Revert "[turbofan] Add new JSFrameSpecialization reducer."

src/compiler/typer.cc

 // Copyright 2014 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/compiler/typer.h"
 
 #include "src/base/flags.h"
 #include "src/base/lazy-instance.h"
 #include "src/bootstrapper.h"
 #include "src/compiler/graph-reducer.h"
@@ skipping 564 matching lines @@
   Type::FunctionType* function_type = typer_->function_type();
   if (function_type != nullptr && param >= 0 &&
       param < static_cast<int>(function_type->Arity())) {
     return Bounds(Type::None(), function_type->Parameter(param));
   }
   return Bounds::Unbounded(zone());
 }
 
 
 Bounds Typer::Visitor::TypeOsrValue(Node* node) {
+  if (node->InputAt(0)->opcode() == IrOpcode::kOsrLoopEntry) {
+    // Before deconstruction, OSR values have type {None} to avoid polluting
+    // the types of phis and other nodes in the graph.
+    return Bounds(Type::None(), Type::None());
+  }
+  if (NodeProperties::IsTyped(node)) {
+    // After deconstruction, OSR values may have had a type explicitly set.
+    return NodeProperties::GetBounds(node);
+  }
+  // Otherwise, be conservative.
   return Bounds::Unbounded(zone());
 }
 
 
 Bounds Typer::Visitor::TypeInt32Constant(Node* node) {
   double number = OpParameter<int32_t>(node);
   return Bounds(Type::Intersect(
       Type::Range(number, number, zone()), Type::UntaggedSigned32(), zone()));
 }
 
@@ skipping 1775 matching lines @@
       TYPED_ARRAYS(TYPED_ARRAY_CASE)
 #undef TYPED_ARRAY_CASE
     }
   }
   return Type::Constant(value, zone());
 }
 
 }  // namespace compiler
 }  // namespace internal
 }  // namespace v8