[crankshaft] Fix abstract equality for receivers.

We need to check both sides for abstract equality of receivers in optimized
code, otherwise we don't handle implicit conversions and undetectable
objects correctly.

R=jarin@chromium.org
BUG=v8:5802

Review-Url: https://codereview.chromium.org/2612213002
Cr-Commit-Position: refs/heads/master@{#42085}

src/crankshaft/hydrogen.cc

@@ -11286,23 +11286,35 @@ HControlInstruction* HOptimizedGraphBuilder::BuildCompareInstruction(
         // The caller expects a branch instruction, so make it happy.
         return New<HBranch>(graph()->GetConstantTrue());
       }
-      // Can we get away with map check and not instance type check?
-      HValue* operand_to_check =
-          left->block()->block_id() < right->block()->block_id() ? left : right;
-      if (combined_type->IsClass()) {
-        Handle<Map> map = combined_type->AsClass()->Map();
-        AddCheckMap(operand_to_check, map);
-        HCompareObjectEqAndBranch* result =
-            New<HCompareObjectEqAndBranch>(left, right);
-        return result;
+      if (op == Token::EQ) {
+        // For abstract equality we need to check both sides are receivers.
+        if (combined_type->IsClass()) {
+          Handle<Map> map = combined_type->AsClass()->Map();
+          AddCheckMap(left, map);
+          AddCheckMap(right, map);
+        } else {
+          BuildCheckHeapObject(left);
+          Add<HCheckInstanceType>(left, HCheckInstanceType::IS_JS_RECEIVER);
+          BuildCheckHeapObject(right);
+          Add<HCheckInstanceType>(right, HCheckInstanceType::IS_JS_RECEIVER);
+        }
       } else {
-        BuildCheckHeapObject(operand_to_check);
-        Add<HCheckInstanceType>(operand_to_check,
-                                HCheckInstanceType::IS_JS_RECEIVER);
-        HCompareObjectEqAndBranch* result =
-            New<HCompareObjectEqAndBranch>(left, right);
-        return result;
+        // For strict equality we only need to check one side.
+        HValue* operand_to_check =
+            left->block()->block_id() < right->block()->block_id() ? left
+                                                                   : right;
+        if (combined_type->IsClass()) {
+          Handle<Map> map = combined_type->AsClass()->Map();
+          AddCheckMap(operand_to_check, map);
+        } else {
+          BuildCheckHeapObject(operand_to_check);
+          Add<HCheckInstanceType>(operand_to_check,
+                                  HCheckInstanceType::IS_JS_RECEIVER);
+        }
       }
+      HCompareObjectEqAndBranch* result =
+          New<HCompareObjectEqAndBranch>(left, right);
+      return result;
     } else {
       if (combined_type->IsClass()) {
         // TODO(bmeurer): This is an optimized version of an x < y, x > y,

test/mjsunit/regress/regress-5802.js

+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+(function() {
+  function eq(a, b) { return a == b; }
+
+  var o = { [Symbol.toPrimitive]: () => "o" };
+
+  assertTrue(eq(o, o));
+  %BaselineFunctionOnNextCall(eq);
+  assertTrue(eq(o, o));
+  %OptimizeFunctionOnNextCall(eq);
+  assertTrue(eq(o, o));
+  assertTrue(eq("o", o));
+  assertTrue(eq(o, "o"));
+  %OptimizeFunctionOnNextCall(eq);
+  assertTrue(eq(o, o));
+  assertTrue(eq("o", o));
+  assertTrue(eq(o, "o"));
+  assertOptimized(eq);
+})();
+
+(function() {
+  function ne(a, b) { return a != b; }
+
+  var o = { [Symbol.toPrimitive]: () => "o" };
+
+  assertFalse(ne(o, o));
+  %BaselineFunctionOnNextCall(ne);
+  assertFalse(ne(o, o));
+  %OptimizeFunctionOnNextCall(ne);
+  assertFalse(ne(o, o));
+  assertFalse(ne("o", o));
+  assertFalse(ne(o, "o"));
+  %OptimizeFunctionOnNextCall(ne);
+  assertFalse(ne(o, o));
+  assertFalse(ne("o", o));
+  assertFalse(ne(o, "o"));
+  assertOptimized(ne);
+})();
+
+(function() {
+  function eq(a, b) { return a == b; }
+
+  var a = {};
+  var b = {b};
+  var u = %GetUndetectable();
+
+  assertTrue(eq(a, a));
+  assertTrue(eq(b, b));
+  assertFalse(eq(a, b));
+  assertFalse(eq(b, a));
+  %BaselineFunctionOnNextCall(eq);
+  assertTrue(eq(a, a));
+  assertTrue(eq(b, b));
+  assertFalse(eq(a, b));
+  assertFalse(eq(b, a));
+  %OptimizeFunctionOnNextCall(eq);
+  assertTrue(eq(a, a));
+  assertTrue(eq(b, b));
+  assertFalse(eq(a, b));
+  assertFalse(eq(b, a));
+  assertTrue(eq(null, u));
+  assertTrue(eq(undefined, u));
+  assertTrue(eq(u, null));
+  assertTrue(eq(u, undefined));
+  %OptimizeFunctionOnNextCall(eq);
+  assertTrue(eq(a, a));
+  assertTrue(eq(b, b));
+  assertFalse(eq(a, b));
+  assertFalse(eq(b, a));
+  assertTrue(eq(null, u));
+  assertTrue(eq(undefined, u));
+  assertTrue(eq(u, null));
+  assertTrue(eq(u, undefined));
+  assertOptimized(eq);
+})();
+
+(function() {
+  function ne(a, b) { return a != b; }
+
+  var a = {};
+  var b = {b};
+  var u = %GetUndetectable();
+
+  assertFalse(ne(a, a));
+  assertFalse(ne(b, b));
+  assertTrue(ne(a, b));
+  assertTrue(ne(b, a));
+  %BaselineFunctionOnNextCall(ne);
+  assertFalse(ne(a, a));
+  assertFalse(ne(b, b));
+  assertTrue(ne(a, b));
+  assertTrue(ne(b, a));
+  %OptimizeFunctionOnNextCall(ne);
+  assertFalse(ne(a, a));
+  assertFalse(ne(b, b));
+  assertTrue(ne(a, b));
+  assertTrue(ne(b, a));
+  assertFalse(ne(null, u));
+  assertFalse(ne(undefined, u));
+  assertFalse(ne(u, null));
+  assertFalse(ne(u, undefined));
+  %OptimizeFunctionOnNextCall(ne);
+  assertFalse(ne(a, a));
+  assertFalse(ne(b, b));
+  assertTrue(ne(a, b));
+  assertTrue(ne(b, a));
+  assertFalse(ne(null, u));
+  assertFalse(ne(undefined, u));
+  assertFalse(ne(u, null));
+  assertFalse(ne(u, undefined));
+  assertOptimized(ne);
+})();