DFG doesn't support to_jsnumber
https://bugs.webkit.org/show_bug.cgi?id=115129
Reviewed by Geoffrey Garen.
Based on Oliver's patch. Implements to_jsnumber as Identity(Number:@thingy), and then does
an optimization in Fixup to turn Identity(Number:) into Identity(Int32:) if the predictions
tell us to. Identity is later turned into Phantom.
Also fixed BackPropMask, which appeared to have NodeDoesNotExit included in it. That's
wrong; NodeDoesNotExit is not a backward propagation property.
Also fixed Identity to be marked as CanExit (i.e. not NodeDoesNotExit).
This more than doubles the FPS on ammo.
* dfg/DFGByteCodeParser.cpp:
(JSC::DFG::ByteCodeParser::parseBlock):
* dfg/DFGCapabilities.h:
(JSC::DFG::canCompileOpcode):
* dfg/DFGFixupPhase.cpp:
(JSC::DFG::FixupPhase::fixupNode):
(FixupPhase):
(JSC::DFG::FixupPhase::observeUseKindOnNode):
(JSC::DFG::FixupPhase::observeUseKindOnEdge):
* dfg/DFGNodeFlags.h:
(DFG):
* dfg/DFGNodeType.h:
(DFG):
* dfg/DFGPredictionPropagationPhase.cpp:
(JSC::DFG::PredictionPropagationPhase::propagate):
git-svn-id: http://svn.webkit.org/repository/webkit/trunk@149162 268f45cc-cd09-0410-ab3c-d52691b4dbfc
diff --git a/Source/JavaScriptCore/dfg/DFGFixupPhase.cpp b/Source/JavaScriptCore/dfg/DFGFixupPhase.cpp
index 3af1b58..c9a58d6 100644
--- a/Source/JavaScriptCore/dfg/DFGFixupPhase.cpp
+++ b/Source/JavaScriptCore/dfg/DFGFixupPhase.cpp
@@ -792,9 +792,22 @@
setUseKindAndUnboxIfProfitable<CellUse>(node->child2());
break;
}
-
+
+ case Phantom:
+ case Identity: {
+ switch (node->child1().useKind()) {
+ case NumberUse:
+ if (node->child1()->shouldSpeculateIntegerForArithmetic())
+ node->child1().setUseKind(Int32Use);
+ break;
+ default:
+ break;
+ }
+ observeUseKindOnEdge(node->child1());
+ break;
+ }
+
case GetArrayLength:
- case Identity:
case Nop:
case Phi:
case ForwardInt32ToDouble:
@@ -810,7 +823,6 @@
#if !ASSERT_DISABLED
// Have these no-op cases here to ensure that nobody forgets to add handlers for new opcodes.
case SetArgument:
- case Phantom:
case JSConstant:
case WeakJSConstant:
case GetLocal:
@@ -1246,10 +1258,20 @@
return true;
#endif
}
-
+
template<UseKind useKind>
void observeUseKindOnNode(Node* node)
{
+ observeUseKindOnNode(node, useKind);
+ }
+
+ void observeUseKindOnEdge(Edge edge)
+ {
+ observeUseKindOnNode(edge.node(), edge.useKind());
+ }
+
+ void observeUseKindOnNode(Node* node, UseKind useKind)
+ {
if (node->op() != GetLocal)
return;
