(compiler, deopt, result);
+    Emit54BitOverflowCheck(compiler, deopt, result);
     return;
   }
 
   // Right (locs.in(1)) is not constant.
   Register right = locs.in(1).reg();
   Range* right_range = shift_left->right()->definition()->range();
   if (shift_left->left()->BindsToConstant() && !is_truncating) {
     // TODO(srdjan): Implement code below for is_truncating().
     // If left is constant, we know the maximal allowed size for right.
     const Object& obj = shift_left->left()->BoundConstant();
     if (obj.IsSmi()) {
       const intptr_t left_int = Smi::Cast(obj).Value();
       if (left_int == 0) {
         __ cmpq(right, Immediate(0));
         __ j(NEGATIVE, deopt);
         return;
       }
       const intptr_t max_right = kSmiBits - Utils::HighestBit(left_int);
       const bool right_needs_check =
           (right_range == NULL) ||
           !right_range->IsWithin(0, max_right - 1);
       if (right_needs_check) {
         __ cmpq(right,
           Immediate(reinterpret_cast<int64_t>(Smi::New(max_right))));
         __ j(ABOVE_EQUAL, deopt);
       }
       __ SmiUntag(right);
       __ shlq(left, right);
     }
-    Emit53BitOverflowCheck(compiler, deopt, result);
+    Emit54BitOverflowCheck(compiler, deopt, result);
     return;
   }
 
   const bool right_needs_check =
       (right_range == NULL) || !right_range->IsWithin(0, (Smi::kBits - 1));
   ASSERT(right == RCX);  // Count must be in RCX
   if (is_truncating) {
     if (right_needs_check) {
       const bool right_may_be_negative =
           (right_range == NULL) ||
@@ skipping 30 matching lines @@
     __ movq(temp, left);
     __ SmiUntag(right);
     // Overflow test (preserve temp and right);
     __ shlq(left, right);
     __ sarq(left, right);
     __ cmpq(left, temp);
     __ j(NOT_EQUAL, deopt);  // Overflow.
     // Shift for result now we know there is no overflow.
     __ shlq(left, right);
   }
-  Emit53BitOverflowCheck(compiler, deopt, result);
+  Emit54BitOverflowCheck(compiler, deopt, result);
 }
 
 
 static bool CanBeImmediate(const Object& constant) {
   return constant.IsSmi() &&
     Immediate(reinterpret_cast<int64_t>(constant.raw())).is_int32();
 }
 
 
 LocationSummary* BinarySmiOpInstr::MakeLocationSummary() const {
@@ skipping 178 matching lines @@
 
         __ sarq(left, Immediate(value));
         __ SmiTag(left);
         break;
       }
 
       default:
         UNREACHABLE();
         break;
     }
-    Emit53BitOverflowCheck(compiler, deopt, result);
+    Emit54BitOverflowCheck(compiler, deopt, result);
     return;
   }  // locs()->in(1).IsConstant().
 
 
   if (locs()->in(1).IsStackSlot()) {
     const Address& right = locs()->in(1).ToStackSlotAddress();
     switch (op_kind()) {
       case Token::kADD: {
         __ addq(left, right);
         if (deopt != NULL) __ j(OVERFLOW, deopt);
@@ skipping 22 matching lines @@
       }
       case Token::kBIT_XOR: {
         // No overflow check.
         __ xorq(left, right);
         break;
       }
       default:
         UNREACHABLE();
         break;
     }
-    Emit53BitOverflowCheck(compiler, deopt, result);
+    Emit54BitOverflowCheck(compiler, deopt, result);
     return;
   }  // locs()->in(1).IsStackSlot().
 
