Avoid wrong imul deopt on ia32 and x64 (fixes v8 bug 2339).

src/ia32/lithium-codegen-ia32.cc

Index: src/ia32/lithium-codegen-ia32.cc
diff --git a/src/ia32/lithium-codegen-ia32.cc b/src/ia32/lithium-codegen-ia32.cc
index 7d413b9f622ff4f66eb4b5e055ff2dfaeaff861d..adede4eda0da010460ebf1fefc01c3bfa13f9ba4 100644
--- a/src/ia32/lithium-codegen-ia32.cc
+++ b/src/ia32/lithium-codegen-ia32.cc
@@ -1234,7 +1234,7 @@ void LCodeGen::DoMulI(LMulI* instr) {
     __ test(left, Operand(left));
     __ j(not_zero, &done, Label::kNear);
     if (right->IsConstantOperand()) {
-      if (ToInteger32(LConstantOperand::cast(right)) <= 0) {
+      if (ToInteger32(LConstantOperand::cast(right)) < 0) {

[Vyacheslav Egorov (Google), 2012/09/21 16:51:20]

If right is 0 then we need to check sign of left, which does not happen. (also
not_zero branch is redundant if right is zero). So this is not correct.

I suggest rewriting regress-1117.js in the following way:

function foo(x) { return x * 0; }

assertEquals(Infinity, 1/foo(5));
assertEquals(Infinity, 1/foo(5));
%OptimizeFunctionOnNextCall(foo);
assertEquals(-Infinity, 1/foo(-5));

And then you will see that it fails :-) It passed for you because we do OSR at
top level and then constant fold multiplication into -0.

         DeoptimizeIf(no_condition, instr->environment());
       }
     } else {