v8/test/mjsunit/es7
Caitlin Potter 4cd8a8b784 [builtins] fix slow-path handling of -Infinity in ArrayIncludes
This is a speculative fix, but I believe it might work.

Idea is to keep `start_from` as a double while establishing an appropriate
index to begin iteration. This should keep -Infinity intact rather than
converting it to a positive high value, which would break the algorithm.
This is similar to what had been implemented on the fast path before it was
changed to send non-Smis to the slow path.

BUG=v8:5986
R=bmeurer@chromium.org, cbruni@chromium.org, machenbach@chromium.org, adamk@chromium.org

Change-Id: I9965fd2e75a8972f3f1c7a18e51bd580030a66ea
Reviewed-on: https://chromium-review.googlesource.com/445857
Commit-Queue: Caitlin Potter <caitp@igalia.com>
Reviewed-by: Adam Klein <adamk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43358}
2017-02-21 23:31:39 +00:00
..
regress [builtins] fix incorrect return value in ArrayIncludes 2017-02-20 14:41:25 +00:00
array-includes-receiver.js Reland [builtins] implement Array.prototype.includes in TurboFan 2016-08-03 03:27:43 +00:00
array-includes-to-object-sloppy.js Remove --harmony-array-includes flag 2015-12-12 01:04:10 +00:00
array-includes-to-object-strict.js Remove --harmony-array-includes flag 2015-12-12 01:04:10 +00:00
array-includes.js [builtins] fix slow-path handling of -Infinity in ArrayIncludes 2017-02-21 23:31:39 +00:00
exponentiation-operator.js Remove --harmony-exponentiation-operator flag 2016-08-02 17:17:35 +00:00
typed-array-includes.js Remove --harmony-array-includes flag 2015-12-12 01:04:10 +00:00