[turbofan] Fix incorrect typing of NumberAdd

Bug: v8:12633
Change-Id: I4bb98b9f93f7c4a13f7374c732f47aaffedd4a14
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3468897
Auto-Submit: Nico Hartmann <nicohartmann@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79129}

src/compiler/escape-analysis-reducer.cc

@@ -6,6 +6,7 @@
 
 #include "src/compiler/all-nodes.h"
 #include "src/compiler/node-matchers.h"
+#include "src/compiler/operation-typer.h"
 #include "src/compiler/simplified-operator.h"
 #include "src/compiler/type-cache.h"
 #include "src/execution/frame-constants.h"
@@ -24,10 +25,11 @@ namespace compiler {
 #endif  // DEBUG
 
 EscapeAnalysisReducer::EscapeAnalysisReducer(
-    Editor* editor, JSGraph* jsgraph, EscapeAnalysisResult analysis_result,
-    Zone* zone)
+    Editor* editor, JSGraph* jsgraph, JSHeapBroker* broker,
+    EscapeAnalysisResult analysis_result, Zone* zone)
     : AdvancedReducer(editor),
       jsgraph_(jsgraph),
+      broker_(broker),
       analysis_result_(analysis_result),
       object_id_cache_(zone),
       node_cache_(jsgraph->graph(), zone),
@@ -221,6 +223,7 @@ void EscapeAnalysisReducer::VerifyReplacement() const {
 }
 
 void EscapeAnalysisReducer::Finalize() {
+  OperationTyper op_typer(broker_, jsgraph()->graph()->zone());
   for (Node* node : arguments_elements_) {
     const NewArgumentsElementsParameters& params =
         NewArgumentsElementsParametersOf(node->op());
@@ -318,17 +321,21 @@ void EscapeAnalysisReducer::Finalize() {
             Node* offset = jsgraph()->graph()->NewNode(
                 jsgraph()->simplified()->NumberAdd(), index,
                 offset_to_first_elem);
+            Type offset_type = op_typer.NumberAdd(
+                NodeProperties::GetType(index),
+                NodeProperties::GetType(offset_to_first_elem));
+            NodeProperties::SetType(offset, offset_type);
             if (type == CreateArgumentsType::kRestParameter) {
               // In the case of rest parameters we should skip the formal
               // parameters.
-              NodeProperties::SetType(offset,
-                                      TypeCache::Get()->kArgumentsLengthType);
               offset = jsgraph()->graph()->NewNode(
                   jsgraph()->simplified()->NumberAdd(), offset,
                   formal_parameter_count);
+              NodeProperties::SetType(
+                  offset, op_typer.NumberAdd(
+                              offset_type,
+                              NodeProperties::GetType(formal_parameter_count)));
             }
-            NodeProperties::SetType(offset,
-                                    TypeCache::Get()->kArgumentsLengthType);
             Node* frame = jsgraph()->graph()->NewNode(
                 jsgraph()->machine()->LoadFramePointer());
             NodeProperties::SetType(frame, Type::ExternalPointer());

src/compiler/escape-analysis-reducer.h

@@ -83,7 +83,7 @@ class NodeHashCache {
 class V8_EXPORT_PRIVATE EscapeAnalysisReducer final
     : public NON_EXPORTED_BASE(AdvancedReducer) {
  public:
-  EscapeAnalysisReducer(Editor* editor, JSGraph* jsgraph,
+  EscapeAnalysisReducer(Editor* editor, JSGraph* jsgraph, JSHeapBroker* broker,
                         EscapeAnalysisResult analysis_result, Zone* zone);
   EscapeAnalysisReducer(const EscapeAnalysisReducer&) = delete;
   EscapeAnalysisReducer& operator=(const EscapeAnalysisReducer&) = delete;
@@ -108,6 +108,7 @@ class V8_EXPORT_PRIVATE EscapeAnalysisReducer final
   Zone* zone() const { return zone_; }
 
   JSGraph* const jsgraph_;
+  JSHeapBroker* const broker_;
   EscapeAnalysisResult analysis_result_;
   ZoneVector<Node*> object_id_cache_;
   NodeHashCache node_cache_;

src/compiler/pipeline.cc

@@ -1544,9 +1544,9 @@ struct EscapeAnalysisPhase {
     GraphReducer reducer(temp_zone, data->graph(),
                          &data->info()->tick_counter(), data->broker(),
                          data->jsgraph()->Dead(), data->observe_node_manager());
-    EscapeAnalysisReducer escape_reducer(&reducer, data->jsgraph(),
-                                         escape_analysis.analysis_result(),
-                                         temp_zone);
+    EscapeAnalysisReducer escape_reducer(
+        &reducer, data->jsgraph(), data->broker(),
+        escape_analysis.analysis_result(), temp_zone);
 
     AddReducer(data, &reducer, &escape_reducer);