[ubsan] Avoid signed left shifts

The workaround is simple: cast to unsigned before shifting.

Bug: v8:3770
Change-Id: I5f0f7af697ec5db0ab1df3d061008940c83c5c56
Reviewed-on: https://chromium-review.googlesource.com/c/1436215Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Deepti Gandluri <gdeepti@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#59140}

src/base/ieee754.cc

@@ -309,7 +309,7 @@ int32_t __ieee754_rem_pio2(double x, double *y) {
   GET_LOW_WORD(low, x);
   SET_LOW_WORD(z, low);
   e0 = (ix >> 20) - 1046; /* e0 = ilogb(z)-23; */
-  SET_HIGH_WORD(z, ix - static_cast<int32_t>(e0 << 20));
+  SET_HIGH_WORD(z, ix - static_cast<int32_t>(static_cast<uint32_t>(e0) << 20));
   for (i = 0; i < 2; i++) {
     tx[i] = static_cast<double>(static_cast<int32_t>(z));
     z = (z - tx[i]) * two24;
@@ -1569,9 +1569,12 @@ double exp(double x) {
   /* x is now in primary range */
   t = x * x;
   if (k >= -1021) {
-    INSERT_WORDS(twopk, 0x3FF00000 + (k << 20), 0);
+    INSERT_WORDS(
+        twopk,
+        0x3FF00000 + static_cast<int32_t>(static_cast<uint32_t>(k) << 20), 0);
   } else {
-    INSERT_WORDS(twopk, 0x3FF00000 + ((k + 1000) << 20), 0);
+    INSERT_WORDS(twopk, 0x3FF00000 + (static_cast<uint32_t>(k + 1000) << 20),
+                 0);
   }
   c = x - t * (P1 + t * (P2 + t * (P3 + t * (P4 + t * P5))));
   if (k == 0) {
@@ -2341,7 +2344,10 @@ double expm1(double x) {
   if (k == 0) {
     return x - (x * e - hxs); /* c is 0 */
   } else {
-    INSERT_WORDS(twopk, 0x3FF00000 + (k << 20), 0); /* 2^k */
+    INSERT_WORDS(
+        twopk,
+        0x3FF00000 + static_cast<int32_t>(static_cast<uint32_t>(k) << 20),
+        0); /* 2^k */
     e = (x * (e - c) - c);
     e -= hxs;
     if (k == -1) return 0.5 * (x - e) - 0.5;

src/compiler/backend/instruction.h

@@ -195,7 +195,8 @@ class UnallocatedOperand final : public InstructionOperand {
       : UnallocatedOperand(virtual_register) {
     DCHECK(policy == FIXED_SLOT);
     value_ |= BasicPolicyField::encode(policy);
-    value_ |= static_cast<int64_t>(index) << FixedSlotIndexField::kShift;
+    value_ |= static_cast<uint64_t>(static_cast<int64_t>(index))
+              << FixedSlotIndexField::kShift;
     DCHECK(this->fixed_slot_index() == index);
   }
 
@@ -382,7 +383,8 @@ class ImmediateOperand : public InstructionOperand {
   explicit ImmediateOperand(ImmediateType type, int32_t value)
       : InstructionOperand(IMMEDIATE) {
     value_ |= TypeField::encode(type);
-    value_ |= static_cast<int64_t>(value) << ValueField::kShift;
+    value_ |= static_cast<uint64_t>(static_cast<int64_t>(value))
+              << ValueField::kShift;
   }
 
   ImmediateType type() const { return TypeField::decode(value_); }
@@ -420,7 +422,8 @@ class LocationOperand : public InstructionOperand {
     DCHECK(IsSupportedRepresentation(rep));
     value_ |= LocationKindField::encode(location_kind);
     value_ |= RepresentationField::encode(rep);
-    value_ |= static_cast<int64_t>(index) << IndexField::kShift;
+    value_ |= static_cast<uint64_t>(static_cast<int64_t>(index))
+              << IndexField::kShift;
   }
 
   int index() const {

src/compiler/linkage.h

@@ -153,7 +153,9 @@ class LinkageLocation {
   LinkageLocation(LocationType type, int32_t location,
                   MachineType machine_type) {
     bit_field_ = TypeField::encode(type) |
-                 ((location << LocationField::kShift) & LocationField::kMask);
+                 // {location} can be -1 (ANY_REGISTER).
+                 ((static_cast<uint32_t>(location) << LocationField::kShift) &
+                  LocationField::kMask);
     machine_type_ = machine_type;
   }
 

