DFG speculation on booleans should be rationalized
https://bugs.webkit.org/show_bug.cgi?id=81840
Reviewed by Gavin Barraclough.
This removes isKnownBoolean() and replaces it with AbstractState-based
optimization, and cleans up the control flow in code gen methods for
Branch and LogicalNot. Also fixes a goof in Node::shouldSpeculateNumber,
and removes isKnownNotBoolean() since that method appeared to be a
helper used solely by 32_64's speculateBooleanOperation().
This is performance-neutral.
* dfg/DFGAbstractState.cpp:
(JSC::DFG::AbstractState::execute):
* dfg/DFGNode.h:
(JSC::DFG::Node::shouldSpeculateNumber):
* dfg/DFGSpeculativeJIT.cpp:
(DFG):
* dfg/DFGSpeculativeJIT.h:
(SpeculativeJIT):
* dfg/DFGSpeculativeJIT32_64.cpp:
(JSC::DFG::SpeculativeJIT::fillSpeculateBoolean):
(JSC::DFG::SpeculativeJIT::compileLogicalNot):
(JSC::DFG::SpeculativeJIT::emitBranch):
(JSC::DFG::SpeculativeJIT::compile):
* dfg/DFGSpeculativeJIT64.cpp:
(JSC::DFG::SpeculativeJIT::compileLogicalNot):
(JSC::DFG::SpeculativeJIT::emitBranch):
(JSC::DFG::SpeculativeJIT::compile):
git-svn-id: http://svn.webkit.org/repository/webkit/trunk@111649 268f45cc-cd09-0410-ab3c-d52691b4dbfc
diff --git a/Source/JavaScriptCore/dfg/DFGAbstractState.cpp b/Source/JavaScriptCore/dfg/DFGAbstractState.cpp
index 70f8a4e..b1a9e89 100644
--- a/Source/JavaScriptCore/dfg/DFGAbstractState.cpp
+++ b/Source/JavaScriptCore/dfg/DFGAbstractState.cpp
@@ -395,7 +395,7 @@
case LogicalNot: {
Node& child = m_graph[node.child1()];
- if (isBooleanPrediction(child.prediction()) || !child.prediction())
+ if (isBooleanPrediction(child.prediction()))
forNode(node.child1()).filter(PredictBoolean);
else if (child.shouldSpeculateFinalObjectOrOther())
forNode(node.child1()).filter(PredictFinalObject | PredictOther);
@@ -644,7 +644,7 @@
// propagation, and to take it one step further, where a variable's value
// is specialized on each direction of a branch. For now, we don't do this.
Node& child = m_graph[node.child1()];
- if (isBooleanPrediction(child.prediction()) || !child.prediction())
+ if (child.shouldSpeculateBoolean())
forNode(node.child1()).filter(PredictBoolean);
else if (child.shouldSpeculateFinalObjectOrOther())
forNode(node.child1()).filter(PredictFinalObject | PredictOther);
