Reviewers: rossberg,
https://codereview.chromium.org/564823003/diff/1/src/compiler/js-typed-lowering.cc
File src/compiler/js-typed-lowering.cc (right):
https://codereview.chromium.org/564823003/diff/1/src/compiler/js-typed-lowering.cc#newcode231
src/compiler/js-typed-lowering.cc:231: // JSAdd(x:-string, y:-string) =>
NumberAdd(ToNumber(x), ToNumber(y))
I convinced myself that this is correct for ES5, could you please make
extra-sure on whether this also holds in ES6?
Description:
Fix typed lowering of JSAdd on non-number inputs.
[email protected]
TEST=mjsunit/regress/regress-3476
Please review this at https://codereview.chromium.org/564823003/
SVN Base: https://v8.googlecode.com/svn/branches/bleeding_edge
Affected files (+16, -7 lines):
M src/compiler/js-typed-lowering.h
M src/compiler/js-typed-lowering.cc
M test/cctest/compiler/test-js-typed-lowering.cc
M test/mjsunit/mjsunit.status
Index: src/compiler/js-typed-lowering.cc
diff --git a/src/compiler/js-typed-lowering.cc
b/src/compiler/js-typed-lowering.cc
index
869096232ffac2c1d3d93f1474068f8d308add49..9f1e7eb8914b5ae824a080718fcebee55c70d58a
100644
--- a/src/compiler/js-typed-lowering.cc
+++ b/src/compiler/js-typed-lowering.cc
@@ -222,14 +222,23 @@ class JSBinopReduction {
Reduction JSTypedLowering::ReduceJSAdd(Node* node) {
JSBinopReduction r(this, node);
- if (r.OneInputIs(Type::String())) {
- r.ConvertInputsToString();
- return r.ChangeToPureOperator(simplified()->StringAdd());
+ if (r.BothInputsAre(Type::Number())) {
+ // JSAdd(x:number, y:number) => NumberAdd(x, y)
+ return r.ChangeToPureOperator(simplified()->NumberAdd());
}
- if (r.NeitherInputCanBe(Type::String())) {
+ Type* maybe_string = Type::Union(Type::String(), Type::Receiver(),
zone());
+ if (r.NeitherInputCanBe(maybe_string)) {
+ // JSAdd(x:-string, y:-string) => NumberAdd(ToNumber(x), ToNumber(y))
r.ConvertInputsToNumber();
return r.ChangeToPureOperator(simplified()->NumberAdd());
}
+ if (r.OneInputIs(Type::String())) {
+ // JSAdd(x:string, y:string) => StringAdd(x, y)
+ // JSAdd(x:string, y) => StringAdd(x, ToString(y))
+ // JSAdd(x, y:string) => StringAdd(ToString(x), y)
+ r.ConvertInputsToString();
+ return r.ChangeToPureOperator(simplified()->StringAdd());
+ }
return NoChange();
}
Index: src/compiler/js-typed-lowering.h
diff --git a/src/compiler/js-typed-lowering.h
b/src/compiler/js-typed-lowering.h
index
ebd2d854bb4f62f2e51d1b3109e913bc6b8cf6bf..4a10092fa86a1ce294e4ee544c59bccf8cceeaff
100644
--- a/src/compiler/js-typed-lowering.h
+++ b/src/compiler/js-typed-lowering.h
@@ -26,6 +26,7 @@ class JSTypedLowering FINAL : public Reducer {
JSGraph* jsgraph() { return jsgraph_; }
Graph* graph() { return jsgraph_->graph(); }
+ Zone* zone() { return jsgraph_->zone(); }
private:
friend class JSBinopReduction;
Index: test/cctest/compiler/test-js-typed-lowering.cc
diff --git a/test/cctest/compiler/test-js-typed-lowering.cc
b/test/cctest/compiler/test-js-typed-lowering.cc
index
adb1e627211e82dfdbba4a22cda3fcb889449256..ee5293f40e21ad0c2d13ceb5606871c5d2fea110
100644
--- a/test/cctest/compiler/test-js-typed-lowering.cc
+++ b/test/cctest/compiler/test-js-typed-lowering.cc
@@ -1024,7 +1024,7 @@ TEST(OrderNumberBinopEffects2) {
};
for (size_t j = 0; j < arraysize(ops); j += 2) {
- BinopEffectsTester B(ops[j], Type::Number(), Type::Object());
+ BinopEffectsTester B(ops[j], Type::Number(), Type::Boolean());
Node* i0 = B.CheckNoOp(0);
Node* i1 = B.CheckConvertedInput(IrOpcode::kJSToNumber, 1, true);
@@ -1037,7 +1037,7 @@ TEST(OrderNumberBinopEffects2) {
}
for (size_t j = 0; j < arraysize(ops); j += 2) {
- BinopEffectsTester B(ops[j], Type::Object(), Type::Number());
+ BinopEffectsTester B(ops[j], Type::Boolean(), Type::Number());
Node* i0 = B.CheckConvertedInput(IrOpcode::kJSToNumber, 0, true);
Node* i1 = B.CheckNoOp(1);
Index: test/mjsunit/mjsunit.status
diff --git a/test/mjsunit/mjsunit.status b/test/mjsunit/mjsunit.status
index
6645074c069e9fcb3bb5bab8dea03fc5a68c95e7..4200749a4a580aa134545383b18e147c83b9f775
100644
--- a/test/mjsunit/mjsunit.status
+++ b/test/mjsunit/mjsunit.status
@@ -92,7 +92,6 @@
'compiler/osr-warm': [PASS, NO_VARIANTS],
'compiler/regress-3136962': [PASS, NO_VARIANTS],
'harmony/proxies-json': [PASS, NO_VARIANTS],
- 'regress/regress-3476': [PASS, NO_VARIANTS],
'regress/regress-760-1': [PASS, NO_VARIANTS],
'regress/regress-760-2': [PASS, NO_VARIANTS],
'regress/regress-crbug-357052': [PASS, NO_VARIANTS],
--
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
---
You received this message because you are subscribed to the Google Groups "v8-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/d/optout.
