Fix type feedback recording in CodeStubAssembler::Equal.

R=bmeurer@chromium.org, jarin@chromium.org

Bug: v8:6941
Change-Id: Ic1062e1c5f181ab5041fb7b7cb1487683a36c300
Reviewed-on: https://chromium-review.googlesource.com/721020
Commit-Queue: Georg Neis <neis@chromium.org>
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#48599}

src/code-stub-assembler.cc

@@ -8652,7 +8652,7 @@ Node* CodeStubAssembler::Equal(Node* lhs, Node* rhs, Node* context,
             BIND(&if_rhsisnotreceiver);
             {
               // The {rhs} is not a JSReceiver and also not the same Symbol
-              // as the {lhs}, so this is equality check is considered false.
+              // as the {lhs}, so this equality check is considered false.
               if (var_type_feedback != nullptr) {
                 Label if_rhsissymbol(this), if_rhsisnotsymbol(this);
                 Branch(IsSymbolInstanceType(rhs_instance_type), &if_rhsissymbol,
@@ -8660,7 +8660,8 @@ Node* CodeStubAssembler::Equal(Node* lhs, Node* rhs, Node* context,
 
                 BIND(&if_rhsissymbol);
                 {
-                  var_type_feedback->Bind(
+                  CombineFeedback(
+                      var_type_feedback,
                       SmiConstant(CompareOperationFeedback::kSymbol));
                   Goto(&if_notequal);
                 }

test/mjsunit/regress/regress-6941.js

+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --opt
+
+function foo(x) {
+  return Symbol.iterator == x;
+}
+
+function main() {
+  foo(Symbol());
+  foo({valueOf() { return Symbol.toPrimitive}});
+}
+
+%NeverOptimizeFunction(main);
+main();
+%OptimizeFunctionOnNextCall(foo);
+main();
+assertOptimized(foo);