[machine-operator-reducer] fix float truncation

Don't replace `TruncateFloat64ToInt32(RoundInt64ToFloat64(value))` with
`value`. Generally, `value` may have a range bigger than the one that
could fit into Int32. Replace it with `TruncateInt64ToInt32(value)`
instead, and only if the `value` fits into Float64 without precision
loss.

Add missing mjsunit test for 52bit multiplication/division optimization
that has landed in refs/heads/master@{#31899}.

BUG=
R=titzer@google.com

Review URL: https://codereview.chromium.org/1433353006

Cr-Commit-Position: refs/heads/master@{#32227}

src/compiler/machine-operator-reducer.cc

@@ -648,7 +648,18 @@ Reduction MachineOperatorReducer::ReduceTruncateFloat64ToInt32(Node* node) {
   Float64Matcher m(node->InputAt(0));
   if (m.HasValue()) return ReplaceInt32(DoubleToInt32(m.Value()));
   if (m.IsChangeInt32ToFloat64()) return Replace(m.node()->InputAt(0));
-  if (m.IsRoundInt64ToFloat64()) return Replace(m.node()->InputAt(0));
+  if (m.IsRoundInt64ToFloat64()) {
+    Node* value = m.node()->InputAt(0);
+    Type* type = NodeProperties::GetType(value);
+    Type::RangeType* range = type->GetRange();
+
+    // Rounding int64 to float64 should not lose precision
+    if (range != nullptr && range->Min() >= 0 &&
+        range->Max() <= 0xFFFFFFFFFFFFFULL) {
+      return Replace(
+          graph()->NewNode(machine()->TruncateInt64ToInt32(), value));
+    }
+  }
   if (m.IsPhi()) {
     Node* const phi = m.node();
     DCHECK_EQ(kRepFloat64, RepresentationOf(OpParameter<MachineType>(phi)));

test/mjsunit/math-52-mul-div.js

+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --turbo-filter=*
+
+function mul(a, b) {
+  const l = a & 0x3ffffff;
+  const h = b & 0x3ffffff;
+
+  return (l * h) >>> 0;
+}
+
+function mulAndDiv(a, b) {
+  const l = a & 0x3ffffff;
+  const h = b & 0x3ffffff;
+  const m = l * h;
+
+  const rl = m & 0x3ffffff;
+  const rh = (m / 0x4000000) >>> 0;
+
+  return rl | rh;
+}
+
+function overflowMul(a, b) {
+  const l = a | 0;
+  const h = b | 0;
+
+  return (l * h) >>> 0;
+}
+
+function overflowDiv(a, b) {
+  const l = a & 0x3ffffff;
+  const h = b & 0x3ffffff;
+  const m = l * h;
+
+  return (m / 0x10) >>> 0;
+}
+
+function nonPowerOfTwoDiv(a, b) {
+  const l = a & 0x3ffffff;
+  const h = b & 0x3ffffff;
+  const m = l * h;
+
+  return (m / 0x4000001) >>> 0;
+}
+
+function test(fn, a, b, sets) {
+  const expected = fn(a, b);
+  fn(1, 2);
+  fn(0, 0);
+  %OptimizeFunctionOnNextCall(fn);
+  const actual = fn(a, b);
+
+  assertEquals(expected, actual);
+
+  sets.forEach(function(set, i) {
+    assertEquals(set.expected, fn(set.a, set.b), fn.name + ', set #' + i);
+  });
+}
+
+test(mul, 0x3ffffff, 0x3ffffff, [
+  { a: 0, b: 0, expected: 0 },
+  { a: 0xdead, b: 0xbeef, expected: 0xa6144983 },
+  { a: 0x1aa1dea, b: 0x2badead, expected: 0x35eb2322 }
+]);
+test(mulAndDiv, 0x3ffffff, 0x3ffffff, [
+  { a: 0, b: 0, expected: 0 },
+  { a: 0xdead, b: 0xbeef, expected: 0x21449ab },
+  { a: 0x1aa1dea, b: 0x2badead, expected: 0x1ebf32f }
+]);
+test(overflowMul, 0x4ffffff, 0x4ffffff, [
+  { a: 0, b: 0, expected: 0 },
+  { a: 0xdead, b: 0xbeef, expected: 0xa6144983 },
+  { a: 0x1aa1dea, b: 0x2badead, expected: 0x35eb2322 }
+]);
+test(overflowDiv, 0x3ffffff, 0x3ffffff, [
+  { a: 0, b: 0, expected: 0 },
+  { a: 0xdead, b: 0xbeef, expected: 0xa614498 },
+  { a: 0x1aa1dea, b: 0x2badead, expected: 0x835eb232 }
+]);
+test(nonPowerOfTwoDiv, 0x3ffffff, 0x3ffffff, [
+  { a: 0, b: 0, expected: 0 },
+  { a: 0xdead, b: 0xbeef, expected: 0x29 },
+  { a: 0x1aa1dea, b: 0x2badead, expected: 0x122d20d }
+]);

test/unittests/compiler/machine-operator-reducer-unittest.cc

@@ -1649,13 +1649,34 @@ TEST_F(MachineOperatorReducerTest, StoreRepWord16WithWord32SarAndWord32Shl) {
 
 TEST_F(MachineOperatorReducerTest, RoundPlusTruncate) {
   Node* p0 = Parameter(0);
+
+  Type* p0_range = Type::Range(0x0, 0xFFFFFF8000001ULL, graph()->zone());
+  NodeProperties::SetType(
+      p0, Type::Intersect(p0_range, Type::Number(), graph()->zone()));
+
   Node* t0 = graph()->NewNode(machine()->RoundInt64ToFloat64(), p0);
   Node* t1 = graph()->NewNode(
       machine()->TruncateFloat64ToInt32(TruncationMode::kJavaScript), t0);
 
   Reduction r = Reduce(t1);
   ASSERT_TRUE(r.Changed());
-  EXPECT_THAT(r.replacement(), p0);
+  EXPECT_THAT(r.replacement(), IsTruncateInt64ToInt32(p0));
+}
+
+
+TEST_F(MachineOperatorReducerTest, OverflowingRoundPlusTruncate) {
+  Node* p0 = Parameter(0);
+
+  Type* p0_range = Type::Range(0x0, 0x10000000000000ULL, graph()->zone());
+  NodeProperties::SetType(
+      p0, Type::Intersect(p0_range, Type::Number(), graph()->zone()));
+
+  Node* t0 = graph()->NewNode(machine()->RoundInt64ToFloat64(), p0);
+  Node* t1 = graph()->NewNode(
+      machine()->TruncateFloat64ToInt32(TruncationMode::kJavaScript), t0);
+
+  Reduction r = Reduce(t1);
+  ASSERT_TRUE(!r.Changed());
 }
 
 }  // namespace compiler