[compiler] Fix OperationTyper::NumberAbs.

I made a mistake in yesterday's cleanup.

R=jarin@chromium.org

Bug: chromium:783051
Change-Id: Iabd7403096197ce8e54d46e079bc9a70aa98578d
Reviewed-on: https://chromium-review.googlesource.com/758765
Commit-Queue: Georg Neis <neis@chromium.org>
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49266}

src/compiler/operation-typer.cc

@@ -284,6 +284,9 @@ Type* OperationTyper::NumberAbs(Type* type) {
   DCHECK(type->Is(Type::Number()));
   if (type->IsNone()) return type;
 
+  bool const maybe_nan = type->Maybe(Type::NaN());
+  bool const maybe_minuszero = type->Maybe(Type::MinusZero());
+
   type = Type::Intersect(type, Type::PlainNumber(), zone());
   if (!type->IsNone()) {
     double const max = type->Max();
@@ -298,10 +301,10 @@ Type* OperationTyper::NumberAbs(Type* type) {
     }
   }
 
-  if (type->Maybe(Type::NaN())) {
+  if (maybe_minuszero) {
     type = Type::Union(type, cache_.kSingletonZero, zone());
   }
-  if (type->Maybe(Type::MinusZero())) {
+  if (maybe_nan) {
     type = Type::Union(type, Type::NaN(), zone());
   }
   return type;

test/mjsunit/regress/regress-783051.js

+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function f() { return Math.abs([][0]); }
+f();
+%OptimizeFunctionOnNextCall(f);
+f();