[turbofan] Fix impossible type handling for TypeGuard and BooleanNot.

src/compiler/simplified-lowering.cc

 // Copyright 2014 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/compiler/simplified-lowering.h"
 
 #include <limits>
 
 #include "src/address-map.h"
 #include "src/base/bits.h"
@@ skipping 1513 matching lines @@
       //------------------------------------------------------------------
       // Simplified operators.
       //------------------------------------------------------------------
       case IrOpcode::kBooleanNot: {
         if (lower()) {
           NodeInfo* input_info = GetInfo(node->InputAt(0));
           if (input_info->representation() == MachineRepresentation::kBit) {
             // BooleanNot(x: kRepBit) => Word32Equal(x, #0)
             node->AppendInput(jsgraph_->zone(), jsgraph_->Int32Constant(0));
             NodeProperties::ChangeOp(node, lowering->machine()->Word32Equal());
-          } else {
-            DCHECK(CanBeTaggedPointer(input_info->representation()));
+          } else if (CanBeTaggedPointer(input_info->representation())) {
             // BooleanNot(x: kRepTagged) => WordEqual(x, #false)
             node->AppendInput(jsgraph_->zone(), jsgraph_->FalseConstant());
             NodeProperties::ChangeOp(node, lowering->machine()->WordEqual());
+          } else {
+            DCHECK_EQ(MachineRepresentation::kNone,
+                      input_info->representation());
+            DeferReplacement(node, lowering->jsgraph()->Int32Constant(0));
           }
         } else {
           // No input representation requirement; adapt during lowering.
           ProcessInput(node, 0, UseInfo::AnyTruncatingToBool());
           SetOutput(node, MachineRepresentation::kBit);
         }
         return;
       }
       case IrOpcode::kNumberEqual: {
         Type* const lhs_type = TypeOf(node->InputAt(0));
@@ skipping 1223 matching lines @@
         if (lower()) NodeProperties::ChangeOp(node, Float64Op(node));
         return;
       case IrOpcode::kStateValues:
         return VisitStateValues(node);
       case IrOpcode::kObjectState:
         return VisitObjectState(node);
       case IrOpcode::kTypeGuard: {
         // We just get rid of the sigma here. In principle, it should be
         // possible to refine the truncation and representation based on
         // the sigma's type.
+
+        // For now, we just handle specially the impossible case.
         MachineRepresentation output =
-            GetOutputInfoForPhi(node, TypeOf(node->InputAt(0)), truncation);
+            TypeOf(node)->IsInhabited()
+                ? GetOutputInfoForPhi(node, TypeOf(node->InputAt(0)),
+                                      truncation)
+                : MachineRepresentation::kNone;
         VisitUnop(node, UseInfo(output, truncation), output);
         if (lower()) DeferReplacement(node, node->InputAt(0));
         return;
       }
 
       case IrOpcode::kOsrGuard:
         return VisitOsrGuard(node);
 
       case IrOpcode::kFinishRegion:
         VisitInputs(node);
@@ skipping 881 matching lines @@
         isolate(), graph()->zone(), callable.descriptor(), 0, flags,
         Operator::kNoProperties);
     to_number_operator_.set(common()->Call(desc));
   }
   return to_number_operator_.get();
 }
 
 }  // namespace compiler
 }  // namespace internal
 }  // namespace v8