Bug 1268224 - Fix canonicalization in more-deterministic builds. r=lth

js/src/vm/TypedArrayObject.cpp

@@ -1664,6 +1664,12 @@ DataViewObject::write(JSContext* cx, Handle<DataViewObject*> obj,
     if (!WebIDLCast(cx, args[1], &value))
         return false;
 
+#ifdef JS_MORE_DETERMINISTIC
+    // See the comment in ElementSpecific::doubleToNative.
+    if (TypeIsFloatingPoint<NativeType>())
+        value = JS::CanonicalizeNaN(value);
+#endif
+
     bool toLittleEndian = args.length() >= 3 && ToBoolean(args[2]);
 
     if (obj->arrayBuffer().isDetached()) {
@@ -2047,6 +2053,11 @@ TypedArrayObject::setElement(TypedArrayObject& obj, uint32_t index, double d)
 {
     MOZ_ASSERT(index < obj.length());
 
+#ifdef JS_MORE_DETERMINISTIC
+    // See the comment in ElementSpecific::doubleToNative.
+    d = JS::CanonicalizeNaN(d);
+#endif
+
     switch (obj.type()) {
       case Scalar::Int8:
         Int8Array::setIndexValue(obj, index, d);