Reviewers: titzer,
Description:
Fix typed lowering to number comparison.
[email protected]
TEST=mjsunit/regress/regress-3564
BUG=v8:3564
LOG=N
Please review this at https://codereview.chromium.org/574653002/
SVN Base: https://v8.googlecode.com/svn/branches/bleeding_edge
Affected files (+9, -7 lines):
M src/compiler/js-typed-lowering.cc
A + test/mjsunit/regress/regress-3564.js
Index: src/compiler/js-typed-lowering.cc
diff --git a/src/compiler/js-typed-lowering.cc
b/src/compiler/js-typed-lowering.cc
index
9f1e7eb8914b5ae824a080718fcebee55c70d58a..55be216ffe63cff80675f3976e7973ce312ca5b3
100644
--- a/src/compiler/js-typed-lowering.cc
+++ b/src/compiler/js-typed-lowering.cc
@@ -303,7 +303,9 @@ Reduction JSTypedLowering::ReduceJSComparison(Node*
node) {
return NoChange();
}
return r.ChangeToPureOperator(stringOp);
- } else if (r.OneInputCannotBe(Type::String())) {
+ }
+ Type* maybe_string = Type::Union(Type::String(), Type::Receiver(),
zone());
+ if (r.OneInputCannotBe(maybe_string)) {
// If one input cannot be a string, then emit a number comparison.
const Operator* less_than;
const Operator* less_than_or_equal;
Index: test/mjsunit/regress/regress-3564.js
diff --git a/test/mjsunit/regress/regress-3476.js
b/test/mjsunit/regress/regress-3564.js
similarity index 55%
copy from test/mjsunit/regress/regress-3476.js
copy to test/mjsunit/regress/regress-3564.js
index
f4333dbbfc0702085b4d36c493c8b6dcc0a481db..a0b9eb299456f6e8e10266b37c3c0c3b9b9b0d5e
100644
--- a/test/mjsunit/regress/regress-3476.js
+++ b/test/mjsunit/regress/regress-3564.js
@@ -9,13 +9,13 @@ function MyWrapper(v) {
}
function f() {
- assertEquals("truex", true + "x");
- assertEquals("truey", true + new String("y"));
- assertEquals("truez", true + new MyWrapper("z"));
+ assertTrue("a" < "x");
+ assertTrue("a" < new String("y"));
+ assertTrue("a" < new MyWrapper("z"));
- assertEquals("xtrue", "x" + true);
- assertEquals("ytrue", new String("y") + true);
- assertEquals("ztrue", new MyWrapper("z") + true);
+ assertFalse("a" > "x");
+ assertFalse("a" > new String("y"));
+ assertFalse("a" > new MyWrapper("z"));
}
f();
--
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
---
You received this message because you are subscribed to the Google Groups "v8-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/d/optout.
