[turbofan] Assign appropriate types to some Date builtins.

src/compiler/type-cache.h

 // Copyright 2014 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef V8_COMPILER_TYPE_CACHE_H_
 #define V8_COMPILER_TYPE_CACHE_H_
 
+#include "src/date.h"
 #include "src/types.h"
 
 namespace v8 {
 namespace internal {
 namespace compiler {
 
 class TypeCache final {
  private:
   // This has to be first for the initialization magic to work.
   base::AccountingAllocator allocator;
@@ skipping 78 matching lines @@
   // The JSTyped::length property always contains a tagged number in the range
   // [0, kMaxSmiValue].
   Type* const kJSTypedArrayLengthType =
       CreateNative(Type::UnsignedSmall(), Type::TaggedSigned());
 
   // The String::length property always contains a smi in the range
   // [0, String::kMaxLength].
   Type* const kStringLengthType =
       CreateNative(CreateRange(0.0, String::kMaxLength), Type::TaggedSigned());
 
+  // The JSDate::value properties always contains a tagged number in the range
+  // [-kMaxTimeInMs, kMaxTimeInMs] or NaN.
+  Type* const kJSDateValueType = Type::Union(
+      CreateRange(-DateCache::kMaxTimeInMs, DateCache::kMaxTimeInMs),
+      Type::NaN(), zone());
+
 #define TYPED_ARRAY(TypeName, type_name, TYPE_NAME, ctype, size) \
   Type* const k##TypeName##Array = CreateArray(k##TypeName);
   TYPED_ARRAYS(TYPED_ARRAY)
 #undef TYPED_ARRAY
 
  private:
   Type* CreateArray(Type* element) { return Type::Array(element, zone()); }
 
   Type* CreateArrayFunction(Type* array) {
     Type* arg1 = Type::Union(Type::Unsigned32(), Type::Object(), zone());
@@ skipping 17 matching lines @@
   }
 
   Zone* zone() { return &zone_; }
 };
 
 }  // namespace compiler
 }  // namespace internal
 }  // namespace v8
 
 #endif  // V8_COMPILER_TYPE_CACHE_H_