[ubsan] Fix a few double-to-float casts

The DoubleToFloat32 helper takes care of everything, so use it
consistently.

Bug: chromium:969498
Change-Id: If71e5374684b89615006548cb0329f4d4cb7fd6d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1648253
Commit-Queue: Ben Smith <binji@chromium.org>
Reviewed-by: Ben Smith <binji@chromium.org>
Auto-Submit: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62062}

src/objects/elements.cc

@@ -3629,10 +3629,7 @@ Handle<Object> TypedElementsAccessor<UINT32_ELEMENTS, uint32_t>::ToHandle(
 // static
 template <>
 float TypedElementsAccessor<FLOAT32_ELEMENTS, float>::FromScalar(double value) {
-  using limits = std::numeric_limits<float>;
-  if (value > limits::max()) return limits::infinity();
-  if (value < limits::lowest()) return -limits::infinity();
-  return static_cast<float>(value);
+  return DoubleToFloat32(value);
 }
 
 // static

src/wasm/wasm-interpreter.cc

@@ -582,7 +582,7 @@ inline float ExecuteF32UConvertI64(uint64_t a, TrapReason* trap) {
 }
 
 inline float ExecuteF32ConvertF64(double a, TrapReason* trap) {
-  return static_cast<float>(a);
+  return DoubleToFloat32(a);
 }
 
 inline Float32 ExecuteF32ReinterpretI32(int32_t a, TrapReason* trap) {

src/wasm/wasm-js.cc

@@ -1322,7 +1322,7 @@ void WebAssemblyGlobal(const v8::FunctionCallbackInfo<v8::Value>& args) {
         v8::Local<v8::Number> number_value;
         if (!value->ToNumber(context).ToLocal(&number_value)) return;
         if (!number_value->NumberValue(context).To(&f64_value)) return;
-        f32_value = static_cast<float>(f64_value);
+        f32_value = i::DoubleToFloat32(f64_value);
       }
       global_obj->SetF32(f32_value);
       break;
@@ -1924,7 +1924,7 @@ void WebAssemblyGlobalSetValue(
     case i::wasm::kWasmF32: {
       double f64_value = 0;
       if (!args[0]->NumberValue(context).To(&f64_value)) return;
-      receiver->SetF32(static_cast<float>(f64_value));
+      receiver->SetF32(i::DoubleToFloat32(f64_value));
       break;
     }
     case i::wasm::kWasmF64: {

test/mjsunit/mjsunit.status

@@ -342,6 +342,7 @@
   'regress/regress-crbug-746835': [SKIP],
   'regress/regress-crbug-772056': [SKIP],
   'regress/regress-crbug-816961': [SKIP],
+  'regress/regress-crbug-969498': [SKIP],
   'regress/wasm/*': [SKIP],
   'regress/regress-8947': [SKIP],
   'regress/regress-9165': [SKIP],

test/mjsunit/regress/regress-crbug-969498.js

+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+let global = new WebAssembly.Global({value: 'f32', mutable: true}, 2e66);
+global.value = 2e66;
+
+// Custom additional test case:
+const kRoundsDown = 3.4028235677973362e+38;
+const kRoundsToInf = 3.4028235677973366e+38;
+var floats = new Float32Array([kRoundsDown, kRoundsToInf]);
+assertNotEquals(Infinity, floats[0]);
+assertEquals(Infinity, floats[1]);
+floats.set([kRoundsDown, kRoundsToInf]);
+assertNotEquals(Infinity, floats[0]);
+assertEquals(Infinity, floats[1]);