Precise shift right result type derivation for all int32 input ranges.

src/compiler/typer.cc

Index: src/compiler/typer.cc
diff --git a/src/compiler/typer.cc b/src/compiler/typer.cc
index 6fd609f2ab2ef6fad23189d1585ce6b7b181afcc..6d5f27e43d9d30d855936803a3fea13c6edaf46f 100644
--- a/src/compiler/typer.cc
+++ b/src/compiler/typer.cc
@@ -987,32 +987,29 @@ Type* Typer::Visitor::JSShiftLeftTyper(Type* lhs, Type* rhs, Typer* t) {
 
 Type* Typer::Visitor::JSShiftRightTyper(Type* lhs, Type* rhs, Typer* t) {
   lhs = NumberToInt32(ToNumber(lhs, t), t);
-  rhs = NumberToUint32(ToNumber(rhs, t), t);
-  double min = kMinInt;
-  double max = kMaxInt;
-  if (lhs->Min() >= 0) {
-    // Right-shifting a non-negative value cannot make it negative, nor larger.
-    min = std::max(min, 0.0);
-    max = std::min(max, lhs->Max());
-    if (rhs->Min() > 0 && rhs->Max() <= 31) {
-      max = static_cast<int>(max) >> static_cast<int>(rhs->Min());
-    }
-  }
-  if (lhs->Max() < 0) {
-    // Right-shifting a negative value cannot make it non-negative, nor smaller.
-    min = std::max(min, lhs->Min());
-    max = std::min(max, -1.0);
-    if (rhs->Min() > 0 && rhs->Max() <= 31) {
-      min = static_cast<int>(min) >> static_cast<int>(rhs->Min());
+  rhs = NumberToInt32(ToNumber(rhs, t), t);
+
+  // Canonicalize the shift range to 0 to 31.
+  int32_t shift_min = rhs->Min();

[titzer, 2015/05/06 11:53:12]

Would it be possible to pull the integer range logic out to a separate function
so that it can be tested simple integer ranges instead of requiring the
construction of types, etc? That would allow more exhaustive and more efficient
unit testing, and allow us to apply the rules to machine-left shifts, too.

+  int32_t shift_max = rhs->Max();
+  if ((int64_t(shift_max) - int64_t(shift_min)) >= 31) {
+    shift_min = 0;
+    shift_max = 31;
+  } else {
+    shift_min &= 0x1f;
+    shift_max &= 0x1f;
+    if (shift_min > shift_max) {
+      shift_min = 0;
+      shift_max = 31;
     }
   }
-  if (rhs->Min() > 0 && rhs->Max() <= 31) {
-    // Right-shifting by a positive value yields a small integer value.
-    double shift_min = kMinInt >> static_cast<int>(rhs->Min());
-    double shift_max = kMaxInt >> static_cast<int>(rhs->Min());
-    min = std::max(min, shift_min);
-    max = std::min(max, shift_max);
-  }
+  DCHECK(shift_min >= 0 && shift_max <= 31);
+
+  int32_t lmin = lhs->Min();
+  int32_t min = std::min(std::max(lmin, 0) >> shift_max, lmin >> shift_min);
+  int32_t lmax = lhs->Max();
+  int32_t max = std::max(lmax >> shift_min, std::min(lmax, -1) >> shift_max);
+
   // TODO(jarin) Ideally, the following micro-optimization should be performed
   // by the type constructor.
   if (max != Type::Signed32()->Max() || min != Type::Signed32()->Min()) {