Bug 69174 - DFG JIT, Branch on integer can always be a 32-bit compare.
Summary: DFG JIT, Branch on integer can always be a 32-bit compare.
Alias: None
Product: WebKit
Classification: Unclassified
Component: JavaScriptCore (show other bugs)
Version: 528+ (Nightly build)
Hardware: Unspecified Unspecified
: P2 Normal
Assignee: Nobody
Depends on:
Reported: 2011-09-30 15:14 PDT by Gavin Barraclough
Modified: 2011-09-30 16:05 PDT (History)
0 users

See Also:

The patch (3.82 KB, patch)
2011-09-30 15:16 PDT, Gavin Barraclough
sam: review+
Details | Formatted Diff | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Gavin Barraclough 2011-09-30 15:14:24 PDT
if (shouldSpeculateInteger(node.child1()) && !isStrictInt32(node.child1())), the JSVALUE64 JIT will currently compare all 64bits in the register, but in these cases the DataFormat is always a JS boxed integer.  In these cases we can just compare the low 32bits anyway - no need to check the tag.  This allows the code to be unified with the JSVALUE32_64 JIT.
Comment 1 Gavin Barraclough 2011-09-30 15:16:07 PDT
Created attachment 109354 [details]
The patch
Comment 2 Gavin Barraclough 2011-09-30 16:05:03 PDT
Fixed in r96436