[turbofan] Fix impossible type handling for TypeGuard and BooleanNot.

This also fixes incorrect type for fixed array accesses.

BUG=chromium:715651,v8:6309,chromium:715204

Review-Url: https://codereview.chromium.org/2848583002
Cr-Commit-Position: refs/heads/master@{#44926}

src/compiler/access-builder.cc

@@ -737,9 +737,9 @@ FieldAccess AccessBuilder::ForArgumentsCallee() {
 FieldAccess AccessBuilder::ForFixedArraySlot(
     size_t index, WriteBarrierKind write_barrier_kind) {
   int offset = FixedArray::OffsetOfElementAt(static_cast<int>(index));
-  FieldAccess access = {kTaggedBase,         offset,
-                        Handle<Name>(),      MaybeHandle<Map>(),
-                        Type::NonInternal(), MachineType::AnyTagged(),
+  FieldAccess access = {kTaggedBase,       offset,
+                        Handle<Name>(),    MaybeHandle<Map>(),
+                        Type::Any(),       MachineType::AnyTagged(),
                         write_barrier_kind};
   return access;
 }

src/compiler/simplified-lowering.cc

@@ -1531,11 +1531,14 @@ class RepresentationSelector {
             // BooleanNot(x: kRepBit) => Word32Equal(x, #0)
             node->AppendInput(jsgraph_->zone(), jsgraph_->Int32Constant(0));
             NodeProperties::ChangeOp(node, lowering->machine()->Word32Equal());
-          } else {
-            DCHECK(CanBeTaggedPointer(input_info->representation()));
+          } else if (CanBeTaggedPointer(input_info->representation())) {
             // BooleanNot(x: kRepTagged) => WordEqual(x, #false)
             node->AppendInput(jsgraph_->zone(), jsgraph_->FalseConstant());
             NodeProperties::ChangeOp(node, lowering->machine()->WordEqual());
+          } else {
+            DCHECK_EQ(MachineRepresentation::kNone,
+                      input_info->representation());
+            DeferReplacement(node, lowering->jsgraph()->Int32Constant(0));
           }
         } else {
           // No input representation requirement; adapt during lowering.
@@ -2779,9 +2782,15 @@ class RepresentationSelector {
         // We just get rid of the sigma here. In principle, it should be
         // possible to refine the truncation and representation based on
         // the sigma's type.
-        MachineRepresentation output =
+        MachineRepresentation representation =
             GetOutputInfoForPhi(node, TypeOf(node->InputAt(0)), truncation);
-        VisitUnop(node, UseInfo(output, truncation), output);
+
+        // For now, we just handle specially the impossible case.
+        MachineRepresentation output = TypeOf(node)->IsInhabited()
+                                           ? representation
+                                           : MachineRepresentation::kNone;
+
+        VisitUnop(node, UseInfo(representation, truncation), output);
         if (lower()) DeferReplacement(node, node->InputAt(0));
         return;
       }

test/mjsunit/compiler/regress-715204.js

+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var global = true;
+global = false;
+
+function f() {
+  global = 1;
+  return !global;
+}
+
+f();

test/mjsunit/compiler/regress-715651.js

+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function f() {
+  this.x = 1;
+}
+
+var a = [];
+
+// Create enough objects to trigger slack tracking.
+for (let i = 0; i < 100; i++) {
+  new f();
+}
+
+function h() {
+  // Create a new object and add an out-of-object property 'y'.
+  var o = new f();
+  o.y = 1.5;
+  return o;
+}
+
+function g(o) {
+  // Add more properties so that we trigger extension of out-ot-object
+  // property store.
+  o.u = 1.1;
+  o.v = 1.2;
+  o.z = 1.3;
+  // Return a field from the out-of-object-property store.
+  return o.y;
+}
+
+g(h());
+g(h());
+%OptimizeFunctionOnNextCall(g);
+assertEquals(1.5, g(h()));