[turbofan] Lower calls to the Number constructor in JSCallReducer.

The expression Number(x) is essentially equivalent to ToNumber(x),
so just lower to JSToNumber in the JSCallReducer and let typing
and typed lowering take care of optimizations.

R=jarin@chromium.org

Review URL: https://codereview.chromium.org/1497903002

Cr-Commit-Position: refs/heads/master@{#32596}

src/compiler/js-call-reducer.cc

@@ -52,8 +52,8 @@ Reduction JSCallReducer::Reduce(Node* node) {
 
 // ES6 section 22.1.1 The Array Constructor
 Reduction JSCallReducer::ReduceArrayConstructor(Node* node) {
-  Node* target = NodeProperties::GetValueInput(node, 0);
   DCHECK_EQ(IrOpcode::kJSCallFunction, node->opcode());
+  Node* target = NodeProperties::GetValueInput(node, 0);
   CallFunctionParameters const& p = CallFunctionParametersOf(node->op());
 
   // Check if we have an allocation site from the CallIC.
@@ -80,6 +80,22 @@ Reduction JSCallReducer::ReduceArrayConstructor(Node* node) {
 }
 
 
+// ES6 section 20.1.1 The Number Constructor
+Reduction JSCallReducer::ReduceNumberConstructor(Node* node) {
+  DCHECK_EQ(IrOpcode::kJSCallFunction, node->opcode());
+  CallFunctionParameters const& p = CallFunctionParametersOf(node->op());
+
+  // Turn the {node} into a {JSToNumber} call.
+  DCHECK_LE(2u, p.arity());
+  Node* value = (p.arity() == 2) ? jsgraph()->ZeroConstant()
+                                 : NodeProperties::GetValueInput(node, 2);
+  NodeProperties::RemoveFrameStateInput(node, 1);
+  NodeProperties::ReplaceValueInputs(node, value);
+  NodeProperties::ChangeOp(node, javascript()->ToNumber());
+  return Changed(node);
+}
+
+
 // ES6 section 19.2.3.1 Function.prototype.apply ( thisArg, argArray )
 Reduction JSCallReducer::ReduceFunctionPrototypeApply(Node* node) {
   DCHECK_EQ(IrOpcode::kJSCallFunction, node->opcode());
@@ -235,10 +251,15 @@ Reduction JSCallReducer::ReduceJSCallFunction(Node* node) {
         }
       }
 
-      // Check for the ArrayConstructor.
+      // Check for the Array constructor.
       if (*function == function->native_context()->array_function()) {
         return ReduceArrayConstructor(node);
       }
+
+      // Check for the Number constructor.
+      if (*function == function->native_context()->number_function()) {
+        return ReduceNumberConstructor(node);
+      }
     }
 
     // Don't mess with other {node}s that have a constant {target}.

src/compiler/js-call-reducer.h

@@ -37,6 +37,7 @@ class JSCallReducer final : public Reducer {
 
  private:
   Reduction ReduceArrayConstructor(Node* node);
+  Reduction ReduceNumberConstructor(Node* node);
   Reduction ReduceFunctionPrototypeApply(Node* node);
   Reduction ReduceFunctionPrototypeCall(Node* node);
   Reduction ReduceJSCallConstruct(Node* node);