[turbofan] Avoid generating dead BooleanNot nodes in typed lowering.

Without this shortcut we generate one BooleanNot per JSUnaryNot with
number input, which is quite common in asm.js. These dead nodes then
survive until the late control reducer runs, and may prevent
optimizations in the mean time.

R=dcarney@chromium.org

Review URL: https://codereview.chromium.org/963713002

Cr-Commit-Position: refs/heads/master@{#26911}

src/compiler/js-typed-lowering.cc

@@ -516,6 +516,12 @@ Reduction JSTypedLowering::ReduceJSUnaryNot(Node* node) {
     node->set_op(simplified()->BooleanNot());
     node->TrimInputCount(1);
     return Changed(node);
+  } else if (input_type->Is(Type::OrderedNumber())) {
+    // JSUnaryNot(x:number,context) => NumberEqual(x,#0)
+    node->set_op(simplified()->NumberEqual());
+    node->ReplaceInput(1, jsgraph()->ZeroConstant());
+    DCHECK_EQ(2, node->InputCount());
+    return Changed(node);
   }
   // JSUnaryNot(x,context) => BooleanNot(AnyToBoolean(x))
   node->set_op(simplified()->BooleanNot());

test/unittests/compiler/js-typed-lowering-unittest.cc

@@ -119,6 +119,16 @@ TEST_F(JSTypedLoweringTest, JSUnaryNotWithBoolean) {
 }
 
 
+TEST_F(JSTypedLoweringTest, JSUnaryNotWithOrderedNumber) {
+  Node* input = Parameter(Type::OrderedNumber(), 0);
+  Node* context = Parameter(Type::Any(), 1);
+  Reduction r =
+      Reduce(graph()->NewNode(javascript()->UnaryNot(), input, context));
+  ASSERT_TRUE(r.Changed());
+  EXPECT_THAT(r.replacement(), IsNumberEqual(input, IsNumberConstant(0)));
+}
+
+
 TEST_F(JSTypedLoweringTest, JSUnaryNotWithFalsish) {
   Node* input = Parameter(
       Type::Union(