[compiler] Fix bogus integer range types

The kInt64, kUint64, and kIntPtr type definitions made no sense.
This CL removes kIntPtr and fixes+renames k(I|Ui)nt64. It also adds
some DCHECKs to avoid similar bugs in the future.

Bug: chromium:1202609
Change-Id: Ibe2e9c7501c22959b850d2b1076e819455440450
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2851895Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74230}

src/compiler/operation-typer.cc

@@ -1262,14 +1262,12 @@ Type OperationTyper::StrictEqual(Type lhs, Type rhs) {
 Type OperationTyper::CheckBounds(Type index, Type length) {
   DCHECK(length.Is(cache_->kPositiveSafeInteger));
   if (length.Is(cache_->kSingletonZero)) return Type::None();
-  Type mask = Type::Range(0.0, length.Max() - 1, zone());
+  Type const upper_bound = Type::Range(0.0, length.Max() - 1, zone());
+  if (index.Maybe(Type::String())) return upper_bound;
   if (index.Maybe(Type::MinusZero())) {
     index = Type::Union(index, cache_->kSingletonZero, zone());
   }
-  if (index.Maybe(Type::String())) {
-    index = Type::Union(index, cache_->kIntPtr, zone());
-  }
-  return Type::Intersect(index, mask, zone());
+  return Type::Intersect(index, upper_bound, zone());
 }
 
 Type OperationTyper::CheckFloat64Hole(Type type) {

src/compiler/representation-change.cc

@@ -1159,11 +1159,11 @@ Node* RepresentationChanger::GetWord64RepresentationFor(
                        MachineRepresentation::kWord64);
     }
   } else if (output_rep == MachineRepresentation::kFloat32) {
-    if (output_type.Is(cache_->kInt64)) {
+    if (output_type.Is(cache_->kDoubleRepresentableInt64)) {
       // float32 -> float64 -> int64
       node = InsertChangeFloat32ToFloat64(node);
       op = machine()->ChangeFloat64ToInt64();
-    } else if (output_type.Is(cache_->kUint64)) {
+    } else if (output_type.Is(cache_->kDoubleRepresentableUint64)) {
       // float32 -> float64 -> uint64
       node = InsertChangeFloat32ToFloat64(node);
       op = machine()->ChangeFloat64ToUint64();
@@ -1181,9 +1181,9 @@ Node* RepresentationChanger::GetWord64RepresentationFor(
                        MachineRepresentation::kWord64);
     }
   } else if (output_rep == MachineRepresentation::kFloat64) {
-    if (output_type.Is(cache_->kInt64)) {
+    if (output_type.Is(cache_->kDoubleRepresentableInt64)) {
       op = machine()->ChangeFloat64ToInt64();
-    } else if (output_type.Is(cache_->kUint64)) {
+    } else if (output_type.Is(cache_->kDoubleRepresentableUint64)) {
       op = machine()->ChangeFloat64ToUint64();
     } else if (use_info.type_check() == TypeCheckKind::kSigned64 ||
                use_info.type_check() == TypeCheckKind::kArrayIndex) {
@@ -1211,7 +1211,7 @@ Node* RepresentationChanger::GetWord64RepresentationFor(
                                              use_node, use_info);
     op = simplified()->TruncateBigIntToUint64();
   } else if (CanBeTaggedPointer(output_rep)) {
-    if (output_type.Is(cache_->kInt64)) {
+    if (output_type.Is(cache_->kDoubleRepresentableInt64)) {
       op = simplified()->ChangeTaggedToInt64();
     } else if (use_info.type_check() == TypeCheckKind::kSigned64) {
       op = simplified()->CheckedTaggedToInt64(

