From 55d238395f21267b815ed15a0199bc1b51ea8121 Mon Sep 17 00:00:00 2001 From: epertoso Date: Tue, 28 Jun 2016 11:35:12 -0700 Subject: [PATCH 1/3] deps: cherry-pick 588e15c from V8 upstream Original commit message: Fixes a bug in cmpw. The opcodes for 'cmpw r/m16, r16' and 'cmpw r16, r/m16' were swapped, causing a few issues when less than/greater than comparison were performed. Adds a regression test. BUG=621926 Committed: https://crrev.com/efa7095e3e360fbadbe909d831ac11b268ca26b0 Review-Url: https://codereview.chromium.org/2103713003 Cr-Original-Commit-Position: refs/heads/master@{#37339} Cr-Commit-Position: refs/heads/master@{#37345} --- deps/v8/src/ia32/assembler-ia32.cc | 4 ++-- deps/v8/src/ia32/disasm-ia32.cc | 21 +++++++++++++++++---- 2 files changed, 19 insertions(+), 6 deletions(-) diff --git a/deps/v8/src/ia32/assembler-ia32.cc b/deps/v8/src/ia32/assembler-ia32.cc index 150131cdbc0e66..680c40c6a1172e 100644 --- a/deps/v8/src/ia32/assembler-ia32.cc +++ b/deps/v8/src/ia32/assembler-ia32.cc @@ -787,14 +787,14 @@ void Assembler::cmpw(const Operand& op, Immediate imm16) { void Assembler::cmpw(Register reg, const Operand& op) { EnsureSpace ensure_space(this); EMIT(0x66); - EMIT(0x39); + EMIT(0x3B); emit_operand(reg, op); } void Assembler::cmpw(const Operand& op, Register reg) { EnsureSpace ensure_space(this); EMIT(0x66); - EMIT(0x3B); + EMIT(0x39); emit_operand(reg, op); } diff --git a/deps/v8/src/ia32/disasm-ia32.cc b/deps/v8/src/ia32/disasm-ia32.cc index 3cd0ac6e52fbe9..b669d8264206f5 100644 --- a/deps/v8/src/ia32/disasm-ia32.cc +++ b/deps/v8/src/ia32/disasm-ia32.cc @@ -1602,11 +1602,19 @@ int DisassemblerIA32::InstructionDecode(v8::internal::Vector out_buffer, while (*data == 0x66) data++; if (*data == 0xf && data[1] == 0x1f) { AppendToBuffer("nop"); // 0x66 prefix - } else if (*data == 0x90) { - AppendToBuffer("nop"); // 0x66 prefix - } else if (*data == 0x8B) { + } else if (*data == 0x39) { data++; - data += PrintOperands("mov_w", REG_OPER_OP_ORDER, data); + data += PrintOperands("cmpw", OPER_REG_OP_ORDER, data); + } else if (*data == 0x3B) { + data++; + data += PrintOperands("cmpw", REG_OPER_OP_ORDER, data); + } else if (*data == 0x81) { + data++; + AppendToBuffer("cmpw "); + data += PrintRightOperand(data); + int imm = *reinterpret_cast(data); + AppendToBuffer(",0x%x", imm); + data += 2; } else if (*data == 0x89) { data++; int mod, regop, rm; @@ -1614,6 +1622,11 @@ int DisassemblerIA32::InstructionDecode(v8::internal::Vector out_buffer, AppendToBuffer("mov_w "); data += PrintRightOperand(data); AppendToBuffer(",%s", NameOfCPURegister(regop)); + } else if (*data == 0x8B) { + data++; + data += PrintOperands("mov_w", REG_OPER_OP_ORDER, data); + } else if (*data == 0x90) { + AppendToBuffer("nop"); // 0x66 prefix } else if (*data == 0xC7) { data++; AppendToBuffer("%s ", "mov_w"); From 83e427db4ca6c8cb958c7d68a3b1d372ba41b4f9 Mon Sep 17 00:00:00 2001 From: epertoso Date: Wed, 29 Jun 2016 01:52:31 -0700 Subject: [PATCH 2/3] deps: cherry-pick c0d4bb8 from V8 upstream Original commit message: Fixes a wrong use of Operand in a test. Operand(reg) -> reg Operand(reg, 0) -> [reg] BUG= Review-Url: https://codereview.chromium.org/2111503002 Cr-Commit-Position: refs/heads/master@{#37370} --- deps/v8/test/cctest/test-assembler-ia32.cc | 41 ++++++++++++++++++++++ 1 file changed, 41 insertions(+) diff --git a/deps/v8/test/cctest/test-assembler-ia32.cc b/deps/v8/test/cctest/test-assembler-ia32.cc index 12733c2cdda3dd..e4cac56c150819 100644 --- a/deps/v8/test/cctest/test-assembler-ia32.cc +++ b/deps/v8/test/cctest/test-assembler-ia32.cc @@ -1497,4 +1497,45 @@ TEST(AssemblerIa32JumpTables2) { } } +TEST(Regress621926) { + // Bug description: + // The opcodes for cmpw r/m16, r16 and cmpw r16, r/m16 were swapped. + // This was causing non-commutative comparisons to produce the wrong result. + CcTest::InitializeVM(); + Isolate* isolate = reinterpret_cast(CcTest::isolate()); + HandleScope scope(isolate); + Assembler assm(isolate, nullptr, 0); + + uint16_t a = 42; + + Label fail; + __ push(ebx); + __ mov(ebx, Immediate(reinterpret_cast(&a))); + __ mov(eax, Immediate(41)); + __ cmpw(eax, Operand(ebx, 0)); + __ j(above_equal, &fail); + __ cmpw(Operand(ebx, 0), eax); + __ j(below_equal, &fail); + __ mov(eax, 1); + __ pop(ebx); + __ ret(0); + __ bind(&fail); + __ mov(eax, 0); + __ pop(ebx); + __ ret(0); + + CodeDesc desc; + assm.GetCode(&desc); + Handle code = isolate->factory()->NewCode( + desc, Code::ComputeFlags(Code::STUB), Handle()); + +#ifdef OBJECT_PRINT + OFStream os(stdout); + code->Print(os); +#endif + + F0 f = FUNCTION_CAST(code->entry()); + CHECK_EQ(f(), 1); +} + #undef __ From 8c09bb9415d32b71b0e00ef95afdc644b2e6760c Mon Sep 17 00:00:00 2001 From: Cristian Cavalli Date: Tue, 9 Aug 2016 14:37:13 -0700 Subject: [PATCH 3/3] deps: Bump V8 version to 5.1.281.79 --- deps/v8/include/v8-version.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/deps/v8/include/v8-version.h b/deps/v8/include/v8-version.h index d4129c32f45938..c31389824080f9 100644 --- a/deps/v8/include/v8-version.h +++ b/deps/v8/include/v8-version.h @@ -11,7 +11,7 @@ #define V8_MAJOR_VERSION 5 #define V8_MINOR_VERSION 1 #define V8_BUILD_NUMBER 281 -#define V8_PATCH_LEVEL 78 +#define V8_PATCH_LEVEL 79 // Use 1 for candidates and 0 otherwise. // (Boolean macro values are not supported by all preprocessors.)