[turbofan] escape analysis: fix typing of new phi nodes

Bug: chromium:744584
Change-Id: Ie25c2ba63e4764f359de38e53c2f3f3222877e0e
Reviewed-on: https://chromium-review.googlesource.com/577690Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46792}

src/compiler/escape-analysis.cc

@@ -438,19 +438,16 @@ bool VirtualObject::MergeFields(size_t i, Node* at, MergeCache* cache,
   int value_input_count = static_cast<int>(cache->fields().size());
   Node* rep = GetField(i);
   if (!rep || !IsCreatedPhi(i)) {
-    Type* phi_type = Type::None();
     for (Node* input : cache->fields()) {
       CHECK_NOT_NULL(input);
       CHECK(!input->IsDead());
-      Type* input_type = NodeProperties::GetType(input);
-      phi_type = Type::Union(phi_type, input_type, graph->zone());
     }
     Node* control = NodeProperties::GetControlInput(at);
     cache->fields().push_back(control);
     Node* phi = graph->NewNode(
         common->Phi(MachineRepresentation::kTagged, value_input_count),
         value_input_count + 1, &cache->fields().front());
-    NodeProperties::SetType(phi, phi_type);
+    NodeProperties::SetType(phi, Type::Any());
     SetField(i, phi, true);
 
 #ifdef DEBUG

test/mjsunit/compiler/escape-analysis-phi-type-2.js

+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --turbo-escape
+
+function f(x) {
+  var o = {a : 0, b: 0};
+  if (x == 0) {
+    o.a = 1
+  } else {
+    if (x <= 1) {
+      if (x == 2) {
+        o.a = 2;
+      } else {
+        o.a = 1
+      }
+      o.a = 2;
+    } else {
+      if (x == 2) {
+        o.a = "x";
+      } else {
+        o.a = "x";
+      }
+      o.b = 22;
+    }
+    o.b = 22;
+  }
+  return o.a + 1;
+}
+
+f(0,0);
+f(1,0);
+f(2,0);
+f(3,0);
+f(0,1);
+f(1,1);
+f(2,1);
+f(3,1);
+%OptimizeFunctionOnNextCall(f);
+assertEquals(f(2), "x1");

test/mjsunit/compiler/escape-analysis-phi-type.js

+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --turbo-escape --turbo-experimental --no-turbo-loop-peeling
+
+function f(x) {
+  var o = {a : 0};
+  var l = [1,2,3,4];
+  var res;
+  for (var i = 0; i < 3; ++i) {
+    if (x%2 == 0) { o.a = 1; b = false}
+    res = l[o.a];
+    o.a = x;
+  }
+  return res;
+}
+
+f(0);
+f(1);
+f(0);
+f(1);
+%OptimizeFunctionOnNextCall(f);
+assertEquals(undefined, f(101));