Use signaling NaN for holes in fixed double arrays.

test/mjsunit/regress/regress-undefined-nan.js

Index: test/mjsunit/regress/regress-undefined-nan.js
diff --git a/test/mjsunit/regress/regress-undefined-nan.js b/test/mjsunit/regress/regress-undefined-nan.js
new file mode 100644
index 0000000000000000000000000000000000000000..cbbb182eeeef31aca7ff5da10a9ce6a15bf3fbd4
--- /dev/null
+++ b/test/mjsunit/regress/regress-undefined-nan.js
@@ -0,0 +1,25 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function loader(dst, src, i) {
+  dst[i] = src[i];
+}
+
+var ab = new ArrayBuffer(8);
+var i_view = new Int32Array(ab);
+i_view[0] = 0xFFF7FFFF;
+i_view[1] = 0xFFF7FFFF;
+var f_view = new Float64Array(ab);
+
+var fixed_double_elements = new Float64Array(1);
+fixed_double_elements[0] = f_view[0];

[Vyacheslav Egorov (Google), 2015/01/22 02:52:20]

This regression test does not necessarily work as is on ia32. This statement has
to be inside an optimized function to ensure transfer through xmm registers.

If this hits runtime and uses FPU registers for transfer somewhere (e.g. return
value of a function call).

If I add here:

var i32 = new Int32Array(fixed_double_elements.buffer);
assertEquals(i_view[0], i32[0]);
assertEquals(i_view[1], i32[1]);

to verify that test tests what it wants - this fails on ia32.debug build.

Need smth like:

function opt_store() { fixed_double_elements[0] = f_view[0]; }

opt_store();
opt_store();
%OptimizeFunctionOnNextCall(opt_store);
opt_store();

to fix it. 

[Benedikt Meurer, 2015/01/22 06:11:15]

Done.

+
+var doubles = [0.5];
+loader(doubles, fixed_double_elements, 0);
+loader(doubles, fixed_double_elements, 0);
+%OptimizeFunctionOnNextCall(loader);
+loader(doubles, fixed_double_elements, 0);
+assertTrue(doubles[0] !== undefined);