AuroraMiddleware/v8
1
0
Fork 0
Code Issues 2 Pull Requests Releases Wiki Activity

[turbofan] Fix lowering of Number.isNaN().

Browse Source 
BUG=v8:6082
R=yangguo@chromium.org

Review-Url: https://codereview.chromium.org/2743183003
Cr-Commit-Position: refs/heads/master@{#43735}
This commit is contained in:
bmeurer 2017-03-13 00:00:59 -07:00 committed by Commit bot
parent 35b06c51a4
commit 9bee8f1065
2 changed files with 16 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
src/compiler/js-builtin-reducer.cc
View File

@ -1513,6 +1513,11 @@ Reduction JSBuiltinReducer::ReduceNumberIsInteger(Node* node) {
// ES6 section 20.1.2.4 Number.isNaN ( number )
Reduction JSBuiltinReducer::ReduceNumberIsNaN(Node* node) {
JSCallReduction r(node);
if (r.InputsMatchZero()) {
// Number.isNaN() -> #false
Node* value = jsgraph()->FalseConstant();
return Replace(value);
}
// Number.isNaN(a:number) -> ObjectIsNaN(a)
Node* input = r.GetJSCallInput(0);
Node* value = graph()->NewNode(simplified()->ObjectIsNaN(), input);

11
test/mjsunit/regress/regress-6082.js Normal file
View File

@ -0,0 +1,11 @@
// Copyright 2017 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --allow-natives-syntax
function foo() { return Number.isNaN(); }
assertFalse(foo());
assertFalse(foo());
%OptimizeFunctionOnNextCall(foo);
assertFalse(foo());