[turbofan] Compute proper type for globals with "constant type".

src/compiler/js-global-specialization.cc

 // Copyright 2015 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/compiler/js-global-specialization.h"
 
 #include "src/compilation-dependencies.h"
 #include "src/compiler/access-builder.h"
 #include "src/compiler/js-graph.h"
 #include "src/compiler/js-operator.h"
@@ skipping 127 matching lines @@
     dependencies()->AssumePropertyCell(property_cell);
     return Replace(node, property_cell_value);
   }
   // Not much we can do if we run the generic pipeline here.
   if (!(flags() & kTypingEnabled)) return NoChange();
   // Load from constant type global property can benefit from representation
   // (and map) feedback with deoptimization support (requires code dependency).
   if (property_details.cell_type() == PropertyCellType::kConstantType &&
       (flags() & kDeoptimizationEnabled)) {
     dependencies()->AssumePropertyCell(property_cell);
-    Type* property_cell_value_type = Type::Any();
-    switch (property_cell->GetConstantType()) {
-      case PropertyCellConstantType::kSmi:
-        property_cell_value_type = Type::Intersect(
-            Type::SignedSmall(), Type::TaggedSigned(), graph()->zone());
-        break;
-      case PropertyCellConstantType::kStableMap: {
-        // TODO(bmeurer): Determine type based on the map's instance type.
-        property_cell_value_type = Type::TaggedPointer();
-        break;
-      }
+    // Compute proper type based on the current value in the cell.
+    Type* property_cell_value_type;
+    if (property_cell_value->IsSmi()) {
+      property_cell_value_type = Type::Intersect(
+          Type::SignedSmall(), Type::TaggedSigned(), graph()->zone());
+    } else if (property_cell_value->IsNumber()) {
+      property_cell_value_type = Type::Intersect(
+          Type::Number(), Type::TaggedPointer(), graph()->zone());
+    } else {
+      property_cell_value_type = Type::Of(property_cell_value, graph()->zone());
     }
     Node* value = effect = graph()->NewNode(
         simplified()->LoadField(
             AccessBuilder::ForPropertyCellValue(property_cell_value_type)),
         jsgraph()->Constant(property_cell), effect, control);
     return Replace(node, value, effect);
   }
   // Load from non-configurable, data property on the global can be lowered to
   // a field load, even without deoptimization, because the property cannot be
   // deleted or reconfigured to an accessor/interceptor property.
@@ skipping 62 matching lines @@
 }
 
 
 JSOperatorBuilder* JSGlobalSpecialization::javascript() const {
   return jsgraph()->javascript();
 }
 
 }  // namespace compiler
 }  // namespace internal
 }  // namespace v8