From 71f3ab8e76f1d3c00cb22f576ee41ce64086e87e Mon Sep 17 00:00:00 2001
From: Benedikt Meurer <bmeurer@chromium.org>
Date: Tue, 28 Nov 2017 07:41:56 +0100
Subject: [PATCH] [turbofan] Improve typing rule for NumberRound.

This extends the typing rule for NumberRound to deal with general number
inputs properly, thus addressing a long-standing TODO. We also add test
cases to ensure that the typing rule gets the corner cases for NaN and
-0 right.

Bug: v8:5267, v8:7109
Change-Id: Ia865ec1d6f8d96f20641bee96891740a9fc6e627
Reviewed-on: https://chromium-review.googlesource.com/792931
Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49651}
---
 src/compiler/operation-typer.cc     |  5 ++--
 test/mjsunit/compiler/math-round.js | 39 +++++++++++++++++++++++++++++
 2 files changed, 42 insertions(+), 2 deletions(-)
 create mode 100644 test/mjsunit/compiler/math-round.js

diff --git a/src/compiler/operation-typer.cc b/src/compiler/operation-typer.cc
index 17619d5aee..40eb88a036 100644
--- a/src/compiler/operation-typer.cc
+++ b/src/compiler/operation-typer.cc
@@ -418,8 +418,9 @@ Type* OperationTyper::NumberLog10(Type* type) {
 Type* OperationTyper::NumberRound(Type* type) {
   DCHECK(type->Is(Type::Number()));
   if (type->Is(cache_.kIntegerOrMinusZeroOrNaN)) return type;
-  // TODO(bmeurer): We could infer a more precise type here.
-  return cache_.kIntegerOrMinusZeroOrNaN;
+  type = Type::Intersect(type, Type::NaN(), zone());
+  type = Type::Union(type, cache_.kIntegerOrMinusZero, zone());
+  return type;
 }
 
 Type* OperationTyper::NumberSign(Type* type) {
diff --git a/test/mjsunit/compiler/math-round.js b/test/mjsunit/compiler/math-round.js
new file mode 100644
index 0000000000..c42bf8f2a0
--- /dev/null
+++ b/test/mjsunit/compiler/math-round.js
@@ -0,0 +1,39 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+// Ensure that the typing rule for Math.round deals correctly with
+// inputs in the range [-0.5,0.0), which are mapped to -0.
+(function() {
+  function foo(x) {
+    // Arrange x such that TurboFan infers type PlainNumber \/ NaN.
+    x = +x;
+    x = Math.abs(x) - 1.0;
+    return Object.is(-0, Math.round(x));
+  }
+
+  assertFalse(foo(1.5));
+  assertTrue(foo(0.5));
+  %OptimizeFunctionOnNextCall(foo);
+  assertFalse(foo(1.5));
+  assertTrue(foo(0.5));
+})();
+
+// Ensure that the typing rule for Math.round deals correctly with
+// NaN inputs, which are mapped to NaN.
+(function() {
+  function foo(x) {
+    // Arrange x such that TurboFan infers type PlainNumber \/ NaN.
+    x = +x;
+    x = Math.abs(x) - 1.0;
+    return Object.is(NaN, Math.round(x));
+  }
+
+  assertFalse(foo(1.5));
+  assertTrue(foo(NaN));
+  %OptimizeFunctionOnNextCall(foo);
+  assertFalse(foo(1.5));
+  assertTrue(foo(NaN));
+})();