[turbofan] Introduce dedicated NumberConvertHoleNaN simplified operator.

src/compiler/js-native-context-specialization.cc

 // Copyright 2015 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/compiler/js-native-context-specialization.h"
 
 #include "src/accessors.h"
 #include "src/code-factory.h"
 #include "src/compilation-dependencies.h"
 #include "src/compiler/access-builder.h"
@@ skipping 772 matching lines @@
           // Deoptimize in case of the hole.
           this_control = this_effect =
               graph()->NewNode(common()->DeoptimizeIf(), check, frame_state,
                                this_effect, this_control);
         }
         // Rename the result to represent the actual type (not polluted by the
         // hole).
         this_value = graph()->NewNode(simplified()->TypeGuard(element_type),
                                       this_value, this_control);
       } else if (elements_kind == FAST_HOLEY_DOUBLE_ELEMENTS) {
-        // Perform the hole check on the result.
-        Node* check =
-            graph()->NewNode(simplified()->NumberIsHoleNaN(), this_value);
         // Check if we are allowed to return the hole directly.
         Type* initial_holey_array_type = Type::Class(
             handle(isolate()->get_initial_js_array_map(elements_kind)),
             graph()->zone());
         if (receiver_type->NowIs(initial_holey_array_type) &&
             isolate()->IsFastArrayConstructorPrototypeChainIntact()) {
           // Add a code dependency on the array protector cell.
           AssumePrototypesStable(receiver_type, native_context,
                                  isolate()->initial_object_prototype());
           dependencies()->AssumePropertyCell(factory()->array_protector());
           // Turn the hole into undefined.
-          this_value = graph()->NewNode(
-              common()->Select(MachineRepresentation::kTagged,
-                               BranchHint::kFalse),
-              check, jsgraph()->UndefinedConstant(), this_value);
+          this_value = graph()->NewNode(simplified()->NumberConvertHoleNaN(),
+                                        this_value);
         } else {
+          // Perform the hole check on the result.
+          Node* check =
+              graph()->NewNode(simplified()->NumberIsHoleNaN(), this_value);
           // Deoptimize in case of the hole.
           this_control = this_effect =
               graph()->NewNode(common()->DeoptimizeIf(), check, frame_state,
                                this_effect, this_control);
         }
       }
     } else {
       DCHECK_EQ(AccessMode::kStore, access_mode);
       if (IsFastSmiElementsKind(elements_kind)) {
         Node* check = graph()->NewNode(simplified()->ObjectIsSmi(), this_value);
@@ skipping 302 matching lines @@
 }
 
 
 SimplifiedOperatorBuilder* JSNativeContextSpecialization::simplified() const {
   return jsgraph()->simplified();
 }
 
 }  // namespace compiler
 }  // namespace internal
 }  // namespace v8