[machine-operator-reducer] fix float truncation

test/unittests/compiler/machine-operator-reducer-unittest.cc

 // Copyright 2014 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/base/bits.h"
 #include "src/base/division-by-constant.h"
 #include "src/compiler/js-graph.h"
 #include "src/compiler/machine-operator-reducer.h"
 #include "src/compiler/typer.h"
 #include "src/conversions-inl.h"
@@ skipping 1631 matching lines @@
     Reduction r = Reduce(node);
     ASSERT_TRUE(r.Changed());
     EXPECT_THAT(r.replacement(),
                 IsStore(rep, base, index, value, effect, control));
   }
 }
 
 
 TEST_F(MachineOperatorReducerTest, RoundPlusTruncate) {
   Node* p0 = Parameter(0);
+
+  Type* p0_range = Type::Range(0x0, 0xFFFFFF8000001ULL, graph()->zone());
+  NodeProperties::SetType(
+      p0, Type::Intersect(p0_range, Type::Number(), graph()->zone()));
+
   Node* t0 = graph()->NewNode(machine()->RoundInt64ToFloat64(), p0);
   Node* t1 = graph()->NewNode(
       machine()->TruncateFloat64ToInt32(TruncationMode::kJavaScript), t0);
 
   Reduction r = Reduce(t1);
   ASSERT_TRUE(r.Changed());
-  EXPECT_THAT(r.replacement(), p0);
+  EXPECT_THAT(r.replacement(), IsTruncateInt64ToInt32(p0));
+}
+
+
+TEST_F(MachineOperatorReducerTest, OverflowingRoundPlusTruncate) {
+  Node* p0 = Parameter(0);
+
+  Type* p0_range = Type::Range(0x0, 0x10000000000000ULL, graph()->zone());
+  NodeProperties::SetType(
+      p0, Type::Intersect(p0_range, Type::Number(), graph()->zone()));
+
+  Node* t0 = graph()->NewNode(machine()->RoundInt64ToFloat64(), p0);
+  Node* t1 = graph()->NewNode(
+      machine()->TruncateFloat64ToInt32(TruncationMode::kJavaScript), t0);
+
+  Reduction r = Reduce(t1);
+  ASSERT_TRUE(!r.Changed());
 }
 
 }  // namespace compiler
 }  // namespace internal
 }  // namespace v8