[Interpreter] Collect NumberOrOddball feedback in CompareOps.

src/globals.h

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef V8_GLOBALS_H_
 #define V8_GLOBALS_H_
 
 #include <stddef.h>
 #include <stdint.h>
 
@@ skipping 1223 matching lines @@
     kNumber = 0x3,
     kNumberOrOddball = 0x7,
     kString = 0x8,
     kAny = 0x1F
   };
 };
 
 // Type feedback is encoded in such a way that, we can combine the feedback
 // at different points by performing an 'OR' operation. Type feedback moves
 // to a more generic type when we combine feedback.
-// kSignedSmall -> kNumber  -> kAny
-//                 kString  -> kAny
+// kSignedSmall -> kNumber  -> kNumberOrOddball -> kAny
+//                             kString          -> kAny
 // TODO(epertoso): consider unifying this with BinaryOperationFeedback.
 class CompareOperationFeedback {
  public:
   enum {
     kNone = 0x00,
     kSignedSmall = 0x01,
     kNumber = 0x3,
-    kString = 0x4,
-    kAny = 0xf
+    kNumberOrOddball = 0x7,
+    kString = 0x8,
+    kAny = 0x1F
   };
 };
 
 // Describes how exactly a frame has been dropped from stack.
 enum LiveEditFrameDropMode {
   // No frame has been dropped.
   LIVE_EDIT_FRAMES_UNTOUCHED,
   // The top JS frame had been calling debug break slot stub. Patch the
   // address this stub jumps to in the end.
   LIVE_EDIT_FRAME_DROPPED_IN_DEBUG_SLOT_CALL,
@@ skipping 43 matching lines @@
 }  // namespace internal
 }  // namespace v8
 
 // Used by js-builtin-reducer to identify whether ReduceArrayIterator() is
 // reducing a JSArray method, or a JSTypedArray method.
 enum class ArrayIteratorKind { kArray, kTypedArray };
 
 namespace i = v8::internal;
 
 #endif  // V8_GLOBALS_H_