[turbofan] Compute better types for additions with minus zero.

src/compiler/typer.cc

 // Copyright 2014 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/compiler/typer.h"
 
 #include "src/base/flags.h"
 #include "src/bootstrapper.h"
 #include "src/compilation-dependencies.h"
 #include "src/compiler/common-operator.h"
@@ skipping 238 matching lines @@
   static Type* NumberToInt32(Type*, Typer*);
   static Type* NumberToUint32(Type*, Typer*);
 
   static Type* ObjectIsCallable(Type*, Typer*);
   static Type* ObjectIsNumber(Type*, Typer*);
   static Type* ObjectIsReceiver(Type*, Typer*);
   static Type* ObjectIsSmi(Type*, Typer*);
   static Type* ObjectIsString(Type*, Typer*);
   static Type* ObjectIsUndetectable(Type*, Typer*);
 
-  static Type* JSAddRanger(RangeType*, RangeType*, Typer*);
+  static Type* JSAddRanger(double lhs_min, double lhs_max, double rhs_min,
+                           double rhs_max, Typer* t);
   static Type* JSSubtractRanger(RangeType*, RangeType*, Typer*);
   static Type* JSDivideRanger(RangeType*, RangeType*, Typer*);
   static Type* JSModulusRanger(RangeType*, RangeType*, Typer*);
 
   static ComparisonOutcome JSCompareTyper(Type*, Type*, Typer*);
 
 #define DECLARE_METHOD(x) static Type* x##Typer(Type*, Type*, Typer*);
   JS_SIMPLE_BINOP_LIST(DECLARE_METHOD)
 #undef DECLARE_METHOD
 
@@ skipping 760 matching lines @@
   double x = -V8_INFINITY;
   for (size_t i = 0; i < n; ++i) {
     if (!std::isnan(a[i])) {
       x = std::max(a[i], x);
     }
   }
   DCHECK(!std::isnan(x));
   return x == 0 ? 0 : x;  // -0 -> 0
 }
 
-Type* Typer::Visitor::JSAddRanger(RangeType* lhs, RangeType* rhs, Typer* t) {
+Type* Typer::Visitor::JSAddRanger(double lhs_min, double lhs_max,
+                                  double rhs_min, double rhs_max, Typer* t) {
   double results[4];
-  results[0] = lhs->Min() + rhs->Min();
-  results[1] = lhs->Min() + rhs->Max();
-  results[2] = lhs->Max() + rhs->Min();
-  results[3] = lhs->Max() + rhs->Max();
-  // Since none of the inputs can be -0, the result cannot be -0 either.
-  // However, it can be nan (the sum of two infinities of opposite sign).
+  results[0] = lhs_min + rhs_min;
+  results[1] = lhs_min + rhs_max;
+  results[2] = lhs_max + rhs_min;
+  results[3] = lhs_max + rhs_max;
+  // The results can be nan (the sum of two infinities of opposite sign).
   // On the other hand, if none of the "results" above is nan, then the actual
   // result cannot be nan either.
   int nans = 0;
   for (int i = 0; i < 4; ++i) {
     if (std::isnan(results[i])) ++nans;
   }
   if (nans == 4) return Type::NaN();  // [-inf..-inf] + [inf..inf] or vice versa
   Type* range =
       Type::Range(array_min(results, 4), array_max(results, 4), t->zone());
   return nans == 0 ? range : Type::Union(range, Type::NaN(), t->zone());
   // Examples:
   //   [-inf, -inf] + [+inf, +inf] = NaN
   //   [-inf, -inf] + [n, +inf] = [-inf, -inf] \/ NaN
   //   [-inf, +inf] + [n, +inf] = [-inf, +inf] \/ NaN
   //   [-inf, m] + [n, +inf] = [-inf, +inf] \/ NaN
 }
 
 
 Type* Typer::Visitor::JSAddTyper(Type* lhs, Type* rhs, Typer* t) {
   lhs = ToPrimitive(lhs, t);
   rhs = ToPrimitive(rhs, t);
   if (lhs->Maybe(Type::String()) || rhs->Maybe(Type::String())) {
     if (lhs->Is(Type::String()) || rhs->Is(Type::String())) {
       return Type::String();
     } else {
       return Type::NumberOrString();
     }
   }
-  lhs = Rangify(ToNumber(lhs, t), t);
-  rhs = Rangify(ToNumber(rhs, t), t);
-  if (lhs->Is(Type::NaN()) || rhs->Is(Type::NaN())) return Type::NaN();
-  if (lhs->IsRange() && rhs->IsRange()) {
-    return JSAddRanger(lhs->AsRange(), rhs->AsRange(), t);
+  // The addition must be numeric.
+  lhs = ToNumber(lhs, t);
+  rhs = ToNumber(rhs, t);
+  // We can give more precise types for integers.
+  if (!lhs->Is(t->cache_.kIntegerOrMinusZeroOrNaN) ||
+      !rhs->Is(t->cache_.kIntegerOrMinusZeroOrNaN)) {
+    return Type::Number();
   }
-  return Type::Number();
+  Type* int_lhs = Type::Intersect(lhs, t->cache_.kInteger, t->zone());
+  Type* int_rhs = Type::Intersect(rhs, t->cache_.kInteger, t->zone());
+  Type* result = JSAddRanger(int_lhs->Min(), int_lhs->Max(), int_rhs->Min(),
+                             int_rhs->Max(), t);
+  if (lhs->Maybe(Type::NaN()) || rhs->Maybe(Type::NaN())) {
+    result = Type::Union(result, Type::NaN(), t->zone());
+  }
+  if (lhs->Maybe(Type::MinusZero()) && rhs->Maybe(Type::MinusZero())) {
+    result = Type::Union(result, Type::MinusZero(), t->zone());
+  }
+  return result;
 }
 
 Type* Typer::Visitor::JSSubtractRanger(RangeType* lhs, RangeType* rhs,
                                        Typer* t) {
   double results[4];
   results[0] = lhs->Min() - rhs->Min();
   results[1] = lhs->Min() - rhs->Max();
   results[2] = lhs->Max() - rhs->Min();
   results[3] = lhs->Max() - rhs->Max();
   // Since none of the inputs can be -0, the result cannot be -0.
@@ skipping 1663 matching lines @@
   }
   if (Type::IsInteger(*value)) {
     return Type::Range(value->Number(), value->Number(), zone());
   }
   return Type::Constant(value, zone());
 }
 
 }  // namespace compiler
 }  // namespace internal
 }  // namespace v8