src/field-index-inl.h

@@ -57,7 +57,7 @@ inline int FieldIndex::GetLoadByFieldIndex() const {
     result -= FixedArray::kHeaderSize / kTaggedSize;
     result = -result - 1;
   }
-  result <<= 1;
+  result = static_cast<uint32_t>(result) << 1;
   return is_double() ? (result | 1) : result;
 }
 

src/interpreter/interpreter-assembler.cc

@@ -242,12 +242,12 @@ Node* InterpreterAssembler::LoadRegister(Node* reg_index) {
 
 Node* InterpreterAssembler::LoadRegister(Register reg) {
   return Load(MachineType::AnyTagged(), GetInterpretedFramePointer(),
-              IntPtrConstant(reg.ToOperand() << kSystemPointerSizeLog2));
+              IntPtrConstant(reg.ToOperand() * kSystemPointerSize));
 }
 
 Node* InterpreterAssembler::LoadAndUntagRegister(Register reg) {
   return LoadAndUntagSmi(GetInterpretedFramePointer(),
-                         reg.ToOperand() << kSystemPointerSizeLog2);
+                         reg.ToOperand() * kSystemPointerSize);
 }
 
 Node* InterpreterAssembler::LoadRegisterAtOperandIndex(int operand_index) {
@@ -298,7 +298,7 @@ Node* InterpreterAssembler::RegisterLocationInRegisterList(
 void InterpreterAssembler::StoreRegister(Node* value, Register reg) {
   StoreNoWriteBarrier(
       MachineRepresentation::kTagged, GetInterpretedFramePointer(),
-      IntPtrConstant(reg.ToOperand() << kSystemPointerSizeLog2), value);
+      IntPtrConstant(reg.ToOperand() * kSystemPointerSize), value);
 }
 
 void InterpreterAssembler::StoreRegister(Node* value, Node* reg_index) {
@@ -308,7 +308,7 @@ void InterpreterAssembler::StoreRegister(Node* value, Node* reg_index) {
 }
 
 void InterpreterAssembler::StoreAndTagRegister(Node* value, Register reg) {
-  int offset = reg.ToOperand() << kSystemPointerSizeLog2;
+  int offset = reg.ToOperand() * kSystemPointerSize;
   StoreAndTagSmi(GetInterpretedFramePointer(), offset, value);
 }
 

src/objects/smi.h

@@ -54,7 +54,7 @@ class Smi : public Object {
   static inline Smi FromIntptr(intptr_t value) {
     DCHECK(Smi::IsValid(value));
     int smi_shift_bits = kSmiTagSize + kSmiShiftSize;
-    return Smi((value << smi_shift_bits) | kSmiTag);
+    return Smi((static_cast<Address>(value) << smi_shift_bits) | kSmiTag);
   }
 
   template <typename E,

src/parsing/parser.cc

@@ -179,7 +179,8 @@ bool Parser::ShortcutNumericLiteralBinaryExpression(Expression** x,
         return true;
       }
       case Token::SHL: {
-        int value = DoubleToInt32(x_val) << (DoubleToInt32(y_val) & 0x1F);
+        int value =
+            base::ShlWithWraparound(DoubleToInt32(x_val), DoubleToInt32(y_val));
         *x = factory()->NewNumberLiteral(value, pos);
         return true;
       }

src/source-position-table.cc

@@ -48,11 +48,12 @@ void SubtractFromEntry(PositionTableEntry& value,
 // Helper: Encode an integer.
 template <typename T>
 void EncodeInt(std::vector<byte>& bytes, T value) {
+  typedef typename std::make_unsigned<T>::type unsigned_type;
   // Zig-zag encoding.
   static const int kShift = sizeof(T) * kBitsPerByte - 1;
-  value = ((value << 1) ^ (value >> kShift));
+  value = ((static_cast<unsigned_type>(value) << 1) ^ (value >> kShift));
   DCHECK_GE(value, 0);
-  auto encoded = static_cast<typename std::make_unsigned<T>::type>(value);
+  unsigned_type encoded = static_cast<unsigned_type>(value);
   bool more;
   do {
     more = encoded > ValueBits::kMax;

src/wasm/decoder.h

@@ -341,7 +341,9 @@ class Decoder {
       DCHECK_LT(pc, end_);
       b = *pc;
       TRACE_IF(trace, "%02x ", b);
-      result = result | ((static_cast<IntType>(b) & 0x7f) << shift);
+      typedef typename std::make_unsigned<IntType>::type Unsigned;
+      result = result |
+               (static_cast<Unsigned>(static_cast<IntType>(b) & 0x7f) << shift);
     }
     if (!is_last_byte && (b & 0x80)) {
       // Make sure that we only instantiate the template for valid byte indexes.

