[turbofan] Support f64 truncation in f64->tagged representation change.

Bug: chromium:933331
Change-Id: I598a32b1efe2d4b7e8278ddf84140c72f787afa8
Reviewed-on: https://chromium-review.googlesource.com/c/1475496Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Jaroslav Sevcik <jarin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#59749}

src/compiler/representation-change.cc

@@ -524,7 +524,9 @@ Node* RepresentationChanger::GetTaggedRepresentationFor(
                    Type::Unsigned32())) {  // float64 -> uint32 -> tagged
       node = InsertChangeFloat64ToUint32(node);
       op = simplified()->ChangeUint32ToTagged();
-    } else if (output_type.Is(Type::Number())) {
+    } else if (output_type.Is(Type::Number()) ||
+               (output_type.Is(Type::NumberOrOddball()) &&
+                truncation.IsUsedAsFloat64())) {
       op = simplified()->ChangeFloat64ToTagged(
           output_type.Maybe(Type::MinusZero())
               ? CheckForMinusZeroMode::kCheckForMinusZero

test/mjsunit/compiler/regresss-933331.js

+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function opt(r, flag){
+  var x;
+  for(let i = 0; i < 2; i++){
+    r[2] = 0;
+    x = r[0] << (flag ? r[0] : flag)
+  }
+  return x;
+}
+
+ar = [3.1];
+opt(ar,1);
+opt(ar,1);
+%OptimizeFunctionOnNextCall(opt);
+assertEquals(24, opt(ar,1));