There is already such a path in the DFG, so currently the FTL is producing worse code than the DFG in this instance.
Technically there already is a fast path, but only for Int32/Int32.
Created attachment 430505 [details] Patch
Comment on attachment 430505 [details] Patch View in context: https://bugs.webkit.org/attachment.cgi?id=430505&action=review > Source/JavaScriptCore/ChangeLog:23 > + if (isCell(left) && isCell(right)) Isn't the thing that requires the slow path that both left and right are either strings or bigints?
Comment on attachment 430505 [details] Patch View in context: https://bugs.webkit.org/attachment.cgi?id=430505&action=review >> Source/JavaScriptCore/ChangeLog:23 >> + if (isCell(left) && isCell(right)) > > Isn't the thing that requires the slow path that both left and right are either strings or bigints? Yes, but checking whether a Cell is either a HeapBigInt or a String would be quite a bit of code, so I am approximating here (going to the slow path even for things like Object == Object). Note that I use the more precise condition when it comes to pruning that check with the abstract interpreter (so if we can prove it is Object == Object, we'll generate the ideal code without all of these checks).
<rdar://problem/79161356>