[turbofan] Weakening of types must handle ranges inside unions.

src/compiler/typer.cc

 // Copyright 2014 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/bootstrapper.h"
 #include "src/compiler/graph-inl.h"
 #include "src/compiler/js-operator.h"
 #include "src/compiler/node.h"
 #include "src/compiler/node-properties-inl.h"
 #include "src/compiler/node-properties.h"
@@ skipping 1101 matching lines @@
   return Bounds::Unbounded(zone());
 }
 
 
 // Returns a somewhat larger range if we previously assigned
 // a (smaller) range to this node. This is used  to speed up
 // the fixpoint calculation in case there appears to be a loop
 // in the graph. In the current implementation, we are
 // increasing the limits to the closest power of two.
 Type* Typer::Visitor::Weaken(Type* current_type, Type* previous_type) {
-  if (current_type->IsRange() && previous_type->IsRange()) {
-    Type::RangeType* previous = previous_type->AsRange();
-    Type::RangeType* current = current_type->AsRange();
-
+  Type::RangeType* previous = previous_type->GetRange();
+  Type::RangeType* current = current_type->GetRange();
+  if (previous != NULL && current != NULL) {
     double current_min = current->Min()->Number();
     Handle<Object> new_min = current->Min();
 
     // Find the closest lower entry in the list of allowed
     // minima (or negative infinity if there is no such entry).
     if (current_min != previous->Min()->Number()) {
       new_min = typer_->integer->AsRange()->Min();
       for (const auto val : typer_->weaken_min_limits_) {
         if (val->Number() <= current_min) {
           new_min = val;
           break;
         }
       }
     }
 
     double current_max = current->Max()->Number();
     Handle<Object> new_max = current->Max();
     // Find the closest greater entry in the list of allowed
     // maxima (or infinity if there is no such entry).
     if (current_max != previous->Max()->Number()) {
       new_max = typer_->integer->AsRange()->Max();
       for (const auto val : typer_->weaken_max_limits_) {
         if (val->Number() >= current_max) {
           new_max = val;
           break;
         }
       }
     }
 
-    return Type::Range(new_min, new_max, typer_->zone());
+    return Type::Union(current_type,
+                       Type::Range(new_min, new_max, typer_->zone()),
+                       typer_->zone());
   }
   return current_type;
 }
 
 
 Bounds Typer::Visitor::TypeJSStoreProperty(Node* node) {
   UNREACHABLE();
   return Bounds();
 }
 
@@ skipping 766 matching lines @@
         return typer_->float64_array_fun_;
       }
     }
   }
   return Type::Constant(value, zone());
 }
 
 }
 }
 }  // namespace v8::internal::compiler