Fix typed lowering of ToBoolean on NaN input.

R=rossberg@chromium.org
TEST=webkit/convert-nan-to-bool

Review URL: https://codereview.chromium.org/565493003

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@23875 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

diff --git a/src/compiler/js-typed-lowering.cc b/src/compiler/js-typed-lowering.cc
index c4e7b2b..8690962 100644 (file)
--- a/src/compiler/js-typed-lowering.cc
+++ b/src/compiler/js-typed-lowering.cc
@@ -416,7 +416,7 @@ Reduction JSTypedLowering::ReduceJSToNumberInput(Node* input) {
   }
   Type* input_type = NodeProperties::GetBounds(input).upper;
   if (input_type->Is(Type::Number())) {
-    // JSToNumber(number) => x
+    // JSToNumber(x:number) => x
     return Changed(input);
   }
   if (input_type->Is(Type::Undefined())) {
@@ -427,8 +427,8 @@ Reduction JSTypedLowering::ReduceJSToNumberInput(Node* input) {
     // JSToNumber(null) => #0
     return ReplaceWith(jsgraph()->ZeroConstant());
   }
-  // TODO(turbofan): js-typed-lowering of ToNumber(boolean)
-  // TODO(turbofan): js-typed-lowering of ToNumber(string)
+  // TODO(turbofan): js-typed-lowering of ToNumber(x:boolean)
+  // TODO(turbofan): js-typed-lowering of ToNumber(x:string)
   return NoChange();
 }
 
@@ -445,7 +445,7 @@ Reduction JSTypedLowering::ReduceJSToStringInput(Node* input) {
   }
   Type* input_type = NodeProperties::GetBounds(input).upper;
   if (input_type->Is(Type::String())) {
-    return Changed(input);  // JSToString(string) => x
+    return Changed(input);  // JSToString(x:string) => x
   }
   if (input_type->Is(Type::Undefined())) {
     return ReplaceWith(jsgraph()->HeapConstant(
@@ -455,8 +455,8 @@ Reduction JSTypedLowering::ReduceJSToStringInput(Node* input) {
     return ReplaceWith(jsgraph()->HeapConstant(
         graph()->zone()->isolate()->factory()->null_string()));
   }
-  // TODO(turbofan): js-typed-lowering of ToString(boolean)
-  // TODO(turbofan): js-typed-lowering of ToString(number)
+  // TODO(turbofan): js-typed-lowering of ToString(x:boolean)
+  // TODO(turbofan): js-typed-lowering of ToString(x:number)
   return NoChange();
 }
 
@@ -473,7 +473,7 @@ Reduction JSTypedLowering::ReduceJSToBooleanInput(Node* input) {
   }
   Type* input_type = NodeProperties::GetBounds(input).upper;
   if (input_type->Is(Type::Boolean())) {
-    return Changed(input);  // JSToBoolean(boolean) => x
+    return Changed(input);  // JSToBoolean(x:boolean) => x
   }
   if (input_type->Is(Type::Undefined())) {
     // JSToBoolean(undefined) => #false
@@ -484,15 +484,15 @@ Reduction JSTypedLowering::ReduceJSToBooleanInput(Node* input) {
     return ReplaceWith(jsgraph()->FalseConstant());
   }
   if (input_type->Is(Type::DetectableReceiver())) {
-    // JSToBoolean(detectable) => #true
+    // JSToBoolean(x:detectable) => #true
     return ReplaceWith(jsgraph()->TrueConstant());
   }
   if (input_type->Is(Type::Undetectable())) {
-    // JSToBoolean(undetectable) => #false
+    // JSToBoolean(x:undetectable) => #false
     return ReplaceWith(jsgraph()->FalseConstant());
   }
-  if (input_type->Is(Type::Number())) {
-    // JSToBoolean(number) => BooleanNot(NumberEqual(x, #0))
+  if (input_type->Is(Type::OrderedNumber())) {
+    // JSToBoolean(x:ordered-number) => BooleanNot(NumberEqual(x, #0))
     Node* cmp = graph()->NewNode(simplified()->NumberEqual(), input,
                                  jsgraph()->ZeroConstant());
     Node* inv = graph()->NewNode(simplified()->BooleanNot(), cmp);
@@ -629,7 +629,7 @@ Reduction JSTypedLowering::Reduce(Node* node) {
       Reduction result = ReduceJSToBooleanInput(node->InputAt(0));
       Node* value;
       if (result.Changed()) {
-        // JSUnaryNot(x) => BooleanNot(x)
+        // JSUnaryNot(x:boolean) => BooleanNot(x)
         value =
             graph()->NewNode(simplified()->BooleanNot(), result.replacement());
         NodeProperties::ReplaceWithValue(node, value);

