Changeset 196668 in webkit

Timestamp:

Feb 16, 2016 3:47:06 PM (8 years ago)

Author:

commit-queue@webkit.org

Message:

Unreviewed, rolling out r196652.
​https://bugs.webkit.org/show_bug.cgi?id=154315

This change caused LayoutTest crashes (Requested by ryanhaddad
on #webkit).

Reverted changeset:

"FTL should support NewTypedArray"
​https://bugs.webkit.org/show_bug.cgi?id=154268
​http://trac.webkit.org/changeset/196652

Location:

trunk/Source/JavaScriptCore

Files:

• ChangeLog (modified) (1 diff)
• ftl/FTLCapabilities.cpp (modified) (2 diffs)
• ftl/FTLLowerDFGToLLVM.cpp (modified) (4 diffs)

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2016-02-16  Commit Queue  <commit-queue@webkit.org>
+
+        Unreviewed, rolling out r196652.
+        https://bugs.webkit.org/show_bug.cgi?id=154315
+
+        This change caused LayoutTest crashes (Requested by ryanhaddad
+        on #webkit).
+
+        Reverted changeset:
+
+        "FTL should support NewTypedArray"
+        https://bugs.webkit.org/show_bug.cgi?id=154268
+        http://trac.webkit.org/changeset/196652
+
 2016-02-16  Brian Burg  <bburg@apple.com>
 

trunk/Source/JavaScriptCore/ftl/FTLCapabilities.cpp

@@ -1 +1 @@
 /*
- * Copyright (C) 2013-2016 Apple Inc. All rights reserved.
+ * Copyright (C) 2013-2015 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -73 +73 @@
     case NewArray:
     case NewArrayBuffer:
-    case NewTypedArray:
     case GetByOffset:
     case GetGetterSetterByOffset:

trunk/Source/JavaScriptCore/ftl/FTLLowerDFGToLLVM.cpp

@@ -845 +845 @@
         case NewArrayWithSize:
             compileNewArrayWithSize();
-            break;
-        case NewTypedArray:
-            compileNewTypedArray();
             break;
         case GetTypedArrayByteOffset:
@@ -4094 +4091 @@
             LValue butterfly = m_out.sub(endOfStorage, payloadSize);
             
-            LValue object = allocateObject<JSArray>(structure, butterfly, failCase);
+            LValue object = allocateObject<JSArray>(
+                structure, butterfly, failCase);
             
             m_out.store32(publicLength, butterfly, m_heaps.Butterfly_publicLength);
@@ -4161 +4159 @@
             m_out.constIntPtr(structure));
         setJSValue(vmCall(m_out.int64, m_out.operation(operationNewArrayWithSize), m_callFrame, structureValue, publicLength));
-    }
-
-    void compileNewTypedArray()
-    {
-        JSGlobalObject* globalObject = m_graph.globalObjectFor(m_node->origin.semantic);
-        TypedArrayType type = m_node->typedArrayType();
-        Structure* structure = globalObject->typedArrayStructure(type);
-
-        LValue size = lowInt32(m_node->child1());
-
-        LBasicBlock smallEnoughCase = FTL_NEW_BLOCK(m_out, ("NewTypedArray small enough case"));
-        LBasicBlock nonZeroCase = FTL_NEW_BLOCK(m_out, ("NewTypedArray non-zero case"));
-        LBasicBlock slowCase = FTL_NEW_BLOCK(m_out, ("NewTypedArray slow case"));
-        LBasicBlock continuation = FTL_NEW_BLOCK(m_out, ("NewTypedArray continuation"));
-
-        m_out.branch(
-            m_out.above(size, m_out.constInt32(JSArrayBufferView::fastSizeLimit)),
-            rarely(slowCase), usually(smallEnoughCase));
-
-        LBasicBlock lastNext = m_out.appendTo(smallEnoughCase, nonZeroCase);
-
-        m_out.branch(m_out.notZero32(size), usually(nonZeroCase), rarely(slowCase));
-
-        m_out.appendTo(nonZeroCase, slowCase);
-
-        LValue byteSize = m_out.shl(m_out.zeroExtPtr(size), m_out.constInt32(logElementSize(type)));
-        if (elementSize(type) < 8) {
-            byteSize = m_out.bitAnd(
-                m_out.add(byteSize, m_out.constIntPtr(7)),
-                m_out.constIntPtr(~static_cast<intptr_t>(7)));
-        }
-        
-        LValue storage = allocateBasicStorage(byteSize, slowCase);
-
-        LValue fastResultValue = allocateObject<JSArrayBufferView>(structure, storage, slowCase);
-
-        m_out.storePtr(storage, fastResultValue, m_heaps.JSArrayBufferView_vector);
-        m_out.store32(size, fastResultValue, m_heaps.JSArrayBufferView_length);
-        m_out.store32(m_out.constInt32(FastTypedArray), fastResultValue, m_heaps.JSArrayBufferView_mode);
-
-        ValueFromBlock fastResult = m_out.anchor(fastResultValue);
-        m_out.jump(continuation);
-
-        m_out.appendTo(slowCase, continuation);
-
-        LValue slowResultValue = lazySlowPath(
-            [=] (const Vector<Location>& locations) -> RefPtr<LazySlowPath::Generator> {
-                return createLazyCallGenerator(
-                    operationNewTypedArrayWithSizeForType(type), locations[0].directGPR(),
-                    CCallHelpers::TrustedImmPtr(structure), locations[1].directGPR());
-            },
-            size);
-        ValueFromBlock slowResult = m_out.anchor(slowResultValue);
-        m_out.jump(continuation);
-
-        m_out.appendTo(continuation, lastNext);
-        setJSValue(m_out.phi(m_out.intPtr, fastResult, slowResult));
     }
     
@@ -7991 +7932 @@
         return m_out.sub(
             m_out.loadPtr(m_out.absolute(&allocator.m_currentPayloadEnd)), newRemaining);
-    }
-
-    LValue allocateBasicStorage(LValue size, LBasicBlock slowPath)
-    {
-        return m_out.sub(allocateBasicStorageAndGetEnd(size, slowPath), size);
     }