v8/test/mjsunit/compiler/regress-store-holey-double-array.js
jarin 6470ddadf9 [turbofan] Prevent storing signalling NaNs into holey double arrays.
This introduces SilenceNaN operator, which makes sure that we only
store quiet NaNs into holey arrays. We omit the NaN silencing code
at instruction selection time if the input is an operation that
cannot possibly produce signalling NaNs.

BUG=

Review-Url: https://codereview.chromium.org/2060233002
Cr-Commit-Position: refs/heads/master@{#36950}
2016-06-14 08:24:43 +00:00

44 lines
846 B
JavaScript

// Copyright 2016 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --allow-natives-syntax
(function StoreHoleBitPattern() {
function g(src, dst, i) {
dst[i] = src[i];
}
var b = new ArrayBuffer(16);
var i32 = new Int32Array(b);
i32[0] = 0xFFF7FFFF;
i32[1] = 0xFFF7FFFF;
i32[3] = 0xFFF7FFFF;
i32[4] = 0xFFF7FFFF;
var f64 = new Float64Array(b);
var a = [,0.1];
g(f64, a, 1);
g(f64, a, 1);
%OptimizeFunctionOnNextCall(g);
g(f64, a, 0);
assertTrue(Number.isNaN(a[0]));
})();
(function ConvertHoleToNumberAndStore() {
function g(a, i) {
var x = a[i];
a[i] = +x;
}
var a=[,0.1];
g(a, 1);
g(a, 1);
%OptimizeFunctionOnNextCall(g);
g(a, 0);
assertTrue(Number.isNaN(a[0]));
})();