X64: Fix bug in DoBranch that miss detecting NaN as falsy.

src/x64/lithium-codegen-x64.cc

 // Copyright 2011 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 959 matching lines @@
     if (type.IsBoolean()) {
       __ Cmp(reg, Factory::true_value());
       EmitBranch(true_block, false_block, equal);
     } else if (type.IsSmi()) {
       __ SmiCompare(reg, Smi::FromInt(0));
       EmitBranch(true_block, false_block, not_equal);
     } else {
       Label* true_label = chunk_->GetAssemblyLabel(true_block);
       Label* false_label = chunk_->GetAssemblyLabel(false_block);
 
-      __ Cmp(reg, Factory::undefined_value());
+      __ CompareRoot(reg, Heap::kUndefinedValueRootIndex);
       __ j(equal, false_label);
-      __ Cmp(reg, Factory::true_value());
+      __ CompareRoot(reg, Heap::kTrueValueRootIndex);
       __ j(equal, true_label);
-      __ Cmp(reg, Factory::false_value());
+      __ CompareRoot(reg, Heap::kFalseValueRootIndex);
       __ j(equal, false_label);
       __ SmiCompare(reg, Smi::FromInt(0));
       __ j(equal, false_label);
       __ JumpIfSmi(reg, true_label);
 
-      // Test for double values. Plus/minus zero are false. NaN is handled
-      // in the stub.
+      // Test for double values. Plus/minus zero and NaN are false.
       NearLabel call_stub;
-      __ Cmp(FieldOperand(reg, HeapObject::kMapOffset),
-             Factory::heap_number_map());
+      __ CompareRoot(FieldOperand(reg, HeapObject::kMapOffset),
+                     Heap::kHeapNumberMapRootIndex);
       __ j(not_equal, &call_stub);
-      __ movq(kScratchRegister, FieldOperand(reg, HeapNumber::kValueOffset));
-      __ shl(kScratchRegister, Immediate(1));  // Shift out the sign bit.
-      __ j(zero, false_label);  // Zero or negative zero.
+
+      // HeapNumber => false iff +0, -0, or NaN. These three cases set the
+      // zero flag when compared to zero using ucomisd.
+      __ xorpd(xmm0, xmm0);
+      __ ucomisd(xmm0, FieldOperand(reg, HeapNumber::kValueOffset));
+      __ j(zero, false_label);
       __ jmp(true_label);
 
       // The conversion stub doesn't cause garbage collections so it's
       // safe to not record a safepoint after the call.
       __ bind(&call_stub);
       ToBooleanStub stub;
       __ Pushad();
       __ push(reg);
       __ CallStub(&stub);
       __ testq(rax, rax);
@@ skipping 921 matching lines @@
 
 void LCodeGen::DoOsrEntry(LOsrEntry* instr) {
   Abort("Unimplemented: %s", "DoOsrEntry");
 }
 
 #undef __
 
 } }  // namespace v8::internal
 
 #endif  // V8_TARGET_ARCH_X64