From b930ef1012d11fdc1e66e5d9663b51bd6b479154 Mon Sep 17 00:00:00 2001 From: "mstarzinger@chromium.org" Date: Thu, 11 Sep 2014 16:09:21 +0000 Subject: [PATCH] Fix typed lowering of JSAdd on non-number inputs. R=rossberg@chromium.org TEST=mjsunit/regress/regress-3476 Review URL: https://codereview.chromium.org/564823003 git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@23883 ce2b1a6d-e550-0410-aec6-3dcde31c8c00 --- src/compiler/js-typed-lowering.cc | 17 +++++++++++++---- src/compiler/js-typed-lowering.h | 1 + test/cctest/compiler/test-js-typed-lowering.cc | 4 ++-- test/mjsunit/mjsunit.status | 1 - 4 files changed, 16 insertions(+), 7 deletions(-) diff --git a/src/compiler/js-typed-lowering.cc b/src/compiler/js-typed-lowering.cc index 869096232f..9f1e7eb891 100644 --- a/src/compiler/js-typed-lowering.cc +++ b/src/compiler/js-typed-lowering.cc @@ -222,14 +222,23 @@ class JSBinopReduction { Reduction JSTypedLowering::ReduceJSAdd(Node* node) { JSBinopReduction r(this, node); - if (r.OneInputIs(Type::String())) { - r.ConvertInputsToString(); - return r.ChangeToPureOperator(simplified()->StringAdd()); + if (r.BothInputsAre(Type::Number())) { + // JSAdd(x:number, y:number) => NumberAdd(x, y) + return r.ChangeToPureOperator(simplified()->NumberAdd()); } - if (r.NeitherInputCanBe(Type::String())) { + Type* maybe_string = Type::Union(Type::String(), Type::Receiver(), zone()); + if (r.NeitherInputCanBe(maybe_string)) { + // JSAdd(x:-string, y:-string) => NumberAdd(ToNumber(x), ToNumber(y)) r.ConvertInputsToNumber(); return r.ChangeToPureOperator(simplified()->NumberAdd()); } + if (r.OneInputIs(Type::String())) { + // JSAdd(x:string, y:string) => StringAdd(x, y) + // JSAdd(x:string, y) => StringAdd(x, ToString(y)) + // JSAdd(x, y:string) => StringAdd(ToString(x), y) + r.ConvertInputsToString(); + return r.ChangeToPureOperator(simplified()->StringAdd()); + } return NoChange(); } diff --git a/src/compiler/js-typed-lowering.h b/src/compiler/js-typed-lowering.h index ebd2d854bb..4a10092fa8 100644 --- a/src/compiler/js-typed-lowering.h +++ b/src/compiler/js-typed-lowering.h @@ -26,6 +26,7 @@ class JSTypedLowering FINAL : public Reducer { JSGraph* jsgraph() { return jsgraph_; } Graph* graph() { return jsgraph_->graph(); } + Zone* zone() { return jsgraph_->zone(); } private: friend class JSBinopReduction; diff --git a/test/cctest/compiler/test-js-typed-lowering.cc b/test/cctest/compiler/test-js-typed-lowering.cc index adb1e62721..ee5293f40e 100644 --- a/test/cctest/compiler/test-js-typed-lowering.cc +++ b/test/cctest/compiler/test-js-typed-lowering.cc @@ -1024,7 +1024,7 @@ TEST(OrderNumberBinopEffects2) { }; for (size_t j = 0; j < arraysize(ops); j += 2) { - BinopEffectsTester B(ops[j], Type::Number(), Type::Object()); + BinopEffectsTester B(ops[j], Type::Number(), Type::Boolean()); Node* i0 = B.CheckNoOp(0); Node* i1 = B.CheckConvertedInput(IrOpcode::kJSToNumber, 1, true); @@ -1037,7 +1037,7 @@ TEST(OrderNumberBinopEffects2) { } for (size_t j = 0; j < arraysize(ops); j += 2) { - BinopEffectsTester B(ops[j], Type::Object(), Type::Number()); + BinopEffectsTester B(ops[j], Type::Boolean(), Type::Number()); Node* i0 = B.CheckConvertedInput(IrOpcode::kJSToNumber, 0, true); Node* i1 = B.CheckNoOp(1); diff --git a/test/mjsunit/mjsunit.status b/test/mjsunit/mjsunit.status index 6645074c06..4200749a4a 100644 --- a/test/mjsunit/mjsunit.status +++ b/test/mjsunit/mjsunit.status @@ -92,7 +92,6 @@ 'compiler/osr-warm': [PASS, NO_VARIANTS], 'compiler/regress-3136962': [PASS, NO_VARIANTS], 'harmony/proxies-json': [PASS, NO_VARIANTS], - 'regress/regress-3476': [PASS, NO_VARIANTS], 'regress/regress-760-1': [PASS, NO_VARIANTS], 'regress/regress-760-2': [PASS, NO_VARIANTS], 'regress/regress-crbug-357052': [PASS, NO_VARIANTS],