GetMapBucket node should speculate on the type of its 'key' child
authorsbarati@apple.com <sbarati@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Tue, 4 Oct 2016 00:35:52 +0000 (00:35 +0000)
committersbarati@apple.com <sbarati@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Tue, 4 Oct 2016 00:35:52 +0000 (00:35 +0000)
commit3b7b668bf4eb893c6094fda32edfa2870740bd35
treed5ad6ddc3a1bbdb7c7c83d1b0f47cc2dda966b9f
parent3808d114a822c3126bfc236df1b67dc350ffa9aa
GetMapBucket node should speculate on the type of its 'key' child
https://bugs.webkit.org/show_bug.cgi?id=161638

Reviewed by Filip Pizlo.

This eliminates type-check branches when we've already
proven the type of the incoming key. Also, it reduces
the branches we emit when type checking the bucket's key.

This is a 2-3% speedup on ES6SampleBench/Basic.

* dfg/DFGFixupPhase.cpp:
(JSC::DFG::FixupPhase::fixupNode):
* dfg/DFGSpeculativeJIT64.cpp:
(JSC::DFG::SpeculativeJIT::compile):
* ftl/FTLLowerDFGToB3.cpp:
(JSC::FTL::DFG::LowerDFGToB3::compileGetMapBucket):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@206763 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Source/JavaScriptCore/ChangeLog
Source/JavaScriptCore/dfg/DFGFixupPhase.cpp
Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp
Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp