[TurboFan] Fix type checks for lowering SpeculativeNumberBinop.

Ensure we only lower SpeculativeNumberBinops to a pure operator for
non-string plain primitives. Previously we could lower if a value might be
the-hole, however this would fail a CHECK in ConvertInputsToNumber which
expects a plain primitive.

BUG=chromium:772420

Change-Id: I0c755d10db7afd9cabfb638eca5662d70dfc8d51
Reviewed-on: https://chromium-review.googlesource.com/715717
Commit-Queue: Ross McIlroy <rmcilroy@chromium.org>
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#48649}

src/compiler/js-typed-lowering.cc

@@ -532,7 +532,7 @@ Reduction JSTypedLowering::ReduceSpeculativeNumberBinop(Node* node) {
   NumberOperationHint hint = NumberOperationHintOf(node->op());
   if ((hint == NumberOperationHint::kNumber ||
        hint == NumberOperationHint::kNumberOrOddball) &&
-      r.BothInputsAre(Type::NumberOrOddball())) {
+      r.BothInputsAre(Type::NumberOrUndefinedOrNullOrBoolean())) {
     r.ConvertInputsToNumber();
     return r.ChangeToPureOperator(r.NumberOpFromSpeculativeNumberOp(),
                                   Type::Number());

src/compiler/types.h

@@ -170,6 +170,8 @@ namespace compiler {
                                   kHole) \
   V(NumberOrString,               kNumber | kString) \
   V(NumberOrUndefined,            kNumber | kUndefined) \
+  V(NumberOrUndefinedOrNullOrBoolean,  \
+                                  kNumber | kNullOrUndefined | kBoolean) \
   V(PlainPrimitive,               kNumberOrString | kBoolean | \
                                   kNullOrUndefined) \
   V(Primitive,                    kSymbol | kPlainPrimitive) \

test/mjsunit/compiler/regress-772420.js

+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function foo(arg) {
+  var value;
+  // None of the branches of this switch are ever taken, but
+  // the sequence means value could be the hole.
+  switch (arg) {
+    case 1:
+      let let_var = 1;
+    case 2:
+      value = let_var;
+  }
+  // Speculative number binop with NumberOrOddball feedback.
+  // Shouldn't be optimized to pure operator since value's phi
+  // could theoretically be the hole (we would have already thrown a
+  // reference error in case 2 above if so, but TF typing still
+  // thinks it could be the hole).
+  return value * undefined;
+}
+
+foo(3);
+foo(3);
+%OptimizeFunctionOnNextCall(foo);
+foo(3);