[turbofan] Make GraphAssembler branching respect typing

GraphAssembler creates Phi nodes and creates additional inputs to them
depending on how many jumps go there. If the typer decorator is active,
it will type the Phi node at creation time. GraphAssembler was not aware
of types (until recently it was not used while the graph is typed) and
did not update the Phi type with each new input. This CL fixes that.

Bug: chromium:1082704
Change-Id: Id94bcda752c7b3dc836eb2b6c6b55b1690185a09
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2202978Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67823}

src/compiler/graph-assembler.h

@@ -582,6 +582,7 @@ void GraphAssembler::MergeState(GraphAssemblerLabel<sizeof...(Vars)>* label,
       label->effect_->ReplaceInput(1, effect());
       for (size_t i = 0; i < kVarCount; i++) {
         label->bindings_[i]->ReplaceInput(1, var_array[i]);
+        CHECK(!NodeProperties::IsTyped(var_array[i]));  // Unsupported.
       }
     }
   } else {
@@ -625,6 +626,13 @@ void GraphAssembler::MergeState(GraphAssemblerLabel<sizeof...(Vars)>* label,
         NodeProperties::ChangeOp(
             label->bindings_[i],
             common()->Phi(label->representations_[i], merged_count + 1));
+        if (NodeProperties::IsTyped(label->bindings_[i])) {
+          CHECK(NodeProperties::IsTyped(var_array[i]));
+          Type old_type = NodeProperties::GetType(label->bindings_[i]);
+          Type new_type = Type::Union(
+              old_type, NodeProperties::GetType(var_array[i]), graph()->zone());
+          NodeProperties::SetType(label->bindings_[i], new_type);
+        }
       }
     }
   }

test/mjsunit/compiler/regress-1082704.js

+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+var array = [[]];
+function foo() {
+  const x = array[0];
+  const y = [][0];
+  return x == y;
+}
+%PrepareFunctionForOptimization(foo);
+assertFalse(foo());
+%OptimizeFunctionOnNextCall(foo);
+assertFalse(foo());