[turbofan] Make Factory::NewNumber() always return the minus_zero_value.

src/ic/ic.cc

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/v8.h"
 
 #include "src/accessors.h"
 #include "src/api.h"
 #include "src/arguments.h"
 #include "src/base/bits.h"
@@ skipping 2481 matching lines @@
   BinaryOpICState state(isolate(), target()->extra_ic_state());
 
   // Compute the actual result using the builtin for the binary operation.
   Object* builtin = isolate()->js_builtins_object()->javascript_builtin(
       TokenToJSBuiltin(state.op()));
   Handle<JSFunction> function = handle(JSFunction::cast(builtin), isolate());
   Handle<Object> result;
   ASSIGN_RETURN_ON_EXCEPTION(
       isolate(), result, Execution::Call(isolate(), function, left, 1, &right),
       Object);
+  if (result->IsHeapNumber()) {
+    // If the result of this BinaryOpIC is used as left or right hand side of
+    // another binary operation, full-codegen.cc might have decided that its
+    // safe to reuse the double box returned by this BinaryOpIC, but the builtin
+    // above does not know or care about this fact and might return a canonical
+    // value (i.e. the global minus zero constant), which we would then
+    // overwrite in the surrounding binary operation. So to be safe, we need to
+    // take a copy of heap numbers here.
+    result = isolate()->factory()->NewHeapNumber(result->Number());
+  }
+  DCHECK(!result.is_identical_to(isolate()->factory()->nan_value()));
+  DCHECK(!result.is_identical_to(isolate()->factory()->infinity_value()));
+  DCHECK(!result.is_identical_to(isolate()->factory()->minus_zero_value()));
 
   // Execution::Call can execute arbitrary JavaScript, hence potentially
   // update the state of this very IC, so we must update the stored state.
   UpdateTarget();
   // Compute the new state.
   BinaryOpICState old_state(isolate(), target()->extra_ic_state());
   state.Update(left, right, result);
 
   // Check if we have a string operation here.
   Handle<Code> target;
@@ skipping 465 matching lines @@
 static const Address IC_utilities[] = {
 #define ADDR(name) FUNCTION_ADDR(name),
     IC_UTIL_LIST(ADDR) NULL
 #undef ADDR
 };
 
 
 Address IC::AddressFromUtilityId(IC::UtilityId id) { return IC_utilities[id]; }
 }
 }  // namespace v8::internal