[turbofan] Allow converting word64 to float32 if value is safe integer.

GeorgNeis · Commit Bot · commit a8cb521a58cd · 2018-10-16T11:31:39.000Z
Bug: v8:895691 Change-Id: Ic92cb250555d097b01f894b4b7b9ae5b2eea6668 Reviewed-on: https://chromium-review.googlesource.com/c/1282990 Commit-Queue: Georg Neis <neis@chromium.org> Reviewed-by: Benedikt Meurer <bmeurer@chromium.org> Cr-Commit-Position: refs/heads/master@{#56691}
diff --git a/src/compiler/representation-change.cc b/src/compiler/representation-change.cc
@@ -586,7 +586,7 @@ Node* RepresentationChanger::GetFloat32RepresentationFor(
   } else if (output_rep == MachineRepresentation::kFloat64) {
     op = machine()->TruncateFloat64ToFloat32();
   } else if (output_rep == MachineRepresentation::kWord64) {
-    if (output_type.Is(Type::Signed32())) {
+    if (output_type.Is(cache_.kSafeInteger)) {
       // int64 -> float64 -> float32
       op = machine()->ChangeInt64ToFloat64();
       node = jsgraph()->graph()->NewNode(op, node);
diff --git a/test/mjsunit/regress/regress-895691.js b/test/mjsunit/regress/regress-895691.js
@@ -0,0 +1,18 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+const n = 2**32;
+const x = new Float32Array();
+
+function f() {
+  for (var i = 96; i < 100; i += 4) {
+    x[i] = i + n;
+  }
+}
+
+f();
+%OptimizeFunctionOnNextCall(f);
+f();
