[turbofan] teach escape analysis about oddly occurring simplified number ops

Bug: chromium:726638
Change-Id: Ib30b147ec60f9f13c5164765f8c63be7a1339e9f
Reviewed-on: https://chromium-review.googlesource.com/517497Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45634}

src/compiler/escape-analysis.cc

@@ -846,6 +846,10 @@ bool EscapeStatusAnalysis::CheckUsesForEscape(Node* uses, Node* rep,
       case IrOpcode::kObjectIsString:
       case IrOpcode::kObjectIsSymbol:
       case IrOpcode::kObjectIsUndetectable:
+#define CASE(opcode) case IrOpcode::k##opcode:
+        SIMPLIFIED_NUMBER_BINOP_LIST(CASE)
+        SIMPLIFIED_NUMBER_UNOP_LIST(CASE)
+#undef CASE
         if (SetEscaped(rep)) {
           TRACE("Setting #%d (%s) to escaped because of use by #%d (%s)\n",
                 rep->id(), rep->op()->mnemonic(), use->id(),

test/mjsunit/compiler/escape-analysis-17.js

+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --turbo-escape
+
+function foo() {
+  var a = {x:1};
+  var b = {x:1.5, y: 1};
+  var x;
+  for (var i = 0; i < 1; i = {}) {
+    // The second iteration of this loop is dead code, leading to a
+    // contradiction between dynamic and static information.
+    x = a.x + 0.5;
+    x = a.x % 0.5;
+    x = Math.abs(a.x);
+    a = b;
+  }
+  return x;
+}
+foo();
+foo();
+%OptimizeFunctionOnNextCall(foo);
+foo();