[MERGE #5717 @nhat-nguyen] Only do float type specialization if both …

…sources are number Merge pull request #5717 from nhat-nguyen:floattypespecfix Fix a bug where we try to type specialize non-numbers to floats
chakra-core · Sep 21, 2018 · 842077d · 842077d
2 parents e1583ae + 1c3ea7e
commit 842077d
Show file tree

Hide file tree

Showing 2 changed files with 22 additions and 0 deletions.
diff --git a/lib/Backend/GlobOpt.cpp b/lib/Backend/GlobOpt.cpp
@@ -10648,6 +10648,11 @@ GlobOpt::TypeSpecializeFloatBinary(IR::Instr *instr, Value *src1Val, Value *src2
         case Js::OpCode::CmGe_A:
         case Js::OpCode::CmGt_A:
         {
+            if (src1Val->GetValueInfo()->IsNotNumber() || src2Val->GetValueInfo()->IsNotNumber())
+            {
+                return false;
+            }
+
             convertDstToBool = true;
             break;
         }

diff --git a/test/Basics/FloatComparison.js b/test/Basics/FloatComparison.js
@@ -63,6 +63,23 @@ var tests = [
             assert.isFalse({} < 0.5);
             assert.isFalse({} <= 0.5);
         }
+    },
+    {
+        name: "No float type specialization when operands are not number",
+        body: function() {
+            function test0() {
+                var func2 = function () {
+                  return f32[1];
+                };
+                var f32 = new Float32Array();
+                var f = 100;
+                for (let i = 0; i < f; i++) {
+                    var id41 = 'caller';
+                    ({ 18: func2() === 'caller' });
+                }
+            }
+            test0();
+        }
     }
 ];