Add fast check for NaN in NumberCompare slow case.

src/runtime.js

 // Copyright 2006-2008 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 110 matching lines @@
   if (IS_STRING(this) && IS_STRING(x)) {
     return %StringCompare(this, x);
   }
 
   // Default implementation.
   var a = %ToPrimitive(this, NUMBER_HINT);
   var b = %ToPrimitive(x, NUMBER_HINT);
   if (IS_STRING(a) && IS_STRING(b)) {
     return %StringCompare(a, b);
   } else {
-    return %NumberCompare(%ToNumber(a), %ToNumber(b), ncr);
+    var a_number = %ToNumber(a);
+    var b_number = %ToNumber(b);
+    if (NUMBER_IS_NAN(a_number) || NUMBER_IS_NAN(b_number)) return ncr;
+    return %NumberCompare(a_number, b_number, ncr);
   }
 }
 
 
 
 /* -----------------------------------
    - - -   A r i t h m e t i c   - - -
    -----------------------------------
 */
 
@@ skipping 452 matching lines @@
   throw %MakeTypeError('cannot_convert_to_primitive', []);
 }
 
 
 // NOTE: Setting the prototype for Array must take place as early as
 // possible due to code generation for array literals.  When
 // generating code for a array literal a boilerplate array is created
 // that is cloned when running the code.  It is essiential that the
 // boilerplate gets the right prototype.
 %FunctionSetPrototype($Array, new $Array(0));