[Webkit-unassigned] [Bug 43742] REGRESSION(r58469): Math.pow() always returns double-backed JSValue which is extremely slow as array subscript

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=43742


Andreas Kling <andreas.kling at nokia.com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
            Summary|Avoid slow-path for array   |REGRESSION(r58469):
                   |lookups with integral       |Math.pow() always returns
                   |double subscripts           |double-backed JSValue which
                   |                            |is extremely slow as array
                   |                            |subscript
           Priority|P2                          |P1
                 CC|                            |barraclough at apple.com,
                   |                            |darin at apple.com




--- Comment #9 from Andreas Kling <andreas.kling at nokia.com>  2010-08-13 12:55:45 PST ---
Oliver mentioned on IRC that this might be a performance regression, so I did a little detective work.

Turns out it did regress severely with http://trac.webkit.org/changeset/58469

With this change, pow() always returns JSValues that are doubles. Previously it would go through the JSValue constructor that stores integral double values as int32s.

I am unsure what the best fix is, move forward with the patch I've posted here, modify the JIT's storeDouble() to emulate JSValue(double), or something else entirely. Please advise :-)

-- 
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.