Changeset 167252 in webkit

Timestamp:

Apr 14, 2014 10:26:28 AM (10 years ago)

Author:

akling@apple.com

Message:

Unreviewed, rolling out r167249.
​https://bugs.webkit.org/show_bug.cgi?id=131621

broke 3 tests on cloop (Requested by kling on #webkit).

Reverted changeset:

"Array.prototype.concat should allocate output storage only
once."
​https://bugs.webkit.org/show_bug.cgi?id=131609
​http://trac.webkit.org/changeset/167249

Patch by Commit Queue <​commit-queue@webkit.org> on 2014-04-14

Location:

trunk/Source/JavaScriptCore

Files:

• ChangeLog (modified) (1 diff)
• runtime/ArrayPrototype.cpp (modified) (2 diffs)

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2014-04-14  Commit Queue  <commit-queue@webkit.org>
+
+        Unreviewed, rolling out r167249.
+        https://bugs.webkit.org/show_bug.cgi?id=131621
+
+        broke 3 tests on cloop (Requested by kling on #webkit).
+
+        Reverted changeset:
+
+        "Array.prototype.concat should allocate output storage only
+        once."
+        https://bugs.webkit.org/show_bug.cgi?id=131609
+        http://trac.webkit.org/changeset/167249
+
 2014-04-14  Alex Christensen  <achristensen@webkit.org>
 

trunk/Source/JavaScriptCore/runtime/ArrayPrototype.cpp

@@ -147 +147 @@
 
 // Helper function
-static ALWAYS_INLINE JSValue getProperty(ExecState* exec, JSObject* obj, unsigned index)
+static JSValue getProperty(ExecState* exec, JSObject* obj, unsigned index)
 {
     PropertySlot slot(obj);
@@ -417 +417 @@
 {
     JSValue thisValue = exec->thisValue().toThis(exec, StrictMode);
+    JSArray* arr = constructEmptyArray(exec, nullptr);
+    unsigned n = 0;
+    JSValue curArg = thisValue.toObject(exec);
+    if (exec->hadException())
+        return JSValue::encode(jsUndefined());
+    size_t i = 0;
     size_t argCount = exec->argumentCount();
-    JSValue curArg = thisValue.toObject(exec);
-    Checked<unsigned, RecordOverflow> finalArraySize = 0;
-
-    for (size_t i = 0; i <= argCount; ++i) {
-        if (JSArray* currentArray = jsDynamicCast<JSArray*>(curArg))
-            finalArraySize += currentArray->length();
-        else
-            finalArraySize++;
-        curArg = exec->uncheckedArgument(i);
-    }
-
-    if (finalArraySize.hasOverflowed())
-        return JSValue::encode(throwOutOfMemoryError(exec));
-
-    JSArray* arr = constructEmptyArray(exec, nullptr, finalArraySize.unsafeGet());
-    if (exec->hadException())
-        return JSValue::encode(jsUndefined());
-
-    curArg = thisValue.toObject(exec);
-    unsigned n = 0;
-    size_t i = 0;
     while (1) {
-        if (JSArray* currentArray = jsDynamicCast<JSArray*>(curArg)) {
-            unsigned length = currentArray->length();
+        if (curArg.inherits(JSArray::info())) {
+            unsigned length = curArg.get(exec, exec->propertyNames().length).toUInt32(exec);
+            JSObject* curObject = curArg.toObject(exec);
             for (unsigned k = 0; k < length; ++k) {
-                JSValue v = getProperty(exec, currentArray, k);
+                JSValue v = getProperty(exec, curObject, k);
                 if (exec->hadException())
                     return JSValue::encode(jsUndefined());