[turbofan] Fix restriction type for modulus in representation inference.

BUG=chromium:650215

Review-Url: https://codereview.chromium.org/2373453002
Cr-Commit-Position: refs/heads/master@{#39715}

src/compiler/simplified-lowering.cc

@@ -1243,7 +1243,7 @@ class RepresentationSelector {
       // based on the feedback types of the inputs.
       VisitBinop(node,
                  UseInfo(MachineRepresentation::kWord32, Truncation::Float64()),
-                 MachineRepresentation::kWord32);
+                 MachineRepresentation::kWord32, Type::Number());
       if (lower()) DeferReplacement(node, lowering->Uint32Mod(node));
       return;
     }
@@ -1255,7 +1255,7 @@ class RepresentationSelector {
       // based on the feedback types of the inputs.
       VisitBinop(node,
                  UseInfo(MachineRepresentation::kWord32, Truncation::Float64()),
-                 MachineRepresentation::kWord32);
+                 MachineRepresentation::kWord32, Type::Number());
       if (lower()) DeferReplacement(node, lowering->Int32Mod(node));
       return;
     }

test/mjsunit/compiler/regress-650215.js

+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function f() {
+  var x = 0;
+  for (var i = 0; i < 10; i++) {
+    x = (2 % x) | 0;
+    if (i === 5) %OptimizeOsr();
+  }
+  return x;
+}
+
+assertEquals(0, f());