[turbofan] Add type to the allocation operator.

src/compiler/js-native-context-specialization.cc

 // Copyright 2015 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/compiler/js-native-context-specialization.h"
 
 #include "src/accessors.h"
 #include "src/code-factory.h"
 #include "src/compilation-dependencies.h"
 #include "src/compiler/access-builder.h"
@@ skipping 1502 matching lines @@
           value = effect = graph()->NewNode(simplified()->CheckNumber(), value,
                                             effect, control);
           if (!field_index.is_inobject() || field_index.is_hidden_field() ||
               !FLAG_unbox_double_fields) {
             if (access_info.HasTransitionMap()) {
               // Allocate a MutableHeapNumber for the new property.
               effect = graph()->NewNode(
                   common()->BeginRegion(RegionObservability::kNotObservable),
                   effect);
               Node* box = effect = graph()->NewNode(
-                  simplified()->Allocate(NOT_TENURED),
+                  simplified()->Allocate(Type::Number(), NOT_TENURED),

[Benedikt Meurer, 2017/04/06 12:08:05]

This should be Type::OtherInternal(). A MutableHeapNumber is not a HeapNumber.

[Jarin, 2017/04/06 15:11:29]

Done. Good catch!

                   jsgraph()->Constant(HeapNumber::kSize), effect, control);
               effect = graph()->NewNode(
                   simplified()->StoreField(AccessBuilder::ForMap()), box,
                   jsgraph()->HeapConstant(factory()->mutable_heap_number_map()),
                   effect, control);
               effect = graph()->NewNode(
                   simplified()->StoreField(AccessBuilder::ForHeapNumberValue()),
                   box, value, effect, control);
               value = effect =
                   graph()->NewNode(common()->FinishRegion(), box, effect);
@@ skipping 668 matching lines @@
     values.push_back(value);
   }
   // Initialize the new fields to undefined.
   for (int i = 0; i < JSObject::kFieldsAdded; ++i) {
     values.push_back(jsgraph()->UndefinedConstant());
   }
   // Allocate and initialize the new properties.
   effect = graph()->NewNode(
       common()->BeginRegion(RegionObservability::kNotObservable), effect);
   Node* new_properties = effect = graph()->NewNode(
-      simplified()->Allocate(NOT_TENURED),
+      simplified()->Allocate(Type::Internal(), NOT_TENURED),

[Benedikt Meurer, 2017/04/06 12:08:05]

Nit: Type::OtherInternal()

[Jarin, 2017/04/06 15:11:29]

Done.

       jsgraph()->Constant(FixedArray::SizeFor(new_length)), effect, control);
   effect = graph()->NewNode(simplified()->StoreField(AccessBuilder::ForMap()),
                             new_properties, jsgraph()->FixedArrayMapConstant(),
                             effect, control);
   effect = graph()->NewNode(
       simplified()->StoreField(AccessBuilder::ForFixedArrayLength()),
       new_properties, jsgraph()->Constant(new_length), effect, control);
   for (int i = 0; i < new_length; ++i) {
     effect = graph()->NewNode(
         simplified()->StoreField(
@@ skipping 155 matching lines @@
   return jsgraph()->javascript();
 }
 
 SimplifiedOperatorBuilder* JSNativeContextSpecialization::simplified() const {
   return jsgraph()->simplified();
 }
 
 }  // namespace compiler
 }  // namespace internal
 }  // namespace v8