[turbofan] fixed uninhabited type handling in ObjectState representation selection

src/compiler/simplified-lowering.cc

 // Copyright 2014 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/compiler/simplified-lowering.h"
 
 #include <limits>
 
 #include "src/address-map.h"
 #include "src/base/bits.h"
@@ skipping 1006 matching lines @@
   }
 
   void VisitObjectState(Node* node) {
     if (propagate()) {
       for (int i = 0; i < node->InputCount(); i++) {
         Node* input = node->InputAt(i);
         Type* input_type = TypeOf(input);
         // TODO(turbofan): Special treatment for ExternalPointer here,
         // to avoid incompatible truncations. We really need a story
         // for the JSFunction::entry field.
-        UseInfo use_info = input_type->Is(Type::ExternalPointer())
-                               ? UseInfo::PointerInt()
-                               : UseInfo::Any();
+        UseInfo use_info = UseInfo::None();
+        if (input_type->IsInhabited()) {
+          if (input_type->Is(Type::ExternalPointer())) {
+            use_info = UseInfo::PointerInt();
+          } else {
+            use_info = UseInfo::Any();
+          }
+        }
         EnqueueInput(node, i, use_info);
       }
     } else if (lower()) {
       Zone* zone = jsgraph_->zone();
       ZoneVector<MachineType>* types =
           new (zone->New(sizeof(ZoneVector<MachineType>)))
               ZoneVector<MachineType>(node->InputCount(), zone);
       for (int i = 0; i < node->InputCount(); i++) {
         Node* input = node->InputAt(i);
         NodeInfo* input_info = GetInfo(input);
         Type* input_type = TypeOf(input);
         // TODO(turbofan): Special treatment for ExternalPointer here,
         // to avoid incompatible truncations. We really need a story
         // for the JSFunction::entry field.
-        if (input_type->Is(Type::ExternalPointer())) {
+        if (!input_type->IsInhabited()) {
+          (*types)[i] = MachineType::None();
+        } else if (input_type->Is(Type::ExternalPointer())) {
           (*types)[i] = MachineType::Pointer();
         } else {
           MachineRepresentation rep = input_type->IsInhabited()
                                           ? input_info->representation()
                                           : MachineRepresentation::kNone;
           MachineType machine_type(rep, DeoptValueSemanticOf(input_type));
           DCHECK(machine_type.representation() !=
                      MachineRepresentation::kWord32 ||
                  machine_type.semantic() == MachineSemantic::kInt32 ||
                  machine_type.semantic() == MachineSemantic::kUint32);
@@ skipping 2384 matching lines @@
         isolate(), graph()->zone(), callable.descriptor(), 0, flags,
         Operator::kNoProperties);
     to_number_operator_.set(common()->Call(desc));
   }
   return to_number_operator_.get();
 }
 
 }  // namespace compiler
 }  // namespace internal
 }  // namespace v8