[turbofan] Extend typer for number comparison ops.

This extends the existing typer for JS-level comparisons to also be
applied on simplified-level number comparisons. Now that nodes having
such operators are introduced early during graph construction, precise
type information has become more important.

R=jarin@chromium.org
TEST=unittests/TyperTest

Change-Id: Ibcfda36cadf72381b3c63138dd8ad2f6b1f7fbba
Reviewed-on: https://chromium-review.googlesource.com/445879
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43447}

src/compiler/typer.cc

@@ -293,6 +293,7 @@ class Typer::Visitor : public Reducer {
   static Type* ObjectIsUndetectable(Type*, Typer*);
 
   static ComparisonOutcome JSCompareTyper(Type*, Type*, Typer*);
+  static ComparisonOutcome NumberCompareTyper(Type*, Type*, Typer*);
 
 #define DECLARE_METHOD(x) static Type* x##Typer(Type*, Type*, Typer*);
   JS_SIMPLE_BINOP_LIST(DECLARE_METHOD)
@@ -300,6 +301,8 @@ class Typer::Visitor : public Reducer {
 
   static Type* JSCallTyper(Type*, Typer*);
 
+  static Type* NumberLessThanTyper(Type*, Type*, Typer*);
+  static Type* NumberLessThanOrEqualTyper(Type*, Type*, Typer*);
   static Type* ReferenceEqualTyper(Type*, Type*, Typer*);
   static Type* StringFromCharCodeTyper(Type*, Typer*);
   static Type* StringFromCodePointTyper(Type*, Typer*);
@@ -939,9 +942,12 @@ Typer::Visitor::ComparisonOutcome Typer::Visitor::JSCompareTyper(Type* lhs,
     return ComparisonOutcome(kComparisonTrue) |
            ComparisonOutcome(kComparisonFalse);
   }
-  lhs = ToNumber(lhs, t);
-  rhs = ToNumber(rhs, t);
+  return NumberCompareTyper(ToNumber(lhs, t), ToNumber(rhs, t), t);
+}
 
+Typer::Visitor::ComparisonOutcome Typer::Visitor::NumberCompareTyper(Type* lhs,
+                                                                     Type* rhs,
+                                                                     Typer* t) {
   // Shortcut for NaNs.
   if (lhs->Is(Type::NaN()) || rhs->Is(Type::NaN())) return kComparisonUndefined;
 
@@ -1695,10 +1701,25 @@ Type* Typer::Visitor::TypeBooleanNot(Node* node) { return Type::Boolean(); }
 
 Type* Typer::Visitor::TypeNumberEqual(Node* node) { return Type::Boolean(); }
 
-Type* Typer::Visitor::TypeNumberLessThan(Node* node) { return Type::Boolean(); }
+// static
+Type* Typer::Visitor::NumberLessThanTyper(Type* lhs, Type* rhs, Typer* t) {
+  return FalsifyUndefined(
+      NumberCompareTyper(ToNumber(lhs, t), ToNumber(rhs, t), t), t);
+}
+
+// static
+Type* Typer::Visitor::NumberLessThanOrEqualTyper(Type* lhs, Type* rhs,
+                                                 Typer* t) {
+  return FalsifyUndefined(
+      Invert(JSCompareTyper(ToNumber(rhs, t), ToNumber(lhs, t), t), t), t);
+}
+
+Type* Typer::Visitor::TypeNumberLessThan(Node* node) {
+  return TypeBinaryOp(node, NumberLessThanTyper);
+}
 
 Type* Typer::Visitor::TypeNumberLessThanOrEqual(Node* node) {
-  return Type::Boolean();
+  return TypeBinaryOp(node, NumberLessThanOrEqualTyper);
 }
 
 Type* Typer::Visitor::TypeSpeculativeNumberEqual(Node* node) {
@@ -1706,11 +1727,11 @@ Type* Typer::Visitor::TypeSpeculativeNumberEqual(Node* node) {
 }
 
 Type* Typer::Visitor::TypeSpeculativeNumberLessThan(Node* node) {
-  return Type::Boolean();
+  return TypeBinaryOp(node, NumberLessThanTyper);
 }
 
 Type* Typer::Visitor::TypeSpeculativeNumberLessThanOrEqual(Node* node) {
-  return Type::Boolean();
+  return TypeBinaryOp(node, NumberLessThanOrEqualTyper);
 }
 
 Type* Typer::Visitor::TypePlainPrimitiveToNumber(Node* node) {

test/unittests/compiler/typer-unittest.cc

@@ -8,6 +8,7 @@
 #include "src/compiler/js-operator.h"
 #include "src/compiler/node-properties.h"
 #include "src/compiler/operator-properties.h"
+#include "src/compiler/simplified-operator.h"
 #include "src/objects-inl.h"
 #include "test/cctest/types-fuzz.h"
 #include "test/unittests/compiler/graph-unittest.h"
@@ -22,7 +23,8 @@ class TyperTest : public TypedGraphTest {
   TyperTest()
       : TypedGraphTest(3),
         types_(zone(), isolate(), random_number_generator()),
-        javascript_(zone()) {
+        javascript_(zone()),
+        simplified_(zone()) {
     context_node_ = graph()->NewNode(common()->Parameter(2), graph()->start());
     rng_ = random_number_generator();
 
@@ -52,6 +54,7 @@ class TyperTest : public TypedGraphTest {
 
   Types types_;
   JSOperatorBuilder javascript_;
+  SimplifiedOperatorBuilder simplified_;
   BinaryOperationHint const hints_ = BinaryOperationHint::kAny;
   Node* context_node_;
   v8::base::RandomNumberGenerator* rng_;
@@ -295,12 +298,31 @@ TEST_F(TyperTest, TypeJSLessThan) {
                       std::less<double>());
 }
 
+TEST_F(TyperTest, TypeNumberLessThan) {
+  TestBinaryCompareOp(simplified_.NumberLessThan(), std::less<double>());
+}
+
+TEST_F(TyperTest, TypeSpeculativeNumberLessThan) {
+  TestBinaryCompareOp(simplified_.SpeculativeNumberLessThan(
+                          NumberOperationHint::kNumberOrOddball),
+                      std::less<double>());
+}
 
 TEST_F(TyperTest, TypeJSLessThanOrEqual) {
   TestBinaryCompareOp(javascript_.LessThanOrEqual(CompareOperationHint::kAny),
                       std::less_equal<double>());
 }
 
+TEST_F(TyperTest, TypeNumberLessThanOrEqual) {
+  TestBinaryCompareOp(simplified_.NumberLessThanOrEqual(),
+                      std::less_equal<double>());
+}
+
+TEST_F(TyperTest, TypeSpeculativeNumberLessThanOrEqual) {
+  TestBinaryCompareOp(simplified_.SpeculativeNumberLessThanOrEqual(
+                          NumberOperationHint::kNumberOrOddball),
+                      std::less_equal<double>());
+}
 
 TEST_F(TyperTest, TypeJSGreaterThan) {
   TestBinaryCompareOp(javascript_.GreaterThan(CompareOperationHint::kAny),