[turbofan] Improve typing rule for NumberCeil.

This extends the typing rule for NumberCeil to deal with general number
inputs properly, thus addressing a long-standing TODO. We also add test
cases to ensure that the typing rule gets the corner cases for NaN and
-0 right.

Bug: v8:5267, v8:7109
Change-Id: I9154e47e58ad106791613db0030051f2a802a981
Reviewed-on: https://chromium-review.googlesource.com/792930Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49650}

src/compiler/operation-typer.cc

@@ -352,8 +352,9 @@ Type* OperationTyper::NumberCbrt(Type* type) {
 Type* OperationTyper::NumberCeil(Type* type) {
   DCHECK(type->Is(Type::Number()));
   if (type->Is(cache_.kIntegerOrMinusZeroOrNaN)) return type;
-  // TODO(bmeurer): We could infer a more precise type here.
-  return cache_.kIntegerOrMinusZeroOrNaN;
+  type = Type::Intersect(type, Type::NaN(), zone());
+  type = Type::Union(type, cache_.kIntegerOrMinusZero, zone());
+  return type;
 }
 
 Type* OperationTyper::NumberClz32(Type* type) {

test/mjsunit/compiler/math-ceil.js

+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+// Ensure that the typing rule for Math.ceil deals correctly with
+// inputs in the range (-1.0,0.0), which are mapped to -0.
+(function() {
+  function foo(x) {
+    // Arrange x such that TurboFan infers type PlainNumber \/ NaN.
+    x = +x;
+    x = Math.abs(x) - 1.0;
+    return Object.is(-0, Math.ceil(x));
+  }
+
+  assertFalse(foo(1.5));
+  assertTrue(foo(0.5));
+  %OptimizeFunctionOnNextCall(foo);
+  assertFalse(foo(1.5));
+  assertTrue(foo(0.5));
+})();
+
+// Ensure that the typing rule for Math.ceil deals correctly with
+// NaN inputs, which are mapped to NaN.
+(function() {
+  function foo(x) {
+    // Arrange x such that TurboFan infers type PlainNumber \/ NaN.
+    x = +x;
+    x = Math.abs(x) - 1.0;
+    return Object.is(NaN, Math.ceil(x));
+  }
+
+  assertFalse(foo(1.5));
+  assertTrue(foo(NaN));
+  %OptimizeFunctionOnNextCall(foo);
+  assertFalse(foo(1.5));
+  assertTrue(foo(NaN));
+})();