[turbofan] Handle -0 truncation in word32->float64 rep change.

This just adds the same case we already added in
https://chromium-review.googlesource.com/c/v8/v8/+/1478192
for conversions to tagged representation.

Bug: chromium:957559
Change-Id: I62a388ba47bd72d65fa07d0141362d7f1383c96e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1588428Reviewed-by: Sigurd Schneider <sigurds@chromium.org>
Commit-Queue: Jaroslav Sevcik <jarin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61115}

src/compiler/representation-change.cc

@@ -836,6 +836,8 @@ Node* RepresentationChanger::GetFloat64RepresentationFor(
          use_info.truncation().IdentifiesZeroAndMinusZero())) {
       op = machine()->ChangeInt32ToFloat64();
     } else if (output_type.Is(Type::Unsigned32()) ||
+               (output_type.Is(Type::Unsigned32OrMinusZero()) &&
+                use_info.truncation().IdentifiesZeroAndMinusZero()) ||
                use_info.truncation().IsUsedAsWord32()) {
       // Either the output is uint32 or the uses only care about the
       // low 32 bits (so we can pick uint32 safely).

test/mjsunit/compiler/regress-957559.js

+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --no-always-opt --opt
+
+
+const v0 = [];
+function f(b) {
+  for (let v13 = 0; v13 <= 3; v13 = v13 + 2241165261) {
+    for (let i = 0; i < 8; i++) {}
+    const v23 = Math.max(v13,-0.0,-2523259642);
+    const v24 = v0[v23];
+  }
+}
+
+f();
+f();
+%OptimizeFunctionOnNextCall(f);
+f();