[crankshaft] Fix constant folding of HDiv instruction.

R=jarin@chromium.org
TEST=mjsunit/regress/regress-crbug-662367
BUG=chromium:662367

Review-Url: https://codereview.chromium.org/2472413002
Cr-Commit-Position: refs/heads/master@{#40773}

src/crankshaft/hydrogen-instructions.cc

@@ -3578,10 +3578,12 @@ HInstruction* HDiv::New(Isolate* isolate, Zone* zone, HValue* context,
           return H_CONSTANT_INT(double_res);
         }
         return H_CONSTANT_DOUBLE(double_res);
-      } else {
+      } else if (c_left->DoubleValue() != 0) {
         int sign = Double(c_left->DoubleValue()).Sign() *
                    Double(c_right->DoubleValue()).Sign();  // Right could be -0.
         return H_CONSTANT_DOUBLE(sign * V8_INFINITY);
+      } else {
+        return H_CONSTANT_DOUBLE(std::numeric_limits<double>::quiet_NaN());
       }
     }
   }

test/mjsunit/regress/regress-crbug-662367.js

+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --fold-constants
+
+var zero = 0;
+
+function f() {
+  return 0 / zero;
+}
+assertTrue(isNaN(f()));
+assertTrue(isNaN(f()));
+%OptimizeFunctionOnNextCall(f);
+assertTrue(isNaN(f()));
+
+function g() {
+  return -0 / zero;
+}
+assertTrue(isNaN(g()));
+assertTrue(isNaN(g()));
+%OptimizeFunctionOnNextCall(g);
+assertTrue(isNaN(g()));