[maglev][arm64] Ensure we zero-extend in Int32Multiply

victorgomes · V8 LUCI CQ · commit e0052e7af9c9 · 2025-12-09T07:10:18.000-08:00
Fixed: 466786677 Change-Id: Ie75222393743a8beeb99f9382dc6d345b8f62604 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7241729 Auto-Submit: Victor Gomes <victorgomes@chromium.org> Commit-Queue: Darius Mercadier <dmercadier@chromium.org> Reviewed-by: Darius Mercadier <dmercadier@chromium.org> Commit-Queue: Victor Gomes <victorgomes@chromium.org> Cr-Commit-Position: refs/heads/main@{#104206}
diff --git a/src/maglev/arm64/maglev-ir-arm64.cc b/src/maglev/arm64/maglev-ir-arm64.cc
@@ -323,7 +323,7 @@ void Int32Multiply::GenerateCode(MaglevAssembler* masm,
   __ Smull(out, left, right);
 
   // Making sure that the 32-bit output is zero-extended.
-  __ Move(out.W(), out.W());
+  __ Mov(out.W(), out.W());
 }
 
 void Int32MultiplyOverflownBits::SetValueLocationConstraints() {
@@ -468,7 +468,7 @@ void Int32MultiplyWithOverflow::GenerateCode(MaglevAssembler* masm,
 
   // Making sure that the 32-bit output is zero-extended (and moving it to the
   // right register if {out_alias_input} is true).
-  __ Move(out, res.W());
+  __ Mov(out, res.W());
 }
 
 void Int32DivideWithOverflow::SetValueLocationConstraints() {
@@ -536,7 +536,7 @@ void Int32DivideWithOverflow::GenerateCode(MaglevAssembler* masm,
   __ CompareAndBranch(temp, Immediate(0), ne,
                       __ GetDeoptLabel(this, DeoptimizeReason::kNotInt32));
 
-  __ Move(out, res);
+  __ Mov(out, res);
 }
 
 void Int32ModulusWithOverflow::SetValueLocationConstraints() {
diff --git a/test/mjsunit/maglev/regress-466786677.js b/test/mjsunit/maglev/regress-466786677.js
@@ -0,0 +1,22 @@
+// Copyright 2025 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function trigger(cond) {
+  let o = {};
+  let mul = (cond ? 1 : 0x80000000) | 0;
+  print(mul);
+  let idx = (mul * 2) | 0;
+  print(idx);
+  o[0] = 1.1;
+  if (cond) o[1] = 2.2;
+  return o[idx];
+}
+
+%PrepareFunctionForOptimization(trigger);
+trigger(true);
+trigger(false);
+%OptimizeMaglevOnNextCall(trigger);
+trigger(false);

Original file line number	Diff line number	Diff line change
`@@ -323,7 +323,7 @@ void Int32Multiply::GenerateCode(MaglevAssembler* masm,`
`323`	`323`	`__ Smull(out, left, right);`
`324`	`324`
`325`	`325`	`// Making sure that the 32-bit output is zero-extended.`
`326`		`- __ Move(out.W(), out.W());`
	`326`	`+ __ Mov(out.W(), out.W());`
`327`	`327`	`}`
`328`	`328`
`329`	`329`	`void Int32MultiplyOverflownBits::SetValueLocationConstraints() {`
`@@ -468,7 +468,7 @@ void Int32MultiplyWithOverflow::GenerateCode(MaglevAssembler* masm,`
`468`	`468`
`469`	`469`	`// Making sure that the 32-bit output is zero-extended (and moving it to the`
`470`	`470`	`// right register if {out_alias_input} is true).`
`471`		`- __ Move(out, res.W());`
	`471`	`+ __ Mov(out, res.W());`
`472`	`472`	`}`
`473`	`473`
`474`	`474`	`void Int32DivideWithOverflow::SetValueLocationConstraints() {`
`@@ -536,7 +536,7 @@ void Int32DivideWithOverflow::GenerateCode(MaglevAssembler* masm,`
`536`	`536`	`__ CompareAndBranch(temp, Immediate(0), ne,`
`537`	`537`	`__ GetDeoptLabel(this, DeoptimizeReason::kNotInt32));`
`538`	`538`
`539`		`- __ Move(out, res);`
	`539`	`+ __ Mov(out, res);`
`540`	`540`	`}`
`541`	`541`
`542`	`542`	`void Int32ModulusWithOverflow::SetValueLocationConstraints() {`