diff --git a/src/compiler/operation-typer.cc b/src/compiler/operation-typer.cc index 226faeaa82..fc774f8706 100644 --- a/src/compiler/operation-typer.cc +++ b/src/compiler/operation-typer.cc @@ -510,7 +510,7 @@ Type* OperationTyper::NumberToString(Type* type) { if (type->IsNone()) return type; if (type->Is(Type::NaN())) return singleton_NaN_string_; if (type->Is(cache_.kZeroOrMinusZero)) return singleton_zero_string_; - return Type::SeqString(); + return Type::String(); } Type* OperationTyper::NumberToUint32(Type* type) { diff --git a/test/mjsunit/regress/regress-crbug-822284.js b/test/mjsunit/regress/regress-crbug-822284.js new file mode 100644 index 0000000000..97a38259e3 --- /dev/null +++ b/test/mjsunit/regress/regress-crbug-822284.js @@ -0,0 +1,22 @@ +// Copyright 2018 the V8 project authors. All rights reserved. +// Use of this source code is governed by a BSD-style license that can be +// found in the LICENSE file. + +// Flags: --allow-natives-syntax + +function foo(a) { + a = "" + Math.abs(a); + return a.charCodeAt(0); +} + +// Add '1' to the number to string table (as SeqString). +String.fromCharCode(49); + +// Turn the SeqString into a ThinString via forced internalization. +const o = {}; +o[(1).toString()] = 1; + +assertEquals(49, foo(1)); +assertEquals(49, foo(1)); +%OptimizeFunctionOnNextCall(foo); +assertEquals(49, foo(1));