[turbofan] Fix NumberIsHoleNaN to check the upper word.

test/mjsunit/compiler/regress-number-is-hole-nan.js

Index: test/mjsunit/compiler/regress-number-is-hole-nan.js
diff --git a/test/mjsunit/regress/regress-crbug-476477-2.js b/test/mjsunit/compiler/regress-number-is-hole-nan.js
similarity index 56%
copy from test/mjsunit/regress/regress-crbug-476477-2.js
copy to test/mjsunit/compiler/regress-number-is-hole-nan.js
index 4dbb41b7d4ced16b488f6e1d00f184446bd41368..368c8371637664598ab76a7b4d02887fce633515 100644
--- a/test/mjsunit/regress/regress-crbug-476477-2.js
+++ b/test/mjsunit/compiler/regress-number-is-hole-nan.js
@@ -4,13 +4,11 @@
 
 // Flags: --allow-natives-syntax
 
-function foo(x) {
-  var s = Math.floor(x / 3600);
-  Math.floor(s);
-  return s % 24;
-}
+var a = [, 2.121736758e-314];
 
-foo(12345678);
-foo(12345678);
+function foo() { return a[1]; }
+
+assertEquals(2.121736758e-314, foo());
+assertEquals(2.121736758e-314, foo());
 %OptimizeFunctionOnNextCall(foo);
-foo(12345678);
+assertEquals(2.121736758e-314, foo());