[turbofan] Make sure value numbering only narrows types.

src/compiler/value-numbering-reducer.cc

 // Copyright 2014 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/compiler/value-numbering-reducer.h"
 
 #include <cstring>
 
 #include "src/base/functional.h"
+#include "src/compiler/node-properties.h"
 #include "src/compiler/node.h"
 
 namespace v8 {
 namespace internal {
 namespace compiler {
 
 namespace {
 
 size_t HashCode(Node* node) {
   size_t h = base::hash_combine(node->op()->HashCode(), node->InputCount());
@@ skipping 14 matching lines @@
   for (int j = 0; j < a->InputCount(); ++j) {
     DCHECK_NOT_NULL(a->InputAt(j));
     DCHECK_NOT_NULL(b->InputAt(j));
     if (a->InputAt(j)->id() != b->InputAt(j)->id()) return false;
   }
   return true;
 }
 
 }  // namespace
 
-
-ValueNumberingReducer::ValueNumberingReducer(Zone* zone)
-    : entries_(nullptr), capacity_(0), size_(0), zone_(zone) {}
-
+ValueNumberingReducer::ValueNumberingReducer(Zone* temp_zone, Zone* graph_zone)
+    : entries_(nullptr),
+      capacity_(0),
+      size_(0),
+      temp_zone_(temp_zone),
+      graph_zone_(graph_zone) {}
 
 ValueNumberingReducer::~ValueNumberingReducer() {}
 
 
 Reduction ValueNumberingReducer::Reduce(Node* node) {
   if (!node->op()->HasProperty(Operator::kIdempotent)) return NoChange();
 
   const size_t hash = HashCode(node);
   if (!entries_) {
     DCHECK(size_ == 0);
     DCHECK(capacity_ == 0);
     // Allocate the initial entries and insert the first entry.
     capacity_ = kInitialCapacity;
-    entries_ = zone()->NewArray<Node*>(kInitialCapacity);
+    entries_ = temp_zone()->NewArray<Node*>(kInitialCapacity);
     memset(entries_, 0, sizeof(*entries_) * kInitialCapacity);
     entries_[hash & (kInitialCapacity - 1)] = node;
     size_ = 1;
     return NoChange();
   }
 
   DCHECK(size_ < capacity_);
   DCHECK(size_ * kCapacityToSizeRatio < capacity_);
 
   const size_t mask = capacity_ - 1;
@@ skipping 44 matching lines @@
         }
       }
     }
 
     // Skip dead entries, but remember their indices so we can reuse them.
     if (entry->IsDead()) {
       dead = i;
       continue;
     }
     if (Equals(entry, node)) {
+      // Make sure the replacement has at least as good type as the original
+      // node.
+      if (NodeProperties::IsTyped(entry) && NodeProperties::IsTyped(node)) {
+        Type* entry_type = NodeProperties::GetType(entry);
+        Type* node_type = NodeProperties::GetType(node);
+        if (!entry_type->Is(node_type)) {
+          NodeProperties::SetType(
+              entry, Type::Intersect(entry_type, node_type, graph_zone()));
+        }
+      }
       return Replace(entry);
     }
   }
 }
 
 
 void ValueNumberingReducer::Grow() {
   // Allocate a new block of entries kCapacityToSizeRatio times the previous
   // capacity.
   Node** const old_entries = entries_;
   size_t const old_capacity = capacity_;
   capacity_ *= kCapacityToSizeRatio;
-  entries_ = zone()->NewArray<Node*>(capacity_);
+  entries_ = temp_zone()->NewArray<Node*>(capacity_);
   memset(entries_, 0, sizeof(*entries_) * capacity_);
   size_ = 0;
   size_t const mask = capacity_ - 1;
 
   // Insert the old entries into the new block (skipping dead nodes).
   for (size_t i = 0; i < old_capacity; ++i) {
     Node* const old_entry = old_entries[i];
     if (!old_entry || old_entry->IsDead()) continue;
     for (size_t j = HashCode(old_entry) & mask;; j = (j + 1) & mask) {
       Node* const entry = entries_[j];
       if (entry == old_entry) {
         // Skip duplicate of the old entry.
         break;
       }
       if (!entry) {
         entries_[j] = old_entry;
         size_++;
         break;
       }
     }
   }
 }
 
 }  // namespace compiler
 }  // namespace internal
 }  // namespace v8