[turbofan] Re-enable FindOrderedHashMapEntryForInt32Key optimization.

This optimization was disabled because 32-bit builds didn't properly
find certain integer keys in maps anymore. The reason was that the
runtime wasn't using ComputeIntegerHash for the full Signed32 range,
but only for the SignedSmall range.

This change improves the ARES-6 Basic test by around 6-7% on the steady
state.

Bug: chromium:77459, v8:6410, v8:6354, v8:6278, v8:6344
Change-Id: Ifae64e6b23ca8acee4c792be299f64caf951242f
Reviewed-on: https://chromium-review.googlesource.com/737871Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#48905}

src/compiler/simplified-lowering.cc

@@ -2961,8 +2961,19 @@ class RepresentationSelector {
         return SetOutput(node, MachineRepresentation::kTagged);
 
       case IrOpcode::kFindOrderedHashMapEntry: {
-        VisitBinop(node, UseInfo::AnyTagged(),
-                   MachineRepresentation::kTaggedSigned);
+        Type* const key_type = TypeOf(node->InputAt(1));
+        if (key_type->Is(Type::Signed32OrMinusZero())) {
+          VisitBinop(node, UseInfo::AnyTagged(), UseInfo::TruncatingWord32(),
+                     MachineRepresentation::kWord32);
+          if (lower()) {
+            NodeProperties::ChangeOp(
+                node,
+                lowering->simplified()->FindOrderedHashMapEntryForInt32Key());
+          }
+        } else {
+          VisitBinop(node, UseInfo::AnyTagged(),
+                     MachineRepresentation::kTaggedSigned);
+        }
         return;
       }
 

src/objects.cc

@@ -2398,11 +2398,12 @@ Object* GetSimpleHash(Object* object) {
   if (object->IsHeapNumber()) {
     double num = HeapNumber::cast(object)->value();
     if (std::isnan(num)) return Smi::FromInt(Smi::kMaxValue);
-    if (i::IsMinusZero(num)) num = 0;
-    if (IsSmiDouble(num)) {
-      return Smi::FromInt(FastD2I(num))->GetHash();
-    }
-    uint32_t hash = ComputeLongHash(double_to_uint64(num));
+    // Use ComputeIntegerHash for all values in Signed32 range, including -0,
+    // which is considered equal to 0 because collections use SameValueZero.
+    int32_t inum = FastD2I(num);
+    uint32_t hash = (FastI2D(inum) == num)
+                        ? ComputeIntegerHash(inum)
+                        : ComputeLongHash(double_to_uint64(num));
     return Smi::FromInt(hash & Smi::kMaxValue);
   }
   if (object->IsName()) {

test/mjsunit/regress/regress-crbug-774459.js

+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+(function() {
+  const m = new Map();
+  const k = Math.pow(2, 31) - 1;
+  m.set(k, 1);
+
+  function foo(m, k) {
+    return m.get(k | 0);
+  }
+
+  assertEquals(1, foo(m, k));
+  assertEquals(1, foo(m, k));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(1, foo(m, k));
+})();