From 5494920a1872aacfd8b83dc849952c98ae0e57e0 Mon Sep 17 00:00:00 2001
From: bmeurer <bmeurer@chromium.org>
Date: Wed, 13 May 2015 04:17:31 -0700
Subject: [PATCH] [turbofan] Use frame state before for shift operations as
 well.

This was already done for other binary operations, so it's basically
copying the existing functionality to shift left and shift right
logical/arithmetic.

R=jarin@chromium.org

Review URL: https://codereview.chromium.org/1140883003

Cr-Commit-Position: refs/heads/master@{#28389}
---
 src/compiler/js-typed-lowering.cc             | 15 ++++++----
 test/mjsunit/compiler/deopt-tonumber-shift.js | 40 +++++++++++++++++++++++++++
 2 files changed, 50 insertions(+), 5 deletions(-)
 create mode 100644 test/mjsunit/compiler/deopt-tonumber-shift.js

diff --git a/src/compiler/js-typed-lowering.cc b/src/compiler/js-typed-lowering.cc
index 9b1d678..c3b7230 100644
--- a/src/compiler/js-typed-lowering.cc
+++ b/src/compiler/js-typed-lowering.cc
@@ -439,12 +439,17 @@ Reduction JSTypedLowering::ReduceUI32Shift(Node* node,
                                            Signedness left_signedness,
                                            const Operator* shift_op) {
   JSBinopReduction r(this, node);
-  Type* reduce_type = r.IsStrong() ? Type::Number() : Type::Primitive();
-  if (r.BothInputsAre(reduce_type)) {
-    r.ConvertInputsForShift(left_signedness);
-    return r.ChangeToPureOperator(shift_op, Type::Integral32());
+  if (r.IsStrong()) {
+    if (r.BothInputsAre(Type::Number())) {
+      r.ConvertInputsForShift(left_signedness);
+      return r.ChangeToPureOperator(shift_op);
+    }
+    return NoChange();
   }
-  return NoChange();
+  Node* frame_state = NodeProperties::GetFrameStateInput(node, 1);
+  r.ConvertInputsToNumber(frame_state);
+  r.ConvertInputsForShift(left_signedness);
+  return r.ChangeToPureOperator(shift_op);
 }
 
 
diff --git a/test/mjsunit/compiler/deopt-tonumber-shift.js b/test/mjsunit/compiler/deopt-tonumber-shift.js
new file mode 100644
index 0000000..bb4d1d5
--- /dev/null
+++ b/test/mjsunit/compiler/deopt-tonumber-shift.js
@@ -0,0 +1,40 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+var f = (function() {
+  "use asm";
+  function f(x, y) {
+    return x << y;
+  }
+  return f;
+})();
+
+var counter = 0;
+
+var deopt = { toString : function() {
+  %DeoptimizeFunction(f);
+  counter++;
+  return "2";
+} };
+
+var o = { toString : function() {
+  counter++;
+  return "1";
+} };
+
+counter = 0;
+assertEquals(4, f(deopt, o));
+assertEquals(2, counter);
+
+%OptimizeFunctionOnNextCall(f);
+counter = 0;
+assertEquals(4, f(o, deopt));
+assertEquals(2, counter);
+
+%OptimizeFunctionOnNextCall(f);
+counter = 0;
+assertEquals(8, f(deopt, deopt));
+assertEquals(2, counter);
-- 
2.7.4