| Index: src/compiler/bytecode-graph-builder.cc
|
| diff --git a/src/compiler/bytecode-graph-builder.cc b/src/compiler/bytecode-graph-builder.cc
|
| index 89175e24a0782052b67d09c0bda638ac3fda23fe..e78122438a193b57e9d4d27cb115b5b6bce15a33 100644
|
| --- a/src/compiler/bytecode-graph-builder.cc
|
| +++ b/src/compiler/bytecode-graph-builder.cc
|
| @@ -1121,9 +1121,11 @@ void BytecodeGraphBuilder::VisitShiftRightLogical() {
|
|
|
| void BytecodeGraphBuilder::VisitInc() {
|
| FrameStateBeforeAndAfter states(this);
|
| - const Operator* js_op = javascript()->Add(BinaryOperationHints::Any());
|
| + // Note: Use subtract -1 here instead of add 1 to ensure we always convert to
|
| + // a number, not a string.
|
| + const Operator* js_op = javascript()->Subtract(BinaryOperationHints::Any());
|
| Node* node = NewNode(js_op, environment()->LookupAccumulator(),
|
| - jsgraph()->OneConstant());
|
| + jsgraph()->Constant(-1.0));
|
| environment()->BindAccumulator(node, &states);
|
| }
|
|
|
|
|