[turbofan] Add missing Word64->Bit support.

The representation changer was lacking support for directly converting
Word64 values to Bit representation.

Bug: chromium:890243, v8:4153, v8:7881, v8:8171, v8:8178
Change-Id: I5fa31716c7b2b10ad00dc31d5035a1ada152661c
Reviewed-on: https://chromium-review.googlesource.com/1251551Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#56304}

src/compiler/representation-change.cc

@@ -919,6 +919,11 @@ Node* RepresentationChanger::GetBitRepresentationFor(
                                        jsgraph()->Int32Constant(0));
     return jsgraph()->graph()->NewNode(machine()->Word32Equal(), node,
                                        jsgraph()->Int32Constant(0));
+  } else if (output_rep == MachineRepresentation::kWord64) {
+    node = jsgraph()->graph()->NewNode(machine()->Word64Equal(), node,
+                                       jsgraph()->Int64Constant(0));
+    return jsgraph()->graph()->NewNode(machine()->Word32Equal(), node,
+                                       jsgraph()->Int32Constant(0));
   } else if (output_rep == MachineRepresentation::kFloat32) {
     node = jsgraph()->graph()->NewNode(machine()->Float32Abs(), node);
     return jsgraph()->graph()->NewNode(machine()->Float32LessThan(),

test/mjsunit/regress/regress-crbug-890243.js

+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+// We need a SpeculativeNumberAdd with Number feedback.
+function bar(x) { return x + x; }
+bar(0.1);
+
+// We also need an indirection via an object field such
+// that only after escape analysis TurboFan can figure
+// out that the value `y` is actually a Number in the
+// safe integer range.
+function baz(y) { return {y}; }
+baz(null); baz(0);
+
+// Now we can put all of that together to get a kRepBit
+// use of a kWord64 value (on 64-bit architectures).
+function foo(o) {
+  return !baz(bar(o.x)).y;
+}
+
+assertFalse(foo({x:1}));
+assertFalse(foo({x:1}));
+%OptimizeFunctionOnNextCall(foo);
+assertFalse(foo({x:1}));