[turbofan] Quickfix for fround built-in lowering.

We have trouble with Math.fround(MEM[...]).  Since we now properly type
LoadBuffer (it can produce undefined), lowering of fround has stopped
triggering (as it requires Number type).  This CL is a quick fix for this issue
- we simply trigger the lowering for NumberOrUndefined and let representation
selection/truncation analysis deal with this.

Ultimately, we would want to insert some 'simplified' ToNumber conversion
that would be optimized as much as possible during representation
selection.

BUG=chromium:603802
LOG=n
R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/1893483003

Cr-Commit-Position: refs/heads/master@{#35513}

src/compiler/js-builtin-reducer.cc

@@ -172,7 +172,7 @@ Reduction JSBuiltinReducer::ReduceMathFloor(Node* node) {
 // ES6 draft 08-24-14, section 20.2.2.17.
 Reduction JSBuiltinReducer::ReduceMathFround(Node* node) {
   JSCallReduction r(node);
-  if (r.InputsMatchOne(Type::Number())) {
+  if (r.InputsMatchOne(Type::NumberOrUndefined())) {
     // Math.fround(a:number) -> TruncateFloat64ToFloat32(a)
     Node* value =
         graph()->NewNode(machine()->TruncateFloat64ToFloat32(), r.left());