[crankshaft] Fix invalid ToNumber optimization.

src/crankshaft/hydrogen.h

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef V8_CRANKSHAFT_HYDROGEN_H_
 #define V8_CRANKSHAFT_HYDROGEN_H_
 
 #include "src/accessors.h"
 #include "src/allocation.h"
 #include "src/ast/ast.h"
@@ skipping 1300 matching lines @@
                                    ElementsKind kind,
                                    HValue* length);
 
   void BuildTransitionElementsKind(HValue* object,
                                    HValue* map,
                                    ElementsKind from_kind,
                                    ElementsKind to_kind,
                                    bool is_jsarray);
 
   HValue* BuildNumberToString(HValue* object, Type* type);
-  HValue* BuildToNumber(HValue* input, Type* input_type);
+  HValue* BuildToNumber(HValue* input);
   HValue* BuildToObject(HValue* receiver);
 
   void BuildJSObjectCheck(HValue* receiver,
                           int bit_field_mask);
 
   // Checks a key value that's being used for a keyed element access context. If
   // the key is a index, i.e. a smi or a number in a unique string with a cached
   // numeric value, the "true" of the continuation is joined. Otherwise,
   // if the key is a name or a unique string, the "false" of the continuation is
   // joined. Otherwise, a deoptimization is triggered. In both paths of the
@@ skipping 1691 matching lines @@
 
  private:
   HGraphBuilder* builder_;
 };
 
 
 }  // namespace internal
 }  // namespace v8
 
 #endif  // V8_CRANKSHAFT_HYDROGEN_H_