[turbofan] Fix lowering of Number.isNaN().

src/compiler/js-builtin-reducer.cc

 // Copyright 2014 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/compiler/js-builtin-reducer.h"
 
 #include "src/base/bits.h"
 #include "src/code-factory.h"
 #include "src/compilation-dependencies.h"
 #include "src/compiler/access-builder.h"
@@ skipping 1495 matching lines @@
     Node* value = graph()->NewNode(simplified()->NumberEqual(), diff,
                                    jsgraph()->ZeroConstant());
     return Replace(value);
   }
   return NoChange();
 }
 
 // ES6 section 20.1.2.4 Number.isNaN ( number )
 Reduction JSBuiltinReducer::ReduceNumberIsNaN(Node* node) {
   JSCallReduction r(node);
+  if (r.InputsMatchZero()) {
+    // Number.isNaN() -> #false
+    Node* value = jsgraph()->FalseConstant();
+    return Replace(value);
+  }
   // Number.isNaN(a:number) -> ObjectIsNaN(a)
   Node* input = r.GetJSCallInput(0);
   Node* value = graph()->NewNode(simplified()->ObjectIsNaN(), input);
   return Replace(value);
 }
 
 // ES6 section 20.1.2.5 Number.isSafeInteger ( number )
 Reduction JSBuiltinReducer::ReduceNumberIsSafeInteger(Node* node) {
   JSCallReduction r(node);
   if (r.InputsMatchOne(type_cache_.kSafeInteger)) {
@@ skipping 748 matching lines @@
   return jsgraph()->simplified();
 }
 
 JSOperatorBuilder* JSBuiltinReducer::javascript() const {
   return jsgraph()->javascript();
 }
 
 }  // namespace compiler
 }  // namespace internal
 }  // namespace v8