[turbofan] Enable --verify-simplified-lowering in debug

Bug: v8:12619
Change-Id: I3b9f82a21c9454ff37036e8abcf73862e38f1fc9
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3494243Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Auto-Submit: Nico Hartmann <nicohartmann@chromium.org>
Commit-Queue: Nico Hartmann <nicohartmann@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79338}

src/compiler/simplified-lowering-verifier.cc

@@ -41,7 +41,10 @@ void SimplifiedLoweringVerifier::CheckAndSet(Node* node, const Type& type,
           node_type_str.str().c_str());
     }
   } else {
-    NodeProperties::SetType(node, type);
+    // We store the type inferred by the verification pass. We do not update
+    // the node's type directly, because following phases might encounter
+    // unsound types as long as the verification is not complete.
+    SetType(node, type);
   }
   SetTruncation(node, GeneralizeTruncation(trunc, type));
 }

src/compiler/simplified-lowering-verifier.h

@@ -16,6 +16,7 @@ class OperationTyper;
 class SimplifiedLoweringVerifier final {
  public:
   struct PerNodeData {
+    Type type = Type::None();
     Truncation truncation = Truncation::Any(IdentifyZeros::kDistinguishZeros);
   };
 
@@ -38,6 +39,19 @@ class SimplifiedLoweringVerifier final {
     return type_guards_.find(node) != type_guards_.end();
   }
 
+  void ResizeDataIfNecessary(Node* node) {
+    if (data_.size() <= node->id()) {
+      data_.resize(node->id() + 1);
+    }
+    DCHECK_EQ(data_[node->id()].truncation,
+              Truncation::Any(IdentifyZeros::kDistinguishZeros));
+  }
+
+  void SetType(Node* node, const Type& type) {
+    ResizeDataIfNecessary(node);
+    data_[node->id()].type = type;
+  }
+
   Type InputType(Node* node, int input_index) const {
     // TODO(nicohartmann): Check that inputs are typed, once all operators are
     // supported.
@@ -45,15 +59,16 @@ class SimplifiedLoweringVerifier final {
     if (NodeProperties::IsTyped(input)) {
       return NodeProperties::GetType(input);
     }
+    // For nodes that have not been typed before SL, we use the type that has
+    // been inferred by the verifier.
+    if (input->id() < data_.size()) {
+      return data_[input->id()].type;
+    }
     return Type::None();
   }
 
   void SetTruncation(Node* node, const Truncation& truncation) {
-    if (data_.size() <= node->id()) {
-      data_.resize(node->id() + 1);
-    }
-    DCHECK_EQ(data_[node->id()].truncation,
-              Truncation::Any(IdentifyZeros::kDistinguishZeros));
+    ResizeDataIfNecessary(node);
     data_[node->id()].truncation = truncation;
   }
 

src/flags/flag-definitions.h

@@ -573,7 +573,8 @@ DEFINE_BOOL(assert_types, false,
 // TODO(tebbi): Support allocating types from background thread.
 DEFINE_NEG_IMPLICATION(assert_types, concurrent_recompilation)
 
-DEFINE_BOOL(verify_simplified_lowering, false,
+// Enable verification of SimplifiedLowering in debug builds.
+DEFINE_BOOL(verify_simplified_lowering, DEBUG_BOOL,
             "verify graph generated by simplified lowering")
 
 DEFINE_BOOL(trace_compilation_dependencies, false, "trace code dependencies")