[turbofan] Remove representation axis for float64 fields.

This removes the representation axis from the type of {Load/StoreField}
operators representing a property load/store. The representation would
be narrowed to {None} which causes problems for all places where we use
the type to reason about the value representation. Instead we should
fully switch to {MachineRepresentation}. This is just a stop-gap fix.

R=jarin@chromium.org
BUG=chromium:636716

Review-Url: https://codereview.chromium.org/2255533003
Cr-Commit-Position: refs/heads/master@{#38678}

src/compiler/js-native-context-specialization.cc

@@ -896,6 +896,11 @@ JSNativeContextSpecialization::BuildPropertyAccess(
         field_type,  MachineType::AnyTagged(), kFullWriteBarrier};
     if (access_mode == AccessMode::kLoad) {
       if (field_type->Is(Type::UntaggedFloat64())) {
+        // TODO(turbofan): We remove the representation axis from the type to
+        // avoid uninhabited representation types. This is a workaround until
+        // the {PropertyAccessInfo} is using {MachineRepresentation} instead.
+        field_access.type = Type::Union(
+            field_type, Type::Representation(Type::Number(), zone()), zone());
         if (!field_index.is_inobject() || field_index.is_hidden_field() ||
             !FLAG_unbox_double_fields) {
           storage = effect = graph()->NewNode(
@@ -910,6 +915,11 @@ JSNativeContextSpecialization::BuildPropertyAccess(
     } else {
       DCHECK_EQ(AccessMode::kStore, access_mode);
       if (field_type->Is(Type::UntaggedFloat64())) {
+        // TODO(turbofan): We remove the representation axis from the type to
+        // avoid uninhabited representation types. This is a workaround until
+        // the {PropertyAccessInfo} is using {MachineRepresentation} instead.
+        field_access.type = Type::Union(
+            field_type, Type::Representation(Type::Number(), zone()), zone());
         value = effect = graph()->NewNode(simplified()->CheckNumber(), value,
                                           effect, control);
 

src/types.h

@@ -751,8 +751,8 @@ class Type {
   SIMD128_TYPES(CONSTRUCT_SIMD_TYPE)
 #undef CONSTRUCT_SIMD_TYPE
 
-  static Type* Union(Type* type1, Type* type2, Zone* reg);
-  static Type* Intersect(Type* type1, Type* type2, Zone* reg);
+  static Type* Union(Type* type1, Type* type2, Zone* zone);
+  static Type* Intersect(Type* type1, Type* type2, Zone* zone);
 
   static Type* Of(double value, Zone* zone) {
     return BitsetType::New(BitsetType::ExpandInternals(BitsetType::Lub(value)));

test/cctest/types-fuzz.h

@@ -208,8 +208,6 @@ class Types {
 
   Type* Representation(Type* t) { return Type::Representation(t, zone_); }
 
-  // Type* Semantic(Type* t) { return Intersect(t,
-  // MaskSemanticForTesting); }
   Type* Semantic(Type* t) { return Type::Semantic(t, zone_); }
 
   Type* Random() {