[webkit-changes] [205174] tags/Safari-603.1.3.0.1

Mon, 29 Aug 2016 23:10:40 -0700

Title: [205174] tags/Safari-603.1.3.0.1

Diff

Modified: tags/Safari-603.1.3.0.1/LayoutTests/ChangeLog (205173 => 205174)


--- tags/Safari-603.1.3.0.1/LayoutTests/ChangeLog	2016-08-30 06:07:44 UTC (rev 205173)
+++ tags/Safari-603.1.3.0.1/LayoutTests/ChangeLog	2016-08-30 06:10:18 UTC (rev 205174)
@@ -1,3 +1,16 @@
+2016-08-29  Babak Shafiei  <[email protected]>
+
+        Merge r204901.
+
+    2016-08-23  Filip Pizlo  <[email protected]>
+
+            js/regress/put-by-id-transition-with-indexing-header.html and svg/carto.net/window.svg fail in debug after r204854
+            https://bugs.webkit.org/show_bug.cgi?id=161115
+
+            Reviewed by Keith Miller.
+
+            * TestExpectations:
+
 2016-08-25  Babak Shafiei  <[email protected]>
 
         Merge r204986.

Modified: tags/Safari-603.1.3.0.1/LayoutTests/TestExpectations (205173 => 205174)


--- tags/Safari-603.1.3.0.1/LayoutTests/TestExpectations	2016-08-30 06:07:44 UTC (rev 205173)
+++ tags/Safari-603.1.3.0.1/LayoutTests/TestExpectations	2016-08-30 06:10:18 UTC (rev 205174)
@@ -1234,4 +1234,3 @@
 webkit.org/b/159755 fast/text/emoji-gender-fe0f-9.html [ ImageOnlyFailure ]
 webkit.org/b/159755 fast/text/emoji-gender.html [ ImageOnlyFailure ]
 
-[Debug] webkit.org/b/161114 svg/carto.net/window.svg [ Skip ]

Modified: tags/Safari-603.1.3.0.1/Source/_javascript_Core/ChangeLog (205173 => 205174)


--- tags/Safari-603.1.3.0.1/Source/_javascript_Core/ChangeLog	2016-08-30 06:07:44 UTC (rev 205173)
+++ tags/Safari-603.1.3.0.1/Source/_javascript_Core/ChangeLog	2016-08-30 06:10:18 UTC (rev 205174)
@@ -1,5 +1,22 @@
 2016-08-29  Babak Shafiei  <[email protected]>
 
+        Merge r204901.
+
+    2016-08-23  Filip Pizlo  <[email protected]>
+
+            js/regress/put-by-id-transition-with-indexing-header.html and svg/carto.net/window.svg fail in debug after r204854
+            https://bugs.webkit.org/show_bug.cgi?id=161115
+
+            Reviewed by Keith Miller.
+
+            There were two small goofs.
+
+            * bytecode/ObjectAllocationProfile.h:
+            (JSC::ObjectAllocationProfile::isNull): The new policy is that the allocator can be null. So now the way you tell if the profile is null is by checking the structure.
+            * jit/JITOperations.cpp: This was using DeferGC, which is now definitely wrong. It forces the GC to happen when the structure and butterfly are mismatched. It's better for the GC to happen before we put the butterfly in the object.
+
+2016-08-29  Babak Shafiei  <[email protected]>
+
         Merge r204897.
 
     2016-08-24  Filip Pizlo  <[email protected]>

Modified: tags/Safari-603.1.3.0.1/Source/_javascript_Core/bytecode/ObjectAllocationProfile.h (205173 => 205174)


--- tags/Safari-603.1.3.0.1/Source/_javascript_Core/bytecode/ObjectAllocationProfile.h	2016-08-30 06:07:44 UTC (rev 205173)
+++ tags/Safari-603.1.3.0.1/Source/_javascript_Core/bytecode/ObjectAllocationProfile.h	2016-08-30 06:10:18 UTC (rev 205174)
@@ -45,7 +45,7 @@
     {
     }
 
-    bool isNull() { return !m_allocator; }
+    bool isNull() { return !m_structure; }
 
     void initialize(VM& vm, JSCell* owner, JSObject* prototype, unsigned inferredInlineCapacity)
     {

Modified: tags/Safari-603.1.3.0.1/Source/_javascript_Core/jit/JITOperations.cpp (205173 => 205174)


--- tags/Safari-603.1.3.0.1/Source/_javascript_Core/jit/JITOperations.cpp	2016-08-30 06:07:44 UTC (rev 205173)
+++ tags/Safari-603.1.3.0.1/Source/_javascript_Core/jit/JITOperations.cpp	2016-08-30 06:10:18 UTC (rev 205174)
@@ -2119,7 +2119,6 @@
     NativeCallFrameTracer tracer(&vm, exec);
 
     ASSERT(!object->structure()->outOfLineCapacity());
-    DeferGC deferGC(vm.heap);
     Butterfly* result = object->growOutOfLineStorage(vm, 0, initialOutOfLineCapacity);
     object->setButterflyWithoutChangingStructure(vm, result);
     return reinterpret_cast<char*>(result);
@@ -2130,7 +2129,6 @@
     VM& vm = exec->vm();
     NativeCallFrameTracer tracer(&vm, exec);
 
-    DeferGC deferGC(vm.heap);
     Butterfly* result = object->growOutOfLineStorage(vm, object->structure()->outOfLineCapacity(), newSize);
     object->setButterflyWithoutChangingStructure(vm, result);
     return reinterpret_cast<char*>(result);

_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes

Reply via email to