Unreviewed, rolling out r208584.
Seems to have regressed Speedometer by 1% on Mac
Reverted changeset:
"We should have a more concise way of determining when we're
varargs calling a function using rest parameters"
https://bugs.webkit.org/show_bug.cgi?id=164258
http://trac.webkit.org/changeset/208584
git-svn-id: http://svn.webkit.org/repository/webkit/trunk@208592 268f45cc-cd09-0410-ab3c-d52691b4dbfc
diff --git a/JSTests/ChangeLog b/JSTests/ChangeLog
index 839f306..bf64ae1 100644
--- a/JSTests/ChangeLog
+++ b/JSTests/ChangeLog
@@ -1,5 +1,18 @@
2016-11-11 Chris Dumez <cdumez@apple.com>
+ Unreviewed, rolling out r208584.
+
+ Seems to have regressed Speedometer by 1% on Mac
+
+ Reverted changeset:
+
+ "We should have a more concise way of determining when we're
+ varargs calling a function using rest parameters"
+ https://bugs.webkit.org/show_bug.cgi?id=164258
+ http://trac.webkit.org/changeset/208584
+
+2016-11-11 Chris Dumez <cdumez@apple.com>
+
Unreviewed, rolling out r208117 and r208160.
Regressed Speedometer by >1.5%
diff --git a/JSTests/microbenchmarks/call-using-spread.js b/JSTests/microbenchmarks/call-using-spread.js
deleted file mode 100644
index 659a344..0000000
--- a/JSTests/microbenchmarks/call-using-spread.js
+++ /dev/null
@@ -1,14 +0,0 @@
-function bar(a, b, c, d, e, f) { }
-noInline(bar);
-function foo(a, b, ...args) {
- return bar(a, b, ...args);
-}
-noInline(foo);
-
-let start = Date.now();
-for (let i = 0; i < 500000; i++) {
- foo(i, i+1, i+2, i+3, i+4, i+5);
-}
-const verbose = false;
-if (verbose)
- print(Date.now() - start);
diff --git a/JSTests/microbenchmarks/spread-large-array.js b/JSTests/microbenchmarks/spread-large-array.js
deleted file mode 100644
index d6efa52..0000000
--- a/JSTests/microbenchmarks/spread-large-array.js
+++ /dev/null
@@ -1,39 +0,0 @@
-function foo(arg) {
- return [...arg];
-}
-noInline(foo);
-
-let arrays = [ ];
-const size = 500;
-{
- let arr = [];
- for (let i = 0; i < size; i++) {
- arr.push(i);
- }
- arrays.push(arr);
-}
-
-{
- let arr = [];
- for (let i = 0; i < size; i++) {
- arr.push(i + 0.5);
- }
- arrays.push(arr);
-}
-
-{
- let arr = [];
- for (let i = 0; i < size; i++) {
- arr.push({i: i});
- }
- arrays.push(arr);
-}
-
-let start = Date.now();
-for (let i = 0; i < 100000; i++) {
- let array = arrays[i % arrays.length];
- foo(array);
-}
-const verbose = false;
-if (verbose)
- print(Date.now() - start);
diff --git a/JSTests/microbenchmarks/spread-small-array.js b/JSTests/microbenchmarks/spread-small-array.js
deleted file mode 100644
index a68ee6c..0000000
--- a/JSTests/microbenchmarks/spread-small-array.js
+++ /dev/null
@@ -1,19 +0,0 @@
-function foo(arg) {
- return [...arg];
-}
-noInline(foo);
-
-let arrays = [
- [10, 20, 40],
- [10.5, 20.5, 40.5],
- [20, {}, 8],
-];
-
-let start = Date.now();
-for (let i = 0; i < 10000000; i++) {
- let array = arrays[i % arrays.length];
- foo(array);
-}
-const verbose = false;
-if (verbose)
- print(Date.now() - start);
diff --git a/JSTests/stress/spread-array-iterator-watchpoint-2.js b/JSTests/stress/spread-array-iterator-watchpoint-2.js
deleted file mode 100644
index 7dde534..0000000
--- a/JSTests/stress/spread-array-iterator-watchpoint-2.js
+++ /dev/null
@@ -1,22 +0,0 @@
-function foo(a) {
- return [...a];
-}
-noInline(foo);
-
-let arr = [];
-for (let i = 0; i < 10000; i++) {
- if (i % 100 === 0)
