The DFG JIT has helper methods for boxing and unboxing doubles, but they are not always used, leading to code duplication. The DFG JIT has a way of emitting assertions that something that it thinks is a boxed double is in fact a bosed double, and it uses those assertions in one place (where the code for unboxDouble is duplicated, no less) but not in others. Furthermore, the JIT assertions (assertions emitted in the code stream) are not enabled in debug builds by default, which greatly reduces their utility. The DFG JIT should enable JIT assertions in debug builds, should use existing assertions (such as AssertIsJSDouble) during boxing and unboxing, and should not duplicate the code for boxing and unboxing.
Created attachment 103808 [details] the patch
Comment on attachment 103808 [details] the patch Clearing flags on attachment: 103808 Committed r93010: <http://trac.webkit.org/changeset/93010>
All reviewed patches have been landed. Closing bug.