[turbofan] Improve typing for CheckBounds.

Also eliminate redundant CheckBounds node during SimplifiedLowering if
we can prove that the index is within the [0.0, length[ range.

R=epertoso@chromium.org

Review-Url: https://codereview.chromium.org/2229343002
Cr-Commit-Position: refs/heads/master@{#38523}

src/compiler/simplified-lowering.cc

@@ -2104,7 +2104,8 @@ class RepresentationSelector {
       }
 
       case IrOpcode::kCheckBounds: {
-        if (TypeOf(node->InputAt(0))->Is(Type::Unsigned32())) {
+        Type* index_type = TypeOf(node->InputAt(0));
+        if (index_type->Is(Type::Unsigned32())) {
           VisitBinop(node, UseInfo::TruncatingWord32(),
                      MachineRepresentation::kWord32);
         } else {
@@ -2112,6 +2113,13 @@ class RepresentationSelector {
                      UseInfo::TruncatingWord32(),
                      MachineRepresentation::kWord32);
         }
+        if (lower()) {
+          // The bounds check is redundant if we already know that
+          // the index is within the bounds of [0.0, length[.
+          if (index_type->Is(NodeProperties::GetType(node))) {
+            DeferReplacement(node, node->InputAt(0));
+          }
+        }
         return;
       }
       case IrOpcode::kCheckIf: {

src/compiler/typer.cc

@@ -1537,8 +1537,14 @@ Type* Typer::Visitor::TypeStringFromCharCode(Node* node) {
 }
 
 Type* Typer::Visitor::TypeCheckBounds(Node* node) {
-  // TODO(bmeurer): We could do better here based on the limit.
-  return Type::Unsigned31();
+  Type* index = Operand(node, 0);
+  Type* length = Operand(node, 1);
+  index = Type::Intersect(index, Type::Integral32(), zone());
+  if (!index->IsInhabited() || !length->IsInhabited()) return Type::None();
+  double min = std::max(index->Min(), 0.0);
+  double max = std::min(index->Max(), length->Min() - 1);
+  if (max < min) return Type::None();
+  return Type::Range(min, max, zone());
 }
 
 Type* Typer::Visitor::TypeCheckMaps(Node* node) {