[turbofan] Fix deoptimization of boolean bit constants.

BUG=chromium:664490

Review-Url: https://codereview.chromium.org/2495243002
Cr-Commit-Position: refs/heads/master@{#40951}

src/compiler/code-generator.cc

@@ -858,12 +858,18 @@ void CodeGenerator::AddTranslationForOperand(Translation* translation,
           constant_object =
               handle(reinterpret_cast<Smi*>(constant.ToInt32()), isolate());
           DCHECK(constant_object->IsSmi());
+        } else if (type.representation() == MachineRepresentation::kBit) {
+          if (constant.ToInt32() == 0) {
+            constant_object = isolate()->factory()->false_value();
+          } else {
+            DCHECK_EQ(1, constant.ToInt32());
+            constant_object = isolate()->factory()->true_value();
+          }
         } else {
           // TODO(jarin,bmeurer): We currently pass in raw pointers to the
           // JSFunction::entry here. We should really consider fixing this.
           DCHECK(type == MachineType::Int32() ||
                  type == MachineType::Uint32() ||
-                 type.representation() == MachineRepresentation::kBit ||
                  type.representation() == MachineRepresentation::kWord32 ||
                  type.representation() == MachineRepresentation::kNone);
           DCHECK(type.representation() != MachineRepresentation::kNone ||

src/compiler/simplified-lowering.cc

@@ -1030,6 +1030,8 @@ class RepresentationSelector {
                      MachineRepresentation::kWord32 ||
                  machine_type.semantic() == MachineSemantic::kInt32 ||
                  machine_type.semantic() == MachineSemantic::kUint32);
+          DCHECK(machine_type.representation() != MachineRepresentation::kBit ||
+                 input_type->Is(Type::Boolean()));
           (*types)[i] = machine_type;
         }
       }

test/mjsunit/compiler/regress-664490.js

+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+var foo = function(msg) {};
+
+foo = function (value) {
+  assertEquals(false, value);
+}
+
+function f() {
+  foo(undefined == 0);
+}
+
+%OptimizeFunctionOnNextCall(f);
+f();