Revert of [turbofan] Remove the leftover LoadBuffer hacks. (patchset #1 id:1...

Revert of [turbofan] Remove the leftover LoadBuffer hacks. (patchset #1 id:1 of https://codereview.chromium.org/1887343002/ )

Reason for revert:
Using types in ChangeLowering is generally unsafe.

Original issue's description:
> [turbofan] Remove the leftover LoadBuffer hacks.
>
> R=jarin@chromium.org
>
> Committed: https://crrev.com/20eff45de11609934be339dffe46276ff0a4bc22
> Cr-Commit-Position: refs/heads/master@{#35509}

TBR=jarin@chromium.org,mstarzinger@chromium.org
# Not skipping CQ checks because original CL landed more than 1 days ago.

Review URL: https://codereview.chromium.org/1893893002

Cr-Commit-Position: refs/heads/master@{#35549}

src/compiler/change-lowering.cc

@@ -177,9 +177,12 @@ Reduction ChangeLowering::ChangeFloat64ToTagged(Node* value, Node* control) {
   Type* const value_type = NodeProperties::GetType(value);
   Node* const value32 = graph()->NewNode(
       machine()->TruncateFloat64ToInt32(TruncationMode::kRoundToZero), value);
-  if (value_type->Is(Type::Signed32())) {
-    return ChangeInt32ToTagged(value32, control);
-  }
+  // TODO(bmeurer): This fast case must be disabled until we kill the asm.js
+  // support in the generic JavaScript pipeline, because LoadBuffer is lying
+  // about its result.
+  // if (value_type->Is(Type::Signed32())) {
+  //   return ChangeInt32ToTagged(value32, control);
+  // }
   Node* check_same = graph()->NewNode(
       machine()->Float64Equal(), value,
       graph()->NewNode(machine()->ChangeInt32ToFloat64(), value32));

src/compiler/pipeline.cc

@@ -771,6 +771,12 @@ struct SimplifiedLoweringPhase {
                                 data->source_positions());
     lowering.LowerAllNodes();
 
+    // TODO(bmeurer): See comment on SimplifiedLowering::abort_compilation_.
+    if (lowering.abort_compilation_) {
+      data->set_compilation_failed();
+      return;
+    }
+
     JSGraphReducer graph_reducer(data->jsgraph(), temp_zone);
     DeadCodeElimination dead_code_elimination(&graph_reducer, data->graph(),
                                               data->common());
@@ -1281,6 +1287,9 @@ Handle<Code> Pipeline::GenerateCode() {
   // Kill the Typer and thereby uninstall the decorator (if any).
   typer.Reset(nullptr);
 
+  // TODO(bmeurer): See comment on SimplifiedLowering::abort_compilation_.
+  if (data.compilation_failed()) return Handle<Code>::null();
+
   return ScheduleAndGenerateCode(
       Linkage::ComputeIncoming(data.instruction_zone(), info()));
 }

src/compiler/simplified-lowering.h

@@ -38,6 +38,11 @@ class SimplifiedLowering final {
   void DoStoreBuffer(Node* node);
   void DoShift(Node* node, Operator const* op, Type* rhs_type);
 
+  // TODO(bmeurer): This is a gigantic hack to support the gigantic LoadBuffer
+  // typing hack to support the gigantic "asm.js should be fast without proper
+  // verifier"-hack, ... Kill this! Soon! Really soon! I'm serious!
+  bool abort_compilation_ = false;
+
  private:
   JSGraph* const jsgraph_;
   Zone* const zone_;