[turbofan] Another fix for induction variable typing monotonicity.

BUG=chromium:645851

Review-Url: https://codereview.chromium.org/2332633002
Cr-Commit-Position: refs/heads/master@{#39358}

src/compiler/typer.cc

@@ -649,7 +649,8 @@ Type* Typer::Visitor::TypeInductionVariablePhi(Node* node) {
   }
   // If we do not have enough type information for the initial value or
   // the increment, just return the initial value's type.
-  if (!initial_type->IsInhabited() || !increment_type->IsInhabited()) {
+  if (!initial_type->IsInhabited() ||
+      increment_type->Is(typer_->cache_.kSingletonZero)) {
     return initial_type;
   }
 

test/mjsunit/compiler/regress-645851.js

+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function f() {
+  var sum = 0;
+  while (1) {
+    for (var j = 0; j < 200; j -=  j) {
+      sum = sum + 1;
+      %OptimizeOsr();
+      if (sum == 2) return;
+    }
+  }
+  return sum;
+}
+
+f();