Harden ArithDiv of integers fix-up by inserting Int32ToDouble node directly
https://bugs.webkit.org/show_bug.cgi?id=107321
Reviewed by Filip Pizlo.
Split out the Int32ToDouble node insertion from fixDoubleEdge() and used it directly when we're fixing up
an ArithDiv node with integer inputs and output for platforms that don't have integer division.
Since we are checking that our inputs should be ints, we can just insert the Int32ToDouble node
without any further checks.
* dfg/DFGFixupPhase.cpp:
(JSC::DFG::FixupPhase::fixupNode):
(JSC::DFG::FixupPhase::fixDoubleEdge):
(FixupPhase):
(JSC::DFG::FixupPhase::injectInt32ToDoubleNode):
git-svn-id: http://svn.webkit.org/repository/webkit/trunk@140203 268f45cc-cd09-0410-ab3c-d52691b4dbfc
diff --git a/Source/JavaScriptCore/dfg/DFGFixupPhase.cpp b/Source/JavaScriptCore/dfg/DFGFixupPhase.cpp
index 2fbb5a0..fd03cdf 100644
--- a/Source/JavaScriptCore/dfg/DFGFixupPhase.cpp
+++ b/Source/JavaScriptCore/dfg/DFGFixupPhase.cpp
@@ -320,8 +320,8 @@
&& node.canSpeculateInteger()) {
if (isX86())
break;
- fixDoubleEdge(0);
- fixDoubleEdge(1);
+ injectInt32ToDoubleNode(0);
+ injectInt32ToDoubleNode(1);
Node& oldDivision = m_graph[m_compileIndex];
@@ -558,6 +558,14 @@
return;
}
+ injectInt32ToDoubleNode(childIndex);
+ }
+
+ void injectInt32ToDoubleNode(unsigned childIndex)
+ {
+ Node& source = m_graph[m_compileIndex];
+ Edge& edge = m_graph.child(source, childIndex);
+
NodeIndex resultIndex = (NodeIndex)m_graph.size();
#if DFG_ENABLE(DEBUG_PROPAGATION_VERBOSE)
