tree e24bb7d4caaa5dacd20a443cc2cb9cbc0b63029b
parent fc3ba8577e14342cc8edda808c517b6b9a088081
author Georg Neis <neis@chromium.org> 1581591370 +0100
committer Commit Bot <commit-bot@chromium.org> 1581600565 +0000

[turbofan] Fix bug in Typer::TypeInductionVariablePhi

The fix in b8b6075021ade0969c6b8de9459cd34163f7dbe1 was insufficient.

The bug is that induction variable typing does not take into account
that the value can become NaN through addition or subtraction of
Infinities. The previous fix incorrectly assumed that this can only
happen when the initial value of the loop variable is an Infinity.

Bug: chromium:1051017
Change-Id: I8c9ffb2925288b80c00e18e7bc22a556bf540733
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2051957
Commit-Queue: Georg Neis <neis@chromium.org>
Reviewed-by: Michael Stanton <mvstanton@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#66258}