src/compiler/type-cache.h

@@ -36,9 +36,10 @@ class V8_EXPORT_PRIVATE TypeCache final {
   Type const kUnsigned31 = Type::Unsigned31();
   Type const kInt32 = Type::Signed32();
   Type const kUint32 = Type::Unsigned32();
-  Type const kInt64 = CreateRange<int64_t>();
-  Type const kUint64 = CreateRange<uint64_t>();
-  Type const kIntPtr = CreateRange<intptr_t>();
+  Type const kDoubleRepresentableInt64 = CreateRange(
+      std::numeric_limits<int64_t>::min(), kMaxDoubleRepresentableInt64);
+  Type const kDoubleRepresentableUint64 = CreateRange(
+      std::numeric_limits<uint64_t>::min(), kMaxDoubleRepresentableUint64);
   Type const kFloat32 = Type::Number();
   Type const kFloat64 = Type::Number();
   Type const kBigInt64 = Type::BigInt();
@@ -190,8 +191,11 @@ class V8_EXPORT_PRIVATE TypeCache final {
  private:
   template <typename T>
   Type CreateRange() {
-    return CreateRange(std::numeric_limits<T>::min(),
-                       std::numeric_limits<T>::max());
+    T min = std::numeric_limits<T>::min();
+    T max = std::numeric_limits<T>::max();
+    DCHECK_EQ(min, static_cast<T>(static_cast<double>(min)));
+    DCHECK_EQ(max, static_cast<T>(static_cast<double>(max)));
+    return CreateRange(min, max);
   }
 
   Type CreateRange(double min, double max) {
@@ -199,6 +203,10 @@ class V8_EXPORT_PRIVATE TypeCache final {
   }
 
   Zone* zone() { return &zone_; }
+
+  static constexpr double kMaxDoubleRepresentableInt64 = 9223372036854774784.0;
+  static constexpr double kMaxDoubleRepresentableUint64 =
+      18446744073709549568.0;
 };
 
 }  // namespace compiler

test/cctest/compiler/test-representation-change.cc

@@ -413,9 +413,11 @@ TEST(Word64) {
   CheckChange(IrOpcode::kChangeFloat64ToInt64, MachineRepresentation::kFloat64,
               TypeCache::Get()->kSafeInteger, MachineRepresentation::kWord64);
   CheckChange(IrOpcode::kChangeFloat64ToInt64, MachineRepresentation::kFloat64,
-              TypeCache::Get()->kInt64, MachineRepresentation::kWord64);
+              TypeCache::Get()->kDoubleRepresentableInt64,
+              MachineRepresentation::kWord64);
   CheckChange(IrOpcode::kChangeFloat64ToUint64, MachineRepresentation::kFloat64,
-              TypeCache::Get()->kUint64, MachineRepresentation::kWord64);
+              TypeCache::Get()->kDoubleRepresentableUint64,
+              MachineRepresentation::kWord64);
   CheckChange(
       IrOpcode::kCheckedFloat64ToInt64, MachineRepresentation::kFloat64,
       Type::Number(), MachineRepresentation::kWord64,
@@ -438,11 +440,13 @@ TEST(Word64) {
                   MachineRepresentation::kWord64);
   CheckTwoChanges(IrOpcode::kChangeFloat32ToFloat64,
                   IrOpcode::kChangeFloat64ToInt64,
-                  MachineRepresentation::kFloat32, TypeCache::Get()->kInt64,
+                  MachineRepresentation::kFloat32,
+                  TypeCache::Get()->kDoubleRepresentableInt64,
                   MachineRepresentation::kWord64);
   CheckTwoChanges(IrOpcode::kChangeFloat32ToFloat64,
                   IrOpcode::kChangeFloat64ToUint64,
-                  MachineRepresentation::kFloat32, TypeCache::Get()->kUint64,
+                  MachineRepresentation::kFloat32,
+                  TypeCache::Get()->kDoubleRepresentableUint64,
                   MachineRepresentation::kWord64);
   CheckTwoChanges(
       IrOpcode::kChangeFloat32ToFloat64, IrOpcode::kCheckedFloat64ToInt64,
@@ -462,7 +466,8 @@ TEST(Word64) {
   CheckChange(IrOpcode::kChangeTaggedToInt64, MachineRepresentation::kTagged,
               TypeCache::Get()->kSafeInteger, MachineRepresentation::kWord64);
   CheckChange(IrOpcode::kChangeTaggedToInt64, MachineRepresentation::kTagged,
-              TypeCache::Get()->kInt64, MachineRepresentation::kWord64);
+              TypeCache::Get()->kDoubleRepresentableInt64,
+              MachineRepresentation::kWord64);
   CheckChange(IrOpcode::kChangeTaggedSignedToInt64,
               MachineRepresentation::kTaggedSigned, Type::SignedSmall(),
               MachineRepresentation::kWord64);