[turbofan] Only consider inhabited types for constant folding in typed lowering.

BUG=chromium:621423

Review-Url: https://codereview.chromium.org/2084483002
Cr-Commit-Position: refs/heads/master@{#37092}

src/compiler/js-typed-lowering.cc

@@ -1849,6 +1849,7 @@ Reduction JSTypedLowering::Reduce(Node* node) {
   if (!NodeProperties::IsConstant(node) && NodeProperties::IsTyped(node) &&
       node->op()->HasProperty(Operator::kEliminatable)) {
     Type* upper = NodeProperties::GetType(node);
+    if (upper->IsInhabited()) {
       if (upper->IsConstant()) {
         Node* replacement = jsgraph()->Constant(upper->AsConstant()->Value());
         ReplaceWithValue(node, replacement);
@@ -1865,7 +1866,8 @@ Reduction JSTypedLowering::Reduce(Node* node) {
         Node* replacement = jsgraph()->NullConstant();
         ReplaceWithValue(node, replacement);
         return Changed(replacement);
-    } else if (upper->Is(Type::PlainNumber()) && upper->Min() == upper->Max()) {
+      } else if (upper->Is(Type::PlainNumber()) &&
+                 upper->Min() == upper->Max()) {
         Node* replacement = jsgraph()->Constant(upper->Min());
         ReplaceWithValue(node, replacement);
         return Changed(replacement);
@@ -1875,6 +1877,7 @@ Reduction JSTypedLowering::Reduce(Node* node) {
         return Changed(replacement);
       }
     }
+  }
   switch (node->opcode()) {
     case IrOpcode::kJSEqual:
       return ReduceJSEqual(node, false);

test/mjsunit/compiler/regress-621423.js

+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+var a = [0, ""];
+a[0] = 0;
+
+function g(array) {
+  array[1] = undefined;
+}
+
+function f() {
+  g(function() {});
+  g(a);
+}
+
+f();
+%OptimizeFunctionOnNextCall(f);
+f();