   // if locs()->in(1).IsRegister.
   Register right = locs()->in(1).reg();
   switch (op_kind()) {
     case Token::kADD: {
       __ addq(left, right);
       if (deopt != NULL) __ j(OVERFLOW, deopt);
       break;
@@ skipping 109 matching lines @@
     case Token::kAND: {
       // Flow graph builder has dissected this operation to guarantee correct
       // behavior (short-circuit evaluation).
       UNREACHABLE();
       break;
     }
     default:
       UNREACHABLE();
       break;
   }
-  Emit53BitOverflowCheck(compiler, deopt, result);
+  Emit54BitOverflowCheck(compiler, deopt, result);
 }
 
 
 LocationSummary* CheckEitherNonSmiInstr::MakeLocationSummary() const {
   intptr_t left_cid = left()->Type()->ToCid();
   intptr_t right_cid = right()->Type()->ToCid();
   ASSERT((left_cid != kDoubleCid) && (right_cid != kDoubleCid));
   const intptr_t kNumInputs = 2;
   const bool need_temp = (left_cid != kSmiCid) && (right_cid != kSmiCid);
   const intptr_t kNumTemps = need_temp ? 1 : 0;
@@ skipping 1160 matching lines @@
 
 void UnarySmiOpInstr::EmitNativeCode(FlowGraphCompiler* compiler) {
   Register value = locs()->in(0).reg();
   ASSERT(value == locs()->out().reg());
   switch (op_kind()) {
     case Token::kNEGATE: {
       Label* deopt = compiler->AddDeoptStub(deopt_id(),
                                             kDeoptUnaryOp);
       __ negq(value);
       __ j(OVERFLOW, deopt);
-      Emit53BitOverflowCheck(compiler, deopt, value);
+      Emit54BitOverflowCheck(compiler, deopt, value);
       break;
     }
     case Token::kBIT_NOT:
       __ notq(value);
       __ andq(value, Immediate(~kSmiTagMask));  // Remove inverted smi-tag.
       break;
     default:
       UNREACHABLE();
   }
 }
@@ skipping 40 matching lines @@
   ASSERT(result != temp);
   __ movsd(value_double, FieldAddress(value_obj, Double::value_offset()));
   __ cvttsd2siq(result, value_double);
   // Overflow is signalled with minint.
   Label do_call, done;
   // Check for overflow and that it fits into Smi.
   __ movq(temp, result);
   __ shlq(temp, Immediate(1));
   __ j(OVERFLOW, &do_call, Assembler::kNearJump);
   __ SmiTag(result);
-  Emit53BitOverflowCheck(compiler, &do_call, result);
+  Emit54BitOverflowCheck(compiler, &do_call, result);
   __ jmp(&done);
   __ Bind(&do_call);
   ASSERT(instance_call()->HasICData());
   const ICData& ic_data = *instance_call()->ic_data();
   ASSERT((ic_data.NumberOfChecks() == 1));
   const Function& target = Function::ZoneHandle(ic_data.GetTargetAt(0));
 
   const intptr_t kNumberOfArguments = 1;
   __ pushq(value_obj);
   compiler->GenerateStaticCall(deopt_id(),
@@ skipping 25 matching lines @@
   Register temp = locs()->temp(0).reg();
 
   __ cvttsd2siq(result, value);
   // Overflow is signalled with minint.
   Label do_call, done;
   // Check for overflow and that it fits into Smi.
   __ movq(temp, result);
   __ shlq(temp, Immediate(1));
   __ j(OVERFLOW, deopt);
   __ SmiTag(result);
-  Emit53BitOverflowCheck(compiler, deopt, result);
+  Emit54BitOverflowCheck(compiler, deopt, result);
 }
 
 
 LocationSummary* DoubleToDoubleInstr::MakeLocationSummary() const {
   const intptr_t kNumInputs = 1;
   const intptr_t kNumTemps = 0;
   LocationSummary* result =
       new LocationSummary(kNumInputs, kNumTemps, LocationSummary::kNoCall);
   result->set_in(0, Location::RequiresFpuRegister());
   result->set_out(Location::RequiresFpuRegister());
@@ skipping 590 matching lines @@
                          PcDescriptors::kOther,
                          locs());
   __ Drop(2);  // Discard type arguments and receiver.
 }
 
 }  // namespace dart
 
 #undef __
 
 #endif  // defined TARGET_ARCH_X64