| Index: src/compiler/bytecode-graph-builder.cc
|
| diff --git a/src/compiler/bytecode-graph-builder.cc b/src/compiler/bytecode-graph-builder.cc
|
| index 2249cbcb3f52d9e1be32458f305ab5d89b92ffdd..dd0a8204f5b11ea4648801ea494b320a89a3b549 100644
|
| --- a/src/compiler/bytecode-graph-builder.cc
|
| +++ b/src/compiler/bytecode-graph-builder.cc
|
| @@ -1121,9 +1121,11 @@ void BytecodeGraphBuilder::VisitShiftRightLogical() {
|
|
|
| void BytecodeGraphBuilder::VisitInc() {
|
| FrameStateBeforeAndAfter states(this);
|
| - const Operator* js_op = javascript()->Add(BinaryOperationHints::Any());
|
| + // Note: Use subtract -1 here instead of add 1 to ensure we always convert to
|
| + // a number, not a string.
|
| + const Operator* js_op = javascript()->Subtract(BinaryOperationHints::Any());
|
| Node* node = NewNode(js_op, environment()->LookupAccumulator(),
|
| - jsgraph()->OneConstant());
|
| + jsgraph()->Constant(-1.0));
|
| environment()->BindAccumulator(node, &states);
|
| }
|
|
|
|
|