[MERGE #5717 @nhat-nguyen] Only do float type specialization if both sources are number

Merge pull request #5717 from nhat-nguyen:floattypespecfix

Fix a bug where we try to type specialize non-numbers to floats

Author: nhat-nguyen

lib/Backend/GlobOpt.cpp

@@ -10648,6 +10648,11 @@ GlobOpt::TypeSpecializeFloatBinary(IR::Instr *instr, Value *src1Val, Value *src2
         case Js::OpCode::CmGe_A:
         case Js::OpCode::CmGt_A:
         {
+            if (src1Val->GetValueInfo()->IsNotNumber() || src2Val->GetValueInfo()->IsNotNumber())
+            {
+                return false;
+            }
+
             convertDstToBool = true;
             break;
         }

test/Basics/FloatComparison.js

@@ -63,6 +63,23 @@ var tests = [
             assert.isFalse({} < 0.5);
             assert.isFalse({} <= 0.5);
         }
+    },
+    {
+        name: "No float type specialization when operands are not number",
+        body: function() {
+            function test0() {
+                var func2 = function () {
+                  return f32[1];
+                };
+                var f32 = new Float32Array();
+                var f = 100;
+                for (let i = 0; i < f; i++) {
+                    var id41 = 'caller';
+                    ({ 18: func2() === 'caller' });
+                }
+            }
+            test0();
+        }
     }
 ];