[turbofan] Also recognize 'type' === typeof x.

So far we only recognized

  typeof x == 'type'
  typeof x != 'type'
  typeof x === 'type'
  typeof x !== 'type'

but some people seem to prefer it the other way around, i.e.

  'type' == typeof x
  'type' != typeof x
  'type' === typeof x
  'type' !== typeof x

as spotted in some Ember.js code, so we should obviously handle that as
well and reduce it to a quick check on x instead of calling the TypeOf
builtin and comparing the resulting string.

R=ishell@chromium.org
BUG=v8:5267

Review-Url: https://codereview.chromium.org/2642743003
Cr-Commit-Position: refs/heads/master@{#42478}

src/compiler/js-typed-lowering.cc

@@ -872,28 +872,37 @@ Reduction JSTypedLowering::ReduceJSTypeOf(Node* node) {
 }
 
 Reduction JSTypedLowering::ReduceJSEqualTypeOf(Node* node, bool invert) {
+  Node* input;
+  Handle<String> type;
   HeapObjectBinopMatcher m(node);
   if (m.left().IsJSTypeOf() && m.right().HasValue() &&
       m.right().Value()->IsString()) {
-    Node* replacement;
-    Node* input = m.left().InputAt(0);
-    Handle<String> value = Handle<String>::cast(m.right().Value());
-    if (String::Equals(value, factory()->boolean_string())) {
-      replacement =
+    input = m.left().InputAt(0);
+    type = Handle<String>::cast(m.right().Value());
+  } else if (m.right().IsJSTypeOf() && m.left().HasValue() &&
+             m.left().Value()->IsString()) {
+    input = m.right().InputAt(0);
+    type = Handle<String>::cast(m.left().Value());
+  } else {
+    return NoChange();
+  }
+  Node* value;
+  if (String::Equals(type, factory()->boolean_string())) {
+    value =
         graph()->NewNode(common()->Select(MachineRepresentation::kTagged),
-                           graph()->NewNode(simplified()->ReferenceEqual(),
-                                            input, jsgraph()->TrueConstant()),
+                         graph()->NewNode(simplified()->ReferenceEqual(), input,
+                                          jsgraph()->TrueConstant()),
                          jsgraph()->TrueConstant(),
-                           graph()->NewNode(simplified()->ReferenceEqual(),
-                                            input, jsgraph()->FalseConstant()));
-    } else if (String::Equals(value, factory()->function_string())) {
-      replacement = graph()->NewNode(simplified()->ObjectIsCallable(), input);
-    } else if (String::Equals(value, factory()->number_string())) {
-      replacement = graph()->NewNode(simplified()->ObjectIsNumber(), input);
-    } else if (String::Equals(value, factory()->string_string())) {
-      replacement = graph()->NewNode(simplified()->ObjectIsString(), input);
-    } else if (String::Equals(value, factory()->undefined_string())) {
-      replacement = graph()->NewNode(
+                         graph()->NewNode(simplified()->ReferenceEqual(), input,
+                                          jsgraph()->FalseConstant()));
+  } else if (String::Equals(type, factory()->function_string())) {
+    value = graph()->NewNode(simplified()->ObjectIsCallable(), input);
+  } else if (String::Equals(type, factory()->number_string())) {
+    value = graph()->NewNode(simplified()->ObjectIsNumber(), input);
+  } else if (String::Equals(type, factory()->string_string())) {
+    value = graph()->NewNode(simplified()->ObjectIsString(), input);
+  } else if (String::Equals(type, factory()->undefined_string())) {
+    value = graph()->NewNode(
         common()->Select(MachineRepresentation::kTagged),
         graph()->NewNode(simplified()->ReferenceEqual(), input,
                          jsgraph()->NullConstant()),
@@ -903,12 +912,10 @@ Reduction JSTypedLowering::ReduceJSEqualTypeOf(Node* node, bool invert) {
     return NoChange();
   }
   if (invert) {
-      replacement = graph()->NewNode(simplified()->BooleanNot(), replacement);
+    value = graph()->NewNode(simplified()->BooleanNot(), value);
   }
-    ReplaceWithValue(node, replacement);
-    return Replace(replacement);
-  }
-  return NoChange();
+  ReplaceWithValue(node, value);
+  return Replace(value);
 }
 
 Reduction JSTypedLowering::ReduceJSEqual(Node* node, bool invert) {