[interpreter] Fix word32 vs word64 bug in CodeStubAssembler::UpdateFeedback.

R=epertoso@chromium.org

Review URL: https://codereview.chromium.org/2360233004 .

Cr-Commit-Position: refs/heads/master@{#39658}

src/code-stub-assembler.cc

@@ -3994,17 +3994,16 @@ compiler::Node* CodeStubAssembler::LoadTypeFeedbackVectorForStub() {
 void CodeStubAssembler::UpdateFeedback(compiler::Node* feedback,
                                        compiler::Node* type_feedback_vector,
                                        compiler::Node* slot_id) {
-  Label combine_feedback(this), record_feedback(this), end(this);
-
   // This method is used for binary op and compare feedback. These
   // vector nodes are initialized with a smi 0, so we can simply OR
   // our new feedback in place.
+  // TODO(interpreter): Consider passing the feedback as Smi already to avoid
+  // the tagging completely.
   Node* previous_feedback =
       LoadFixedArrayElement(type_feedback_vector, slot_id);
-  Node* untagged_previous_feedback = SmiUntag(previous_feedback);
-  Node* combined_feedback = Word32Or(untagged_previous_feedback, feedback);
-  StoreFixedArrayElement(type_feedback_vector, slot_id,
-                         SmiTag(combined_feedback), SKIP_WRITE_BARRIER);
+  Node* combined_feedback = SmiOr(previous_feedback, SmiFromWord32(feedback));
+  StoreFixedArrayElement(type_feedback_vector, slot_id, combined_feedback,
+                         SKIP_WRITE_BARRIER);
 }
 
 compiler::Node* CodeStubAssembler::LoadReceiverMap(compiler::Node* receiver) {

src/code-stub-assembler.h

@@ -121,6 +121,9 @@ class CodeStubAssembler : public compiler::CodeAssembler {
   compiler::Node* SmiMod(compiler::Node* a, compiler::Node* b);
   // Computes a * b for Smi inputs a and b; result is not necessarily a Smi.
   compiler::Node* SmiMul(compiler::Node* a, compiler::Node* b);
+  compiler::Node* SmiOr(compiler::Node* a, compiler::Node* b) {
+    return WordOr(a, b);
+  }
 
   // Allocate an object of the given size.
   compiler::Node* Allocate(compiler::Node* size, AllocationFlags flags = kNone);

test/cctest/interpreter/test-interpreter.cc

@@ -413,7 +413,7 @@ TEST(InterpreterStringAdd) {
   for (size_t i = 0; i < arraysize(test_cases); i++) {
     BytecodeArrayBuilder builder(isolate, handles.main_zone(), 1, 0, 1);
     FeedbackVectorSpec feedback_spec(&zone);
-    FeedbackVectorSlot slot = feedback_spec.AddGeneralSlot();
+    FeedbackVectorSlot slot = feedback_spec.AddInterpreterBinaryOpICSlot();
     Handle<i::TypeFeedbackVector> vector =
         NewTypeFeedbackVector(isolate, &feedback_spec);
 

test/mjsunit/compiler/regress-strict-equals-mixed-feedback.js

+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function bar(x, y) {
+  return x === y;
+}
+
+function foo(x) {
+  bar("0", x);
+}
+
+foo("0");
+foo("0");
+%BaselineFunctionOnNextCall(bar);
+foo("0");
+foo("0");
+bar(1, 1);
+%OptimizeFunctionOnNextCall(foo);
+foo("0");
+assertOptimized(foo);