[turbofan] Teach the LoopVariableOptimizer about ToNumber.

Bug: chromium:819298, chromium:820729
Change-Id: I3a1bccfe889ca409085396e2e1c4ae991093d0ea
Reviewed-on: https://chromium-review.googlesource.com/960321
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51910}

src/compiler/loop-variable-optimizer.cc

@@ -239,7 +239,12 @@ InductionVariable* LoopVariableOptimizer::TryGetInductionVariable(Node* phi) {
   }
 
   // TODO(jarin) Support both sides.
-  if (arith->InputAt(0) != phi) return nullptr;
+  Node* input = arith->InputAt(0);
+  if (input->opcode() == IrOpcode::kSpeculativeToNumber ||
+      input->opcode() == IrOpcode::kJSToNumber) {
+    input = input->InputAt(0);
+  }
+  if (input != phi) return nullptr;
 
   Node* effect_phi = nullptr;
   for (Node* use : loop->uses()) {