[turbofan] Add re-typing for PlainPrimitiveToNumber during representation inference.

This makes sure that the uses of PlainPrimitiveToNumber get a more
precise type (so that the uses know how to interpret the output
representation).

BUG=chromium:628516

Review-Url: https://codereview.chromium.org/2151223002
Cr-Commit-Position: refs/heads/master@{#37792}

src/compiler/simplified-lowering.cc

@@ -457,6 +457,10 @@ class RepresentationSelector {
         break;
       }
 
+      case IrOpcode::kPlainPrimitiveToNumber:
+        new_type = op_typer_.ToNumber(FeedbackTypeOf(node->InputAt(0)));
+        break;
+
       case IrOpcode::kNumberAbs: {
         new_type = op_typer_.NumberAbs(FeedbackTypeOf(node->InputAt(0)));
         break;

test/mjsunit/compiler/regress-628516.js

+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+function f() {
+  var i = 0;
+  while (1) {
+    if ({}) i = expected[0] == x[0];
+    i++;
+  }
+}
+
+assertThrows(f);