Title: [227655] branches/safari-605-branch/Source/_javascript_Core
- Revision
- 227655
- Author
- [email protected]
- Date
- 2018-01-25 21:02:59 -0800 (Thu, 25 Jan 2018)
Log Message
Cherry-pick r227435. rdar://problem/36873349
Modified Paths
Diff
Modified: branches/safari-605-branch/Source/_javascript_Core/ChangeLog (227654 => 227655)
--- branches/safari-605-branch/Source/_javascript_Core/ChangeLog 2018-01-26 05:02:57 UTC (rev 227654)
+++ branches/safari-605-branch/Source/_javascript_Core/ChangeLog 2018-01-26 05:02:59 UTC (rev 227655)
@@ -1,5 +1,26 @@
2018-01-25 Jason Marcell <[email protected]>
+ Cherry-pick r227435. rdar://problem/36873349
+
+ 2018-01-23 Robin Morisset <[email protected]>
+
+ Rollout r219636
+ https://bugs.webkit.org/show_bug.cgi?id=181997
+ <rdar://problem/35883022>
+
+ Unreviewed, as it is a rollout.
+
+ * dfg/DFGSpeculativeJIT.cpp:
+ (JSC::DFG::SpeculativeJIT::emitAllocateRawObject):
+ * runtime/JSArray.cpp:
+ (JSC::JSArray::tryCreateUninitializedRestricted):
+ * runtime/JSArray.h:
+ (JSC::JSArray::tryCreate):
+ * runtime/JSObject.cpp:
+ (JSC::JSObject::ensureLengthSlow):
+
+2018-01-25 Jason Marcell <[email protected]>
+
Cherry-pick r227410. rdar://problem/36873404
2018-01-23 Robin Morisset <[email protected]>
Modified: branches/safari-605-branch/Source/_javascript_Core/dfg/DFGSpeculativeJIT.cpp (227654 => 227655)
--- branches/safari-605-branch/Source/_javascript_Core/dfg/DFGSpeculativeJIT.cpp 2018-01-26 05:02:57 UTC (rev 227654)
+++ branches/safari-605-branch/Source/_javascript_Core/dfg/DFGSpeculativeJIT.cpp 2018-01-26 05:02:59 UTC (rev 227655)
@@ -144,7 +144,7 @@
slowCases, this, operationNewRawObject, resultGPR, storageGPR,
structure, vectorLength));
- if (numElements < vectorLength && LIKELY(!hasUndecided(structure->indexingType()))) {
+ if (numElements < vectorLength) {
#if USE(JSVALUE64)
if (hasDouble(structure->indexingType()))
m_jit.move(TrustedImm64(bitwise_cast<int64_t>(PNaN)), scratchGPR);
Modified: branches/safari-605-branch/Source/_javascript_Core/runtime/JSArray.cpp (227654 => 227655)
--- branches/safari-605-branch/Source/_javascript_Core/runtime/JSArray.cpp 2018-01-26 05:02:57 UTC (rev 227654)
+++ branches/safari-605-branch/Source/_javascript_Core/runtime/JSArray.cpp 2018-01-26 05:02:59 UTC (rev 227655)
@@ -91,7 +91,7 @@
if (hasDouble(indexingType)) {
for (; i < vectorLength; ++i)
butterfly->contiguousDouble().at(std::numeric_limits<uint32_t>::max(), i) = PNaN;
- } else if (LIKELY(!hasUndecided(indexingType))) {
+ } else {
for (; i < vectorLength; ++i)
butterfly->contiguous().at(std::numeric_limits<uint32_t>::max(), i).clear();
}
Modified: branches/safari-605-branch/Source/_javascript_Core/runtime/JSArray.h (227654 => 227655)
--- branches/safari-605-branch/Source/_javascript_Core/runtime/JSArray.h 2018-01-26 05:02:57 UTC (rev 227654)
+++ branches/safari-605-branch/Source/_javascript_Core/runtime/JSArray.h 2018-01-26 05:02:59 UTC (rev 227655)
@@ -247,7 +247,7 @@
butterfly->setPublicLength(initialLength);
if (hasDouble(indexingType))
clearArray(butterfly->contiguousDouble().data(), vectorLength);
- else if (LIKELY(!hasUndecided(indexingType)))
+ else
clearArray(butterfly->contiguous().data(), vectorLength);
} else {
ASSERT(
Modified: branches/safari-605-branch/Source/_javascript_Core/runtime/JSObject.cpp (227654 => 227655)
--- branches/safari-605-branch/Source/_javascript_Core/runtime/JSObject.cpp 2018-01-26 05:02:57 UTC (rev 227654)
+++ branches/safari-605-branch/Source/_javascript_Core/runtime/JSObject.cpp 2018-01-26 05:02:59 UTC (rev 227655)
@@ -3222,7 +3222,7 @@
if (hasDouble(indexingType())) {
for (unsigned i = oldVectorLength; i < newVectorLength; ++i)
butterfly->indexingPayload<double>()[i] = PNaN;
- } else if (LIKELY(!hasUndecided(indexingType()))) {
+ } else {
for (unsigned i = oldVectorLength; i < newVectorLength; ++i)
butterfly->indexingPayload<WriteBarrier<Unknown>>()[i].clear();
}
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
