Fix DoubleToFloat32 corner case

jakobkummerow · Commit Bot · commit 7265ea973cff · 2019-04-26T16:10:51.000Z
For a few double value above the max float, we have to round down to that max float rather than rounding up to infinity. Bug: chromium:956564 Change-Id: I34be1def5330bd4c3352b792d20dd500f108d9e1 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1585852 Commit-Queue: Jakob Kummerow <jkummerow@chromium.org> Commit-Queue: Andreas Haas <ahaas@chromium.org> Auto-Submit: Jakob Kummerow <jkummerow@chromium.org> Reviewed-by: Andreas Haas <ahaas@chromium.org> Cr-Commit-Position: refs/heads/master@{#61052}
diff --git a/src/conversions-inl.h b/src/conversions-inl.h
@@ -59,9 +59,24 @@ inline unsigned int FastD2UI(double x) {
 
 
 inline float DoubleToFloat32(double x) {
-  typedef std::numeric_limits<float> limits;
-  if (x > limits::max()) return limits::infinity();
-  if (x < limits::lowest()) return -limits::infinity();
+  using limits = std::numeric_limits<float>;
+  if (x > limits::max()) {
+    // kRoundingThreshold is the maximum double that rounds down to
+    // the maximum representable float. Its mantissa bits are:
+    // 1111111111111111111111101111111111111111111111111111
+    // [<--- float range --->]
+    // Note the zero-bit right after the float mantissa range, which
+    // determines the rounding-down.
+    static const double kRoundingThreshold = 3.4028235677973362e+38;
+    if (x <= kRoundingThreshold) return limits::max();
+    return limits::infinity();
+  }
+  if (x < limits::lowest()) {
+    // Same as above, mirrored to negative numbers.
+    static const double kRoundingThreshold = -3.4028235677973362e+38;
+    if (x >= kRoundingThreshold) return limits::lowest();
+    return -limits::infinity();
+  }
   return static_cast<float>(x);
 }
 
