Revert of [turbofan] Remove the leftover LoadBuffer hacks.

src/compiler/change-lowering.cc

 // Copyright 2014 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/compiler/change-lowering.h"
 
 #include "src/address-map.h"
 #include "src/code-factory.h"
 #include "src/compiler/js-graph.h"
 #include "src/compiler/linkage.h"
@@ skipping 157 matching lines @@
 Reduction ChangeLowering::ChangeBoolToBit(Node* value) {
   return Replace(graph()->NewNode(machine()->WordEqual(), value,
                                   jsgraph()->TrueConstant()));
 }
 
 
 Reduction ChangeLowering::ChangeFloat64ToTagged(Node* value, Node* control) {
   Type* const value_type = NodeProperties::GetType(value);
   Node* const value32 = graph()->NewNode(
       machine()->TruncateFloat64ToInt32(TruncationMode::kRoundToZero), value);
-  if (value_type->Is(Type::Signed32())) {
-    return ChangeInt32ToTagged(value32, control);
-  }
+  // TODO(bmeurer): This fast case must be disabled until we kill the asm.js
+  // support in the generic JavaScript pipeline, because LoadBuffer is lying
+  // about its result.
+  // if (value_type->Is(Type::Signed32())) {
+  //   return ChangeInt32ToTagged(value32, control);
+  // }
   Node* check_same = graph()->NewNode(
       machine()->Float64Equal(), value,
       graph()->NewNode(machine()->ChangeInt32ToFloat64(), value32));
   Node* branch_same = graph()->NewNode(common()->Branch(), check_same, control);
 
   Node* if_smi = graph()->NewNode(common()->IfTrue(), branch_same);
   Node* vsmi;
   Node* if_box = graph()->NewNode(common()->IfFalse(), branch_same);
   Node* vbox;
 
@@ skipping 576 matching lines @@
 }
 
 
 MachineOperatorBuilder* ChangeLowering::machine() const {
   return jsgraph()->machine();
 }
 
 }  // namespace compiler
 }  // namespace internal
 }  // namespace v8