[crankshaft] Fix invalid ToNumber optimization.

[crankshaft] Fix invalid ToNumber optimization.

We cannot optimize away ToNumber conversions based on the Type that we
see in Crankshaft, as this might be the (unchecked or even pretruncated)
lower bound. We can only use the HType, which is based on the definition.

R=jkummerow@chromium.org
BUG=chromium:590989
LOG=n

Committed: https://crrev.com/0c35579093dc5e286ad89e5c7bde3aeb355def07
Cr-Commit-Position: refs/heads/master@{#34445}

[Benedikt Meurer, 2016-03-02 18:41:23]

Hey Jakob,

Here's the bugfix. The second test case fails because our awesome
Crankshaft/BinaryOpIC combo treats undefined as Number (for reason...).
Please take a look.

Thanks,
Benedikt

[Benedikt Meurer, 2016-03-02 18:42:07]

Please hit CQ if you're fine with it, looks like I'm going to spend the next
hours/days in the hospital...

[Jakob Kummerow, 2016-03-02 19:23:19]

LGTM. Thanks for the quick fix!

[Jakob Kummerow, 2016-03-02 19:23:30]

The CQ bit was checked by jkummerow@chromium.org

[commit-bot: I haz the power, 2016-03-02 19:23:39]

CQ is trying da patch. Follow status at
 https://chromium-cq-status.appspot.com/patch-status/1757013002/1
View timeline at
 https://chromium-cq-status.appspot.com/patch-timeline/1757013002/1

[commit-bot: I haz the power, 2016-03-02 19:26:19]

Committed patchset #1 (id:1)

[commit-bot: I haz the power, 2016-03-02 19:28:13]

Description was changed from

==========
[crankshaft] Fix invalid ToNumber optimization.

We cannot optimize away ToNumber conversions based on the Type that we
see in Crankshaft, as this might be the (unchecked or even pretruncated)
lower bound. We can only use the HType, which is based on the definition.

R=jkummerow@chromium.org
BUG=chromium:590989
LOG=n
==========

to

==========
[crankshaft] Fix invalid ToNumber optimization.

We cannot optimize away ToNumber conversions based on the Type that we
see in Crankshaft, as this might be the (unchecked or even pretruncated)
lower bound. We can only use the HType, which is based on the definition.

R=jkummerow@chromium.org
BUG=chromium:590989
LOG=n

Committed: https://crrev.com/0c35579093dc5e286ad89e5c7bde3aeb355def07
Cr-Commit-Position: refs/heads/master@{#34445}
==========

[commit-bot: I haz the power, 2016-03-02 19:28:14]

Patchset 1 (id:??) landed as
https://crrev.com/0c35579093dc5e286ad89e5c7bde3aeb355def07
Cr-Commit-Position: refs/heads/master@{#34445}