Title: [205216] trunk/Source/_javascript_Core
- Revision
- 205216
- Author
- [email protected]
- Date
- 2016-08-30 18:48:22 -0700 (Tue, 30 Aug 2016)
Log Message
[JSC] Some arith nodes are too pessimistic with the types supported on the fast path
https://bugs.webkit.org/show_bug.cgi?id=161410
Patch by Benjamin Poulain <[email protected]> on 2016-08-30
Reviewed by Geoffrey Garen.
* dfg/DFGFixupPhase.cpp:
(JSC::DFG::FixupPhase::fixupNode):
DoubleRep is able to convert numbers, undefined, booleans and null.
I was too pessimistic when I gated the double implementations
on number-or-boolean speculation. We can just let DoubleRep convert
the other cases as long as it is not a Cell.
Modified Paths
Diff
Modified: trunk/Source/_javascript_Core/ChangeLog (205215 => 205216)
--- trunk/Source/_javascript_Core/ChangeLog 2016-08-31 01:34:29 UTC (rev 205215)
+++ trunk/Source/_javascript_Core/ChangeLog 2016-08-31 01:48:22 UTC (rev 205216)
@@ -1,3 +1,17 @@
+2016-08-30 Benjamin Poulain <[email protected]>
+
+ [JSC] Some arith nodes are too pessimistic with the types supported on the fast path
+ https://bugs.webkit.org/show_bug.cgi?id=161410
+
+ Reviewed by Geoffrey Garen.
+
+ * dfg/DFGFixupPhase.cpp:
+ (JSC::DFG::FixupPhase::fixupNode):
+ DoubleRep is able to convert numbers, undefined, booleans and null.
+ I was too pessimistic when I gated the double implementations
+ on number-or-boolean speculation. We can just let DoubleRep convert
+ the other cases as long as it is not a Cell.
+
2016-08-30 Chris Dumez <[email protected]>
Unreviewed, fix build after r205205.
Modified: trunk/Source/_javascript_Core/dfg/DFGFixupPhase.cpp (205215 => 205216)
--- trunk/Source/_javascript_Core/dfg/DFGFixupPhase.cpp 2016-08-31 01:34:29 UTC (rev 205215)
+++ trunk/Source/_javascript_Core/dfg/DFGFixupPhase.cpp 2016-08-31 01:48:22 UTC (rev 205216)
@@ -343,7 +343,7 @@
break;
}
- if (node->child1()->shouldSpeculateNumberOrBoolean()) {
+ if (node->child1()->shouldSpeculateNotCell()) {
fixDoubleOrBooleanEdge(node->child1());
node->clearFlags(NodeMustGenerate);
} else
@@ -400,7 +400,7 @@
case ArithSin:
case ArithSqrt: {
Edge& child1 = node->child1();
- if (child1->shouldSpeculateNumberOrBoolean()) {
+ if (child1->shouldSpeculateNotCell()) {
fixDoubleOrBooleanEdge(child1);
node->clearFlags(NodeMustGenerate);
} else
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
