Enforce strict weak ordering on NaN frequencies

src/compiler/js-inlining-heuristic.cc

 // Copyright 2015 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/compiler/js-inlining-heuristic.h"
 
 #include "src/compilation-info.h"
 #include "src/compiler/common-operator.h"
 #include "src/compiler/node-matchers.h"
 #include "src/compiler/simplified-operator.h"
@@ skipping 288 matching lines @@
       cumulative_count_ += function->shared()->ast_node_count();
     }
   }
 
   return Replace(value);
 }
 
 bool JSInliningHeuristic::CandidateCompare::operator()(
     const Candidate& left, const Candidate& right) const {
   if (right.frequency.IsUnknown()) {
+    if (left.frequency.IsUnknown()) {
+      // If left and right are both unknown then the ordering is indeterminate,
+      // which breaks strict weak ordering requirements, so we fall back to the
+      // node id as a tie breaker.
+      return left.node->id() > right.node->id();
+    }
     return true;
   } else if (left.frequency.IsUnknown()) {
     return false;
   } else if (left.frequency.value() > right.frequency.value()) {
     return true;
   } else if (left.frequency.value() < right.frequency.value()) {
     return false;
   } else {
     return left.node->id() > right.node->id();
   }
@@ skipping 23 matching lines @@
   return jsgraph()->common();
 }
 
 SimplifiedOperatorBuilder* JSInliningHeuristic::simplified() const {
   return jsgraph()->simplified();
 }
 
 }  // namespace compiler
 }  // namespace internal
 }  // namespace v8