[compiler] Make typer deal with conversions that return empty type.

The typer's ToNumber (and thus ToInteger etc.) returns type None when
the input type is BigInt, but we weren't quite ready for that in a few
places.

R=jarin@chromium.org

Bug: v8:7121
Change-Id: Ib12c726338f1ec3dfb9ba5cf54b00cc8d1351a89
Reviewed-on: https://chromium-review.googlesource.com/785130
Commit-Queue: Georg Neis <neis@chromium.org>
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49604}

src/compiler/operation-typer.cc

@@ -754,11 +754,11 @@ Type* OperationTyper::NumberBitwiseOr(Type* lhs, Type* rhs) {
   DCHECK(lhs->Is(Type::Number()));
   DCHECK(rhs->Is(Type::Number()));
 
-  if (lhs->IsNone() || rhs->IsNone()) return Type::None();
-
   lhs = NumberToInt32(lhs);
   rhs = NumberToInt32(rhs);
 
+  if (lhs->IsNone() || rhs->IsNone()) return Type::None();
+
   double lmin = lhs->Min();
   double rmin = rhs->Min();
   double lmax = lhs->Max();
@@ -791,11 +791,11 @@ Type* OperationTyper::NumberBitwiseAnd(Type* lhs, Type* rhs) {
   DCHECK(lhs->Is(Type::Number()));
   DCHECK(rhs->Is(Type::Number()));
 
-  if (lhs->IsNone() || rhs->IsNone()) return Type::None();
-
   lhs = NumberToInt32(lhs);
   rhs = NumberToInt32(rhs);
 
+  if (lhs->IsNone() || rhs->IsNone()) return Type::None();
+
   double lmin = lhs->Min();
   double rmin = rhs->Min();
   double lmax = lhs->Max();
@@ -822,11 +822,11 @@ Type* OperationTyper::NumberBitwiseXor(Type* lhs, Type* rhs) {
   DCHECK(lhs->Is(Type::Number()));
   DCHECK(rhs->Is(Type::Number()));
 
-  if (lhs->IsNone() || rhs->IsNone()) return Type::None();
-
   lhs = NumberToInt32(lhs);
   rhs = NumberToInt32(rhs);
 
+  if (lhs->IsNone() || rhs->IsNone()) return Type::None();
+
   double lmin = lhs->Min();
   double rmin = rhs->Min();
   double lmax = lhs->Max();
@@ -847,11 +847,11 @@ Type* OperationTyper::NumberShiftLeft(Type* lhs, Type* rhs) {
   DCHECK(lhs->Is(Type::Number()));
   DCHECK(rhs->Is(Type::Number()));
 
-  if (lhs->IsNone() || rhs->IsNone()) return Type::None();
-
   lhs = NumberToInt32(lhs);
   rhs = NumberToUint32(rhs);
 
+  if (lhs->IsNone() || rhs->IsNone()) return Type::None();
+
   int32_t min_lhs = lhs->Min();
   int32_t max_lhs = lhs->Max();
   uint32_t min_rhs = rhs->Min();
@@ -882,11 +882,11 @@ Type* OperationTyper::NumberShiftRight(Type* lhs, Type* rhs) {
   DCHECK(lhs->Is(Type::Number()));
   DCHECK(rhs->Is(Type::Number()));
 
-  if (lhs->IsNone() || rhs->IsNone()) return Type::None();
-
   lhs = NumberToInt32(lhs);
   rhs = NumberToUint32(rhs);
 
+  if (lhs->IsNone() || rhs->IsNone()) return Type::None();
+
   int32_t min_lhs = lhs->Min();
   int32_t max_lhs = lhs->Max();
   uint32_t min_rhs = rhs->Min();
@@ -907,11 +907,11 @@ Type* OperationTyper::NumberShiftRightLogical(Type* lhs, Type* rhs) {
   DCHECK(lhs->Is(Type::Number()));
   DCHECK(rhs->Is(Type::Number()));
 
-  if (lhs->IsNone() || rhs->IsNone()) return Type::None();
-
   lhs = NumberToUint32(lhs);
   rhs = NumberToUint32(rhs);
 
+  if (lhs->IsNone() || rhs->IsNone()) return Type::None();
+
   uint32_t min_lhs = lhs->Min();
   uint32_t max_lhs = lhs->Max();
   uint32_t min_rhs = rhs->Min();

src/compiler/typer.cc

@@ -481,8 +481,8 @@ Type* Typer::Visitor::ToInteger(Type* type, Typer* t) {
 // static
 Type* Typer::Visitor::ToLength(Type* type, Typer* t) {
   // ES6 section 7.1.15 ToLength ( argument )
-  if (type->IsNone()) return type;
   type = ToInteger(type, t);
+  if (type->IsNone()) return type;
   double min = type->Min();
   double max = type->Max();
   if (max <= 0.0) {

test/mjsunit/compiler/regress-7121.js

+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --harmony-bigint
+
+function foo() { %_ToLength(42n) }
+assertThrows(foo, TypeError);
+%OptimizeFunctionOnNextCall(foo);
+assertThrows(foo, TypeError);