Fix typed lowering of JSAdd on non-number inputs.

Fix typed lowering of JSAdd on non-number inputs.

R=rossberg@chromium.org
TEST=mjsunit/regress/regress-3476

Committed: https://code.google.com/p/v8/source/detail?r=23883

[Michael Starzinger, 2014-09-11 14:25:44]

https://codereview.chromium.org/564823003/diff/1/src/compiler/js-typed-loweri...
File src/compiler/js-typed-lowering.cc (right):

https://codereview.chromium.org/564823003/diff/1/src/compiler/js-typed-loweri...
src/compiler/js-typed-lowering.cc:231: // JSAdd(x:-string, y:-string) =>
NumberAdd(ToNumber(x), ToNumber(y))
I convinced myself that this is correct for ES5, could you please make
extra-sure on whether this also holds in ES6?

[rossberg, 2014-09-11 14:50:19]

lgtm

https://codereview.chromium.org/564823003/diff/1/src/compiler/js-typed-loweri...
File src/compiler/js-typed-lowering.cc (right):

https://codereview.chromium.org/564823003/diff/1/src/compiler/js-typed-loweri...
src/compiler/js-typed-lowering.cc:231: // JSAdd(x:-string, y:-string) =>
NumberAdd(ToNumber(x), ToNumber(y))
On 2014/09/11 14:25:44, Michael Starzinger wrote:
> I convinced myself that this is correct for ES5, could you please make
> extra-sure on whether this also holds in ES6?

It seems correct, as long as ToNumber(symbol) throws a TypeError (which is
currently the case in the draft, but I remember some discussion about changing
it).

[Michael Starzinger, 2014-09-11 16:09:33]

Committed patchset #1 (id:1) manually as 23883 (presubmit successful).