[turbofan] Unify Math.floor / Math.ceil optimization.

src/math.js

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 "use strict";
 
 // This file relies on the fact that the following declarations have been made
 // in runtime.js:
 // var $Object = global.Object;
 
@@ skipping 39 matching lines @@
 
 // ECMA 262 - 15.8.2.5
 // The naming of y and x matches the spec, as does the order in which
 // ToNumber (valueOf) is called.
 function MathAtan2JS(y, x) {
   return %MathAtan2(TO_NUMBER_INLINE(y), TO_NUMBER_INLINE(x));
 }
 
 // ECMA 262 - 15.8.2.6
 function MathCeil(x) {
-  return -MathFloor(-x);
+  return -%_MathFloor(-x);
 }
 
 // ECMA 262 - 15.8.2.8
 function MathExp(x) {
   return %MathExpRT(TO_NUMBER_INLINE(x));
 }
 
 // ECMA 262 - 15.8.2.9
 function MathFloor(x) {
-  x = TO_NUMBER_INLINE(x);
-  // It's more common to call this with a positive number that's out
-  // of range than negative numbers; check the upper bound first.
-  if (x < 0x80000000 && x > 0) {
-    // Numbers in the range [0, 2^31) can be floored by converting
-    // them to an unsigned 32-bit value using the shift operator.
-    // We avoid doing so for -0, because the result of Math.floor(-0)
-    // has to be -0, which wouldn't be the case with the shift.
-    return TO_UINT32(x);
-  } else {
-    return %MathFloorRT(x);
-  }
+  return %_MathFloor(+x);
 }
 
 // ECMA 262 - 15.8.2.10
 function MathLog(x) {
   return %_MathLogRT(TO_NUMBER_INLINE(x));
 }
 
 // ECMA 262 - 15.8.2.11
 function MathMax(arg1, arg2) {  // length == 2
   var length = %_ArgumentsLength();
@@ skipping 275 matching lines @@
 // Keep reference to original values of some global properties.  This
 // has the added benefit that the code in this file is isolated from
 // changes to these properties.
 $abs = MathAbs;
 $exp = MathExp;
 $floor = MathFloor;
 $max = MathMax;
 $min = MathMin;
 
 })();