[turbofan] Don't treat INFINITY as integer

The fast-path of Number.isInteger and Number.isFinite
both returned true for (-)INFINITY, because kInteger
in the type cache includes both infinities. This CL
uses kSafeInteger range to statically optimize those
two operators.

Bug: chromium:823151, chromium:823100
Change-Id: Icab7f305e8c38f25a4b34b88414f0b515bd7a0fb
Reviewed-on: https://chromium-review.googlesource.com/968201Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Sigurd Schneider <sigurds@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52010}

src/compiler/simplified-lowering.cc

@@ -2746,7 +2746,7 @@ class RepresentationSelector {
       }
       case IrOpcode::kObjectIsFiniteNumber: {
         Type* const input_type = GetUpperBound(node->InputAt(0));
-        if (input_type->Is(type_cache_.kInteger)) {
+        if (input_type->Is(type_cache_.kSafeInteger)) {
           VisitUnop(node, UseInfo::None(), MachineRepresentation::kBit);
           if (lower()) {
             DeferReplacement(node, lowering->jsgraph()->Int32Constant(1));
@@ -2773,8 +2773,7 @@ class RepresentationSelector {
       }
       case IrOpcode::kObjectIsInteger: {
         Type* const input_type = GetUpperBound(node->InputAt(0));
-        // Ranges are always integers.
-        if (input_type->IsRange()) {
+        if (input_type->Is(type_cache_.kSafeInteger)) {
           VisitUnop(node, UseInfo::None(), MachineRepresentation::kBit);
           if (lower()) {
             DeferReplacement(node, lowering->jsgraph()->Int32Constant(1));