DFG should short-circuit Branch(LogicalNot(...))
https://bugs.webkit.org/show_bug.cgi?id=83181

Reviewed by Geoff Garen.
        
Slight (sub 1%) speed-up on V8.

* dfg/DFGFixupPhase.cpp:
(JSC::DFG::FixupPhase::fixupNode):



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@113240 268f45cc-cd09-0410-ab3c-d52691b4dbfc
diff --git a/Source/JavaScriptCore/dfg/DFGFixupPhase.cpp b/Source/JavaScriptCore/dfg/DFGFixupPhase.cpp
index b704996..3e4c1d9 100644
--- a/Source/JavaScriptCore/dfg/DFGFixupPhase.cpp
+++ b/Source/JavaScriptCore/dfg/DFGFixupPhase.cpp
@@ -187,11 +187,25 @@
         }
             
         case Branch: {
-            if (m_graph[node.child1()].shouldSpeculateInteger())
-                break;
-            if (!m_graph[node.child1()].shouldSpeculateNumber())
-                break;
-            fixDoubleEdge(0);
+            if (!m_graph[node.child1()].shouldSpeculateInteger()
+                && m_graph[node.child1()].shouldSpeculateNumber())
+                fixDoubleEdge(0);
+
+            Node& myNode = m_graph[m_compileIndex]; // reload because the graph may have changed
+            Edge logicalNotEdge = myNode.child1();
+            Node& logicalNot = m_graph[logicalNotEdge];
+            if (logicalNot.op() == LogicalNot
+                && logicalNot.adjustedRefCount() == 1) {
+                Edge newChildEdge = logicalNot.child1();
+                m_graph.ref(newChildEdge);
+                m_graph.deref(logicalNotEdge);
+                myNode.children.setChild1(newChildEdge);
+                
+                BlockIndex toBeTaken = myNode.notTakenBlockIndex();
+                BlockIndex toBeNotTaken = myNode.takenBlockIndex();
+                myNode.setTakenBlockIndex(toBeTaken);
+                myNode.setNotTakenBlockIndex(toBeNotTaken);
+            }
             break;
         }