ValueToInt32 speculation will cause OSR exits even when it does not have to
https://bugs.webkit.org/show_bug.cgi?id=81068
<rdar://problem/11043926>
Reviewed by Anders Carlsson.
Two related changes:
1) ValueToInt32 will now always just defer to the non-speculative path, instead
of exiting, if it doesn't know what speculations to perform.
2) ValueToInt32 will speculate boolean if it sees this to be profitable.
* dfg/DFGAbstractState.cpp:
(JSC::DFG::AbstractState::execute):
* dfg/DFGNode.h:
(JSC::DFG::Node::shouldSpeculateBoolean):
(Node):
* dfg/DFGSpeculativeJIT.cpp:
(JSC::DFG::SpeculativeJIT::compileValueToInt32):
git-svn-id: http://svn.webkit.org/repository/webkit/trunk@110661 268f45cc-cd09-0410-ab3c-d52691b4dbfc
diff --git a/Source/JavaScriptCore/dfg/DFGAbstractState.cpp b/Source/JavaScriptCore/dfg/DFGAbstractState.cpp
index 2e20baf..c93fc15 100644
--- a/Source/JavaScriptCore/dfg/DFGAbstractState.cpp
+++ b/Source/JavaScriptCore/dfg/DFGAbstractState.cpp
@@ -291,11 +291,12 @@
break;
case ValueToInt32:
- if (m_graph[node.child1()].shouldNotSpeculateInteger()) {
- if (m_graph[node.child1()].shouldSpeculateDouble())
- forNode(node.child1()).filter(PredictNumber);
- } else
+ if (m_graph[node.child1()].shouldSpeculateInteger())
forNode(node.child1()).filter(PredictInt32);
+ else if (m_graph[node.child1()].shouldSpeculateNumber())
+ forNode(node.child1()).filter(PredictNumber);
+ else if (m_graph[node.child1()].shouldSpeculateBoolean())
+ forNode(node.child1()).filter(PredictBoolean);
forNode(nodeIndex).set(PredictInt32);
break;
