[turbofan] Fix typing rule for Math.sign.

jaro-sevcik · Commit bot · commit 25504a220f75 · 2016-09-01T20:06:27.000Z
Review-Url: https://codereview.chromium.org/2306583002 Cr-Commit-Position: refs/heads/master@{#39103}
diff --git a/src/compiler/type-cache.h b/src/compiler/type-cache.h
@@ -46,7 +46,9 @@ class TypeCache final {
   Type* const kTenOrUndefined =
       Type::Union(kSingletonTen, Type::Undefined(), zone());
   Type* const kMinusOneOrZero = CreateRange(-1.0, 0.0);
-  Type* const kMinusOneToOne = CreateRange(-1.0, 1.0);
+  Type* const kMinusOneToOneOrMinusZeroOrNaN = Type::Union(
+      Type::Union(CreateRange(-1.0, 1.0), Type::MinusZero(), zone()),
+      Type::NaN(), zone());
   Type* const kZeroOrOne = CreateRange(0.0, 1.0);
   Type* const kZeroOrOneOrNaN = Type::Union(kZeroOrOne, Type::NaN(), zone());
   Type* const kZeroToThirtyOne = CreateRange(0.0, 31.0);
diff --git a/src/compiler/typer.cc b/src/compiler/typer.cc
@@ -1324,7 +1324,7 @@ Type* Typer::Visitor::JSCallFunctionTyper(Type* fun, Typer* t) {
         case kMathTan:
           return Type::Number();
         case kMathSign:
-          return t->cache_.kMinusOneToOne;
+          return t->cache_.kMinusOneToOneOrMinusZeroOrNaN;
         // Binary math functions.
         case kMathAtan2:
         case kMathPow:
diff --git a/test/mjsunit/compiler/regress-math-sign-nan-type.js b/test/mjsunit/compiler/regress-math-sign-nan-type.js
@@ -0,0 +1,14 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function f(a) {
+  return Math.sign(+a) < 2;
+}
+
+f(NaN);
+f(NaN);
+%OptimizeFunctionOnNextCall(f);
+assertFalse(f(NaN));
