[turbofan] Check word32 -> float64 conversion with input type/output truncation.

src/compiler/representation-change.h

 // Copyright 2014 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef V8_COMPILER_REPRESENTATION_CHANGE_H_
 #define V8_COMPILER_REPRESENTATION_CHANGE_H_
 
 #include <sstream>
 
 #include "src/base/bits.h"
@@ skipping 36 matching lines @@
       // Since loads of integers from memory implicitly sign or zero extend the
       // value to the full machine word size and stores implicitly truncate,
       // no representation change is necessary.
       return node;
     }
     if (use_type & kRepTagged) {
       return GetTaggedRepresentationFor(node, output_type);
     } else if (use_type & kRepFloat32) {
       return GetFloat32RepresentationFor(node, output_type);
     } else if (use_type & kRepFloat64) {
-      return GetFloat64RepresentationFor(node, output_type);
+      return GetFloat64RepresentationFor(node, output_type, use_type);
     } else if (use_type & kRepBit) {
       return GetBitRepresentationFor(node, output_type);
     } else if (IsWord(use_type)) {
       return GetWord32RepresentationFor(node, output_type);
     } else if (use_type & kRepWord64) {
       return GetWord64RepresentationFor(node, output_type);
     } else {
       return node;
     }
   }
@@ skipping 86 matching lines @@
       node = jsgraph()->graph()->NewNode(op, node);
       op = machine()->TruncateFloat64ToFloat32();
     } else if (output_type & kRepFloat64) {
       op = machine()->TruncateFloat64ToFloat32();
     } else {
       return TypeError(node, output_type, kRepFloat32);
     }
     return jsgraph()->graph()->NewNode(op, node);
   }
 
-  Node* GetFloat64RepresentationFor(Node* node, MachineTypeUnion output_type) {
+  Node* GetFloat64RepresentationFor(Node* node, MachineTypeUnion output_type,
+                                    MachineTypeUnion use_type) {
     // Eagerly fold representation changes for constants.
     switch (node->opcode()) {
       case IrOpcode::kNumberConstant:
         return jsgraph()->Float64Constant(OpParameter<double>(node));
       case IrOpcode::kInt32Constant:
         if (output_type & kTypeUint32) {
           uint32_t value = static_cast<uint32_t>(OpParameter<int32_t>(node));
           return jsgraph()->Float64Constant(static_cast<double>(value));
         } else {
           int32_t value = OpParameter<int32_t>(node);
           return jsgraph()->Float64Constant(value);
         }
       case IrOpcode::kFloat64Constant:
         return node;  // No change necessary.
       case IrOpcode::kFloat32Constant:
         return jsgraph()->Float64Constant(OpParameter<float>(node));
       default:
         break;
     }
     // Select the correct X -> Float64 operator.
     const Operator* op;
     if (output_type & kRepBit) {
       return TypeError(node, output_type, kRepFloat64);
     } else if (IsWord(output_type)) {
       if (output_type & kTypeUint32) {
         op = machine()->ChangeUint32ToFloat64();
       } else {
+        // Either the output is int32 or the uses only care about the
+        // low 32 bits (so we can pick int32 safely).
+        DCHECK(output_type & kTypeInt32 ||
+               !(use_type & ~(kTypeInt32 | kTypeUint32 | kRepMask)));
         op = machine()->ChangeInt32ToFloat64();
       }
     } else if (output_type & kRepTagged) {
       op = simplified()->ChangeTaggedToFloat64();
     } else if (output_type & kRepFloat32) {
       op = machine()->ChangeFloat32ToFloat64();
     } else {
       return TypeError(node, output_type, kRepFloat64);
     }
     return jsgraph()->graph()->NewNode(op, node);
@@ skipping 51 matching lines @@
         return MakeInt32Constant(OpParameter<float>(node));
       case IrOpcode::kNumberConstant:
       case IrOpcode::kFloat64Constant:
         return MakeInt32Constant(OpParameter<double>(node));
       default:
         break;
     }
     // Select the correct X -> Word32 operator.
     const Operator* op;
     Type* type = NodeProperties::GetType(node);
+
     if (output_type & kRepBit) {
       return node;  // Sloppy comparison -> word32
     } else if (output_type & kRepFloat64) {
       if (output_type & kTypeUint32 || type->Is(Type::Unsigned32())) {
         op = machine()->ChangeFloat64ToUint32();
       } else if (output_type & kTypeInt32 || type->Is(Type::Signed32())) {
         op = machine()->ChangeFloat64ToInt32();
       } else {
         op = machine()->TruncateFloat64ToInt32(TruncationMode::kJavaScript);
       }
@@ skipping 191 matching lines @@
   Factory* factory() const { return isolate()->factory(); }
   SimplifiedOperatorBuilder* simplified() { return jsgraph()->simplified(); }
   MachineOperatorBuilder* machine() { return jsgraph()->machine(); }
 };
 
 }  // namespace compiler
 }  // namespace internal
 }  // namespace v8
 
 #endif  // V8_COMPILER_REPRESENTATION_CHANGE_H_