[turbofan] Compute proper type for globals with "constant type".

src/compiler/js-global-specialization.cc

Index: src/compiler/js-global-specialization.cc
diff --git a/src/compiler/js-global-specialization.cc b/src/compiler/js-global-specialization.cc
index 4caed2e555d66032bef59839468c34f2280ecb4f..00ade7a9c8546b596c922482ff65b40407f4e308 100644
--- a/src/compiler/js-global-specialization.cc
+++ b/src/compiler/js-global-specialization.cc
@@ -145,17 +145,16 @@ Reduction JSGlobalSpecialization::ReduceLoadFromPropertyCell(
   if (property_details.cell_type() == PropertyCellType::kConstantType &&
       (flags() & kDeoptimizationEnabled)) {
     dependencies()->AssumePropertyCell(property_cell);
-    Type* property_cell_value_type = Type::Any();
-    switch (property_cell->GetConstantType()) {
-      case PropertyCellConstantType::kSmi:
-        property_cell_value_type = Type::Intersect(
-            Type::SignedSmall(), Type::TaggedSigned(), graph()->zone());
-        break;
-      case PropertyCellConstantType::kStableMap: {
-        // TODO(bmeurer): Determine type based on the map's instance type.
-        property_cell_value_type = Type::TaggedPointer();
-        break;
-      }
+    // Compute proper type based on the current value in the cell.
+    Type* property_cell_value_type;
+    if (property_cell_value->IsSmi()) {
+      property_cell_value_type = Type::Intersect(
+          Type::SignedSmall(), Type::TaggedSigned(), graph()->zone());
+    } else if (property_cell_value->IsNumber()) {
+      property_cell_value_type = Type::Intersect(
+          Type::Number(), Type::TaggedPointer(), graph()->zone());
+    } else {
+      property_cell_value_type = Type::Of(property_cell_value, graph()->zone());
     }
     Node* value = effect = graph()->NewNode(
         simplified()->LoadField(