tighten invariants of HValue::InferRange

test/mjsunit/math-floor.js

Index: test/mjsunit/math-floor.js
diff --git a/test/mjsunit/math-floor.js b/test/mjsunit/math-floor.js
index 11f4cd789c7587e89c576ca9e38e9c81455a115a..2c1390583e250e84b748430b555c919dfab0a207 100644
--- a/test/mjsunit/math-floor.js
+++ b/test/mjsunit/math-floor.js
@@ -51,6 +51,17 @@ function test() {
   testFloor(-Infinity, -Infinity);
   testFloor(NaN, NaN);
 
+  // Ensure that a negative zero coming from Math.floor is properly
+  // handled by other ops that take unboxed doubles.  See cr7514040.

[Kevin Millikin (Chromium), 2011/08/02 10:24:14]

No need to cross reference the code review in the test.  The casual reader
doesn't know what it is, and normally the commit message includes it anyway.

+  function ifloor(x) {
+      return 1/Math.floor(x);
+  }
+  assertEquals(-Infinity, ifloor(-0));
+  assertEquals(-Infinity, ifloor(-0));
+  assertEquals(-Infinity, ifloor(-0));
+  %OptimizeFunctionOnNextCall(ifloor);
+  assertEquals(-Infinity, ifloor(-0));
+
   testFloor(0, 0.1);
   testFloor(0, 0.49999999999999994);
   testFloor(0, 0.5);
@@ -129,3 +140,20 @@ function test() {
 for (var i = 0; i < 500; i++) {
   test();
 }
+
+
+// Ensure that a negative zero coming from Math.floor is properly
+// handled by other ops that take unboxed doubles.  See cr7514040.
+function floorsum(i,n) {
+  var ret = Math.floor(n);
+  while (--i > 0) {
+    ret += Math.floor(n);
+  }
+  return ret;
+}
+assertEquals(-0, floorsum(1000,-0));
+%OptimizeFunctionOnNextCall(floorsum);
+// It seems that %OptimizeFunctionOnNextCall doesn't always work!  Here

[Kevin Millikin (Chromium), 2011/08/02 10:24:14]

It should always work (or else that's a bug).

I think what's happening here is that (a) the call to Math.floor in the loop is
invariant, so it gets lifted out; (b) the optimized floorsum correctly
deoptimizes on the negative zero; then, (c) the function is optimized a second
time via OSR because it contains a long running loop, but (d) the call to
Math.floor in the loop is prevented from being hoisted out of the loop because
it hasn't been computed at OSR entry, and so (e) there we hit the bug.

You can see that by passing the flags --trace-deopt --trace-osr.

This comment should just say something like 'use a high trip count to get the
loop optimized via OSR'.

+// we push iterations up to a large number to ensure that we try to
+// unbox doubles as much as possible.
+assertEquals(-0, floorsum(1000000,-0));