Title: [143818] trunk/Source/_javascript_Core
- Revision
- 143818
- Author
- [email protected]
- Date
- 2013-02-22 17:10:31 -0800 (Fri, 22 Feb 2013)
Log Message
DFG::SpeculativeJIT::speculateNumber() should just use SpeculateDoubleOperand instead of doing its own thing
https://bugs.webkit.org/show_bug.cgi?id=110659
Reviewed by Oliver Hunt and Mark Hahnenberg.
This simplifies the code, and also has the effect that if speculateNumber() is called
prior to someone actually using the number in a double context, then the number will
already be up-converted to double and ready to go.
Previously if this ever came up, the subsequent use would have to again branch to see
if the value is tagged as int or tagged as double.
On the other hand, if you ever did speculateNumber() and then used the value as a
JSValue, this will be a slow down now.
I suspect that the former (speculateNumber() and then use as number) is more likely
than the latter (speculateNumber() and then use as JSValue).
* dfg/DFGSpeculativeJIT.cpp:
(JSC::DFG::SpeculativeJIT::speculateNumber):
Modified Paths
Diff
Modified: trunk/Source/_javascript_Core/ChangeLog (143817 => 143818)
--- trunk/Source/_javascript_Core/ChangeLog 2013-02-23 01:03:10 UTC (rev 143817)
+++ trunk/Source/_javascript_Core/ChangeLog 2013-02-23 01:10:31 UTC (rev 143818)
@@ -1,5 +1,28 @@
2013-02-22 Filip Pizlo <[email protected]>
+ DFG::SpeculativeJIT::speculateNumber() should just use SpeculateDoubleOperand instead of doing its own thing
+ https://bugs.webkit.org/show_bug.cgi?id=110659
+
+ Reviewed by Oliver Hunt and Mark Hahnenberg.
+
+ This simplifies the code, and also has the effect that if speculateNumber() is called
+ prior to someone actually using the number in a double context, then the number will
+ already be up-converted to double and ready to go.
+
+ Previously if this ever came up, the subsequent use would have to again branch to see
+ if the value is tagged as int or tagged as double.
+
+ On the other hand, if you ever did speculateNumber() and then used the value as a
+ JSValue, this will be a slow down now.
+
+ I suspect that the former (speculateNumber() and then use as number) is more likely
+ than the latter (speculateNumber() and then use as JSValue).
+
+ * dfg/DFGSpeculativeJIT.cpp:
+ (JSC::DFG::SpeculativeJIT::speculateNumber):
+
+2013-02-22 Filip Pizlo <[email protected]>
+
DFG FixupPhase should have one common hook for knowing if a node is ever being speculated a certain way
https://bugs.webkit.org/show_bug.cgi?id=110650
Modified: trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT.cpp (143817 => 143818)
--- trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT.cpp 2013-02-23 01:03:10 UTC (rev 143817)
+++ trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT.cpp 2013-02-23 01:10:31 UTC (rev 143818)
@@ -3936,21 +3936,7 @@
if (!needsTypeCheck(edge, SpecNumber))
return;
- JSValueOperand operand(this, edge, ManualOperandSpeculation);
-#if USE(JSVALUE64)
- JITCompiler::Jump isInteger = m_jit.branch64(MacroAssembler::AboveOrEqual, operand.gpr(), GPRInfo::tagTypeNumberRegister);
- typeCheck(
- JSValueRegs(operand.gpr()), edge, SpecNumber,
- m_jit.branchTest64(MacroAssembler::Zero, operand.gpr(), GPRInfo::tagTypeNumberRegister));
- isInteger.link(&m_jit);
-#else
- JSValueOperand op1(this, edge, ManualOperandSpeculation);
- JITCompiler::Jump isInteger = m_jit.branch32(MacroAssembler::Equal, operand.tagGPR(), TrustedImm32(JSValue::Int32Tag));
- typeCheck(
- JSValueRegs(operand.tagGPR(), op1.payloadGPR()), edge, SpecNumber,
- m_jit.branch32(MacroAssembler::AboveOrEqual, operand.tagGPR(), TrustedImm32(JSValue::LowestTag)));
- isInteger.link(&m_jit);
-#endif
+ (SpeculateDoubleOperand(this, edge)).fpr();
}
void SpeculativeJIT::speculateRealNumber(Edge edge)
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
