[MERGE chakra-core#2486 @ThomsonTan] Discard extra bits for left shift on arm

ThomsonTan · ThomsonTan · commit b5c277f4d7bf · 2017-02-09T14:19:19.000-08:00
Merge pull request chakra-core#2486 from ThomsonTan:FixShiftPeepsOnArm We use `<<` in Lowerer::PeepShl to convert SHR+SHL to AND. `<<` on ARM is implemented via LSL which generates all 0 when shift count is larger than 32. This is inconsistent to implement `<<` in JavaScript which only shift the lower 5-bit. See https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Operators/Bitwise_Operators#Left_shift.
diff --git a/.gitignore b/.gitignore
@@ -77,6 +77,7 @@ install_manifest.txt
 # VIM
 .*.swo
 .*.swp
+tags
 
 # VS Code
 .vscode/
diff --git a/lib/Backend/PreLowerPeeps.cpp b/lib/Backend/PreLowerPeeps.cpp
@@ -98,6 +98,12 @@ IR::Instr *Lowerer::PeepShl(IR::Instr *instrShl)
     instrDef->Remove();
 
     IntConstType oldValue = src2->AsIntConstOpnd()->GetValue();
+
+    // Left shift operator (<<) on arm32 is implemented by LSL which doesn't discard bits beyond lowerest 5-bit.
+    // Need to discard such bits to conform to << in JavaScript. This is not a problem for x86 and x64 because
+    // behavior of SHL is consistent with JavaScript but keep the below line for clarity.
+    oldValue %= sizeof(int32) * 8;
+
     oldValue = ~((1 << oldValue) - 1);
     src2->AsIntConstOpnd()->SetValue(oldValue);
 
diff --git a/test/Bugs/bug10026875.baseline b/test/Bugs/bug10026875.baseline
@@ -0,0 +1,2 @@
+28442624
+28442624
diff --git a/test/Bugs/bug10026875.js b/test/Bugs/bug10026875.js
@@ -0,0 +1,10 @@
+//-------------------------------------------------------------------------------------------------------
+// Copyright (C) Microsoft. All rights reserved.
+// Licensed under the MIT license. See LICENSE.txt file in the project root for full license information.
+//-------------------------------------------------------------------------------------------------------
+
+function test0() {
+  WScript.Echo(28510759.1 >> 49 << 49)
+}
+test0();
+test0();
diff --git a/test/Bugs/rlexe.xml b/test/Bugs/rlexe.xml
@@ -367,4 +367,11 @@
       <compile-flags>-maxinterpretcount:1 -off:simplejit</compile-flags>
     </default>
   </test>
+  <test>
+    <default>
+      <files>bug10026875.js</files>
+      <baseline>bug10026875.baseline</baseline>
+      <compile-flags>-maxinterpretcount:1 -off:simplejit</compile-flags>
+    </default>
+  </test>
 </regress-exe>
