[turbofan] fix deopt-loop for specuative Boolean to Number conversion

Bug: chromium:965513
Change-Id: I18ff91c98ad6106c5d4df260e6ead6a9e2425dbb
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1622119
Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
Auto-Submit: Tobias Tebbi <tebbi@chromium.org>
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61730}

src/compiler/representation-change.cc

@@ -843,7 +843,10 @@ Node* RepresentationChanger::GetFloat64RepresentationFor(
     }
   } else if (output_rep == MachineRepresentation::kBit) {
     CHECK(output_type.Is(Type::Boolean()));
-    if (use_info.truncation().IsUsedAsFloat64()) {
+    // TODO(tebbi): TypeCheckKind::kNumberOrOddball should imply Float64
+    // truncation, since this exactly means that we treat Oddballs as Numbers.
+    if (use_info.truncation().IsUsedAsFloat64() ||
+        use_info.type_check() == TypeCheckKind::kNumberOrOddball) {
       op = machine()->ChangeUint32ToFloat64();
     } else {
       CHECK_NE(use_info.type_check(), TypeCheckKind::kNone);
@@ -975,6 +978,7 @@ Node* RepresentationChanger::GetWord32RepresentationFor(
       CHECK(Truncation::Any(kIdentifyZeros)
                 .IsLessGeneralThan(use_info.truncation()));
       CHECK_NE(use_info.type_check(), TypeCheckKind::kNone);
+      CHECK_NE(use_info.type_check(), TypeCheckKind::kNumberOrOddball);
       Node* unreachable =
           InsertUnconditionalDeopt(use_node, DeoptimizeReason::kNotASmi);
       return jsgraph()->graph()->NewNode(
@@ -1261,6 +1265,7 @@ Node* RepresentationChanger::GetWord64RepresentationFor(
   } else if (output_rep == MachineRepresentation::kBit) {
     CHECK(output_type.Is(Type::Boolean()));
     CHECK_NE(use_info.type_check(), TypeCheckKind::kNone);
+    CHECK_NE(use_info.type_check(), TypeCheckKind::kNumberOrOddball);
     Node* unreachable =
         InsertUnconditionalDeopt(use_node, DeoptimizeReason::kNotASmi);
     return jsgraph()->graph()->NewNode(

src/compiler/representation-change.h

@@ -240,6 +240,8 @@ class UseInfo {
   }
   static UseInfo CheckedNumberOrOddballAsFloat64(
       IdentifyZeros identify_zeros, const VectorSlotPair& feedback) {
+    // TODO(tebbi): We should use Float64 truncation here, since this exactly
+    // means that we treat Oddballs as Numbers.
     return UseInfo(MachineRepresentation::kFloat64,
                    Truncation::Any(identify_zeros),
                    TypeCheckKind::kNumberOrOddball, feedback);

test/mjsunit/compiler/regress-crbug-965513.js

+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+// Flags: --allow-natives-syntax --opt
+
+%EnsureFeedbackVectorForFunction(foo);
+function foo(x) {
+  return x * (x == 1);
+}
+
+foo(0.5);
+foo(1.5);
+%OptimizeFunctionOnNextCall(foo);
+foo(1.5);
+assertOptimized(foo);