Restrict representation inference to avoid truncation of phi inputs.

BUG=chromium:446778
LOG=N

Review URL: https://codereview.chromium.org/837153002

Cr-Commit-Position: refs/heads/master@{#25967}

src/compiler/simplified-lowering.cc

@@ -307,8 +307,8 @@ class RepresentationSelector {
     if ((use & kRepMask) == kRepTagged) {
       // only tagged uses.
       return kRepTagged;
-    } else if (IsSafeIntAdditiveOperand(node)) {
-      // Integer within [-2^52, 2^52] range.
+    } else if (upper->Is(Type::Integral32())) {
+      // Integer within [-2^31, 2^32[ range.
       if ((use & kRepMask) == kRepFloat64) {
         // only float64 uses.
         return kRepFloat64;
@@ -318,7 +318,7 @@ class RepresentationSelector {
       } else if ((use & kRepMask) == kRepWord32 ||
                  (use & kTypeMask) == kTypeInt32 ||
                  (use & kTypeMask) == kTypeUint32) {
-        // The type is a safe integer, but we only use 32 bits.
+        // We only use 32 bits or we use the result consistently.
         return kRepWord32;
       } else {
         return kRepFloat64;

test/cctest/compiler/test-simplified-lowering.cc

@@ -2037,11 +2037,6 @@ TEST(PhiRepresentation) {
   HandleAndZoneScope scope;
   Zone* z = scope.main_zone();
 
-  Factory* f = z->isolate()->factory();
-  Handle<Object> range_min = f->NewNumber(-1e13);
-  Handle<Object> range_max = f->NewNumber(1e+15);
-  Type* range = Type::Range(range_min, range_max, z);
-
   struct TestData {
     Type* arg1;
     Type* arg2;
@@ -2052,7 +2047,8 @@ TEST(PhiRepresentation) {
   TestData test_data[] = {
       {Type::Signed32(), Type::Unsigned32(), kMachInt32,
        kRepWord32 | kTypeNumber},
-      {range, range, kMachUint32, kRepWord32 | kTypeNumber},
+      {Type::Signed32(), Type::Unsigned32(), kMachUint32,
+       kRepWord32 | kTypeNumber},
       {Type::Signed32(), Type::Signed32(), kMachInt32, kMachInt32},
       {Type::Unsigned32(), Type::Unsigned32(), kMachInt32, kMachUint32},
       {Type::Number(), Type::Signed32(), kMachInt32, kMachFloat64},

test/mjsunit/compiler/regress-446778.js

@@ -0,0 +1,17 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+function Module() {
+  "use asm";
+  function f() {
+   var i = (140737463189505);
+   do {
+    i = i + i | 0;
+    x = undefined + i | 0;
+   } while (!i);
+  }
+  return { f: f };
+}
+
+Module().f();