[turbofan] Fix truncation/representation sloppiness wrt. bool/bit.

src/compiler/representation-change.h

 // Copyright 2014 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef V8_COMPILER_REPRESENTATION_CHANGE_H_
 #define V8_COMPILER_REPRESENTATION_CHANGE_H_
 
 #include <sstream>
 
 #include "src/base/bits.h"
 #include "src/compiler/js-graph.h"
 #include "src/compiler/machine-operator.h"
 #include "src/compiler/node-properties-inl.h"
 #include "src/compiler/simplified-operator.h"
 
 namespace v8 {
 namespace internal {
 namespace compiler {
 
 // Contains logic related to changing the representation of values for constants
 // and other nodes, as well as lowering Simplified->Machine operators.
 // Eagerly folds any representation changes for constants.
 class RepresentationChanger {
  public:
   RepresentationChanger(JSGraph* jsgraph, SimplifiedOperatorBuilder* simplified,
                         Isolate* isolate)
       : jsgraph_(jsgraph),
         simplified_(simplified),
         isolate_(isolate),
-        bit_range_(Type::Range(isolate->factory()->NewNumber(0),
-                               isolate->factory()->NewNumber(1),
-                               jsgraph->zone())),
         testing_type_errors_(false),
         type_error_(false) {}
 
   // TODO(titzer): should Word64 also be implicitly convertable to others?
   static const MachineTypeUnion rWord = kRepWord8 | kRepWord16 | kRepWord32;
 
   Node* GetRepresentationFor(Node* node, MachineTypeUnion output_type,
                              MachineTypeUnion use_type) {
     if (!base::bits::IsPowerOfTwo32(output_type & kRepMask)) {
       // There should be only one output representation.
@@ skipping 216 matching lines @@
         return MakeInt32Constant(OpParameter<float>(node));
       case IrOpcode::kNumberConstant:
       case IrOpcode::kFloat64Constant:
         return MakeInt32Constant(OpParameter<double>(node));
       default:
         break;
     }
     // Select the correct X -> Word32 operator.
     const Operator* op;
     if (output_type & kRepBit) {
-      return node;  // No change necessary.
+      return node;  // Sloppy comparison -> word32
     } else if (output_type & kRepFloat64) {
       if (output_type & kTypeUint32 || use_unsigned) {
         op = machine()->ChangeFloat64ToUint32();
       } else {
         op = machine()->ChangeFloat64ToInt32();
       }
     } else if (output_type & kRepFloat32) {
       node = InsertChangeFloat32ToFloat64(node);  // float32 -> float64 -> int32
       if (output_type & kTypeUint32 || use_unsigned) {
         op = machine()->ChangeFloat64ToUint32();
       } else {
         op = machine()->ChangeFloat64ToInt32();
       }
     } else if (output_type & kRepTagged) {
       if (output_type & kTypeUint32 || use_unsigned) {
         op = simplified()->ChangeTaggedToUint32();
       } else {
         op = simplified()->ChangeTaggedToInt32();
       }
     } else {
       return TypeError(node, output_type, kRepWord32);
     }
     return jsgraph()->graph()->NewNode(op, node);
   }
 
   Node* GetBitRepresentationFor(Node* node, MachineTypeUnion output_type) {
     // Eagerly fold representation changes for constants.
     switch (node->opcode()) {
-      case IrOpcode::kInt32Constant: {
-        int32_t value = OpParameter<int32_t>(node);
-        if (value == 0 || value == 1) return node;
-        return jsgraph()->Int32Constant(1);  // value != 0
-      }
-      case IrOpcode::kNumberConstant: {
-        double value = OpParameter<double>(node);
-        if (value == 0 || std::isnan(value)) return jsgraph()->Int32Constant(0);
-        return jsgraph()->Int32Constant(1);  // value != +0.0, -0.0, NaN
-      }
       case IrOpcode::kHeapConstant: {
-        Handle<Object> object = OpParameter<Unique<Object>>(node).handle();
-        return jsgraph()->Int32Constant(object->BooleanValue() ? 1 : 0);
+        Handle<Object> value = OpParameter<Unique<Object> >(node).handle();
+        DCHECK(value.is_identical_to(factory()->true_value()) ||
+               value.is_identical_to(factory()->false_value()));
+        return jsgraph()->Int32Constant(
+            value.is_identical_to(factory()->true_value()) ? 1 : 0);
       }
       default:
         break;
     }
     // Select the correct X -> Bit operator.
     const Operator* op;
-    if (output_type & rWord) {
-      op = simplified()->ChangeWord32ToBit();
-    } else if (output_type & kRepWord64) {
-      op = simplified()->ChangeWord64ToBit();
-    } else if (output_type & kRepTagged) {
-      Type* upper = NodeProperties::GetBounds(node).upper;
-      if (upper->Is(Type::Boolean())) {
-        op = simplified()->ChangeBoolToBit();
-      } else if (upper->Is(Type::Signed32())) {
-        // Tagged -> Int32 -> Bit
-        node = InsertChangeTaggedToInt32(node);
-        op = simplified()->ChangeWord32ToBit();
-      } else if (upper->Is(Type::Unsigned32())) {
-        // Tagged -> Uint32 -> Bit
-        node = InsertChangeTaggedToUint32(node);
-        op = simplified()->ChangeWord32ToBit();
-      } else {
-        return TypeError(node, output_type, kRepBit);
-      }
+    if (output_type & kRepTagged) {
+      op = simplified()->ChangeBoolToBit();
     } else {
       return TypeError(node, output_type, kRepBit);
     }
-    return graph()->NewNode(op, node);
+    return jsgraph()->graph()->NewNode(op, node);
   }
 
