[turbofan] Fix invalid representation selection for Phis/Selects.

We cannot just blindly make a representation selection for Phi or Select
based on the truncations, but we also need to consider the type of the
inputs (or actually of the Phi/Select node itself). We can only use
Word32 representation based on Word32 truncation if the inputs are
Number or Oddball, same for Float64.

R=epertoso@chromium.org
BUG=v8:5255

Review-Url: https://codereview.chromium.org/2206553002
Cr-Commit-Position: refs/heads/master@{#38241}

src/compiler/simplified-lowering.cc

@@ -839,11 +839,11 @@ class RepresentationSelector {
       return MachineRepresentation::kNone;
     } else if (type->Is(Type::Signed32()) || type->Is(Type::Unsigned32())) {
       return MachineRepresentation::kWord32;
-    } else if (use.IsUsedAsWord32()) {
+    } else if (type->Is(Type::NumberOrOddball()) && use.IsUsedAsWord32()) {
       return MachineRepresentation::kWord32;
     } else if (type->Is(Type::Boolean())) {
       return MachineRepresentation::kBit;
-    } else if (use.IsUsedAsFloat64()) {
+    } else if (type->Is(Type::NumberOrOddball()) && use.IsUsedAsFloat64()) {
       return MachineRepresentation::kFloat64;
     } else if (type->Is(
                    Type::Union(Type::SignedSmall(), Type::NaN(), zone()))) {

test/mjsunit/regress/regress-v8-5255-1.js

+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function foo(x) {
+  return (x ? true : "7") >> 0;
+}
+
+assertEquals(1, foo(1));
+assertEquals(1, foo(1));
+%OptimizeFunctionOnNextCall(foo);
+assertEquals(7, foo(0));

test/mjsunit/regress/regress-v8-5255-2.js

+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function foo(x) {
+  return (x ? true : "7") << 0;
+}
+
+assertEquals(1, foo(1));
+assertEquals(1, foo(1));
+%OptimizeFunctionOnNextCall(foo);
+assertEquals(7, foo(0));

test/mjsunit/regress/regress-v8-5255-3.js

+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function foo(x) {
+  return (x ? true : "7") >>> 0;
+}
+
+assertEquals(1, foo(1));
+assertEquals(1, foo(1));
+%OptimizeFunctionOnNextCall(foo);
+assertEquals(7, foo(0));