v8/test/mjsunit/regress/regress-crbug-930948.js
Sigurd Schneider 82faa6d315 [array] Fix Array#map storing signaling NaNs
Bug: chromium:930948
Change-Id: I7567fec06ec4bad11e8b8336ac13fdfc225b632c
Reviewed-on: https://chromium-review.googlesource.com/c/1466503
Reviewed-by: Michael Stanton <mvstanton@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Mathias Bynens <mathias@chromium.org>
Commit-Queue: Sigurd Schneider <sigurds@chromium.org>
Cr-Commit-Position: refs/heads/master@{#59547}
2019-02-13 10:23:19 +00:00

26 lines
627 B
JavaScript

// Copyright 2019 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --verify-heap --allow-natives-syntax
// This checks that TransitionAndStoreNumberElement silences NaNs.
function foo() {
return [undefined].map(Math.asin);
}
foo();
foo();
%OptimizeFunctionOnNextCall(foo);
foo();
// This checks that TransitionAndStoreElement silences NaNs.
function bar(b) {
return [undefined].map(x => b ? Math.asin(x) : "string");
}
bar(true);
bar(false);
bar(true);
bar(false);
%OptimizeFunctionOnNextCall(bar);
bar(true);