AuroraMiddleware/v8
1
0
Fork 0
Code Issues 2 Pull Requests Releases Wiki Activity

Fix typed lowering to number comparison.

Browse Source 
R=titzer@chromium.org
TEST=mjsunit/regress/regress-3564
BUG=v8:3564
LOG=N

Review URL: https://codereview.chromium.org/574653002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@23972 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
This commit is contained in:
mstarzinger@chromium.org 2014-09-16 11:33:30 +00:00
parent aedae395b1
commit 429924b780
2 changed files with 27 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
src/compiler/js-typed-lowering.cc
View File

@ -309,7 +309,9 @@ Reduction JSTypedLowering::ReduceJSComparison(Node* node) {
return NoChange();
}
return r.ChangeToPureOperator(stringOp);
} else if (r.OneInputCannotBe(Type::String())) {
}
Type* maybe_string = Type::Union(Type::String(), Type::Receiver(), zone());
if (r.OneInputCannotBe(maybe_string)) {
// If one input cannot be a string, then emit a number comparison.
const Operator* less_than;
const Operator* less_than_or_equal;

24
test/mjsunit/regress/regress-3564.js Normal file
View File

@ -0,0 +1,24 @@
// Copyright 2014 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --allow-natives-syntax
function MyWrapper(v) {
return { valueOf: function() { return v } };
}
function f() {
assertTrue("a" < "x");
assertTrue("a" < new String("y"));
assertTrue("a" < new MyWrapper("z"));
assertFalse("a" > "x");
assertFalse("a" > new String("y"));
assertFalse("a" > new MyWrapper("z"));
}
f();
f();
%OptimizeFunctionOnNextCall(f);
f();