Fix typed lowering of JSAdd on non-number inputs.

src/compiler/js-typed-lowering.cc

 // Copyright 2014 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/compiler/access-builder.h"
 #include "src/compiler/graph-inl.h"
 #include "src/compiler/js-typed-lowering.h"
 #include "src/compiler/node-aux-data-inl.h"
 #include "src/compiler/node-properties-inl.h"
 #include "src/types.h"
@@ skipping 204 matching lines @@
   }
 
   void update_effect(Node* effect) {
     NodeProperties::ReplaceEffectInput(node_, effect);
   }
 };
 
 
 Reduction JSTypedLowering::ReduceJSAdd(Node* node) {
   JSBinopReduction r(this, node);
+  if (r.BothInputsAre(Type::Number())) {
+    // JSAdd(x:number, y:number) => NumberAdd(x, y)
+    return r.ChangeToPureOperator(simplified()->NumberAdd());
+  }
+  Type* maybe_string = Type::Union(Type::String(), Type::Receiver(), zone());
+  if (r.NeitherInputCanBe(maybe_string)) {
+    // JSAdd(x:-string, y:-string) => NumberAdd(ToNumber(x), ToNumber(y))

[Michael Starzinger, 2014/09/11 14:25:44]

I convinced myself that this is correct for ES5, could you please make
extra-sure on whether this also holds in ES6?

[rossberg, 2014/09/11 14:50:19]

It seems correct, as long as ToNumber(symbol) throws a TypeError (which is
currently the case in the draft, but I remember some discussion about changing
it).

+    r.ConvertInputsToNumber();
+    return r.ChangeToPureOperator(simplified()->NumberAdd());
+  }
   if (r.OneInputIs(Type::String())) {
+    // JSAdd(x:string, y:string) => StringAdd(x, y)
+    // JSAdd(x:string, y) => StringAdd(x, ToString(y))
+    // JSAdd(x, y:string) => StringAdd(ToString(x), y)
     r.ConvertInputsToString();
     return r.ChangeToPureOperator(simplified()->StringAdd());
   }
-  if (r.NeitherInputCanBe(Type::String())) {
-    r.ConvertInputsToNumber();
-    return r.ChangeToPureOperator(simplified()->NumberAdd());
-  }
   return NoChange();
 }
 
 
 Reduction JSTypedLowering::ReduceNumberBinop(Node* node,
                                              const Operator* numberOp) {
   JSBinopReduction r(this, node);
   if (r.OneInputIs(Type::Primitive())) {
     // If at least one input is a primitive, then insert appropriate conversions
     // to number and reduce this operator to the given numeric one.
@@ skipping 416 matching lines @@
       return ReduceJSStoreProperty(node);
     default:
       break;
   }
   return NoChange();
 }
 
 }  // namespace compiler
 }  // namespace internal
 }  // namespace v8