MIPS: Do the qNaN fixup at de-serialization time.

src/runtime.js

 // Copyright 2006-2008 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 29 matching lines @@
 */
 
 // The following declarations are shared with other native JS files.
 // They are all declared at this one spot to avoid redeclaration errors.
 var $Object = global.Object;
 var $Array = global.Array;
 var $String = global.String;
 var $Number = global.Number;
 var $Function = global.Function;
 var $Boolean = global.Boolean;
-var $NaN = 0/0;
+var $NaN = %GetRootNan();
 var builtins = this;
 
 // ECMA-262 Section 11.9.3.
 function EQUALS(y) {
   if (IS_STRING(this) && IS_STRING(y)) return %StringEquals(this, y);
   var x = this;
 
   while (true) {
     if (IS_NUMBER(x)) {
       while (true) {
@@ skipping 597 matching lines @@
   throw %MakeTypeError('cannot_convert_to_primitive', []);
 }
 
 
 // NOTE: Setting the prototype for Array must take place as early as
 // possible due to code generation for array literals.  When
 // generating code for a array literal a boilerplate array is created
 // that is cloned when running the code.  It is essential that the
 // boilerplate gets the right prototype.
 %FunctionSetPrototype($Array, new $Array(0));