[turbofan] Avoid unnecessary bit materialization in CheckedInt32Mod.

The slow-path of CheckedInt32Mod(x,y) when x is found to be negative
still had the power of two right hand side optimization, and thus would
perform a dynamic check on y. Now the same dynamic check was done for
the fast-path, and the word operations for this check were pure, leading
to weird bit materialization in TurboFan (due to sea of nodes). But
there's not really a point to be clever for the slow-path, so we just
insert the Uint32Mod operation directly here, which completely avoids
the problem.

This improves the Kraken/audio-oscillator test from around 73ms to 69ms.

Bug: v8:8069
Change-Id: Ie8ea667136c95df2bd8c5ba56ebbc6bd2442ff23
Reviewed-on: https://chromium-review.googlesource.com/c/1259063Reviewed-by: Sigurd Schneider <sigurds@chromium.org>
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#56370}

src/compiler/effect-control-linearizer.cc

@@ -1862,8 +1862,11 @@ Node* EffectControlLinearizer::LowerCheckedInt32Mod(Node* node,
 
   __ Bind(&if_lhs_negative);
   {
-    // The {lhs} is a negative integer.
-    Node* res = BuildUint32Mod(__ Int32Sub(zero, lhs), rhs);
+    // The {lhs} is a negative integer. This is very unlikely and
+    // we intentionally don't use the BuildUint32Mod() here, which
+    // would try to figure out whether {rhs} is a power of two,
+    // since this is intended to be a slow-path.
+    Node* res = __ Uint32Mod(__ Int32Sub(zero, lhs), rhs);
 
     // Check if we would have to return -0.
     __ DeoptimizeIf(DeoptimizeReason::kMinusZero, VectorSlotPair(),

test/mjsunit/compiler/number-modulus.js

@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --allow-natives-syntax --opt
+// Flags: --allow-natives-syntax --opt --noalways-opt
 
 // Test that NumberModulus with Number feedback works if only in the
 // end SimplifiedLowering figures out that the inputs to this operation
@@ -154,3 +154,25 @@
   assertEquals(1, foo(-1));
   assertOptimized(foo);
 })();
+
+// Test that CheckedInt32Mod handles the slow-path (when
+// the left hand side is negative) correctly.
+(function() {
+  // We need a SpeculativeNumberModulus with SignedSmall feedback.
+  function foo(x, y) {
+    return x % y;
+  }
+
+  assertEquals(0, foo(2, 1));
+  assertEquals(0, foo(2, 2));
+  assertEquals(-1, foo(-3, 2));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(0, foo(2, 1));
+  assertEquals(0, foo(2, 2));
+  assertEquals(-1, foo(-3, 2));
+  assertOptimized(foo);
+
+  // Now `foo` should deoptimize if the result is -0.
+  assertEquals(-0, foo(-2, 2));
+  assertUnoptimized(foo);
+})();