[strong] Disallow implicit conversions for bitwise ops, shifts

src/compiler/js-typed-lowering.cc

 // Copyright 2014 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/compiler/access-builder.h"
 #include "src/compiler/js-graph.h"
 #include "src/compiler/js-typed-lowering.h"
 #include "src/compiler/node-matchers.h"
 #include "src/compiler/node-properties.h"
 #include "src/compiler/operator-properties.h"
@@ skipping 327 matching lines @@
   }
 #endif
   return NoChange();
 }
 
 
 Reduction JSTypedLowering::ReduceNumberBinop(Node* node,
                                              const Operator* numberOp) {
   JSBinopReduction r(this, node);
   if (is_strong(OpParameter<LanguageMode>(node))) {
-    if (r.left_type()->Is(Type::Number()) &&
-        (r.right_type()->Is(Type::Number()))) {
+    if (r.BothInputsAre(Type::Number())) {
       return r.ChangeToPureOperator(numberOp, Type::Number());
     }
     return NoChange();
   }
   Node* frame_state = NodeProperties::GetFrameStateInput(node, 1);
   r.ConvertInputsToNumber(frame_state);
   return r.ChangeToPureOperator(numberOp, Type::Number());
 }
 
 
 Reduction JSTypedLowering::ReduceInt32Binop(Node* node, const Operator* intOp) {
   JSBinopReduction r(this, node);
+  if (is_strong(OpParameter<LanguageMode>(node))) {
+    if (r.BothInputsAre(Type::Number())) {

[arv (Not doing code reviews), 2015/04/24 15:39:42]

Let me make sure I understand this. If the operands are not numbers we keep the
nodes which will cause the runtime call which will throw?

[conradw, 2015/04/27 11:20:47]

Yes. Without this case the Binop call could be lowered while inputs are
not guaranteed to be numbers (since convertInputsToNumber is used), which
would effectively replace the strong mode version with the sloppy mode
version. I made a mistake in the shift version of this, which I've fixed
in the next patchset.

+      r.ConvertInputsToUI32(kSigned, kSigned);
+      return r.ChangeToPureOperator(intOp, Type::Integral32());
+    }
+    return NoChange();
+  }
   Node* frame_state = NodeProperties::GetFrameStateInput(node, 1);
   r.ConvertInputsToNumber(frame_state);
   r.ConvertInputsToUI32(kSigned, kSigned);
   return r.ChangeToPureOperator(intOp, Type::Integral32());
 }
 
 
 Reduction JSTypedLowering::ReduceUI32Shift(Node* node,
                                            Signedness left_signedness,
                                            const Operator* shift_op) {
   JSBinopReduction r(this, node);
+  if (is_strong(OpParameter<LanguageMode>(node))) {
+    if (r.BothInputsAre(Type::Number())) {
+      r.ConvertInputsToUI32(left_signedness, kUnsigned);
+      return r.ChangeToPureOperator(shift_op, Type::Integral32());
+    }
+    return NoChange();
+  }
   if (r.BothInputsAre(Type::Primitive())) {
     r.ConvertInputsForShift(left_signedness);
     return r.ChangeToPureOperator(shift_op, Type::Integral32());
   }
   return NoChange();
 }
 
 
 Reduction JSTypedLowering::ReduceJSComparison(Node* node) {
   JSBinopReduction r(this, node);
@@ skipping 693 matching lines @@
 }
 
 
 MachineOperatorBuilder* JSTypedLowering::machine() const {
   return jsgraph()->machine();
 }
 
 }  // namespace compiler
 }  // namespace internal
 }  // namespace v8