[turbofan] Introduce dedicated ObjectIsNaN operator.

test/unittests/compiler/js-builtin-reducer-unittest.cc

 // Copyright 2014 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/compiler/js-builtin-reducer.h"
 #include "src/compiler/js-graph.h"
 #include "src/compiler/node-properties.h"
 #include "src/compiler/simplified-operator.h"
 #include "src/compiler/typer.h"
 #include "src/isolate-inl.h"
@@ skipping 1457 matching lines @@
   Node* context = UndefinedConstant();
   Node* frame_state = graph()->start();
   TRACED_FOREACH(Type*, t0, kNumberTypes) {
     Node* p0 = Parameter(t0, 0);
     Node* call =
         graph()->NewNode(javascript()->Call(3), function, UndefinedConstant(),
                          p0, context, frame_state, effect, control);
     Reduction r = Reduce(call);
 
     ASSERT_TRUE(r.Changed());
-    EXPECT_THAT(r.replacement(), IsBooleanNot(IsNumberEqual(p0, p0)));
+    EXPECT_THAT(r.replacement(), IsObjectIsNaN(p0));
   }
 }
 
 // -----------------------------------------------------------------------------
 // Number.isSafeInteger
 
 TEST_F(JSBuiltinReducerTest, NumberIsSafeIntegerWithIntegral32) {
   Node* function = NumberFunction("isSafeInteger");
 
   Node* effect = graph()->start();
@@ skipping 90 matching lines @@
   Reduction r = Reduce(call);
 
   ASSERT_TRUE(r.Changed());
   EXPECT_THAT(r.replacement(),
               IsStringFromCharCode(IsPlainPrimitiveToNumber(p0)));
 }
 
 }  // namespace compiler
 }  // namespace internal
 }  // namespace v8