[turbofan] teach escape analysis about oddly occurring NumberLessThan node

Bug: chromium:733181
Change-Id: If5b0bc8592ba71962237814ad521499afda22edf
Reviewed-on: https://chromium-review.googlesource.com/538653Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45977}

src/compiler/escape-analysis.cc

@@ -846,6 +846,9 @@ bool EscapeStatusAnalysis::CheckUsesForEscape(Node* uses, Node* rep,
       case IrOpcode::kObjectIsString:
       case IrOpcode::kObjectIsSymbol:
       case IrOpcode::kObjectIsUndetectable:
+      case IrOpcode::kNumberLessThan:
+      case IrOpcode::kNumberLessThanOrEqual:
+      case IrOpcode::kNumberEqual:
 #define CASE(opcode) case IrOpcode::k##opcode:
         SIMPLIFIED_NUMBER_BINOP_LIST(CASE)
         SIMPLIFIED_NUMBER_UNOP_LIST(CASE)

test/mjsunit/compiler/escape-analysis-17.js

@@ -7,13 +7,16 @@
 function foo() {
   var a = {x:1};
   var b = {x:1.5, y: 1};
-  var x;
+  var x = 0;
   for (var i = 0; i < 1; i = {}) {
     // The second iteration of this loop is dead code, leading to a
     // contradiction between dynamic and static information.
-    x = a.x + 0.5;
-    x = a.x % 0.5;
-    x = Math.abs(a.x);
+    x += a.x + 0.5;
+    x += a.x % 0.5;
+    x += Math.abs(a.x);
+    x += a.x < 6;
+    x += a.x === 7;
+    x += a.x <= 8;
     a = b;
   }
   return x;