[turbofan] Introduce a SpeculativeToNumber operator.

src/compiler/loop-variable-optimizer.cc

 // Copyright 2016 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/compiler/loop-variable-optimizer.h"
 
 #include "src/compiler/common-operator.h"
 #include "src/compiler/graph.h"
 #include "src/compiler/node-marker.h"
 #include "src/compiler/node-properties.h"
@@ skipping 299 matching lines @@
     arithmeticType = InductionVariable::ArithmeticType::kAddition;
   } else if (arith->opcode() == IrOpcode::kJSSubtract ||
              arith->opcode() == IrOpcode::kSpeculativeNumberSubtract) {
     arithmeticType = InductionVariable::ArithmeticType::kSubtraction;
   } else {
     return nullptr;
   }
 
   // TODO(jarin) Support both sides.
   if (arith->InputAt(0) != phi) {
-    if (arith->InputAt(0)->opcode() != IrOpcode::kJSToNumber ||
+    if ((arith->InputAt(0)->opcode() != IrOpcode::kJSToNumber &&
+         arith->InputAt(0)->opcode() != IrOpcode::kSpeculativeToNumber) ||
         arith->InputAt(0)->InputAt(0) != phi) {
       return nullptr;
     }
   }
   Node* incr = arith->InputAt(1);
   return new (zone())
       InductionVariable(phi, arith, incr, initial, zone(), arithmeticType);
 }
 
 void LoopVariableOptimizer::DetectInductionVariables(Node* loop) {
@@ skipping 69 matching lines @@
                                         backedge_value, backedge_control);
         induction_var->phi()->ReplaceInput(1, rename);
       }
     }
   }
 }
 
 }  // namespace compiler
 }  // namespace internal
 }  // namespace v8