[turbofan] Sanitize typing of Date builtins.

src/compiler/type-cache.h

Index: src/compiler/type-cache.h
diff --git a/src/compiler/type-cache.h b/src/compiler/type-cache.h
index 1f2dda816df3fd295ee83a54d9146abde1aeac56..831cf22edd56a211fa5b10a8c7ba4280cd9f317e 100644
--- a/src/compiler/type-cache.h
+++ b/src/compiler/type-cache.h
@@ -104,12 +104,46 @@ class TypeCache final {
   Type* const kStringLengthType =
       CreateNative(CreateRange(0.0, String::kMaxLength), Type::TaggedSigned());
 
-  // The JSDate::value properties always contains a tagged number in the range
+  // The JSDate::day property always contains a tagged number in the range
+  // [0, 23] or NaN.

[epertoso, 2016/08/30 08:08:04]

[1, 31]

[Benedikt Meurer, 2016/08/30 09:35:59]

Done.

+  Type* const kJSDateDayType =
+      Type::Union(CreateRange(1, 31.0), Type::NaN(), zone());
+
+  // The JSDate::hour property always contains a tagged number in the range
+  // [0, 23] or NaN.
+  Type* const kJSDateHourType =
+      Type::Union(CreateRange(0, 23.0), Type::NaN(), zone());
+
+  // The JSDate::minute property always contains a tagged number in the range
+  // [0, 59] or NaN.
+  Type* const kJSDateMinuteType =
+      Type::Union(CreateRange(0, 59.0), Type::NaN(), zone());
+
+  // The JSDate::month property always contains a tagged number in the range
+  // [0, 11] or NaN.
+  Type* const kJSDateMonthType =
+      Type::Union(CreateRange(0, 11.0), Type::NaN(), zone());
+
+  // The JSDate::second property always contains a tagged number in the range
+  // [0, 59] or NaN.
+  Type* const kJSDateSecondType = kJSDateMinuteType;
+
+  // The JSDate::value property always contains a tagged number in the range
   // [-kMaxTimeInMs, kMaxTimeInMs] or NaN.
   Type* const kJSDateValueType = Type::Union(
       CreateRange(-DateCache::kMaxTimeInMs, DateCache::kMaxTimeInMs),
       Type::NaN(), zone());
 
+  // The JSDate::weekday property always contains a tagged number in the range
+  // [0, 6] or NaN.
+  Type* const kJSDateWeekdayType =
+      Type::Union(CreateRange(0, 6.0), Type::NaN(), zone());
+
+  // The JSDate::year property always contains a tagged number in the signed
+  // small range or NaN.
+  Type* const kJSDateYearType =
+      Type::Union(Type::SignedSmall(), Type::NaN(), zone());
+
 #define TYPED_ARRAY(TypeName, type_name, TYPE_NAME, ctype, size) \
   Type* const k##TypeName##Array = CreateArray(k##TypeName);
   TYPED_ARRAYS(TYPED_ARRAY)