[turbofan] Add initial support for growing stores.

src/compiler/operation-typer.cc

 // Copyright 2016 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/compiler/operation-typer.h"
 
 #include "src/compiler/common-operator.h"
 #include "src/factory.h"
 #include "src/isolate.h"
 #include "src/type-cache.h"
@@ skipping 467 matching lines @@
   if (type->Is(cache_.kZeroish)) return cache_.kSingletonZero;
   if (type->Is(unsigned32ish_)) {
     return Type::Intersect(Type::Union(type, cache_.kSingletonZero, zone()),
                            Type::Unsigned32(), zone());
   }
   return Type::Unsigned32();
 }
 
 Type* OperationTyper::NumberSilenceNaN(Type* type) {
   DCHECK(type->Is(Type::Number()));
-  // TODO(turbofan): We should have a dedicated type for the signaling NaN.
+  // TODO(jarin): This is a terrible hack; we definitely need a dedicated type
+  // for the hole (tagged and/or double). Otherwise if the input is the hole
+  // NaN constant, we'd just eliminate this node in JSTypedLowering.
+  if (type->Maybe(Type::NaN())) return Type::Number();
   return type;
 }
 
 Type* OperationTyper::NumberAdd(Type* lhs, Type* rhs) {
   DCHECK(lhs->Is(Type::Number()));
   DCHECK(rhs->Is(Type::Number()));
 
   if (!lhs->IsInhabited() || !rhs->IsInhabited()) {
     return Type::None();
   }
@@ skipping 429 matching lines @@
   return singleton_true();
 }
 
 Type* OperationTyper::TypeTypeGuard(const Operator* sigma_op, Type* input) {
   return Type::Intersect(input, TypeGuardTypeOf(sigma_op), zone());
 }
 
 }  // namespace compiler
 }  // namespace internal
 }  // namespace v8