[crankshaft] Fix constant folding of HDiv instruction.

R=jarin@chromium.org
TEST=mjsunit/regress/regress-crbug-662367
BUG=chromium:662367

Review-Url: https://codereview.chromium.org/2486923004
Cr-Commit-Position: refs/heads/master@{#40897}

src/crankshaft/hydrogen-instructions.cc

@@ -3572,7 +3572,10 @@ HInstruction* HDiv::New(Isolate* isolate, Zone* zone, HValue* context,
     HConstant* c_left = HConstant::cast(left);
     HConstant* c_right = HConstant::cast(right);
     if ((c_left->HasNumberValue() && c_right->HasNumberValue())) {
-      if (c_right->DoubleValue() != 0) {
+      if (std::isnan(c_left->DoubleValue()) ||
+          std::isnan(c_right->DoubleValue())) {
+        return H_CONSTANT_DOUBLE(std::numeric_limits<double>::quiet_NaN());
+      } else if (c_right->DoubleValue() != 0) {
         double double_res = c_left->DoubleValue() / c_right->DoubleValue();
         if (IsInt32Double(double_res)) {
           return H_CONSTANT_INT(double_res);

test/mjsunit/regress/regress-crbug-662367.js

@@ -6,18 +6,32 @@
 
 var zero = 0;
 
-function f() {
-  return 0 / zero;
-}
-assertTrue(isNaN(f()));
-assertTrue(isNaN(f()));
-%OptimizeFunctionOnNextCall(f);
-assertTrue(isNaN(f()));
+(function ConstantFoldZeroDivZero() {
+  function f() {
+    return 0 / zero;
+  }
+  assertTrue(isNaN(f()));
+  assertTrue(isNaN(f()));
+  %OptimizeFunctionOnNextCall(f);
+  assertTrue(isNaN(f()));
+})();
 
-function g() {
-  return -0 / zero;
-}
-assertTrue(isNaN(g()));
-assertTrue(isNaN(g()));
-%OptimizeFunctionOnNextCall(g);
-assertTrue(isNaN(g()));
+(function ConstantFoldMinusZeroDivZero() {
+  function f() {
+    return -0 / zero;
+  }
+  assertTrue(isNaN(f()));
+  assertTrue(isNaN(f()));
+  %OptimizeFunctionOnNextCall(f);
+  assertTrue(isNaN(f()));
+})();
+
+(function ConstantFoldNaNDivZero() {
+  function f() {
+    return NaN / 0;
+  }
+  assertTrue(isNaN(f()));
+  assertTrue(isNaN(f()));
+  %OptimizeFunctionOnNextCall(f);
+  assertTrue(isNaN(f()));
+})();