[turbofan] Fix bug in CheckTaggedSigned lowering.

src/compiler/simplified-lowering.cc

 // Copyright 2014 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/compiler/simplified-lowering.h"
 
 #include <limits>
 
 #include "src/address-map.h"
 #include "src/base/bits.h"
@@ skipping 677 matching lines @@
     DCHECK_EQ(2, node->op()->ValueInputCount());
     return GetUpperBound(node->InputAt(0))->Is(type) &&
            GetUpperBound(node->InputAt(1))->Is(type);
   }
 
   void ConvertInput(Node* node, int index, UseInfo use) {
     Node* input = node->InputAt(index);
     // In the change phase, insert a change before the use if necessary.
     if (use.representation() == MachineRepresentation::kNone)
       return;  // No input requirement on the use.
+    DCHECK_NOT_NULL(input);
     NodeInfo* input_info = GetInfo(input);
     MachineRepresentation input_rep = input_info->representation();
     if (input_rep != use.representation() ||
         use.type_check() != TypeCheckKind::kNone) {
       // Output representation doesn't match usage.
       TRACE("  change: #%d:%s(@%d #%d:%s) ", node->id(), node->op()->mnemonic(),
             index, input->id(), input->op()->mnemonic());
       TRACE(" from ");
       PrintOutputInfo(input_info);
       TRACE(" to ");
@@ skipping 963 matching lines @@
             DeferReplacement(node, node->InputAt(0));
           }
         }
         return;
       }
       case IrOpcode::kCheckTaggedSigned: {
         if (SmiValuesAre32Bits() && truncation.TruncatesToWord32()) {
           // TODO(jarin,bmeurer): Add CheckedSignedSmallAsWord32?
           VisitUnop(node, UseInfo::CheckedSigned32AsWord32(),
                     MachineRepresentation::kWord32);
-          DeferReplacement(node, node->InputAt(0));
+          if (lower()) DeferReplacement(node, node->InputAt(0));
         } else {
           VisitUnop(node, UseInfo::AnyTagged(), MachineRepresentation::kTagged);
           if (lower()) {
             if (InputIs(node, Type::TaggedSigned())) {
               DeferReplacement(node, node->InputAt(0));
             }
           }
         }
         return;
       }
@@ skipping 1367 matching lines @@
         isolate(), graph()->zone(), callable.descriptor(), 0, flags,
         Operator::kNoProperties);
     to_number_operator_.set(common()->Call(desc));
   }
   return to_number_operator_.get();
 }
 
 }  // namespace compiler
 }  // namespace internal
 }  // namespace v8