[turbofan] Allow converting word64 to float32 if value is safe integer.

Bug: v8:895691
Change-Id: Ic92cb250555d097b01f894b4b7b9ae5b2eea6668
Reviewed-on: https://chromium-review.googlesource.com/c/1282990
Commit-Queue: Georg Neis <neis@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#56691}

src/compiler/representation-change.cc

@@ -586,7 +586,7 @@ Node* RepresentationChanger::GetFloat32RepresentationFor(
   } else if (output_rep == MachineRepresentation::kFloat64) {
     op = machine()->TruncateFloat64ToFloat32();
   } else if (output_rep == MachineRepresentation::kWord64) {
-    if (output_type.Is(Type::Signed32())) {
+    if (output_type.Is(cache_.kSafeInteger)) {
       // int64 -> float64 -> float32
       op = machine()->ChangeInt64ToFloat64();
       node = jsgraph()->graph()->NewNode(op, node);

test/mjsunit/regress/regress-895691.js

+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+const n = 2**32;
+const x = new Float32Array();
+
+function f() {
+  for (var i = 96; i < 100; i += 4) {
+    x[i] = i + n;
+  }
+}
+
+f();
+%OptimizeFunctionOnNextCall(f);
+f();