[turbofan] Decide lowering for NumberAdd/Subtract/Multiply based on feedback.

For NumberAdd/Subtract/Multiply we currently onlt consult the upper
bound to decide whether to compute using Int32 or Float64 operations,
whereas for NumberModulus, NumberEqual, etc. we do decide based on
the feedback types, where the only significant difference is that we
cannot promise Word32 truncations on the inputs.

This change unifies the handling for NumberAdd/Subtract/Multiply as
well, which triggers surprisingly often in our core benchmark suites..

Bug: v8:8015
Change-Id: If8ec1bc82d1e1b71285c829262a0d343a4eb2af7
Reviewed-on: https://chromium-review.googlesource.com/1226033
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#55943}

src/compiler/simplified-lowering.cc

@@ -1757,9 +1757,12 @@ class RepresentationSelector {
 
       case IrOpcode::kNumberAdd:
       case IrOpcode::kNumberSubtract: {
-        if (BothInputsAre(node, type_cache_.kAdditiveSafeIntegerOrMinusZero) &&
-            (GetUpperBound(node).Is(Type::Signed32()) ||
-             GetUpperBound(node).Is(Type::Unsigned32()) ||
+        if (TypeOf(node->InputAt(0))
+                .Is(type_cache_.kAdditiveSafeIntegerOrMinusZero) &&
+            TypeOf(node->InputAt(1))
+                .Is(type_cache_.kAdditiveSafeIntegerOrMinusZero) &&
+            (TypeOf(node).Is(Type::Signed32()) ||
+             TypeOf(node).Is(Type::Unsigned32()) ||
              truncation.IsUsedAsWord32())) {
           // => Int32Add/Sub
           VisitWord32TruncatingBinop(node);
@@ -1832,12 +1835,12 @@ class RepresentationSelector {
         return;
       }
       case IrOpcode::kNumberMultiply: {
-        if (BothInputsAre(node, Type::Integral32()) &&
-            (NodeProperties::GetType(node).Is(Type::Signed32()) ||
-             NodeProperties::GetType(node).Is(Type::Unsigned32()) ||
+        if (TypeOf(node->InputAt(0)).Is(Type::Integral32()) &&
+            TypeOf(node->InputAt(1)).Is(Type::Integral32()) &&
+            (TypeOf(node).Is(Type::Signed32()) ||
+             TypeOf(node).Is(Type::Unsigned32()) ||
              (truncation.IsUsedAsWord32() &&
-              NodeProperties::GetType(node).Is(
-                  type_cache_.kSafeIntegerOrMinusZero)))) {
+              TypeOf(node).Is(type_cache_.kSafeIntegerOrMinusZero)))) {
           // Multiply reduces to Int32Mul if the inputs are integers, and
           // (a) the output is either known to be Signed32, or
           // (b) the output is known to be Unsigned32, or

test/mjsunit/compiler/number-add.js

+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+// This tests that NumberAdd passes on the right truncations
+// even if it figures out during SimplifiedLowering that it
+// can indeed do a Word32 operation (based on the feedback
+// baked in for its inputs by other operators).
+(function() {
+  // We need a + with Number feedback to get to a NumberAdd
+  // during the typed lowering pass of TurboFan's frontend.
+  function foo(x, y) { return x + y; }
+  foo(0.1, 0.2);
+  foo(0.1, 0.2);
+
+  // Now we need to fool TurboFan to think that it has to
+  // perform the `foo(x,-1)` on Float64 values until the
+  // very last moment (after the RETYPE phase of the
+  // SimplifiedLowering) where it realizes that the inputs
+  // and outputs of the NumberAdd allow it perform the
+  // operation on Word32.
+  function bar(x) {
+    x = Math.trunc(foo(x - 1, 1));
+    return foo(x, -1);
+  }
+
+  assertEquals(0, bar(1));
+  assertEquals(1, bar(2));
+  %OptimizeFunctionOnNextCall(bar);
+  assertEquals(2, bar(3));
+})();