[turbofan] Test coverage for SpeculativeNumberAdd/Subtract in SimplifiedLowering.

This adds missing test coverage for corner cases of SpeculativeNumberAdd
and SpeculativeNumberSubtract inside of SimplifiedLowering. This was
discovered to be untested by the coverage bot.

Bug: v8:8015
Change-Id: I7355b1b840a76bc12bd911adb6c2d88f05d816c5
Reviewed-on: https://chromium-review.googlesource.com/1236256
Reviewed-by: Sigurd Schneider <sigurds@chromium.org>
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#56090}

test/mjsunit/compiler/number-add.js

@@ -31,3 +31,32 @@
   %OptimizeFunctionOnNextCall(bar);
   assertEquals(2, bar(3));
 })();
+
+// This tests that SpeculativeNumberAdd can still lower to
+// Int32Add in SimplifiedLowering, which requires some magic
+// to make sure that SpeculativeNumberAdd survives to that
+// point, especially the JSTypedLowering needs to be unable
+// to tell that the inputs to SpeculativeNumberAdd are non
+// String primitives.
+(function() {
+  // We need a function that has a + with feedback Number or
+  // NumberOrOddball, but for whose inputs the JSTypedLowering
+  // cannot reduce it to NumberAdd (with SpeculativeToNumber
+  // conversions). We achieve this utilizing an object literal
+  // indirection here.
+  function baz(x) {
+    return {x}.x + x;
+  }
+  baz(null);
+  baz(undefined);
+
+  // Now we just need to truncate the result.
+  function foo(x) {
+    return baz(1) | 0;
+  }
+
+  assertEquals(2, foo());
+  assertEquals(2, foo());
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(2, foo());
+})();

test/mjsunit/compiler/number-subtract.js

@@ -0,0 +1,34 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+// This tests that SpeculativeNumberSubtract can still lower to
+// Int32Sub in SimplifiedLowering, which requires some magic
+// to make sure that SpeculativeNumberSubtract survives to that
+// point, especially the JSTypedLowering needs to be unable
+// to tell that the inputs to SpeculativeNumberAdd are not
+// Number, Undefined, Null or Boolean.
+(function() {
+  // We need a function that has a - with feedback Number or
+  // NumberOrOddball, but for whose inputs the JSTypedLowering
+  // cannot reduce it to NumberSubtract (with SpeculativeToNumber
+  // conversions). We achieve this utilizing an object literal
+  // indirection here.
+  function baz(x) {
+    return {x}.x - x;
+  }
+  baz(null);
+  baz(undefined);
+
+  // Now we just need to truncate the result.
+  function foo(x) {
+    return baz(42) | 0;
+  }
+
+  assertEquals(0, foo());
+  assertEquals(0, foo());
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(0, foo());
+})();