[turbofan] Add missing test coverage for ObjectIsSafeInteger.

The previous tests didn't cover the case Number.isSafeInteger(x)
where TurboFan was unable to tell that `x` is always a Number and
thus had to use the ObjectIsSafeInteger operator instead.

Bug: v8:8015
Change-Id: I9bdbfa602fe0bf8c5fb2bc6c160ace7ab0bc0aaa
Reviewed-on: https://chromium-review.googlesource.com/1238234Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#56114}

test/mjsunit/compiler/number-issafeinteger.js

@@ -40,11 +40,19 @@ function test(f) {
   assertFalse(f(2 * near_lower - 7));
 }
 
-function f(x) {
-  return Number.isSafeInteger(+x);
-}
+// Check that the NumberIsSafeInteger simplified operator in
+// TurboFan does the right thing.
+function NumberIsSafeInteger(x) { return Number.isSafeInteger(+x); }
+test(NumberIsSafeInteger);
+test(NumberIsSafeInteger);
+%OptimizeFunctionOnNextCall(NumberIsSafeInteger);
+test(NumberIsSafeInteger);
 
-test(f);
-test(f);
-%OptimizeFunctionOnNextCall(f);
-test(f);
+// Check that the ObjectIsSafeInteger simplified operator in
+// TurboFan does the right thing as well (i.e. when TurboFan
+// is not able to tell statically that the inputs are numbers).
+function ObjectIsSafeInteger(x) { return Number.isSafeInteger(x); }
+test(ObjectIsSafeInteger);
+test(ObjectIsSafeInteger);
+%OptimizeFunctionOnNextCall(ObjectIsSafeInteger);
+test(ObjectIsSafeInteger);