[turbofan] Avoid overflow checks on SpeculativeNumberAdd/Subtract/Multiply.

Keep the unrestricted feedback type around during retyping and use that
to check whether an overflow check is actually necessary when doing the
lowering of SpeculativeNumberAdd/Subtract/Multiply. If based on feedback
that is taken for the inputs we already know that the result of the
operation fits into Signed32 or Unsigned32 range, then we don't need to
perform any overflow checks.

R=mvstanton@chromium.org
BUG=v8:5267,v8:5270

Review-Url: https://codereview.chromium.org/2309193003
Cr-Commit-Position: refs/heads/master@{#39198}

src/compiler/representation-change.cc

@@ -746,8 +746,10 @@ const Operator* RepresentationChanger::Int32OverflowOperatorFor(
 const Operator* RepresentationChanger::Uint32OperatorFor(
     IrOpcode::Value opcode) {
   switch (opcode) {
+    case IrOpcode::kSpeculativeNumberAdd:
     case IrOpcode::kNumberAdd:
       return machine()->Int32Add();
+    case IrOpcode::kSpeculativeNumberSubtract:
     case IrOpcode::kNumberSubtract:
       return machine()->Int32Sub();
     case IrOpcode::kSpeculativeNumberMultiply:

src/compiler/representation-change.h

@@ -35,6 +35,10 @@ class Truncation final {
   bool IsUsedAsFloat64() const {
     return LessGeneral(kind_, TruncationKind::kFloat64);
   }
+  bool IdentifiesMinusZeroAndZero() {
+    return LessGeneral(kind_, TruncationKind::kWord32) ||
+           LessGeneral(kind_, TruncationKind::kBool);
+  }
   bool IdentifiesNaNAndZero() {
     return LessGeneral(kind_, TruncationKind::kWord32) ||
            LessGeneral(kind_, TruncationKind::kBool);