[turbofan] Fix bug in String.fromCharCode optimization

The optimization was replacing
  String.fromCharCode(x) == "y"
with x == y instead of (x & 0xFFFF) == y if x was outside
of uint16 range.

Bug: v8:7340, v8:7531
Change-Id: I967306cc2e05c28de82e16cf1b2312fe47396a7d
Reviewed-on: https://chromium-review.googlesource.com/979808Reviewed-by: Georg Neis <neis@chromium.org>
Commit-Queue: Sigurd Schneider <sigurds@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52214}

src/compiler/typed-optimization.cc

@@ -409,6 +409,15 @@ TypedOptimization::TryReduceStringComparisonOfStringFromSingleCharCode(
 
   const Operator* comparison_op = NumberComparisonFor(comparison->op());
   Node* from_char_code_repl = NodeProperties::GetValueInput(from_char_code, 0);
+  Type* from_char_code_repl_type = NodeProperties::GetType(from_char_code_repl);
+  if (!from_char_code_repl_type->Is(type_cache_.kUint16)) {
+    // Convert to signed int32 to satisfy type of {NumberBitwiseAnd}.
+    from_char_code_repl =
+        graph()->NewNode(simplified()->NumberToInt32(), from_char_code_repl);
+    from_char_code_repl = graph()->NewNode(
+        simplified()->NumberBitwiseAnd(), from_char_code_repl,
+        jsgraph()->Constant(std::numeric_limits<uint16_t>::max()));
+  }
   Node* constant_repl = jsgraph()->Constant(string->Get(0));
 
   Node* number_comparison = nullptr;

test/mjsunit/constant-folding-2.js

@@ -275,6 +275,10 @@ test(function stringCodePointAt() {
   assertSame(undefined, "äϠ�".codePointAt(1 + 4294967295));
 }, 10);
 
+test(function stringFromCharCode() {
+  assertEquals("！", String.fromCharCode(0x10FF01));
+}, 2);
+
 test(function int32Mod() {
   assertEquals(-0, -2147483648 % (-1));
 });