| Index: src/compiler/js-typed-lowering.cc
|
| diff --git a/src/compiler/js-typed-lowering.cc b/src/compiler/js-typed-lowering.cc
|
| index b97fa02be9708a4709e9fbde46dfb20c2b49985b..178a0628f3bb8b567fcd4bcf9821aeb4ebbabb68 100644
|
| --- a/src/compiler/js-typed-lowering.cc
|
| +++ b/src/compiler/js-typed-lowering.cc
|
| @@ -36,6 +36,8 @@ JSTypedLowering::JSTypedLowering(JSGraph* jsgraph)
|
| Handle<Object> one = factory->NewNumber(1.0);
|
| zero_range_ = Type::Range(zero, zero, zone());
|
| one_range_ = Type::Range(one, one, zone());
|
| + Handle<Object> thirtyone = factory->NewNumber(31.0);
|
| + zero_thirtyone_range_ = Type::Range(zero, thirtyone, zone());
|
| }
|
|
|
|
|
| @@ -79,8 +81,12 @@ class JSBinopReduction {
|
| void ConvertInputsForShift(bool left_signed) {
|
| node_->ReplaceInput(0, ConvertToI32(left_signed, left()));
|
| Node* rnum = ConvertToI32(false, right());
|
| - node_->ReplaceInput(1, graph()->NewNode(machine()->Word32And(), rnum,
|
| - jsgraph()->Int32Constant(0x1F)));
|
| + Type* rnum_type = NodeProperties::GetBounds(rnum).upper;
|
| + if (!rnum_type->Is(lowering_->zero_thirtyone_range_)) {
|
| + rnum = graph()->NewNode(machine()->Word32And(), rnum,
|
| + jsgraph()->Int32Constant(0x1F));
|
| + }
|
| + node_->ReplaceInput(1, rnum);
|
| }
|
|
|
| void SwapInputs() {
|
|
|