Bug 83234 - DFG InstanceOf should not uselessly speculate cell
Summary: DFG InstanceOf should not uselessly speculate cell
Alias: None
Product: WebKit
Classification: Unclassified
Component: JavaScriptCore (show other bugs)
Version: 528+ (Nightly build)
Hardware: All All
: P2 Normal
Assignee: Nobody
Depends on:
Reported: 2012-04-04 16:31 PDT by Filip Pizlo
Modified: 2012-04-04 17:59 PDT (History)
0 users

See Also:

the patch (1.80 KB, patch)
2012-04-04 16:34 PDT, Filip Pizlo
oliver: review+
Details | Formatted Diff | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Filip Pizlo 2012-04-04 16:31:50 PDT
A useless speculation is one that:

1) Is performed on a value that dies at the point of speculation.

2) Handling the case where the speculation would fail is trivial and takes fewer instructions than an OSR exit trampoline (i.e. <12 bytes on x86).

InstanceOf has a SpeculateCell optimization, which is probably great most of the time, but there are times when you do something like:

if (o.f instanceof p)

The temporary result of o.f dies immediately. Handling the case where it's not a cell is super easy: just return false. So there's little use in speculating cell here.
Comment 1 Filip Pizlo 2012-04-04 16:34:55 PDT
Created attachment 135717 [details]
the patch
Comment 2 Filip Pizlo 2012-04-04 17:59:24 PDT
Landed in http://trac.webkit.org/changeset/113269