tree 8ac7a12389ceed9704bee43d8bb1afbaeee7e1f0
parent 0da7ca8781c6c7ec852bef845b72ca7f212cdc23
author Mike Stanton <mvstanton@chromium.org> 1575297047 +0100
committer Commit Bot <commit-bot@chromium.org> 1575300052 +0000

[TurboFan] Loop variable analysis requires more sensitivity

Loop variable analysis doesn't recognize that the initial type of the
loop variable phi combined with the increment type may produce a NaN
result through the addition of two infinities of differing sign.

This leads to unreachable code and a SIGINT crash.

The fix is to consider this case before typing the loop variable phi,
falling back to more conservative typing if discovered.

R=neis@chromium.org

Bug: chromium:1028863
Change-Id: Ic4b5189c4c50c5bbe29e46050de630fd0673de9f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1946352
Commit-Queue: Michael Stanton <mvstanton@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#65291}