[turbofan] Fix Word32 (Signed32OrMinusZero) conversions that identify zeros.

When converting a Signed32\/MinusZero value from Word32 to Float64
representation or just passing it through as Word32 (with potential
type checks on it) we don't need to worry about -0 as long as the uses
identify 0 and -0.

Drive-by-fix: Fix the CheckChange() helper in the representation
changer test to pass Truncation::Any() by default.

Bug: chromium:891639, chromium:891612, chromium:891627, v8:8015, v8:8178
Change-Id: I06948ec0cdb8e778cb3678124ef927277a5f40ee
Reviewed-on: https://chromium-review.googlesource.com/c/1258902Reviewed-by: Sigurd Schneider <sigurds@chromium.org>
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#56369}

src/compiler/representation-change.cc

@@ -625,7 +625,9 @@ Node* RepresentationChanger::GetFloat64RepresentationFor(
     return jsgraph()->graph()->NewNode(
         jsgraph()->common()->DeadValue(MachineRepresentation::kFloat64), node);
   } else if (IsWord(output_rep)) {
-    if (output_type.Is(Type::Signed32())) {
+    if (output_type.Is(Type::Signed32()) ||
+        (output_type.Is(Type::Signed32OrMinusZero()) &&
+         use_info.truncation().IdentifiesZeroAndMinusZero())) {
       op = machine()->ChangeInt32ToFloat64();
     } else if (output_type.Is(Type::Unsigned32()) ||
                use_info.truncation().IsUsedAsWord32()) {
@@ -806,6 +808,12 @@ Node* RepresentationChanger::GetWord32RepresentationFor(
                        MachineRepresentation::kWord32);
     }
   } else if (output_rep == MachineRepresentation::kWord32) {
+    if (use_info.truncation().IdentifiesZeroAndMinusZero()) {
+      if (output_type.Is(Type::Signed32OrMinusZero()) ||
+          output_type.Is(Type::Unsigned32OrMinusZero())) {
+        return node;
+      }
+    }
     // Only the checked case should get here, the non-checked case is
     // handled in GetRepresentationFor.
     if (use_info.type_check() == TypeCheckKind::kSignedSmall ||

test/cctest/compiler/test-representation-change.cc

@@ -310,7 +310,7 @@ static void CheckChange(IrOpcode::Value expected, MachineRepresentation from,
 
 static void CheckChange(IrOpcode::Value expected, MachineRepresentation from,
                         Type from_type, MachineRepresentation to) {
-  CheckChange(expected, from, from_type, UseInfo(to, Truncation::None()));
+  CheckChange(expected, from, from_type, UseInfo(to, Truncation::Any()));
 }
 
 static void CheckTwoChanges(IrOpcode::Value expected2,
@@ -516,6 +516,10 @@ TEST(SingleChanges) {
   // Int32,Uint32 <-> Float64 are actually machine conversions.
   CheckChange(IrOpcode::kChangeInt32ToFloat64, MachineRepresentation::kWord32,
               Type::Signed32(), MachineRepresentation::kFloat64);
+  CheckChange(IrOpcode::kChangeInt32ToFloat64, MachineRepresentation::kWord32,
+              Type::Signed32OrMinusZero(), MachineRepresentation::kFloat64,
+              UseInfo(MachineRepresentation::kFloat64,
+                      Truncation::Any(kIdentifyZeros)));
   CheckChange(IrOpcode::kChangeUint32ToFloat64, MachineRepresentation::kWord32,
               Type::Unsigned32(), MachineRepresentation::kFloat64);
   CheckChange(IrOpcode::kChangeFloat64ToInt32, MachineRepresentation::kFloat64,
@@ -570,7 +574,8 @@ TEST(SignednessInWord32) {
               Type::Signed32(), MachineRepresentation::kWord32);
   CheckChange(IrOpcode::kTruncateFloat64ToWord32,
               MachineRepresentation::kFloat64, Type::Number(),
-              MachineRepresentation::kWord32);
+              MachineRepresentation::kWord32,
+              UseInfo(MachineRepresentation::kWord32, Truncation::Word32()));
   CheckChange(IrOpcode::kCheckedTruncateTaggedToWord32,
               MachineRepresentation::kTagged, Type::NonInternal(),
               MachineRepresentation::kWord32,

test/mjsunit/regress/regress-crbug-891627.js

+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+// We need a NumberModulus, so we make sure that we have a
+// SpeculativeNumberModulus with Number feedback, and later
+// on use it with known Number inputs (via the bitwise or),
+// such that JSTypedLowering turns it into the NumberModulus.
+function bar(x) { return x % 2; }
+bar(0.1);
+
+// Check that the Word32->Float64 conversion works properly.
+(function() {
+  function foo(x) {
+    // The NumberEqual identifies 0 and -0.
+    return bar(x | -1) == 4294967295;
+  }
+
+  assertFalse(foo(1));
+  assertFalse(foo(0));
+  %OptimizeFunctionOnNextCall(foo);
+  assertFalse(foo(1));
+  assertFalse(foo(0));
+})();
+
+// Check that the Word32->Word32 conversion works properly.
+(function() {
+  function makeFoo(y) {
+    return function foo(x) {
+      return bar(x | -1) == y;
+    }
+  }
+  makeFoo(0);  // Defeat the function context specialization.
+  const foo = makeFoo(1);
+
+  assertFalse(foo(1));
+  assertFalse(foo(0));
+  %OptimizeFunctionOnNextCall(foo);
+  assertFalse(foo(1));
+  assertFalse(foo(0));
+})();