[WIP] NumberToString operator in TF.

src/compiler/js-builtin-reducer.cc

Index: src/compiler/js-builtin-reducer.cc
diff --git a/src/compiler/js-builtin-reducer.cc b/src/compiler/js-builtin-reducer.cc
index 868ae7b0b3cb0411e35084c6bad2f9325dc39c90..15b6d174687157544ab8c1a7c3d058d6aff3bfa4 100644
--- a/src/compiler/js-builtin-reducer.cc
+++ b/src/compiler/js-builtin-reducer.cc
@@ -529,6 +529,56 @@ Reduction JSBuiltinReducer::ReduceNumberParseInt(Node* node) {
   return NoChange();
 }
 
+namespace {
+
+Node* GetNumberWitness(Node* node) {
+  Node* receiver = NodeProperties::GetValueInput(node, 1);
+  Type* receiver_type = NodeProperties::GetType(receiver);
+  Node* effect = NodeProperties::GetEffectInput(node);
+  if (receiver_type->Is(Type::Number())) return receiver;
+  // Check if the {node} is dominated by a CheckNumber renaming for
+  // it's {receiver}, and if so use that renaming as {receiver} for
+  // the lowering below.
+  for (Node* dominator = effect;;) {
+    if (dominator->opcode() == IrOpcode::kCheckNumber &&
+        dominator->InputAt(0) == receiver) {
+      return dominator;
+    }
+    if (dominator->op()->EffectInputCount() != 1) {
+      // Didn't find any appropriate CheckNumber node.
+      return nullptr;
+    }
+    dominator = NodeProperties::GetEffectInput(dominator);
+  }
+}
+
+}  // namespace
+
+// 20.1.3.6 Number.prototype.toString ( [ radix ] )
+Reduction JSBuiltinReducer::ReduceNumberToString(Node* node) {
+  if (Node* receiver = GetNumberWitness(node)) {
+    // Determine the optional {radix} parameter.
+    Node* radix = node->op()->ValueInputCount() > 2
+                      ? NodeProperties::GetValueInput(node, 2)
+                      : jsgraph()->Constant(10);
+    Type* radix_type = NodeProperties::GetType(radix);
+    if (radix_type->Is(Type::Undefined())) {
+      radix = jsgraph()->Constant(10.0);
+      radix_type = type_cache_.kSingletonTen;
+    }
+    if (radix_type->Is(Type::Unsigned32())) {
+      if (radix_type->Min() >= 2.0 && radix_type->Max() <= 36.0) {
+        // Return the String representation of the Number {receiver}
+        // according to the given {radix}.
+        Node* value =
+            graph()->NewNode(simplified()->NumberToString(), receiver, radix);
+        return Replace(value);
+      }
+    }
+  }
+  return NoChange();
+}
+
 // ES6 section 21.1.2.1 String.fromCharCode ( ...codeUnits )
 Reduction JSBuiltinReducer::ReduceStringFromCharCode(Node* node) {
   JSCallReduction r(node);
@@ -851,6 +901,9 @@ Reduction JSBuiltinReducer::Reduce(Node* node) {
     case kNumberParseInt:
       reduction = ReduceNumberParseInt(node);
       break;
+    case kNumberToString:
+      reduction = ReduceNumberToString(node);
+      break;
     case kStringFromCharCode:
       reduction = ReduceStringFromCharCode(node);
       break;