Bug 69174 - DFG JIT, Branch on integer can always be a 32-bit compare.
Summary: DFG JIT, Branch on integer can always be a 32-bit compare.
Status: RESOLVED FIXED
Alias: None
Product: WebKit
Classification: Unclassified
Component: JavaScriptCore (show other bugs)
Version: 528+ (Nightly build)
Hardware: Unspecified Unspecified
: P2 Normal
Assignee: Nobody
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2011-09-30 15:14 PDT by Gavin Barraclough
Modified: 2011-09-30 16:05 PDT (History)
0 users

See Also:

Attachments
The patch (3.82 KB, patch)
2011-09-30 15:16 PDT, Gavin Barraclough 		sam: review+
Details | Formatted Diff | Diff
View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Gavin Barraclough 2011-09-30 15:14:24 PDT 
if (shouldSpeculateInteger(node.child1()) && !isStrictInt32(node.child1())), the JSVALUE64 JIT will currently compare all 64bits in the register, but in these cases the DataFormat is always a JS boxed integer.  In these cases we can just compare the low 32bits anyway - no need to check the tag.  This allows the code to be unified with the JSVALUE32_64 JIT.
Comment 1 Gavin Barraclough 2011-09-30 15:16:07 PDT 
Created attachment 109354 [details]
The patch
Comment 2 Gavin Barraclough 2011-09-30 16:05:03 PDT 
Fixed in r96436