Get rid of DFG::DoubleOperand and simplify ValueToInt32
https://bugs.webkit.org/show_bug.cgi?id=110072

Source/JavaScriptCore: 

Reviewed by Geoffrey Garen.
        
ValueToInt32 had a side-effecting path, which was not OSR-friendly: an OSR after
the side-effect would lead to the side-effect re-executing. I got rid of that path
and replaced it with an optimization for the case where the input is speculated
number-or-other. This makes idioms like null|0 and true|0 work as expected, and
get optimized appropriately.
        
Also got rid of DoubleOperand. Replaced all remaining uses of it with
SpeculateDoubleOperand. Because the latter asserts that the Edge is a DoubleUse
edge and the remaining uses of DoubleOperand are all for untyped uses, I worked
around the assertion by setting the UseKind to DoubleUse by force. This is sound,
since all existing assertions for DoubleUse are actually asserting that we're not
converting a value to double unexpectedly. But all of these calls to
SpeculateDoubleOperand are when the operand is already known to be represented as
double, so there is no conversion.
        
This is neutral on benchmarks, except stanford-crypto-ccm, which speeds up a
little. Mostly, this is intended to delete a bunch of code. DoubleOperand was
equivalent to the replace-edge-with-DoubleUse trick that I'm using now, except it
involved a _lot_ more code.

* dfg/DFGAbstractState.cpp:
(JSC::DFG::AbstractState::execute):
* dfg/DFGCSEPhase.cpp:
(JSC::DFG::CSEPhase::performNodeCSE):
* dfg/DFGFixupPhase.cpp:
(JSC::DFG::FixupPhase::fixupNode):
* dfg/DFGNodeType.h:
(DFG):
* dfg/DFGSpeculativeJIT.cpp:
(DFG):
(JSC::DFG::SpeculativeJIT::compileValueToInt32):
* dfg/DFGSpeculativeJIT.h:
(SpeculativeJIT):
(DFG):
(FPRTemporary):
* dfg/DFGSpeculativeJIT32_64.cpp:
(DFG):
(JSC::DFG::SpeculativeJIT::compile):
* dfg/DFGSpeculativeJIT64.cpp:
(DFG):

LayoutTests: 

Reviewed by Geoffrey Garen.

* fast/js/dfg-value-to-int32-with-side-effect-expected.txt: Added.
* fast/js/dfg-value-to-int32-with-side-effect.html: Added.
* fast/js/jsc-test-list:
* fast/js/script-tests/dfg-value-to-int32-with-side-effect.js: Added.
(foo):
(.result.foo):



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@143241 268f45cc-cd09-0410-ab3c-d52691b4dbfc
DFG::SpeculativeJIT::isKnownXYZ methods should use CFA rather than other things
https://bugs.webkit.org/show_bug.cgi?id=110092

Reviewed by Geoffrey Garen.
        
These methods were previously using GenerationInfo and other things to try to
gain information that the CFA could give away for free, if you asked kindly
enough.
        
Also fixed CallLinkStatus's dump() method since it was making an invalid
assertion: we most certainly can have a status where the structure is non-null
and the executable is null, like if we're dealing with an InternalFunction.
        
Also removed calls to isKnownNotXYZ from fillSpeculateABC methods in 32_64. I
don't know why that was there. But it was causing asserts if the value was
empty - i.e. we had already exited unconditionally but we didn't know it. I
could have fixed this by introducing another form of isKnownNotXYZ which was
tolerant of empty values, but I didn't feel like fixing code that I knew to be
unnecessary. (More deeply, isKnownNotCell, for example, really asks: "do you
know that this value can never be a cell?" while some of the previous uses
wanted to ask: "do you know that this is a value that is not a cell?". The
former is "true" if the value is a contradiction [i.e. BOTTOM], while the
latter is "false" for contradictions, since contradictions are not values.)

* bytecode/CallLinkStatus.cpp:
(JSC::CallLinkStatus::dump):
* bytecode/CallLinkStatus.h:
(JSC::CallLinkStatus::CallLinkStatus):
* dfg/DFGSpeculativeJIT.cpp:
(DFG):
* dfg/DFGSpeculativeJIT.h:
(JSC::DFG::SpeculativeJIT::isKnownInteger):
(JSC::DFG::SpeculativeJIT::isKnownCell):
(JSC::DFG::SpeculativeJIT::isKnownNotInteger):
(JSC::DFG::SpeculativeJIT::isKnownNotNumber):
(JSC::DFG::SpeculativeJIT::isKnownNotCell):
* dfg/DFGSpeculativeJIT32_64.cpp:
(JSC::DFG::SpeculativeJIT::fillSpeculateIntInternal):
(JSC::DFG::SpeculativeJIT::fillSpeculateDouble):
(JSC::DFG::SpeculativeJIT::fillSpeculateCell):
* dfg/DFGStructureAbstractValue.h:
(JSC::DFG::StructureAbstractValue::dump):



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@143242 268f45cc-cd09-0410-ab3c-d52691b4dbfc