ConvertThis should be turned into Identity based on predictions in Fixup, rather than based on proofs in ConstantFolding
https://bugs.webkit.org/show_bug.cgi?id=111674

Source/JavaScriptCore: 

Reviewed by Oliver Hunt.
        
This gets rid of the speculated forms of ConvertThis in the backend, and has Fixup
convert them to either Identity(Object:@child) if the child is predicted object, or
Phantom(Other:@child) ; WeakJSConstant(global this object) if it's predicted Other.
        
The goal of this is to ensure that the optimization fixpoint doesn't create
Identity's, since doing so requires a rerun of CSE. So far this isn't a speed-up
but I'm hoping this will be a step towards reducing the need to rerun the fixpoint
so as to ultimately reduce compile times.

* dfg/DFGAbstractState.cpp:
(JSC::DFG::AbstractState::executeEffects):
* dfg/DFGAssemblyHelpers.h:
(AssemblyHelpers):
* dfg/DFGConstantFoldingPhase.cpp:
(JSC::DFG::ConstantFoldingPhase::foldConstants):
* dfg/DFGFixupPhase.cpp:
(JSC::DFG::FixupPhase::fixupNode):
(FixupPhase):
(JSC::DFG::FixupPhase::observeUseKindOnNode):
(JSC::DFG::FixupPhase::setUseKindAndUnboxIfProfitable):
* dfg/DFGGraph.h:
(JSC::DFG::Graph::globalThisObjectFor):
(Graph):
* dfg/DFGNode.h:
(Node):
(JSC::DFG::Node::convertToIdentity):
(JSC::DFG::Node::convertToWeakConstant):
* dfg/DFGSpeculativeJIT32_64.cpp:
(JSC::DFG::SpeculativeJIT::compile):
* dfg/DFGSpeculativeJIT64.cpp:
(JSC::DFG::SpeculativeJIT::compile):

LayoutTests: 

Reviewed by Oliver Hunt.

* fast/js/dfg-convert-this-object-then-exit-on-other-expected.txt: Added.
* fast/js/dfg-convert-this-object-then-exit-on-other.html: Added.
* fast/js/dfg-convert-this-other-then-exit-on-object-expected.txt: Added.
* fast/js/dfg-convert-this-other-then-exit-on-object.html: Added.
* fast/js/dfg-convert-this-polymorphic-object-then-exit-on-other-expected.txt: Added.
* fast/js/dfg-convert-this-polymorphic-object-then-exit-on-other.html: Added.
* fast/js/dfg-convert-this-polymorphic-object-then-exit-on-string-expected.txt: Added.
* fast/js/dfg-convert-this-polymorphic-object-then-exit-on-string.html: Added.
* fast/js/jsc-test-list:
* fast/js/script-tests/dfg-convert-this-object-then-exit-on-other.js: Added.
(foo):
* fast/js/script-tests/dfg-convert-this-other-then-exit-on-object.js: Added.
(foo):
* fast/js/script-tests/dfg-convert-this-polymorphic-object-then-exit-on-other.js: Added.
(foo):
* fast/js/script-tests/dfg-convert-this-polymorphic-object-then-exit-on-string.js: Added.
(foo):



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@145052 268f45cc-cd09-0410-ab3c-d52691b4dbfc