[turbofan] Fix incorrect typing rule for NumberExpm1.

The Math.expm1() function can actually return -0, for example in the
case that -0 is passed to it.

Bug: chromium:880207
Change-Id: If3a7a3a1fb6a18075ba0d7816687dfd831ebe293
Reviewed-on: https://chromium-review.googlesource.com/1205072Reviewed-by: Georg Neis <neis@chromium.org>
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#55657}

src/compiler/operation-typer.cc

@@ -417,7 +417,7 @@ Type OperationTyper::NumberExp(Type type) {
 
 Type OperationTyper::NumberExpm1(Type type) {
   DCHECK(type.Is(Type::Number()));
-  return Type::Union(Type::PlainNumber(), Type::NaN(), zone());
+  return Type::Number();
 }
 
 Type OperationTyper::NumberFloor(Type type) {

test/mjsunit/regress/regress-crbug-880207.js

+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function foo() {
+  return Object.is(Math.expm1(-0), -0);
+}
+
+assertTrue(foo());
+%OptimizeFunctionOnNextCall(foo);
+assertTrue(foo());