[Crankshaft] Don't do HMathFloorOfDiv optimization for kUint32 values

BUG=v8:4507
LOG=y
R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/1409353005

Cr-Commit-Position: refs/heads/master@{#31474}

src/crankshaft/hydrogen-instructions.cc

@@ -1581,9 +1581,10 @@ HValue* HUnaryMathOperation::Canonicalize() {
     HDiv* hdiv = HDiv::cast(value());
 
     HValue* left = hdiv->left();
-    if (left->representation().IsInteger32()) {
+    if (left->representation().IsInteger32() && !left->CheckFlag(kUint32)) {
       // A value with an integer representation does not need to be transformed.
-    } else if (left->IsChange() && HChange::cast(left)->from().IsInteger32()) {
+    } else if (left->IsChange() && HChange::cast(left)->from().IsInteger32() &&
+               !HChange::cast(left)->value()->CheckFlag(kUint32)) {
       // A change from an integer32 can be replaced by the integer32 value.
       left = HChange::cast(left)->value();
     } else if (hdiv->observed_input_representation(1).IsSmiOrInteger32()) {
@@ -1597,10 +1598,12 @@ HValue* HUnaryMathOperation::Canonicalize() {
     if (right->IsInteger32Constant()) {
       right = Prepend(HConstant::cast(right)->CopyToRepresentation(
           Representation::Integer32(), right->block()->zone()));
-    } else if (right->representation().IsInteger32()) {
+    } else if (right->representation().IsInteger32() &&
+               !right->CheckFlag(kUint32)) {
       // A value with an integer representation does not need to be transformed.
     } else if (right->IsChange() &&
-               HChange::cast(right)->from().IsInteger32()) {
+               HChange::cast(right)->from().IsInteger32() &&
+               !HChange::cast(right)->value()->CheckFlag(kUint32)) {
       // A change from an integer32 can be replaced by the integer32 value.
       right = HChange::cast(right)->value();
     } else if (hdiv->observed_input_representation(2).IsSmiOrInteger32()) {

test/mjsunit/regress/regress-4507.js

+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function broken(value) {
+  return Math.floor(value/65536);
+}
+function toUnsigned(i) {
+  return i >>> 0;
+}
+function outer(i) {
+  return broken(toUnsigned(i));
+}
+for (var i = 0; i < 5; i++) outer(0);
+broken(0x80000000);  // Spice things up with a sprinkling of type feedback.
+%OptimizeFunctionOnNextCall(outer);
+assertEquals(32768, outer(0x80000000));