[turbofan] fix typing and lowering of SpeculativeSafeInteger{Add,Subtract}

Bug: 
Change-Id: Ibd7c17b4ace25237c3d35466280aff27c44016f0
Reviewed-on: https://chromium-review.googlesource.com/774461Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49427}

src/compiler/operation-typer.cc

@@ -611,7 +611,7 @@ Type* OperationTyper::SpeculativeSafeIntegerAdd(Type* lhs, Type* rhs) {
   // In either case the result will be in the safe integer range, so we
   // can bake in the type here. This needs to be in sync with
   // SimplifiedLowering::VisitSpeculativeAdditiveOp.
-  return Type::Intersect(result, cache_.kSafeInteger, zone());
+  return Type::Intersect(result, cache_.kSafeIntegerOrMinusZero, zone());
 }
 
 Type* OperationTyper::SpeculativeSafeIntegerSubtract(Type* lhs, Type* rhs) {

src/compiler/simplified-lowering.cc

@@ -1273,16 +1273,13 @@ class RepresentationSelector {
                                          SimplifiedLowering* lowering) {
     Type* left_upper = GetUpperBound(node->InputAt(0));
     Type* right_upper = GetUpperBound(node->InputAt(1));
-    // Only eliminate eliminate the node if the ToNumber conversion cannot
-    // cause any observable side-effect and if we know for sure that it
-    // is a number addition (we must exclude strings).
-    if (left_upper->Is(Type::NumberOrOddball()) &&
-        right_upper->Is(Type::NumberOrOddball())) {
-      if (truncation.IsUnused()) return VisitUnused(node);
-    }
 
     if (left_upper->Is(type_cache_.kAdditiveSafeIntegerOrMinusZero) &&
         right_upper->Is(type_cache_.kAdditiveSafeIntegerOrMinusZero)) {
+      // Only eliminate the node if its typing rule can be satisfied, namely
+      // that a safe integer is produced.
+      if (truncation.IsUnused()) return VisitUnused(node);
+
       // If we know how to interpret the result or if the users only care
       // about the low 32-bits, we can truncate to Word32 do a wrapping
       // addition.

test/mjsunit/compiler/type-speculative-safe-integer-add.js

+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+(function(){
+    function f(x){
+        return 1/(x+x);
+    }
+
+    function forgetAboutMinus0(i) {
+        var x = 0;
+        var y;
+        for(; i > 0; --i) {
+            y = f(x);
+            x = -0;
+        }
+        return y;
+    }
+
+    forgetAboutMinus0(1);
+    assertEquals(Infinity, forgetAboutMinus0(1));
+    %OptimizeFunctionOnNextCall(forgetAboutMinus0);
+    assertEquals(Infinity, forgetAboutMinus0(1));
+    assertEquals(-Infinity, forgetAboutMinus0(2));
+})();
+
+(function(){
+    function f(x){
+        return x+x;
+    }
+
+    function NumberAdd(x,y) {
+        return x + y;
+    }
+    NumberAdd(1,0.5);
+    NumberAdd(0.5, 1);
+    NumberAdd(NaN, Infinity);
+
+    function forgetAboutNaN(b) {
+        var x = b ? NaN : 1;
+        return NumberAdd(f(x), 0);
+    }
+
+    forgetAboutNaN(false);
+    assertEquals(2, forgetAboutNaN(false));
+    %OptimizeFunctionOnNextCall(forgetAboutNaN);
+    assertEquals(2, forgetAboutNaN(false));
+    assertEquals(NaN, forgetAboutNaN(true));
+})();