Make the Integer32 type info only cover the signed 32 bit integers....

src/ia32/codegen-ia32.cc

 // Copyright 2010 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 1232 matching lines @@
       __ SmiUntag(right_);
     }
   } else {
     // We know we have SSE2 here because otherwise the label is not linked (see
     // NonSmiInputLabel).
     CpuFeatures::Scope use_sse2(SSE2);
     // Handle the non-constant right hand side situation:
     if (left_info_.IsSmi()) {
       // Right is a heap object.
       __ JumpIfNotNumber(right_, right_info_, entry_label());
-      __ ConvertToInt32(right_, right_, dst_, left_info_, entry_label());
+      __ ConvertToInt32(right_, right_, dst_, right_info_, entry_label());
       __ mov(dst_, Operand(left_));
       __ SmiUntag(dst_);
     } else if (right_info_.IsSmi()) {
       // Left is a heap object.
       __ JumpIfNotNumber(left_, left_info_, entry_label());
       __ ConvertToInt32(dst_, left_, dst_, left_info_, entry_label());
       __ SmiUntag(right_);
     } else {
       // Here we don't know if it's one or both that is a heap object.
       Label only_right_is_heap_object, got_both;
       __ mov(dst_, Operand(left_));
       __ SmiUntag(dst_, &only_right_is_heap_object);
       // Left was a heap object.
       __ JumpIfNotNumber(left_, left_info_, entry_label());
       __ ConvertToInt32(dst_, left_, dst_, left_info_, entry_label());
       __ SmiUntag(right_, &got_both);
       // Both were heap objects.
       __ rcl(right_, 1);  // Put tag back.
       __ JumpIfNotNumber(right_, right_info_, entry_label());
-      __ ConvertToInt32(right_, right_, no_reg, left_info_, entry_label());
+      __ ConvertToInt32(right_, right_, no_reg, right_info_, entry_label());
       __ jmp(&got_both);
       __ bind(&only_right_is_heap_object);
       __ JumpIfNotNumber(right_, right_info_, entry_label());
-      __ ConvertToInt32(right_, right_, no_reg, left_info_, entry_label());
+      __ ConvertToInt32(right_, right_, no_reg, right_info_, entry_label());
       __ bind(&got_both);
     }
   }
   ASSERT(op_ == Token::BIT_AND ||
          op_ == Token::BIT_OR ||
          op_ == Token::BIT_XOR ||
          right_.is(ecx));
   switch (op_) {
     case Token::BIT_AND: __ and_(dst_, Operand(right_));  break;
     case Token::BIT_OR:   __ or_(dst_, Operand(right_));  break;
@@ skipping 645 matching lines @@
     // We will modify right, it must be spilled.
     frame_->Spill(ecx);
     // DeferredInlineBinaryOperation requires all the registers that it is told
     // about to be spilled and distinct.  We know that right is ecx and left is
     // not ecx.
     frame_->Spill(left->reg());
 
     // Use a fresh answer register to avoid spilling the left operand.
     answer = allocator_->Allocate();
     ASSERT(answer.is_valid());
+
     DeferredInlineBinaryOperation* deferred =
         new DeferredInlineBinaryOperation(op,
                                           answer.reg(),
                                           left->reg(),
                                           ecx,
                                           left_type_info,
                                           right_type_info,
                                           overwrite_mode);
     JumpIfNotBothSmiUsingTypeInfo(left->reg(), right->reg(), answer.reg(),
                                   left_type_info, right_type_info,
@@ skipping 2645 matching lines @@
 
   // If the property has been removed while iterating, we just skip it.
   __ test(ebx, Operand(ebx));
   node->continue_target()->Branch(equal);
 
   end_del_check.Bind();
   // Store the entry in the 'each' expression and take another spin in the
   // loop.  edx: i'th entry of the enum cache (or string there of)
   frame_->EmitPush(ebx);
   { Reference each(this, node->each());
-    // Loading a reference may leave the frame in an unspilled state.
-    frame_->SpillAll();
     if (!each.is_illegal()) {
       if (each.size() > 0) {
+        // Loading a reference may leave the frame in an unspilled state.
+        frame_->SpillAll();
+        // Get the value (under the reference on the stack) from memory.
         frame_->EmitPush(frame_->ElementAt(each.size()));
         each.SetValue(NOT_CONST_INIT);
         frame_->Drop(2);
       } else {
         // If the reference was to a slot we rely on the convenient property
         // that it doesn't matter whether a value (eg, ebx pushed above) is
         // right on top of or right underneath a zero-sized reference.
         each.SetValue(NOT_CONST_INIT);
         frame_->Drop();
       }
@@ skipping 9766 matching lines @@
   masm.GetCode(&desc);
   // Call the function from C++.
   return FUNCTION_CAST<MemCopyFunction>(buffer);
 }
 
 #undef __
 
 } }  // namespace v8::internal
 
 #endif  // V8_TARGET_ARCH_IA32