src/wasm/wasm-interpreter.cc

@@ -1974,15 +1974,18 @@ class ThreadImpl {
     Push(WasmValue(Simd128(res)));                                       \
     return true;                                                         \
   }
-        SHIFT_CASE(I32x4Shl, i32x4, int4, 4, a << imm.shift)
+        SHIFT_CASE(I32x4Shl, i32x4, int4, 4,
+                   static_cast<uint32_t>(a) << imm.shift)
         SHIFT_CASE(I32x4ShrS, i32x4, int4, 4, a >> imm.shift)
         SHIFT_CASE(I32x4ShrU, i32x4, int4, 4,
                    static_cast<uint32_t>(a) >> imm.shift)
-        SHIFT_CASE(I16x8Shl, i16x8, int8, 8, a << imm.shift)
+        SHIFT_CASE(I16x8Shl, i16x8, int8, 8,
+                   static_cast<uint16_t>(a) << imm.shift)
         SHIFT_CASE(I16x8ShrS, i16x8, int8, 8, a >> imm.shift)
         SHIFT_CASE(I16x8ShrU, i16x8, int8, 8,
                    static_cast<uint16_t>(a) >> imm.shift)
-        SHIFT_CASE(I8x16Shl, i8x16, int16, 16, a << imm.shift)
+        SHIFT_CASE(I8x16Shl, i8x16, int16, 16,
+                   static_cast<uint8_t>(a) << imm.shift)
         SHIFT_CASE(I8x16ShrS, i8x16, int16, 16, a >> imm.shift)
         SHIFT_CASE(I8x16ShrU, i8x16, int16, 16,
                    static_cast<uint8_t>(a) >> imm.shift)

src/x64/assembler-x64-inl.h

@@ -160,14 +160,14 @@ void Assembler::emit_optional_rex_32(Operand op) {
 // byte 1 of 3-byte VEX
 void Assembler::emit_vex3_byte1(XMMRegister reg, XMMRegister rm,
                                 LeadingOpcode m) {
-  byte rxb = ~((reg.high_bit() << 2) | rm.high_bit()) << 5;
+  byte rxb = static_cast<byte>(~((reg.high_bit() << 2) | rm.high_bit())) << 5;
   emit(rxb | m);
 }
 
 
 // byte 1 of 3-byte VEX
 void Assembler::emit_vex3_byte1(XMMRegister reg, Operand rm, LeadingOpcode m) {
-  byte rxb = ~((reg.high_bit() << 2) | rm.data().rex) << 5;
+  byte rxb = static_cast<byte>(~((reg.high_bit() << 2) | rm.data().rex)) << 5;
   emit(rxb | m);
 }
 
@@ -175,7 +175,7 @@ void Assembler::emit_vex3_byte1(XMMRegister reg, Operand rm, LeadingOpcode m) {
 // byte 1 of 2-byte VEX
 void Assembler::emit_vex2_byte1(XMMRegister reg, XMMRegister v, VectorLength l,
                                 SIMDPrefix pp) {
-  byte rv = ~((reg.high_bit() << 4) | v.code()) << 3;
+  byte rv = static_cast<byte>(~((reg.high_bit() << 4) | v.code())) << 3;
   emit(rv | l | pp);
 }
 

test/cctest/compiler/test-machine-operator-reducer.cc

@@ -335,7 +335,7 @@ TEST(ReduceWord32Shl) {
   FOR_INT32_INPUTS(i) {
     for (int y = 0; y < 32; y++) {
       int32_t x = *i;
-      R.CheckFoldBinop<int32_t>(x << y, x, y);
+      R.CheckFoldBinop<int32_t>(base::ShlWithWraparound(x, y), x, y);
     }
   }
 
