From 19509c4a5c10a04a0cba4d834a9f965f7423a82e Mon Sep 17 00:00:00 2001 From: Geoffrey Garen Date: Thu, 25 Sep 2014 13:58:36 +0200 Subject: REGRESSION: `if (false === (true && undefined)) console.log("wrong!");` logs "wrong!", shouldn't! https://bugs.webkit.org/show_bug.cgi?id=123179 Reviewed by Mark Hahnenberg. Source/JavaScriptCore: * parser/NodeConstructors.h: (JSC::LogicalOpNode::LogicalOpNode): * parser/ResultType.h: (JSC::ResultType::forLogicalOp): Don't assume that && produces a boolean. This is JavaScript (aka Sparta). LayoutTests: * js/dom/branch-fold-correctness.html: Added a test for this case. Change-Id: I72f81f31d88dee306428dd5eab9d40fcec009042 git-svn-id: http://svn.webkit.org/repository/webkit/trunk@157830 268f45cc-cd09-0410-ab3c-d52691b4dbfc Reviewed-by: Michael Bruning --- Source/JavaScriptCore/parser/NodeConstructors.h | 2 +- Source/JavaScriptCore/parser/ResultType.h | 15 ++++++++++++++- 2 files changed, 15 insertions(+), 2 deletions(-) (limited to 'Source/JavaScriptCore/parser') diff --git a/Source/JavaScriptCore/parser/NodeConstructors.h b/Source/JavaScriptCore/parser/NodeConstructors.h index b31c01432..4bc670f81 100644 --- a/Source/JavaScriptCore/parser/NodeConstructors.h +++ b/Source/JavaScriptCore/parser/NodeConstructors.h @@ -517,7 +517,7 @@ inline ResolveNode::ResolveNode(const JSTokenLocation& location, const Identifie } inline LogicalOpNode::LogicalOpNode(const JSTokenLocation& location, ExpressionNode* expr1, ExpressionNode* expr2, LogicalOperator oper) - : ExpressionNode(location, ResultType::booleanType()) + : ExpressionNode(location, ResultType::forLogicalOp(expr1->resultDescriptor(), expr2->resultDescriptor())) , m_expr1(expr1) , m_expr2(expr2) , m_operator(oper) diff --git a/Source/JavaScriptCore/parser/ResultType.h b/Source/JavaScriptCore/parser/ResultType.h index de4bde66b..ad86c98c7 100644 --- a/Source/JavaScriptCore/parser/ResultType.h +++ b/Source/JavaScriptCore/parser/ResultType.h @@ -120,7 +120,20 @@ namespace JSC { return stringType(); return stringOrNumberType(); } - + + // Unlike in C, a logical op produces the value of the + // last expression evaluated (and not true or false). + static ResultType forLogicalOp(ResultType op1, ResultType op2) + { + if (op1.definitelyIsBoolean() && op2.definitelyIsBoolean()) + return booleanType(); + if (op1.definitelyIsNumber() && op2.definitelyIsNumber()) + return numberType(); + if (op1.definitelyIsString() && op2.definitelyIsString()) + return stringType(); + return unknownType(); + } + static ResultType forBitOp() { return numberTypeIsInt32(); -- cgit v1.2.1