[runtime] use canonical NaN string to fit Turbofan types

Bug: chromium:1264013
Change-Id: If2e504e6713617fdc1d098da3b71ffc78a4f0eb0
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3251177
Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
Reviewed-by: Omer Katz <omerkatz@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77611}

src/heap/factory.cc

@@ -3138,6 +3138,8 @@ Handle<String> Factory::HeapNumberToString(Handle<HeapNumber> number,
   Handle<String> result;
   if (value == 0) {
     result = zero_string();
+  } else if (std::isnan(value)) {
+    result = NaN_string();
   } else {
     char arr[kNumberToStringBufferSize];
     base::Vector<char> buffer(arr, arraysize(arr));

test/mjsunit/regress/regress-crbug-1264013.js

+// Copyright 2021 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --interrupt-budget=1000 --assert-types
+
+function f(a, x) {
+  return a[x] + 1;
+}
+var b = false;
+for (var i = 0; i < 1000; ++i) {
+    var x = f(b, "bar");
+    try {
+        if (x != 43) throw "Error: bad result: " + x;
+    } catch (e) {}
+}