[turbofan] Use frame state before for shift operations as well.

This was already done for other binary operations, so it's basically
copying the existing functionality to shift left and shift right
logical/arithmetic.

R=jarin@chromium.org

Review URL: https://codereview.chromium.org/1140883003

Cr-Commit-Position: refs/heads/master@{#28389}

diff --git a/src/compiler/js-typed-lowering.cc b/src/compiler/js-typed-lowering.cc
index 9b1d678..c3b7230 100644 (file)
--- a/src/compiler/js-typed-lowering.cc
+++ b/src/compiler/js-typed-lowering.cc
@@ -439,12 +439,17 @@ Reduction JSTypedLowering::ReduceUI32Shift(Node* node,
                                            Signedness left_signedness,
                                            const Operator* shift_op) {
   JSBinopReduction r(this, node);
-  Type* reduce_type = r.IsStrong() ? Type::Number() : Type::Primitive();
-  if (r.BothInputsAre(reduce_type)) {
-    r.ConvertInputsForShift(left_signedness);
-    return r.ChangeToPureOperator(shift_op, Type::Integral32());
+  if (r.IsStrong()) {
+    if (r.BothInputsAre(Type::Number())) {
+      r.ConvertInputsForShift(left_signedness);
+      return r.ChangeToPureOperator(shift_op);
+    }
+    return NoChange();
   }
-  return NoChange();
+  Node* frame_state = NodeProperties::GetFrameStateInput(node, 1);
+  r.ConvertInputsToNumber(frame_state);
+  r.ConvertInputsForShift(left_signedness);
+  return r.ChangeToPureOperator(shift_op);
 }
 
 

diff --git a/test/mjsunit/compiler/deopt-tonumber-shift.js b/test/mjsunit/compiler/deopt-tonumber-shift.js
new file mode 100644 (file)
index 0000000..bb4d1d5
--- /dev/null
+++ b/test/mjsunit/compiler/deopt-tonumber-shift.js
@@ -0,0 +1,40 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+var f = (function() {
+  "use asm";
+  function f(x, y) {
+    return x << y;
+  }
+  return f;
+})();
+
+var counter = 0;
+
+var deopt = { toString : function() {
+  %DeoptimizeFunction(f);
+  counter++;
+  return "2";
+} };
+
+var o = { toString : function() {
+  counter++;
+  return "1";
+} };
+
+counter = 0;
+assertEquals(4, f(deopt, o));
+assertEquals(2, counter);
+
+%OptimizeFunctionOnNextCall(f);
+counter = 0;
+assertEquals(4, f(o, deopt));
+assertEquals(2, counter);
+
+%OptimizeFunctionOnNextCall(f);
+counter = 0;
+assertEquals(8, f(deopt, deopt));
+assertEquals(2, counter);