[turbofan] Add missing Word8/16 -> Word64 representation changes.

Word8 and Word16 representation is treated like Word32 for the sake of
TurboFan's representation selection, but this was missing from the
Word64 conversions.

Bug: chromium:884933, v8:4153, v8:7881, v8:8171, v8:8178
Change-Id: If7b69cdd02b12546d87bba0643e9ee9cb35cb299
Reviewed-on: https://chromium-review.googlesource.com/1229953Reviewed-by: Georg Neis <neis@chromium.org>
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#55983}

src/compiler/representation-change.cc

@@ -962,7 +962,7 @@ Node* RepresentationChanger::GetWord64RepresentationFor(
         jsgraph()->common()->DeadValue(MachineRepresentation::kWord64), node);
   } else if (output_rep == MachineRepresentation::kBit) {
     return node;  // Sloppy comparison -> word64
-  } else if (output_rep == MachineRepresentation::kWord32) {
+  } else if (IsWord(output_rep)) {
     if (output_type.Is(Type::Unsigned32())) {
       op = machine()->ChangeUint32ToUint64();
     } else if (output_type.Is(Type::Signed32())) {

test/cctest/compiler/test-representation-change.cc

@@ -348,6 +348,14 @@ static void CheckChange(IrOpcode::Value expected, MachineRepresentation from,
 }
 
 TEST(Word64) {
+  CheckChange(IrOpcode::kChangeInt32ToInt64, MachineRepresentation::kWord8,
+              TypeCache::Get().kInt8, MachineRepresentation::kWord64);
+  CheckChange(IrOpcode::kChangeUint32ToUint64, MachineRepresentation::kWord8,
+              TypeCache::Get().kUint8, MachineRepresentation::kWord64);
+  CheckChange(IrOpcode::kChangeInt32ToInt64, MachineRepresentation::kWord16,
+              TypeCache::Get().kInt16, MachineRepresentation::kWord64);
+  CheckChange(IrOpcode::kChangeUint32ToUint64, MachineRepresentation::kWord16,
+              TypeCache::Get().kUint16, MachineRepresentation::kWord64);
   CheckChange(IrOpcode::kChangeInt32ToInt64, MachineRepresentation::kWord32,
               Type::Signed32(), MachineRepresentation::kWord64);
   CheckChange(IrOpcode::kChangeUint32ToUint64, MachineRepresentation::kWord32,

test/mjsunit/regress/regress-crbug-884933.js

+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+// Test Uint8 -> Word64 conversions.
+(function() {
+  function bar(x, y) {
+    return x + y;
+  }
+
+  bar(0.1, 0.2);
+  bar(0.1, 0.2);
+
+  function foo(dv) {
+    return bar(dv.getUint8(0, true), 0xFFFFFFFF);
+  }
+
+  const dv = new DataView(new ArrayBuffer(8));
+  assertEquals(0xFFFFFFFF, foo(dv));
+  assertEquals(0xFFFFFFFF, foo(dv));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(0xFFFFFFFF, foo(dv));
+})();
+
+// Test Int8 -> Word64 conversions.
+(function() {
+  function bar(x, y) {
+    return x + y;
+  }
+
+  bar(0.1, 0.2);
+  bar(0.1, 0.2);
+
+  function foo(dv) {
+    return bar(dv.getInt8(0, true), 0xFFFFFFFF);
+  }
+
+  const dv = new DataView(new ArrayBuffer(8));
+  assertEquals(0xFFFFFFFF, foo(dv));
+  assertEquals(0xFFFFFFFF, foo(dv));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(0xFFFFFFFF, foo(dv));
+})();
+
+// Test Uint16 -> Word64 conversions.
+(function() {
+  function bar(x, y) {
+    return x + y;
+  }
+
+  bar(0.1, 0.2);
+  bar(0.1, 0.2);
+
+  function foo(dv) {
+    return bar(dv.getUint16(0, true), 0xFFFFFFFF);
+  }
+
+  const dv = new DataView(new ArrayBuffer(8));
+  assertEquals(0xFFFFFFFF, foo(dv));
+  assertEquals(0xFFFFFFFF, foo(dv));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(0xFFFFFFFF, foo(dv));
+})();
+
+// Test Int16 -> Word64 conversions.
+(function() {
+  function bar(x, y) {
+    return x + y;
+  }
+
+  bar(0.1, 0.2);
+  bar(0.1, 0.2);
+
+  function foo(dv) {
+    return bar(dv.getInt16(0, true), 0xFFFFFFFF);
+  }
+
+  const dv = new DataView(new ArrayBuffer(8));
+  assertEquals(0xFFFFFFFF, foo(dv));
+  assertEquals(0xFFFFFFFF, foo(dv));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(0xFFFFFFFF, foo(dv));
+})();