From: mstarzinger@chromium.org <mstarzinger@chromium.org>
Date: Thu, 11 Sep 2014 16:09:21 +0000 (+0000)
Subject: Fix typed lowering of JSAdd on non-number inputs.
X-Git-Tag: upstream/4.7.83~6972
X-Git-Url: http://review.tizen.org/git/?a=commitdiff_plain;h=b930ef1012d11fdc1e66e5d9663b51bd6b479154;p=platform%2Fupstream%2Fv8.git

Fix typed lowering of JSAdd on non-number inputs.

R=rossberg@chromium.org
TEST=mjsunit/regress/regress-3476

Review URL: https://codereview.chromium.org/564823003

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@23883 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
---

diff --git a/src/compiler/js-typed-lowering.cc b/src/compiler/js-typed-lowering.cc
index 8690962..9f1e7eb 100644
--- a/src/compiler/js-typed-lowering.cc
+++ b/src/compiler/js-typed-lowering.cc
@@ -222,14 +222,23 @@ class JSBinopReduction {
 
 Reduction JSTypedLowering::ReduceJSAdd(Node* node) {
   JSBinopReduction r(this, node);
-  if (r.OneInputIs(Type::String())) {
-    r.ConvertInputsToString();
-    return r.ChangeToPureOperator(simplified()->StringAdd());
+  if (r.BothInputsAre(Type::Number())) {
+    // JSAdd(x:number, y:number) => NumberAdd(x, y)
+    return r.ChangeToPureOperator(simplified()->NumberAdd());
   }
-  if (r.NeitherInputCanBe(Type::String())) {
+  Type* maybe_string = Type::Union(Type::String(), Type::Receiver(), zone());
+  if (r.NeitherInputCanBe(maybe_string)) {
+    // JSAdd(x:-string, y:-string) => NumberAdd(ToNumber(x), ToNumber(y))
     r.ConvertInputsToNumber();
     return r.ChangeToPureOperator(simplified()->NumberAdd());
   }
+  if (r.OneInputIs(Type::String())) {
+    // JSAdd(x:string, y:string) => StringAdd(x, y)
+    // JSAdd(x:string, y) => StringAdd(x, ToString(y))
+    // JSAdd(x, y:string) => StringAdd(ToString(x), y)
+    r.ConvertInputsToString();
+    return r.ChangeToPureOperator(simplified()->StringAdd());
+  }
   return NoChange();
 }
 
diff --git a/src/compiler/js-typed-lowering.h b/src/compiler/js-typed-lowering.h
index ebd2d85..4a10092 100644
--- a/src/compiler/js-typed-lowering.h
+++ b/src/compiler/js-typed-lowering.h
@@ -26,6 +26,7 @@ class JSTypedLowering FINAL : public Reducer {
 
   JSGraph* jsgraph() { return jsgraph_; }
   Graph* graph() { return jsgraph_->graph(); }
+  Zone* zone() { return jsgraph_->zone(); }
 
  private:
   friend class JSBinopReduction;
diff --git a/test/cctest/compiler/test-js-typed-lowering.cc b/test/cctest/compiler/test-js-typed-lowering.cc
index adb1e62..ee5293f 100644
--- a/test/cctest/compiler/test-js-typed-lowering.cc
+++ b/test/cctest/compiler/test-js-typed-lowering.cc
@@ -1024,7 +1024,7 @@ TEST(OrderNumberBinopEffects2) {
   };
 
   for (size_t j = 0; j < arraysize(ops); j += 2) {
-    BinopEffectsTester B(ops[j], Type::Number(), Type::Object());
+    BinopEffectsTester B(ops[j], Type::Number(), Type::Boolean());
 
     Node* i0 = B.CheckNoOp(0);
     Node* i1 = B.CheckConvertedInput(IrOpcode::kJSToNumber, 1, true);
@@ -1037,7 +1037,7 @@ TEST(OrderNumberBinopEffects2) {
   }
 
   for (size_t j = 0; j < arraysize(ops); j += 2) {
-    BinopEffectsTester B(ops[j], Type::Object(), Type::Number());
+    BinopEffectsTester B(ops[j], Type::Boolean(), Type::Number());
 
     Node* i0 = B.CheckConvertedInput(IrOpcode::kJSToNumber, 0, true);
     Node* i1 = B.CheckNoOp(1);
diff --git a/test/mjsunit/mjsunit.status b/test/mjsunit/mjsunit.status
index 6645074..4200749 100644
--- a/test/mjsunit/mjsunit.status
+++ b/test/mjsunit/mjsunit.status
@@ -92,7 +92,6 @@
   'compiler/osr-warm': [PASS, NO_VARIANTS],
   'compiler/regress-3136962': [PASS, NO_VARIANTS],
   'harmony/proxies-json': [PASS, NO_VARIANTS],
-  'regress/regress-3476': [PASS, NO_VARIANTS],
   'regress/regress-760-1': [PASS, NO_VARIANTS],
   'regress/regress-760-2': [PASS, NO_VARIANTS],
   'regress/regress-crbug-357052': [PASS, NO_VARIANTS],