Ensure lower <= upper bound

src/typing.cc

 // Copyright 2013 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 229 matching lines @@
     RECURSE(Visit(stmt->init()));
   }
   store_.Forget();  // Control may transfer here via looping.
   if (stmt->cond() != NULL) {
     // Collect type feedback.
     stmt->cond()->RecordToBooleanTypeFeedback(oracle());
 
     RECURSE(Visit(stmt->cond()));
   }
   RECURSE(Visit(stmt->body()));
-  store_.Forget();  // Control may transfer here via 'continue'.
   if (stmt->next() != NULL) {
+    store_.Forget();  // Control may transfer here via 'continue'.
     RECURSE(Visit(stmt->next()));
   }
   store_.Forget();  // Control may transfer here via termination or 'break'.
 }
 
 
 void AstTyper::VisitForInStatement(ForInStatement* stmt) {
   // Collect type feedback.
   stmt->RecordTypeFeedback(oracle());
 
@@ skipping 311 matching lines @@
           expr->left()->bounds(), expr->right()->bounds(), isolate_));
       break;
     }
     case Token::BIT_OR:
     case Token::BIT_AND: {
       RECURSE(Visit(expr->left()));
       RECURSE(Visit(expr->right()));
       Type* upper = Type::Union(
           expr->left()->bounds().upper, expr->right()->bounds().upper);
       if (!upper->Is(Type::Signed32())) upper = Type::Signed32();
-      NarrowType(expr, Bounds(Type::Smi(), upper, isolate_));
+      Type* lower = Type::Intersect(
+          handle(Type::Smi(), isolate_), handle(upper, isolate_));
+      NarrowType(expr, Bounds(lower, upper, isolate_));
       break;
     }
     case Token::BIT_XOR:
     case Token::SHL:
     case Token::SAR:
       RECURSE(Visit(expr->left()));
       RECURSE(Visit(expr->right()));
       NarrowType(expr, Bounds(Type::Smi(), Type::Signed32(), isolate_));
       break;
     case Token::SHR:
       RECURSE(Visit(expr->left()));
       RECURSE(Visit(expr->right()));
-      NarrowType(expr, Bounds(Type::Smi(), Type::Unsigned32(), isolate_));
+      // TODO(rossberg): we could use an UnsignedSmi as lower bound here...
+      NarrowType(expr, Bounds(Type::Unsigned32(), isolate_));
       break;
     case Token::ADD: {
       RECURSE(Visit(expr->left()));
       RECURSE(Visit(expr->right()));
       Bounds l = expr->left()->bounds();
       Bounds r = expr->right()->bounds();
       Type* lower =
+          l.lower->Is(Type::None()) || r.lower->Is(Type::None()) ?
+              Type::None() :
+          l.lower->Is(Type::String()) || r.lower->Is(Type::String()) ?
+              Type::String() :
           l.lower->Is(Type::Number()) && r.lower->Is(Type::Number()) ?
-              Type::Smi() :
-          l.lower->Is(Type::String()) || r.lower->Is(Type::String()) ?
-              Type::String() : Type::None();
+              Type::Smi() : Type::None();
       Type* upper =
+          l.upper->Is(Type::String()) || r.upper->Is(Type::String()) ?
+              Type::String() :
           l.upper->Is(Type::Number()) && r.upper->Is(Type::Number()) ?
-              Type::Number() :
-          l.upper->Is(Type::String()) || r.upper->Is(Type::String()) ?
-              Type::String() : Type::NumberOrString();
+              Type::Number() : Type::NumberOrString();
       NarrowType(expr, Bounds(lower, upper, isolate_));
       break;
     }
     case Token::SUB:
     case Token::MUL:
     case Token::DIV:
     case Token::MOD:
       RECURSE(Visit(expr->left()));
       RECURSE(Visit(expr->right()));
       NarrowType(expr, Bounds(Type::Smi(), Type::Number(), isolate_));
@@ skipping 72 matching lines @@
 void AstTyper::VisitModuleUrl(ModuleUrl* module) {
 }
 
 
 void AstTyper::VisitModuleStatement(ModuleStatement* stmt) {
   RECURSE(Visit(stmt->body()));
 }
 
 
 } }  // namespace v8::internal