This helps with patterns such as

((a[i] + n) + m) | 0

where we know n and m are small integers, and a[i] is a holey smi
array where we have never read a hole so far.

In that case, we still perform the additions with overflow checks
since we currently only propagate/use the truncation if the operation
outcome is in the safe-integer range (without taking feedback into
account).  The problem here is that both 'n + a[i]' and '(n + a[i]) +
m' have type Union(Range(..., ...), NaN), even though the NaN will
never pass the Smi check on a[i].

This CL changes restricts the static type of 
SpeculativeSafeInteger(Add|Subtract) to the safe integer range. 
This is safe because we will always either truncate or use the feedback
(i.e., deopt if the inputs are not Signed32).  In either case, the 
result will always be in safe-integer range.

As a result, we will perform the second addition without
overflow check. Getting rid of the overflow check on the first
is done in a separate CL.

Bug: v8:5267,v8:6764
Change-Id: I27dba0fda832fc1f04477db6dd3495d5b4b2bd0b
Reviewed-on: https://chromium-review.googlesource.com/634903
Commit-Queue: Jaroslav Sevcik <jarin@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47763}