Title: [113269] trunk/Source/_javascript_Core
- Revision
- 113269
- Author
- [email protected]
- Date
- 2012-04-04 17:48:08 -0700 (Wed, 04 Apr 2012)
Log Message
DFG InstanceOf should not uselessly speculate cell
https://bugs.webkit.org/show_bug.cgi?id=83234
Reviewed by Oliver Hunt.
If InstanceOf is the only user of its child then don't speculate cell, since
the not-cell case is super easy to handle.
* dfg/DFGSpeculativeJIT.cpp:
(JSC::DFG::SpeculativeJIT::compileInstanceOf):
Modified Paths
Diff
Modified: trunk/Source/_javascript_Core/ChangeLog (113268 => 113269)
--- trunk/Source/_javascript_Core/ChangeLog 2012-04-05 00:14:41 UTC (rev 113268)
+++ trunk/Source/_javascript_Core/ChangeLog 2012-04-05 00:48:08 UTC (rev 113269)
@@ -1,3 +1,16 @@
+2012-04-04 Filip Pizlo <[email protected]>
+
+ DFG InstanceOf should not uselessly speculate cell
+ https://bugs.webkit.org/show_bug.cgi?id=83234
+
+ Reviewed by Oliver Hunt.
+
+ If InstanceOf is the only user of its child then don't speculate cell, since
+ the not-cell case is super easy to handle.
+
+ * dfg/DFGSpeculativeJIT.cpp:
+ (JSC::DFG::SpeculativeJIT::compileInstanceOf):
+
2012-04-04 Michael Saboff <[email protected]>
Fixed minor error: "& 3" should be "& 2".
Modified: trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT.cpp (113268 => 113269)
--- trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT.cpp 2012-04-05 00:14:41 UTC (rev 113268)
+++ trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT.cpp 2012-04-05 00:48:08 UTC (rev 113269)
@@ -2229,8 +2229,12 @@
void SpeculativeJIT::compileInstanceOf(Node& node)
{
- if (!!(at(node.child1()).prediction() & ~PredictCell) && !!(m_state.forNode(node.child1()).m_type & ~PredictCell)) {
+ if ((!!(at(node.child1()).prediction() & ~PredictCell)
+ && !!(m_state.forNode(node.child1()).m_type & ~PredictCell))
+ || at(node.child1()).adjustedRefCount() == 1) {
// It might not be a cell. Speculate less aggressively.
+ // Or: it might only be used once (i.e. by us), so we get zero benefit
+ // from speculating any more aggressively than we absolutely need to.
JSValueOperand value(this, node.child1());
SpeculateCellOperand prototype(this, node.child3());
_______________________________________________
webkit-changes mailing list
[email protected]
http://lists.webkit.org/mailman/listinfo.cgi/webkit-changes
