[turbofan] Narrow type of Phis during JSTypedLowering.

src/compiler/js-typed-lowering.cc

Index: src/compiler/js-typed-lowering.cc
diff --git a/src/compiler/js-typed-lowering.cc b/src/compiler/js-typed-lowering.cc
index ed8f3b0dae4afa3f5db2af01cef9c10f2d79852d..bfcbd54777b09a6e90e38f73f8ee783e668ab541 100644
--- a/src/compiler/js-typed-lowering.cc
+++ b/src/compiler/js-typed-lowering.cc
@@ -1926,6 +1926,26 @@ Reduction JSTypedLowering::ReduceJSGeneratorRestoreRegister(Node* node) {
   return Changed(element);
 }
 
+Reduction JSTypedLowering::ReducePhi(Node* node) {
+  // Try to narrow the type of the Phi {node}, which might be more precise now
+  // after lowering based on types, i.e. a SpeculativeNumberAdd has a more
+  // precise type than the JSAdd that was in the graph when the Typer was run.
+  DCHECK_EQ(IrOpcode::kPhi, node->opcode());
+  int arity = node->op()->ValueInputCount();
+  Type* type = NodeProperties::GetType(node->InputAt(0));
+  for (int i = 1; i < arity; ++i) {
+    type = Type::Union(type, NodeProperties::GetType(node->InputAt(i)),
+                       graph()->zone());
+  }
+  Type* const node_type = NodeProperties::GetType(node);
+  if (!node_type->Is(type)) {
+    type = Type::Intersect(node_type, type, graph()->zone());
+    NodeProperties::SetType(node, type);
+    return Changed(node);
+  }
+  return NoChange();
+}
+
 Reduction JSTypedLowering::ReduceSelect(Node* node) {
   DCHECK_EQ(IrOpcode::kSelect, node->opcode());
   Node* const condition = NodeProperties::GetValueInput(node, 0);
@@ -2166,6 +2186,8 @@ Reduction JSTypedLowering::Reduce(Node* node) {
       return ReduceJSGeneratorRestoreContinuation(node);
     case IrOpcode::kJSGeneratorRestoreRegister:
       return ReduceJSGeneratorRestoreRegister(node);
+    case IrOpcode::kPhi:
+      return ReducePhi(node);
     case IrOpcode::kSelect:
       return ReduceSelect(node);
     case IrOpcode::kCheckMaps: