Reland "[turbofan] Support Phi nodes in SL Verifier"

This reverts commit 82a876b0.

Bug: v8:13086, v8:12619
Change-Id: Idcc42f36b642fefb3ed706214e7385cccc89effc
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3779687
Auto-Submit: Nico Hartmann <nicohartmann@chromium.org>
Commit-Queue: Nico Hartmann <nicohartmann@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/main@{#82285}

src/compiler/js-typed-lowering.cc

@@ -1124,7 +1124,8 @@ Reduction JSTypedLowering::ReduceJSToObject(Node* node) {
 
   Node* if_true = graph()->NewNode(common()->IfTrue(), branch);
   Node* etrue = effect;
-  Node* rtrue = receiver;
+  Node* rtrue = etrue = graph()->NewNode(common()->TypeGuard(Type::Receiver()),
+                                         receiver, etrue, if_true);
 
   Node* if_false = graph()->NewNode(common()->IfFalse(), branch);
   Node* efalse = effect;
@@ -1140,6 +1141,8 @@ Reduction JSTypedLowering::ReduceJSToObject(Node* node) {
         graph()->NewNode(common()->Call(call_descriptor),
                          jsgraph()->HeapConstant(callable.code()), receiver,
                          context, frame_state, efalse, if_false);
+    // Preserve the type inferred by the typer.
+    NodeProperties::SetType(rfalse, NodeProperties::GetType(node));
   }
 
   // Update potential {IfException} uses of {node} to point to the above
@@ -1219,7 +1222,11 @@ Reduction JSTypedLowering::ReduceJSHasInPrototypeChain(Node* node) {
   NodeProperties::MergeControlToEnd(graph(), common(), terminate);
   Node* vloop = value = graph()->NewNode(
       common()->Phi(MachineRepresentation::kTagged, 2), value, value, loop);
-  NodeProperties::SetType(vloop, Type::NonInternal());
+  // Typer might put a type on the above Phi node. We reset that to Type::Any
+  // and provide the type using a TypeGuard to enforce a consistent typing.
+  NodeProperties::SetType(value, Type::Any());
+  effect = value = graph()->NewNode(common()->TypeGuard(Type::NonInternal()),
+                                    value, effect, control);
 
   // Load the {value} map and instance type.
   Node* value_map = effect = graph()->NewNode(

src/compiler/simplified-lowering-verifier.cc

@@ -334,6 +334,19 @@ void SimplifiedLoweringVerifier::VisitNode(Node* node,
       SetTruncation(node, Truncation::Any());
       break;
     }
+    case IrOpcode::kPhi: {
+      const int arity = node->op()->ValueInputCount();
+      Type output_type = InputType(node, 0);
+      Truncation output_trunc = InputTruncation(node, 0);
+      for (int i = 1; i < arity; ++i) {
+        output_type =
+            Type::Union(output_type, InputType(node, i), graph_zone());
+        output_trunc =
+            LeastGeneralTruncation(output_trunc, InputTruncation(node, i));
+      }
+      CheckAndSet(node, output_type, output_trunc);
+      break;
+    }
 
 #define CASE(code, ...) case IrOpcode::k##code:
       // Control operators
@@ -363,7 +376,6 @@ void SimplifiedLoweringVerifier::VisitNode(Node* node,
       CASE(RelocatableInt64Constant)
       // Inner operators
       CASE(Select)
-      CASE(Phi)
       CASE(InductionVariablePhi)
       CASE(BeginRegion)
       CASE(FinishRegion)