[turbofan] Fix typing for NumberMin and NumberMax to handle uninhabited types.

BUG=chromium:700883

Review-Url: https://codereview.chromium.org/2751513006
Cr-Commit-Position: refs/heads/master@{#43812}

src/compiler/operation-typer.cc

@@ -912,6 +912,9 @@ Type* OperationTyper::NumberImul(Type* lhs, Type* rhs) {
 Type* OperationTyper::NumberMax(Type* lhs, Type* rhs) {
   DCHECK(lhs->Is(Type::Number()));
   DCHECK(rhs->Is(Type::Number()));
+  if (!lhs->IsInhabited() || !rhs->IsInhabited()) {
+    return Type::None();
+  }
   if (lhs->Is(Type::NaN()) || rhs->Is(Type::NaN())) {
     return Type::NaN();
   }
@@ -935,6 +938,9 @@ Type* OperationTyper::NumberMax(Type* lhs, Type* rhs) {
 Type* OperationTyper::NumberMin(Type* lhs, Type* rhs) {
   DCHECK(lhs->Is(Type::Number()));
   DCHECK(rhs->Is(Type::Number()));
+  if (!lhs->IsInhabited() || !rhs->IsInhabited()) {
+    return Type::None();
+  }
   if (lhs->Is(Type::NaN()) || rhs->Is(Type::NaN())) {
     return Type::NaN();
   }

test/mjsunit/compiler/regress-700883.js

+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function add(x) {
+ return x + x;
+}
+
+add(0);
+add(1);
+%SetForceInlineFlag(add);
+
+var min = Math.min;
+function foo(x) {
+ x = x|0;
+ let y = add(x ? 800000000000 : NaN);
+ return min(y, x);
+}
+
+%OptimizeFunctionOnNextCall(foo);
+foo();