DFG should optimize a==b for a being an object and b being either an object or
null/undefined, and vice versa
https://bugs.webkit.org/show_bug.cgi?id=82656
Reviewed by Oliver Hunt.
Implements additional object equality optimizations for the case that one
operand is predicted to be an easily speculated object (like FinalObject or
Array) and the other is either an easily speculated object or Other, i.e.
Null or Undefined.
2-5% speed-up on V8/raytrace, leading to a sub-1% progression on V8.
I also took the opportunity to clean up the control flow for the speculation
decisions in the various Compare opcodes. And to fix a build bug in SamplingTool.
And to remove debug cruft I stupidly committed in my last patch.
(SamplingRegion):
- dfg/DFGAbstractState.cpp:
(JSC::DFG::AbstractState::execute):
- dfg/DFGOperations.cpp:
- dfg/DFGSpeculativeJIT.cpp:
(JSC::DFG::SpeculativeJIT::compilePeepHoleBranch):
(JSC::DFG::SpeculativeJIT::compare):
(SpeculativeJIT):
- dfg/DFGSpeculativeJIT32_64.cpp:
(JSC::DFG::SpeculativeJIT::nonSpeculativePeepholeBranch):
(JSC::DFG::SpeculativeJIT::compileObjectToObjectOrOtherEquality):
(DFG):
(JSC::DFG::SpeculativeJIT::compilePeepHoleObjectToObjectOrOtherEquality):
- dfg/DFGSpeculativeJIT64.cpp:
(JSC::DFG::SpeculativeJIT::nonSpeculativePeepholeBranch):
(JSC::DFG::SpeculativeJIT::compileObjectToObjectOrOtherEquality):
(DFG):
(JSC::DFG::SpeculativeJIT::compilePeepHoleObjectToObjectOrOtherEquality):
