V4: fix reverse type propagation

Only do integer add/sub/mul when all operands are known to be integers.

[ChangeLog][QtQml] Fixed invalidly opportunistic truncating of non-integer values for additions/subtractions/multiplications in JavaScript and binding expressions.

Change-Id: I21b3bede2fb3e8033305591110b98cc9e6bf52f8
Reviewed-by: Simon Hausmann <simon.hausmann@digia.com>

2 files changed, 17 insertions, 10 deletions

diff --git a/src/qml/compiler/qv4ssa.cpp b/src/qml/compiler/qv4ssa.cpp
index 8b218492a9..5861138dbe 100644
--- a/src/qml/compiler/qv4ssa.cpp
+++ b/src/qml/compiler/qv4ssa.cpp
@@ -2562,17 +2562,21 @@ public:
             } else if (m->source->asConvert()) {
                 break;
             } else if (Binop *b = m->source->asBinop()) {
+                bool iterateOnOperands = true;
+
                 switch (b->op) {
+                case OpSub:
+                case OpMul:
                 case OpAdd:
-                    if (b->left->type & NumberType || b->right->type & NumberType)
+                    if (b->left->type == SInt32Type && b->right->type == SInt32Type) {
+                        iterateOnOperands = false;
                         break;
-                    else
+                    } else {
                         continue;
+                    }
                 case OpBitAnd:
                 case OpBitOr:
                 case OpBitXor:
-                case OpSub:
-                case OpMul:
                 case OpLShift:
                 case OpRShift:
                 case OpURShift:
@@ -2580,10 +2584,13 @@ public:
                 default:
                     continue;
                 }
-                if (Temp *lt = b->left->asTemp())
-                    candidates.append(*lt);
-                if (Temp *rt = b->right->asTemp())
-                    candidates.append(*rt);
+
+                if (iterateOnOperands) {
+                    if (Temp *lt = b->left->asTemp())
+                        candidates.append(*lt);
+                    if (Temp *rt = b->right->asTemp())
+                        candidates.append(*rt);
+                }
             } else if (Unop *u = m->source->asUnop()) {
                 if (u->op == OpCompl || u->op == OpUPlus) {
                     if (Temp *t = u->expr->asTemp())
diff --git a/tests/auto/qml/qjsengine/tst_qjsengine.cpp b/tests/auto/qml/qjsengine/tst_qjsengine.cpp
index b1ec4b709c..d24a1a4f20 100644
--- a/tests/auto/qml/qjsengine/tst_qjsengine.cpp
+++ b/tests/auto/qml/qjsengine/tst_qjsengine.cpp
@@ -3609,8 +3609,8 @@ void tst_QJSEngine::intConversion_QTBUG43309()
     QJSEngine engine;
     QString jsCode = "var n = 0.1; var m = (n*255) | 0; m";
     QJSValue result = engine.evaluate( jsCode );
-//    QVERIFY(result.isNumber());
-//    QCOMPARE(result.toNumber(), 25.0);
+    QVERIFY(result.isNumber());
+    QCOMPARE(result.toNumber(), 25.0);
 }
 
 QTEST_MAIN(tst_QJSEngine)