[turbofan] Retype ConvertTaggedHoleToUndefined in representation selection.

Bug: chromium:758983
Change-Id: Iea65c6c6330b4eed0969eee1f8b261e1446771f5
Reviewed-on: https://chromium-review.googlesource.com/640382
Commit-Queue: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47669}

src/compiler/operation-typer.cc

@@ -1055,6 +1055,15 @@ Type* OperationTyper::TypeTypeGuard(const Operator* sigma_op, Type* input) {
   return Type::Intersect(input, TypeGuardTypeOf(sigma_op), zone());
 }
 
+Type* OperationTyper::ConvertTaggedHoleToUndefined(Type* input) {
+  if (input->Maybe(Type::Hole())) {
+    // Turn "the hole" into undefined.
+    Type* type = Type::Intersect(input, Type::NonInternal(), zone());
+    return Type::Union(type, Type::Undefined(), zone());
+  }
+  return input;
+}
+
 }  // namespace compiler
 }  // namespace internal
 }  // namespace v8

src/compiler/operation-typer.h

@@ -51,6 +51,7 @@ class V8_EXPORT_PRIVATE OperationTyper {
   // Check operators.
   Type* CheckFloat64Hole(Type* type);
   Type* CheckNumber(Type* type);
+  Type* ConvertTaggedHoleToUndefined(Type* type);
 
   Type* TypeTypeGuard(const Operator* sigma_op, Type* input);
 

src/compiler/simplified-lowering.cc

@@ -481,6 +481,11 @@ class RepresentationSelector {
         break;
       }
 
+      case IrOpcode::kConvertTaggedHoleToUndefined:
+        new_type = op_typer_.ConvertTaggedHoleToUndefined(
+            FeedbackTypeOf(node->InputAt(0)));
+        break;
+
       case IrOpcode::kTypeGuard: {
         new_type = op_typer_.TypeTypeGuard(node->op(),
                                            FeedbackTypeOf(node->InputAt(0)));

src/compiler/typer.cc

@@ -1909,12 +1909,7 @@ Type* Typer::Visitor::TypeCheckNotTaggedHole(Node* node) {
 
 Type* Typer::Visitor::TypeConvertTaggedHoleToUndefined(Node* node) {
   Type* type = Operand(node, 0);
-  if (type->Maybe(Type::Hole())) {
-    // Turn "the hole" into undefined.
-    type = Type::Intersect(type, Type::NonInternal(), zone());
-    type = Type::Union(type, Type::Undefined(), zone());
-  }
-  return type;
+  return typer_->operation_typer()->ConvertTaggedHoleToUndefined(type);
 }
 
 Type* Typer::Visitor::TypeAllocate(Node* node) {

test/mjsunit/compiler/regress-758983.js

+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+var holey = [ 2.2,,"x" ];
+
+function f(b) {
+  holey[0] = 1.1;
+  var r = holey[0];
+  r = b ? r : 0;
+  return r < 0;
+}
+
+f(true);
+f(true);
+%OptimizeFunctionOnNextCall(f);
+assertFalse(f(true));