diff --git a/src/builtins/array-map.tq b/src/builtins/array-map.tq index eef9c69b79..5967afc8b9 100644 --- a/src/builtins/array-map.tq +++ b/src/builtins/array-map.tq @@ -142,7 +142,7 @@ namespace array_map { for (let i: Smi = 0; i < validLength; i++) { typeswitch (this.fixedArray[i]) { case (n: Number): { - elements[i] = Convert(n); + elements[i] = Float64SilenceNaN(Convert(n)); } case (h: HeapObject): { assert(h == Hole); diff --git a/src/compiler/effect-control-linearizer.cc b/src/compiler/effect-control-linearizer.cc index d641bd932f..81abb74eab 100644 --- a/src/compiler/effect-control-linearizer.cc +++ b/src/compiler/effect-control-linearizer.cc @@ -4598,7 +4598,7 @@ void EffectControlLinearizer::LowerTransitionAndStoreElement(Node* node) { Node* float_value = __ LoadField(AccessBuilder::ForHeapNumberValue(), value); __ StoreElement(AccessBuilder::ForFixedDoubleArrayElement(), elements, - index, float_value); + index, __ Float64SilenceNaN(float_value)); __ Goto(&done); } } @@ -4664,7 +4664,7 @@ void EffectControlLinearizer::LowerTransitionAndStoreNumberElement(Node* node) { Node* elements = __ LoadField(AccessBuilder::ForJSObjectElements(), array); __ StoreElement(AccessBuilder::ForFixedDoubleArrayElement(), elements, index, - value); + __ Float64SilenceNaN(value)); } void EffectControlLinearizer::LowerTransitionAndStoreNonNumberElement( diff --git a/src/compiler/graph-assembler.h b/src/compiler/graph-assembler.h index 45392c068b..c8e4517f66 100644 --- a/src/compiler/graph-assembler.h +++ b/src/compiler/graph-assembler.h @@ -39,7 +39,8 @@ namespace compiler { V(BitcastFloat64ToInt64) \ V(Float64Abs) \ V(Word32ReverseBytes) \ - V(Word64ReverseBytes) + V(Word64ReverseBytes) \ + V(Float64SilenceNaN) #define PURE_ASSEMBLER_MACH_BINOP_LIST(V) \ V(WordShl) \ diff --git a/test/mjsunit/regress/regress-crbug-930948-base.js b/test/mjsunit/regress/regress-crbug-930948-base.js new file mode 100644 index 0000000000..740f42a288 --- /dev/null +++ b/test/mjsunit/regress/regress-crbug-930948-base.js @@ -0,0 +1,10 @@ +// Copyright 2019 the V8 project authors. All rights reserved. +// Use of this source code is governed by a BSD-style license that can be +// found in the LICENSE file. + +// Flags: --verify-heap --allow-natives-syntax + +function foo() { + return [undefined].map(Math.asin); +} +foo(); diff --git a/test/mjsunit/regress/regress-crbug-930948.js b/test/mjsunit/regress/regress-crbug-930948.js new file mode 100644 index 0000000000..06dcf40646 --- /dev/null +++ b/test/mjsunit/regress/regress-crbug-930948.js @@ -0,0 +1,25 @@ +// Copyright 2019 the V8 project authors. All rights reserved. +// Use of this source code is governed by a BSD-style license that can be +// found in the LICENSE file. + +// Flags: --verify-heap --allow-natives-syntax + +// This checks that TransitionAndStoreNumberElement silences NaNs. +function foo() { + return [undefined].map(Math.asin); +} +foo(); +foo(); +%OptimizeFunctionOnNextCall(foo); +foo(); + +// This checks that TransitionAndStoreElement silences NaNs. +function bar(b) { + return [undefined].map(x => b ? Math.asin(x) : "string"); +} +bar(true); +bar(false); +bar(true); +bar(false); +%OptimizeFunctionOnNextCall(bar); +bar(true);