[turbofan] Properly handle -0 in Word32->Word64 conversion.

This adds missing support when converting a Word32 value (either in
Signed32 or Unsigned32 range) to Word64 representation, for which the
type also includes MinusZero. This conversion is fine as long as the
difference between 0 and -0 is not observable (in other words, as long
as the truncation identifies zeros).

Bug: chromium:971782, chromium:225811, v8:4153, v8:7881, v8:8171, v8:8383
Change-Id: I9d350a25f57b1342eb7fd1279d55a8610bdaf7cd
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1664062Reviewed-by: Sigurd Schneider <sigurds@chromium.org>
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62235}

src/compiler/representation-change.cc

@@ -1272,9 +1272,15 @@ Node* RepresentationChanger::GetWord64RepresentationFor(
         jsgraph()->common()->DeadValue(MachineRepresentation::kWord64),
         unreachable);
   } else if (IsWord(output_rep)) {
-    if (output_type.Is(Type::Unsigned32())) {
+    if (output_type.Is(Type::Unsigned32OrMinusZero())) {
+      // uint32 -> uint64
+      CHECK_IMPLIES(output_type.Maybe(Type::MinusZero()),
+                    use_info.truncation().IdentifiesZeroAndMinusZero());
       op = machine()->ChangeUint32ToUint64();
-    } else if (output_type.Is(Type::Signed32())) {
+    } else if (output_type.Is(Type::Signed32OrMinusZero())) {
+      // int32 -> int64
+      CHECK_IMPLIES(output_type.Maybe(Type::MinusZero()),
+                    use_info.truncation().IdentifiesZeroAndMinusZero());
       op = machine()->ChangeInt32ToInt64();
     } else {
       return TypeError(node, output_rep, output_type,

test/cctest/compiler/test-representation-change.cc

@@ -376,8 +376,16 @@ TEST(Word64) {
               TypeCache::Get()->kUint16, MachineRepresentation::kWord64);
   CheckChange(IrOpcode::kChangeInt32ToInt64, MachineRepresentation::kWord32,
               Type::Signed32(), MachineRepresentation::kWord64);
+  CheckChange(
+      IrOpcode::kChangeInt32ToInt64, MachineRepresentation::kWord32,
+      Type::Signed32OrMinusZero(), MachineRepresentation::kWord64,
+      UseInfo(MachineRepresentation::kWord64, Truncation::Any(kIdentifyZeros)));
   CheckChange(IrOpcode::kChangeUint32ToUint64, MachineRepresentation::kWord32,
               Type::Unsigned32(), MachineRepresentation::kWord64);
+  CheckChange(
+      IrOpcode::kChangeUint32ToUint64, MachineRepresentation::kWord32,
+      Type::Unsigned32OrMinusZero(), MachineRepresentation::kWord64,
+      UseInfo(MachineRepresentation::kWord64, Truncation::Any(kIdentifyZeros)));
 
   CheckChange(IrOpcode::kTruncateInt64ToInt32, MachineRepresentation::kWord64,
               Type::Signed32(), MachineRepresentation::kWord32);

test/mjsunit/regress/regress-crbug-971782.js

+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function foo(dv) {
+  for (let i = -1; i < 1; ++i) {
+    dv.setUint16(i % 1);
+  }
+}
+
+const dv = new DataView(new ArrayBuffer(2));
+%PrepareFunctionForOptimization(foo);
+foo(dv);
+foo(dv);
+%OptimizeFunctionOnNextCall(foo);
+foo(dv);