[compiler] Add simple mjsunit test using %VerifyType

Also make the output more helpful in the error case.

Bug: v8:11724
Change-Id: Ibb8bd328f936f3d4f847ba7e14adf9c30b9460f0
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2903158
Auto-Submit: Georg Neis <neis@chromium.org>
Commit-Queue: Nico Hartmann <nicohartmann@chromium.org>
Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74691}

src/compiler/simplified-lowering.cc

@@ -3943,10 +3943,15 @@ class RepresentationSelector {
         VisitUnop<T>(node, UseInfo::AnyTagged(), MachineRepresentation::kTagged,
                      inputType);
         if (lower<T>()) {
-          CHECK_IMPLIES(!FLAG_fuzzing, inputType.CanBeAsserted());
           if (inputType.CanBeAsserted()) {
             ChangeOp(node, simplified()->AssertType(inputType));
           } else {
+            if (!FLAG_fuzzing) {
+#ifdef DEBUG
+              inputType.Print();
+#endif
+              FATAL("%%VerifyType: unsupported type");
+            }
             DeferReplacement(node, node->InputAt(0));
           }
         }

test/mjsunit/compiler/verify-type.js

+// Copyright 2021 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax  --no-stress-opt
+
+function foo(x) {
+  return %VerifyType(x * x);
+}
+
+%PrepareFunctionForOptimization(foo);
+foo(42);
+%OptimizeFunctionOnNextCall(foo);
+foo(42);