   Node* GetWord64RepresentationFor(Node* node, MachineTypeUnion output_type) {
     if (output_type & kRepBit) {
       return node;  // Sloppy comparison -> word64
     }
     // Can't really convert Word64 to anything else. Purported to be internal.
     return TypeError(node, output_type, kRepWord64);
   }
 
@@ skipping 84 matching lines @@
     if (type->Is(Type::Unsigned32())) return kTypeUint32;
     if (type->Is(Type::Number())) return kTypeNumber;
     if (type->Is(Type::Boolean())) return kTypeBool;
     return kTypeAny;
   }
 
  private:
   JSGraph* jsgraph_;
   SimplifiedOperatorBuilder* simplified_;
   Isolate* isolate_;
-  Type* bit_range_;
 
   friend class RepresentationChangerTester;  // accesses the below fields.
 
   bool testing_type_errors_;  // If {true}, don't abort on a type error.
   bool type_error_;           // Set when a type error is detected.
 
   Node* TypeError(Node* node, MachineTypeUnion output_type,
                   MachineTypeUnion use) {
     type_error_ = true;
     if (!testing_type_errors_) {
       std::ostringstream out_str;
       out_str << static_cast<MachineType>(output_type);
 
       std::ostringstream use_str;
       use_str << static_cast<MachineType>(use);
 
       V8_Fatal(__FILE__, __LINE__,
                "RepresentationChangerError: node #%d:%s of "
                "%s cannot be changed to %s",
                node->id(), node->op()->mnemonic(), out_str.str().c_str(),
                use_str.str().c_str());
     }
     return node;
   }
 
   Node* InsertChangeFloat32ToFloat64(Node* node) {
-    return graph()->NewNode(machine()->ChangeFloat32ToFloat64(), node);
+    return jsgraph()->graph()->NewNode(machine()->ChangeFloat32ToFloat64(),
+                                       node);
   }
 
   Node* InsertChangeTaggedToFloat64(Node* node) {
-    return graph()->NewNode(simplified()->ChangeTaggedToFloat64(), node);
+    return jsgraph()->graph()->NewNode(simplified()->ChangeTaggedToFloat64(),
+                                       node);
   }
 
-  Node* InsertChangeTaggedToInt32(Node* node) {
-    return graph()->NewNode(simplified()->ChangeTaggedToInt32(), node);
-  }
-
-  Node* InsertChangeTaggedToUint32(Node* node) {
-    return graph()->NewNode(simplified()->ChangeTaggedToUint32(), node);
-  }
-
-  Graph* graph() const { return jsgraph()->graph(); }
   JSGraph* jsgraph() const { return jsgraph_; }
   Isolate* isolate() const { return isolate_; }
-  SimplifiedOperatorBuilder* simplified() const { return simplified_; }
-  MachineOperatorBuilder* machine() const { return jsgraph()->machine(); }
+  Factory* factory() const { return isolate()->factory(); }
+  SimplifiedOperatorBuilder* simplified() { return simplified_; }
+  MachineOperatorBuilder* machine() { return jsgraph()->machine(); }
 };
 
 }  // namespace compiler
 }  // namespace internal
 }  // namespace v8
 
 #endif  // V8_COMPILER_REPRESENTATION_CHANGE_H_