[ignition] Improve code generation for TestTypeOf.

The code generated for the TestTypeOf bytecode was not ideal, mostly
because of the default case that just aborted. If we do CSA_ASSERT to
check the validity of the literal_flag instead anf then just use the
last label as the default, the bytecode handler no longer builds a
stack frame and generated code quality is now really close to ideal.

The TestTypeOf bytecode handler was found to be among the three
hottest bytecode handlers in the Speedometer/AngularJS benchmark.

R=jarin@chromium.org

Change-Id: I47705a0ca0a436d5c42899001064e77d44845a64
Reviewed-on: https://chromium-review.googlesource.com/589207Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46930}

src/interpreter/interpreter-generator.cc

@@ -2170,16 +2170,15 @@ IGNITION_HANDLER(TestTypeOf, InterpreterAssembler) {
   int32_t cases[] = {TYPEOF_LITERAL_LIST(CASE)};
 #undef CASE
 
-  Label if_true(this), if_false(this), end(this), abort(this, Label::kDeferred);
+  Label if_true(this), if_false(this), end(this);
 
-  Switch(literal_flag, &abort, cases, labels, arraysize(cases));
+  // We juse use the final label as the default and properly CSA_ASSERT
+  // that the {literal_flag} is valid here; this significantly improves
+  // the generated code (compared to having a default label that aborts).
+  unsigned const num_cases = arraysize(cases);
+  CSA_ASSERT(this, Uint32LessThan(literal_flag, Int32Constant(num_cases)));
+  Switch(literal_flag, labels[num_cases - 1], cases, labels, num_cases - 1);
 
-  BIND(&abort);
-  {
-    Comment("Abort");
-    Abort(BailoutReason::kUnexpectedTestTypeofLiteralFlag);
-    Goto(&if_false);
-  }
   BIND(&if_number);
   {
     Comment("IfNumber");