[strong] Disallow implicit conversions for bitwise ops, shifts

src/compiler/js-typed-lowering.cc

Index: src/compiler/js-typed-lowering.cc
diff --git a/src/compiler/js-typed-lowering.cc b/src/compiler/js-typed-lowering.cc
index a3fbb669ed3759087c5809d0816ce7d7565bd4d0..054403dd7cea71bc5de78f9a70dca638c0e06a20 100644
--- a/src/compiler/js-typed-lowering.cc
+++ b/src/compiler/js-typed-lowering.cc
@@ -345,8 +345,7 @@ Reduction JSTypedLowering::ReduceNumberBinop(Node* node,
                                              const Operator* numberOp) {
   JSBinopReduction r(this, node);
   if (is_strong(OpParameter<LanguageMode>(node))) {
-    if (r.left_type()->Is(Type::Number()) &&
-        (r.right_type()->Is(Type::Number()))) {
+    if (r.BothInputsAre(Type::Number())) {
       return r.ChangeToPureOperator(numberOp, Type::Number());
     }
     return NoChange();
@@ -359,6 +358,13 @@ Reduction JSTypedLowering::ReduceNumberBinop(Node* node,
 
 Reduction JSTypedLowering::ReduceInt32Binop(Node* node, const Operator* intOp) {
   JSBinopReduction r(this, node);
+  if (is_strong(OpParameter<LanguageMode>(node))) {
+    if (r.BothInputsAre(Type::Number())) {

[arv (Not doing code reviews), 2015/04/24 15:39:42]

Let me make sure I understand this. If the operands are not numbers we keep the
nodes which will cause the runtime call which will throw?

[conradw, 2015/04/27 11:20:47]

Yes. Without this case the Binop call could be lowered while inputs are
not guaranteed to be numbers (since convertInputsToNumber is used), which
would effectively replace the strong mode version with the sloppy mode
version. I made a mistake in the shift version of this, which I've fixed
in the next patchset.

+      r.ConvertInputsToUI32(kSigned, kSigned);
+      return r.ChangeToPureOperator(intOp, Type::Integral32());
+    }
+    return NoChange();
+  }
   Node* frame_state = NodeProperties::GetFrameStateInput(node, 1);
   r.ConvertInputsToNumber(frame_state);
   r.ConvertInputsToUI32(kSigned, kSigned);
@@ -370,6 +376,13 @@ Reduction JSTypedLowering::ReduceUI32Shift(Node* node,
                                            Signedness left_signedness,
                                            const Operator* shift_op) {
   JSBinopReduction r(this, node);
+  if (is_strong(OpParameter<LanguageMode>(node))) {
+    if (r.BothInputsAre(Type::Number())) {
+      r.ConvertInputsToUI32(left_signedness, kUnsigned);
+      return r.ChangeToPureOperator(shift_op, Type::Integral32());
+    }
+    return NoChange();
+  }
   if (r.BothInputsAre(Type::Primitive())) {
     r.ConvertInputsForShift(left_signedness);
     return r.ChangeToPureOperator(shift_op, Type::Integral32());