[turbofan] Fix Math.expm1 builtin typing.

This fixes the typing for the case when the call is not lowered to
the simplified operator.

Bug: chromium:880207
Change-Id: Icecf12de77ece0fe9ffec2777874f5f0004a1e97
Reviewed-on: https://chromium-review.googlesource.com/c/1278642
Commit-Queue: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#56621}

src/compiler/typer.cc

@@ -1437,7 +1437,6 @@ Type Typer::Visitor::JSCallTyper(Type fun, Typer* t) {
     // Unary math functions.
     case BuiltinFunctionId::kMathAbs:
     case BuiltinFunctionId::kMathExp:
-    case BuiltinFunctionId::kMathExpm1:
       return Type::Union(Type::PlainNumber(), Type::NaN(), t->zone());
     case BuiltinFunctionId::kMathAcos:
     case BuiltinFunctionId::kMathAcosh:
@@ -1447,6 +1446,7 @@ Type Typer::Visitor::JSCallTyper(Type fun, Typer* t) {
     case BuiltinFunctionId::kMathAtanh:
     case BuiltinFunctionId::kMathCbrt:
     case BuiltinFunctionId::kMathCos:
+    case BuiltinFunctionId::kMathExpm1:
     case BuiltinFunctionId::kMathFround:
     case BuiltinFunctionId::kMathLog:
     case BuiltinFunctionId::kMathLog1p:

test/mjsunit/regress/regress-crbug-880207.js

@@ -4,10 +4,34 @@
 
 // Flags: --allow-natives-syntax
 
-function foo() {
+(function TestOptimizedFastExpm1MinusZero() {
+  function foo() {
     return Object.is(Math.expm1(-0), -0);
-}
+  }
 
-assertTrue(foo());
-%OptimizeFunctionOnNextCall(foo);
-assertTrue(foo());
+  assertTrue(foo());
+  %OptimizeFunctionOnNextCall(foo);
+  assertTrue(foo());
+})();
+
+(function TestOptimizedExpm1MinusZeroSlowPath() {
+  function f(x) {
+    return Object.is(Math.expm1(x), -0);
+  }
+
+  function g() {
+    return f(-0);
+  }
+
+  f(0);
+  // Compile function optimistically for numbers (with fast inlined
+  // path for Math.expm1).
+  %OptimizeFunctionOnNextCall(f);
+  // Invalidate the optimistic assumption, deopting and marking non-number
+  // input feedback in the call IC.
+  f("0");
+  // Optimize again, now with non-lowered call to Math.expm1.
+  assertTrue(g());
+  %OptimizeFunctionOnNextCall(g);
+  assertTrue(g());
+})();