Fix typed lowering of JSAdd on non-number inputs.

test/cctest/compiler/test-js-typed-lowering.cc

 // Copyright 2014 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/v8.h"
 #include "test/cctest/cctest.h"
 
 #include "src/compiler/graph-inl.h"
 #include "src/compiler/js-typed-lowering.h"
 #include "src/compiler/node-properties-inl.h"
@@ skipping 1006 matching lines @@
 
   const Operator* ops[] = {
       R.javascript.Add(),      R.simplified.NumberAdd(),
       R.javascript.Subtract(), R.simplified.NumberSubtract(),
       R.javascript.Multiply(), R.simplified.NumberMultiply(),
       R.javascript.Divide(),   R.simplified.NumberDivide(),
       R.javascript.Modulus(),  R.simplified.NumberModulus(),
   };
 
   for (size_t j = 0; j < arraysize(ops); j += 2) {
-    BinopEffectsTester B(ops[j], Type::Number(), Type::Object());
+    BinopEffectsTester B(ops[j], Type::Number(), Type::Boolean());
 
     Node* i0 = B.CheckNoOp(0);
     Node* i1 = B.CheckConvertedInput(IrOpcode::kJSToNumber, 1, true);
 
     CHECK_EQ(B.p0, i0);
     CHECK_EQ(B.p1, i1->InputAt(0));
 
     // Effects should be ordered start -> i1 -> effect_use
     B.CheckEffectOrdering(i1);
   }
 
   for (size_t j = 0; j < arraysize(ops); j += 2) {
-    BinopEffectsTester B(ops[j], Type::Object(), Type::Number());
+    BinopEffectsTester B(ops[j], Type::Boolean(), Type::Number());
 
     Node* i0 = B.CheckConvertedInput(IrOpcode::kJSToNumber, 0, true);
     Node* i1 = B.CheckNoOp(1);
 
     CHECK_EQ(B.p0, i0->InputAt(0));
     CHECK_EQ(B.p1, i1);
 
     // Effects should be ordered start -> i0 -> effect_use
     B.CheckEffectOrdering(i0);
   }
@@ skipping 292 matching lines @@
           CHECK_EQ(p1, r->InputAt(0));
           CHECK_EQ(p0, r->InputAt(1));
         } else {
           CHECK_EQ(p0, r->InputAt(0));
           CHECK_EQ(p1, r->InputAt(1));
         }
       }
     }
   }
 }