[crankshaft] Fix invalid ToNumber optimization.

src/crankshaft/hydrogen.cc

 // Copyright 2013 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/crankshaft/hydrogen.h"
 
 #include <sstream>
 
 #include "src/allocation-site-scopes.h"
 #include "src/ast/ast-numbering.h"
@@ skipping 2032 matching lines @@
     Add<HPushArguments>(object);
     Push(Add<HCallRuntime>(
             Runtime::FunctionForId(Runtime::kNumberToStringSkipCache),
             1));
   }
   if_found.End();
 
   return Pop();
 }
 
-
-HValue* HGraphBuilder::BuildToNumber(HValue* input, Type* input_type) {
-  if (input->type().IsTaggedNumber() || input_type->Is(Type::Number())) {
+HValue* HGraphBuilder::BuildToNumber(HValue* input) {
+  if (input->type().IsTaggedNumber()) {
     return input;
   }
   Callable callable = CodeFactory::ToNumber(isolate());
   HValue* stub = Add<HConstant>(callable.code());
   HValue* values[] = {context(), input};
   HCallWithDescriptor* instr =
       Add<HCallWithDescriptor>(stub, 0, callable.descriptor(),
                                Vector<HValue*>(values, arraysize(values)));
   instr->set_type(HType::TaggedNumber());
   return instr;
@@ skipping 9008 matching lines @@
 
     // Fallback to using the string add stub.
     return AddUncasted<HStringAdd>(
         left, right, allocation_mode.GetPretenureMode(), STRING_ADD_CHECK_NONE,
         allocation_mode.feedback_site());
   }
 
   // Special case for +x here.
   if (op == Token::MUL) {
     if (left->EqualsInteger32Constant(1)) {
-      return BuildToNumber(right, right_type);
+      return BuildToNumber(right);
     }
     if (right->EqualsInteger32Constant(1)) {
-      return BuildToNumber(left, left_type);
+      return BuildToNumber(left);
     }
   }
 
   if (graph()->info()->IsStub()) {
     left = EnforceNumberType(left, left_type);
     right = EnforceNumberType(right, right_type);
   }
 
   Representation result_rep = RepresentationFor(result_type);
 
@@ skipping 1202 matching lines @@
                                Vector<HValue*>(values, arraysize(values)));
   return ast_context()->ReturnInstruction(result, call->id());
 }
 
 
 void HOptimizedGraphBuilder::GenerateToNumber(CallRuntime* call) {
   DCHECK_EQ(1, call->arguments()->length());
   CHECK_ALIVE(VisitForValue(call->arguments()->at(0)));
   Callable callable = CodeFactory::ToNumber(isolate());
   HValue* input = Pop();
-  Type* input_type = Type::Any();
-  HValue* result = BuildToNumber(input, input_type);
+  HValue* result = BuildToNumber(input);
   if (result->HasObservableSideEffects()) {
     if (!ast_context()->IsEffect()) Push(result);
     Add<HSimulate>(call->id(), REMOVABLE_SIMULATE);
     if (!ast_context()->IsEffect()) result = Pop();
   }
   return ast_context()->ReturnValue(result);
 }
 
 
 void HOptimizedGraphBuilder::GenerateIsJSProxy(CallRuntime* call) {
@@ skipping 1150 matching lines @@
     isolate()->GetHTracer()->TraceHydrogen(name(), graph_);
   }
 
 #ifdef DEBUG
   graph_->Verify(false);  // No full verify.
 #endif
 }
 
 }  // namespace internal
 }  // namespace v8