Add proper support for proxies to HType.

TEST=mjsunit/regress/regress-crbug-448730
BUG=chromium:448730
LOG=y
R=jarin@chromium.org

Review URL: https://codereview.chromium.org/847373002

Cr-Commit-Position: refs/heads/master@{#26056}

src/hydrogen-types.cc

@@ -24,6 +24,7 @@ HType HType::FromType(typename T::TypeHandle type) {
   if (type->Is(T::Undefined())) return HType::Undefined();
   if (type->Is(T::Array())) return HType::JSArray();
   if (type->Is(T::Object())) return HType::JSObject();
+  if (type->Is(T::Receiver())) return HType::JSReceiver();
   return HType::Tagged();
 }
 

src/hydrogen-types.h

@@ -17,22 +17,23 @@ namespace internal {
 template <typename T> class Handle;
 class Object;
 
-#define HTYPE_LIST(V)                                 \
-  V(Any, 0x0)              /* 0000 0000 0000 0000 */  \
-  V(Tagged, 0x1)           /* 0000 0000 0000 0001 */  \
-  V(TaggedPrimitive, 0x5)  /* 0000 0000 0000 0101 */  \
-  V(TaggedNumber, 0xd)     /* 0000 0000 0000 1101 */  \
-  V(Smi, 0x1d)             /* 0000 0000 0001 1101 */  \
-  V(HeapObject, 0x21)      /* 0000 0000 0010 0001 */  \
-  V(HeapPrimitive, 0x25)   /* 0000 0000 0010 0101 */  \
-  V(Null, 0x27)            /* 0000 0000 0010 0111 */  \
-  V(HeapNumber, 0x2d)      /* 0000 0000 0010 1101 */  \
-  V(String, 0x65)          /* 0000 0000 0110 0101 */  \
-  V(Boolean, 0xa5)         /* 0000 0000 1010 0101 */  \
-  V(Undefined, 0x125)      /* 0000 0001 0010 0101 */  \
-  V(JSObject, 0x221)       /* 0000 0010 0010 0001 */  \
-  V(JSArray, 0x621)        /* 0000 0110 0010 0001 */  \
-  V(None, 0x7ff)           /* 0000 0111 1111 1111 */
+#define HTYPE_LIST(V)                               \
+  V(Any, 0x0)             /* 0000 0000 0000 0000 */ \
+  V(Tagged, 0x1)          /* 0000 0000 0000 0001 */ \
+  V(TaggedPrimitive, 0x5) /* 0000 0000 0000 0101 */ \
+  V(TaggedNumber, 0xd)    /* 0000 0000 0000 1101 */ \
+  V(Smi, 0x1d)            /* 0000 0000 0001 1101 */ \
+  V(HeapObject, 0x21)     /* 0000 0000 0010 0001 */ \
+  V(HeapPrimitive, 0x25)  /* 0000 0000 0010 0101 */ \
+  V(Null, 0x27)           /* 0000 0000 0010 0111 */ \
+  V(HeapNumber, 0x2d)     /* 0000 0000 0010 1101 */ \
+  V(String, 0x65)         /* 0000 0000 0110 0101 */ \
+  V(Boolean, 0xa5)        /* 0000 0000 1010 0101 */ \
+  V(Undefined, 0x125)     /* 0000 0001 0010 0101 */ \
+  V(JSReceiver, 0x221)    /* 0000 0010 0010 0001 */ \
+  V(JSObject, 0x621)      /* 0000 0110 0010 0001 */ \
+  V(JSArray, 0xe21)       /* 0000 1110 0010 0001 */ \
+  V(None, 0xfff)          /* 0000 1111 1111 1111 */
 
 class HType FINAL {
  public:

test/mjsunit/regress/regress-crbug-448730.js

+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --harmony-proxies
+
+function bar() {}
+bar({ a: Proxy.create({}) });
+function foo(x) { x.a.b == ""; }
+var x = {a: {b: "" }};
+foo(x);
+foo(x);
+%OptimizeFunctionOnNextCall(foo);
+foo(x);