AuroraMiddleware/v8
1
0
Fork 0
Code Issues 2 Pull Requests Releases Wiki Activity

[array] Fix Array#map storing signaling NaNs

Browse Source 
Bug: chromium:930948
Change-Id: I7567fec06ec4bad11e8b8336ac13fdfc225b632c
Reviewed-on: https://chromium-review.googlesource.com/c/1466503
Reviewed-by: Michael Stanton <mvstanton@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Mathias Bynens <mathias@chromium.org>
Commit-Queue: Sigurd Schneider <sigurds@chromium.org>
Cr-Commit-Position: refs/heads/master@{#59547}
This commit is contained in:
Sigurd Schneider 2019-02-12 15:48:55 +01:00 committed by Commit Bot
parent e7063b3d6b
commit 82faa6d315
5 changed files with 40 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
src/builtins/array-map.tq
View File

@ -142,7 +142,7 @@ namespace array_map {
for (let i: Smi = 0; i < validLength; i++) {
typeswitch (this.fixedArray[i]) {
case (n: Number): {
elements[i] = Convert<float64>(n);
elements[i] = Float64SilenceNaN(Convert<float64>(n));
}
case (h: HeapObject): {
assert(h == Hole);

4
src/compiler/effect-control-linearizer.cc
View File

@ -4598,7 +4598,7 @@ void EffectControlLinearizer::LowerTransitionAndStoreElement(Node* node) {
Node* float_value =
__ LoadField(AccessBuilder::ForHeapNumberValue(), value);
__ StoreElement(AccessBuilder::ForFixedDoubleArrayElement(), elements,
index, float_value);
index, __ Float64SilenceNaN(float_value));
__ Goto(&done);
}
}
@ -4664,7 +4664,7 @@ void EffectControlLinearizer::LowerTransitionAndStoreNumberElement(Node* node) {
Node* elements = __ LoadField(AccessBuilder::ForJSObjectElements(), array);
__ StoreElement(AccessBuilder::ForFixedDoubleArrayElement(), elements, index,
value);
__ Float64SilenceNaN(value));
}
void EffectControlLinearizer::LowerTransitionAndStoreNonNumberElement(

3
src/compiler/graph-assembler.h
View File

@ -39,7 +39,8 @@ namespace compiler {
V(BitcastFloat64ToInt64) \
V(Float64Abs) \
V(Word32ReverseBytes) \
V(Word64ReverseBytes)
V(Word64ReverseBytes) \
V(Float64SilenceNaN)
#define PURE_ASSEMBLER_MACH_BINOP_LIST(V) \
V(WordShl) \

10
test/mjsunit/regress/regress-crbug-930948-base.js Normal file
View File

@ -0,0 +1,10 @@
// Copyright 2019 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --verify-heap --allow-natives-syntax
function foo() {
return [undefined].map(Math.asin);
}
foo();

25
test/mjsunit/regress/regress-crbug-930948.js Normal file
View File

@ -0,0 +1,25 @@
// Copyright 2019 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --verify-heap --allow-natives-syntax
// This checks that TransitionAndStoreNumberElement silences NaNs.
function foo() {
return [undefined].map(Math.asin);
}
foo();
foo();
%OptimizeFunctionOnNextCall(foo);
foo();
// This checks that TransitionAndStoreElement silences NaNs.
function bar(b) {
return [undefined].map(x => b ? Math.asin(x) : "string");
}
bar(true);
bar(false);
bar(true);
bar(false);
%OptimizeFunctionOnNextCall(bar);
bar(true);