AuroraMiddleware/v8
1
0
Fork 0
Code Issues 2 Pull Requests Releases Wiki Activity

Fix typed lowering of JSAdd on non-number inputs.

Browse Source 
R=rossberg@chromium.org
TEST=mjsunit/regress/regress-3476

Review URL: https://codereview.chromium.org/564823003

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@23883 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
This commit is contained in:
mstarzinger@chromium.org 2014-09-11 16:09:21 +00:00
parent 9951770a30
commit b930ef1012
4 changed files with 16 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

17
src/compiler/js-typed-lowering.cc
View File

@ -222,14 +222,23 @@ class JSBinopReduction {
Reduction JSTypedLowering::ReduceJSAdd(Node* node) { Reduction JSTypedLowering::ReduceJSAdd(Node* node) {
JSBinopReduction r(this, node); JSBinopReduction r(this, node);
if (r.OneInputIs(Type::String())) { if (r.BothInputsAre(Type::Number())) {
r.ConvertInputsToString(); // JSAdd(x:number, y:number) => NumberAdd(x, y)
return r.ChangeToPureOperator(simplified()->StringAdd()); return r.ChangeToPureOperator(simplified()->NumberAdd());
} }
if (r.NeitherInputCanBe(Type::String())) { Type* maybe_string = Type::Union(Type::String(), Type::Receiver(), zone());
if (r.NeitherInputCanBe(maybe_string)) {
// JSAdd(x:-string, y:-string) => NumberAdd(ToNumber(x), ToNumber(y))
r.ConvertInputsToNumber(); r.ConvertInputsToNumber();
return r.ChangeToPureOperator(simplified()->NumberAdd()); return r.ChangeToPureOperator(simplified()->NumberAdd());
} }
if (r.OneInputIs(Type::String())) {
// JSAdd(x:string, y:string) => StringAdd(x, y)
// JSAdd(x:string, y) => StringAdd(x, ToString(y))
// JSAdd(x, y:string) => StringAdd(ToString(x), y)
r.ConvertInputsToString();
return r.ChangeToPureOperator(simplified()->StringAdd());
}
return NoChange(); return NoChange();
} }

1
src/compiler/js-typed-lowering.h
View File

@ -26,6 +26,7 @@ class JSTypedLowering FINAL : public Reducer {
JSGraph* jsgraph() { return jsgraph_; } JSGraph* jsgraph() { return jsgraph_; }
Graph* graph() { return jsgraph_->graph(); } Graph* graph() { return jsgraph_->graph(); }
Zone* zone() { return jsgraph_->zone(); }
private: private:
friend class JSBinopReduction; friend class JSBinopReduction;

4
test/cctest/compiler/test-js-typed-lowering.cc
View File

@ -1024,7 +1024,7 @@ TEST(OrderNumberBinopEffects2) {
}; };
for (size_t j = 0; j < arraysize(ops); j += 2) { for (size_t j = 0; j < arraysize(ops); j += 2) {
BinopEffectsTester B(ops[j], Type::Number(), Type::Object()); BinopEffectsTester B(ops[j], Type::Number(), Type::Boolean());
Node* i0 = B.CheckNoOp(0); Node* i0 = B.CheckNoOp(0);
Node* i1 = B.CheckConvertedInput(IrOpcode::kJSToNumber, 1, true); Node* i1 = B.CheckConvertedInput(IrOpcode::kJSToNumber, 1, true);
@ -1037,7 +1037,7 @@ TEST(OrderNumberBinopEffects2) {
} }
for (size_t j = 0; j < arraysize(ops); j += 2) { for (size_t j = 0; j < arraysize(ops); j += 2) {
BinopEffectsTester B(ops[j], Type::Object(), Type::Number()); BinopEffectsTester B(ops[j], Type::Boolean(), Type::Number());
Node* i0 = B.CheckConvertedInput(IrOpcode::kJSToNumber, 0, true); Node* i0 = B.CheckConvertedInput(IrOpcode::kJSToNumber, 0, true);
Node* i1 = B.CheckNoOp(1); Node* i1 = B.CheckNoOp(1);

1
test/mjsunit/mjsunit.status
View File

@ -92,7 +92,6 @@
'compiler/osr-warm': [PASS, NO_VARIANTS], 'compiler/osr-warm': [PASS, NO_VARIANTS],
'compiler/regress-3136962': [PASS, NO_VARIANTS], 'compiler/regress-3136962': [PASS, NO_VARIANTS],
'harmony/proxies-json': [PASS, NO_VARIANTS], 'harmony/proxies-json': [PASS, NO_VARIANTS],
'regress/regress-3476': [PASS, NO_VARIANTS],
'regress/regress-760-1': [PASS, NO_VARIANTS], 'regress/regress-760-1': [PASS, NO_VARIANTS],
'regress/regress-760-2': [PASS, NO_VARIANTS], 'regress/regress-760-2': [PASS, NO_VARIANTS],
'regress/regress-crbug-357052': [PASS, NO_VARIANTS], 'regress/regress-crbug-357052': [PASS, NO_VARIANTS],