[turbofan] Don't propagate truncations if output is tagged.

Disable the propagation of truncations through Phi, Select or TypeGuard
if the output representation is tagged, because when the truncations are
taken we don't necessarily reflect this in the types and therefore we
might end up in a situation where we produce a word32 value, the type
says Number, and now we need to change that to tagged, which is not
possible since we don't know how to interpret the bits, i.e. whether the
value is Signed32 or Unsigned32.

BUG=chromium:644048

Review-Url: https://codereview.chromium.org/2311903002
Cr-Commit-Position: refs/heads/master@{#39186}

src/compiler/simplified-lowering.cc

@@ -912,6 +912,9 @@ class RepresentationSelector {
     }
     // Convert inputs to the output representation of this phi, pass the
     // truncation truncation along.
+    if (output == MachineRepresentation::kTagged) {
+      truncation = Truncation::Any();
+    }
     UseInfo input_use(output, truncation);
     ProcessInput(node, 1, input_use);
     ProcessInput(node, 2, input_use);
@@ -936,6 +939,9 @@ class RepresentationSelector {
 
     // Convert inputs to the output representation of this phi, pass the
     // truncation along.
+    if (output == MachineRepresentation::kTagged) {
+      truncation = Truncation::Any();
+    }
     UseInfo input_use(output, truncation);
     for (int i = 0; i < node->InputCount(); i++) {
       ProcessInput(node, i, i < values ? input_use : UseInfo::None());
@@ -2415,6 +2421,9 @@ class RepresentationSelector {
         MachineRepresentation output =
             GetOutputInfoForPhi(node, TypeOf(node->InputAt(0)), truncation);
 
+        if (output == MachineRepresentation::kTagged) {
+          truncation = Truncation::Any();
+        }
         VisitUnop(node, UseInfo(output, truncation), output);
         if (lower()) DeferReplacement(node, node->InputAt(0));
         return;

test/mjsunit/compiler/regress-644048.js

+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function foo(x) {
+  (x
+      ? (!0 / 0)
+         : x) | 0
+}
+
+foo(1);
+foo(2);
+%OptimizeFunctionOnNextCall(foo);
+foo(3);