Use signaling NaN for holes in fixed double arrays.

src/hydrogen-instructions.cc

Index: src/hydrogen-instructions.cc
diff --git a/src/hydrogen-instructions.cc b/src/hydrogen-instructions.cc
index 287fc56399229f262db4d21f8011cd4dca35f7f4..e192ecff4b057d9f63cd96161de7f6d66126db69 100644
--- a/src/hydrogen-instructions.cc
+++ b/src/hydrogen-instructions.cc
@@ -2683,6 +2683,19 @@ static bool IsInteger32(double value) {
 }
 
 
+HConstant::HConstant(Special special)
+    : HTemplateInstruction<0>(HType::TaggedNumber()),
+      object_(Handle<Object>::null()),
+      object_map_(Handle<Map>::null()),
+      bit_field_(HasDoubleValueField::encode(true) |
+                 InstanceTypeField::encode(kUnknownInstanceType)),
+      int32_value_(0) {
+  DCHECK_EQ(kHoleNaN, special);
+  std::memcpy(&double_value_, &kHoleNanInt64, sizeof(double_value_));
+  Initialize(Representation::Double());
+}
+
+
 HConstant::HConstant(Handle<Object> object, Representation r)
     : HTemplateInstruction<0>(HType::FromValue(object)),
       object_(Unique<Object>::CreateUninitialized(object)),
@@ -4040,31 +4053,22 @@ bool HStoreKeyed::TryIncreaseBaseOffset(uint32_t increase_by_value) {
 
 
 bool HStoreKeyed::NeedsCanonicalization() {
-  // If value is an integer or smi or comes from the result of a keyed load or
-  // constant then it is either be a non-hole value or in the case of a constant
-  // the hole is only being stored explicitly: no need for canonicalization.
-  //
-  // The exception to that is keyed loads from external float or double arrays:
-  // these can load arbitrary representation of NaN.
-
-  if (value()->IsConstant()) {
-    return false;
-  }
-
-  if (value()->IsLoadKeyed()) {
-    return IsExternalFloatOrDoubleElementsKind(
-        HLoadKeyed::cast(value())->elements_kind());
-  }
-
-  if (value()->IsChange()) {
-    if (HChange::cast(value())->from().IsSmiOrInteger32()) {
-      return false;
+  switch (value()->opcode()) {

[Vyacheslav Egorov (Google), 2015/01/22 02:52:20]

This check should account for heap number fields (mutable boxes, unboxed fields,
etc).

There we just load payload directly bypassing the HChange.

Repro:

function A(src) { this.x = src[0]; }

new A(fixed_double_elements);
new A(fixed_double_elements);

%OptimizeFunctionOnNextCall(A);

var obj = new A(fixed_double_elements);

function move_x(dst, obj) { dst[0] = obj.x; }

var doubles = [0.5];
move_x(doubles, obj);
move_x(doubles, obj);
%OptimizeFunctionOnNextCall(move_x);
move_x(doubles, obj);
assertTrue(doubles[0] !== undefined);

[Benedikt Meurer, 2015/01/22 06:11:15]

Fixed, thanks.

+    case kLoadKeyed: {
+      ElementsKind load_kind = HLoadKeyed::cast(value())->elements_kind();
+      return IsExternalFloatOrDoubleElementsKind(load_kind) ||
+             IsFixedFloatElementsKind(load_kind);
     }
-    if (HChange::cast(value())->value()->type().IsSmi()) {
-      return false;
+    case kChange: {
+      Representation from = HChange::cast(value())->from();
+      return from.IsTagged() || from.IsHeapObject();
     }
+    case kPhi:
+      // Better safe than sorry...
+      return true;
+    default:
+      return false;
   }
-  return true;
 }