[compiler] Fix monotonicity issue in typing of dead code

Monotonicity of typing of arithmetic operations could fail in the
presence of optimized_out Oddball inputs, which can arise in dead code
in resumable functions. The CL fixes these with a small change to
BinaryNumberOpTyper.

Bug: chromium:1227677
Change-Id: I1e1d2e174b757e839d776685f52f7c4ac900844b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3020972Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#75683}

src/compiler/typer.cc

@@ -392,6 +392,8 @@ Type Typer::Visitor::BinaryNumberOpTyper(Type lhs, Type rhs, Typer* t,
                                          BinaryTyperFun f) {
   lhs = ToNumeric(lhs, t);
   rhs = ToNumeric(rhs, t);
+  if (lhs.IsNone() || rhs.IsNone()) return Type::None();
+
   bool lhs_is_number = lhs.Is(Type::Number());
   bool rhs_is_number = rhs.Is(Type::Number());
   if (lhs_is_number && rhs_is_number) {

test/mjsunit/compiler/regress-crbug-1227677.js

+// Copyright 2021 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+//
+// Flags: --allow-natives-syntax --interrupt-budget=1024
+
+(function() {
+  async function foo() {
+    for (let j = 0; j < 1; j++) {
+      const x = 2n * 3n;
+      for (let k = 0; k < 4; k++) {
+        function unused() {}
+        x >> 5n;
+        for (let i = 0; i < 100; i++) ;
+        for (let i = 0; i == 6; i++) await 7;
+      }
+    }
+  }
+  %PrepareFunctionForOptimization(foo);
+  foo();
+  foo();
+  %OptimizeFunctionOnNextCall(foo);
+  foo();
+})();
+
+(function() {
+  async function foo() {
+    for (let j = 0; j < 1; j++) {
+      const x = 2n * 3n;
+      for (let k = 0; k < 4; k++) {
+        function unused() {}
+        x << 5n;
+        for (let i = 0; i < 100; i++) ;
+        for (let i = 0; i == 6; i++) await 7;
+      }
+    }
+  }
+  %PrepareFunctionForOptimization(foo);
+  foo();
+  foo();
+  %OptimizeFunctionOnNextCall(foo);
+  foo();
+})();
+
+(function() {
+  async function foo() {
+    for (let j = 0; j < 1; j++) {
+      const x = 2n * 3n;
+      for (let k = 0; k < 4; k++) {
+        function unused() {}
+        x / 5n;
+        for (let i = 0; i < 100; i++) ;
+        for (let i = 0; i == 6; i++) await 7;
+      }
+    }
+  }
+  %PrepareFunctionForOptimization(foo);
+  foo();
+  foo();
+  %OptimizeFunctionOnNextCall(foo);
+  foo();
+})();
+
+(function() {
+  async function foo() {
+    for (let j = 0; j < 1; j++) {
+      const x = 2n * 3n;
+      for (let k = 0; k < 4; k++) {
+        function unused() {}
+        x % 5n;
+        for (let i = 0; i < 100; i++) ;
+        for (let i = 0; i == 6; i++) await 7;
+      }
+    }
+  }
+  %PrepareFunctionForOptimization(foo);
+  foo();
+  foo();
+  %OptimizeFunctionOnNextCall(foo);
+  foo();
+})();
+
+(function() {
+  async function foo() {
+    for (let j = 0; j < 1; j++) {
+      const x = 2n * 3n;
+      for (let k = 0; k < 4; k++) {
+        function unused() {}
+        x * 5n;
+        for (let i = 0; i < 100; i++) ;
+        for (let i = 0; i == 6; i++) await 7;
+      }
+    }
+  }
+  %PrepareFunctionForOptimization(foo);
+  foo();
+  foo();
+  %OptimizeFunctionOnNextCall(foo);
+  foo();
+})();
+
+(function() {
+  async function foo() {
+    for (let j = 0; j < 1; j++) {
+      const x = 2n * 3n;
+      for (let k = 0; k < 4; k++) {
+        function unused() {}
+        x ^ 5n;
+        for (let i = 0; i < 100; i++) ;
+        for (let i = 0; i == 6; i++) await 7;
+      }
+    }
+  }
+  %PrepareFunctionForOptimization(foo);
+  foo();
+  foo();
+  %OptimizeFunctionOnNextCall(foo);
+  foo();
+})();
+
+(function() {
+  async function foo() {
+    for (let j = 0; j < 1; j++) {
+      const x = 2n * 3n;
+      for (let k = 0; k < 4; k++) {
+        function unused() {}
+        x & 5n;
+        for (let i = 0; i < 100; i++) ;
+        for (let i = 0; i == 6; i++) await 7;
+      }
+    }
+  }
+  %PrepareFunctionForOptimization(foo);
+  foo();
+  foo();
+  %OptimizeFunctionOnNextCall(foo);
+  foo();
+})();
+
+(function() {
+  async function foo() {
+    for (let j = 0; j < 1; j++) {
+      const x = 2n * 3n;
+      for (let k = 0; k < 4; k++) {
+        function unused() {}
+        x | 5n;
+        for (let i = 0; i < 100; i++) ;
+        for (let i = 0; i == 6; i++) await 7;
+      }
+    }
+  }
+  %PrepareFunctionForOptimization(foo);
+  foo();
+  foo();
+  %OptimizeFunctionOnNextCall(foo);
+  foo();
+})();
+
+(function() {
+  async function foo() {
+    for (let j = 0; j < 1; j++) {
+      const x = 2n * 3n;
+      for (let k = 0; k < 4; k++) {
+        function unused() {}
+        x + 5n;
+        for (let i = 0; i < 100; i++) ;
+        for (let i = 0; i == 6; i++) await 7;
+      }
+    }
+  }
+  %PrepareFunctionForOptimization(foo);
+  foo();
+  foo();
+  %OptimizeFunctionOnNextCall(foo);
+  foo();
+})();
+
+(function() {
+  async function foo() {
+    for (let j = 0; j < 1; j++) {
+      const x = 2n * 3n;
+      for (let k = 0; k < 4; k++) {
+        function unused() {}
+        x < 5n;
+        for (let i = 0; i < 100; i++) ;
+        for (let i = 0; i == 6; i++) await 7;
+      }
+    }
+  }
+  %PrepareFunctionForOptimization(foo);
+  foo();
+  foo();
+  %OptimizeFunctionOnNextCall(foo);
+  foo();
+})();