[turbofan] Adds handling of number or oddball type feedback to SpeculativeNumberShiftLeft.

src/compiler/js-typed-lowering.cc

 // Copyright 2014 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/code-factory.h"
 #include "src/compilation-dependencies.h"
 #include "src/compiler/access-builder.h"
 #include "src/compiler/js-graph.h"
 #include "src/compiler/js-typed-lowering.h"
 #include "src/compiler/linkage.h"
@@ skipping 577 matching lines @@
   r.ConvertInputsToNumber();
   r.ConvertInputsToUI32(kSigned, kSigned);
   return r.ChangeToPureOperator(intOp, Type::Integral32());
 }
 
 Reduction JSTypedLowering::ReduceShiftLeft(Node* node) {
   if (flags() & kDisableIntegerBinaryOpReduction) return NoChange();
 
   JSBinopReduction r(this, node);
   BinaryOperationHints::Hint feedback = r.GetNumberBinaryOperationFeedback();
   if (feedback == BinaryOperationHints::kSigned32 ||

[Benedikt Meurer, 2016/07/27 03:34:36]

Nit: use feedback != BinaryOperationHints::kAny as we do for the other reduction
rules.

[epertoso, 2016/07/27 08:26:36]

Done.

-      feedback == BinaryOperationHints::kSignedSmall) {
+      feedback == BinaryOperationHints::kSignedSmall ||
+      feedback == BinaryOperationHints::kNumberOrOddball) {
     return r.ChangeToSpeculativeOperator(
         simplified()->SpeculativeNumberShiftLeft(feedback), Type::Signed32());
   }
 
   // If deoptimization is enabled we rely on type feedback.
   if (r.BothInputsAre(Type::PlainPrimitive()) ||
       !(flags() & kDeoptimizationEnabled)) {
     r.ConvertInputsToNumber();
     r.ConvertInputsToUI32(kSigned, kUnsigned);
     return r.ChangeToPureOperator(simplified()->NumberShiftLeft(),
@@ skipping 1453 matching lines @@
 }
 
 
 CompilationDependencies* JSTypedLowering::dependencies() const {
   return dependencies_;
 }
 
 }  // namespace compiler
 }  // namespace internal
 }  // namespace v8