[turbofan] Switch equality check for constant fields to SameValue.

The current NumberEqual check ignores -0 when it is stored to
a constant unboxed double field containing 0.

Bug: v8:9113
Change-Id: I7eb59ca8af09ab7317da3c6ce9c9cedad81f6cae
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1561317Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Jaroslav Sevcik <jarin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#60771}

src/compiler/js-native-context-specialization.cc

@@ -2320,8 +2320,8 @@ JSNativeContextSpecialization::BuildPropertyStore(
           Node* current_value = effect = graph()->NewNode(
               simplified()->LoadField(field_access), storage, effect, control);
 
-          Node* check = graph()->NewNode(simplified()->NumberEqual(),
-                                         current_value, value);
+          Node* check =
+              graph()->NewNode(simplified()->SameValue(), current_value, value);
           effect = graph()->NewNode(
               simplified()->CheckIf(DeoptimizeReason::kWrongValue), check,
               effect, control);

test/mjsunit/compiler/regress-v8-9113.js

+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+let dummy = { x : 0.1 };
+
+let o = { x : 0 };
+
+function f(o, v) {
+  o.x = v;
+}
+
+f(o, 0);
+f(o, 0);
+assertEquals(Infinity, 1 / o.x);
+%OptimizeFunctionOnNextCall(f);
+f(o, -0);
+assertEquals(-Infinity, 1 / o.x);