[turbofan] Fix inconsistent treatment of SpeculativeToNumber.

This is a partial revert of e583fc83.
The reasoning here is that the treatment of SpeculativeToNumber[hint]
was not consistent (which led to the original bug that caused the
performance regression): The semantics of the operator is that it turns
its input into a number, and might bailout if the input is too complex
to accomplish that within optimized code. It can use the hint to handle
even fewer cases without the risk of a deoptimization loop. However it
cannot rely on the hint influencing the output, especially not before
SimplifiedLowering ran. The code for the OOB element access however
relied on the hint being enforced, which caused the original bug.

This CL repairs that and instead uses CheckSmi for the OOB element
access guard.

Also-By: tebbi@chromium.org
Bug: chromium:819298, chromium:820729
Change-Id: I9b2170ccf9b5561d698c0108e93e538cac1e708c
Reviewed-on: https://chromium-review.googlesource.com/961066Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51924}

src/compiler/js-native-context-specialization.cc

@@ -2246,13 +2246,11 @@ JSNativeContextSpecialization::BuildElementAccess(
 
     if (load_mode == LOAD_IGNORE_OUT_OF_BOUNDS ||
         store_mode == STORE_NO_TRANSITION_IGNORE_OUT_OF_BOUNDS) {
-      // Only check that the {index} is in Signed32 range. We do the actual
+      // Only check that the {index} is in SignedSmall range. We do the actual
       // bounds check below and just skip the property access if it's out of
       // bounds for the {receiver}.
       index = effect = graph()->NewNode(
-          simplified()->SpeculativeToNumber(NumberOperationHint::kSigned32,
-                                            VectorSlotPair()),
-          index, effect, control);
+          simplified()->CheckSmi(VectorSlotPair()), index, effect, control);
 
       // Cast the {index} to Unsigned32 range, so that the bounds checks
       // below are performed on unsigned values, which means that all the

src/compiler/typed-optimization.cc

@@ -504,30 +504,10 @@ Reduction TypedOptimization::ReduceSpeculativeToNumber(Node* node) {
   DCHECK_EQ(IrOpcode::kSpeculativeToNumber, node->opcode());
   Node* const input = NodeProperties::GetValueInput(node, 0);
   Type* const input_type = NodeProperties::GetType(input);
-  switch (NumberOperationParametersOf(node->op()).hint()) {
-    case NumberOperationHint::kSigned32:
-      if (input_type->Is(Type::Signed32())) {
-        // SpeculativeToNumber(x:signed32) => x
-        ReplaceWithValue(node, input);
-        return Replace(input);
-      }
-      break;
-    case NumberOperationHint::kSignedSmall:
-    case NumberOperationHint::kSignedSmallInputs:
-      if (input_type->Is(Type::SignedSmall())) {
-        // SpeculativeToNumber(x:signed-small) => x
-        ReplaceWithValue(node, input);
-        return Replace(input);
-      }
-      break;
-    case NumberOperationHint::kNumber:
-    case NumberOperationHint::kNumberOrOddball:
-      if (input_type->Is(Type::Number())) {
-        // SpeculativeToNumber(x:number) => x
-        ReplaceWithValue(node, input);
-        return Replace(input);
-      }
-      break;
+  if (input_type->Is(Type::Number())) {
+    // SpeculativeToNumber(x:number) => x
+    ReplaceWithValue(node, input);
+    return Replace(input);
   }
   return NoChange();
 }