Bug 227159

Summary: [DFG] Untyped branches should eliminate checks based on results from the AbstractInterpreter
Product: WebKit Reporter: Robin Morisset <rmorisset>
Component: JavaScriptCoreAssignee: Robin Morisset <rmorisset>
Status: RESOLVED FIXED    
Severity: Normal CC: ews-watchlist, fpizlo, keith_miller, mark.lam, msaboff, saam, tzagallo, webkit-bug-importer
Priority: P2 Keywords: InRadar
Version: WebKit Nightly Build   
Hardware: Unspecified   
OS: Unspecified   
Attachments:
Description Flags
Patch none

Description Robin Morisset 2021-06-17 23:09:41 PDT 
We currently emit a ton of code for Untyped branches, as we use branchIfTruthy which does not know anything about the abstract interpreter.
Even worse: we call branchIfTruthy after emitting some fast paths, and branchIfTruthy replicates these fast paths (Int32 and Booleans).
Comment 1 Robin Morisset 2021-06-17 23:20:34 PDT 
Created attachment 431757 [details]
Patch
Comment 2 Filip Pizlo 2021-06-18 10:12:40 PDT 
Comment on attachment 431757 [details]
Patch

Did the FTL have a similar problem?
Comment 3 EWS 2021-06-18 10:17:52 PDT 
Committed r279041 (238961@main): <https://commits.webkit.org/238961@main>

All reviewed patches have been landed. Closing bug and clearing flags on attachment 431757 [details].
Comment 4 Radar WebKit Bug Importer 2021-06-18 10:18:27 PDT 
<rdar://problem/79508395>
Comment 5 Robin Morisset 2021-06-18 12:46:51 PDT 
(In reply to Filip Pizlo from comment #2)
> Comment on attachment 431757 [details]
> Patch
> 
> Did the FTL have a similar problem?

No, it calls boolify() which implements almost exactly the same logic as I added here to the DFG.