@@ -211,7 +211,10 @@ Node* RepresentationChanger::GetRepresentationFor(
211
211
return GetFloat32RepresentationFor (node, output_rep, output_type,
212
212
use_info.truncation ());
213
213
case MachineRepresentation::kFloat64 :
214
- DCHECK_NE (TypeCheckKind::kBigInt , use_info.type_check ());
214
+ DCHECK (use_info.type_check () == TypeCheckKind::kNone ||
215
+ use_info.type_check () == TypeCheckKind::kNumber ||
216
+ use_info.type_check () == TypeCheckKind::kNumberOrBoolean ||
217
+ use_info.type_check () == TypeCheckKind::kNumberOrOddball );
215
218
return GetFloat64RepresentationFor (node, output_rep, output_type,
216
219
use_node, use_info);
217
220
case MachineRepresentation::kBit :
@@ -727,15 +730,22 @@ Node* RepresentationChanger::GetFloat64RepresentationFor(
727
730
}
728
731
} else if (IsAnyTagged (output_rep)) {
729
732
if (output_type.Is (Type::Undefined ())) {
730
- if (use_info.type_check () == TypeCheckKind::kNumberOrBoolean ) {
733
+ if (use_info.type_check () == TypeCheckKind::kNumberOrOddball ||
734
+ (use_info.type_check () == TypeCheckKind::kNone &&
735
+ use_info.truncation ().TruncatesOddballAndBigIntToNumber ())) {
736
+ return jsgraph ()->Float64Constant (
737
+ std::numeric_limits<double >::quiet_NaN ());
738
+ } else {
739
+ DCHECK (use_info.type_check () == TypeCheckKind::kNone ||
740
+ use_info.type_check () == TypeCheckKind::kNumber ||
741
+ use_info.type_check () == TypeCheckKind::kNumberOrBoolean );
731
742
Node* unreachable = InsertUnconditionalDeopt (
732
- use_node, DeoptimizeReason::kNotANumberOrBoolean );
743
+ use_node, use_info.type_check () == TypeCheckKind::kNumber
744
+ ? DeoptimizeReason::kNotANumber
745
+ : DeoptimizeReason::kNotANumberOrBoolean );
733
746
return jsgraph ()->graph ()->NewNode (
734
747
jsgraph ()->common ()->DeadValue (MachineRepresentation::kFloat64 ),
735
748
unreachable);
736
- } else {
737
- return jsgraph ()->Float64Constant (
738
- std::numeric_limits<double >::quiet_NaN ());
739
749
}
740
750
} else if (output_rep == MachineRepresentation::kTaggedSigned ) {
741
751
node = InsertChangeTaggedSignedToInt32 (node);
@@ -747,12 +757,13 @@ Node* RepresentationChanger::GetFloat64RepresentationFor(
747
757
output_type.Is (Type::NumberOrHole ())) {
748
758
// JavaScript 'null' is an Oddball that results in +0 when truncated to
749
759
// Number. In a context like -0 == null, which must evaluate to false,
750
- // this truncation must not happen. For this reason we restrict this case
751
- // to when either the user explicitly requested a float (and thus wants
752
- // +0 if null is the input) or we know from the types that the input can
753
- // only be Number | Hole. The latter is necessary to handle the operator
754
- // CheckFloat64Hole. We did not put in the type (Number | Oddball \ Null)
755
- // to discover more bugs related to this conversion via crashes.
760
+ // this truncation must not happen. For this reason we restrict this
761
+ // case to when either the user explicitly requested a float (and thus
762
+ // wants +0 if null is the input) or we know from the types that the
763
+ // input can only be Number | Hole. The latter is necessary to handle
764
+ // the operator CheckFloat64Hole. We did not put in the type (Number |
765
+ // Oddball \ Null) to discover more bugs related to this conversion via
766
+ // crashes.
756
767
op = simplified ()->TruncateTaggedToFloat64 ();
757
768
} else if (use_info.type_check () == TypeCheckKind::kNumber ||
758
769
(use_info.type_check () == TypeCheckKind::kNumberOrOddball &&
0 commit comments