[crankshaft] Fix deopt loop in String.fromCharCode on non-int32 inputs.

The Crankshaft fast case for String.fromCharCode() unconditionally
deoptimizes on all non-int32 inputs, even tho it would be perfectly
valid to just truncate the index to an int32.

R=ishell@chromium.org
BUG=chromium:587068
LOG=n

Review URL: https://codereview.chromium.org/1727873003

Cr-Commit-Position: refs/heads/master@{#34243}

src/crankshaft/hydrogen.cc

@@ -8791,6 +8791,9 @@ bool HOptimizedGraphBuilder::TryInlineBuiltinMethodCall(
       if (argument_count == 2) {
         HValue* argument = Pop();
         Drop(2);  // Receiver and function.
+        argument = AddUncasted<HForceRepresentation>(
+            argument, Representation::Integer32());
+        argument->SetFlag(HValue::kTruncatingToInt32);
         HInstruction* result = NewUncasted<HStringCharFromCode>(argument);
         ast_context()->ReturnInstruction(result, expr->id());
         return true;

test/mjsunit/regress/regress-crbug-587068.js

+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+// The Crankshaft fast case for String.fromCharCode used to unconditionally
+// deoptimize on non int32 indices.
+function foo(i) { return String.fromCharCode(i); }
+foo(33);
+foo(33);
+%OptimizeFunctionOnNextCall(foo);
+foo(33.3);
+assertOptimized(foo);