[interpreter] Fix feedback collection for negation.

We'd sometimes forget that the input was not originally a numeric.

Bug: v8:7135
Change-Id: I8bc690cc0c2dfac8a2a218ca56352b6a569825dc
Reviewed-on: https://chromium-review.googlesource.com/793039Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Reviewed-by: Mythri Alle <mythria@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49667}

src/interpreter/interpreter-generator.cc

@@ -1230,8 +1230,8 @@ class UnaryNumericOpAssembler : public InterpreterAssembler {
       BIND(&if_bigint);
       {
         var_result.Bind(BigIntOp(value));
-        var_feedback.Bind(SmiOr(var_feedback.value(),
-                                SmiConstant(BinaryOperationFeedback::kBigInt)));
+        CombineFeedback(&var_feedback,
+                        SmiConstant(BinaryOperationFeedback::kBigInt));
         Goto(&end);
       }
 
@@ -1264,8 +1264,8 @@ class UnaryNumericOpAssembler : public InterpreterAssembler {
 
     BIND(&do_float_op);
     {
-      var_feedback.Bind(SmiOr(var_feedback.value(),
-                              SmiConstant(BinaryOperationFeedback::kNumber)));
+      CombineFeedback(&var_feedback,
+                      SmiConstant(BinaryOperationFeedback::kNumber));
       var_result.Bind(
           AllocateHeapNumberWithValue(FloatOp(var_float_value.value())));
       Goto(&end);
@@ -1295,12 +1295,14 @@ class NegateAssemblerImpl : public UnaryNumericOpAssembler {
     GotoIf(SmiEqual(smi_value, SmiConstant(Smi::kMinValue)), &if_min_smi);
 
     // Else simply subtract operand from 0.
-    var_feedback->Bind(SmiConstant(BinaryOperationFeedback::kSignedSmall));
+    CombineFeedback(var_feedback,
+                    SmiConstant(BinaryOperationFeedback::kSignedSmall));
     var_result.Bind(SmiSub(SmiConstant(0), smi_value));
     Goto(&end);
 
     BIND(&if_zero);
-    var_feedback->Bind(SmiConstant(BinaryOperationFeedback::kNumber));
+    CombineFeedback(var_feedback,
+                    SmiConstant(BinaryOperationFeedback::kNumber));
     var_result.Bind(MinusZeroConstant());
     Goto(&end);
 
@@ -1395,9 +1397,8 @@ class IncDecAssembler : public UnaryNumericOpAssembler {
     }
 
     BIND(&if_notoverflow);
-    var_feedback->Bind(
-        SmiOr(var_feedback->value(),
-              SmiConstant(BinaryOperationFeedback::kSignedSmall)));
+    CombineFeedback(var_feedback,
+                    SmiConstant(BinaryOperationFeedback::kSignedSmall));
     return BitcastWordToTaggedSigned(Projection(0, pair));
   }
 

test/mjsunit/regress/regress-7135.js

+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --opt
+
+function foo() { return -"0" }
+foo();
+%OptimizeFunctionOnNextCall(foo);
+foo();
+assertOptimized(foo);
+
+function bar() { return -"1" }
+bar();
+%OptimizeFunctionOnNextCall(bar);
+bar();
+assertOptimized(bar);