Avoid wrong imul deopt on ia32 and x64 (fixes v8 bug 2339).

test/mjsunit/regress/regress-2339.js

Index: test/mjsunit/regress/regress-2339.js
diff --git a/test/mjsunit/deopt-minus-zero.js b/test/mjsunit/regress/regress-2339.js
similarity index 86%
copy from test/mjsunit/deopt-minus-zero.js
copy to test/mjsunit/regress/regress-2339.js
index ee0983127dc3ae10311cf11a88ba40284e366dfe..9b82ca189b26f6838141ffa58860de2af13fc222 100644
--- a/test/mjsunit/deopt-minus-zero.js
+++ b/test/mjsunit/regress/regress-2339.js
@@ -31,6 +31,7 @@
  * The possible optimization states of a function. Must be in sync with the
  * return values of Runtime_GetOptimizationStatus() in runtime.cc!
  */
+
 var OptimizationState = {
     YES: 1,
     NO: 2,
@@ -38,19 +39,19 @@ var OptimizationState = {
     NEVER: 4
 };
 
-function mul (a, b) {
-  return a * b;
+function simple() {
+  return simple_two_args(0, undefined);
 }
 
-mul(-1, -1);
-mul(0x80000001|0, -1);
-mul(0x80000001|0, -1);
-%OptimizeFunctionOnNextCall(mul);
-mul(0, -1);
-%OptimizeFunctionOnNextCall(mul);
-mul(0, -1);
+function simple_two_args(always_zero, always_undefined) {
+  var always_five = always_undefined || 5;
+  return always_zero * always_five * .5;
+}
 
-var raw_optimized = %GetOptimizationStatus(mul);
+for (var i = 0; i < 10000; i++) {

[Jakob Kummerow, 2012/09/26 09:26:41]

can we use %OptimizeFunctionOnNextCall here too? --trace-opt should tell you
whether it's simple() [with inlining] or simple_two_args() that must be
optimized.

+  simple();
+}
+var raw_optimized = %GetOptimizationStatus(simple);
 assertFalse(raw_optimized == OptimizationState.NO);
 gc();