From 85f6e1684447a728b51e8b7a56746e5bad781d4a Mon Sep 17 00:00:00 2001
From: ishell <ishell@chromium.org>
Date: Wed, 2 Sep 2015 02:32:31 -0700
Subject: [PATCH] [arm64] Don't try convert binary operation to shifted form
 when both operands are the same.

BUG=chromium:523307
LOG=N

Review URL: https://codereview.chromium.org/1304923003

Cr-Commit-Position: refs/heads/master@{#30538}
---
 src/arm64/lithium-arm64.cc                   |  2 ++
 test/mjsunit/regress/regress-crbug-523307.js | 16 ++++++++++++++++
 2 files changed, 18 insertions(+)
 create mode 100644 test/mjsunit/regress/regress-crbug-523307.js

diff --git a/src/arm64/lithium-arm64.cc b/src/arm64/lithium-arm64.cc
index bdf49bf..63ae421 100644
--- a/src/arm64/lithium-arm64.cc
+++ b/src/arm64/lithium-arm64.cc
@@ -2132,6 +2132,8 @@ HBitwiseBinaryOperation* LChunkBuilder::CanTransformToShiftedOp(HValue* val,
   DCHECK(hleft->representation().Equals(hinstr->representation()));
   DCHECK(hright->representation().Equals(hinstr->representation()));
 
+  if (hleft == hright) return NULL;
+
   if ((hright->IsConstant() &&
        LikelyFitsImmField(hinstr, HConstant::cast(hright)->Integer32Value())) ||
       (hinstr->IsCommutative() && hleft->IsConstant() &&
diff --git a/test/mjsunit/regress/regress-crbug-523307.js b/test/mjsunit/regress/regress-crbug-523307.js
new file mode 100644
index 0000000..f290967
--- /dev/null
+++ b/test/mjsunit/regress/regress-crbug-523307.js
@@ -0,0 +1,16 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function f(x) {
+  var c = x * x << 366;
+  var a = c + c;
+  return a;
+}
+
+f(1);
+f(1);
+%OptimizeFunctionOnNextCall(f);
+f(1);
-- 
2.7.4