[turbofan] Make sure value numbering only narrows types.

Review-Url: https://codereview.chromium.org/2145683004
Cr-Commit-Position: refs/heads/master@{#37745}

src/compiler/pipeline.cc

@@ -898,7 +898,7 @@ struct TypedLoweringPhase {
         data->info()->is_deoptimization_enabled()
             ? JSIntrinsicLowering::kDeoptimizationEnabled
             : JSIntrinsicLowering::kDeoptimizationDisabled);
-    ValueNumberingReducer value_numbering(temp_zone);
+    ValueNumberingReducer value_numbering(temp_zone, data->graph()->zone());
     SimplifiedOperatorReducer simple_reducer(&graph_reducer, data->jsgraph());
     CheckpointElimination checkpoint_elimination(&graph_reducer);
     CommonOperatorReducer common_reducer(&graph_reducer, data->graph(),
@@ -955,7 +955,7 @@ struct EarlyOptimizationPhase {
                                               data->common());
     SimplifiedOperatorReducer simple_reducer(&graph_reducer, data->jsgraph());
     RedundancyElimination redundancy_elimination(&graph_reducer, temp_zone);
-    ValueNumberingReducer value_numbering(temp_zone);
+    ValueNumberingReducer value_numbering(temp_zone, data->graph()->zone());
     MachineOperatorReducer machine_reducer(data->jsgraph());
     CommonOperatorReducer common_reducer(&graph_reducer, data->graph(),
                                          data->common(), data->machine());
@@ -1061,7 +1061,7 @@ struct LateOptimizationPhase {
                                                    data->jsgraph(), temp_zone);
     DeadCodeElimination dead_code_elimination(&graph_reducer, data->graph(),
                                               data->common());
-    ValueNumberingReducer value_numbering(temp_zone);
+    ValueNumberingReducer value_numbering(temp_zone, data->graph()->zone());
     MachineOperatorReducer machine_reducer(data->jsgraph());
     CommonOperatorReducer common_reducer(&graph_reducer, data->graph(),
                                          data->common(), data->machine());

src/compiler/value-numbering-reducer.cc

@@ -7,6 +7,7 @@
 #include <cstring>
 
 #include "src/base/functional.h"
+#include "src/compiler/node-properties.h"
 #include "src/compiler/node.h"
 
 namespace v8 {
@@ -41,10 +42,12 @@ bool Equals(Node* a, Node* b) {
 
 }  // namespace
 
-
-ValueNumberingReducer::ValueNumberingReducer(Zone* zone)
-    : entries_(nullptr), capacity_(0), size_(0), zone_(zone) {}
-
+ValueNumberingReducer::ValueNumberingReducer(Zone* temp_zone, Zone* graph_zone)
+    : entries_(nullptr),
+      capacity_(0),
+      size_(0),
+      temp_zone_(temp_zone),
+      graph_zone_(graph_zone) {}
 
 ValueNumberingReducer::~ValueNumberingReducer() {}
 
@@ -58,7 +61,7 @@ Reduction ValueNumberingReducer::Reduce(Node* node) {
     DCHECK(capacity_ == 0);
     // Allocate the initial entries and insert the first entry.
     capacity_ = kInitialCapacity;
-    entries_ = zone()->NewArray<Node*>(kInitialCapacity);
+    entries_ = temp_zone()->NewArray<Node*>(kInitialCapacity);
     memset(entries_, 0, sizeof(*entries_) * kInitialCapacity);
     entries_[hash & (kInitialCapacity - 1)] = node;
     size_ = 1;
@@ -123,6 +126,16 @@ Reduction ValueNumberingReducer::Reduce(Node* node) {
       continue;
     }
     if (Equals(entry, node)) {
+      // Make sure the replacement has at least as good type as the original
+      // node.
+      if (NodeProperties::IsTyped(entry) && NodeProperties::IsTyped(node)) {
+        Type* entry_type = NodeProperties::GetType(entry);
+        Type* node_type = NodeProperties::GetType(node);
+        if (!entry_type->Is(node_type)) {
+          NodeProperties::SetType(
+              entry, Type::Intersect(entry_type, node_type, graph_zone()));
+        }
+      }
       return Replace(entry);
     }
   }
@@ -135,7 +148,7 @@ void ValueNumberingReducer::Grow() {
   Node** const old_entries = entries_;
   size_t const old_capacity = capacity_;
   capacity_ *= kCapacityToSizeRatio;
-  entries_ = zone()->NewArray<Node*>(capacity_);
+  entries_ = temp_zone()->NewArray<Node*>(capacity_);
   memset(entries_, 0, sizeof(*entries_) * capacity_);
   size_ = 0;
   size_t const mask = capacity_ - 1;

src/compiler/value-numbering-reducer.h

@@ -13,7 +13,7 @@ namespace compiler {
 
 class ValueNumberingReducer final : public Reducer {
  public:
-  explicit ValueNumberingReducer(Zone* zone);
+  explicit ValueNumberingReducer(Zone* temp_zone, Zone* graph_zone);
   ~ValueNumberingReducer();
 
   Reduction Reduce(Node* node) override;
@@ -22,12 +22,14 @@ class ValueNumberingReducer final : public Reducer {
   enum { kInitialCapacity = 256u, kCapacityToSizeRatio = 2u };
 
   void Grow();
-  Zone* zone() const { return zone_; }
+  Zone* temp_zone() const { return temp_zone_; }
+  Zone* graph_zone() const { return graph_zone_; }
 
   Node** entries_;
   size_t capacity_;
   size_t size_;
-  Zone* zone_;
+  Zone* temp_zone_;
+  Zone* graph_zone_;
 };
 
 }  // namespace compiler

test/unittests/compiler/value-numbering-reducer-unittest.cc

@@ -28,7 +28,8 @@ static const TestOperator kOp1(1, Operator::kIdempotent, 1, 1);
 
 class ValueNumberingReducerTest : public TestWithZone {
  public:
-  ValueNumberingReducerTest() : graph_(zone()), reducer_(zone()) {}
+  ValueNumberingReducerTest()
+      : graph_(zone()), reducer_(zone(), graph()->zone()) {}
 
  protected:
   Reduction Reduce(Node* node) { return reducer_.Reduce(node); }