Make sure to invoke valueOf methods on both operands of & and >> -- even...

src/runtime.js

 // Copyright 2006-2008 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 206 matching lines @@
   if (!IS_NUMBER(y)) y = %ToNumber(y);
   return %NumberOr(x, y);
 }
 
 
 // ECMA-262, section 11.10, page 57.
 function BIT_AND(y) {
   var x;
   if (IS_NUMBER(this)) {
     x = this;
+    if (!IS_NUMBER(y)) y = %ToNumber(y);
   } else {
     x = %ToNumber(this);
+    // Make sure to convert the right operand to a number before
+    // bailing out in the fast case, but after converting the
+    // left operand. This ensures that valueOf methods on the right
+    // operand are always executed.
+    if (!IS_NUMBER(y)) y = %ToNumber(y);
     // Optimize for the case where we end up AND'ing a value
     // that doesn't convert to a number. This is common in
     // certain benchmarks.
     if (NUMBER_IS_NAN(x)) return 0;
   }
-  if (!IS_NUMBER(y)) y = %ToNumber(y);
   return %NumberAnd(x, y);
 }
 
 
 // ECMA-262, section 11.10, page 57.
 function BIT_XOR(y) {
   var x = IS_NUMBER(this) ? this : %ToNumber(this);
   if (!IS_NUMBER(y)) y = %ToNumber(y);
   return %NumberXor(x, y);
 }
@@ skipping 19 matching lines @@
   if (!IS_NUMBER(y)) y = %ToNumber(y);
   return %NumberShl(x, y);
 }
 
 
 // ECMA-262, section 11.7.2, page 51.
 function SAR(y) {
   var x;
   if (IS_NUMBER(this)) {
     x = this;
+    if (!IS_NUMBER(y)) y = %ToNumber(y);
   } else {
     x = %ToNumber(this);
+    // Make sure to convert the right operand to a number before
+    // bailing out in the fast case, but after converting the
+    // left operand. This ensures that valueOf methods on the right
+    // operand are always executed.
+    if (!IS_NUMBER(y)) y = %ToNumber(y);
     // Optimize for the case where we end up shifting a value
     // that doesn't convert to a number. This is common in
     // certain benchmarks.
     if (NUMBER_IS_NAN(x)) return 0;
   }
-  if (!IS_NUMBER(y)) y = %ToNumber(y);
   return %NumberSar(x, y);
 }
 
 
 // ECMA-262, section 11.7.3, page 52.
 function SHR(y) {
   var x = IS_NUMBER(this) ? this : %ToNumber(this);
   if (!IS_NUMBER(y)) y = %ToNumber(y);
   return %NumberShr(x, y);
 }
@@ skipping 276 matching lines @@
   throw %MakeTypeError('cannot_convert_to_primitive', []);
 }
 
 
 // NOTE: Setting the prototype for Array must take place as early as
 // possible due to code generation for array literals.  When
 // generating code for a array literal a boilerplate array is created
 // that is cloned when running the code.  It is essiential that the
 // boilerplate gets the right prototype.
 %FunctionSetPrototype($Array, new $Array(0));