DFG should fold double-to-int conversions
https://bugs.webkit.org/show_bug.cgi?id=77532

Reviewed by Oliver Hunt.
        
Performance neutral on major benchmarks. But it makes calling V8's
Math.random() 4x faster.

* bytecode/CodeBlock.cpp:
(JSC):
(JSC::CodeBlock::addOrFindConstant):
* bytecode/CodeBlock.h:
(JSC::CodeBlock::addConstant):
(CodeBlock):
* dfg/DFGAbstractState.cpp:
(JSC::DFG::AbstractState::execute):
* dfg/DFGByteCodeParser.cpp:
(JSC::DFG::ByteCodeParser::toInt32):
(ByteCodeParser):
(JSC::DFG::ByteCodeParser::getJSConstantForValue):
(JSC::DFG::ByteCodeParser::isInt32Constant):
* dfg/DFGGraph.h:
(JSC::DFG::Graph::addShouldSpeculateInteger):
(Graph):
(JSC::DFG::Graph::addImmediateShouldSpeculateInteger):
* dfg/DFGPropagator.cpp:
(JSC::DFG::Propagator::propagateNodePredictions):
(JSC::DFG::Propagator::doRoundOfDoubleVoting):
(JSC::DFG::Propagator::fixupNode):
* dfg/DFGSpeculativeJIT.cpp:
(JSC::DFG::SpeculativeJIT::compileAdd):
(DFG):
(JSC::DFG::SpeculativeJIT::compileArithSub):
* dfg/DFGSpeculativeJIT.h:
(JSC::DFG::SpeculativeJIT::valueOfNumberConstantAsInt32):
(SpeculativeJIT):
* dfg/DFGSpeculativeJIT32_64.cpp:
(JSC::DFG::SpeculativeJIT::compile):
* dfg/DFGSpeculativeJIT64.cpp:
(JSC::DFG::SpeculativeJIT::compile):
* runtime/JSValueInlineMethods.h:
(JSC::JSValue::asDouble):



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@106502 268f45cc-cd09-0410-ab3c-d52691b4dbfc
diff --git a/Source/JavaScriptCore/dfg/DFGAbstractState.cpp b/Source/JavaScriptCore/dfg/DFGAbstractState.cpp
index bbc9612..bd35e1d 100644
--- a/Source/JavaScriptCore/dfg/DFGAbstractState.cpp
+++ b/Source/JavaScriptCore/dfg/DFGAbstractState.cpp
@@ -280,7 +280,7 @@
             
     case ValueAdd:
     case ArithAdd: {
-        if (Node::shouldSpeculateInteger(m_graph[node.child1()], m_graph[node.child2()]) && node.canSpeculateInteger()) {
+        if (m_graph.addShouldSpeculateInteger(node, m_codeBlock)) {
             forNode(node.child1()).filter(PredictInt32);
             forNode(node.child2()).filter(PredictInt32);
             forNode(nodeIndex).set(PredictInt32);
@@ -298,7 +298,19 @@
         break;
     }
             
-    case ArithSub:
+    case ArithSub: {
+        if (m_graph.addShouldSpeculateInteger(node, m_codeBlock)) {
+            forNode(node.child1()).filter(PredictInt32);
+            forNode(node.child2()).filter(PredictInt32);
+            forNode(nodeIndex).set(PredictInt32);
+            break;
+        }
+        forNode(node.child1()).filter(PredictNumber);
+        forNode(node.child2()).filter(PredictNumber);
+        forNode(nodeIndex).set(PredictDouble);
+        break;
+    }
+        
     case ArithMul:
     case ArithDiv:
     case ArithMin: