[turbofan] Fix invalid Number.parseInt inlining.

The inlined version of Number.parseInt did a ToInt32 truncation, which
is not what the EcmaScript specification says.

R=jarin@chromium.org
BUG=v8:5538

Review-Url: https://chromiumcodereview.appspot.com/2432143002
Cr-Commit-Position: refs/heads/master@{#40418}

src/compiler/js-builtin-reducer.cc

@@ -887,11 +887,10 @@ Reduction JSBuiltinReducer::ReduceNumberParseInt(Node* node) {
       r.InputsMatchTwo(type_cache_.kSafeInteger,
                        type_cache_.kZeroOrUndefined) ||
       r.InputsMatchTwo(type_cache_.kSafeInteger, type_cache_.kTenOrUndefined)) {
-    // Number.parseInt(a:safe-integer) -> NumberToInt32(a)
-    // Number.parseInt(a:safe-integer,b:#0\/undefined) -> NumberToInt32(a)
-    // Number.parseInt(a:safe-integer,b:#10\/undefined) -> NumberToInt32(a)
-    Node* input = r.GetJSCallInput(0);
-    Node* value = graph()->NewNode(simplified()->NumberToInt32(), input);
+    // Number.parseInt(a:safe-integer) -> a
+    // Number.parseInt(a:safe-integer,b:#0\/undefined) -> a
+    // Number.parseInt(a:safe-integer,b:#10\/undefined) -> a
+    Node* value = r.GetJSCallInput(0);
     return Replace(value);
   }
   return NoChange();

test/mjsunit/compiler/regress-5538.js

+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+(function() {
+  function foo(x) {
+    x = x | 0;
+    return Number.parseInt(x + 1);
+  }
+
+  assertEquals(1, foo(0));
+  assertEquals(2, foo(1));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(Math.pow(2, 31), foo(Math.pow(2, 31) - 1));
+})();
+
+(function() {
+  function foo(x) {
+    x = x | 0;
+    return Number.parseInt(x + 1, 0);
+  }
+
+  assertEquals(1, foo(0));
+  assertEquals(2, foo(1));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(Math.pow(2, 31), foo(Math.pow(2, 31) - 1));
+})();
+
+(function() {
+  function foo(x) {
+    x = x | 0;
+    return Number.parseInt(x + 1, 10);
+  }
+
+  assertEquals(1, foo(0));
+  assertEquals(2, foo(1));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(Math.pow(2, 31), foo(Math.pow(2, 31) - 1));
+})();
+
+(function() {
+  function foo(x) {
+    x = x | 0;
+    return Number.parseInt(x + 1, undefined);
+  }
+
+  assertEquals(1, foo(0));
+  assertEquals(2, foo(1));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(Math.pow(2, 31), foo(Math.pow(2, 31) - 1));
+})();

test/unittests/compiler/js-builtin-reducer-unittest.cc

@@ -1517,7 +1517,7 @@ TEST_F(JSBuiltinReducerTest, NumberParseIntWithIntegral32) {
     Reduction r = Reduce(call);
 
     ASSERT_TRUE(r.Changed());
-    EXPECT_THAT(r.replacement(), IsNumberToInt32(p0));
+    EXPECT_EQ(p0, r.replacement());
   }
 }
 
@@ -1537,7 +1537,7 @@ TEST_F(JSBuiltinReducerTest, NumberParseIntWithIntegral32AndUndefined) {
     Reduction r = Reduce(call);
 
     ASSERT_TRUE(r.Changed());
-    EXPECT_THAT(r.replacement(), IsNumberToInt32(p0));
+    EXPECT_EQ(p0, r.replacement());
   }
 }