@@ -354,7 +354,7 @@ TEST(ReduceWord64Shl) {
   FOR_INT64_INPUTS(i) {
     for (int64_t y = 0; y < 64; y++) {
       int64_t x = *i;
-      R.CheckFoldBinop<int64_t>(x << y, x, y);
+      R.CheckFoldBinop<int64_t>(base::ShlWithWraparound(x, y), x, y);
     }
   }
 

test/cctest/compiler/test-run-machops.cc

@@ -1438,11 +1438,11 @@ TEST(RunInt32AddAndWord32SarP) {
 TEST(RunInt32AddAndWord32ShlP) {
   {
     RawMachineAssemblerTester<int32_t> m(
-        MachineType::Uint32(), MachineType::Int32(), MachineType::Uint32());
+        MachineType::Uint32(), MachineType::Uint32(), MachineType::Uint32());
     m.Return(m.Int32Add(m.Parameter(0),
                         m.Word32Shl(m.Parameter(1), m.Parameter(2))));
     FOR_UINT32_INPUTS(i) {
-      FOR_INT32_INPUTS(j) {
+      FOR_UINT32_INPUTS(j) {
         FOR_UINT32_SHIFTS(shift) {
           // Use uint32_t because signed overflow is UB in C.
           int32_t expected = *i + (*j << shift);
@@ -1453,10 +1453,10 @@ TEST(RunInt32AddAndWord32ShlP) {
   }
   {
     RawMachineAssemblerTester<int32_t> m(
-        MachineType::Int32(), MachineType::Uint32(), MachineType::Uint32());
+        MachineType::Uint32(), MachineType::Uint32(), MachineType::Uint32());
     m.Return(m.Int32Add(m.Word32Shl(m.Parameter(0), m.Parameter(1)),
                         m.Parameter(2)));
-    FOR_INT32_INPUTS(i) {
+    FOR_UINT32_INPUTS(i) {
       FOR_UINT32_SHIFTS(shift) {
         FOR_UINT32_INPUTS(k) {
           // Use uint32_t because signed overflow is UB in C.
@@ -1604,7 +1604,7 @@ TEST(RunInt32AddInBranch) {
                 right = *j >> shift;
                 break;
               case IrOpcode::kWord32Shl:
-                right = *j << shift;
+                right = static_cast<uint32_t>(*j) << shift;
                 break;
               case IrOpcode::kWord32Shr:
                 right = static_cast<uint32_t>(*j) >> shift;
@@ -1690,7 +1690,7 @@ TEST(RunInt32AddInComparison) {
                 right = *j >> shift;
                 break;
               case IrOpcode::kWord32Shl:
-                right = *j << shift;
+                right = static_cast<uint32_t>(*j) << shift;
                 break;
               case IrOpcode::kWord32Shr:
                 right = static_cast<uint32_t>(*j) >> shift;
@@ -1784,11 +1784,11 @@ TEST(RunInt32SubAndWord32SarP) {
 TEST(RunInt32SubAndWord32ShlP) {
   {
     RawMachineAssemblerTester<int32_t> m(
-        MachineType::Uint32(), MachineType::Int32(), MachineType::Uint32());
+        MachineType::Uint32(), MachineType::Uint32(), MachineType::Uint32());
     m.Return(m.Int32Sub(m.Parameter(0),
                         m.Word32Shl(m.Parameter(1), m.Parameter(2))));
     FOR_UINT32_INPUTS(i) {
-      FOR_INT32_INPUTS(j) {
+      FOR_UINT32_INPUTS(j) {
         FOR_UINT32_SHIFTS(shift) {
           int32_t expected = *i - (*j << shift);
           CHECK_EQ(expected, m.Call(*i, *j, shift));
@@ -1798,10 +1798,10 @@ TEST(RunInt32SubAndWord32ShlP) {
   }
   {
     RawMachineAssemblerTester<int32_t> m(
-        MachineType::Int32(), MachineType::Uint32(), MachineType::Uint32());
+        MachineType::Uint32(), MachineType::Uint32(), MachineType::Uint32());
     m.Return(m.Int32Sub(m.Word32Shl(m.Parameter(0), m.Parameter(1)),
                         m.Parameter(2)));
-    FOR_INT32_INPUTS(i) {
+    FOR_UINT32_INPUTS(i) {
       FOR_UINT32_SHIFTS(shift) {
         FOR_UINT32_INPUTS(k) {
           // Use uint32_t because signed overflow is UB in C.
@@ -1949,7 +1949,7 @@ TEST(RunInt32SubInBranch) {
                 right = *j >> shift;
                 break;
               case IrOpcode::kWord32Shl:
-                right = *j << shift;
+                right = static_cast<uint32_t>(*j) << shift;
                 break;
               case IrOpcode::kWord32Shr:
                 right = static_cast<uint32_t>(*j) >> shift;
@@ -2035,7 +2035,7 @@ TEST(RunInt32SubInComparison) {
                 right = *j >> shift;
                 break;
               case IrOpcode::kWord32Shl:
-                right = *j << shift;
+                right = static_cast<uint32_t>(*j) << shift;
                 break;
               case IrOpcode::kWord32Shr:
                 right = static_cast<uint32_t>(*j) >> shift;
@@ -2627,7 +2627,7 @@ TEST(RunWord32AndInBranch) {
                 right = *j >> shift;
                 break;
               case IrOpcode::kWord32Shl:
-                right = *j << shift;
+                right = static_cast<uint32_t>(*j) << shift;
                 break;
               case IrOpcode::kWord32Shr:
                 right = static_cast<uint32_t>(*j) >> shift;
@@ -2856,7 +2856,7 @@ TEST(RunWord32OrInBranch) {
                 right = *j >> shift;
                 break;
               case IrOpcode::kWord32Shl:
-                right = *j << shift;
+                right = static_cast<uint32_t>(*j) << shift;
                 break;
               case IrOpcode::kWord32Shr:
                 right = static_cast<uint32_t>(*j) >> shift;
@@ -3082,7 +3082,7 @@ TEST(RunWord32XorInBranch) {
                 right = *j >> shift;
                 break;
               case IrOpcode::kWord32Shl:
-                right = *j << shift;
+                right = static_cast<uint32_t>(*j) << shift;
                 break;
               case IrOpcode::kWord32Shr:
                 right = static_cast<uint32_t>(*j) >> shift;

