Fix typed lowering of JSToBoolean on number inputs.

R=titzer@chromium.org
TEST=cctest/test-js-typed-lowering/JSToBoolean_replacement

Review URL: https://codereview.chromium.org/533103002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@23642 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

src/compiler/js-typed-lowering.cc

@@ -491,10 +491,7 @@ Reduction JSTypedLowering::ReduceJSToBooleanInput(Node* input) {
     Node* cmp = graph()->NewNode(simplified()->NumberEqual(), input,
                                  jsgraph()->ZeroConstant());
     Node* inv = graph()->NewNode(simplified()->BooleanNot(), cmp);
-    ReplaceEagerly(input, inv);
-    // TODO(titzer): Ugly. ReplaceEagerly smashes all uses. Smash it back here.
-    cmp->ReplaceInput(0, input);
-    return Changed(inv);
+    return ReplaceWith(inv);
   }
   // TODO(turbofan): js-typed-lowering of ToBoolean(string)
   return NoChange();

test/cctest/compiler/test-js-typed-lowering.cc

@@ -506,7 +506,8 @@ TEST(JSToBoolean) {
 TEST(JSToBoolean_replacement) {
   JSTypedLoweringTester R;
 
-  Type* types[] = {Type::Null(), Type::Undefined(), Type::Boolean(),
+  Type* types[] = {Type::Null(),             Type::Undefined(),
+                   Type::Boolean(),          Type::Number(),
                    Type::DetectableObject(), Type::Undetectable()};
 
   for (size_t i = 0; i < arraysize(types); i++) {
@@ -521,6 +522,8 @@ TEST(JSToBoolean_replacement) {
 
     if (types[i]->Is(Type::Boolean())) {
       CHECK_EQ(n, r);
+    } else if (types[i]->Is(Type::Number())) {
+      CHECK_EQ(IrOpcode::kBooleanNot, r->opcode());
     } else {
       CHECK_EQ(IrOpcode::kHeapConstant, r->opcode());
     }