[turbofan] Properly re-type CheckBounds.

The CheckBounds operator was missing from the re-typing phase during
representation selection, meaning that even if better type information
was available on the inputs (i.e. due to taking feedback), this new
type information was not propagated through CheckBounds properly.

Bug: v8:8015
Change-Id: I503555e041c9fa2b9b27a28d223202d17b27a92e
Reviewed-on: https://chromium-review.googlesource.com/1212963Reviewed-by: Georg Neis <neis@chromium.org>
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#55706}

src/compiler/operation-typer.cc

@@ -1175,6 +1175,19 @@ Type OperationTyper::StrictEqual(Type lhs, Type rhs) {
   return Type::Boolean();
 }
 
+Type OperationTyper::CheckBounds(Type index, Type length) {
+  DCHECK(length.Is(Type::Unsigned31()));
+  if (index.Maybe(Type::MinusZero())) {
+    index = Type::Union(index, cache_.kSingletonZero, zone());
+  }
+  index = Type::Intersect(index, Type::Integral32(), zone());
+  if (index.IsNone() || length.IsNone()) return Type::None();
+  double min = std::max(index.Min(), 0.0);
+  double max = std::min(index.Max(), length.Max() - 1);
+  if (max < min) return Type::None();
+  return Type::Range(min, max, zone());
+}
+
 Type OperationTyper::CheckFloat64Hole(Type type) {
   if (type.Maybe(Type::Hole())) {
     // Turn "the hole" into undefined.

src/compiler/operation-typer.h

@@ -58,6 +58,7 @@ class V8_EXPORT_PRIVATE OperationTyper {
   Type StrictEqual(Type lhs, Type rhs);
 
   // Check operators.
+  Type CheckBounds(Type index, Type length);
   Type CheckFloat64Hole(Type type);
   Type CheckNumber(Type type);
   Type ConvertTaggedHoleToUndefined(Type type);

src/compiler/simplified-lowering.cc

@@ -478,6 +478,13 @@ class RepresentationSelector {
         new_type = op_typer_.ToNumber(FeedbackTypeOf(node->InputAt(0)));
         break;
 
+      case IrOpcode::kCheckBounds:
+        new_type = Type::Intersect(
+            op_typer_.CheckBounds(FeedbackTypeOf(node->InputAt(0)),
+                                  FeedbackTypeOf(node->InputAt(1))),
+            info->restriction_type(), graph_zone());
+        break;
+
       case IrOpcode::kCheckFloat64Hole:
         new_type = Type::Intersect(
             op_typer_.CheckFloat64Hole(FeedbackTypeOf(node->InputAt(0))),

src/compiler/typer.cc

@@ -1952,18 +1952,8 @@ Type Typer::Visitor::TypePoisonIndex(Node* node) {
 }
 
 Type Typer::Visitor::TypeCheckBounds(Node* node) {
-  Type index = Operand(node, 0);
-  Type length = Operand(node, 1);
-  DCHECK(length.Is(Type::Unsigned31()));
-  if (index.Maybe(Type::MinusZero())) {
-    index = Type::Union(index, typer_->cache_.kSingletonZero, zone());
-  }
-  index = Type::Intersect(index, Type::Integral32(), zone());
-  if (index.IsNone() || length.IsNone()) return Type::None();
-  double min = std::max(index.Min(), 0.0);
-  double max = std::min(index.Max(), length.Max() - 1);
-  if (max < min) return Type::None();
-  return Type::Range(min, max, zone());
+  return typer_->operation_typer_.CheckBounds(Operand(node, 0),
+                                              Operand(node, 1));
 }
 
 Type Typer::Visitor::TypeCheckHeapObject(Node* node) {