REGRESSION: `if (false === (true && undefined)) console.log("wrong!");` logs "wrong!", shouldn't!

https://bugs.webkit.org/show_bug.cgi?id=123179

Reviewed by Mark Hahnenberg.

Source/JavaScriptCore:

* parser/NodeConstructors.h:
(JSC::LogicalOpNode::LogicalOpNode):
* parser/ResultType.h:
(JSC::ResultType::forLogicalOp): Don't assume that && produces a boolean.
This is JavaScript (aka Sparta).

LayoutTests:

* js/dom/branch-fold-correctness.html: Added a test for this case.

Change-Id: I72f81f31d88dee306428dd5eab9d40fcec009042
git-svn-id: http://svn.webkit.org/repository/webkit/trunk@157830 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Reviewed-by: Michael Bruning <michael.bruning@digia.com>

2 files changed, 15 insertions, 2 deletions

diff --git a/Source/JavaScriptCore/parser/NodeConstructors.h b/Source/JavaScriptCore/parser/NodeConstructors.h
index b31c01432..4bc670f81 100644
--- a/Source/JavaScriptCore/parser/NodeConstructors.h
+++ b/Source/JavaScriptCore/parser/NodeConstructors.h
@@ -517,7 +517,7 @@ inline ResolveNode::ResolveNode(const JSTokenLocation& location, const Identifie
     }
 
     inline LogicalOpNode::LogicalOpNode(const JSTokenLocation& location, ExpressionNode* expr1, ExpressionNode* expr2, LogicalOperator oper)
-        : ExpressionNode(location, ResultType::booleanType())
+        : ExpressionNode(location, ResultType::forLogicalOp(expr1->resultDescriptor(), expr2->resultDescriptor()))
         , m_expr1(expr1)
         , m_expr2(expr2)
         , m_operator(oper)
diff --git a/Source/JavaScriptCore/parser/ResultType.h b/Source/JavaScriptCore/parser/ResultType.h
index de4bde66b..ad86c98c7 100644
--- a/Source/JavaScriptCore/parser/ResultType.h
+++ b/Source/JavaScriptCore/parser/ResultType.h
@@ -120,7 +120,20 @@ namespace JSC {
                 return stringType();
             return stringOrNumberType();
         }
-        
+
+        // Unlike in C, a logical op produces the value of the
+        // last expression evaluated (and not true or false).
+        static ResultType forLogicalOp(ResultType op1, ResultType op2)
+        {
+            if (op1.definitelyIsBoolean() && op2.definitelyIsBoolean())
+                return booleanType();
+            if (op1.definitelyIsNumber() && op2.definitelyIsNumber())
+                return numberType();
+            if (op1.definitelyIsString() && op2.definitelyIsString())
+                return stringType();
+            return unknownType();
+        }
+
         static ResultType forBitOp()
         {
             return numberTypeIsInt32();