[turbofan] Fix arm backend matching of (x >>> 24) & 0xffff.

We emitted rotation by 24 bits with bitwise and, but that is wrong
because the low 8 bits can wrap around and "leak" into the result.

Bug: chromium:739902
Change-Id: Id49251e89405afb1581b8c60cde808c2d8bf693d
Reviewed-on: https://chromium-review.googlesource.com/645848Reviewed-by: Martyn Capewell <martyn.capewell@arm.com>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Commit-Queue: Jaroslav Sevcik <jarin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47746}

src/compiler/arm/instruction-selector-arm.cc

@@ -866,11 +866,18 @@ void InstructionSelector::VisitWord32And(Node* node) {
         uint32_t const shift = mshr.right().Value();
 
         if (((shift == 8) || (shift == 16) || (shift == 24)) &&
-            ((value == 0xff) || (value == 0xffff))) {
-          // Merge SHR into AND by emitting a UXTB or UXTH instruction with a
+            (value == 0xff)) {
+          // Merge SHR into AND by emitting a UXTB instruction with a
           // bytewise rotation.
-          Emit((value == 0xff) ? kArmUxtb : kArmUxth,
-               g.DefineAsRegister(m.node()), g.UseRegister(mshr.left().node()),
+          Emit(kArmUxtb, g.DefineAsRegister(m.node()),
+               g.UseRegister(mshr.left().node()),
+               g.TempImmediate(mshr.right().Value()));
+          return;
+        } else if (((shift == 8) || (shift == 16)) && (value == 0xffff)) {
+          // Merge SHR into AND by emitting a UXTH instruction with a
+          // bytewise rotation.
+          Emit(kArmUxth, g.DefineAsRegister(m.node()),
+               g.UseRegister(mshr.left().node()),
                g.TempImmediate(mshr.right().Value()));
           return;
         } else if (IsSupported(ARMv7) && (width != 0) &&

test/mjsunit/compiler/regress-739902.js

+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+(function() {
+  function f(x) {
+    return String.fromCharCode(x >>> 24);
+  };
+
+  var e = 0x41000001;
+
+  f(e);
+  %OptimizeFunctionOnNextCall(f);
+  assertEquals("A", f(e));
+})();
+
+(function() {
+  function f(x) {
+    return (x >>> 24) & 0xffff;
+  };
+
+  f(1);
+  %OptimizeFunctionOnNextCall(f);
+  assertEquals(0, f(1));
+  assertEquals(100, f((100 << 24) + 42));
+})();

test/unittests/compiler/arm/instruction-selector-arm-unittest.cc

@@ -3155,7 +3155,7 @@ TEST_F(InstructionSelectorTest, Word32AndWithWord32ShrAnd0xff) {
 
 
 TEST_F(InstructionSelectorTest, Word32AndWithWord32ShrAnd0xffff) {
-  TRACED_FORRANGE(int32_t, shr, 1, 3) {
+  TRACED_FORRANGE(int32_t, shr, 1, 2) {
     StreamBuilder m(this, MachineType::Int32(), MachineType::Int32());
     Node* const p0 = m.Parameter(0);
     Node* const r = m.Word32And(m.Word32Shr(p0, m.Int32Constant(shr * 8)),
@@ -3167,7 +3167,7 @@ TEST_F(InstructionSelectorTest, Word32AndWithWord32ShrAnd0xffff) {
     ASSERT_EQ(2U, s[0]->InputCount());
     EXPECT_EQ(shr * 8, s.ToInt32(s[0]->InputAt(1)));
   }
-  TRACED_FORRANGE(int32_t, shr, 1, 3) {
+  TRACED_FORRANGE(int32_t, shr, 1, 2) {
     StreamBuilder m(this, MachineType::Int32(), MachineType::Int32());
     Node* const p0 = m.Parameter(0);
     Node* const r = m.Word32And(m.Int32Constant(0xffff),