v8/test/mjsunit/regress/regress-double-canonicalization.js
verwaest c17b44bd3a Fix double canonicalization
This turns the blacklist back into a white-list adding all binary operations as allowed operations. The one known fix is that it forces canonicalization of the double-hole as double constant.

BUG=chromium:621147

Review-Url: https://codereview.chromium.org/2106393002
Cr-Commit-Position: refs/heads/master@{#37452}
2016-06-30 15:18:16 +00:00

25 lines
578 B
JavaScript

// Copyright 2016 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --allow-natives-syntax
var ab = new ArrayBuffer(8);
var i_view = new Int32Array(ab);
i_view[0] = %GetHoleNaNUpper()
i_view[1] = %GetHoleNaNLower();
var hole_nan = (new Float64Array(ab))[0];
var array = [];
function write() {
array[0] = hole_nan;
}
write();
%OptimizeFunctionOnNextCall(write);
write();
array[1] = undefined;
assertTrue(isNaN(array[0]));
assertEquals("number", typeof array[0]);