[turbofan] Treat the INT32 state of a truncating binary op IC as number or...

[turbofan] Treat the INT32 state of a truncating binary op IC as number or oddball on 32-bit machines.

This was causing a few unexpected deopt loops.

BUG=v8:5320

Review-Url: https://codereview.chromium.org/2292873002
Cr-Commit-Position: refs/heads/master@{#39019}

src/compiler/type-hint-analyzer.cc

@@ -15,14 +15,17 @@ namespace compiler {
 
 namespace {
 
-BinaryOperationHint ToBinaryOperationHint(BinaryOpICState::Kind kind) {
+BinaryOperationHint ToBinaryOperationHint(Token::Value op,
+                                          BinaryOpICState::Kind kind) {
   switch (kind) {
     case BinaryOpICState::NONE:
       return BinaryOperationHint::kNone;
     case BinaryOpICState::SMI:
       return BinaryOperationHint::kSignedSmall;
     case BinaryOpICState::INT32:
-      return BinaryOperationHint::kSigned32;
+      return (Token::IsTruncatingBinaryOp(op) && SmiValuesAre31Bits())
+                 ? BinaryOperationHint::kNumberOrOddball
+                 : BinaryOperationHint::kSigned32;
     case BinaryOpICState::NUMBER:
       return BinaryOperationHint::kNumberOrOddball;
     case BinaryOpICState::STRING:
@@ -66,7 +69,7 @@ bool TypeHintAnalysis::GetBinaryOperationHint(TypeFeedbackId id,
   Handle<Code> code = i->second;
   DCHECK_EQ(Code::BINARY_OP_IC, code->kind());
   BinaryOpICState state(code->GetIsolate(), code->extra_ic_state());
-  *hint = ToBinaryOperationHint(state.kind());
+  *hint = ToBinaryOperationHint(state.op(), state.kind());
   return true;
 }
 

test/mjsunit/compiler/regress-5320.js

+// Copyright 2016 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+function OptimizeTruncatingBinaryOp(func) {
+  func(42, -2);
+  func(31, undefined);
+  %BaselineFunctionOnNextCall(func);
+  func(42, -2);
+  func(31, undefined);
+  %OptimizeFunctionOnNextCall(func);
+  func(-1, 2.1);
+  assertOptimized(func);
+}
+
+// SAR
+OptimizeTruncatingBinaryOp(function(a, b) { return a >> b; });
+// SHR
+OptimizeTruncatingBinaryOp(function(a, b) { return a >>> b; });
+// SHL
+OptimizeTruncatingBinaryOp(function(a, b) { return a << b; });
+// BIT_AND
+OptimizeTruncatingBinaryOp(function(a, b) { return a & b; });
+// BIT_OR
+OptimizeTruncatingBinaryOp(function(a, b) { return a | b; });
+// BIT_XOR
+OptimizeTruncatingBinaryOp(function(a, b) { return a ^ b; });