[turbofan] Introduce TruncateTaggedPointerToBit operator.

src/compiler/representation-change.cc

 // Copyright 2015 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/compiler/representation-change.h"
 
 #include <sstream>
 
 #include "src/base/bits.h"
 #include "src/code-factory.h"
@@ skipping 707 matching lines @@
   if (output_type->Is(Type::None())) {
     // This is an impossible value; it should not be used at runtime.
     // We just provide a dummy value here.
     return jsgraph()->Int32Constant(0);
   } else if (output_rep == MachineRepresentation::kTagged ||
              output_rep == MachineRepresentation::kTaggedPointer) {
     if (output_type->Is(Type::BooleanOrNullOrUndefined())) {
       // true is the only trueish Oddball.
       op = simplified()->ChangeTaggedToBit();
     } else {
-      op = simplified()->TruncateTaggedToBit();
+      if (output_rep == MachineRepresentation::kTagged &&
+          output_type->Maybe(Type::SignedSmall())) {
+        op = simplified()->TruncateTaggedToBit();
+      } else {
+        // The {output_type} either doesn't include the Smi range,
+        // or the {output_rep} is known to be TaggedPointer.
+        op = simplified()->TruncateTaggedPointerToBit();
+      }
     }
   } else if (output_rep == MachineRepresentation::kTaggedSigned) {
     node = jsgraph()->graph()->NewNode(machine()->WordEqual(), node,
                                        jsgraph()->IntPtrConstant(0));
     return jsgraph()->graph()->NewNode(machine()->Word32Equal(), node,
                                        jsgraph()->Int32Constant(0));
   } else if (IsWord(output_rep)) {
     node = jsgraph()->graph()->NewNode(machine()->Word32Equal(), node,
                                        jsgraph()->Int32Constant(0));
     return jsgraph()->graph()->NewNode(machine()->Word32Equal(), node,
@@ skipping 299 matching lines @@
                                      node);
 }
 
 Node* RepresentationChanger::InsertChangeUint32ToFloat64(Node* node) {
   return jsgraph()->graph()->NewNode(machine()->ChangeUint32ToFloat64(), node);
 }
 
 }  // namespace compiler
 }  // namespace internal
 }  // namespace v8