Bug 83234

Summary:

DFG InstanceOf should not uselessly speculate cell

Product:

WebKit

Reporter:

Filip Pizlo <fpizlo>

Component:

JavaScriptCore

Assignee:

Nobody <webkit-unassigned>

Status:

RESOLVED FIXED

Severity:

Normal

Priority:

Version:

528+ (Nightly build)

Hardware:

All

OS:

All

Attachments:

Description	Flags
the patch	oliver: review+

Description Filip Pizlo 2012-04-04 16:31:50 PDT

A useless speculation is one that:

1) Is performed on a value that dies at the point of speculation.

2) Handling the case where the speculation would fail is trivial and takes fewer instructions than an OSR exit trampoline (i.e. <12 bytes on x86).

InstanceOf has a SpeculateCell optimization, which is probably great most of the time, but there are times when you do something like:

if (o.f instanceof p)

The temporary result of o.f dies immediately. Handling the case where it's not a cell is super easy: just return false. So there's little use in speculating cell here.

Comment 1 Filip Pizlo 2012-04-04 16:34:55 PDT

Created attachment 135717 [details]
the patch

Comment 2 Filip Pizlo 2012-04-04 17:59:24 PDT

Landed in http://trac.webkit.org/changeset/113269