From 80a7be5cd97d10b823a2bc24358a302ed541bc26 Mon Sep 17 00:00:00 2001
From: jarin <jarin@chromium.org>
Date: Wed, 7 Jan 2015 03:38:42 -0800
Subject: [PATCH] Restrict representation inference to avoid truncation of phi
 inputs.

BUG=chromium:446778
LOG=N

Review URL: https://codereview.chromium.org/837153002

Cr-Commit-Position: refs/heads/master@{#25967}
---
 src/compiler/simplified-lowering.cc              |  6 +++---
 test/cctest/compiler/test-simplified-lowering.cc |  8 ++------
 test/mjsunit/compiler/regress-446778.js          | 17 +++++++++++++++++
 3 files changed, 22 insertions(+), 9 deletions(-)
 create mode 100644 test/mjsunit/compiler/regress-446778.js

diff --git a/src/compiler/simplified-lowering.cc b/src/compiler/simplified-lowering.cc
index 5f9a406..1461709 100644
--- a/src/compiler/simplified-lowering.cc
+++ b/src/compiler/simplified-lowering.cc
@@ -307,8 +307,8 @@ class RepresentationSelector {
     if ((use & kRepMask) == kRepTagged) {
       // only tagged uses.
       return kRepTagged;
-    } else if (IsSafeIntAdditiveOperand(node)) {
-      // Integer within [-2^52, 2^52] range.
+    } else if (upper->Is(Type::Integral32())) {
+      // Integer within [-2^31, 2^32[ range.
       if ((use & kRepMask) == kRepFloat64) {
         // only float64 uses.
         return kRepFloat64;
@@ -318,7 +318,7 @@ class RepresentationSelector {
       } else if ((use & kRepMask) == kRepWord32 ||
                  (use & kTypeMask) == kTypeInt32 ||
                  (use & kTypeMask) == kTypeUint32) {
-        // The type is a safe integer, but we only use 32 bits.
+        // We only use 32 bits or we use the result consistently.
         return kRepWord32;
       } else {
         return kRepFloat64;
diff --git a/test/cctest/compiler/test-simplified-lowering.cc b/test/cctest/compiler/test-simplified-lowering.cc
index f1cbcbe..147aa32 100644
--- a/test/cctest/compiler/test-simplified-lowering.cc
+++ b/test/cctest/compiler/test-simplified-lowering.cc
@@ -2037,11 +2037,6 @@ TEST(PhiRepresentation) {
   HandleAndZoneScope scope;
   Zone* z = scope.main_zone();
 
-  Factory* f = z->isolate()->factory();
-  Handle<Object> range_min = f->NewNumber(-1e13);
-  Handle<Object> range_max = f->NewNumber(1e+15);
-  Type* range = Type::Range(range_min, range_max, z);
-
   struct TestData {
     Type* arg1;
     Type* arg2;
@@ -2052,7 +2047,8 @@ TEST(PhiRepresentation) {
   TestData test_data[] = {
       {Type::Signed32(), Type::Unsigned32(), kMachInt32,
        kRepWord32 | kTypeNumber},
-      {range, range, kMachUint32, kRepWord32 | kTypeNumber},
+      {Type::Signed32(), Type::Unsigned32(), kMachUint32,
+       kRepWord32 | kTypeNumber},
       {Type::Signed32(), Type::Signed32(), kMachInt32, kMachInt32},
       {Type::Unsigned32(), Type::Unsigned32(), kMachInt32, kMachUint32},
       {Type::Number(), Type::Signed32(), kMachInt32, kMachFloat64},
diff --git a/test/mjsunit/compiler/regress-446778.js b/test/mjsunit/compiler/regress-446778.js
new file mode 100644
index 0000000..a7fa3fd
--- /dev/null
+++ b/test/mjsunit/compiler/regress-446778.js
@@ -0,0 +1,17 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+function Module() {
+  "use asm";
+  function f() {
+   var i = (140737463189505);
+   do {
+    i = i + i | 0;
+    x = undefined + i | 0;
+   } while (!i);
+  }
+  return { f: f };
+}
+
+Module().f();
-- 
2.7.4