[turbofan] Introduce a SpeculativeToNumber operator.

src/compiler/bytecode-graph-builder.cc

Index: src/compiler/bytecode-graph-builder.cc
diff --git a/src/compiler/bytecode-graph-builder.cc b/src/compiler/bytecode-graph-builder.cc
index d2267f7fa2605dfa5609e7fdf3fae3330930e6ae..49afab5537f0ce9ea59b23141c44c0dd0d271351 100644
--- a/src/compiler/bytecode-graph-builder.cc
+++ b/src/compiler/bytecode-graph-builder.cc
@@ -2034,8 +2034,7 @@ void BytecodeGraphBuilder::VisitToNumber() {
   Node* node = nullptr;
   FeedbackSlot slot =
       feedback_vector()->ToSlot(bytecode_iterator().GetIndexOperand(1));
-  if (Node* simplified = TryBuildSimplifiedBinaryOp(
-          javascript()->Multiply(), object, jsgraph()->OneConstant(), slot)) {
+  if (Node* simplified = TryBuildSimplifiedToNumber(object, slot)) {
     node = simplified;
   } else {
     node = NewNode(javascript()->ToNumber(), object);
@@ -2462,6 +2461,19 @@ Node* BytecodeGraphBuilder::TryBuildSimplifiedBinaryOp(const Operator* op,
   return nullptr;
 }
 
+Node* BytecodeGraphBuilder::TryBuildSimplifiedToNumber(Node* value,
+                                                       FeedbackSlot slot) {
+  Node* effect = environment()->GetEffectDependency();
+  Node* control = environment()->GetControlDependency();
+  Reduction early_reduction = type_hint_lowering().ReduceToNumberOperation(
+      value, effect, control, slot);
+  if (early_reduction.Changed()) {
+    ApplyEarlyReduction(early_reduction);
+    return early_reduction.replacement();
+  }
+  return nullptr;
+}
+
 Node* BytecodeGraphBuilder::TryBuildSimplifiedLoadNamed(const Operator* op,
                                                         Node* receiver,
                                                         FeedbackSlot slot) {