SimplifiedLowering eliminates a CheckFloat64Hole because the (unused) CheckNumber passes a truncation to it. We really need to represent the float64 hole NaN appropriately to ensure that this doesn't happen anymore.
This bug requires manual review: We are only 13 days from stable.
Please contact the milestone owner if you have questions.
Owners: amineer@(Android), cmasso@(iOS), bhthompson@(ChromeOS), govind@(Desktop)
For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
This issue has been approved for a merge. Please merge the fix to any appropriate branches as soon as possible!
If all merges have been completed, please remove any remaining Merge-Approved labels from this issue.
Thanks for your time! To disable nags, add the Disable-Nags label.
For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
Comment 1 by machenb...@chromium.org
, Apr 11 2017Components: -Blink>JavaScript Blink>JavaScript>Compiler
Status: Available (was: Untriaged)
// PTAL, repro: function foo(v, i) { v[i].x; } var v=[, 0.1]; foo(v, 1); foo(v, 1); %OptimizeFunctionOnNextCall(foo); foo(v, 0); // Output: # Compared x64,ignition with x64,ignition_turbo # # Flags of x64,ignition: --abort_on_stack_overflow --expose-gc --allow-natives-syntax --invoke-weak-callbacks --omit-quit --es-staging --random-seed 732681078 --ignition --turbo-filter=~ --hydrogen-filter=~ --nocrankshaft # Flags of x64,ignition_turbo: --abort_on_stack_overflow --expose-gc --allow-natives-syntax --invoke-weak-callbacks --omit-quit --es-staging --random-seed 732681078 --ignition --turbo # # Difference: - ./repro.js:2: TypeError: Cannot read property 'x' of undefined # ### Start of configuration x64,ignition: ./repro.js:2: TypeError: Cannot read property 'x' of undefined v[i].x; ^ ### End of configuration x64,ignition # ### Start of configuration x64,ignition_turbo: ### End of configuration x64,ignition_turbo