[ic] Unify undetectable abstract equality comparison.

The treatment of different undetectable objects was inconsistent after
the latest changes to the undetectable bit in the maps. Given two
different undetectable JSObjects a and b, a monomorphic CompareIC would
say false for a == b, while the rest of the system (including the
generic case for the CompareIC) would say true.

The fix is rather straight-forward: We just go generic on a CompareIC
once we see an undetectable JSObject.

R=yangguo@chromium.org

Review URL: https://codereview.chromium.org/1735863004

Cr-Commit-Position: refs/heads/master@{#34315}

src/ic/ic-state.cc

@@ -404,7 +404,9 @@ CompareICState::State CompareICState::NewInputState(State old_state,
       if (value->IsInternalizedString()) return INTERNALIZED_STRING;
       if (value->IsString()) return STRING;
       if (value->IsSymbol()) return UNIQUE_NAME;
-      if (value->IsJSReceiver()) return RECEIVER;
+      if (value->IsJSReceiver() && !value->IsUndetectableObject()) {
+        return RECEIVER;
+      }
       break;
     case BOOLEAN:
       if (value->IsBoolean()) return BOOLEAN;
@@ -428,7 +430,9 @@ CompareICState::State CompareICState::NewInputState(State old_state,
       if (value->IsUniqueName()) return UNIQUE_NAME;
       break;
     case RECEIVER:
-      if (value->IsJSReceiver()) return RECEIVER;
+      if (value->IsJSReceiver() && !value->IsUndetectableObject()) {
+        return RECEIVER;
+      }
       break;
     case GENERIC:
       break;
@@ -464,6 +468,9 @@ CompareICState::State CompareICState::TargetState(
       }
       if (x->IsString() && y->IsString()) return STRING;
       if (x->IsJSReceiver() && y->IsJSReceiver()) {
+        if (x->IsUndetectableObject() || y->IsUndetectableObject()) {
+          return GENERIC;
+        }
         if (Handle<JSReceiver>::cast(x)->map() ==
             Handle<JSReceiver>::cast(y)->map()) {
           return KNOWN_RECEIVER;

test/mjsunit/mjsunit.status

@@ -866,7 +866,6 @@
 
   # TODO(rmcilroy,4680): Test assert failures.
   'array-literal-feedback': [FAIL],
-  'undetectable-compare': [FAIL],
   'debug-liveedit-2': [FAIL],
   'compiler/deopt-tonumber-compare': [FAIL],
   'es6/string-search': [FAIL],

test/mjsunit/undetectable-compare.js

@@ -92,5 +92,15 @@ for (var i = 0; i < 5; i++) {
 }
 
 
-assertFalse(undetectable == %GetUndetectable());
+assertTrue(undetectable == %GetUndetectable());
 assertFalse(undetectable === %GetUndetectable());
+
+
+function test2(a, b) {
+  assertTrue(a == b);
+}
+test2(1, 1);
+test2(undetectable, undetectable);
+for (var i = 0; i < 5; ++i) {
+  test2(undetectable, %GetUndetectable());
+}