Avoid bogus type assertion on object comparison in Hydrogen

src/hydrogen.cc

 // Copyright 2013 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 9801 matching lines @@
                      Deoptimizer::SOFT);
     combined_type = left_type = right_type = Type::Any(zone());
   }
 
   Representation left_rep = Representation::FromType(left_type);
   Representation right_rep = Representation::FromType(right_type);
   Representation combined_rep = Representation::FromType(combined_type);
 
   if (combined_type->Is(Type::Receiver())) {
     if (Token::IsEqualityOp(op)) {
+      // HCompareObjectEqAndBranch can only deal with object, so
+      // exclude numbers.
+      if ((left->IsConstant() &&
+           HConstant::cast(left)->HasNumberValue()) ||
+          (right->IsConstant() &&
+           HConstant::cast(right)->HasNumberValue())) {
+        Add<HDeoptimize>("Type mismatch between feedback and constant",
+                         Deoptimizer::SOFT);
+        // The caller expects a branch instruction, so make it happy.
+        return New<HBranch>(graph()->GetConstantTrue());
+      }
       // Can we get away with map check and not instance type check?
       HValue* operand_to_check =
           left->block()->block_id() < right->block()->block_id() ? left : right;
       if (combined_type->IsClass()) {
         Handle<Map> map = combined_type->AsClass();
         AddCheckMap(operand_to_check, map);
         HCompareObjectEqAndBranch* result =
             New<HCompareObjectEqAndBranch>(left, right);
         if (FLAG_hydrogen_track_positions) {
           result->set_operand_position(zone(), 0, left_position);
@@ skipping 26 matching lines @@
       return New<HBranch>(graph()->GetConstantTrue());
     }
     BuildCheckHeapObject(left);
     Add<HCheckInstanceType>(left, HCheckInstanceType::IS_INTERNALIZED_STRING);
     BuildCheckHeapObject(right);
     Add<HCheckInstanceType>(right, HCheckInstanceType::IS_INTERNALIZED_STRING);
     HCompareObjectEqAndBranch* result =
         New<HCompareObjectEqAndBranch>(left, right);
     return result;
   } else if (combined_type->Is(Type::String())) {
-    // If we have a constant argument, it should be consistent with the type
-    // feedback (otherwise we fail assertions in HCompareObjectEqAndBranch).
-    if ((left->IsConstant() &&
-         !HConstant::cast(left)->HasStringValue()) ||
-        (right->IsConstant() &&
-         !HConstant::cast(right)->HasStringValue())) {
-      Add<HDeoptimize>("Type mismatch between feedback and constant",
-                       Deoptimizer::SOFT);
-      // The caller expects a branch instruction, so make it happy.
-      return New<HBranch>(graph()->GetConstantTrue());
-    }

[Jarin, 2014/04/10 14:24:35]

I have removed this because it does not use HCompareObjectEqAndBranch, so we do
not run into problems with the assertion. The bad case should be rare, so
bailing out early is not worth the added complexity here.

     BuildCheckHeapObject(left);
     Add<HCheckInstanceType>(left, HCheckInstanceType::IS_STRING);
     BuildCheckHeapObject(right);
     Add<HCheckInstanceType>(right, HCheckInstanceType::IS_STRING);
     HStringCompareAndBranch* result =
         New<HStringCompareAndBranch>(left, right, op);
     return result;
   } else {
     if (combined_rep.IsTagged() || combined_rep.IsNone()) {
       HCompareGeneric* result = Add<HCompareGeneric>(left, right, op);
@@ skipping 1635 matching lines @@
   if (ShouldProduceTraceOutput()) {
     isolate()->GetHTracer()->TraceHydrogen(name(), graph_);
   }
 
 #ifdef DEBUG
   graph_->Verify(false);  // No full verify.
 #endif
 }
 
 } }  // namespace v8::internal