Revert "tighten invariants of HValue::InferRange"

This change reportedly causes a slowdown or inifinite loop on ARM.  Revert
pending investigation.

R=vegorov@chromium.org
BUG=
TEST=

Review URL: http://codereview.chromium.org/7566040

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8834 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

diff --git a/src/hydrogen-instructions.cc b/src/hydrogen-instructions.cc
index 5bea55a..2be2a03 100644 (file)
--- a/src/hydrogen-instructions.cc
+++ b/src/hydrogen-instructions.cc
@@ -862,10 +862,19 @@ void HInstanceOf::PrintDataTo(StringStream* stream) {
 
 
 Range* HValue::InferRange() {
-  // Untagged integer32 cannot be -0, all other representations can.
-  Range* result = new Range();
-  result->set_can_be_minus_zero(!representation().IsInteger32());
-  return result;
+  if (representation().IsTagged()) {
+    // Tagged values are always in int32 range when converted to integer,
+    // but they can contain -0.
+    Range* result = new Range();
+    result->set_can_be_minus_zero(true);
+    return result;
+  } else if (representation().IsNone()) {
+    return NULL;
+  } else {
+    // Untagged integer32 cannot be -0 and we don't compute ranges for
+    // untagged doubles.
+    return new Range();
+  }
 }
 
 

diff --git a/test/mjsunit/math-floor.js b/test/mjsunit/math-floor.js
index c299203..11f4cd7 100644 (file)
--- a/test/mjsunit/math-floor.js
+++ b/test/mjsunit/math-floor.js
@@ -51,17 +51,6 @@ function test() {
   testFloor(-Infinity, -Infinity);
   testFloor(NaN, NaN);
 
-  // Ensure that a negative zero coming from Math.floor is properly handled
-  // by other operations.
-  function ifloor(x) {
-    return 1 / Math.floor(x);
-  }
-  assertEquals(-Infinity, ifloor(-0));
-  assertEquals(-Infinity, ifloor(-0));
-  assertEquals(-Infinity, ifloor(-0));
-  %OptimizeFunctionOnNextCall(ifloor);
-  assertEquals(-Infinity, ifloor(-0));
-
   testFloor(0, 0.1);
   testFloor(0, 0.49999999999999994);
   testFloor(0, 0.5);
@@ -140,19 +129,3 @@ function test() {
 for (var i = 0; i < 500; i++) {
   test();
 }
-
-
-// Regression test for a bug where a negative zero coming from Math.floor
-// was not properly handled by other operations.
-function floorsum(i, n) {
-  var ret = Math.floor(n);
-  while (--i > 0) {
-    ret += Math.floor(n);
-  }
-  return ret;
-}
-assertEquals(-0, floorsum(1, -0));
-%OptimizeFunctionOnNextCall(floorsum);
-// The optimized function will deopt.  Run it with enough iterations to try
-// to optimize via OSR (triggering the bug).
-assertEquals(-0, floorsum(100000, -0));

diff --git a/test/mjsunit/math-round.js b/test/mjsunit/math-round.js
index 973040d..1366557 100644 (file)
--- a/test/mjsunit/math-round.js
+++ b/test/mjsunit/math-round.js
@@ -1,4 +1,4 @@
-// Copyright 2011 the V8 project authors. All rights reserved.
+// Copyright 2010 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
@@ -44,21 +44,6 @@ testRound(Infinity, Infinity);
 testRound(-Infinity, -Infinity);
 testRound(NaN, NaN);
 
-// Regression test for a bug where a negative zero coming from Math.round
-// was not properly handled by other operations.
-function roundsum(i, n) {
-  var ret = Math.round(n);
-  while (--i > 0) {
-    ret += Math.round(n);
-  }
-  return ret;
-}
-assertEquals(-0, roundsum(1, -0));
-%OptimizeFunctionOnNextCall(roundsum);
-// The optimized function will deopt.  Run it with enough iterations to try
-// to optimize via OSR (triggering the bug).
-assertEquals(-0, roundsum(100000, -0));
-
 testRound(1, 0.5);
 testRound(1, 0.7);
 testRound(1, 1);