Fix bug in optimization of Uint32LessThan.

R=jarin@chromium.org
BUG=

Review URL: https://codereview.chromium.org/689883003

Cr-Commit-Position: refs/heads/master@{#25023}
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@25023 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

src/compiler/machine-operator-reducer.cc

@@ -370,15 +370,16 @@ Reduction MachineOperatorReducer::Reduce(Node* node) {
       if (m.left().IsWord32Sar() && m.right().HasValue()) {
         Int32BinopMatcher mleft(m.left().node());
         if (mleft.right().HasValue()) {
-          // (x >> K) < C => x < (C << K) | (2^K - 1)
+          // (x >> K) < C => x < (C << K)
           // when C < (M >> K)
           const uint32_t c = m.right().Value();
           const uint32_t k = mleft.right().Value() & 0x1f;
           if (c < static_cast<uint32_t>(kMaxInt >> k)) {
             node->ReplaceInput(0, mleft.left().node());
-            node->ReplaceInput(1, Uint32Constant((c << k) | ((1 << k) - 1)));
+            node->ReplaceInput(1, Uint32Constant(c << k));
             return Changed(node);
           }
+          // TODO(turbofan): else the comparison is always true.
         }
       }
       break;

test/mjsunit/asm/uint32-less-than-shift.js

+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+function Module(stdlib, foreign, heap) {
+  'use asm';
+
+  function foo1(i1) {
+    i1 = i1 | 0;
+    var i10 = i1 >> 5;
+    if (i10 >>> 0 < 5) {
+      return 1;
+    } else {
+      return 0;
+    }
+    return 0;
+  }
+
+  function foo2(i1) {
+    i1 = i1 | 0;
+    var i10 = i1 / 32 | 0;
+    if (i10 >>> 0 < 5) {
+      return 1;
+    } else {
+      return 0;
+    }
+    return 0;
+  }
+
+  function foo3(i1) {
+    i1 = i1 | 0;
+    var i10 = (i1 + 32 | 0) / 32 | 0;
+    if (i10 >>> 0 < 5) {
+      return 1;
+    } else {
+      return 0;
+    }
+    return 0;
+  }
+  return {foo1: foo1, foo2: foo2, foo3: foo3};
+}
+
+var m = Module(this, {}, undefined);
+
+for (var i = 0; i < 4 * 32; i++) {
+  assertEquals(1, m.foo1(i));
+  assertEquals(1, m.foo2(i));
+  assertEquals(1, m.foo3(i));
+}
+
+for (var i = 4 * 32; i < 5 * 32; i++) {
+  assertEquals(1, m.foo1(i));
+  assertEquals(1, m.foo2(i));
+  assertEquals(0, m.foo3(i));
+}
+
+for (var i = 5 * 32; i < 10 * 32; i++) {
+  assertEquals(0, m.foo1(i));
+  assertEquals(0, m.foo2(i));
+  assertEquals(0, m.foo3(i));
+}

test/unittests/compiler/machine-operator-reducer-unittest.cc

@@ -1089,10 +1089,9 @@ TEST_F(MachineOperatorReducerTest, Uint32LessThanWithWord32Sar) {
 
     Reduction r = Reduce(node);
     ASSERT_TRUE(r.Changed());
-    EXPECT_THAT(
-        r.replacement(),
-        IsUint32LessThan(p0, IsInt32Constant(bit_cast<int32_t>(
-                                 (limit << shift) | ((1u << shift) - 1)))));
+    EXPECT_THAT(r.replacement(),
+                IsUint32LessThan(
+                    p0, IsInt32Constant(bit_cast<int32_t>(limit << shift))));
   }
 }