[turbofan] Properly constant-fold JSToString with numbers.

So far we didn't properly constant-fold JSToString operators in
JSTypedLowering where the input was a known number constant.

Bug: v8:6815
Change-Id: Iac87346b7d38f0f75461f285ea7daa2d5a5e1524
Reviewed-on: https://chromium-review.googlesource.com/663358Reviewed-by: Michael Stanton <mvstanton@chromium.org>
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47972}

src/compiler/js-typed-lowering.cc

@@ -1030,6 +1030,16 @@ Reduction JSTypedLowering::ReduceJSToStringInput(Node* input) {
   if (input_type->Is(Type::Null())) {
     return Replace(jsgraph()->HeapConstant(factory()->null_string()));
   }
+  if (input_type->Is(Type::NaN())) {
+    return Replace(jsgraph()->HeapConstant(factory()->NaN_string()));
+  }
+  if (input_type->Is(Type::OrderedNumber()) &&
+      input_type->Min() == input_type->Max()) {
+    // Note that we can use Type::OrderedNumber(), since
+    // both 0 and -0 map to the String "0" in JavaScript.
+    return Replace(jsgraph()->HeapConstant(
+        factory()->NumberToString(factory()->NewNumber(input_type->Min()))));
+  }
   // TODO(turbofan): js-typed-lowering of ToString(x:number)
   return NoChange();
 }

test/mjsunit/compiler/constant-fold-tostring.js

+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --no-always-opt --opt
+
+// Check that constant-folding of ToString operations works properly for NaN.
+(function() {
+  const foo = () => `${NaN}`;
+  assertEquals("NaN", foo());
+  assertEquals("NaN", foo());
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals("NaN", foo());
+})();
+
+// Check that constant-folding of ToString operations works properly for 0/-0.
+(function() {
+  const foo = x => `${x ? 0 : -0}`;
+  assertEquals("0", foo(true));
+  assertEquals("0", foo(false));
+  assertEquals("0", foo(true));
+  assertEquals("0", foo(false));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals("0", foo(true));
+  assertEquals("0", foo(false));
+})();