[interpreter] Properly collect rhs feedback for comparisons with oddballs.

src/interpreter/interpreter.cc

 // Copyright 2015 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/interpreter/interpreter.h"
 
 #include <fstream>
 #include <memory>
 
 #include "src/ast/prettyprinter.h"
@@ skipping 1063 matching lines @@
                         __ Int32Constant(CompareOperationFeedback::kNumber)));
         __ Goto(&update_feedback);
 
         __ Bind(&rhs_is_not_number);
         {
           Node* rhs_instance_type = __ LoadInstanceType(rhs);
           Node* rhs_is_oddball =
               __ Word32Equal(rhs_instance_type, __ Int32Constant(ODDBALL_TYPE));
           __ GotoUnless(rhs_is_oddball, &rhs_is_not_oddball);
 
-          var_type_feedback.Bind(
-              __ Int32Constant(CompareOperationFeedback::kNumberOrOddball));
-          __ Goto(&do_compare);
+          var_type_feedback.Bind(__ Word32Or(
+              var_type_feedback.value(),
+              __ Int32Constant(CompareOperationFeedback::kNumberOrOddball)));
+          __ Goto(&update_feedback);
 
           __ Bind(&rhs_is_not_oddball);
           {
             Node* rhs_type =
                 __ Select(__ IsStringInstanceType(rhs_instance_type),
                           __ Int32Constant(CompareOperationFeedback::kString),
                           __ Int32Constant(CompareOperationFeedback::kAny));
             var_type_feedback.Bind(
                 __ Word32Or(var_type_feedback.value(), rhs_type));
             __ Goto(&update_feedback);
@@ skipping 1665 matching lines @@
   __ StoreObjectField(generator, JSGeneratorObject::kContinuationOffset,
       __ SmiTag(new_state));
   __ SetAccumulator(old_state);
 
   __ Dispatch();
 }
 
 }  // namespace interpreter
 }  // namespace internal
 }  // namespace v8