v8/test/mjsunit/regress/regress-crbug-903043.js
Benedikt Meurer 56f6a763c2 [turbofan] Fix -0 check for subnormals.
Previously we'd check `x` for -0 by testing `(1.0 / x) == -Infinity`,
but this will yield the wrong results when `x` is a subnormal, i.e.
really close to 0.

In CSA we already perform bit checks to test for -0, so teach TurboFan
to do the same for comparisons to -0 (via `Object.is`). We introduce a
new NumberIsMinusZero simplified operator to handle the case where
SimplifiedLowering already knows that the input is a number.

Bug: chromium:903043, v8:6882
Change-Id: I0cb7c568029b461a92fc183104d5f359b4bfe7f4
Reviewed-on: https://chromium-review.googlesource.com/c/1328802
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Sigurd Schneider <sigurds@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57382}
2018-11-09 12:04:30 +00:00

40 lines
835 B
JavaScript

// Copyright 2018 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --allow-natives-syntax
(function() {
function foo() {
const x = 1e-1;
return Object.is(-0, x * (-1e-308));
}
assertFalse(foo());
assertFalse(foo());
%OptimizeFunctionOnNextCall(foo);
assertFalse(foo());
})();
(function() {
function foo(x) {
return Object.is(-0, x * (-1e-308));
}
assertFalse(foo(1e-1));
assertFalse(foo(1e-1));
%OptimizeFunctionOnNextCall(foo);
assertFalse(foo(1e-1));
})();
(function() {
function foo(x) {
return Object.is(-0, x);
}
assertFalse(foo(1e-1 * (-1e-308)));
assertFalse(foo(1e-1 * (-1e-308)));
%OptimizeFunctionOnNextCall(foo);
assertFalse(foo(1e-1 * (-1e-308)));
})();