[compiler] Really do not call Min/Max on empty type.

There were some places left where that could happen.

Bug: chromium:782754
Change-Id: I1db1f5b361cdf443b730a220c0e569ad48dd298d
Reviewed-on: https://chromium-review.googlesource.com/758841Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49283}

src/compiler/js-typed-lowering.cc

@@ -881,7 +881,7 @@ Reduction JSTypedLowering::ReduceJSToLength(Node* node) {
   Node* input = NodeProperties::GetValueInput(node, 0);
   Type* input_type = NodeProperties::GetType(input);
   if (input_type->Is(type_cache_.kIntegerOrMinusZero)) {
-    if (input_type->Max() <= 0.0) {
+    if (input_type->IsNone() || input_type->Max() <= 0.0) {
       input = jsgraph()->ZeroConstant();
     } else if (input_type->Min() >= kMaxSafeInteger) {
       input = jsgraph()->Constant(kMaxSafeInteger);

src/compiler/operation-typer.cc

@@ -423,7 +423,9 @@ Type* OperationTyper::NumberSign(Type* type) {
   bool maybe_minuszero = type->Maybe(Type::MinusZero());
   bool maybe_nan = type->Maybe(Type::NaN());
   type = Type::Intersect(type, Type::PlainNumber(), zone());
-  if (type->Max() < 0.0) {
+  if (type->IsNone()) {
+    // Do nothing.
+  } else if (type->Max() < 0.0) {
     type = cache_.kSingletonMinusOne;
   } else if (type->Max() <= 0.0) {
     type = cache_.kMinusOneOrZero;
@@ -436,6 +438,7 @@ Type* OperationTyper::NumberSign(Type* type) {
   }
   if (maybe_minuszero) type = Type::Union(type, Type::MinusZero(), zone());
   if (maybe_nan) type = Type::Union(type, Type::NaN(), zone());
+  DCHECK(!type->IsNone());
   return type;
 }
 
@@ -657,7 +660,9 @@ Type* OperationTyper::NumberDivide(Type* lhs, Type* rhs) {
       ((lhs->Min() == -V8_INFINITY || lhs->Max() == +V8_INFINITY) &&
        (rhs->Min() == -V8_INFINITY || rhs->Max() == +V8_INFINITY));
   lhs = Type::Intersect(lhs, Type::OrderedNumber(), zone());
+  DCHECK(!lhs->IsNone());
   rhs = Type::Intersect(rhs, Type::OrderedNumber(), zone());
+  DCHECK(!rhs->IsNone());
 
   // Try to rule out -0.
   bool maybe_minuszero =
@@ -949,7 +954,9 @@ Type* OperationTyper::NumberMax(Type* lhs, Type* rhs) {
     type = Type::Union(type, Type::NaN(), zone());
   }
   lhs = Type::Intersect(lhs, Type::OrderedNumber(), zone());
+  DCHECK(!lhs->IsNone());
   rhs = Type::Intersect(rhs, Type::OrderedNumber(), zone());
+  DCHECK(!rhs->IsNone());
   if (lhs->Is(cache_.kInteger) && rhs->Is(cache_.kInteger)) {
     double max = std::max(lhs->Max(), rhs->Max());
     double min = std::max(lhs->Min(), rhs->Min());
@@ -973,7 +980,9 @@ Type* OperationTyper::NumberMin(Type* lhs, Type* rhs) {
     type = Type::Union(type, Type::NaN(), zone());
   }
   lhs = Type::Intersect(lhs, Type::OrderedNumber(), zone());
+  DCHECK(!lhs->IsNone());
   rhs = Type::Intersect(rhs, Type::OrderedNumber(), zone());
+  DCHECK(!rhs->IsNone());
   if (lhs->Is(cache_.kInteger) && rhs->Is(cache_.kInteger)) {
     double max = std::min(lhs->Max(), rhs->Max());
     double min = std::min(lhs->Min(), rhs->Min());

src/compiler/simplified-lowering.cc

@@ -557,8 +557,10 @@ class RepresentationSelector {
 
     Type* current_integer =
         Type::Intersect(current_type, integer, graph_zone());
+    DCHECK(!current_integer->IsNone());
     Type* previous_integer =
         Type::Intersect(previous_type, integer, graph_zone());
+    DCHECK(!previous_integer->IsNone());
 
     // Once we start weakening a node, we should always weaken.
     if (!GetInfo(node)->weakened()) {
@@ -2420,8 +2422,9 @@ class RepresentationSelector {
           VisitBinop(node, UseInfo::TruncatingWord32(),
                      MachineRepresentation::kWord32);
           if (lower()) {
-            if (index_type->Min() >= 0.0 &&
-                index_type->Max() < length_type->Min()) {
+            if (index_type->IsNone() || length_type->IsNone() ||
+                (index_type->Min() >= 0.0 &&
+                 index_type->Max() < length_type->Min())) {
               // The bounds check is redundant if we already know that
               // the index is within the bounds of [0.0, length[.
               DeferReplacement(node, node->InputAt(0));

src/compiler/types.h

@@ -605,7 +605,7 @@ class V8_EXPORT_PRIVATE Type {
   // Minimum and maximum of a numeric type.
   // These functions do not distinguish between -0 and +0.  If the type equals
   // kNaN, they return NaN; otherwise kNaN is ignored.  Only call these
-  // functions on subtypes of Number.
+  // functions on subtypes of Number, but not on None!
   double Min();
   double Max();
 

test/mjsunit/regress/regress-782754.js

+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+let a = [1,2];
+function f(skip) { g(undefined, skip) }
+function g(x, skip) {
+  if (skip) return;
+  return a[x+1];
+}
+g(0, false);
+g(0, false);
+f(true);
+f(true);
+%OptimizeFunctionOnNextCall(f);
+f(false);