Patch 2.1 branch with bug fix change 4471.

src/ia32/codegen-ia32.cc

 // Copyright 2010 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 1161 matching lines @@
           : TypeInfo::Integer32();
     }
     case Token::BIT_XOR:
       // Result is always a 32 bit integer. Smi property of inputs is preserved.
       return (operands_type.IsSmi())
           ? TypeInfo::Smi()
           : TypeInfo::Integer32();
     case Token::SAR:
       if (left.is_smi()) return TypeInfo::Smi();
       // Result is a smi if we shift by a constant >= 1, otherwise an integer32.
+      // Shift amount is masked with 0x1F (ECMA standard 11.7.2).
       return (right.is_constant() && right.handle()->IsSmi()
-                     && Smi::cast(*right.handle())->value() >= 1)
+              && (Smi::cast(*right.handle())->value() & 0x1F)  >= 1)
           ? TypeInfo::Smi()
           : TypeInfo::Integer32();
     case Token::SHR:
-      // Result is a smi if we shift by a constant >= 2, otherwise an integer32.
-      return (right.is_constant() && right.handle()->IsSmi()
-                     && Smi::cast(*right.handle())->value() >= 2)
-          ? TypeInfo::Smi()
-          : TypeInfo::Integer32();
+      // Result is a smi if we shift by a constant >= 2, an integer32 if
+      // we shift by 1, and an unsigned 32-bit integer if we shift by 0.
+      if (right.is_constant() && right.handle()->IsSmi()) {
+        int shift_amount = Smi::cast(*right.handle())->value() & 0x1F;
+        if (shift_amount > 1) {
+          return TypeInfo::Smi();
+        } else if (shift_amount > 0) {
+          return TypeInfo::Integer32();
+        }
+      }
+      return TypeInfo::Number();
     case Token::ADD:
       if (operands_type.IsSmi()) {
         // The Integer32 range is big enough to take the sum of any two Smis.
         return TypeInfo::Integer32();
       } else {
         // Result could be a string or a number. Check types of inputs.
         return operands_type.IsNumber()
             ? TypeInfo::Number()
             : TypeInfo::Unknown();
       }
@@ skipping 11364 matching lines @@
 
   // Call the runtime; it returns -1 (less), 0 (equal), or 1 (greater)
   // tagged as a small integer.
   __ bind(&runtime);
   __ TailCallRuntime(Runtime::kStringCompare, 2, 1);
 }
 
 #undef __
 
 } }  // namespace v8::internal