jumpTrueOrFalse only takes the fast path for boolean false on 64bit L…

…LInt https://bugs.webkit.org/show_bug.cgi?id=186446 <rdar://problem/40949995> Patch by Tadeu Zagallo <[email protected]> on 2018-06-08 Reviewed by Mark Lam. On 64bit LLInt, jumpTrueOrFalse did a mask check to take the fast path for boolean literals, but it would only work for false. Change it so that it takes the fast path for true, false, null and undefined. * llint/LowLevelInterpreter.asm: * llint/LowLevelInterpreter64.asm: git-svn-id: http://svn.webkit.org/repository/webkit/trunk@232658 268f45cc-cd09-0410-ab3c-d52691b4dbfc
wqyfavor · Jun 9, 2018 · 1e75a42 · 1e75a42
1 parent 86c135c
commit 1e75a42
Show file tree

Hide file tree

Showing 3 changed files with 18 additions and 4 deletions.
diff --git a/Source/JavaScriptCore/ChangeLog b/Source/JavaScriptCore/ChangeLog
@@ -1,3 +1,18 @@
+2018-06-08  Tadeu Zagallo  <[email protected]>
+
+        jumpTrueOrFalse only takes the fast path for boolean false on 64bit LLInt 
+        https://bugs.webkit.org/show_bug.cgi?id=186446
+        <rdar://problem/40949995>
+
+        Reviewed by Mark Lam.
+
+        On 64bit LLInt, jumpTrueOrFalse did a mask check to take the fast path for
+        boolean literals, but it would only work for false. Change it so that it
+        takes the fast path for true, false, null and undefined.
+
+        * llint/LowLevelInterpreter.asm:
+        * llint/LowLevelInterpreter64.asm:
+
 2018-06-08  Brian Burg  <[email protected]>
 
         [Cocoa] Web Automation: include browser name and version in listing for automation targets

diff --git a/Source/JavaScriptCore/llint/LowLevelInterpreter.asm b/Source/JavaScriptCore/llint/LowLevelInterpreter.asm
@@ -1583,14 +1583,14 @@ _llint_op_define_accessor_property:
 _llint_op_jtrue:
     traceExecution()
     jumpTrueOrFalse(
-        macro (value, target) btinz value, target end,
+        macro (value, target) btinz value, 1, target end,
         _llint_slow_path_jtrue)
 
 
 _llint_op_jfalse:
     traceExecution()
     jumpTrueOrFalse(
-        macro (value, target) btiz value, target end,
+        macro (value, target) btiz value, 1, target end,
         _llint_slow_path_jfalse)
 
 

diff --git a/Source/JavaScriptCore/llint/LowLevelInterpreter64.asm b/Source/JavaScriptCore/llint/LowLevelInterpreter64.asm
@@ -1821,8 +1821,7 @@ _llint_op_jmp:
 macro jumpTrueOrFalse(conditionOp, slow)
     loadisFromInstruction(1, t1)
     loadConstantOrVariable(t1, t0)
-    xorq ValueFalse, t0
-    btqnz t0, -1, .slow
+    btqnz t0, ~0xf, .slow
     conditionOp(t0, .target)
     dispatch(3)