[turbofan] Revert "Avoid overflow checks on SpeculativeNumberAdd/Subtract/Multiply."

The optimization is not correct for unsigned output types, and we the
overall complexity seems too high. We need to find a better way to
take into account the input/output type restrictions.

Also added a regression test for the unsigned output bug.

BUG=v8:5267,v8:5270,v8:5357
TBR=jarin@chromium.org

Review-Url: https://codereview.chromium.org/2320013002
Cr-Commit-Position: refs/heads/master@{#39262}

src/compiler/representation-change.cc

@@ -751,10 +751,8 @@ const Operator* RepresentationChanger::Int32OverflowOperatorFor(
 const Operator* RepresentationChanger::Uint32OperatorFor(
     IrOpcode::Value opcode) {
   switch (opcode) {
-    case IrOpcode::kSpeculativeNumberAdd:
     case IrOpcode::kNumberAdd:
       return machine()->Int32Add();
-    case IrOpcode::kSpeculativeNumberSubtract:
     case IrOpcode::kNumberSubtract:
       return machine()->Int32Sub();
     case IrOpcode::kSpeculativeNumberMultiply:

src/compiler/representation-change.h

@@ -35,10 +35,6 @@ class Truncation final {
   bool IsUsedAsFloat64() const {
     return LessGeneral(kind_, TruncationKind::kFloat64);
   }
-  bool IdentifiesMinusZeroAndZero() {
-    return LessGeneral(kind_, TruncationKind::kWord32) ||
-           LessGeneral(kind_, TruncationKind::kBool);
-  }
   bool IdentifiesNaNAndZero() {
     return LessGeneral(kind_, TruncationKind::kWord32) ||
            LessGeneral(kind_, TruncationKind::kBool);

test/mjsunit/regress/regress-5357.js

+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function foo(a) {
+  a++;
+  a = Math.max(0, a);
+  a++;
+  return a;
+}
+
+foo(0);
+foo(0);
+%OptimizeFunctionOnNextCall(foo);
+assertEquals(2147483648, foo(2147483646));