[bigint,compiler] Remove reduction of Number(x) to ToNumber(x).

In the presence of bigints, this optimization is no longer valid.

Bug: v8:6791
Change-Id: I996ac78f8ae4aef5494dd0089374d04c6db6e72f
Reviewed-on: https://chromium-review.googlesource.com/796070Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49725}

src/compiler/js-call-reducer.cc

@@ -90,20 +90,6 @@ Reduction JSCallReducer::ReduceBooleanConstructor(Node* node) {
   return Replace(value);
 }
 
-// ES6 section 20.1.1 The Number Constructor
-Reduction JSCallReducer::ReduceNumberConstructor(Node* node) {
-  DCHECK_EQ(IrOpcode::kJSCall, node->opcode());
-  CallParameters const& p = CallParametersOf(node->op());
-
-  // Turn the {node} into a {JSToNumber} call.
-  DCHECK_LE(2u, p.arity());
-  Node* value = (p.arity() == 2) ? jsgraph()->ZeroConstant()
-                                 : NodeProperties::GetValueInput(node, 2);
-  NodeProperties::ReplaceValueInputs(node, value);
-  NodeProperties::ChangeOp(node, javascript()->ToNumber());
-  return Changed(node);
-}
-
 // ES section #sec-object-constructor
 Reduction JSCallReducer::ReduceObjectConstructor(Node* node) {
   DCHECK_EQ(IrOpcode::kJSCall, node->opcode());
@@ -1908,8 +1894,6 @@ Reduction JSCallReducer::ReduceJSCall(Node* node) {
           return ReduceFunctionPrototypeCall(node);
         case Builtins::kFunctionPrototypeHasInstance:
           return ReduceFunctionPrototypeHasInstance(node);
-        case Builtins::kNumberConstructor:
-          return ReduceNumberConstructor(node);
         case Builtins::kObjectConstructor:
           return ReduceObjectConstructor(node);
         case Builtins::kObjectGetPrototypeOf:

src/compiler/js-call-reducer.h

@@ -55,7 +55,6 @@ class JSCallReducer final : public AdvancedReducer {
   Reduction ReduceArrayConstructor(Node* node);
   Reduction ReduceBooleanConstructor(Node* node);
   Reduction ReduceCallApiFunction(Node* node, Handle<JSFunction> function);
-  Reduction ReduceNumberConstructor(Node* node);
   Reduction ReduceFunctionPrototypeApply(Node* node);
   Reduction ReduceFunctionPrototypeBind(Node* node);
   Reduction ReduceFunctionPrototypeCall(Node* node);

test/mjsunit/harmony/bigint/turbo.js

+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --harmony-bigint
+
+
+function foo(x) {
+  return Number(x);
+}
+foo(42n);
+%OptimizeFunctionOnNextCall(foo);
+assertEquals(42, foo(42n));