Changeset 37417 in webkit for trunk/JavaScriptCore/VM/Machine.cpp

Timestamp:

Oct 8, 2008, 3:53:13 AM (17 years ago)

Author:

[email protected]

Message:

2008-10-08 Maciej Stachowiak <​[email protected]>

Reviewed by Oliver Hunt.

Re-landing the following fix with the crashing bug in it fixed (r37405):

• optimize away multiplication by constant 1.0

2.3% speedup on v8 RayTrace benchmark

Apparently it's not uncommon for JavaScript code to multiply by
constant 1.0 in the mistaken belief that this converts integer to
floating point and that there is any operational difference.

• VM/CTI.cpp: (JSC::CTI::privateCompileMainPass): Optimize to_jsnumber for case where parameter is already number. (JSC::CTI::privateCompileSlowCases): ditto
• VM/Machine.cpp: (JSC::Machine::privateExecute): ditto
• kjs/grammar.y: (makeMultNode): Transform as follows: +FOO * BAR ==> FOO * BAR FOO * +BAR ==> FOO * BAR FOO * 1 ==> +FOO 1 * FOO ==> +FOO (makeDivNode): Transform as follows: +FOO / BAR ==> FOO / BAR FOO / +BAR ==> FOO / BAR (makeSubNode): Transform as follows: +FOO - BAR ==> FOO - BAR FOO - +BAR ==> FOO - BAR
• kjs/nodes.h: (JSC::ExpressionNode::stripUnaryPlus): Helper for above grammar.y changes (JSC::UnaryPlusNode::stripUnaryPlus): ditto

File:

• trunk/JavaScriptCore/VM/Machine.cpp (modified) (1 diff)

trunk/JavaScriptCore/VM/Machine.cpp

@@ -1816 +1816 @@
         int dst = (++vPC)->u.operand;
         int src = (++vPC)->u.operand;
-        JSValue* result = r[src].jsValue(exec)->toJSNumber(exec);
-        VM_CHECK_EXCEPTION();
-
-        r[dst] = result;
+
+        JSValue* srcVal = r[src].jsValue(exec);
+
+        if (LIKELY(JSImmediate::isNumber(srcVal) || static_cast<JSCell*>(srcVal)->structureID()->typeInfo().type() == NumberType)) {
+            r[dst] = r[src];
+        } else {
+            JSValue* result = srcVal->toJSNumber(exec);
+            VM_CHECK_EXCEPTION();
+            r[dst] = result;
+        }
 
         ++vPC;