This was uncovered by the op_sub stress test on 32-bit builds. On 32-bit builds, DoubleRep will erroneously convert 'true' to a 'NaN' instead of a double 1. On 64-bit, the same issue exists but is masked by another bug in DoubleRep where boolean values will always erroneously trigger a BadType OSR exit.
Created attachment 263446 [details] the patch.
Created attachment 263447 [details] 32-bit benchmark result 1
Created attachment 263448 [details] 32-bit benchmark result 2
Created attachment 263449 [details] 64-bit benchmark result 1
Created attachment 263450 [details] 64-bit benchmark result 2
Benchmark results show no significance difference in perf. The components that show up as definitely faster / slower in one run does not manifest on the second run with the same builds. Similarly, when run individually, the test components also do not show any significant difference in perf.
Comment on attachment 263446 [details] the patch. View in context: https://bugs.webkit.org/attachment.cgi?id=263446&action=review > Source/JavaScriptCore/ChangeLog:18 > + implemented incorrectly. It was checking if any bits other than bit 0 was set. was=>were > Source/JavaScriptCore/ChangeLog:19 > + However, boolean JS values always has TagBitBool (the 3rd bit) set. Hence, the has=>have
Thanks. Landed in r191290: <http://trac.webkit.org/r191290>.