diff --git a/src/types.h b/src/types.h
index cca8b31..2b77ad7 100644 (file)
--- a/src/types.h
+++ b/src/types.h
@@ -193,7 +193,8 @@ namespace internal {
   V(Signed32,            kSignedSmall | kOtherUnsigned31 | kOtherSigned32) \
   V(Unsigned32,          kUnsignedSmall | kOtherUnsigned31 | kOtherUnsigned32) \
   V(Integral32,          kSigned32 | kUnsigned32) \
-  V(Number,              kIntegral32 | kMinusZero | kNaN | kOtherNumber) \
+  V(OrderedNumber,       kIntegral32 | kMinusZero | kOtherNumber) \
+  V(Number,              kOrderedNumber | kNaN) \
   V(String,              kInternalizedString | kOtherString) \
   V(UniqueName,          kSymbol | kInternalizedString) \
   V(Name,                kSymbol | kString) \

diff --git a/test/cctest/compiler/test-js-typed-lowering.cc b/test/cctest/compiler/test-js-typed-lowering.cc
index a7ffc67..adb1e62 100644 (file)
--- a/test/cctest/compiler/test-js-typed-lowering.cc
+++ b/test/cctest/compiler/test-js-typed-lowering.cc
@@ -472,12 +472,12 @@ TEST(JSToBoolean) {
     CHECK_EQ(IrOpcode::kParameter, r->opcode());
   }
 
-  {  // ToBoolean(number)
-    Node* r = R.ReduceUnop(op, Type::Number());
+  {  // ToBoolean(ordered-number)
+    Node* r = R.ReduceUnop(op, Type::OrderedNumber());
     CHECK_EQ(IrOpcode::kBooleanNot, r->opcode());
     Node* i = r->InputAt(0);
     CHECK_EQ(IrOpcode::kNumberEqual, i->opcode());
-    // ToBoolean(number) => BooleanNot(NumberEqual(x, #0))
+    // ToBoolean(x:ordered-number) => BooleanNot(NumberEqual(x, #0))
   }
 
   {  // ToBoolean(string)
@@ -507,7 +507,7 @@ TEST(JSToBoolean_replacement) {
   JSTypedLoweringTester R;
 
   Type* types[] = {Type::Null(),             Type::Undefined(),
-                   Type::Boolean(),          Type::Number(),
+                   Type::Boolean(),          Type::OrderedNumber(),
                    Type::DetectableObject(), Type::Undetectable()};
 
   for (size_t i = 0; i < arraysize(types); i++) {
@@ -522,7 +522,7 @@ TEST(JSToBoolean_replacement) {
 
     if (types[i]->Is(Type::Boolean())) {
       CHECK_EQ(n, r);
-    } else if (types[i]->Is(Type::Number())) {
+    } else if (types[i]->Is(Type::OrderedNumber())) {
       CHECK_EQ(IrOpcode::kBooleanNot, r->opcode());
     } else {
       CHECK_EQ(IrOpcode::kHeapConstant, r->opcode());

diff --git a/test/mozilla/mozilla.status b/test/mozilla/mozilla.status
index 9e8b0af..592f762 100644 (file)
--- a/test/mozilla/mozilla.status
+++ b/test/mozilla/mozilla.status
@@ -63,9 +63,6 @@
   # TODO(turbofan): Large switch statements crash.
   'js1_5/Regress/regress-398085-01': [PASS, NO_VARIANTS],
 
-  # TODO(mstarzinger): Typed lowering screws up ToBoolean somehow.
-  'ecma/TypeConversion/9.2': [PASS, NO_VARIANTS],
-
   ##################### SKIPPED TESTS #####################
 
   # This test checks that we behave properly in an out-of-memory

diff --git a/test/webkit/webkit.status b/test/webkit/webkit.status
index 4f00530..8398b08 100644 (file)
--- a/test/webkit/webkit.status
+++ b/test/webkit/webkit.status
@@ -37,8 +37,6 @@
   'exception-with-handler-inside-eval-with-dynamic-scope': [PASS, NO_VARIANTS],
   # TODO(turbofan): We run out of stack earlier on 64-bit for now.
   'fast/js/deep-recursion-test': [PASS, NO_VARIANTS],
-  # TODO(mstarzinger): Typed lowering screws up ToBoolean somehow.
-  'convert-nan-to-bool': [PASS, NO_VARIANTS],
   # TODO(mstarzinger): Causes crash in generated code, needs investigation.
   'dfg-arguments-osr-exit': [PASS, NO_VARIANTS],
   'dfg-arguments-osr-exit-multiple-blocks': [PASS, NO_VARIANTS],