e3c9239626
The typing of SpeculativeSafeIntegerSubtract didn't include -0, and the SimplifiedLowering rules for SpeculativeSafeIntegerSubtract didn't properly handle the case of `-0 - 0`, but would always pass Word32 truncations. Bug: chromium:913296 Change-Id: I0e5a401f075db8b349a5579e1e294df97378ea49 Reviewed-on: https://chromium-review.googlesource.com/c/1370042 Reviewed-by: Tobias Tebbi <tebbi@chromium.org> Commit-Queue: Benedikt Meurer <bmeurer@chromium.org> Cr-Commit-Position: refs/heads/master@{#58147}
14 lines
359 B
JavaScript
14 lines
359 B
JavaScript
// Copyright 2018 the V8 project authors. All rights reserved.
|
|
// Use of this source code is governed by a BSD-style license that can be
|
|
// found in the LICENSE file.
|
|
|
|
// Flags: --allow-natives-syntax
|
|
|
|
function foo(trigger) {
|
|
return Object.is((trigger ? -0 : 0) - 0, -0);
|
|
}
|
|
|
|
assertFalse(foo(false));
|
|
%OptimizeFunctionOnNextCall(foo);
|
|
assertTrue(foo(true));
|