[turbofan] Handle all oddballs in OddballToNumber

Bug: chromium:931664

R=neis@chromium.org

Change-Id: I4ad8e79b9b64898034d72264e968fc0cd01909b9
Reviewed-on: https://chromium-review.googlesource.com/c/1477050
Commit-Queue: Maya Lekova <mslekova@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#59650}

src/compiler/js-heap-broker.cc

@@ -2426,26 +2426,26 @@ bool ObjectRef::BooleanValue() const {
   return IsSmi() ? (AsSmi() != 0) : data()->AsHeapObject()->boolean_value();
 }
 
-double ObjectRef::OddballToNumber() const {
+Maybe<double> ObjectRef::OddballToNumber() const {
   OddballType type = AsHeapObject().map().oddball_type();
 
   switch (type) {
     case OddballType::kBoolean: {
       ObjectRef true_ref(broker(),
                          broker()->isolate()->factory()->true_value());
-      return this->equals(true_ref) ? 1 : 0;
+      return this->equals(true_ref) ? Just(1.0) : Just(0.0);
       break;
     }
     case OddballType::kUndefined: {
-      return std::numeric_limits<double>::quiet_NaN();
+      return Just(std::numeric_limits<double>::quiet_NaN());
       break;
     }
     case OddballType::kNull: {
-      return 0;
+      return Just(0.0);
       break;
     }
     default: {
-      UNREACHABLE();
+      return Nothing<double>();
       break;
     }
   }

src/compiler/js-heap-broker.h

@@ -121,7 +121,7 @@ class ObjectRef {
   bool IsNullOrUndefined() const;
 
   bool BooleanValue() const;
-  double OddballToNumber() const;
+  Maybe<double> OddballToNumber() const;
 
   Isolate* isolate() const;
 

src/compiler/js-typed-lowering.cc

@@ -959,8 +959,9 @@ Reduction JSTypedLowering::ReduceJSToNumberInput(Node* input) {
   }
   if (input_type.IsHeapConstant()) {
     HeapObjectRef input_value = input_type.AsHeapConstant()->Ref();
-    if (input_value.map().oddball_type() != OddballType::kNone) {
-      return Replace(jsgraph()->Constant(input_value.OddballToNumber()));
+    double value;
+    if (input_value.OddballToNumber().To(&value)) {
+      return Replace(jsgraph()->Constant(value));
     }
   }
   if (input_type.Is(Type::Number())) {

src/compiler/typed-optimization.cc

@@ -747,8 +747,9 @@ Reduction TypedOptimization::ReduceJSToNumberInput(Node* input) {
   }
   if (input_type.IsHeapConstant()) {
     HeapObjectRef input_value = input_type.AsHeapConstant()->Ref();
-    if (input_value.map().oddball_type() != OddballType::kNone) {
-      return Replace(jsgraph()->Constant(input_value.OddballToNumber()));
+    double value;
+    if (input_value.OddballToNumber().To(&value)) {
+      return Replace(jsgraph()->Constant(value));
     }
   }
   if (input_type.Is(Type::Number())) {

test/mjsunit/regress/regress-crbug-931664.js

+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function opt(){
+  for(l in('a')){
+    try{
+      for(a in('')) {
+        for(let arg2 in(+(arg2)));
+      }
+    }
+    finally{}
+  }
+}
+opt();
+%OptimizeFunctionOnNextCall(opt);
+opt();