Fix typed lowering of ToBoolean on NaN input.

src/types.h

 // Copyright 2014 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef V8_TYPES_H_
 #define V8_TYPES_H_
 
 #include "src/factory.h"
 #include "src/handles.h"
 #include "src/ostreams.h"
@@ skipping 175 matching lines @@
   V(Function,            1 << 17 | REPRESENTATION(kTaggedPtr)) \
   V(RegExp,              1 << 18 | REPRESENTATION(kTaggedPtr)) \
   V(OtherObject,         1 << 19 | REPRESENTATION(kTaggedPtr)) \
   V(Proxy,               1 << 20 | REPRESENTATION(kTaggedPtr)) \
   V(Internal,            1 << 21 | REPRESENTATION(kTagged | kUntagged)) \
   \
   V(SignedSmall,         kUnsignedSmall | kOtherSignedSmall) \
   V(Signed32,            kSignedSmall | kOtherUnsigned31 | kOtherSigned32) \
   V(Unsigned32,          kUnsignedSmall | kOtherUnsigned31 | kOtherUnsigned32) \
   V(Integral32,          kSigned32 | kUnsigned32) \
-  V(Number,              kIntegral32 | kMinusZero | kNaN | kOtherNumber) \
+  V(OrderedNumber,       kIntegral32 | kMinusZero | kOtherNumber) \
+  V(Number,              kOrderedNumber | kNaN) \
   V(String,              kInternalizedString | kOtherString) \
   V(UniqueName,          kSymbol | kInternalizedString) \
   V(Name,                kSymbol | kString) \
   V(NumberOrString,      kNumber | kString) \
   V(Primitive,           kNumber | kName | kBoolean | kNull | kUndefined) \
   V(DetectableObject,    kArray | kFunction | kRegExp | kOtherObject) \
   V(DetectableReceiver,  kDetectableObject | kProxy) \
   V(Detectable,          kDetectableReceiver | kNumber | kName) \
   V(Object,              kDetectableObject | kUndetectable) \
   V(Receiver,            kObject | kProxy) \
@@ skipping 788 matching lines @@
   bool Narrows(BoundsImpl that) {
     return that.lower->Is(this->lower) && this->upper->Is(that.upper);
   }
 };
 
 typedef BoundsImpl<ZoneTypeConfig> Bounds;
 
 } }  // namespace v8::internal
 
 #endif  // V8_TYPES_H_