[turbofan] remove type-widening NaN-addition folding

Folding _ + NaN => NaN can widen type None to a constant type, which leads to floating DeadValue nodes. This CL fixes this by removing the optimization. Alternatively, we should consider removing all nodes of type None in simplified lowering.

Bug: chromium:817225
Change-Id: I2a126b360d70d3626f8a3c5e73ac72dc980ac8b3
Reviewed-on: https://chromium-review.googlesource.com/946129Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51699}

src/compiler/machine-operator-reducer.cc

@@ -352,10 +352,6 @@ Reduction MachineOperatorReducer::Reduce(Node* node) {
     }
     case IrOpcode::kFloat64Add: {
       Float64BinopMatcher m(node);
-      if (m.right().IsNaN()) {  // x + NaN => NaN
-        // Do some calculation to make a signalling NaN quiet.
-        return ReplaceFloat64(m.right().Value() - m.right().Value());
-      }
       if (m.IsFoldable()) {  // K + K => K
         return ReplaceFloat64(m.left().Value() + m.right().Value());
       }

test/mjsunit/compiler/regress-817225.js

+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+//
+// Flags: --allow-natives-syntax
+
+function inlined(abort, n, a, b) {
+  if (abort) return;
+  var x = a ? true : "" + a;
+  if (!a) {
+    var y = n + y + 10;
+    if(!b) {
+      x = y;
+    }
+    if (x) {
+      x = false;
+    }
+  }
+  return x + 1;
+}
+inlined();
+function optimized(abort, a, b) {
+  return inlined(abort, "abc", a, b);
+}
+optimized(true);
+%OptimizeFunctionOnNextCall(optimized);
+optimized();