[vm] Disable incorrect widening of smis to int32

The optimization of widening smi operations to int32 does not account
for uses which depend on the range of operation (e.g. BinarySmiOp
which uses the result of widened operation becomes incorrect).

Closes dart-lang/sdk#32619

Change-Id: Ia419c7bbec93679a5cdd1d16ffa3f51824fc08bb
Reviewed-on: https://dart-review.googlesource.com/c/47661
Commit-Queue: Alexander Markov <alexmarkov@google.com>
Reviewed-by: Vyacheslav Egorov <vegorov@google.com>

Author: alexmarkov

runtime/tests/vm/dart/regress32619_test.dart

@@ -0,0 +1,41 @@
+// Copyright (c) 2018, the Dart project authors.  Please see the AUTHORS file
+// for details. All rights reserved. Use of this source code is governed by a
+// BSD-style license that can be found in the LICENSE file.
+
+// Regression test for dartbug.com/32619: incorrect widening of smis to int32.
+
+// VMOptions=--optimization-counter-threshold=5 --no-background-compilation
+
+import "package:expect/expect.dart";
+import 'dart:typed_data';
+
+const int _digitBits = 32;
+const int _digitMask = (1 << _digitBits) - 1;
+
+const int _halfDigitBits = _digitBits >> 1;
+const int _halfDigitMask = (1 << _halfDigitBits) - 1;
+
+int _mulAdd(Uint32List multiplicandDigits, int i, Uint32List accumulatorDigits,
+    int j, int n) {
+  int carry = 0;
+  while (--n >= 0) {
+    int ml = multiplicandDigits[i] & _halfDigitMask;
+    int mh = multiplicandDigits[i++] >> _halfDigitBits;
+    int ph = mh * 4;
+    int q1 = ((ph & _halfDigitMask) << _halfDigitBits);
+    int pl = 4 * ml + q1 + accumulatorDigits[j];
+    carry = (pl >> _digitBits) + (ph >> _halfDigitBits);
+    accumulatorDigits[j++] = pl & _digitMask;
+  }
+
+  return carry;
+}
+
+main() {
+  var multiplicandDigits = new Uint32List.fromList([0, 294967296, 0, 0]);
+  var accumulatorDigits = new Uint32List.fromList([0, 4, 4, 0, 0, 0]);
+
+  var d1 = _mulAdd(multiplicandDigits, 0, accumulatorDigits, 0, 2);
+
+  Expect.equals(0, d1);
+}

runtime/vm/compiler/backend/flow_graph.cc

@@ -21,6 +21,8 @@
 namespace dart {
 
 #if defined(TARGET_ARCH_ARM) || defined(TARGET_ARCH_IA32)
+// Smi->Int32 widening pass is disabled due to dartbug.com/32619.
+DEFINE_FLAG(bool, use_smi_widening, false, "Enable Smi->Int32 widening pass.");
 DEFINE_FLAG(bool, trace_smi_widening, false, "Trace Smi->Int32 widening pass.");
 #endif
 DEFINE_FLAG(bool, prune_dead_locals, true, "optimize dead locals away");
@@ -1863,6 +1865,10 @@ static bool BenefitsFromWidening(BinarySmiOpInstr* smi_op) {
 }
 
 void FlowGraph::WidenSmiToInt32() {
+  if (!FLAG_use_smi_widening) {
+    return;
+  }
+
   GrowableArray<BinarySmiOpInstr*> candidates;
 
   // Step 1. Collect all instructions that potentially benefit from widening of