[turbofan] fix type widening bug in RedundancyElimination, completely

This is an improved version of
https://chromium-review.googlesource.com/c/v8/v8/+/1981507

Bug: chromium:1031909
Change-Id: I552f49bf87340eee3c85fa02893b8e63a77a3608
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1997129Reviewed-by: Georg Neis <neis@chromium.org>
Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#65722}

src/compiler/redundancy-elimination.cc

@@ -237,7 +237,7 @@ Node* RedundancyElimination::EffectPathChecks::LookupBoundsCheckFor(
     Node* node) const {
   for (Check const* check = head_; check != nullptr; check = check->next) {
     if (check->node->opcode() == IrOpcode::kCheckBounds &&
-        check->node->InputAt(0) == node) {
+        check->node->InputAt(0) == node && TypeSubsumes(node, check->node)) {
       return check->node;
     }
   }
@@ -385,9 +385,7 @@ Reduction RedundancyElimination::ReduceSpeculativeNumberOperation(Node* node) {
     // than the type of the {first} node, otherwise we
     // would end up replacing NumberConstant inputs with
     // CheckBounds operations, which is kind of pointless.
-    // In addition, as always, we need to make sure not to widen types.
-    if (!NodeProperties::GetType(first).Is(NodeProperties::GetType(check)) &&
-        NodeProperties::GetType(check).Is(NodeProperties::GetType(first))) {
+    if (!NodeProperties::GetType(first).Is(NodeProperties::GetType(check))) {
       NodeProperties::ReplaceValueInput(node, check, 0);
     }
   }