[turbofan] Lower asm.js truncations to JSToNumber.

- JSBitwiseOr(x, 0) => Word32Or(NumberToInt32(JSToNumber(x)), 0)
- JSMultiply(x, 1) => NumberMultiply(JSToNumber(x), 1)

R=jarin@chromium.org

Review URL: https://codereview.chromium.org/706863003

Cr-Commit-Position: refs/heads/master@{#25198}
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@25198 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

src/compiler/js-typed-lowering.cc

@@ -29,6 +29,16 @@ static void RelaxEffects(Node* node) {
 }
 
 
+JSTypedLowering::JSTypedLowering(JSGraph* jsgraph)
+    : jsgraph_(jsgraph), simplified_(jsgraph->zone()) {
+  Factory* factory = zone()->isolate()->factory();
+  Handle<Object> zero = factory->NewNumber(0.0);
+  Handle<Object> one = factory->NewNumber(1.0);
+  zero_range_ = Type::Range(zero, zero, zone());
+  one_range_ = Type::Range(one, one, zone());
+}
+
+
 JSTypedLowering::~JSTypedLowering() {}
 
 
@@ -259,6 +269,36 @@ Reduction JSTypedLowering::ReduceJSAdd(Node* node) {
 }
 
 
+Reduction JSTypedLowering::ReduceJSBitwiseOr(Node* node) {
+  JSBinopReduction r(this, node);
+  if (r.BothInputsAre(Type::Primitive()) || r.OneInputIs(zero_range_)) {
+    // TODO(jarin): Propagate frame state input from non-primitive input node to
+    // JSToNumber node.
+    // TODO(titzer): some Smi bitwise operations don't really require going
+    // all the way to int32, which can save tagging/untagging for some
+    // operations
+    // on some platforms.
+    // TODO(turbofan): make this heuristic configurable for code size.
+    r.ConvertInputsToInt32(true, true);
+    return r.ChangeToPureOperator(machine()->Word32Or());
+  }
+  return NoChange();
+}
+
+
+Reduction JSTypedLowering::ReduceJSMultiply(Node* node) {
+  JSBinopReduction r(this, node);
+  if (r.BothInputsAre(Type::Primitive()) || r.OneInputIs(one_range_)) {
+    // TODO(jarin): Propagate frame state input from non-primitive input node to
+    // JSToNumber node.
+    r.ConvertInputsToNumber();
+    return r.ChangeToPureOperator(simplified()->NumberMultiply());
+  }
+  // TODO(turbofan): relax/remove the effects of this operator in other cases.
+  return NoChange();
+}
+
+
 Reduction JSTypedLowering::ReduceNumberBinop(Node* node,
                                              const Operator* numberOp) {
   JSBinopReduction r(this, node);
@@ -697,7 +737,7 @@ Reduction JSTypedLowering::Reduce(Node* node) {
     case IrOpcode::kJSGreaterThanOrEqual:
       return ReduceJSComparison(node);
     case IrOpcode::kJSBitwiseOr:
-      return ReduceI32Binop(node, true, true, machine()->Word32Or());
+      return ReduceJSBitwiseOr(node);
     case IrOpcode::kJSBitwiseXor:
       return ReduceI32Binop(node, true, true, machine()->Word32Xor());
     case IrOpcode::kJSBitwiseAnd:
@@ -713,7 +753,7 @@ Reduction JSTypedLowering::Reduce(Node* node) {
     case IrOpcode::kJSSubtract:
       return ReduceNumberBinop(node, simplified()->NumberSubtract());
     case IrOpcode::kJSMultiply:
-      return ReduceNumberBinop(node, simplified()->NumberMultiply());
+      return ReduceJSMultiply(node);
     case IrOpcode::kJSDivide:
       return ReduceNumberBinop(node, simplified()->NumberDivide());
     case IrOpcode::kJSModulus:

src/compiler/js-typed-lowering.h

@@ -18,8 +18,7 @@ namespace compiler {
 // Lowers JS-level operators to simplified operators based on types.
 class JSTypedLowering FINAL : public Reducer {
  public:
-  explicit JSTypedLowering(JSGraph* jsgraph)
-      : jsgraph_(jsgraph), simplified_(jsgraph->zone()) {}
+  explicit JSTypedLowering(JSGraph* jsgraph);
   virtual ~JSTypedLowering();
 
   virtual Reduction Reduce(Node* node) OVERRIDE;
@@ -34,6 +33,8 @@ class JSTypedLowering FINAL : public Reducer {
   Reduction ReplaceEagerly(Node* old, Node* node);
   Reduction ReplaceWith(Node* node) { return Reducer::Replace(node); }
   Reduction ReduceJSAdd(Node* node);
+  Reduction ReduceJSBitwiseOr(Node* node);
+  Reduction ReduceJSMultiply(Node* node);
   Reduction ReduceJSComparison(Node* node);
   Reduction ReduceJSLoadProperty(Node* node);
   Reduction ReduceJSStoreProperty(Node* node);
@@ -55,6 +56,8 @@ class JSTypedLowering FINAL : public Reducer {
 
   JSGraph* jsgraph_;
   SimplifiedOperatorBuilder simplified_;
+  Type* zero_range_;
+  Type* one_range_;
 };
 
 }  // namespace compiler