[turbofan] Adds handling of number or oddball type feedback to SpeculativeNumberShiftLeft.

src/compiler/representation-change.cc

 // Copyright 2015 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/compiler/representation-change.h"
 
 #include <sstream>
 
 #include "src/base/bits.h"
 #include "src/code-factory.h"
@@ skipping 439 matching lines @@
       op = simplified()->CheckedFloat64ToInt32();
     }
   } else if (output_rep == MachineRepresentation::kTagged) {
     if (output_type->Is(Type::TaggedSigned())) {
       op = simplified()->ChangeTaggedSignedToInt32();
     } else if (output_type->Is(Type::Unsigned32())) {
       op = simplified()->ChangeTaggedToUint32();
     } else if (output_type->Is(Type::Signed32())) {
       op = simplified()->ChangeTaggedToInt32();
     } else if (use_info.truncation().IsUsedAsWord32()) {
+      if (use_info.type_check() == TypeCheckKind::kNumberOrOddball) {
+        op = simplified()->CheckedTaggedToFloat64();
+        Node* effect = NodeProperties::GetEffectInput(use_node);
+        Node* control = NodeProperties::GetControlInput(use_node);
+        Node* to_float_checked =
+            jsgraph()->graph()->NewNode(op, node, effect, control);
+        NodeProperties::ReplaceEffectInput(use_node, to_float_checked);
+        return jsgraph()->graph()->NewNode(machine()->TruncateFloat64ToWord32(),
+                                           to_float_checked);

[Jarin, 2016/07/27 05:34:01]

As discussed offline, we should introduce a dedicated operator that does the
checking and truncation, so that we have fast path for smis. (In a separate CL,
so not actionable now.)

[epertoso, 2016/07/27 08:26:36]

Acknowledged.

+      }
       op = simplified()->TruncateTaggedToWord32();
     } else if (use_info.type_check() == TypeCheckKind::kSigned32) {
       op = simplified()->CheckedTaggedToInt32();
     }
   } else if (output_rep == MachineRepresentation::kWord32) {
     // Only the checked case should get here, the non-checked case is
     // handled in GetRepresentationFor.
-    DCHECK(use_info.type_check() == TypeCheckKind::kSigned32);
-    if (output_type->Is(Type::Signed32())) {
+    if (use_info.type_check() == TypeCheckKind::kSigned32) {
+      if (output_type->Is(Type::Signed32())) {
+        return node;
+      } else if (output_type->Is(Type::Unsigned32())) {
+        op = simplified()->CheckedUint32ToInt32();
+      }
+    } else {
+      DCHECK(use_info.type_check() == TypeCheckKind::kNumberOrOddball);

[Benedikt Meurer, 2016/07/27 03:34:36]

Nit: Use DCHECK_EQ(TypeCheckKind::kNumberOrOddball, use_info.type_check());

[epertoso, 2016/07/27 08:26:36]

Done.

       return node;
-    } else if (output_type->Is(Type::Unsigned32())) {
-      op = simplified()->CheckedUint32ToInt32();
     }
   } else if (output_rep == MachineRepresentation::kWord8 ||
              output_rep == MachineRepresentation::kWord16) {
     DCHECK(use_info.representation() == MachineRepresentation::kWord32);
     DCHECK(use_info.type_check() == TypeCheckKind::kSigned32);
     return node;
   }
 
   if (op == nullptr) {
     return TypeError(node, output_rep, output_type,
@@ skipping 366 matching lines @@
 }
 
 Node* RepresentationChanger::InsertChangeTaggedToFloat64(Node* node) {
   return jsgraph()->graph()->NewNode(simplified()->ChangeTaggedToFloat64(),
                                      node);
 }
 
 }  // namespace compiler
 }  // namespace internal
 }  // namespace v8