Avoid wrong imul deopt on ia32 and x64 (fixes v8 bug 2339).

src/ia32/lithium-codegen-ia32.cc

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 1216 matching lines @@
   if (instr->hydrogen()->CheckFlag(HValue::kCanOverflow)) {
     DeoptimizeIf(overflow, instr->environment());
   }
 
   if (instr->hydrogen()->CheckFlag(HValue::kBailoutOnMinusZero)) {
     // Bail out if the result is supposed to be negative zero.
     Label done;
     __ test(left, Operand(left));
     __ j(not_zero, &done, Label::kNear);
     if (right->IsConstantOperand()) {
-      if (ToInteger32(LConstantOperand::cast(right)) <= 0) {
+      if (ToInteger32(LConstantOperand::cast(right)) < 0) {

[Vyacheslav Egorov (Google), 2012/09/21 16:51:20]

If right is 0 then we need to check sign of left, which does not happen. (also
not_zero branch is redundant if right is zero). So this is not correct.

I suggest rewriting regress-1117.js in the following way:

function foo(x) { return x * 0; }

assertEquals(Infinity, 1/foo(5));
assertEquals(Infinity, 1/foo(5));
%OptimizeFunctionOnNextCall(foo);
assertEquals(-Infinity, 1/foo(-5));

And then you will see that it fails :-) It passed for you because we do OSR at
top level and then constant fold multiplication into -0.

         DeoptimizeIf(no_condition, instr->environment());
       }
     } else {
       // Test the non-zero operand for negative sign.
       __ or_(ToRegister(instr->temp()), ToOperand(right));
       DeoptimizeIf(sign, instr->environment());
     }
     __ bind(&done);
   }
 }
@@ skipping 4293 matching lines @@
                               FixedArray::kHeaderSize - kPointerSize));
   __ bind(&done);
 }
 
 
 #undef __
 
 } }  // namespace v8::internal
 
 #endif  // V8_TARGET_ARCH_IA32