Bug 69174

Summary: DFG JIT, Branch on integer can always be a 32-bit compare.
Product: WebKit Reporter: Gavin Barraclough <barraclough>
Component: JavaScriptCoreAssignee: Nobody <webkit-unassigned>
Status: RESOLVED FIXED    
Severity: Normal    
Priority: P2    
Version: 528+ (Nightly build)   
Hardware: Unspecified   
OS: Unspecified   
Attachments:
Description Flags
The patch sam: review+

Description Gavin Barraclough 2011-09-30 15:14:24 PDT
if (shouldSpeculateInteger(node.child1()) && !isStrictInt32(node.child1())), the JSVALUE64 JIT will currently compare all 64bits in the register, but in these cases the DataFormat is always a JS boxed integer.  In these cases we can just compare the low 32bits anyway - no need to check the tag.  This allows the code to be unified with the JSVALUE32_64 JIT.
Comment 1 Gavin Barraclough 2011-09-30 15:16:07 PDT
Created attachment 109354 [details]
The patch
Comment 2 Gavin Barraclough 2011-09-30 16:05:03 PDT
Fixed in r96436