[turbofan] NaN is never truish.

BUG=v8:4207
LOG=y
R=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/1198993009

Cr-Commit-Position: refs/heads/master@{#29230}

src/compiler/ast-graph-builder.cc

@@ -3641,8 +3641,10 @@ Node* AstGraphBuilder::BuildToBoolean(Node* input) {
   // TODO(bmeurer, mstarzinger): Refactor this into a separate optimization
   // method.
   switch (input->opcode()) {
-    case IrOpcode::kNumberConstant:
-      return jsgraph_->BooleanConstant(!NumberMatcher(input).Is(0));
+    case IrOpcode::kNumberConstant: {
+      NumberMatcher m(input);
+      return jsgraph_->BooleanConstant(!m.Is(0) && !m.IsNaN());
+    }
     case IrOpcode::kHeapConstant: {
       Handle<HeapObject> object = HeapObjectMatcher(input).Value().handle();
       return jsgraph_->BooleanConstant(object->BooleanValue());

test/mjsunit/compiler/regress-4207.js

+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function bar() { return 0/0 && 1; }
+assertEquals(NaN, bar());
+%OptimizeFunctionOnNextCall(bar);
+assertEquals(NaN, bar());
+
+function foo() { return 0/0 || 1; }
+assertEquals(1, foo());
+%OptimizeFunctionOnNextCall(foo);
+assertEquals(1, foo());