[asm.js] Fix numeric literal negation in multiplication.

R=clemensh@chromium.org
TEST=mjsunit/asm/int32-mul
BUG=chromium:715482

Change-Id: I525e901fd6ade101999694a53d5147b6e4ccc2e5
Reviewed-on: https://chromium-review.googlesource.com/488024Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44892}

src/asmjs/asm-parser.cc

@@ -1599,7 +1599,7 @@ AsmType* AsmJsParser::UnaryExpression() {
   return ret;
 }
 
-// 6.8.8 MultaplicativeExpression
+// 6.8.8 MultiplicativeExpression
 AsmType* AsmJsParser::MultiplicativeExpression() {
   uint32_t uvalue;
   if (CheckForUnsignedBelow(0x100000, &uvalue)) {
@@ -1609,14 +1609,16 @@ AsmType* AsmJsParser::MultiplicativeExpression() {
       if (!a->IsA(AsmType::Int())) {
         FAILn("Expected int");
       }
-      current_function_builder_->EmitI32Const(static_cast<int32_t>(uvalue));
+      int32_t value = static_cast<int32_t>(uvalue);
+      current_function_builder_->EmitI32Const(value);
       current_function_builder_->Emit(kExprI32Mul);
       return AsmType::Intish();
     }
     scanner_.Rewind();
   } else if (Check('-')) {
     if (CheckForUnsignedBelow(0x100000, &uvalue)) {
-      current_function_builder_->EmitI32Const(-static_cast<int32_t>(uvalue));
+      int32_t value = -static_cast<int32_t>(uvalue);
+      current_function_builder_->EmitI32Const(value);
       if (Check('*')) {
         AsmType* a;
         RECURSEn(a = UnaryExpression());
@@ -1643,7 +1645,8 @@ AsmType* AsmJsParser::MultiplicativeExpression() {
           if (!a->IsA(AsmType::Int())) {
             FAILn("Integer multiply of expects int");
           }
-          current_function_builder_->EmitI32Const(static_cast<int32_t>(uvalue));
+          int32_t value = -static_cast<int32_t>(uvalue);
+          current_function_builder_->EmitI32Const(value);
           current_function_builder_->Emit(kExprI32Mul);
           return AsmType::Intish();
         }
@@ -1655,7 +1658,8 @@ AsmType* AsmJsParser::MultiplicativeExpression() {
         if (!a->IsA(AsmType::Int())) {
           FAILn("Integer multiply of expects int");
         }
-        current_function_builder_->EmitI32Const(static_cast<int32_t>(uvalue));
+        int32_t value = static_cast<int32_t>(uvalue);
+        current_function_builder_->EmitI32Const(value);
         current_function_builder_->Emit(kExprI32Mul);
         return AsmType::Intish();
       }

src/asmjs/asm-parser.h

@@ -294,7 +294,7 @@ class AsmJsParser {
   AsmType* MemberExpression();           // 6.8.5 MemberExpression
   AsmType* AssignmentExpression();       // 6.8.6 AssignmentExpression
   AsmType* UnaryExpression();            // 6.8.7 UnaryExpression
-  AsmType* MultiplicativeExpression();   // 6.8.8 MultaplicativeExpression
+  AsmType* MultiplicativeExpression();   // 6.8.8 MultiplicativeExpression
   AsmType* AdditiveExpression();         // 6.8.9 AdditiveExpression
   AsmType* ShiftExpression();            // 6.8.10 ShiftExpression
   AsmType* RelationalExpression();       // 6.8.11 RelationalExpression

test/mjsunit/asm/int32-mul.js

@@ -6,7 +6,7 @@ function Module(stdlib, foreign, heap) {
   "use asm";
   function f1(i) {
     i = i|0;
-    return (i | 0) * 3 | 0;
+    return (i | 0) * -3 | 0;
   }
   function f2(i) {
     i = i|0;
@@ -26,7 +26,7 @@ function Module(stdlib, foreign, heap) {
 var m = Module(this, {}, new ArrayBuffer(1024));
 
 for (var i = -2147483648; i < 2147483648; i += 3999771) {
-  assertEquals(i * 3 | 0, m.f1(i));
+  assertEquals(i * -3 | 0, m.f1(i));
   assertEquals(i * 7 | 0, m.f2(i));
   assertEquals(i * 1024 | 0, m.f3(i));
   assertEquals(i * 333339 | 0, m.f4(i));