Precise shift right result type derivation for all int32 input ranges.

src/compiler/typer.cc

 // Copyright 2014 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/base/flags.h"
 #include "src/bootstrapper.h"
 #include "src/compiler/graph-reducer.h"
 #include "src/compiler/js-operator.h"
 #include "src/compiler/node.h"
 #include "src/compiler/node-properties.h"
@@ skipping 969 matching lines @@
 }
 
 
 Type* Typer::Visitor::JSShiftLeftTyper(Type* lhs, Type* rhs, Typer* t) {
   return Type::Signed32();
 }
 
 
 Type* Typer::Visitor::JSShiftRightTyper(Type* lhs, Type* rhs, Typer* t) {
   lhs = NumberToInt32(ToNumber(lhs, t), t);
-  rhs = NumberToUint32(ToNumber(rhs, t), t);
-  double min = kMinInt;
-  double max = kMaxInt;
-  if (lhs->Min() >= 0) {
-    // Right-shifting a non-negative value cannot make it negative, nor larger.
-    min = std::max(min, 0.0);
-    max = std::min(max, lhs->Max());
-    if (rhs->Min() > 0 && rhs->Max() <= 31) {
-      max = static_cast<int>(max) >> static_cast<int>(rhs->Min());
+  rhs = NumberToInt32(ToNumber(rhs, t), t);
+
+  // Canonicalize the shift range to 0 to 31.
+  int32_t shift_min = rhs->Min();

[titzer, 2015/05/06 11:53:12]

Would it be possible to pull the integer range logic out to a separate function
so that it can be tested simple integer ranges instead of requiring the
construction of types, etc? That would allow more exhaustive and more efficient
unit testing, and allow us to apply the rules to machine-left shifts, too.

+  int32_t shift_max = rhs->Max();
+  if ((int64_t(shift_max) - int64_t(shift_min)) >= 31) {
+    shift_min = 0;
+    shift_max = 31;
+  } else {
+    shift_min &= 0x1f;
+    shift_max &= 0x1f;
+    if (shift_min > shift_max) {
+      shift_min = 0;
+      shift_max = 31;
     }
   }
-  if (lhs->Max() < 0) {
-    // Right-shifting a negative value cannot make it non-negative, nor smaller.
-    min = std::max(min, lhs->Min());
-    max = std::min(max, -1.0);
-    if (rhs->Min() > 0 && rhs->Max() <= 31) {
-      min = static_cast<int>(min) >> static_cast<int>(rhs->Min());
-    }
-  }
-  if (rhs->Min() > 0 && rhs->Max() <= 31) {
-    // Right-shifting by a positive value yields a small integer value.
-    double shift_min = kMinInt >> static_cast<int>(rhs->Min());
-    double shift_max = kMaxInt >> static_cast<int>(rhs->Min());
-    min = std::max(min, shift_min);
-    max = std::min(max, shift_max);
-  }
+  DCHECK(shift_min >= 0 && shift_max <= 31);
+
+  int32_t lmin = lhs->Min();
+  int32_t min = std::min(std::max(lmin, 0) >> shift_max, lmin >> shift_min);
+  int32_t lmax = lhs->Max();
+  int32_t max = std::max(lmax >> shift_min, std::min(lmax, -1) >> shift_max);
+
   // TODO(jarin) Ideally, the following micro-optimization should be performed
   // by the type constructor.
   if (max != Type::Signed32()->Max() || min != Type::Signed32()->Min()) {
     return Type::Range(min, max, t->zone());
   }
   return Type::Signed32();
 }
 
 
 Type* Typer::Visitor::JSShiftRightLogicalTyper(Type* lhs, Type* rhs, Typer* t) {
@@ skipping 1335 matching lines @@
       TYPED_ARRAYS(TYPED_ARRAY_CASE)
 #undef TYPED_ARRAY_CASE
     }
   }
   return Type::Constant(value, zone());
 }
 
 }  // namespace compiler
 }  // namespace internal
 }  // namespace v8