[turbofan] Work-around stack overflow in zlib.

src/compiler/js-typed-lowering.cc

 // Copyright 2014 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/compiler/access-builder.h"
 #include "src/compiler/graph-inl.h"
 #include "src/compiler/js-builtin-reducer.h"
 #include "src/compiler/js-typed-lowering.h"
 #include "src/compiler/node-aux-data-inl.h"
 #include "src/compiler/node-properties-inl.h"
@@ skipping 538 matching lines @@
   if (input_type->Is(Type::String())) {
     // JSToBoolean(x:string) => BooleanNot(NumberEqual(x.length, #0))
     FieldAccess access = AccessBuilder::ForStringLength();
     Node* length = graph()->NewNode(simplified()->LoadField(access), input,
                                     graph()->start(), graph()->start());
     Node* cmp = graph()->NewNode(simplified()->NumberEqual(), length,
                                  jsgraph()->ZeroConstant());
     Node* inv = graph()->NewNode(simplified()->BooleanNot(), cmp);
     return ReplaceWith(inv);
   }
-  if (input->opcode() == IrOpcode::kPhi && input_type->Is(Type::Primitive())) {
-    // JSToBoolean(phi(x1,...,xn):primitive)
+  // TODO(turbofan): We need some kinda of PrimitiveToBoolean simplified
+  // operator, then we can do the pushing in the SimplifiedOperatorReducer
+  // and do not need to protect against stack overflow (because of backedges
+  // in phis) below.
+  if (input->opcode() == IrOpcode::kPhi &&
+      input_type->Is(
+          Type::Union(Type::Boolean(), Type::OrderedNumber(), zone()))) {
+    // JSToBoolean(phi(x1,...,xn):ordered-number|boolean)
     //   => phi(JSToBoolean(x1),...,JSToBoolean(xn))
     int input_count = input->InputCount() - 1;
     Node** inputs = zone()->NewArray<Node*>(input_count + 1);
     for (int i = 0; i < input_count; ++i) {
       Node* value = input->InputAt(i);
+      Type* value_type = NodeProperties::GetBounds(value).upper;
       // Recursively try to reduce the value first.
-      Reduction result = ReduceJSToBooleanInput(value);
+      Reduction result = (value_type->Is(Type::Boolean()) ||
+                          value_type->Is(Type::OrderedNumber()))
+                             ? ReduceJSToBooleanInput(value)
+                             : NoChange();
       if (result.Changed()) {
         inputs[i] = result.replacement();
       } else {
         inputs[i] = graph()->NewNode(javascript()->ToBoolean(), value,
                                      jsgraph()->ZeroConstant(),
                                      graph()->start(), graph()->start());
       }
     }
     inputs[input_count] = input->InputAt(input_count);
     Node* phi = graph()->NewNode(common()->Phi(kMachAnyTagged, input_count),
@@ skipping 167 matching lines @@
       return JSBuiltinReducer(jsgraph()).Reduce(node);
     default:
       break;
   }
   return NoChange();
 }
 
 }  // namespace compiler
 }  // namespace internal
 }  // namespace v8