[turbofan] Unify Int32Add/Sub representation selection rules.

Unify the representation selection rules for NumberAdd/Subtract and
SpeculativeNumberAdd/Subtract wrt. Int32Add/Sub selection. We can
safely use Int32Add/Sub as long as the inputs are in the safe additive
integer range and the output is either truncated to Word32 or provably
in Signed32 or Unsigned32 range.

R=jarin@chromium.org

Review-Url: https://codereview.chromium.org/2253293005
Cr-Commit-Position: refs/heads/master@{#38746}

src/compiler/simplified-lowering.cc

@@ -1124,19 +1124,11 @@ class RepresentationSelector {
     if (BothInputsAre(node, Type::PlainPrimitive())) {
       if (truncation.IsUnused()) return VisitUnused(node);
     }
-    if (BothInputsAre(node, Type::Signed32OrMinusZero()) &&
-        NodeProperties::GetType(node)->Is(Type::Signed32())) {
-      // int32 + int32 = int32   ==>   signed Int32Add/Sub
-      VisitInt32Binop(node);
-      if (lower()) ChangeToPureOp(node, Int32Op(node));
-      return;
-    }
-
-    // Use truncation if available.
     if (BothInputsAre(node, type_cache_.kAdditiveSafeIntegerOrMinusZero) &&
-        truncation.IsUsedAsWord32()) {
-      // safe-int + safe-int = x (truncated to int32)
-      // => signed Int32Add/Sub (truncated)
+        (GetUpperBound(node)->Is(Type::Signed32()) ||
+         GetUpperBound(node)->Is(Type::Unsigned32()) ||
+         truncation.IsUsedAsWord32())) {
+      // => Int32Add/Sub
       VisitWord32TruncatingBinop(node);
       if (lower()) ChangeToPureOp(node, Int32Op(node));
       return;
@@ -1387,23 +1379,17 @@ class RepresentationSelector {
 
       case IrOpcode::kNumberAdd:
       case IrOpcode::kNumberSubtract: {
-        if (BothInputsAre(node, Type::Signed32()) &&
-            NodeProperties::GetType(node)->Is(Type::Signed32())) {
-          // int32 + int32 = int32
-          // => signed Int32Add/Sub
-          VisitInt32Binop(node);
-          if (lower()) NodeProperties::ChangeOp(node, Int32Op(node));
-        } else if (BothInputsAre(node,
-                                 type_cache_.kAdditiveSafeIntegerOrMinusZero) &&
-                   truncation.IsUsedAsWord32()) {
-          // safe-int + safe-int = x (truncated to int32)
-          // => signed Int32Add/Sub (truncated)
+        if (BothInputsAre(node, type_cache_.kAdditiveSafeIntegerOrMinusZero) &&
+            (GetUpperBound(node)->Is(Type::Signed32()) ||
+             GetUpperBound(node)->Is(Type::Unsigned32()) ||
+             truncation.IsUsedAsWord32())) {
+          // => Int32Add/Sub
           VisitWord32TruncatingBinop(node);
-          if (lower()) NodeProperties::ChangeOp(node, Int32Op(node));
+          if (lower()) ChangeToPureOp(node, Int32Op(node));
         } else {
           // => Float64Add/Sub
           VisitFloat64Binop(node);
-          if (lower()) NodeProperties::ChangeOp(node, Float64Op(node));
+          if (lower()) ChangeToPureOp(node, Float64Op(node));
         }
         return;
       }

test/mjsunit/compiler/integral32-add-sub.js

+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+(function() {
+  function foo(x) {
+    x = x >>> 0;
+    var y = 0 - 2147483648;
+    return x + y;
+  }
+
+  assertEquals(-2147483648, foo(0));
+  assertEquals(0, foo(2147483648));
+  assertEquals(2147483647, foo(4294967295));
+  %BaselineFunctionOnNextCall(foo);
+  assertEquals(-2147483648, foo(0));
+  assertEquals(0, foo(2147483648));
+  assertEquals(2147483647, foo(4294967295));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(-2147483648, foo(0));
+  assertEquals(0, foo(2147483648));
+  assertEquals(2147483647, foo(4294967295));
+  assertOptimized(foo);
+})();
+
+(function() {
+  function foo(x) {
+    x = x >>> 0;
+    var y = 2147483648;
+    return x - y;
+  }
+
+  assertEquals(-2147483648, foo(0));
+  assertEquals(0, foo(2147483648));
+  assertEquals(2147483647, foo(4294967295));
+  %BaselineFunctionOnNextCall(foo);
+  assertEquals(-2147483648, foo(0));
+  assertEquals(0, foo(2147483648));
+  assertEquals(2147483647, foo(4294967295));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(-2147483648, foo(0));
+  assertEquals(0, foo(2147483648));
+  assertEquals(2147483647, foo(4294967295));
+  assertOptimized(foo);
+})();
+
+(function() {
+  function foo(x) {
+    x = x | 0;
+    var y = 2147483648;
+    return x + y;
+  }
+
+  assertEquals(2147483648, foo(0));
+  assertEquals(0, foo(-2147483648));
+  assertEquals(4294967295, foo(2147483647));
+  %BaselineFunctionOnNextCall(foo);
+  assertEquals(2147483648, foo(0));
+  assertEquals(0, foo(-2147483648));
+  assertEquals(4294967295, foo(2147483647));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(2147483648, foo(0));
+  assertEquals(0, foo(-2147483648));
+  assertEquals(4294967295, foo(2147483647));
+  assertOptimized(foo);
+})();
+
+(function() {
+  function foo(x) {
+    x = x | 0;
+    var y = 0 - 2147483648;
+    return x - y;
+  }
+
+  assertEquals(2147483648, foo(0));
+  assertEquals(0, foo(-2147483648));
+  assertEquals(4294967295, foo(2147483647));
+  %BaselineFunctionOnNextCall(foo);
+  assertEquals(2147483648, foo(0));
+  assertEquals(0, foo(-2147483648));
+  assertEquals(4294967295, foo(2147483647));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(2147483648, foo(0));
+  assertEquals(0, foo(-2147483648));
+  assertEquals(4294967295, foo(2147483647));
+  assertOptimized(foo);
+})();
+
+(function() {
+  function foo(x) {
+    x = x | 0;
+    var y = -0;
+    return x + y;
+  }
+
+  assertEquals(2147483647, foo(2147483647));
+  assertEquals(-2147483648, foo(-2147483648));
+  assertEquals(0, foo(0));
+  %BaselineFunctionOnNextCall(foo);
+  assertEquals(2147483647, foo(2147483647));
+  assertEquals(-2147483648, foo(-2147483648));
+  assertEquals(0, foo(0));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(2147483647, foo(2147483647));
+  assertEquals(-2147483648, foo(-2147483648));
+  assertEquals(0, foo(0));
+  assertOptimized(foo);
+})();
+
+(function() {
+  function foo(x) {
+    var y = (x < 0) ? 4294967295 : 4294967296;
+    var z = (x > 0) ? 2147483647 : 2147483648;
+    return y - z;
+  }
+
+  assertEquals(2147483647, foo(-1));
+  assertEquals(2147483648, foo(0));
+  assertEquals(2147483649, foo(1));
+  %BaselineFunctionOnNextCall(foo);
+  assertEquals(2147483647, foo(-1));
+  assertEquals(2147483648, foo(0));
+  assertEquals(2147483649, foo(1));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(2147483647, foo(-1));
+  assertEquals(2147483648, foo(0));
+  assertEquals(2147483649, foo(1));
+  assertOptimized(foo);
+})();