From 92507bbdeb00c1924048ca9697efab05ed89c13c Mon Sep 17 00:00:00 2001
From: Myles Borins <myles.borins@gmail.com>
Date: Mon, 20 Jun 2016 21:31:10 -0700
Subject: [PATCH] deps: backport 7dfb5beeec from V8 upstream

This commit backports a fix to a JIT bug in V8.
After 100 or so comparisons `typeof null ==="undefined"` is returning
`true` instead of `false`.

Original commit message:

	Fix 'typeof null' canonicalization in crankshaft

	BUG=

	Review URL: https://codereview.chromium.org/1912553002

	Cr-Commit-Position: refs/heads/master@{#35699}

Ref: https://bugs.chromium.org/p/chromium/issues/detail?id=604033
---
 deps/v8/src/crankshaft/hydrogen-instructions.cc      |  2 +-
 .../test/mjsunit/regress/regress-opt-typeof-null.js  | 12 ++++++++++++
 2 files changed, 13 insertions(+), 1 deletion(-)
 create mode 100644 deps/v8/test/mjsunit/regress/regress-opt-typeof-null.js

diff --git a/deps/v8/src/crankshaft/hydrogen-instructions.cc b/deps/v8/src/crankshaft/hydrogen-instructions.cc
index a9c6228cd35c09..729fc588bcb7c2 100644
--- a/deps/v8/src/crankshaft/hydrogen-instructions.cc
+++ b/deps/v8/src/crankshaft/hydrogen-instructions.cc
@@ -1283,7 +1283,6 @@ namespace {
 String* TypeOfString(HConstant* constant, Isolate* isolate) {
   Heap* heap = isolate->heap();
   if (constant->HasNumberValue()) return heap->number_string();
-  if (constant->IsUndetectable()) return heap->undefined_string();
   if (constant->HasStringValue()) return heap->string_string();
   switch (constant->GetInstanceType()) {
     case ODDBALL_TYPE: {
@@ -1312,6 +1311,7 @@ String* TypeOfString(HConstant* constant, Isolate* isolate) {
       return nullptr;
     }
     default:
+      if (constant->IsUndetectable()) return heap->undefined_string();
       if (constant->IsCallable()) return heap->function_string();
       return heap->object_string();
   }
diff --git a/deps/v8/test/mjsunit/regress/regress-opt-typeof-null.js b/deps/v8/test/mjsunit/regress/regress-opt-typeof-null.js
new file mode 100644
index 00000000000000..e4721a18c5e0fb
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-opt-typeof-null.js
@@ -0,0 +1,12 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function f() {
+  return typeof null === "object";
+};
+
+%OptimizeFunctionOnNextCall(f);
+assertTrue(f());