Title: [97942] trunk/Source/_javascript_Core
- Revision
- 97942
- Author
- fpi...@apple.com
- Date
- 2011-10-19 23:39:33 -0700 (Wed, 19 Oct 2011)
Log Message
DFG ConvertThis emits slow code when the source node is known to be,
but not predicted to be, a final object
https://bugs.webkit.org/show_bug.cgi?id=70466
Reviewed by Oliver Hunt.
Added a new case in ConvertThis compilation.
* dfg/DFGSpeculativeJIT32_64.cpp:
(JSC::DFG::SpeculativeJIT::compile):
* dfg/DFGSpeculativeJIT64.cpp:
(JSC::DFG::SpeculativeJIT::compile):
Modified Paths
Diff
Modified: trunk/Source/_javascript_Core/ChangeLog (97941 => 97942)
--- trunk/Source/_javascript_Core/ChangeLog 2011-10-20 06:36:17 UTC (rev 97941)
+++ trunk/Source/_javascript_Core/ChangeLog 2011-10-20 06:39:33 UTC (rev 97942)
@@ -1,5 +1,20 @@
2011-10-19 Filip Pizlo <fpi...@apple.com>
+ DFG ConvertThis emits slow code when the source node is known to be,
+ but not predicted to be, a final object
+ https://bugs.webkit.org/show_bug.cgi?id=70466
+
+ Reviewed by Oliver Hunt.
+
+ Added a new case in ConvertThis compilation.
+
+ * dfg/DFGSpeculativeJIT32_64.cpp:
+ (JSC::DFG::SpeculativeJIT::compile):
+ * dfg/DFGSpeculativeJIT64.cpp:
+ (JSC::DFG::SpeculativeJIT::compile):
+
+2011-10-19 Filip Pizlo <fpi...@apple.com>
+
Optimization triggers in the old JIT may sometimes fire repeatedly even
though there is no optimization to be done
https://bugs.webkit.org/show_bug.cgi?id=70467
Modified: trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT32_64.cpp (97941 => 97942)
--- trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT32_64.cpp 2011-10-20 06:36:17 UTC (rev 97941)
+++ trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT32_64.cpp 2011-10-20 06:39:33 UTC (rev 97942)
@@ -1804,6 +1804,12 @@
}
case ConvertThis: {
+ if (isObjectPrediction(m_state.forNode(node.child1()).m_type)) {
+ SpeculateCellOperand thisValue(this, node.child1());
+ cellResult(thisValue.gpr(), m_compileIndex);
+ break;
+ }
+
if (isOtherPrediction(at(node.child1()).prediction())) {
JSValueOperand thisValue(this, node.child1());
GPRTemporary scratch(this, thisValue);
Modified: trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT64.cpp (97941 => 97942)
--- trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT64.cpp 2011-10-20 06:36:17 UTC (rev 97941)
+++ trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT64.cpp 2011-10-20 06:39:33 UTC (rev 97942)
@@ -1888,6 +1888,12 @@
}
case ConvertThis: {
+ if (isObjectPrediction(m_state.forNode(node.child1()).m_type)) {
+ SpeculateCellOperand thisValue(this, node.child1());
+ cellResult(thisValue.gpr(), m_compileIndex);
+ break;
+ }
+
if (isOtherPrediction(at(node.child1()).prediction())) {
JSValueOperand thisValue(this, node.child1());
GPRTemporary scratch(this, thisValue);
_______________________________________________
webkit-changes mailing list
webkit-changes@lists.webkit.org
http://lists.webkit.org/mailman/listinfo.cgi/webkit-changes
