[turbofan] Fixes Array constructor with single string argument

Bug: chromium:1034449
Change-Id: Id121b60af0c8c8621464f15aa754056cecb04595
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2064985
Commit-Queue: Nico Hartmann <nicohartmann@chromium.org>
Reviewed-by: Sathya Gunasekaran  <gsathya@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#66386}

src/compiler/js-create-lowering.cc

@@ -471,6 +471,12 @@ Reduction JSCreateLowering::ReduceNewArray(
       initial_map,
       initial_map.AsElementsKind(GetHoleyElementsKind(elements_kind)));
 
+  // Because CheckBounds performs implicit conversion from string to number, an
+  // additional CheckNumber is required to behave correctly for calls with a
+  // single string argument.
+  length = effect = graph()->NewNode(
+      simplified()->CheckNumber(FeedbackSource{}), length, effect, control);
+
   // Check that the {limit} is an unsigned integer in the valid range.
   // This has to be kept in sync with src/runtime/runtime-array.cc,
   // where this limit is protected.
@@ -512,6 +518,7 @@ Reduction JSCreateLowering::ReduceNewArray(
     const SlackTrackingPrediction& slack_tracking_prediction) {
   DCHECK(node->opcode() == IrOpcode::kJSCreateArray ||
          node->opcode() == IrOpcode::kJSCreateEmptyLiteralArray);
+  DCHECK(NodeProperties::GetType(length).Is(Type::Number()));
   Node* effect = NodeProperties::GetEffectInput(node);
   Node* control = NodeProperties::GetControlInput(node);
 

test/mjsunit/regress/regress-1034449.js

+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --opt --no-always-opt
+
+function f(len) {
+  return new Array(len);
+}
+
+%PrepareFunctionForOptimization(f);
+assertEquals(3, f(3).length);
+assertEquals(18, f(18).length);
+%OptimizeFunctionOnNextCall(f);
+assertEquals(4, f(4).length);
+assertOptimized(f);
+let a = f("8");
+assertUnoptimized(f);
+assertEquals(1, a.length);
+assertEquals("8", a[0]);
+
+// Check there is no deopt loop.
+%PrepareFunctionForOptimization(f);
+assertEquals(1, f(1).length);
+%OptimizeFunctionOnNextCall(f);
+assertEquals(8, f(8).length);
+assertOptimized(f);
+assertEquals(1, f("8").length);
+assertOptimized(f);