Fix AND expression in v4

The type of the and expressions, e.g. (a && b), were being assigned
to the type of the right hand expression (b). As reported in
QTBUG-24660, this approach could lead to some unexpected behaviors.

Now, when the left and right hand expressions are of different types,
the responsability to deal with the and expression is delegated to v8.

Task-number: QTBUG-24660
Change-Id: Ic42ebb035e62e2f197c337b2106d00453a99f04c
Reviewed-by: Roberto Raggi <roberto.raggi@nokia.com>

1 files changed, 9 insertions, 3 deletions

diff --git a/src/qml/qml/v4/qv4irbuilder.cpp b/src/qml/qml/v4/qv4irbuilder.cpp
index 8f7422454a..06178259f2 100644
--- a/src/qml/qml/v4/qv4irbuilder.cpp
+++ b/src/qml/qml/v4/qv4irbuilder.cpp
@@ -911,12 +911,15 @@ bool QV4IRBuilder::visit(AST::BinaryExpression *ast)
             IR::BasicBlock *iffalse = _function->newBasicBlock();
             IR::BasicBlock *endif = _function->newBasicBlock();
 
-            condition(ast->left, iftrue, iffalse);
+            ExprResult left = expression(ast->left);
+            IR::Temp *cond = _block->TEMP(IR::BoolType);
+            _block->MOVE(cond, left);
+            _block->CJUMP(cond, iftrue, iffalse);
 
             IR::Temp *r = _block->TEMP(IR::InvalidType);
 
             _block = iffalse;
-            _block->MOVE(r, _block->CONST(IR::BoolType, 0)); // ### use the right null value
+            _block->MOVE(r, cond);
             _block->JUMP(endif);
 
             _block = iftrue;
@@ -924,9 +927,12 @@ bool QV4IRBuilder::visit(AST::BinaryExpression *ast)
             _block->MOVE(r, right);
             _block->JUMP(endif);
 
+            if (left.type() != right.type())
+                discard();
+
             _block = endif;
 
-            r->type = right.type(); // ### not exactly, it can be IR::BoolType.
+            r->type = right.type();
             _expr.code = r;
         }
     } break;