[turbofan] Fix simplified lowering of SpeculativeNumberModulus

If the inputs are Unsigned32OrMinusZeroOrNaN and we want to compile for
an Unsigned32 result, we still need to deopt if the RHS is zero (because
that must produce NaN).

Bug: chromium:1028862
Change-Id: Ib5b7cd10f8c4ec9a76b75a2b408729f1ca86ea3e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1943150Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Michael Stanton <mvstanton@chromium.org>
Auto-Submit: Georg Neis <neis@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#65260}

src/compiler/simplified-lowering.cc

@@ -1565,7 +1565,7 @@ class RepresentationSelector {
       } else if (BothInputsAre(node, Type::Unsigned32OrMinusZeroOrNaN())) {
         VisitBinop(node, lhs_use, rhs_use, MachineRepresentation::kWord32,
                    Type::Unsigned32());
-        if (lower()) DeferReplacement(node, lowering->Uint32Mod(node));
+        if (lower()) ChangeToUint32OverflowOp(node);
       } else {
         VisitBinop(node, lhs_use, rhs_use, MachineRepresentation::kWord32,
                    Type::Signed32());

test/mjsunit/compiler/regress-1028862.js

+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function foo() {
+  for (let i = 0; i < 5; i++) {
+    // Only allocate feedback vector after the first round so that we get Smi
+    // feedback for the modulus operation.
+    if (i == 1) %PrepareFunctionForOptimization(foo);
+    1 == new Date(42).getMilliseconds() % i;
+  }
+}
+
+foo();
+%OptimizeFunctionOnNextCall(foo);
+foo();