[Turbofan] Make the -0 deopt case more efficient in multiplication.

src/compiler/machine-operator-reducer.cc

 // Copyright 2014 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/compiler/machine-operator-reducer.h"
 
 #include "src/base/bits.h"
 #include "src/base/division-by-constant.h"
 #include "src/base/ieee754.h"
 #include "src/codegen.h"
@@ skipping 246 matching lines @@
     case IrOpcode::kInt32Mod:
       return ReduceInt32Mod(node);
     case IrOpcode::kUint32Mod:
       return ReduceUint32Mod(node);
     case IrOpcode::kInt32LessThan: {
       Int32BinopMatcher m(node);
       if (m.IsFoldable()) {  // K < K => K
         return ReplaceBool(m.left().Value() < m.right().Value());
       }
       if (m.LeftEqualsRight()) return ReplaceBool(false);  // x < x => false
+      if (m.left().IsWord32Or() && m.right().Is(0)) {      // (X | Y) < 0 ...
+        // This targets the check for -0 after multiplication.

[Benedikt Meurer, 2016/07/20 17:37:44]

This is a detail that is not necessarily relevant. I'd prefer to have a single
comment like this instead:

// (x | K) < 0 => true or (K | x) < 0 => true iff K < 0

+        Int32BinopMatcher mleftmatcher(m.left().node());
+        if ((mleftmatcher.left().HasValue() &&

[Benedikt Meurer, 2016/07/20 17:37:44]

Please add a IsNegative() helper to the Int32Matcher (similar to what we have
for Float64Matcher already) and use that here for left and right checks.

+             mleftmatcher.left().Value() < 0) ||
+            (mleftmatcher.right().HasValue() &&
+             mleftmatcher.right().Value() < 0)) {
+          return ReplaceBool(true);  // and X < 0 or Y < 0 => true
+        }
+      }
       break;
     }
     case IrOpcode::kInt32LessThanOrEqual: {
       Int32BinopMatcher m(node);
       if (m.IsFoldable()) {  // K <= K => K
         return ReplaceBool(m.left().Value() <= m.right().Value());
       }
       if (m.LeftEqualsRight()) return ReplaceBool(true);  // x <= x => true
       break;
     }
@@ skipping 965 matching lines @@
 MachineOperatorBuilder* MachineOperatorReducer::machine() const {
   return jsgraph()->machine();
 }
 
 
 Graph* MachineOperatorReducer::graph() const { return jsgraph()->graph(); }
 
 }  // namespace compiler
 }  // namespace internal
 }  // namespace v8