[turbofan] x - y < 0 is not equivalent to x < y.

We cannot change x - y < 0 to x < y, because it would only be safe if
x - y cannot overflow, which we don't know in general.

R=jarin@chromium.org
BUG=v8:5129

Review-Url: https://codereview.chromium.org/2090493002
Cr-Commit-Position: refs/heads/master@{#37164}

src/compiler/machine-operator-reducer.cc

@@ -234,18 +234,6 @@ Reduction MachineOperatorReducer::Reduce(Node* node) {
       if (m.IsFoldable()) {  // K < K => K
         return ReplaceBool(m.left().Value() < m.right().Value());
       }
-      if (m.left().IsInt32Sub() && m.right().Is(0)) {  // x - y < 0 => x < y
-        Int32BinopMatcher msub(m.left().node());
-        node->ReplaceInput(0, msub.left().node());
-        node->ReplaceInput(1, msub.right().node());
-        return Changed(node);
-      }
-      if (m.left().Is(0) && m.right().IsInt32Sub()) {  // 0 < x - y => y < x
-        Int32BinopMatcher msub(m.right().node());
-        node->ReplaceInput(0, msub.right().node());
-        node->ReplaceInput(1, msub.left().node());
-        return Changed(node);
-      }
       if (m.LeftEqualsRight()) return ReplaceBool(false);  // x < x => false
       break;
     }
@@ -254,18 +242,6 @@ Reduction MachineOperatorReducer::Reduce(Node* node) {
       if (m.IsFoldable()) {  // K <= K => K
         return ReplaceBool(m.left().Value() <= m.right().Value());
       }
-      if (m.left().IsInt32Sub() && m.right().Is(0)) {  // x - y <= 0 => x <= y
-        Int32BinopMatcher msub(m.left().node());
-        node->ReplaceInput(0, msub.left().node());
-        node->ReplaceInput(1, msub.right().node());
-        return Changed(node);
-      }
-      if (m.left().Is(0) && m.right().IsInt32Sub()) {  // 0 <= x - y => y <= x
-        Int32BinopMatcher msub(m.right().node());
-        node->ReplaceInput(0, msub.right().node());
-        node->ReplaceInput(1, msub.left().node());
-        return Changed(node);
-      }
       if (m.LeftEqualsRight()) return ReplaceBool(true);  // x <= x => true
       break;
     }

test/cctest/compiler/test-machine-operator-reducer.cc

@@ -616,13 +616,8 @@ TEST(ReduceInt32LessThan) {
   R.CheckDontPutConstantOnRight(-440197);
 
   Node* x = R.Parameter(0);
-  Node* y = R.Parameter(1);
-  Node* zero = R.Constant<int32_t>(0);
-  Node* sub = R.graph.NewNode(R.machine.Int32Sub(), x, y);
 
   R.CheckFoldBinop<int32_t>(0, x, x);  // x < x  => 0
-  R.CheckFoldBinop(x, y, sub, zero);   // x - y < 0 => x < y
-  R.CheckFoldBinop(y, x, zero, sub);   // 0 < x - y => y < x
 }
 
 
@@ -640,13 +635,8 @@ TEST(ReduceInt32LessThanOrEqual) {
   FOR_INT32_INPUTS(i) { R.CheckDontPutConstantOnRight<int32_t>(*i); }
 
   Node* x = R.Parameter(0);
-  Node* y = R.Parameter(1);
-  Node* zero = R.Constant<int32_t>(0);
-  Node* sub = R.graph.NewNode(R.machine.Int32Sub(), x, y);
 
   R.CheckFoldBinop<int32_t>(1, x, x);  // x <= x => 1
-  R.CheckFoldBinop(x, y, sub, zero);   // x - y <= 0 => x <= y
-  R.CheckFoldBinop(y, x, zero, sub);   // 0 <= x - y => y <= x
 }
 
 

test/mjsunit/compiler/regress-5129.js

+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function foo($a,$b) {
+ $a = $a|0;
+ $b = $b|0;
+ var $sub = $a - $b;
+ return ($sub|0) < 0;
+}
+
+%OptimizeFunctionOnNextCall(foo);
+assertTrue(foo(0x7fffffff,-1));