[turbofan] Add more sanity checks to representation inference.

src/compiler/js-intrinsic-lowering.cc

 // Copyright 2015 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/compiler/js-intrinsic-lowering.h"
 
 #include <stack>
 
 #include "src/code-factory.h"
 #include "src/compiler/access-builder.h"
@@ skipping 131 matching lines @@
   NodeProperties::MergeControlToEnd(graph(), common(), deoptimize);
   Revisit(graph()->end());
 
   node->TrimInputCount(0);
   NodeProperties::ChangeOp(node, common()->Dead());
   return Changed(node);
 }
 
 
 Reduction JSIntrinsicLowering::ReduceDoubleHi(Node* node) {
+  // Tell the compiler to assume number input.
+  Node* renamed = graph()->NewNode(common()->Guard(Type::Number()),
+                                   node->InputAt(0), graph()->start());
+  node->ReplaceInput(0, renamed);
   return Change(node, machine()->Float64ExtractHighWord32());
 }
 
 
 Reduction JSIntrinsicLowering::ReduceDoubleLo(Node* node) {
+  // Tell the compiler to assume number input.
+  Node* renamed = graph()->NewNode(common()->Guard(Type::Number()),
+                                   node->InputAt(0), graph()->start());
+  node->ReplaceInput(0, renamed);
   return Change(node, machine()->Float64ExtractLowWord32());
 }
 
 
 Reduction JSIntrinsicLowering::ReduceIncrementStatsCounter(Node* node) {
   if (!FLAG_native_code_counters) return ChangeToUndefined(node);
   HeapObjectMatcher m(NodeProperties::GetValueInput(node, 0));
   if (!m.HasValue() || !m.Value()->IsString()) {
     return ChangeToUndefined(node);
   }
@@ skipping 70 matching lines @@
 }
 
 
 Reduction JSIntrinsicLowering::ReduceMathFloor(Node* node) {
   if (!machine()->Float64RoundDown().IsSupported()) return NoChange();
   return Change(node, machine()->Float64RoundDown().op());
 }
 
 
 Reduction JSIntrinsicLowering::ReduceMathSqrt(Node* node) {
+  // Tell the compiler to assume number input.
+  Node* renamed = graph()->NewNode(common()->Guard(Type::Number()),
+                                   node->InputAt(0), graph()->start());
+  node->ReplaceInput(0, renamed);
   return Change(node, machine()->Float64Sqrt());
 }
 
 
 Reduction JSIntrinsicLowering::ReduceValueOf(Node* node) {
   // if (%_IsSmi(value)) {
   //   return value;
   // } else if (%_GetInstanceType(%_GetMap(value)) == JS_VALUE_TYPE) {
   //   return %_GetValue(value);
   // } else {
@@ skipping 140 matching lines @@
     ReplaceWithValue(node, value);
     return Replace(value);
   }
 
   Node* check = graph()->NewNode(simplified()->ObjectIsSmi(), value);
   Node* branch =
       graph()->NewNode(common()->Branch(BranchHint::kTrue), check, control);
 
   Node* if_true = graph()->NewNode(common()->IfTrue(), branch);
   Node* etrue = effect;
-  Node* vtrue = value;
+  Node* vtrue =
+      graph()->NewNode(common()->Guard(type_cache_.kSmi), value, if_true);
 
   Node* if_false = graph()->NewNode(common()->IfFalse(), branch);
   Node* efalse = effect;
   Node* vfalse;
   {
     vfalse = efalse =
         graph()->NewNode(javascript()->CallRuntime(Runtime::kToInteger), value,
                          context, frame_state, efalse, if_false);
+    // TODO(jarin) Intersect the type with integers?
+    NodeProperties::SetType(vfalse, NodeProperties::GetType(node));
+
     if_false = graph()->NewNode(common()->IfSuccess(), vfalse);
   }
 
   control = graph()->NewNode(common()->Merge(2), if_true, if_false);
   effect = graph()->NewNode(common()->EffectPhi(2), etrue, efalse, control);
   value = graph()->NewNode(common()->Phi(MachineRepresentation::kTagged, 2),
                            vtrue, vfalse, control);
+
   // TODO(bmeurer, mstarzinger): Rewire IfException inputs to {vfalse}.
   ReplaceWithValue(node, value, effect, control);
   return Changed(value);
 }
 
 
 Reduction JSIntrinsicLowering::ReduceToName(Node* node) {
   NodeProperties::ChangeOp(node, javascript()->ToName());
   return Changed(node);
 }
@@ skipping 170 matching lines @@
 }
 
 
 SimplifiedOperatorBuilder* JSIntrinsicLowering::simplified() const {
   return jsgraph()->simplified();
 }
 
 }  // namespace compiler
 }  // namespace internal
 }  // namespace v8