Index: src/compiler/bytecode-graph-builder.cc |
diff --git a/src/compiler/bytecode-graph-builder.cc b/src/compiler/bytecode-graph-builder.cc |
index 89175e24a0782052b67d09c0bda638ac3fda23fe..e78122438a193b57e9d4d27cb115b5b6bce15a33 100644 |
--- a/src/compiler/bytecode-graph-builder.cc |
+++ b/src/compiler/bytecode-graph-builder.cc |
@@ -1121,9 +1121,11 @@ void BytecodeGraphBuilder::VisitShiftRightLogical() { |
void BytecodeGraphBuilder::VisitInc() { |
FrameStateBeforeAndAfter states(this); |
- const Operator* js_op = javascript()->Add(BinaryOperationHints::Any()); |
+ // Note: Use subtract -1 here instead of add 1 to ensure we always convert to |
+ // a number, not a string. |
+ const Operator* js_op = javascript()->Subtract(BinaryOperationHints::Any()); |
Node* node = NewNode(js_op, environment()->LookupAccumulator(), |
- jsgraph()->OneConstant()); |
+ jsgraph()->Constant(-1.0)); |
environment()->BindAccumulator(node, &states); |
} |