Changeset 227435 in webkit

Timestamp:

Jan 23, 2018 12:49:26 PM (6 years ago)

Author:

rmorisset@apple.com

Message:

Rollout r219636
​https://bugs.webkit.org/show_bug.cgi?id=181997
<rdar://problem/35883022>

Unreviewed, as it is a rollout.

• dfg/DFGSpeculativeJIT.cpp:

(JSC::DFG::SpeculativeJIT::emitAllocateRawObject):

• runtime/JSArray.cpp:

(JSC::JSArray::tryCreateUninitializedRestricted):

• runtime/JSArray.h:

(JSC::JSArray::tryCreate):

• runtime/JSObject.cpp:

(JSC::JSObject::ensureLengthSlow):

Location:

trunk/Source/JavaScriptCore

Files:

• ChangeLog (modified) (1 diff)
• dfg/DFGSpeculativeJIT.cpp (modified) (1 diff)
• runtime/JSArray.cpp (modified) (1 diff)
• runtime/JSArray.h (modified) (1 diff)
• runtime/JSObject.cpp (modified) (1 diff)

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2018-01-23  Robin Morisset  <rmorisset@apple.com>
+
+        Rollout r219636
+        https://bugs.webkit.org/show_bug.cgi?id=181997
+        <rdar://problem/35883022>
+
+        Unreviewed, as it is a rollout.
+
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::emitAllocateRawObject):
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::tryCreateUninitializedRestricted):
+        * runtime/JSArray.h:
+        (JSC::JSArray::tryCreate):
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::ensureLengthSlow):
+
 2018-01-23  Mark Lam  <mark.lam@apple.com>
 

trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp

@@ -145 +145 @@
         structure, vectorLength));
 
-    if (numElements < vectorLength && LIKELY(!hasUndecided(structure->indexingType()))) {
+    if (numElements < vectorLength) {
 #if USE(JSVALUE64)
         if (hasDouble(structure->indexingType()))

trunk/Source/JavaScriptCore/runtime/JSArray.cpp

@@ -92 +92 @@
             for (; i < vectorLength; ++i)
                 butterfly->contiguousDouble().at(std::numeric_limits<uint32_t>::max(), i) = PNaN;
-        } else if (LIKELY(!hasUndecided(indexingType))) {
+        } else {
             for (; i < vectorLength; ++i)
                 butterfly->contiguous().at(std::numeric_limits<uint32_t>::max(), i).clear();

trunk/Source/JavaScriptCore/runtime/JSArray.h

@@ -248 +248 @@
         if (hasDouble(indexingType))
             clearArray(butterfly->contiguousDouble().data(), vectorLength);
-        else if (LIKELY(!hasUndecided(indexingType)))
+        else
             clearArray(butterfly->contiguous().data(), vectorLength);
     } else {

trunk/Source/JavaScriptCore/runtime/JSObject.cpp

@@ -3223 +3223 @@
         for (unsigned i = oldVectorLength; i < newVectorLength; ++i)
             butterfly->indexingPayload<double>()[i] = PNaN;
-    } else if (LIKELY(!hasUndecided(indexingType()))) {
+    } else {
         for (unsigned i = oldVectorLength; i < newVectorLength; ++i)
             butterfly->indexingPayload<WriteBarrier<Unknown>>()[i].clear();