Fix typed lowering to number comparison.

test/mjsunit/regress/regress-3564.js

 // Copyright 2014 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // Flags: --allow-natives-syntax
 
 function MyWrapper(v) {
   return { valueOf: function() { return v } };
 }
 
 function f() {
-  assertEquals("truex", true + "x");
-  assertEquals("truey", true + new String("y"));
-  assertEquals("truez", true + new MyWrapper("z"));
+  assertTrue("a" < "x");
+  assertTrue("a" < new String("y"));
+  assertTrue("a" < new MyWrapper("z"));
 
-  assertEquals("xtrue", "x" + true);
-  assertEquals("ytrue", new String("y") + true);
-  assertEquals("ztrue", new MyWrapper("z") + true);
+  assertFalse("a" > "x");
+  assertFalse("a" > new String("y"));
+  assertFalse("a" > new MyWrapper("z"));
 }
 
 f();
 f();
 %OptimizeFunctionOnNextCall(f);
 f();