[turbofan] Relax index type constraints for StringCharAt/StringCharCodeAt.

Also support inlining the builtins String.prototype.charCodeAt and
String.prototype.charAt if the index type is not statically known
to be in the Unsigned32 range, but in anything in Integral32 plus
minus zero and NaN.

R=yangguo@chromium.org

Review-Url: https://codereview.chromium.org/2597913002
Cr-Commit-Position: refs/heads/master@{#41913}

src/compiler/js-builtin-reducer.cc

@@ -1522,8 +1522,17 @@ Reduction JSBuiltinReducer::ReduceStringCharAt(Node* node) {
     Node* effect = NodeProperties::GetEffectInput(node);
     Node* control = NodeProperties::GetControlInput(node);
 
-    if (index_type->Is(Type::Unsigned32())) {
+    if (index_type->Is(Type::Integral32OrMinusZeroOrNaN())) {
       if (Node* receiver = GetStringWitness(node)) {
+        if (!index_type->Is(Type::Unsigned32())) {
+          // Map -0 and NaN to 0 (as per ToInteger), and the values in
+          // the [-2^31,-1] range to the [2^31,2^32-1] range, which will
+          // be considered out-of-bounds as well, because of the maximal
+          // String length limit in V8.
+          STATIC_ASSERT(String::kMaxLength <= kMaxInt);
+          index = graph()->NewNode(simplified()->NumberToUint32(), index);
+        }
+
         // Determine the {receiver} length.
         Node* receiver_length = effect = graph()->NewNode(
             simplified()->LoadField(AccessBuilder::ForStringLength()), receiver,
@@ -1567,8 +1576,17 @@ Reduction JSBuiltinReducer::ReduceStringCharCodeAt(Node* node) {
     Node* effect = NodeProperties::GetEffectInput(node);
     Node* control = NodeProperties::GetControlInput(node);
 
-    if (index_type->Is(Type::Unsigned32())) {
+    if (index_type->Is(Type::Integral32OrMinusZeroOrNaN())) {
       if (Node* receiver = GetStringWitness(node)) {
+        if (!index_type->Is(Type::Unsigned32())) {
+          // Map -0 and NaN to 0 (as per ToInteger), and the values in
+          // the [-2^31,-1] range to the [2^31,2^32-1] range, which will
+          // be considered out-of-bounds as well, because of the maximal
+          // String length limit in V8.
+          STATIC_ASSERT(String::kMaxLength <= kMaxInt);
+          index = graph()->NewNode(simplified()->NumberToUint32(), index);
+        }
+
         // Determine the {receiver} length.
         Node* receiver_length = effect = graph()->NewNode(
             simplified()->LoadField(AccessBuilder::ForStringLength()), receiver,

src/compiler/types.h

@@ -139,6 +139,7 @@ namespace compiler {
   V(Unsigned32OrMinusZero,      kUnsigned32 | kMinusZero) \
   V(Unsigned32OrMinusZeroOrNaN, kUnsigned32 | kMinusZero | kNaN) \
   V(Integral32,                 kSigned32 | kUnsigned32) \
+  V(Integral32OrMinusZeroOrNaN, kIntegral32 | kMinusZero | kNaN) \
   V(PlainNumber,                kIntegral32 | kOtherNumber) \
   V(OrderedNumber,              kPlainNumber | kMinusZero) \
   V(MinusZeroOrNaN,             kMinusZero | kNaN) \