Avoid bogus type assertion on object comparison in Hydrogen

src/hydrogen.cc

Index: src/hydrogen.cc
diff --git a/src/hydrogen.cc b/src/hydrogen.cc
index 309278703b59e4c34000df3c8c91169aef42893e..da58a83c9ffca7160dc009a35ba24276fc02353d 100644
--- a/src/hydrogen.cc
+++ b/src/hydrogen.cc
@@ -9819,6 +9819,17 @@ HControlInstruction* HOptimizedGraphBuilder::BuildCompareInstruction(
 
   if (combined_type->Is(Type::Receiver())) {
     if (Token::IsEqualityOp(op)) {
+      // HCompareObjectEqAndBranch can only deal with object, so
+      // exclude numbers.
+      if ((left->IsConstant() &&
+           HConstant::cast(left)->HasNumberValue()) ||
+          (right->IsConstant() &&
+           HConstant::cast(right)->HasNumberValue())) {
+        Add<HDeoptimize>("Type mismatch between feedback and constant",
+                         Deoptimizer::SOFT);
+        // The caller expects a branch instruction, so make it happy.
+        return New<HBranch>(graph()->GetConstantTrue());
+      }
       // Can we get away with map check and not instance type check?
       HValue* operand_to_check =
           left->block()->block_id() < right->block()->block_id() ? left : right;
@@ -9865,17 +9876,6 @@ HControlInstruction* HOptimizedGraphBuilder::BuildCompareInstruction(
         New<HCompareObjectEqAndBranch>(left, right);
     return result;
   } else if (combined_type->Is(Type::String())) {
-    // If we have a constant argument, it should be consistent with the type
-    // feedback (otherwise we fail assertions in HCompareObjectEqAndBranch).
-    if ((left->IsConstant() &&
-         !HConstant::cast(left)->HasStringValue()) ||
-        (right->IsConstant() &&
-         !HConstant::cast(right)->HasStringValue())) {
-      Add<HDeoptimize>("Type mismatch between feedback and constant",
-                       Deoptimizer::SOFT);
-      // The caller expects a branch instruction, so make it happy.
-      return New<HBranch>(graph()->GetConstantTrue());
-    }

[Jarin, 2014/04/10 14:24:35]

I have removed this because it does not use HCompareObjectEqAndBranch, so we do
not run into problems with the assertion. The bad case should be rare, so
bailing out early is not worth the added complexity here.

     BuildCheckHeapObject(left);
     Add<HCheckInstanceType>(left, HCheckInstanceType::IS_STRING);
     BuildCheckHeapObject(right);