test/cctest/interpreter/test-interpreter.cc

@@ -7,6 +7,7 @@
 #include "src/v8.h"
 
 #include "src/api-inl.h"
+#include "src/base/overflowing-math.h"
 #include "src/execution.h"
 #include "src/handles.h"
 #include "src/interpreter/bytecode-array-builder.h"
@@ -239,7 +240,7 @@ static double BinaryOpC(Token::Value op, double lhs, double rhs) {
     case Token::Value::MUL:
       return lhs * rhs;
     case Token::Value::DIV:
-      return lhs / rhs;
+      return base::Divide(lhs, rhs);
     case Token::Value::MOD:
       return Modulo(lhs, rhs);
     case Token::Value::BIT_OR:
@@ -252,10 +253,7 @@ static double BinaryOpC(Token::Value op, double lhs, double rhs) {
       return (v8::internal::DoubleToInt32(lhs) &
               v8::internal::DoubleToInt32(rhs));
     case Token::Value::SHL: {
-      int32_t val = v8::internal::DoubleToInt32(lhs);
-      uint32_t count = v8::internal::DoubleToUint32(rhs) & 0x1F;
-      int32_t result = val << count;
-      return result;
+      return base::ShlWithWraparound(DoubleToInt32(lhs), DoubleToInt32(rhs));
     }
     case Token::Value::SAR: {
       int32_t val = v8::internal::DoubleToInt32(lhs);

test/cctest/wasm/test-run-wasm-64.cc

@@ -32,9 +32,9 @@ WASM_EXEC_TEST(I64Const) {
 
 WASM_EXEC_TEST(I64Const_many) {
   int cntr = 0;
-  FOR_INT32_INPUTS(i) {
+  FOR_UINT32_INPUTS(i) {
     WasmRunner<int64_t> r(execution_tier);
-    const int64_t kExpectedValue = (static_cast<int64_t>(*i) << 32) | cntr;
+    const int64_t kExpectedValue = (static_cast<uint64_t>(*i) << 32) | cntr;
     // return(kExpectedValue)
     BUILD(r, WASM_I64V(kExpectedValue));
     CHECK_EQ(kExpectedValue, r.Call());
@@ -1172,16 +1172,9 @@ WASM_EXEC_TEST(Call_Int64Sub) {
   BUILD(r, WASM_CALL_FUNCTION(t.function_index(), WASM_GET_LOCAL(0),
                               WASM_GET_LOCAL(1)));
 
