[turbofan] Improve ChangeLowering.

- Use representation information provided by the type system to skip SMI
  checks.
- Fix combining of ChangeTaggedToFloat64 with JSToNumber now that JS
  operators can produce control.
- Remove the unnecessary abstraction of smi/field offsets.
- Improve unit test coverage.
- Various cosmetic fixes.

R=svenpanne@chromium.org

Review URL: https://codereview.chromium.org/1018873002

Cr-Commit-Position: refs/heads/master@{#27250}

src/compiler/change-lowering.h

@@ -31,13 +31,13 @@ class ChangeLowering FINAL : public Reducer {
 
   Node* AllocateHeapNumberWithValue(Node* value, Node* control);
   Node* ChangeInt32ToFloat64(Node* value);
+  Node* ChangeInt32ToSmi(Node* value);
   Node* ChangeSmiToFloat64(Node* value);
   Node* ChangeSmiToInt32(Node* value);
   Node* ChangeUint32ToFloat64(Node* value);
   Node* ChangeUint32ToSmi(Node* value);
   Node* LoadHeapNumberValue(Node* value, Node* control);
   Node* TestNotSmi(Node* value);
-  Node* Uint32LessThanOrEqual(Node* lhs, Node* rhs);
 
   Reduction ChangeBitToBool(Node* value, Node* control);
   Reduction ChangeBoolToBit(Node* value);