https://bugs.webkit.org/show_bug.cgi?id=115088

Reviewed by Oliver Hunt.

Source/JavaScriptCore: 

No change on the benchmarks we track, but a 3X speedup on a
microbenchmark that uses these techniques.

* dfg/DFGByteCodeParser.cpp:
(JSC::DFG::ByteCodeParser::parseBlock): (!/=)= and (!/=)== can constant
fold all types, not just numbers, because true constants have no
side effects when type-converted at runtime.

* dfg/DFGFixupPhase.cpp:
(JSC::DFG::FixupPhase::fixupNode):
* dfg/DFGNode.h:
(JSC::DFG::Node::shouldSpeculateBoolean): Added support for fixing up
boolean uses, like we do for other types like number.

* dfg/DFGSpeculativeJIT.cpp:
(JSC::DFG::SpeculativeJIT::compilePeepHoleBooleanBranch):
(JSC::DFG::SpeculativeJIT::compilePeepHoleBranch):
(JSC::DFG::SpeculativeJIT::compare):
(JSC::DFG::SpeculativeJIT::compileStrictEq):
(JSC::DFG::SpeculativeJIT::compileBooleanCompare): Peephole fuse
boolean compare and/or compare-branch, now that we have the types for
them.

* dfg/DFGSpeculativeJIT.h: Updated declarations.

LayoutTests: 

* fast/js/regress/script-tests/branch-fold.js:
(g): Added some boolean and constant-folded cases.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@149041 268f45cc-cd09-0410-ab3c-d52691b4dbfc