v8/test/mjsunit/regress/regress-crbug-880207.js
Jaroslav Sevcik c59c9c46b5 [turbofan] Fix Math.expm1 builtin typing.
This fixes the typing for the case when the call is not lowered to
the simplified operator.

Bug: chromium:880207
Change-Id: Icecf12de77ece0fe9ffec2777874f5f0004a1e97
Reviewed-on: https://chromium-review.googlesource.com/c/1278642
Commit-Queue: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#56621}
2018-10-15 06:00:03 +00:00

38 lines
951 B
JavaScript

// Copyright 2018 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --allow-natives-syntax
(function TestOptimizedFastExpm1MinusZero() {
function foo() {
return Object.is(Math.expm1(-0), -0);
}
assertTrue(foo());
%OptimizeFunctionOnNextCall(foo);
assertTrue(foo());
})();
(function TestOptimizedExpm1MinusZeroSlowPath() {
function f(x) {
return Object.is(Math.expm1(x), -0);
}
function g() {
return f(-0);
}
f(0);
// Compile function optimistically for numbers (with fast inlined
// path for Math.expm1).
%OptimizeFunctionOnNextCall(f);
// Invalidate the optimistic assumption, deopting and marking non-number
// input feedback in the call IC.
f("0");
// Optimize again, now with non-lowered call to Math.expm1.
assertTrue(g());
%OptimizeFunctionOnNextCall(g);
assertTrue(g());
})();