[turbofan] Only replace nodes eagerly during simplified lowering if the types stay the same.

BUG=chromium:452427
LOG=n
R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/871373010

Cr-Commit-Position: refs/heads/master@{#26286}

src/compiler/simplified-lowering.cc

@@ -1032,14 +1032,16 @@ class RepresentationSelector {
              node->op()->mnemonic(), replacement->id(),
              replacement->op()->mnemonic()));
     }
-    if (replacement->id() < count_) {
-      // Replace with a previously existing node eagerly.
+    if (replacement->id() < count_ &&
+        GetInfo(replacement)->output == GetInfo(node)->output) {
+      // Replace with a previously existing node eagerly only if the type is the
+      // same.
       node->ReplaceUses(replacement);
     } else {
       // Otherwise, we are replacing a node with a representation change.
       // Such a substitution must be done after all lowering is done, because
-      // new nodes do not have {NodeInfo} entries, and that would confuse
-      // the representation change insertion for uses of it.
+      // changing the type could confuse the representation change
+      // insertion for uses of the node.
       replacements_.push_back(node);
       replacements_.push_back(replacement);
     }

test/mjsunit/compiler/regress-452427.js

+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var stdlib = {};
+var foreign = {};
+var heap = new ArrayBuffer(64 * 1024);
+
+var rol = (function Module(stdlib, foreign, heap) {
+  "use asm";
+  function rol() {
+    y = "a" > false;
+    return y + (1 - y);
+  }
+  return { rol: rol };
+})(stdlib, foreign, heap).rol;
+
+assertEquals(1, rol());