[turbofan] Decide lowering for NumberDivide based on feedback.

Again in the spirit of https://chromium-review.googlesource.com/1226033
we can simplify the handling of NumberDivide and decide the lowering
based on the feedback type.

Drive-by-fix: Add test coverage for the relevant corner cases of the
NumberDivide handling in SimplifiedLowering.

Bug: v8:8015
Change-Id: I0edaca0fddb31d64d2c269268e87a32a687a0b26
Reviewed-on: https://chromium-review.googlesource.com/1236262Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#56113}

src/compiler/simplified-lowering.cc

@@ -1954,25 +1954,23 @@ class RepresentationSelector {
         return;
       }
       case IrOpcode::kNumberDivide: {
-        if (BothInputsAreUnsigned32(node) && truncation.IsUsedAsWord32()) {
+        if (TypeOf(node->InputAt(0)).Is(Type::Unsigned32()) &&
+            TypeOf(node->InputAt(1)).Is(Type::Unsigned32()) &&
+            (truncation.IsUsedAsWord32() ||
+             TypeOf(node).Is(Type::Unsigned32()))) {
           // => unsigned Uint32Div
           VisitWord32TruncatingBinop(node);
           if (lower()) DeferReplacement(node, lowering->Uint32Div(node));
           return;
         }
-        if (BothInputsAreSigned32(node)) {
-          if (NodeProperties::GetType(node).Is(Type::Signed32())) {
-            // => signed Int32Div
-            VisitWord32TruncatingBinop(node);
-            if (lower()) DeferReplacement(node, lowering->Int32Div(node));
-            return;
-          }
-          if (truncation.IsUsedAsWord32()) {
-            // => signed Int32Div
-            VisitWord32TruncatingBinop(node);
-            if (lower()) DeferReplacement(node, lowering->Int32Div(node));
-            return;
-          }
+        if (TypeOf(node->InputAt(0)).Is(Type::Signed32()) &&
+            TypeOf(node->InputAt(1)).Is(Type::Signed32()) &&
+            (truncation.IsUsedAsWord32() ||
+             TypeOf(node).Is(Type::Signed32()))) {
+          // => signed Int32Div
+          VisitWord32TruncatingBinop(node);
+          if (lower()) DeferReplacement(node, lowering->Int32Div(node));
+          return;
         }
         // Number x Number => Float64Div
         VisitFloat64Binop(node);

test/mjsunit/compiler/number-divide.js

+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --opt
+
+// Test that NumberDivide with Number feedback works if only in the
+// end SimplifiedLowering figures out that the inputs to this operation
+// are actually Unsigned32.
+(function() {
+  // We need a separately polluted % with NumberOrOddball feedback.
+  function bar(x) { return x / 2; }
+  bar(undefined);  // The % feedback is now NumberOrOddball.
+
+  // Now just use the gadget above in a way that only after RETYPE
+  // in SimplifiedLowering we find out that the `x` is actually in
+  // Unsigned32 range (based on taking the SignedSmall feedback on
+  // the + operator).
+  function foo(x) {
+    x = (x >>> 0) + 1;
+    return bar(x) | 0;
+  }
+
+  assertEquals(1, foo(1));
+  assertEquals(1, foo(2));
+  assertEquals(2, foo(3));
+  assertEquals(2, foo(4));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(1, foo(1));
+  assertEquals(1, foo(2));
+  assertEquals(2, foo(3));
+  assertEquals(2, foo(4));
+  assertOptimized(foo);
+})();
+
+// Test that NumberDivide with Number feedback works if only in the
+// end SimplifiedLowering figures out that the inputs to this operation
+// are actually Signed32.
+(function() {
+  // We need a separately polluted % with NumberOrOddball feedback.
+  function bar(x) { return x / 2; }
+  bar(undefined);  // The % feedback is now NumberOrOddball.
+
+  // Now just use the gadget above in a way that only after RETYPE
+  // in SimplifiedLowering we find out that the `x` is actually in
+  // Signed32 range (based on taking the SignedSmall feedback on
+  // the + operator).
+  function foo(x) {
+    x = (x | 0) + 1;
+    return bar(x) | 0;
+  }
+
+  assertEquals(1, foo(1));
+  assertEquals(1, foo(2));
+  assertEquals(2, foo(3));
+  assertEquals(2, foo(4));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(1, foo(1));
+  assertEquals(1, foo(2));
+  assertEquals(2, foo(3));
+  assertEquals(2, foo(4));
+  assertOptimized(foo);
+})();