Bug 722260 - Properly handle NaN values as keys in Map objects. r=luke

--HG--
extra : rebase_source : 54ac2dccb9c1cb5c53f726939c988c4abfd74ab7

js/src/builtin/MapObject.cpp

@@ -90,14 +90,10 @@ HashableValue::setValue(JSContext *cx, const Value &v)
         if (JSDOUBLE_IS_INT32(d, &i)) {
             /* Normalize int32-valued doubles to int32 for faster hashing and testing. */
             value = Int32Value(i);
+        } else if (JSDOUBLE_IS_NaN(d)) {
+            /* NaNs with different bits must hash and test identically. */
+            value = DoubleValue(js_NaN);
         } else {
-#ifdef DEBUG
-            /* All NaN values are the same. The bit-pattern must reflect this. */
-            jsval_layout a, b;
-            a.asDouble = d;
-            b.asDouble = JS_CANONICALIZE_NAN(d);
-            JS_ASSERT(a.asBits == b.asBits);
-#endif
             value = v;
         }
     } else {

js/src/tests/ecma_6/Map/NaN-as-key.js

@@ -0,0 +1,55 @@
+/*
+ * Any copyright is dedicated to the Public Domain.
+ * http://creativecommons.org/licenses/publicdomain/
+ */
+
+//-----------------------------------------------------------------------------
+var BUGNUMBER = 722260;
+var summary = 'All NaNs must be treated as identical keys for Map';
+
+print(BUGNUMBER + ": " + summary);
+
+/**************
+ * BEGIN TEST *
+ **************/
+
+/* Avoid constant-folding that would happen were |undefined| to be used. */
+var key = -/a/g.missingProperty;
+
+var m = new Map();
+m.set(key, 17);
+assertEq(m.get(key), 17);
+assertEq(m.get(-key), 17);
+assertEq(m.get(NaN), 17);
+
+m.delete(-key);
+assertEq(m.has(key), false);
+assertEq(m.has(-key), false);
+assertEq(m.has(NaN), false);
+
+m.set(-key, 17);
+assertEq(m.get(key), 17);
+assertEq(m.get(-key), 17);
+assertEq(m.get(NaN), 17);
+
+m.delete(NaN);
+assertEq(m.has(key), false);
+assertEq(m.has(-key), false);
+assertEq(m.has(NaN), false);
+
+m.set(NaN, 17);
+assertEq(m.get(key), 17);
+assertEq(m.get(-key), 17);
+assertEq(m.get(NaN), 17);
+
+m.delete(key);
+assertEq(m.has(key), false);
+assertEq(m.has(-key), false);
+assertEq(m.has(NaN), false);
+
+/******************************************************************************/
+
+if (typeof reportCompare === "function")
+  reportCompare(true, true);
+
+print("Tests complete");

js/src/tests/ecma_6/Set/NaN-as-key.js

@@ -0,0 +1,56 @@
+/*
+ * Any copyright is dedicated to the Public Domain.
+ * http://creativecommons.org/licenses/publicdomain/
+ */
+
+//-----------------------------------------------------------------------------
+var BUGNUMBER = 722260;
+var summary = 'All NaNs must be treated as identical keys for Set';
+
+print(BUGNUMBER + ": " + summary);
+
+/**************
+ * BEGIN TEST *
+ **************/
+
+/* Avoid constant-folding that would happen were |undefined| to be used. */
+var key = -/a/g.missingProperty;
+
+var s = new Set();
+s.add(key, 17);
+assertEq(s.has(key), true);
+assertEq(s.has(-key), true);
+assertEq(s.has(NaN), true);
+
+s.delete(-key);
+assertEq(s.has(key), false);
+assertEq(s.has(-key), false);
+assertEq(s.has(NaN), false);
+
+s.add(-key, 17);
+assertEq(s.has(key), true);
+assertEq(s.has(-key), true);
+assertEq(s.has(NaN), true);
+
+s.delete(NaN);
+assertEq(s.has(key), false);
+assertEq(s.has(-key), false);
+assertEq(s.has(NaN), false);
+
+s.add(NaN, 17);
+assertEq(s.has(key), true);
+assertEq(s.has(-key), true);
+assertEq(s.has(NaN), true);
+
+s.delete(key);
+assertEq(s.has(key), false);
+assertEq(s.has(-key), false);
+assertEq(s.has(NaN), false);
+
+
+/******************************************************************************/
+
+if (typeof reportCompare === "function")
+  reportCompare(true, true);
+
+print("Tests complete");

js/src/tests/ecma_6/jstests.list

@@ -0,0 +1,2 @@
+include Map/jstests.list
+include Set/jstests.list

js/src/tests/jstests.list

@@ -4,6 +4,7 @@ include ecma_2/jstests.list
 include ecma_3/jstests.list
 include ecma_3_1/jstests.list
 include ecma_5/jstests.list
+include ecma_6/jstests.list
 include js1_1/jstests.list
 include js1_2/jstests.list
 include js1_3/jstests.list