Precise shift right result type derivation for all int32 input ranges.

src/compiler/typer.cc

 // Copyright 2014 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/base/flags.h"
 #include "src/bootstrapper.h"
 #include "src/compiler/graph-reducer.h"
 #include "src/compiler/js-operator.h"
 #include "src/compiler/node.h"
 #include "src/compiler/node-properties.h"
@@ skipping 966 matching lines @@
   }
   return Type::Signed32();
 }
 
 
 Type* Typer::Visitor::JSShiftLeftTyper(Type* lhs, Type* rhs, Typer* t) {
   return Type::Signed32();
 }
 
 
+IntType JSShiftRightIntType(IntType lhs, IntType rhs) {
+  // Canonicalize the shift range to 0 to 31.
+  int32_t shift_min = rhs.min;
+  int32_t shift_max = rhs.max;
+  if ((int64_t(shift_max) - int64_t(shift_min)) >= 31) {
+    shift_min = 0;
+    shift_max = 31;
+  } else {
+    shift_min &= 0x1f;
+    shift_max &= 0x1f;
+    if (shift_min > shift_max) {
+      shift_min = 0;
+      shift_max = 31;
+    }
+  }
+  DCHECK(shift_min >= 0 && shift_max <= 31);
+
+  return IntType(lhs.min < 0 ? lhs.min >> shift_min : lhs.min >> shift_max,
+                 lhs.max >= 0 ? lhs.max >> shift_min : lhs.max >> shift_max);
+}
+
+
 Type* Typer::Visitor::JSShiftRightTyper(Type* lhs, Type* rhs, Typer* t) {
   lhs = NumberToInt32(ToNumber(lhs, t), t);
-  rhs = NumberToUint32(ToNumber(rhs, t), t);
-  double min = kMinInt;
-  double max = kMaxInt;
-  if (lhs->Min() >= 0) {
-    // Right-shifting a non-negative value cannot make it negative, nor larger.
-    min = std::max(min, 0.0);
-    max = std::min(max, lhs->Max());
-    if (rhs->Min() > 0 && rhs->Max() <= 31) {
-      max = static_cast<int>(max) >> static_cast<int>(rhs->Min());
-    }
-  }
-  if (lhs->Max() < 0) {
-    // Right-shifting a negative value cannot make it non-negative, nor smaller.
-    min = std::max(min, lhs->Min());
-    max = std::min(max, -1.0);
-    if (rhs->Min() > 0 && rhs->Max() <= 31) {
-      min = static_cast<int>(min) >> static_cast<int>(rhs->Min());
-    }
-  }
-  if (rhs->Min() > 0 && rhs->Max() <= 31) {
-    // Right-shifting by a positive value yields a small integer value.
-    double shift_min = kMinInt >> static_cast<int>(rhs->Min());
-    double shift_max = kMaxInt >> static_cast<int>(rhs->Min());
-    min = std::max(min, shift_min);
-    max = std::min(max, shift_max);
-  }
+  rhs = NumberToInt32(ToNumber(rhs, t), t);
+  IntType type = JSShiftRightIntType(IntType(lhs->Min(), lhs->Max()),
+                                     IntType(rhs->Min(), rhs->Max()));
+
   // TODO(jarin) Ideally, the following micro-optimization should be performed
   // by the type constructor.
-  if (max != Type::Signed32()->Max() || min != Type::Signed32()->Min()) {
-    return Type::Range(min, max, t->zone());
+  if (type.max != Type::Signed32()->Max() ||
+      type.min != Type::Signed32()->Min()) {
+    return Type::Range(type.min, type.max, t->zone());
   }
   return Type::Signed32();
 }
 
 
 Type* Typer::Visitor::JSShiftRightLogicalTyper(Type* lhs, Type* rhs, Typer* t) {
   lhs = NumberToUint32(ToNumber(lhs, t), t);
   // Logical right-shifting any value cannot make it larger.
   return Type::Range(0.0, lhs->Max(), t->zone());
 }
@@ skipping 1337 matching lines @@
       TYPED_ARRAYS(TYPED_ARRAY_CASE)
 #undef TYPED_ARRAY_CASE
     }
   }
   return Type::Constant(value, zone());
 }
 
 }  // namespace compiler
 }  // namespace internal
 }  // namespace v8