[turbofan] Revert invalid optimization of flooring division.

The optimization

  NumberFloor(NumberDivide(lhs, rhs))

to

  NumberToInt32(NumberDivide(lhs, rhs))

for potentially negative lhs is not valid, since Math.floor rounds
towards -infinity, whereas ToInt32 truncates.

BUG=chromium:699282
R=jarin@chromium.org

Review-Url: https://codereview.chromium.org/2743673002
Cr-Commit-Position: refs/heads/master@{#43699}

src/compiler/typed-optimization.cc

@@ -219,11 +219,6 @@ Reduction TypedOptimization::ReduceNumberFloor(Node* node) {
       NodeProperties::SetType(node, lhs_type);
       return Changed(node);
     }
-    if (lhs_type->Is(Type::Signed32()) && rhs_type->Is(Type::Unsigned32())) {
-      NodeProperties::ChangeOp(node, simplified()->NumberToInt32());
-      NodeProperties::SetType(node, lhs_type);
-      return Changed(node);
-    }
   }
   return NoChange();
 }

test/mjsunit/regress/regress-crbug-699282.js

+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+var v = 1;
+function foo() { return Math.floor(-v / 125); }
+assertEquals(-1, foo());
+%OptimizeFunctionOnNextCall(foo);
+assertEquals(-1, foo());