[turbofan] Fix type for HOLEY_DOUBLE_ELEMENTS loads.

This correctly types values loaded via {LoadElement} nodes from arrays
of HOLEY_DOUBLE_ELEMENTS elements kind as {Type::NumberOrHole}. Even
though "the hole" is still encoded as a tagged NaN, the type system
still needs to consider it as a potential hole value.

R=bmeurer@chromium.org
TEST=mjsunit/regress/regress-crbug-736575
BUG=chromium:736575

Change-Id: Ib869284900a4affb2ddaa1d2a96df9443dba6921
Reviewed-on: https://chromium-review.googlesource.com/567180Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46620}

src/compiler/access-builder.cc

@@ -883,7 +883,7 @@ ElementAccess AccessBuilder::ForFixedArrayElement(ElementsKind kind) {
       access.machine_type = MachineType::Float64();
       break;
     case HOLEY_DOUBLE_ELEMENTS:
-      access.type = Type::Number();
+      access.type = Type::NumberOrHole();
       access.write_barrier_kind = kNoWriteBarrier;
       access.machine_type = MachineType::Float64();
       break;

src/compiler/js-builtin-reducer.cc

@@ -421,7 +421,7 @@ Reduction JSBuiltinReducer::ReduceFastArrayIteratorNext(
           value = graph()->NewNode(simplified()->ConvertTaggedHoleToUndefined(),
                                    value);
         } else if (elements_kind == HOLEY_DOUBLE_ELEMENTS) {
-          // TODO(bmeurer): avoid deopt if not all uses of value are truncated.
+          // TODO(6587): avoid deopt if not all uses of value are truncated.
           CheckFloat64HoleMode mode = CheckFloat64HoleMode::kAllowReturnHole;
           value = etrue1 = graph()->NewNode(
               simplified()->CheckFloat64Hole(mode), value, etrue1, if_true1);

test/mjsunit/es6/array-iterator-turbo.js

@@ -43,13 +43,15 @@ let tests = {
           return sum;
       },
 
-      HOLEY_DOUBLE_ELEMENTS(array) {
+      // TODO(6587): Re-enable the below test case once we no longer deopt due
+      // to non-truncating uses of {CheckFloat64Hole} nodes.
+      /*HOLEY_DOUBLE_ELEMENTS(array) {
         let sum = 0.0;
         for (let x of array) {
           if (x) sum += x;
         }
         return sum;
-      }
+      }*/
     };
 
     let tests = {
@@ -84,12 +86,14 @@ let tests = {
         array2: [0.6, 0.4, 0.2],
         expected2: 1.2
       },
-      HOLEY_DOUBLE_ELEMENTS: {
+      // TODO(6587): Re-enable the below test case once we no longer deopt due
+      // to non-truncating uses of {CheckFloat64Hole} nodes.
+      /*HOLEY_DOUBLE_ELEMENTS: {
         array: [0.1, , 0.3, , 0.5, , 0.7, , 0.9, ,],
         expected: 2.5,
         array2: [0.1, , 0.3],
         expected2: 0.4
-      }
+      }*/
     };
 
     for (let key of Object.keys(runners)) {

test/mjsunit/regress/regress-crbug-736575.js

+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function f() {
+  return [...[/*hole*/, 2.3]];
+}
+
+assertEquals(undefined, f()[0]);
+assertEquals(undefined, f()[0]);
+%OptimizeFunctionOnNextCall(f);
+assertEquals(undefined, f()[0]);