[stubs] Fix hole-related double bug in ArrayNoArgumentConstructor

src/code-stub-assembler.cc

Index: src/code-stub-assembler.cc
diff --git a/src/code-stub-assembler.cc b/src/code-stub-assembler.cc
index cf9fcb8df8baf5371af463fb1325125f24a770e7..77460a1c8895a5f677e001cce806d415e626af28 100644
--- a/src/code-stub-assembler.cc
+++ b/src/code-stub-assembler.cc
@@ -691,12 +691,31 @@ Node* CodeStubAssembler::AllocateJSArray(ElementsKind kind, Node* array_map,
       elements, FixedArray::kLengthOffset,
       mode == SMI_PARAMETERS ? capacity_node : SmiTag(capacity_node));
 
-  Node* double_hole = Float64Constant(bit_cast<double>(kHoleNanInt64));
+  int const first_element_offset = FixedArray::kHeaderSize - kHeapObjectTag;
   Node* hole = HeapConstant(Handle<HeapObject>(heap->the_hole_value()));
+  Node* double_hole =
+      Is64() ? Int64Constant(kHoleNanInt64) : Int32Constant(kHoleNanLower32);
+  DCHECK_EQ(kHoleNanLower32, kHoleNanUpper32);
   if (constant_capacity && capacity <= kElementLoopUnrollThreshold) {
     for (int i = 0; i < capacity; ++i) {
       if (is_double) {
-        StoreFixedDoubleArrayElement(elements, Int32Constant(i), double_hole);
+        Node* offset = ElementOffsetFromIndex(Int32Constant(i), kind, mode,
+                                              first_element_offset);
+        // Don't use doubles to store the hole double, since manipulating the

[Benedikt Meurer, 2016/05/21 09:12:22]

Mhm, yeah, we really need Float64 and Float32 helper classes to pass around
float64/float32 values in C++ while preserving the bit pattern. Maybe Enrico can
fix that, it's been on my list for long time.

In either case, please add TODO here, that this code can be removed once we have
Float64Constant operators using the Float64 class for preserving the precise bit
pattern.

[danno, 2016/05/21 09:22:16]

Done.

+        // signaling NaN used for the hole in C++, e.g. with bit_cast, will
+        // change its value on ia32 (the x87 stack is used to return values
+        // and stores to the stack silently clear the signalling bit).
+        if (Is64()) {
+          StoreNoWriteBarrier(MachineRepresentation::kWord64, elements, offset,
+                              double_hole);
+        } else {
+          StoreNoWriteBarrier(MachineRepresentation::kWord32, elements, offset,
+                              double_hole);
+          offset = ElementOffsetFromIndex(Int32Constant(i), kind, mode,
+                                          first_element_offset + kPointerSize);
+          StoreNoWriteBarrier(MachineRepresentation::kWord32, elements, offset,
+                              double_hole);
+        }
       } else {
         StoreFixedArrayElement(elements, Int32Constant(i), hole,
                                SKIP_WRITE_BARRIER);