v8/test/mjsunit/regress/regress-crbug-969498.js
Jakob Kummerow 05e3b64132 [ubsan] Fix a few double-to-float casts
The DoubleToFloat32 helper takes care of everything, so use it
consistently.

Bug: chromium:969498
Change-Id: If71e5374684b89615006548cb0329f4d4cb7fd6d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1648253
Commit-Queue: Ben Smith <binji@chromium.org>
Reviewed-by: Ben Smith <binji@chromium.org>
Auto-Submit: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62062}
2019-06-08 12:38:02 +00:00

17 lines
632 B
JavaScript

// Copyright 2019 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
let global = new WebAssembly.Global({value: 'f32', mutable: true}, 2e66);
global.value = 2e66;
// Custom additional test case:
const kRoundsDown = 3.4028235677973362e+38;
const kRoundsToInf = 3.4028235677973366e+38;
var floats = new Float32Array([kRoundsDown, kRoundsToInf]);
assertNotEquals(Infinity, floats[0]);
assertEquals(Infinity, floats[1]);
floats.set([kRoundsDown, kRoundsToInf]);
assertNotEquals(Infinity, floats[0]);
assertEquals(Infinity, floats[1]);