[turbofan] Introduce TruncateTaggedPointerToBit operator.

src/compiler/representation-change.cc

Index: src/compiler/representation-change.cc
diff --git a/src/compiler/representation-change.cc b/src/compiler/representation-change.cc
index 4b4f8c91c65e0cd8b36ac548077125939e160ba5..6b532702958eda40cc9af09c70939e59580aa5fb 100644
--- a/src/compiler/representation-change.cc
+++ b/src/compiler/representation-change.cc
@@ -725,7 +725,14 @@ Node* RepresentationChanger::GetBitRepresentationFor(
       // true is the only trueish Oddball.
       op = simplified()->ChangeTaggedToBit();
     } else {
-      op = simplified()->TruncateTaggedToBit();
+      if (output_rep == MachineRepresentation::kTagged &&
+          output_type->Maybe(Type::SignedSmall())) {
+        op = simplified()->TruncateTaggedToBit();
+      } else {
+        // The {output_type} either doesn't include the Smi range,
+        // or the {output_rep} is known to be TaggedPointer.
+        op = simplified()->TruncateTaggedPointerToBit();
+      }
     }
   } else if (output_rep == MachineRepresentation::kTaggedSigned) {
     node = jsgraph()->graph()->NewNode(machine()->WordEqual(), node,