Canonicalize NaNs on store to Fast(Float|Double) arrays

test/mjsunit/regress/regress-2596.js

Index: test/mjsunit/regress/regress-2596.js
diff --git a/test/mjsunit/regress/regress-2489.js b/test/mjsunit/regress/regress-2596.js
similarity index 73%
copy from test/mjsunit/regress/regress-2489.js
copy to test/mjsunit/regress/regress-2596.js
index 882c4f794a88e24d1d64e86a466b27c39f51e625..1d327fe0f8b756242da8b5f5798cbf9c6691adb1 100644
--- a/test/mjsunit/regress/regress-2489.js
+++ b/test/mjsunit/regress/regress-2596.js
@@ -27,24 +27,30 @@
 
 // Flags: --allow-natives-syntax
 
-"use strict";
+var bytes = new Uint8Array([
+    0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x7f]);  // kHoleNaN
+var doubles = new Float64Array(bytes.buffer);
+assertTrue(isNaN(doubles[0]));
 
-function f(a, b) {
-  return g("c", "d");
-}
+var prototype = [2.5, 2.5];
+var array = [3.5, 3.5];
+array.__proto__ = prototype;
+assertTrue(%HasFastDoubleElements(array));
 
-function g(a, b) {
-  g.constructor.apply(this, arguments);
+function boom(index) {
+  array[index] = doubles[0];
+  return array[index];
 }
 
-g.constructor = function(a, b) {
-  assertEquals("c", a);
-  assertEquals("d", b);
-}
+assertTrue(isNaN(boom(0)));
+assertTrue(isNaN(boom(0)));
+assertTrue(isNaN(boom(0)));
+
+// Test hydrogen
+%OptimizeFunctionOnNextCall(boom);
+assertTrue(isNaN(boom(0)));
+assertTrue(isNaN(boom(0)));
+assertTrue(isNaN(boom(0)));
+
+
 
-f("a", "b");
-f("a", "b");
-%OptimizeFunctionOnNextCall(f);
-f("a", "b");
-g.x = "deopt";
-f("a", "b");