[turbofan] Properly handle bit->float64 representation changes.

BUG=chromium:629062
R=jarin@chromium.org

Review-Url: https://codereview.chromium.org/2155323003
Cr-Commit-Position: refs/heads/master@{#37853}

src/compiler/representation-change.cc

@@ -340,6 +340,8 @@ Node* RepresentationChanger::GetFloat64RepresentationFor(
       // low 32 bits (so we can pick uint32 safely).
       op = machine()->ChangeUint32ToFloat64();
     }
+  } else if (output_rep == MachineRepresentation::kBit) {
+    op = machine()->ChangeUint32ToFloat64();
   } else if (output_rep == MachineRepresentation::kTagged) {
     if (output_type->Is(Type::Undefined())) {
       return jsgraph()->Float64Constant(

test/cctest/compiler/test-representation-change.cc

@@ -657,10 +657,6 @@ TEST(TypeErrors) {
   // Floats cannot be implicitly converted to/from comparison conditions.
   r.CheckTypeError(MachineRepresentation::kFloat64, Type::None(),
                    MachineRepresentation::kBit);
-  r.CheckTypeError(MachineRepresentation::kBit, Type::None(),
-                   MachineRepresentation::kFloat64);
-  r.CheckTypeError(MachineRepresentation::kBit, Type::Boolean(),
-                   MachineRepresentation::kFloat64);
 
   // Floats cannot be implicitly converted to/from comparison conditions.
   r.CheckTypeError(MachineRepresentation::kFloat32, Type::None(),

test/mjsunit/regress/regress-crbug-629062.js

+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function foo(x) {
+  return 1 + ((1 == 0) && undefined);
+}
+
+foo(false);
+foo(false);
+%OptimizeFunctionOnNextCall(foo);
+foo(true);