Fix typed lowering of ToBoolean on NaN input.

src/compiler/js-typed-lowering.cc

 // Copyright 2014 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/compiler/access-builder.h"
 #include "src/compiler/graph-inl.h"
 #include "src/compiler/js-typed-lowering.h"
 #include "src/compiler/node-aux-data-inl.h"
 #include "src/compiler/node-properties-inl.h"
 #include "src/types.h"
@@ skipping 398 matching lines @@
     // Recursively try to reduce the input first.
     Reduction result = ReduceJSToNumberInput(input->InputAt(0));
     if (result.Changed()) {
       RelaxEffects(input);
       return result;
     }
     return Changed(input);  // JSToNumber(JSToNumber(x)) => JSToNumber(x)
   }
   Type* input_type = NodeProperties::GetBounds(input).upper;
   if (input_type->Is(Type::Number())) {
-    // JSToNumber(number) => x
+    // JSToNumber(x:number) => x
     return Changed(input);
   }
   if (input_type->Is(Type::Undefined())) {
     // JSToNumber(undefined) => #NaN
     return ReplaceWith(jsgraph()->NaNConstant());
   }
   if (input_type->Is(Type::Null())) {
     // JSToNumber(null) => #0
     return ReplaceWith(jsgraph()->ZeroConstant());
   }
-  // TODO(turbofan): js-typed-lowering of ToNumber(boolean)
-  // TODO(turbofan): js-typed-lowering of ToNumber(string)
+  // TODO(turbofan): js-typed-lowering of ToNumber(x:boolean)
+  // TODO(turbofan): js-typed-lowering of ToNumber(x:string)
   return NoChange();
 }
 
 
 Reduction JSTypedLowering::ReduceJSToStringInput(Node* input) {
   if (input->opcode() == IrOpcode::kJSToString) {
     // Recursively try to reduce the input first.
     Reduction result = ReduceJSToStringInput(input->InputAt(0));
     if (result.Changed()) {
       RelaxEffects(input);
       return result;
     }
     return Changed(input);  // JSToString(JSToString(x)) => JSToString(x)
   }
   Type* input_type = NodeProperties::GetBounds(input).upper;
   if (input_type->Is(Type::String())) {
-    return Changed(input);  // JSToString(string) => x
+    return Changed(input);  // JSToString(x:string) => x
   }
   if (input_type->Is(Type::Undefined())) {
     return ReplaceWith(jsgraph()->HeapConstant(
         graph()->zone()->isolate()->factory()->undefined_string()));
   }
   if (input_type->Is(Type::Null())) {
     return ReplaceWith(jsgraph()->HeapConstant(
         graph()->zone()->isolate()->factory()->null_string()));
   }
-  // TODO(turbofan): js-typed-lowering of ToString(boolean)
-  // TODO(turbofan): js-typed-lowering of ToString(number)
+  // TODO(turbofan): js-typed-lowering of ToString(x:boolean)
+  // TODO(turbofan): js-typed-lowering of ToString(x:number)
   return NoChange();
 }
 
 
 Reduction JSTypedLowering::ReduceJSToBooleanInput(Node* input) {
   if (input->opcode() == IrOpcode::kJSToBoolean) {
     // Recursively try to reduce the input first.
     Reduction result = ReduceJSToBooleanInput(input->InputAt(0));
     if (result.Changed()) {
       RelaxEffects(input);
       return result;
     }
     return Changed(input);  // JSToBoolean(JSToBoolean(x)) => JSToBoolean(x)
   }
   Type* input_type = NodeProperties::GetBounds(input).upper;
   if (input_type->Is(Type::Boolean())) {
-    return Changed(input);  // JSToBoolean(boolean) => x
+    return Changed(input);  // JSToBoolean(x:boolean) => x
   }
   if (input_type->Is(Type::Undefined())) {
     // JSToBoolean(undefined) => #false
     return ReplaceWith(jsgraph()->FalseConstant());
   }
   if (input_type->Is(Type::Null())) {
     // JSToBoolean(null) => #false
     return ReplaceWith(jsgraph()->FalseConstant());
   }
   if (input_type->Is(Type::DetectableReceiver())) {
-    // JSToBoolean(detectable) => #true
+    // JSToBoolean(x:detectable) => #true
     return ReplaceWith(jsgraph()->TrueConstant());
   }
   if (input_type->Is(Type::Undetectable())) {
-    // JSToBoolean(undetectable) => #false
+    // JSToBoolean(x:undetectable) => #false
     return ReplaceWith(jsgraph()->FalseConstant());
   }
-  if (input_type->Is(Type::Number())) {
-    // JSToBoolean(number) => BooleanNot(NumberEqual(x, #0))
+  if (input_type->Is(Type::OrderedNumber())) {
+    // JSToBoolean(x:ordered-number) => BooleanNot(NumberEqual(x, #0))
     Node* cmp = graph()->NewNode(simplified()->NumberEqual(), input,
                                  jsgraph()->ZeroConstant());
     Node* inv = graph()->NewNode(simplified()->BooleanNot(), cmp);
     return ReplaceWith(inv);
   }
   // TODO(turbofan): js-typed-lowering of ToBoolean(string)
   return NoChange();
 }
 
 
@@ skipping 116 matching lines @@
     case IrOpcode::kJSMultiply:
       return ReduceNumberBinop(node, simplified()->NumberMultiply());
     case IrOpcode::kJSDivide:
       return ReduceNumberBinop(node, simplified()->NumberDivide());
     case IrOpcode::kJSModulus:
       return ReduceNumberBinop(node, simplified()->NumberModulus());
     case IrOpcode::kJSUnaryNot: {
       Reduction result = ReduceJSToBooleanInput(node->InputAt(0));
       Node* value;
       if (result.Changed()) {
-        // JSUnaryNot(x) => BooleanNot(x)
+        // JSUnaryNot(x:boolean) => BooleanNot(x)
         value =
             graph()->NewNode(simplified()->BooleanNot(), result.replacement());
         NodeProperties::ReplaceWithValue(node, value);
         return Changed(value);
       } else {
         // JSUnaryNot(x) => BooleanNot(JSToBoolean(x))
         value = graph()->NewNode(simplified()->BooleanNot(), node);
         node->set_op(javascript()->ToBoolean());
         NodeProperties::ReplaceWithValue(node, value, node);
         // Note: ReplaceUses() smashes all uses, so smash it back here.
@@ skipping 16 matching lines @@
       return ReduceJSStoreProperty(node);
     default:
       break;
   }
   return NoChange();
 }
 
 }  // namespace compiler
 }  // namespace internal
 }  // namespace v8