Bug 68977

Summary: DFG JIT falls back on numerical comparisons when it does not recognize a prediction
Product: WebKit Reporter: Filip Pizlo <fpizlo>
Component: JavaScriptCoreAssignee: Nobody <webkit-unassigned>
Status: RESOLVED FIXED    
Severity: Normal    
Priority: P2    
Version: 528+ (Nightly build)   
Hardware: All   
OS: All   
Attachments:
Description Flags
the patch ggaren: review+

Filip Pizlo
Reported 2011-09-28 00:04:29 PDT
The DFG will emit numerical comparison code (with numerical speculation) when the operands to the comparison are something that it does not have optimized code generation for. This means that any code that tries to compare strings, for example, will fall out of the speculative path.
Attachments
the patch (3.91 KB, patch)
2011-09-28 14:58 PDT, Filip Pizlo 		ggaren: review+
DetailsFormatted DiffDiff
View All Add attachment proposed patch, testcase, etc.
Filip Pizlo
Comment 1 2011-09-28 14:58:35 PDT
Created attachment 109080 [details] the patch
Geoffrey Garen
Comment 2 2011-09-28 15:01:26 PDT
Comment on attachment 109080 [details] the patch r=me Can double comparisons peephole fuse with branches?
Oliver Hunt
Comment 3 2011-09-28 15:03:06 PDT
Comment on attachment 109080 [details] the patch Add test cases that hit the object equality instead of correct operation case.
Filip Pizlo
Comment 4 2011-09-28 17:47:34 PDT
(In reply to comment #2) > (From update of attachment 109080 [details]) > r=me > > Can double comparisons peephole fuse with branches? Yup. We drop through the shouldSpeculateInteger() check, and then trigger on the shouldSpeculateNumber() check (which means are these things either double or integer, plus still some cruft from static speculation days, which I'll get rid of eventually in another patch).
Filip Pizlo
Comment 5 2011-09-28 17:47:56 PDT
Landed in r96280.
Note You need to log in before you can comment on or make changes to this bug.