[turbofan] Work around lowering uninhabited ReferenceEqual.

This change prevents constant folding of uninhabited RefenceEqual node
because that could widen a type (from None type to the type of the
boolean constant).

Hopefully, this is a temporary workaround that will be replaced
by a better dead code elimination.

Bug: v8:6631
Change-Id: Ie25e7d710aaf1d37c9adba60f92438570843dd5d
Reviewed-on: https://chromium-review.googlesource.com/627916Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Commit-Queue: Jaroslav Sevcik <jarin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47545}

src/compiler/new-escape-analysis.cc

@@ -598,15 +598,31 @@ void ReduceNode(const Operator* op, EscapeAnalysisTracker::Scope* current,
       Node* right = current->ValueInput(1);
       const VirtualObject* left_object = current->GetVirtualObject(left);
       const VirtualObject* right_object = current->GetVirtualObject(right);
+      Node* replacement = nullptr;
       if (left_object && !left_object->HasEscaped()) {
         if (right_object && !right_object->HasEscaped() &&
             left_object->id() == right_object->id()) {
-          current->SetReplacement(jsgraph->TrueConstant());
+          replacement = jsgraph->TrueConstant();
         } else {
-          current->SetReplacement(jsgraph->FalseConstant());
+          replacement = jsgraph->FalseConstant();
         }
       } else if (right_object && !right_object->HasEscaped()) {
-        current->SetReplacement(jsgraph->FalseConstant());
+        replacement = jsgraph->FalseConstant();
+      }
+      if (replacement) {
+        // TODO(tebbi) This is a workaround for uninhabited types. If we
+        // replaced a value of uninhabited type with a constant, we would
+        // widen the type of the node. This could produce inconsistent
+        // types (which might confuse representation selection). We get
+        // around this by refusing to constant-fold and escape-analyze
+        // if the type is not inhabited.
+        if (NodeProperties::GetType(left)->IsInhabited() &&
+            NodeProperties::GetType(right)->IsInhabited()) {
+          current->SetReplacement(replacement);
+        } else {
+          current->SetEscaped(left);
+          current->SetEscaped(right);
+        }
       }
       break;
     }

src/compiler/typed-optimization.cc

@@ -301,7 +301,12 @@ Reduction TypedOptimization::ReduceReferenceEqual(Node* node) {
   Type* const lhs_type = NodeProperties::GetType(lhs);
   Type* const rhs_type = NodeProperties::GetType(rhs);
   if (!lhs_type->Maybe(rhs_type)) {
-    return Replace(jsgraph()->FalseConstant());
+    Node* replacement = jsgraph()->FalseConstant();
+    // Make sure we do not widen the type.
+    if (NodeProperties::GetType(replacement)
+            ->Is(NodeProperties::GetType(node))) {
+      return Replace(jsgraph()->FalseConstant());
+    }
   }
   return NoChange();
 }

test/mjsunit/compiler/regress-v8-6631.js

+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function h(x) {
+  return (x|0) && (1>>x == {})
+}
+
+function g() {
+  return h(1)
+};
+
+function f() {
+  return g(h({}))
+};
+
+f();
+f();
+%OptimizeFunctionOnNextCall(f);
+f();