[turbofan] Fix bug in Number.Min/Max typings

They try to be very precise about when the result can be -0,
but do so incorrectly. I'm changing the code to just do the
simple thing instead. Let's see how that affects performance.

Bug: chromium:1072171
Change-Id: I9737a84aa19d06685af5b7bca541e348dc37cca8
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2157028Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67246}

src/compiler/operation-typer.cc

@@ -1040,32 +1040,26 @@ Type OperationTyper::NumberMax(Type lhs, Type rhs) {
   if (lhs.Maybe(Type::NaN()) || rhs.Maybe(Type::NaN())) {
     type = Type::Union(type, Type::NaN(), zone());
   }
+  if (lhs.Maybe(Type::MinusZero()) || rhs.Maybe(Type::MinusZero())) {
+    type = Type::Union(type, Type::MinusZero(), zone());
+  }
 
   if (!lhs.Is(cache_->kIntegerOrMinusZeroOrNaN) ||
       !rhs.Is(cache_->kIntegerOrMinusZeroOrNaN)) {
     return Type::Union(type, Type::Union(lhs, rhs, zone()), zone());
   }
 
-  bool const lhs_maybe_minus_zero = lhs.Maybe(Type::MinusZero());
-  bool const rhs_maybe_minus_zero = rhs.Maybe(Type::MinusZero());
   lhs = Type::Intersect(lhs, cache_->kInteger, zone());
   rhs = Type::Intersect(rhs, cache_->kInteger, zone());
 
-  bool maybe_minus_zero = lhs_maybe_minus_zero || rhs_maybe_minus_zero;
   if (!lhs.IsNone() || !rhs.IsNone()) {
     double min = std::max(lhs.IsNone() ? -V8_INFINITY : lhs.Min(),
                           rhs.IsNone() ? -V8_INFINITY : rhs.Min());
     double max = std::max(lhs.IsNone() ? -V8_INFINITY : lhs.Max(),
                           rhs.IsNone() ? -V8_INFINITY : rhs.Max());
     type = Type::Union(type, Type::Range(min, max, zone()), zone());
-    maybe_minus_zero =
-        maybe_minus_zero && (min < 0.0 || (min == 0.0 && lhs_maybe_minus_zero &&
-                                           rhs_maybe_minus_zero));
   }
 
-  if (maybe_minus_zero) {
-    type = Type::Union(type, Type::MinusZero(), zone());
-  }
   return type;
 }
 
@@ -1080,14 +1074,15 @@ Type OperationTyper::NumberMin(Type lhs, Type rhs) {
   if (lhs.Maybe(Type::NaN()) || rhs.Maybe(Type::NaN())) {
     type = Type::Union(type, Type::NaN(), zone());
   }
+  if (lhs.Maybe(Type::MinusZero()) || rhs.Maybe(Type::MinusZero())) {
+    type = Type::Union(type, Type::MinusZero(), zone());
+  }
 
   if (!lhs.Is(cache_->kIntegerOrMinusZeroOrNaN) ||
       !rhs.Is(cache_->kIntegerOrMinusZeroOrNaN)) {
     return Type::Union(type, Type::Union(lhs, rhs, zone()), zone());
   }
 
-  bool maybe_minus_zero =
-      lhs.Maybe(Type::MinusZero()) || rhs.Maybe(Type::MinusZero());
   lhs = Type::Intersect(lhs, cache_->kInteger, zone());
   rhs = Type::Intersect(rhs, cache_->kInteger, zone());
 
@@ -1097,12 +1092,8 @@ Type OperationTyper::NumberMin(Type lhs, Type rhs) {
     double max = std::min(lhs.IsNone() ? +V8_INFINITY : lhs.Max(),
                           rhs.IsNone() ? +V8_INFINITY : rhs.Max());
     type = Type::Union(type, Type::Range(min, max, zone()), zone());
-    maybe_minus_zero = maybe_minus_zero && max >= 0.0;
   }
 
-  if (maybe_minus_zero) {
-    type = Type::Union(type, Type::MinusZero(), zone());
-  }
   return type;
 }
 

test/mjsunit/compiler/regress-1072171.js

+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function testMax1(b) {
+  const max = Math.max(-1, b ? -0 : 1);
+  return Object.is(max, -0);
+}
+%PrepareFunctionForOptimization(testMax1);
+assertTrue(testMax1(true));
+assertTrue(testMax1(true));
+%OptimizeFunctionOnNextCall(testMax1);
+assertTrue(testMax1(true));
+
+function testMax2(b) {
+  const max = Math.max(b ? -0 : 1, -1);
+  return Object.is(max, -0);
+}
+%PrepareFunctionForOptimization(testMax2);
+assertTrue(testMax2(true));
+assertTrue(testMax2(true));
+%OptimizeFunctionOnNextCall(testMax2);
+assertTrue(testMax2(true));
+
+function testMin1(b) {
+  const min = Math.min(1, b ? -0 : -1);
+  return Object.is(min, -0);
+}
+%PrepareFunctionForOptimization(testMin1);
+assertTrue(testMin1(true));
+assertTrue(testMin1(true));
+%OptimizeFunctionOnNextCall(testMin1);
+assertTrue(testMin1(true));
+
+function testMin2(b) {
+  const min = Math.min(b ? -0 : -1, 1);
+  return Object.is(min, -0);
+}
+%PrepareFunctionForOptimization(testMin2);
+assertTrue(testMin2(true));
+assertTrue(testMin2(true));
+%OptimizeFunctionOnNextCall(testMin2);
+assertTrue(testMin2(true));

test/unittests/compiler/typer-unittest.cc

@@ -622,12 +622,10 @@ TEST_F(TyperTest, Manual_Operation_NumberMax) {
   Type f = t(Type::MinusZero(), zero);
   CHECK(zero.Is(f));
   CHECK(f.Is(b));
-  CHECK(f.Is(zero));  // Checks precision, not soundness.
 
   Type g = t(zero, Type::MinusZero());
   CHECK(zero.Is(g));
   CHECK(g.Is(c));
-  CHECK(g.Is(zero));  // Checks precision, not soundness.
 }
 
 TEST_F(TyperTest, Manual_Operation_NumberMin) {