Sink NaN sanitization to uses and remove it when it's unnecessary
https://bugs.webkit.org/show_bug.cgi?id=131419

Reviewed by Oliver Hunt.
        
This moves NaN purification to stores that could see an impure NaN.
        
5% speed-up on AsmBench, 50% speed-up on AsmBench/n-body. It is a regression on FloatMM
though, because of the other bug that causes that benchmark to box doubles in a loop.

* bytecode/SpeculatedType.h:
(JSC::isInt32SpeculationForArithmetic):
(JSC::isMachineIntSpeculationForArithmetic):
(JSC::isDoubleSpeculation):
(JSC::isDoubleSpeculationForArithmetic):
* dfg/DFGAbstractInterpreterInlines.h:
(JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
* dfg/DFGAbstractValue.cpp:
(JSC::DFG::AbstractValue::fixTypeForRepresentation):
* dfg/DFGFixupPhase.cpp:
(JSC::DFG::FixupPhase::fixupNode):
(JSC::DFG::FixupPhase::injectTypeConversionsForEdge):
* dfg/DFGInPlaceAbstractState.cpp:
(JSC::DFG::InPlaceAbstractState::mergeStateAtTail):
* dfg/DFGPredictionPropagationPhase.cpp:
(JSC::DFG::PredictionPropagationPhase::propagate):
* dfg/DFGSpeculativeJIT.cpp:
(JSC::DFG::SpeculativeJIT::compileValueRep):
(JSC::DFG::SpeculativeJIT::compileGetByValOnFloatTypedArray):
* dfg/DFGUseKind.h:
(JSC::DFG::typeFilterFor):
* ftl/FTLLowerDFGToLLVM.cpp:
(JSC::FTL::LowerDFGToLLVM::compileValueRep):
(JSC::FTL::LowerDFGToLLVM::compileGetByVal):
* runtime/PureNaN.h:
* tests/stress/float32-array-nan-inlined.js: Added.
(foo):
(test):
* tests/stress/float32-array-nan.js: Added.
(foo):
(test):
* tests/stress/float64-array-nan-inlined.js: Added.
(foo):
(isBigEndian):
(test):
* tests/stress/float64-array-nan.js: Added.
(foo):
(isBigEndian):
(test):



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@167416 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Extra error reporting for invalid value conversions
https://bugs.webkit.org/show_bug.cgi?id=131786

Rubber stamped by Ryosuke Niwa.

* dfg/DFGFixupPhase.cpp:
(JSC::DFG::FixupPhase::injectTypeConversionsForEdge):



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@167417 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Build fix after http://trac.webkit.org/changeset/167416 (Sink NaN sanitization)

* dfg/DFGSpeculativeJIT.cpp: (JSC::DFG::SpeculativeJIT::speculate):



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@167418 268f45cc-cd09-0410-ab3c-d52691b4dbfc