Let NaN flow as double into HBranch

test/mjsunit/tobool-ic.js

Index: test/mjsunit/tobool-ic.js
diff --git a/test/mjsunit/regress/regress-crbug-173907.js b/test/mjsunit/tobool-ic.js
similarity index 52%
copy from test/mjsunit/regress/regress-crbug-173907.js
copy to test/mjsunit/tobool-ic.js
index 9f92fefa7880d65771fbbe70aedb13d2d039f58e..0c17d748ffd1bedc7aab12da30a4b11fd8b948c1 100644
--- a/test/mjsunit/regress/regress-crbug-173907.js
+++ b/test/mjsunit/tobool-ic.js
@@ -25,64 +25,84 @@
 // (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
-// Flags: --allow-natives-syntax
+// Flags: --allow-natives-syntax --noalways-opt --crankshaft
 
-var X = 1.1;
-var K = 0.5;
 
-var O = 0;
-var result = new Float64Array(2);
+// Extensive verification of ToBool conversion in stub and optimized code
 
-function spill() {
-  try { } catch (e) { }
+var opt_count = 0;
+var foo = function(a) {
+  if(a) {
+    return true;
+  } else {
+    return false;
+  }
+};
+
+function CheckOptCount() {
+  assertEquals(opt_count, %GetOptimizationCount(foo));
 }
 
-function buggy() {
-  var v = X;
-  var phi1 = v + K;
-  var phi2 = v - K;
-
-  spill();  // At this point initial values for phi1 and phi2 are spilled.
-
-  var xmm1 = v;
-  var xmm2 = v*v*v;
-  var xmm3 = v*v*v*v;
-  var xmm4 = v*v*v*v*v;
-  var xmm5 = v*v*v*v*v*v;
-  var xmm6 = v*v*v*v*v*v*v;
-  var xmm7 = v*v*v*v*v*v*v*v;
-  var xmm8 = v*v*v*v*v*v*v*v*v;
-
-  // All registers are blocked and phis for phi1 and phi2 are spilled because
-  // their left (incoming) value is spilled, there are no free registers,
-  // and phis themselves have only ANY-policy uses.
-
-  for (var x = 0; x < 2; x++) {
-    xmm1 += xmm1 * xmm6;
-    xmm2 += xmm1 * xmm5;
-    xmm3 += xmm1 * xmm4;
-    xmm4 += xmm1 * xmm3;
-    xmm5 += xmm1 * xmm2;
-
-    // Now swap values of phi1 and phi2 to create cycle between phis.
-    var t = phi1;
-    phi1 = phi2;
-    phi2 = t;
-  }
+function TriggerDeopt(new_type) {
+  foo(new_type);
+}
+
+function TestHeapNumbers() {
+  assertTrue(foo(1.2));
+  assertTrue(foo(0.001));
+  assertTrue(foo(-0.001));
+  assertFalse(foo(NaN));
+  assertFalse(foo(-0.0));
+}
+
+function TestSmi() {
+  assertTrue(foo(1));
+  assertTrue(foo(12));
+  assertTrue(foo(1000000000));
+  assertFalse(foo(0));
+}
+
+function TestUndef() {
+  assertFalse(foo(undefined));
+}
 
-  // Now we want to get values of phi1 and phi2. However we would like to
-  // do it in a way that does not produce any uses of phi1&phi2 that have
-  // a register beneficial policy. How? We just hide these uses behind phis.
-  result[0] = (O === 0) ? phi1 : phi2;
-  result[1] = (O !== 0) ? phi1 : phi2;
+function TestNull() {
+  assertFalse(foo(null));
 }
 
-function test() {
-  buggy();
-  assertArrayEquals([X + K, X - K], result);
+function TestBool() {
+  assertFalse(foo(false));
+  assertTrue(foo(true));
 }
 
-test();
-test();
-%OptimizeFunctionOnNextCall(buggy);
-test();
+function TestString() {
+  assertTrue(foo("asdf"));
+  assertFalse(foo(""));
+}
+
+function TestSpecObject() {
+  assertTrue(foo({}));
+  assertTrue(foo({a:33}));
+  assertTrue(foo(new Object()));
+}
+
+var tests = [TestSpecObject, TestString, TestBool, TestNull,
+             TestUndef, TestSmi, TestHeapNumbers];
+
+for (var i=0; i<tests.length; i++) {
+  // Run tests with a new type -> full-code
+  tests[i]();
+
+  // Optimize with this new type
+  %OptimizeFunctionOnNextCall(foo);
+  opt_count += 1;
+  tests[i]();
+  CheckOptCount();
+
+  // Run all previously recorded types to assert
+  // that they don't deopt the function
+  for (var j=0; j<i; j++) {
+    tests[j]();
+    %GetOptimizationStatus(foo) === 1;
+  }
+}