[turbofan] escape analysis: support type None as ObjectState input

Bug: chromium:753616
Change-Id: I0e9495184d83f30b91ba0c813c4222a962ec235e
Reviewed-on: https://chromium-review.googlesource.com/610003Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47278}

src/compiler/new-escape-analysis.cc

@@ -652,8 +652,8 @@ void ReduceNode(const Operator* op, EscapeAnalysisTracker::Scope* current,
       }
       break;
     }
-  }  // namespace
-}  // namespace
+  }
+}
 
 }  // namespace
 

src/compiler/simplified-lowering.cc

@@ -1132,20 +1132,7 @@ class RepresentationSelector {
   void VisitObjectState(Node* node) {
     if (propagate()) {
       for (int i = 0; i < node->InputCount(); i++) {
-        Node* input = node->InputAt(i);
-        Type* input_type = TypeOf(input);
-        // TODO(turbofan): Special treatment for ExternalPointer here,
-        // to avoid incompatible truncations. We really need a story
-        // for the JSFunction::entry field.
-        UseInfo use_info = UseInfo::None();
-        if (input_type->IsInhabited()) {
-          if (input_type->Is(Type::ExternalPointer())) {
-            use_info = UseInfo::PointerInt();
-          } else {
-            use_info = UseInfo::Any();
-          }
-        }
-        EnqueueInput(node, i, use_info);
+        EnqueueInput(node, i, UseInfo::Any());
       }
     } else if (lower()) {
       Zone* zone = jsgraph_->zone();

test/mjsunit/compiler/escape-analysis-type-none-in-object-state.js

+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function f(x) {
+  if (x != "x") {
+    var o = {a: (x + 1) * 1.5};
+    %DeoptimizeNow();
+    return o.a;
+  }
+}
+
+f(1.5); f(2.5); f(NaN);
+
+function g(x) {
+  f(""+x);
+}
+
+g("x"); g("x");
+%OptimizeFunctionOnNextCall(g);
+g("x");