deps: cherry-pick 5005faed5 from V8 upstream

Original commit message:

    [turbofan] Improve representation selection for type guard.

    This takes into account the type of the type guard when choosing
    representation for a node. To make the representation changes
    unambiguous, we pass the restricted type to the changer.

    BUG=chromium:726554

    Review-Url: https://codereview.chromium.org/2920193004
    Cr-Commit-Position: refs/heads/master@{nodejs#45734}

PR-URL: nodejs#15177
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Michaël Zasso <targos@protonmail.com>

deps/v8/src/compiler/simplified-lowering.cc

@@ -734,7 +734,11 @@ class RepresentationSelector {
            !GetUpperBound(node->InputAt(1))->Maybe(type);
   }
 
-  void ConvertInput(Node* node, int index, UseInfo use) {
+  // Converts input {index} of {node} according to given UseInfo {use},
+  // assuming the type of the input is {input_type}. If {input_type} is null,
+  // it takes the input from the input node {TypeOf(node->InputAt(index))}.
+  void ConvertInput(Node* node, int index, UseInfo use,
+                    Type* input_type = nullptr) {
     Node* input = node->InputAt(index);
     // In the change phase, insert a change before the use if necessary.
     if (use.representation() == MachineRepresentation::kNone)
@@ -752,8 +756,11 @@ class RepresentationSelector {
       TRACE(" to ");
       PrintUseInfo(use);
       TRACE("\n");
+      if (input_type == nullptr) {
+        input_type = TypeOf(input);
+      }
       Node* n = changer_->GetRepresentationFor(
-          input, input_info->representation(), TypeOf(input), node, use);
+          input, input_info->representation(), input_type, node, use);
       node->ReplaceInput(index, n);
     }
   }
@@ -2802,18 +2809,22 @@ class RepresentationSelector {
       case IrOpcode::kObjectState:
         return VisitObjectState(node);
       case IrOpcode::kTypeGuard: {
-        // We just get rid of the sigma here. In principle, it should be
-        // possible to refine the truncation and representation based on
-        // the sigma's type.
+        // We just get rid of the sigma here, choosing the best representation
+        // for the sigma's type.
+        Type* type = TypeOf(node);
         MachineRepresentation representation =
-            GetOutputInfoForPhi(node, TypeOf(node->InputAt(0)), truncation);
-
-        // For now, we just handle specially the impossible case.
-        MachineRepresentation output = TypeOf(node)->IsInhabited()
-                                           ? representation
-                                           : MachineRepresentation::kNone;
+            GetOutputInfoForPhi(node, type, truncation);
 
-        VisitUnop(node, UseInfo(representation, truncation), output);
+        // Here we pretend that the input has the sigma's type for the
+        // conversion.
+        UseInfo use(representation, truncation);
+        if (propagate()) {
+          EnqueueInput(node, 0, use);
+        } else if (lower()) {
+          ConvertInput(node, 0, use, type);
+        }
+        ProcessRemainingInputs(node, 1);
+        SetOutput(node, representation);
         if (lower()) DeferReplacement(node, node->InputAt(0));
         return;
       }

deps/v8/test/mjsunit/compiler/regress-726554.js

@@ -0,0 +1,27 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function h(a,b){
+  for(var i=0; i<a.length; i++) {h(a[i],b[i]); }
+}
+
+function g() {
+  h(arguments.length, 2);
+}
+
+function f() {
+  return g(1, 2);
+}
+
+b = [1,,];
+b[1] = 3.5;
+
+h(b, [1073741823, 2147483648, -12]);
+
+f();
+f();
+%OptimizeFunctionOnNextCall(f);
+f();