Extend typed lowering to cover JSStrictEqual on differing types.

src/compiler/js-typed-lowering.cc

 // Copyright 2014 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/compiler/access-builder.h"
 #include "src/compiler/graph-inl.h"
 #include "src/compiler/js-builtin-reducer.h"
 #include "src/compiler/js-typed-lowering.h"
 #include "src/compiler/node-aux-data-inl.h"
 #include "src/compiler/node-properties-inl.h"
@@ skipping 441 matching lines @@
   // TODO(turbofan): js-typed-lowering of Equal(boolean)
   return NoChange();
 }
 
 
 Reduction JSTypedLowering::ReduceJSStrictEqual(Node* node, bool invert) {
   JSBinopReduction r(this, node);
   if (r.left() == r.right()) {
     // x === x is always true if x != NaN
     if (!r.left_type()->Maybe(Type::NaN())) {
-      return ReplaceEagerly(node, invert ? jsgraph()->FalseConstant()
-                                         : jsgraph()->TrueConstant());
+      return ReplaceEagerly(node, jsgraph()->BooleanConstant(!invert));
     }
   }
   if (r.OneInputIs(Type::Undefined())) {
     return r.ChangeToPureOperator(
         simplified()->ReferenceEqual(Type::Undefined()), invert);
   }
   if (r.OneInputIs(Type::Null())) {
     return r.ChangeToPureOperator(simplified()->ReferenceEqual(Type::Null()),
                                   invert);
   }
   if (r.OneInputIs(Type::Boolean())) {
     return r.ChangeToPureOperator(simplified()->ReferenceEqual(Type::Boolean()),
                                   invert);
   }
   if (r.OneInputIs(Type::Object())) {
     return r.ChangeToPureOperator(simplified()->ReferenceEqual(Type::Object()),
                                   invert);
   }
   if (r.OneInputIs(Type::Receiver())) {
     return r.ChangeToPureOperator(
         simplified()->ReferenceEqual(Type::Receiver()), invert);
   }
   if (r.BothInputsAre(Type::String())) {
     return r.ChangeToPureOperator(simplified()->StringEqual(), invert);
   }
   if (r.BothInputsAre(Type::Number())) {
     return r.ChangeToPureOperator(simplified()->NumberEqual(), invert);
   }
+  Type* string_or_number = Type::Union(Type::String(), Type::Number(), zone());
+  if (r.OneInputCannotBe(string_or_number)) {
+    // For values with canonical representation (i.e. not string nor number) an
+    // empty type intersection means the values cannot be strictly equal.
+    Type* intersect = Type::Intersect(r.left_type(), r.right_type(), zone());

[rossberg, 2014/11/14 13:41:42]

That's what left_type->Maybe(right_type) is for. ;)

[titzer, 2014/11/14 13:43:24]

I like Maybe, I just want it to be reliable....
/unpopular_opinion_bird 
:(

[Michael Starzinger, 2014/11/14 14:03:06]

Done.

+    if (!intersect->IsInhabited()) {
+      return ReplaceEagerly(node, jsgraph()->BooleanConstant(invert));
+    }
+  }
   // TODO(turbofan): js-typed-lowering of StrictEqual(mixed types)
   return NoChange();
 }
 
 
 Reduction JSTypedLowering::ReduceJSToNumberInput(Node* input) {
   if (input->opcode() == IrOpcode::kJSToNumber) {
     // Recursively try to reduce the input first.
     Reduction result = ReduceJSToNumberInput(input->InputAt(0));
     if (result.Changed()) {
@@ skipping 298 matching lines @@
       return JSBuiltinReducer(jsgraph()).Reduce(node);
     default:
       break;
   }
   return NoChange();
 }
 
 }  // namespace compiler
 }  // namespace internal
 }  // namespace v8