[turbofan] Properly check Tagged->Word32 changes.

Don't unconditionally assume that Tagged->Word32 changes are always
truncating independent of the type of the input. Work-around the
remaining issues with for-in by properly renaming the index if it's
not already of appropriate type (happens with generators or OSR).

R=jarin@chromium.org

Review-Url: https://codereview.chromium.org/2545393002
Cr-Commit-Position: refs/heads/master@{#41484}

src/compiler/js-typed-lowering.cc

@@ -2068,6 +2068,15 @@ Reduction JSTypedLowering::ReduceJSForInNext(Node* node) {
   Node* effect = NodeProperties::GetEffectInput(node);
   Node* control = NodeProperties::GetControlInput(node);
 
+  // We know that the {index} is in Unsigned32 range here, otherwise executing
+  // the JSForInNext wouldn't be valid. Unfortunately due to OSR and generators
+  // this is not always reflected in the types, hence we might need to rename
+  // the {index} here.
+  if (!NodeProperties::GetType(index)->Is(Type::Unsigned32())) {
+    index = graph()->NewNode(common()->TypeGuard(Type::Unsigned32()), index,
+                             control);
+  }
+
   // Load the next {key} from the {cache_array}.
   Node* key = effect = graph()->NewNode(
       simplified()->LoadElement(AccessBuilder::ForFixedArrayElement()),

src/compiler/representation-change.cc

@@ -634,10 +634,10 @@ Node* RepresentationChanger::GetWord32RepresentationFor(
     } else if (output_type->Is(Type::Unsigned32())) {
       op = simplified()->ChangeTaggedToUint32();
     } else if (use_info.truncation().IsUsedAsWord32()) {
-      if (use_info.type_check() != TypeCheckKind::kNone) {
-        op = simplified()->CheckedTruncateTaggedToWord32();
-      } else {
+      if (output_type->Is(Type::NumberOrOddball())) {
         op = simplified()->TruncateTaggedToWord32();
+      } else if (use_info.type_check() != TypeCheckKind::kNone) {
+        op = simplified()->CheckedTruncateTaggedToWord32();
       }
     }
   } else if (output_rep == MachineRepresentation::kWord32) {

test/cctest/compiler/test-representation-change.cc

@@ -427,7 +427,7 @@ TEST(SignednessInWord32) {
               MachineRepresentation::kFloat64, Type::Number(),
               MachineRepresentation::kWord32);
   CheckChange(IrOpcode::kCheckedTruncateTaggedToWord32,
-              MachineRepresentation::kTagged, Type::NumberOrOddball(),
+              MachineRepresentation::kTagged, Type::NonInternal(),
               MachineRepresentation::kWord32,
               UseInfo::CheckedNumberOrOddballAsWord32());