[turbofan] Fix typing rule for CheckBounds.

As of crrev.com/2760213003, the CheckBounds operator passes a truncation
that identfies zero and minus zero. However that was not reflected in
the typing rule, and as such the type of CheckBounds(-0,length) was
always Type::None. That confused the typed alias analysis in the
LoadElimination and led to ignoring StoreElement nodes.

BUG=chromium:708050
R=jarin@chromium.org

Review-Url: https://codereview.chromium.org/2812013006
Cr-Commit-Position: refs/heads/master@{#44598}

src/compiler/typer.cc

@@ -1810,6 +1810,9 @@ Type* Typer::Visitor::TypeStringIndexOf(Node* node) {
 Type* Typer::Visitor::TypeCheckBounds(Node* node) {
   Type* index = Operand(node, 0);
   Type* length = Operand(node, 1);
+  if (index->Maybe(Type::MinusZero())) {
+    index = Type::Union(index, typer_->cache_.kSingletonZero, zone());
+  }
   index = Type::Intersect(index, Type::Integral32(), zone());
   if (!index->IsInhabited() || !length->IsInhabited()) return Type::None();
   double min = std::max(index->Min(), 0.0);

test/mjsunit/regress/regress-crbug-708050-1.js

+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+var v = {}
+
+function foo() {
+  v[0] = 5;
+  v[-0] = 27;
+  return v[0];
+}
+
+assertEquals(27, foo());
+%OptimizeFunctionOnNextCall(foo);
+assertEquals(27, foo());

test/mjsunit/regress/regress-crbug-708050-2.js

+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+var v = [];
+
+function foo() {
+  v[0] = 5;
+  v[-0] = 27;
+  return v[0];
+}
+
+assertEquals(27, foo());
+%OptimizeFunctionOnNextCall(foo);
+assertEquals(27, foo());