Changeset 205216 in webkit

Timestamp:

Aug 30, 2016 6:48:22 PM (8 years ago)

Author:

commit-queue@webkit.org

Message:

[JSC] Some arith nodes are too pessimistic with the types supported on the fast path
​https://bugs.webkit.org/show_bug.cgi?id=161410

Patch by Benjamin Poulain <​bpoulain@apple.com> on 2016-08-30
Reviewed by Geoffrey Garen.

• dfg/DFGFixupPhase.cpp:

(JSC::DFG::FixupPhase::fixupNode):
DoubleRep is able to convert numbers, undefined, booleans and null.
I was too pessimistic when I gated the double implementations
on number-or-boolean speculation. We can just let DoubleRep convert
the other cases as long as it is not a Cell.

Location:

trunk/Source/JavaScriptCore

Files:

• ChangeLog (modified) (1 diff)
• dfg/DFGFixupPhase.cpp (modified) (2 diffs)

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2016-08-30  Benjamin Poulain  <bpoulain@apple.com>
+
+        [JSC] Some arith nodes are too pessimistic with the types supported on the fast path
+        https://bugs.webkit.org/show_bug.cgi?id=161410
+
+        Reviewed by Geoffrey Garen.
+
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        DoubleRep is able to convert numbers, undefined, booleans and null.
+        I was too pessimistic when I gated the double implementations
+        on number-or-boolean speculation. We can just let DoubleRep convert
+        the other cases as long as it is not a Cell.
+
 2016-08-30  Chris Dumez  <cdumez@apple.com>
 

trunk/Source/JavaScriptCore/dfg/DFGFixupPhase.cpp

@@ -344 +344 @@
             }
 
-            if (node->child1()->shouldSpeculateNumberOrBoolean()) {
+            if (node->child1()->shouldSpeculateNotCell()) {
                 fixDoubleOrBooleanEdge(node->child1());
                 node->clearFlags(NodeMustGenerate);
@@ -401 +401 @@
         case ArithSqrt: {
             Edge& child1 = node->child1();
-            if (child1->shouldSpeculateNumberOrBoolean()) {
+            if (child1->shouldSpeculateNotCell()) {
                 fixDoubleOrBooleanEdge(child1);
                 node->clearFlags(NodeMustGenerate);