[turbofan] Introduce new Select operator to improve bounds checking.

src/compiler/verifier.cc

 // Copyright 2014 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/compiler/verifier.h"
 
 #include <deque>
 #include <queue>
 #include <sstream>
 #include <string>
@@ skipping 292 matching lines @@
       // Projection has an input that produces enough values.
       int index = OpParameter<int>(node->op());
       Node* input = NodeProperties::GetValueInput(node, 0);
       CHECK_GT(OperatorProperties::GetValueOutputCount(input->op()), index);
       // Type can be anything.
       // TODO(rossberg): Introduce tuple types for this.
       // TODO(titzer): Convince rossberg not to.
       CheckUpperIs(node, Type::Any());
       break;
     }
+    case IrOpcode::kSelect: {
+      CHECK_EQ(0, effect_count);
+      CHECK_EQ(0, control_count);
+      CHECK_EQ(3, value_count);
+      break;
+    }
     case IrOpcode::kPhi: {
       // Phi input count matches parent control node.
       CHECK_EQ(0, effect_count);
       CHECK_EQ(1, control_count);
       Node* control = NodeProperties::GetControlInput(node, 0);
       CHECK_EQ(value_count,
                OperatorProperties::GetControlInputCount(control->op()));
       CHECK_EQ(input_count, 1 + value_count);
       // Type must be subsumed by all input types.
       // TODO(rossberg): for now at least, narrowing does not really hold.
@@ skipping 647 matching lines @@
     // Check inputs for all nodes in the block.
     for (size_t i = 0; i < block->NodeCount(); i++) {
       Node* node = block->NodeAt(i);
       CheckInputsDominate(schedule, block, node, static_cast<int>(i) - 1);
     }
   }
 }
 }
 }
 }  // namespace v8::internal::compiler