[compiler] Add a few regression tests

Tbr: nicohartmann@chromium.org
Bug: chromium:1198705, chromium:1199345, chromium:1200490
Change-Id: I4a486df636e084279423e6cd3b867137bfe3fd6f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2939984
Reviewed-by: Georg Neis <neis@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74945}

test/mjsunit/compiler/regress-1198705.js

@@ -0,0 +1,24 @@
+// Copyright 2021 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function bar(x) {
+  x = (x|0) * 2**52;
+  x = Math.min(Math.max(x, 0), 2**52);
+  return (x + x)|0;
+}
+
+%PrepareFunctionForOptimization(bar);
+assertEquals(0, bar(0));
+%OptimizeFunctionOnNextCall(bar);
+
+function foo() {
+  return bar(1);
+}
+
+%PrepareFunctionForOptimization(foo);
+assertEquals(0, foo());
+%OptimizeFunctionOnNextCall(foo);
+assertEquals(0, foo());

test/mjsunit/compiler/regress-1199345.js

@@ -0,0 +1,46 @@
+// Copyright 2021 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --opt --no-always-opt
+
+
+(function() {
+  function foo(a) {
+    var x = -0;
+    if (a) {
+      x = 0;
+    }
+    return x + (x - 0);
+  }
+  %PrepareFunctionForOptimization(foo);
+  assertEquals(0, foo(true));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(-0, foo(false));
+})();
+
+
+// The following test already passed before the bugfix.
+
+(function() {
+  function foo(a) {
+    var x = 0;
+    var y = -0;
+    if (a == 42) x = 2**32 - 1;
+    if (a == 0) {
+      x = 0
+      y = 1;
+    }
+    if (a == 2) x = -0;
+    return x + y;
+  }
+  %PrepareFunctionForOptimization(foo);
+  assertEquals(1, foo(0));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(0, foo(1));
+  // We don't automatically deopt for y = -0 because (x + -0) can only become -0
+  // for x = -0.
+  assertOptimized(foo);
+  assertEquals(-0, foo(2));
+  assertUnoptimized(foo);
+})();

test/mjsunit/compiler/regress-1200490.js

@@ -0,0 +1,49 @@
+// Copyright 2021 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+
+(function() {
+  function foo(a) {
+    var y = 1;
+    var z = 0;
+    if (a) {
+      y = -1;
+      z = -0;
+    }
+    return z + (0 * y);
+  }
+  assertEquals(-0, foo(true));
+  %PrepareFunctionForOptimization(foo);
+  assertEquals(0, foo(false));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(-0, foo(true));
+})();
+
+
+(function() {
+  function foo(a) {
+    var x = a ? -0 : 0;
+    return x + (x % 1);
+  }
+  assertEquals(-0, foo(true));
+  %PrepareFunctionForOptimization(foo);
+  assertEquals(0, foo(false));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(-0, foo(true));
+})();
+
+
+(function() {
+  function foo(a) {
+    var x = a ? -0 : 0;
+    return x + (x % -1);
+  }
+  assertEquals(-0, foo(true));
+  %PrepareFunctionForOptimization(foo);
+  assertEquals(0, foo(false));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(-0, foo(true));
+})();