Workaround to avoid generic lowering breaking branches.

src/compiler/js-generic-lowering.cc

Index: src/compiler/js-generic-lowering.cc
diff --git a/src/compiler/js-generic-lowering.cc b/src/compiler/js-generic-lowering.cc
index 4d0753c4d271b2c03d5d7cedfe5848d7b546dca0..b8cf80389ca7d3c9b150da0e528fa8b93b36104a 100644
--- a/src/compiler/js-generic-lowering.cc
+++ b/src/compiler/js-generic-lowering.cc
@@ -385,9 +385,14 @@ void JSGenericLowering::ReplaceWithRuntimeCall(Node* node,
 
 
 Node* JSGenericLowering::LowerBranch(Node* node) {
-  Node* test = graph()->NewNode(machine()->WordEqual(), node->InputAt(0),
-                                jsgraph()->TrueConstant());
-  node->ReplaceInput(0, test);
+  if (!info()->is_typing_enabled()) {
+    // TODO(mstarzinger): If typing is enabled then simplified lowering will
+    // have inserted the correct ChangeBoolToBit, otherwise we need to perform
+    // poor-man's representation inference here and insert manual change.
+    Node* test = graph()->NewNode(machine()->WordEqual(), node->InputAt(0),
+                                  jsgraph()->TrueConstant());
+    node->ReplaceInput(0, test);
+  }
   return node;
 }