Fixpoint typing has to consider all imprecise nodes

R=jarin@chromium.org
BUG=

Review URL: https://codereview.chromium.org/568743003

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@23931 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

src/compiler/typer.cc

@@ -119,19 +119,27 @@ class Typer::RunVisitor : public Typer::Visitor {
  public:
   RunVisitor(Typer* typer, MaybeHandle<Context> context)
       : Visitor(typer, context),
-        phis(NodeSet::key_compare(), NodeSet::allocator_type(typer->zone())) {}
+        redo(NodeSet::key_compare(), NodeSet::allocator_type(typer->zone())) {}
 
   GenericGraphVisit::Control Post(Node* node) {
     if (OperatorProperties::HasValueOutput(node->op())) {
       Bounds bounds = TypeNode(node);
       NodeProperties::SetBounds(node, bounds);
-      // Remember phis for least fixpoint iteration.
-      if (node->opcode() == IrOpcode::kPhi) phis.insert(node);
+      // Remember incompletely typed nodes for least fixpoint iteration.
+      int arity = OperatorProperties::GetValueInputCount(node->op());
+      for (int i = 0; i < arity; ++i) {
+        // TODO(rossberg): change once IsTyped is available.
+        // if (!NodeProperties::IsTyped(NodeProperties::GetValueInput(node, i))) {
+        if (OperandType(node, i).upper->Is(Type::None())) {
+          redo.insert(node);
+          break;
+        }
+      }
     }
     return GenericGraphVisit::CONTINUE;
   }
 
-  NodeSet phis;
+  NodeSet redo;
 };
 
 
@@ -190,7 +198,7 @@ void Typer::Run(Graph* graph, MaybeHandle<Context> context) {
   RunVisitor typing(this, context);
   graph->VisitNodeInputsFromEnd(&typing);
   // Find least fixpoint.
-  for (NodeSetIter i = typing.phis.begin(); i != typing.phis.end(); ++i) {
+  for (NodeSetIter i = typing.redo.begin(); i != typing.redo.end(); ++i) {
     Widen(graph, *i, context);
   }
 }

test/cctest/cctest.status

@@ -98,36 +98,6 @@
   'test-run-inlining/InlineTwiceDependentDiamond': [SKIP],
   'test-run-inlining/InlineTwiceDependentDiamondDifferent': [SKIP],
 
-  # TODO(mstarzinger): Causes crash in generated code, needs investigation.
-  'test-api/FixedUint8Array': [PASS, NO_VARIANTS],
-  'test-api/FixedUint8ClampedArray': [PASS, NO_VARIANTS],
-  'test-api/FixedInt8Array': [PASS, NO_VARIANTS],
-  'test-api/FixedUint16Array': [PASS, NO_VARIANTS],
-  'test-api/FixedInt16Array': [PASS, NO_VARIANTS],
-  'test-api/FixedUint32Array': [PASS, NO_VARIANTS],
-  'test-api/FixedInt32Array': [PASS, NO_VARIANTS],
-  'test-api/FixedFloat32Array': [PASS, NO_VARIANTS],
-  'test-api/FixedFloat64Array': [PASS, NO_VARIANTS],
-  'test-api/ExternalInt8Array': [PASS, NO_VARIANTS],
-  'test-api/ExternalUint8Array': [PASS, NO_VARIANTS],
-  'test-api/ExternalUint8ClampedArray': [PASS, NO_VARIANTS],
-  'test-api/ExternalInt16Array': [PASS, NO_VARIANTS],
-  'test-api/ExternalUint32Array': [PASS, NO_VARIANTS],
-  'test-api/ExternalUint16Array': [PASS, NO_VARIANTS],
-  'test-api/ExternalInt32Array': [PASS, NO_VARIANTS],
-  'test-api/ExternalFloat32Array': [PASS, NO_VARIANTS],
-  'test-api/ExternalArrays': [PASS, NO_VARIANTS],
-  'test-api/ExternalFloat64Array': [PASS, NO_VARIANTS],
-  'test-api/Uint8Array': [PASS, NO_VARIANTS],
-  'test-api/Int8Array': [PASS, NO_VARIANTS],
-  'test-api/Uint16Array': [PASS, NO_VARIANTS],
-  'test-api/Int16Array': [PASS, NO_VARIANTS],
-  'test-api/Uint32Array': [PASS, NO_VARIANTS],
-  'test-api/Int32Array': [PASS, NO_VARIANTS],
-  'test-api/Float64Array': [PASS, NO_VARIANTS],
-  'test-api/Float32Array': [PASS, NO_VARIANTS],
-  'test-api/Uint8ClampedArray': [PASS, NO_VARIANTS],
-
   # Some tests are just too slow to run for now.
   'test-api/Threading*': [PASS, NO_VARIANTS],
   'test-heap/IncrementalMarkingStepMakesBigProgressWithLargeObjects': [PASS, NO_VARIANTS],

test/mjsunit/mjsunit.status

@@ -67,10 +67,6 @@
   'debug-references': [PASS, NO_VARIANTS],
   'regress/regress-263': [PASS, NO_VARIANTS],
 
-  # TODO(mstarzinger): Causes crash in generated code, needs investigation.
-  'array-sort': [PASS, NO_VARIANTS],
-  'dehoisted-array-index': [PASS, NO_VARIANTS],
-
   # TODO(mstarzinger/rossberg): Typer doesn't like contexts very much.
   'harmony/block-conflicts': [PASS, NO_VARIANTS],
   'harmony/block-for': [PASS, NO_VARIANTS],
@@ -83,7 +79,6 @@
   'string-oom-concat': [PASS, NO_VARIANTS],
   'unbox-double-arrays': [PASS, NO_VARIANTS],
   'compiler/osr-warm': [PASS, NO_VARIANTS],
-  'compiler/regress-3136962': [PASS, NO_VARIANTS],
   'harmony/proxies-json': [PASS, NO_VARIANTS],
   'regress/regress-760-1': [PASS, NO_VARIANTS],
   'regress/regress-760-2': [PASS, NO_VARIANTS],

test/webkit/webkit.status

@@ -37,11 +37,6 @@
   'exception-with-handler-inside-eval-with-dynamic-scope': [PASS, NO_VARIANTS],
   # TODO(turbofan): We run out of stack earlier on 64-bit for now.
   'fast/js/deep-recursion-test': [PASS, NO_VARIANTS],
-  # TODO(mstarzinger): Causes crash in generated code, needs investigation.
-  'dfg-arguments-osr-exit': [PASS, NO_VARIANTS],
-  'dfg-arguments-osr-exit-multiple-blocks': [PASS, NO_VARIANTS],
-  'dfg-arguments-osr-exit-multiple-blocks-before-exit': [PASS, NO_VARIANTS],
-  'dfg-arguments-unexpected-escape': [PASS, NO_VARIANTS],
   # TODO(bmeurer,svenpanne): Investigate test failure.
   'fast/js/toString-number': [SKIP],
 }],  # ALWAYS