Fix typed lowering of ToBoolean on NaN input.

src/compiler/js-typed-lowering.cc

Index: src/compiler/js-typed-lowering.cc
diff --git a/src/compiler/js-typed-lowering.cc b/src/compiler/js-typed-lowering.cc
index c4e7b2b7ccc75f3261b925f1ccf05e48416ef355..e77d6eebd4deeb1dd8b48ee852c2bd35dca59725 100644
--- a/src/compiler/js-typed-lowering.cc
+++ b/src/compiler/js-typed-lowering.cc
@@ -491,8 +491,8 @@ Reduction JSTypedLowering::ReduceJSToBooleanInput(Node* input) {
     // JSToBoolean(undetectable) => #false
     return ReplaceWith(jsgraph()->FalseConstant());
   }
-  if (input_type->Is(Type::Number())) {
-    // JSToBoolean(number) => BooleanNot(NumberEqual(x, #0))
+  if (input_type->Is(Type::OrderedNumber())) {
+    // JSToBoolean(ordered-number) => BooleanNot(NumberEqual(x, #0))

[rossberg, 2014/09/11 12:17:50]

s/x/ordered-number/

[Michael Starzinger, 2014/09/11 12:35:59]

Done.

     Node* cmp = graph()->NewNode(simplified()->NumberEqual(), input,
                                  jsgraph()->ZeroConstant());
     Node* inv = graph()->NewNode(simplified()->BooleanNot(), cmp);
@@ -629,7 +629,7 @@ Reduction JSTypedLowering::Reduce(Node* node) {
       Reduction result = ReduceJSToBooleanInput(node->InputAt(0));
       Node* value;
       if (result.Changed()) {
-        // JSUnaryNot(x) => BooleanNot(x)
+        // JSUnaryNot(boolean) => BooleanNot(x)

[rossberg, 2014/09/11 12:17:50]

s/x/boolean/

[Michael Starzinger, 2014/09/11 12:35:59]

Done.

         value =
             graph()->NewNode(simplified()->BooleanNot(), result.replacement());
         NodeProperties::ReplaceWithValue(node, value);