commit e086f377fa790537fb517d29c8ac56ef01767580
author commit-queue@webkit.org <commit-queue@webkit.org@268f45cc-cd09-0410-ab3c-d52691b4dbfc> Fri Apr 08 18:07:25 2016 +0000
committer commit-queue@webkit.org <commit-queue@webkit.org@268f45cc-cd09-0410-ab3c-d52691b4dbfc> Fri Apr 08 18:07:25 2016 +0000
tree cb3fea80e294387890ccf2f171d2c1dd2c4c8d77
parent 7e60658328430491c709c812bdaecb2cd0a67e94

UInt32ToNumber should have an Int52 path
https://bugs.webkit.org/show_bug.cgi?id=125704

Patch by Benjamin Poulain <bpoulain@apple.com> on 2016-04-08
Reviewed by Filip Pizlo.

When dealing with big numbers, fall back to Int52 instead
of double when possible.

* dfg/DFGAbstractInterpreterInlines.h:
(JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
* dfg/DFGFixupPhase.cpp:
(JSC::DFG::FixupPhase::fixupNode):
* dfg/DFGPredictionPropagationPhase.cpp:
(JSC::DFG::PredictionPropagationPhase::propagate):
* dfg/DFGSpeculativeJIT.cpp:
(JSC::DFG::SpeculativeJIT::compileUInt32ToNumber):
* ftl/FTLLowerDFGToB3.cpp:
(JSC::FTL::DFG::LowerDFGToB3::compileUInt32ToNumber):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@199235 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h

diff --git a/Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h b/Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h
index 7ca6bbc..390b380 100644
--- a/Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h
+++ b/Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h
@@ -299,6 +299,14 @@
     case UInt32ToNumber: {
         JSValue child = forNode(node->child1()).value();
         if (doesOverflow(node->arithMode())) {
+            if (enableInt52()) {
+                if (child && child.isMachineInt()) {
+                    setConstant(node, jsNumber(child.asMachineInt()));
+                    break;
+                }
+                forNode(node).setType(SpecMachineInt);
+                break;
+            }
             if (child && child.isInt32()) {
                 uint32_t value = child.asInt32();
                 setConstant(node, jsNumber(value));