tree 92c16b66498f48e303b39c39aa49b80ef89d4bde
parent 3dcb5d13fd7ec3f11c5b57c0bef001067cf1a77f
author Aart Bik <ajcbik@google.com> 1538694645 +0000
committer commit-bot@chromium.org <commit-bot@chromium.org> 1538694645 +0000

[vm/compiler] Fix crashes in AOT X64 DEBUG compiler.

Rationale:
The method ConstructReplacementFor() in range analysis would unconditionally
replace an UnaryInt64Op with an UnaryUint32Op, regardless of whether it contains
an NEGATE or NOT. None of the backends supports a NEGATE UnaryUint32Op,
however (I added a missing assert to X64 for the future, even though we currently
found the issue in the constructor already). Note that alternatively we could implement
NEGATE UnaryUint32Op for all platforms.

Note:
A similar issue was found for TRUNCDIV with a second fuzz test, which is fixed
in same CL with a more general approach.

Bug:
https://github.com/dart-lang/sdk/issues/34678
https://github.com/dart-lang/sdk/issues/34679


Change-Id: I370268620008e5d4cb605c0bd11e423d8fcd5327
Reviewed-on: https://dart-review.googlesource.com/c/78148
Reviewed-by: Alexander Markov <alexmarkov@google.com>
Commit-Queue: Aart Bik <ajcbik@google.com>