-  FOR_INT32_INPUTS(i) {
-    FOR_INT32_INPUTS(j) {
-      int64_t a = static_cast<int64_t>(*i) << 32 |
-                  (static_cast<int64_t>(*j) | 0xFFFFFFFF);
-      int64_t b = static_cast<int64_t>(*j) << 32 |
-                  (static_cast<int64_t>(*i) | 0xFFFFFFFF);
-
-      int64_t expected = static_cast<int64_t>(static_cast<uint64_t>(a) -
-                                              static_cast<uint64_t>(b));
-      CHECK_EQ(expected, r.Call(a, b));
+  FOR_INT64_INPUTS(i) {
+    FOR_INT64_INPUTS(j) {
+      CHECK_EQ(base::SubWithWraparound(*i, *j), r.Call(*i, *j));
     }
   }
 }
@@ -1217,7 +1210,8 @@ WASM_EXEC_TEST(LoadStoreI64_sx) {
       r.builder().BlankMemory();
       memory[size - 1] = static_cast<byte>(i);  // set the high order byte.
 
-      int64_t expected = static_cast<int64_t>(i) << ((size - 1) * 8);
+      int64_t expected = static_cast<uint64_t>(static_cast<int64_t>(i))
+                         << ((size - 1) * 8);
 
       CHECK_EQ(expected, r.Call());
       CHECK_EQ(static_cast<byte>(i), memory[8 + size - 1]);

test/cctest/wasm/test-run-wasm-simd.cc

@@ -158,7 +158,8 @@ int UnsignedGreaterEqual(T a, T b) {
 
 template <typename T>
 T LogicalShiftLeft(T a, int shift) {
-  return a << shift;
+  using UnsignedT = typename std::make_unsigned<T>::type;
+  return static_cast<UnsignedT>(a) << shift;
 }
 
 template <typename T>

test/cctest/wasm/test-run-wasm.cc

@@ -204,7 +204,7 @@ WASM_I32_BINOP_TEST(RemU, uint32_t, b == 0 ? 0xDEADBEEF : a % b)
 WASM_I32_BINOP_TEST(And, int32_t, a& b)
 WASM_I32_BINOP_TEST(Ior, int32_t, a | b)
 WASM_I32_BINOP_TEST(Xor, int32_t, a ^ b)
-WASM_I32_BINOP_TEST(Shl, int32_t, a << (b & 0x1F))
+WASM_I32_BINOP_TEST(Shl, int32_t, base::ShlWithWraparound(a, b))
 WASM_I32_BINOP_TEST(ShrU, uint32_t, a >> (b & 0x1F))
 WASM_I32_BINOP_TEST(ShrS, int32_t, a >> (b & 0x1F))
 WASM_I32_BINOP_TEST(Ror, uint32_t, (a >> (b & 0x1F)) | (a << ((32 - b) & 0x1F)))
@@ -2039,7 +2039,7 @@ WASM_EXEC_TEST(Int32LoadInt16_signext) {
   BUILD(r, WASM_LOAD_MEM(MachineType::Int16(), WASM_GET_LOCAL(0)));
 
   for (int i = 0; i < kNumBytes; i += 2) {
-    int32_t expected = memory[i] | (static_cast<int8_t>(memory[i + 1]) << 8);
+    int32_t expected = static_cast<int16_t>(memory[i] | (memory[i + 1] << 8));
     CHECK_EQ(expected, r.Call(i));
   }
 }
@@ -3307,9 +3307,11 @@ WASM_EXEC_TEST(I32MulOnDifferentRegisters) {
 }
 
 WASM_EXEC_TEST(I32ShlOnDifferentRegisters) {
-  BinOpOnDifferentRegisters<int32_t>(
-      execution_tier, kWasmI32, ArrayVector(kSome32BitInputs), kExprI32Shl,
-      [](int32_t lhs, int32_t rhs, bool* trap) { return lhs << (rhs & 31); });
+  BinOpOnDifferentRegisters<int32_t>(execution_tier, kWasmI32,
+                                     ArrayVector(kSome32BitInputs), kExprI32Shl,
+                                     [](int32_t lhs, int32_t rhs, bool* trap) {
+                                       return base::ShlWithWraparound(lhs, rhs);
+                                     });
 }
 
