Fix typed lowering of ToBoolean on NaN input.

src/compiler/js-typed-lowering.cc

 // Copyright 2014 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/compiler/access-builder.h"
 #include "src/compiler/graph-inl.h"
 #include "src/compiler/js-typed-lowering.h"
 #include "src/compiler/node-aux-data-inl.h"
 #include "src/compiler/node-properties-inl.h"
 #include "src/types.h"
@@ skipping 455 matching lines @@
     // Recursively try to reduce the input first.
     Reduction result = ReduceJSToBooleanInput(input->InputAt(0));
     if (result.Changed()) {
       RelaxEffects(input);
       return result;
     }
     return Changed(input);  // JSToBoolean(JSToBoolean(x)) => JSToBoolean(x)
   }
   Type* input_type = NodeProperties::GetBounds(input).upper;
   if (input_type->Is(Type::Boolean())) {
     return Changed(input);  // JSToBoolean(boolean) => x

[rossberg, 2014/09/11 12:17:50]

s/x/boolean/

[Michael Starzinger, 2014/09/11 12:35:59]

Done, but with a slightly different notation as per offline discussion.

   }
   if (input_type->Is(Type::Undefined())) {
     // JSToBoolean(undefined) => #false
     return ReplaceWith(jsgraph()->FalseConstant());
   }
   if (input_type->Is(Type::Null())) {
     // JSToBoolean(null) => #false
     return ReplaceWith(jsgraph()->FalseConstant());
   }
   if (input_type->Is(Type::DetectableReceiver())) {
     // JSToBoolean(detectable) => #true
     return ReplaceWith(jsgraph()->TrueConstant());
   }
   if (input_type->Is(Type::Undetectable())) {
     // JSToBoolean(undetectable) => #false
     return ReplaceWith(jsgraph()->FalseConstant());
   }
-  if (input_type->Is(Type::Number())) {
-    // JSToBoolean(number) => BooleanNot(NumberEqual(x, #0))
+  if (input_type->Is(Type::OrderedNumber())) {
+    // JSToBoolean(ordered-number) => BooleanNot(NumberEqual(x, #0))

[rossberg, 2014/09/11 12:17:50]

s/x/ordered-number/

[Michael Starzinger, 2014/09/11 12:35:59]

Done.

     Node* cmp = graph()->NewNode(simplified()->NumberEqual(), input,
                                  jsgraph()->ZeroConstant());
     Node* inv = graph()->NewNode(simplified()->BooleanNot(), cmp);
     return ReplaceWith(inv);
   }
   // TODO(turbofan): js-typed-lowering of ToBoolean(string)
   return NoChange();
 }
 
 
@@ skipping 116 matching lines @@
     case IrOpcode::kJSMultiply:
       return ReduceNumberBinop(node, simplified()->NumberMultiply());
     case IrOpcode::kJSDivide:
       return ReduceNumberBinop(node, simplified()->NumberDivide());
     case IrOpcode::kJSModulus:
       return ReduceNumberBinop(node, simplified()->NumberModulus());
     case IrOpcode::kJSUnaryNot: {
       Reduction result = ReduceJSToBooleanInput(node->InputAt(0));
       Node* value;
       if (result.Changed()) {
-        // JSUnaryNot(x) => BooleanNot(x)
+        // JSUnaryNot(boolean) => BooleanNot(x)

[rossberg, 2014/09/11 12:17:50]

s/x/boolean/

[Michael Starzinger, 2014/09/11 12:35:59]

Done.

         value =
             graph()->NewNode(simplified()->BooleanNot(), result.replacement());
         NodeProperties::ReplaceWithValue(node, value);
         return Changed(value);
       } else {
         // JSUnaryNot(x) => BooleanNot(JSToBoolean(x))
         value = graph()->NewNode(simplified()->BooleanNot(), node);
         node->set_op(javascript()->ToBoolean());
         NodeProperties::ReplaceWithValue(node, value, node);
         // Note: ReplaceUses() smashes all uses, so smash it back here.
@@ skipping 16 matching lines @@
       return ReduceJSStoreProperty(node);
     default:
       break;
   }
   return NoChange();
 }
 
 }  // namespace compiler
 }  // namespace internal
 }  // namespace v8