diff --git a/src/compiler/js-typed-lowering.cc b/src/compiler/js-typed-lowering.cc index 38671a2dee..35283e4137 100644 --- a/src/compiler/js-typed-lowering.cc +++ b/src/compiler/js-typed-lowering.cc @@ -309,7 +309,9 @@ Reduction JSTypedLowering::ReduceJSComparison(Node* node) { return NoChange(); } return r.ChangeToPureOperator(stringOp); - } else if (r.OneInputCannotBe(Type::String())) { + } + Type* maybe_string = Type::Union(Type::String(), Type::Receiver(), zone()); + if (r.OneInputCannotBe(maybe_string)) { // If one input cannot be a string, then emit a number comparison. const Operator* less_than; const Operator* less_than_or_equal; diff --git a/test/mjsunit/regress/regress-3564.js b/test/mjsunit/regress/regress-3564.js new file mode 100644 index 0000000000..a0b9eb2994 --- /dev/null +++ b/test/mjsunit/regress/regress-3564.js @@ -0,0 +1,24 @@ +// Copyright 2014 the V8 project authors. All rights reserved. +// Use of this source code is governed by a BSD-style license that can be +// found in the LICENSE file. + +// Flags: --allow-natives-syntax + +function MyWrapper(v) { + return { valueOf: function() { return v } }; +} + +function f() { + assertTrue("a" < "x"); + assertTrue("a" < new String("y")); + assertTrue("a" < new MyWrapper("z")); + + assertFalse("a" > "x"); + assertFalse("a" > new String("y")); + assertFalse("a" > new MyWrapper("z")); +} + +f(); +f(); +%OptimizeFunctionOnNextCall(f); +f();