Merge remote-tracking branch 'origin/5.4' into dev

Change-Id: Ie2225337cb5eef39035146827484496a6b3690b3

2 files changed, 15 insertions, 2 deletions

diff --git a/Source/JavaScriptCore/parser/NodeConstructors.h b/Source/JavaScriptCore/parser/NodeConstructors.h
index b31c01432..4bc670f81 100644
--- a/Source/JavaScriptCore/parser/NodeConstructors.h
+++ b/Source/JavaScriptCore/parser/NodeConstructors.h
@@ -517,7 +517,7 @@ inline ResolveNode::ResolveNode(const JSTokenLocation& location, const Identifie
     }
 
     inline LogicalOpNode::LogicalOpNode(const JSTokenLocation& location, ExpressionNode* expr1, ExpressionNode* expr2, LogicalOperator oper)
-        : ExpressionNode(location, ResultType::booleanType())
+        : ExpressionNode(location, ResultType::forLogicalOp(expr1->resultDescriptor(), expr2->resultDescriptor()))
         , m_expr1(expr1)
         , m_expr2(expr2)
         , m_operator(oper)
diff --git a/Source/JavaScriptCore/parser/ResultType.h b/Source/JavaScriptCore/parser/ResultType.h
index de4bde66b..ad86c98c7 100644
--- a/Source/JavaScriptCore/parser/ResultType.h
+++ b/Source/JavaScriptCore/parser/ResultType.h
@@ -120,7 +120,20 @@ namespace JSC {
                 return stringType();
             return stringOrNumberType();
         }
-        
+
+        // Unlike in C, a logical op produces the value of the
+        // last expression evaluated (and not true or false).
+        static ResultType forLogicalOp(ResultType op1, ResultType op2)
+        {
+            if (op1.definitelyIsBoolean() && op2.definitelyIsBoolean())
+                return booleanType();
+            if (op1.definitelyIsNumber() && op2.definitelyIsNumber())
+                return numberType();
+            if (op1.definitelyIsString() && op2.definitelyIsString())
+                return stringType();
+            return unknownType();
+        }
+
         static ResultType forBitOp()
         {
             return numberTypeIsInt32();