Modified: trunk/Source/_javascript_Core/ChangeLog (208821 => 208822)
--- trunk/Source/_javascript_Core/ChangeLog 2016-11-16 23:34:39 UTC (rev 208821)
+++ trunk/Source/_javascript_Core/ChangeLog 2016-11-16 23:57:05 UTC (rev 208822)
@@ -1,3 +1,16 @@
+2016-11-16 Filip Pizlo <[email protected]>
+
+ Unreviewed, roll out r208811. It's not sound.
+
+ * ftl/FTLLowerDFGToB3.cpp:
+ (JSC::FTL::DFG::LowerDFGToB3::compileMaterializeNewObject):
+ (JSC::FTL::DFG::LowerDFGToB3::allocatePropertyStorage):
+ (JSC::FTL::DFG::LowerDFGToB3::reallocatePropertyStorage):
+ (JSC::FTL::DFG::LowerDFGToB3::allocateObject):
+ (JSC::FTL::DFG::LowerDFGToB3::mutatorFence):
+ (JSC::FTL::DFG::LowerDFGToB3::setButterfly):
+ (JSC::FTL::DFG::LowerDFGToB3::splatWordsIfMutatorIsFenced): Deleted.
+
2016-11-16 Keith Miller <[email protected]>
Wasm function parser should use template functions for each binary and unary opcode
Modified: trunk/Source/_javascript_Core/ftl/FTLLowerDFGToB3.cpp (208821 => 208822)
--- trunk/Source/_javascript_Core/ftl/FTLLowerDFGToB3.cpp 2016-11-16 23:34:39 UTC (rev 208821)
+++ trunk/Source/_javascript_Core/ftl/FTLLowerDFGToB3.cpp 2016-11-16 23:57:05 UTC (rev 208822)
@@ -8134,7 +8134,7 @@
ValueFromBlock haveButterfly = m_out.anchor(fastButterflyValue);
- splatWordsIfMutatorIsFenced(
+ splatWords(
fastButterflyValue,
m_out.constInt32(-structure->outOfLineCapacity() - 1),
m_out.constInt32(-1),
@@ -8960,25 +8960,6 @@
splatWords(butterfly, begin, end, hole, heap->atAnyIndex());
}
- void splatWordsIfMutatorIsFenced(LValue base, LValue begin, LValue end, LValue value, const AbstractHeap& heap)
- {
- LBasicBlock slowPath = m_out.newBlock();
- LBasicBlock continuation = m_out.newBlock();
-
- LBasicBlock lastNext = m_out.insertNewBlocksBefore(slowPath);
-
- m_out.branch(
- m_out.load8ZeroExt32(m_out.absolute(vm().heap.addressOfMutatorShouldBeFenced())),
- rarely(slowPath), usually(continuation));
-
- m_out.appendTo(slowPath, continuation);
-
- splatWords(base, begin, end, value, heap);
- m_out.jump(continuation);
-
- m_out.appendTo(continuation, lastNext);
- }
-
void splatWords(LValue base, LValue begin, LValue end, LValue value, const AbstractHeap& heap)
{
const uint64_t unrollingLimit = 10;
@@ -9032,7 +9013,7 @@
LValue result = allocatePropertyStorageWithSizeImpl(initialOutOfLineCapacity);
- splatWordsIfMutatorIsFenced(
+ splatWords(
result,
m_out.constInt32(-initialOutOfLineCapacity - 1), m_out.constInt32(-1),
m_out.int64Zero, m_heaps.properties.atAnyNumber());
@@ -9065,7 +9046,7 @@
m_out.storePtr(loaded, m_out.address(m_heaps.properties.atAnyNumber(), result, offset));
}
- splatWordsIfMutatorIsFenced(
+ splatWords(
result,
m_out.constInt32(-newSize - 1), m_out.constInt32(-oldSize - 1),
m_out.int64Zero, m_heaps.properties.atAnyNumber());
@@ -9945,7 +9926,7 @@
LValue allocator, Structure* structure, LValue butterfly, LBasicBlock slowPath)
{
LValue result = allocateCell(allocator, structure, slowPath);
- splatWordsIfMutatorIsFenced(
+ splatWords(
result,
m_out.constInt32(JSFinalObject::offsetOfInlineStorage() / 8),
m_out.constInt32(JSFinalObject::offsetOfInlineStorage() / 8 + structure->inlineCapacity()),
