[turbofan] Fix lowering of Number.isNaN().

BUG=v8:6082
R=yangguo@chromium.org

Review-Url: https://codereview.chromium.org/2743183003
Cr-Commit-Position: refs/heads/master@{#43735}

src/compiler/js-builtin-reducer.cc

@@ -1513,6 +1513,11 @@ Reduction JSBuiltinReducer::ReduceNumberIsInteger(Node* node) {
 // ES6 section 20.1.2.4 Number.isNaN ( number )
 Reduction JSBuiltinReducer::ReduceNumberIsNaN(Node* node) {
   JSCallReduction r(node);
+  if (r.InputsMatchZero()) {
+    // Number.isNaN() -> #false
+    Node* value = jsgraph()->FalseConstant();
+    return Replace(value);
+  }
   // Number.isNaN(a:number) -> ObjectIsNaN(a)
   Node* input = r.GetJSCallInput(0);
   Node* value = graph()->NewNode(simplified()->ObjectIsNaN(), input);

test/mjsunit/regress/regress-6082.js

+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function foo() { return Number.isNaN(); }
+assertFalse(foo());
+assertFalse(foo());
+%OptimizeFunctionOnNextCall(foo);
+assertFalse(foo());