tighten invariants of HValue::InferRange

test/mjsunit/math-floor.js

 // Copyright 2011 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 33 matching lines @@
 }
 
 function test() {
   testFloor(0, 0);
   testFloor(0, zero());
   testFloor(-0, -0);
   testFloor(Infinity, Infinity);
   testFloor(-Infinity, -Infinity);
   testFloor(NaN, NaN);
 
+  // Ensure that a negative zero coming from Math.floor is properly
+  // handled by other ops that take unboxed doubles.  See cr7514040.

[Kevin Millikin (Chromium), 2011/08/02 10:24:14]

No need to cross reference the code review in the test.  The casual reader
doesn't know what it is, and normally the commit message includes it anyway.

+  function ifloor(x) {
+      return 1/Math.floor(x);
+  }
+  assertEquals(-Infinity, ifloor(-0));
+  assertEquals(-Infinity, ifloor(-0));
+  assertEquals(-Infinity, ifloor(-0));
+  %OptimizeFunctionOnNextCall(ifloor);
+  assertEquals(-Infinity, ifloor(-0));
+
   testFloor(0, 0.1);
   testFloor(0, 0.49999999999999994);
   testFloor(0, 0.5);
   testFloor(0, 0.7);
   testFloor(-1, -0.1);
   testFloor(-1, -0.49999999999999994);
   testFloor(-1, -0.5);
   testFloor(-1, -0.7);
   testFloor(1, 1);
   testFloor(1, 1.1);
@@ skipping 58 matching lines @@
   testFloor(-two_52 + 1, -two_52 + 1 + 0.1);
   testFloor(-two_52 + 1, -two_52 + 1 + 0.5);
   testFloor(-two_52 + 1, -two_52 + 1 + 0.7);
 }
 
 
 // Test in a loop to cover the custom IC and GC-related issues.
 for (var i = 0; i < 500; i++) {
   test();
 }
+
+
+// Ensure that a negative zero coming from Math.floor is properly
+// handled by other ops that take unboxed doubles.  See cr7514040.
+function floorsum(i,n) {
+  var ret = Math.floor(n);
+  while (--i > 0) {
+    ret += Math.floor(n);
+  }
+  return ret;
+}
+assertEquals(-0, floorsum(1000,-0));
+%OptimizeFunctionOnNextCall(floorsum);
+// It seems that %OptimizeFunctionOnNextCall doesn't always work!  Here

[Kevin Millikin (Chromium), 2011/08/02 10:24:14]

It should always work (or else that's a bug).

I think what's happening here is that (a) the call to Math.floor in the loop is
invariant, so it gets lifted out; (b) the optimized floorsum correctly
deoptimizes on the negative zero; then, (c) the function is optimized a second
time via OSR because it contains a long running loop, but (d) the call to
Math.floor in the loop is prevented from being hoisted out of the loop because
it hasn't been computed at OSR entry, and so (e) there we hit the bug.

You can see that by passing the flags --trace-deopt --trace-osr.

This comment should just say something like 'use a high trip count to get the
loop optimized via OSR'.

+// we push iterations up to a large number to ensure that we try to
+// unbox doubles as much as possible.
+assertEquals(-0, floorsum(1000000,-0));