Fixing +fround(x) in asm typer.

The rules for handling foreign functions were interfering with handling
of standard functions (such as fround).

Adding more tests around abs()

BUG= https://bugs.chromium.org/p/v8/issues/detail?id=4203
TEST=test-asm-validator,asm-wasm
R=titzer@chromium.org,rossberg@chromium.org
LOG=N

Review URL: https://codereview.chromium.org/1794303002

Cr-Commit-Position: refs/heads/master@{#34756}

src/typing-asm.cc

@@ -1158,7 +1158,9 @@ void AsmTyper::VisitBinaryOperation(BinaryOperation* expr) {
       // BIT_OR allows Any since it is used as a type coercion.
       VisitIntegerBitwiseOperator(expr, Type::Any(), cache_.kAsmIntQ,
                                   cache_.kAsmSigned, true);
-      if (expr->left()->IsCall() && expr->op() == Token::BIT_OR) {
+      if (expr->left()->IsCall() && expr->op() == Token::BIT_OR &&
+          Type::Number()->Is(expr->left()->bounds().upper)) {
+        // Force the return types of foreign functions.
         expr->left()->set_bounds(Bounds(cache_.kAsmSigned));
       }
       return;
@@ -1252,7 +1254,9 @@ void AsmTyper::VisitBinaryOperation(BinaryOperation* expr) {
       } else if (expr->op() == Token::MUL && expr->right()->IsLiteral() &&
                  right_type->Is(cache_.kAsmDouble)) {
         // For unary +, expressed as x * 1.0
-        if (expr->left()->IsCall() && expr->op() == Token::MUL) {
+        if (expr->left()->IsCall() && expr->op() == Token::MUL &&
+            Type::Number()->Is(expr->left()->bounds().upper)) {
+          // Force the return types of foreign functions.
           expr->left()->set_bounds(Bounds(cache_.kAsmDouble));
         }
         IntersectResult(expr, cache_.kAsmDouble);

test/cctest/test-asm-validator.cc

@@ -2032,6 +2032,30 @@ TEST(CeilFloat) {
   CHECK_FUNC_TYPES_END
 }
 
+TEST(FloatReturnAsDouble) {
+  CHECK_FUNC_TYPES_BEGIN(
+      "function bar() { var x = fround(3.1); return +fround(x); }\n"
+      "function foo() { bar(); }") {
+    CHECK_EXPR(FunctionLiteral, FUNC_D_TYPE) {
+      CHECK_EXPR(Assignment, Bounds(cache.kAsmFloat)) {
+        CHECK_VAR(x, Bounds(cache.kAsmFloat));
+        CHECK_EXPR(Call, Bounds(cache.kAsmFloat)) {
+          CHECK_VAR(fround, FUNC_N2F_TYPE);
+          CHECK_EXPR(Literal, Bounds(cache.kAsmDouble));
+        }
+      }
+      CHECK_EXPR(BinaryOperation, Bounds(cache.kAsmDouble)) {
+        CHECK_EXPR(Call, Bounds(cache.kAsmFloat)) {
+          CHECK_VAR(fround, FUNC_N2F_TYPE);
+          CHECK_VAR(x, Bounds(cache.kAsmFloat));
+        }
+        CHECK_EXPR(Literal, Bounds(cache.kAsmDouble));
+      }
+    }
+    CHECK_SKIP();
+  }
+  CHECK_FUNC_TYPES_END
+}
 
 TEST(TypeConsistency) {
   v8::V8::Initialize();

test/mjsunit/wasm/asm-wasm.js

@@ -1374,6 +1374,89 @@ TestForeignVariables();
 })();
 
 
+(function TestAbsInt() {
+  function Module(stdlib) {
+    "use asm";
+    var abs = stdlib.Math.abs;
+    function func(x) {
+      x = x | 0;
+      return abs(x|0)|0;
+    }
+    return {func:func};
+  }
+  var m = Wasm.instantiateModuleFromAsm(Module.toString());
+  var values = [0, 1, -1, 0x40000000, 0x7FFFFFFF, -0x80000000];
+  for (var i = 0; i < values.length; i++) {
+    var val = values[i];
+    assertEquals(Math.abs(val) | 0, m.func(val));
+  }
+})();
+
+
+(function TestAbsFloat() {
+  function Module(stdlib) {
+    "use asm";
+    var fround = stdlib.Math.fround;
+    var abs = stdlib.Math.abs;
+    function func(x) {
+      x = fround(x);
+      x = abs(x);
+      return fround(x);
+    }
+    return {func:func};
+  }
+  var m = Wasm.instantiateModuleFromAsm(Module.toString());
+  var values = [
+    0, -0, 1, -1, 0.9, -0.9, 1.414, 0x7F, -0x80, -0x8000, -0x80000000,
+    0x7FFF, 0x7FFFFFFF, Infinity, -Infinity, NaN
+  ];
+  for (var i = 0; i < values.length; i++) {
+    var val = values[i];
+    assertEquals(Math.fround(Math.abs(val)), m.func(val));
+  }
+})();
+
+
+(function TestAbsDouble() {
+  function Module(stdlib) {
+    "use asm";
+    var fround = stdlib.Math.fround;
+    var abs = stdlib.Math.abs;
+    function func(x) {
+      x = +x;
+      x = abs(x);
+      return +x;
+    }
+    return {func:func};
+  }
+  var m = Wasm.instantiateModuleFromAsm(Module.toString());
+  var values = [
+    0, -0, 1, -1, 0.9, -0.9, 1.414, 0x7F, -0x80, -0x8000, -0x80000000,
+    0x7FFF, 0x7FFFFFFF, Infinity, -Infinity, NaN
+  ];
+  for (var i = 0; i < values.length; i++) {
+    var val = values[i];
+    assertEquals(Math.abs(val), m.func(val));
+  }
+})();
+
+
+(function TestFloatAsDouble() {
+  function Module(stdlib) {
+    "use asm";
+    var fround = stdlib.Math.fround;
+    var abs = stdlib.Math.abs;
+    function func() {
+      var x = fround(1.0);
+      return +fround(x);
+    }
+    return {func:func};
+  }
+  var m = Wasm.instantiateModuleFromAsm(Module.toString());
+  assertEquals(1, m.func());
+})();
+
+
 (function TestOr() {
   function Module() {
     "use asm";