 WASM_EXEC_TEST(I32ShrSOnDifferentRegisters) {
@@ -3383,9 +3385,11 @@ WASM_EXEC_TEST(I64MulOnDifferentRegisters) {
 }
 
 WASM_EXEC_TEST(I64ShlOnDifferentRegisters) {
-  BinOpOnDifferentRegisters<int64_t>(
-      execution_tier, kWasmI64, ArrayVector(kSome64BitInputs), kExprI64Shl,
-      [](int64_t lhs, int64_t rhs, bool* trap) { return lhs << (rhs & 63); });
+  BinOpOnDifferentRegisters<int64_t>(execution_tier, kWasmI64,
+                                     ArrayVector(kSome64BitInputs), kExprI64Shl,
+                                     [](int64_t lhs, int64_t rhs, bool* trap) {
+                                       return base::ShlWithWraparound(lhs, rhs);
+                                     });
 }
 
 WASM_EXEC_TEST(I64ShrSOnDifferentRegisters) {

test/cctest/wasm/test-wasm-interpreter-entry.cc

@@ -124,7 +124,7 @@ TEST(TestArgumentPassing_double_int64) {
        WASM_CALL_FUNCTION0(f2.function_index())},
       [](int32_t a, int32_t b) {
         int64_t a64 = static_cast<int64_t>(a) & 0xFFFFFFFF;
-        int64_t b64 = static_cast<int64_t>(b) << 32;
+        int64_t b64 = static_cast<uint64_t>(static_cast<int64_t>(b)) << 32;
         return static_cast<double>(a64 | b64);
       });
 

test/unittests/compiler/typer-unittest.cc

@@ -303,7 +303,9 @@ class TyperTest : public TypedGraphTest {
 
 namespace {
 
-int32_t shift_left(int32_t x, int32_t y) { return x << (y & 0x1F); }
+int32_t shift_left(int32_t x, int32_t y) {
+  return static_cast<uint32_t>(x) << (y & 0x1F);
+}
 int32_t shift_right(int32_t x, int32_t y) { return x >> (y & 0x1F); }
 int32_t bit_or(int32_t x, int32_t y) { return x | y; }
 int32_t bit_and(int32_t x, int32_t y) { return x & y; }

test/unittests/interpreter/interpreter-assembler-unittest.cc

@@ -419,8 +419,8 @@ TARGET_TEST_F(InterpreterAssemblerTest, GetContext) {
     EXPECT_THAT(
         m.GetContext(),
         m.IsLoad(MachineType::AnyTagged(), c::IsLoadParentFramePointer(),
-                 c::IsIntPtrConstant(Register::current_context().ToOperand()
-                                     << kPointerSizeLog2)));
+                 c::IsIntPtrConstant(Register::current_context().ToOperand() *
+                                     kPointerSize)));
   }
 }
 
@@ -535,8 +535,8 @@ TARGET_TEST_F(InterpreterAssemblerTest, LoadFeedbackVector) {
 
     Matcher<Node*> load_function_matcher =
         m.IsLoad(MachineType::AnyTagged(), c::IsLoadParentFramePointer(),
-                 c::IsIntPtrConstant(Register::function_closure().ToOperand()
-                                     << kPointerSizeLog2));
+                 c::IsIntPtrConstant(Register::function_closure().ToOperand() *
+                                     kPointerSize));
     Matcher<Node*> load_vector_cell_matcher = m.IsLoad(
         MachineType::AnyTagged(), load_function_matcher,
         c::IsIntPtrConstant(JSFunction::kFeedbackCellOffset - kHeapObjectTag));

test/unittests/wasm/function-body-decoder-unittest.cc

@@ -328,7 +328,8 @@ TEST_F(FunctionBodyDecoderTest, Int32Const) {
 TEST_F(FunctionBodyDecoderTest, Int64Const) {
   const int kInc = 4498211;
   for (int32_t i = kMinInt; i < kMaxInt - kInc; i = i + kInc) {
-    byte code[] = {WASM_I64V((static_cast<int64_t>(i) << 32) | i)};
+    byte code[] = {
+        WASM_I64V((static_cast<uint64_t>(static_cast<int64_t>(i)) << 32) | i)};
     EXPECT_VERIFIES_C(l_l, code);
   }
 }