- arr.push([], i);
- foo(arr);
-}
-
-let calledIterator = false;
-let arrayIterator = [][Symbol.iterator]().__proto__;
-arrayIterator.next = function() {
- calledIterator = true;
- return {done: true};
-};
-
-let r = foo(arr);
-if (!calledIterator || r.length)
- throw new Error("Bad result");
diff --git a/JSTests/stress/spread-array-iterator-watchpoint.js b/JSTests/stress/spread-array-iterator-watchpoint.js
deleted file mode 100644
index ac77453..0000000
--- a/JSTests/stress/spread-array-iterator-watchpoint.js
+++ /dev/null
@@ -1,25 +0,0 @@
-function foo(a) {
- return [...a];
-}
-noInline(foo);
-
-let arr = [];
-for (let i = 0; i < 10000; i++) {
- if (i % 100 === 0)
- arr.push([], i);
- foo(arr);
-}
-
-let calledIterator = false;
-Array.prototype[Symbol.iterator] = function iterator() {
- calledIterator = true;
- return {
- next() {
- return {done: true};
- }
- };
-};
-
-foo(arr);
-if (!calledIterator)
- throw new Error("Bad result");
diff --git a/JSTests/stress/spread-non-array.js b/JSTests/stress/spread-non-array.js
deleted file mode 100644
index 124789a..0000000
--- a/JSTests/stress/spread-non-array.js
+++ /dev/null
@@ -1,62 +0,0 @@
-function assert(b) {
- if (!b)
- throw new Error("Bad assertion.");
-}
-function foo(m) {
- return [...m];
-}
-noInline(foo);
-
-let map = new Map;
-map.set(20, 30);
-map.set(40, 50);
-
-let called = 0;
-let customIterator = {
- [Symbol.iterator]: function() {
- called++;
- let count = 0;
- return {
- next() {
- called++;
- count++;
- if (count === 1)
- return {done: false, value: [20, 30]};
- if (count === 2)
- return {done: false, value: [40, 50]};
- return {done: true};
- }
- };
- }
-};
-for (let i = 0; i < 10000; i++) {
- for (let o of [customIterator, map]) {
- let [[a, b], [c, d]] = foo(o);
- assert(a === 20);
- assert(b === 30);
- assert(c === 40);
- assert(d === 50);
- }
- assert(called === 4);
- called = 0;
-}
-
-function bar(m) {
- return [...m, ...m];
-}
-noInline(bar);
-for (let i = 0; i < 10000; i++) {
- for (let o of [customIterator, map]) {
- let [[a, b], [c, d], [e, f], [g, h]] = bar(o);
- assert(a === 20);
- assert(b === 30);
- assert(c === 40);
- assert(d === 50);
- assert(e === 20);
- assert(f === 30);
- assert(g === 40);
- assert(h === 50);
- }
- assert(called === 8);
- called = 0;
-}
diff --git a/Source/JavaScriptCore/CMakeLists.txt b/Source/JavaScriptCore/CMakeLists.txt
index 785e9d2..72dcc02 100644
--- a/Source/JavaScriptCore/CMakeLists.txt
+++ b/Source/JavaScriptCore/CMakeLists.txt
@@ -650,7 +650,6 @@
runtime/ArrayBufferView.cpp
runtime/ArrayConstructor.cpp
runtime/ArrayConventions.cpp
- runtime/ArrayIteratorAdaptiveWatchpoint.cpp
runtime/ArrayIteratorPrototype.cpp
runtime/ArrayPrototype.cpp
runtime/AtomicsObject.cpp
@@ -744,7 +743,6 @@
runtime/JSDataViewPrototype.cpp
runtime/JSDateMath.cpp
runtime/JSEnvironmentRecord.cpp
- runtime/JSFixedArray.cpp
runtime/JSFunction.cpp
runtime/JSGeneratorFunction.cpp
runtime/JSGlobalLexicalEnvironment.cpp
@@ -1352,7 +1350,6 @@
${JAVASCRIPTCORE_DIR}/builtins/GlobalOperations.js
${JAVASCRIPTCORE_DIR}/builtins/InspectorInstrumentationObject.js
${JAVASCRIPTCORE_DIR}/builtins/InternalPromiseConstructor.js
- ${JAVASCRIPTCORE_DIR}/builtins/IteratorHelpers.js
${JAVASCRIPTCORE_DIR}/builtins/IteratorPrototype.js
${JAVASCRIPTCORE_DIR}/builtins/MapPrototype.js
${JAVASCRIPTCORE_DIR}/builtins/ModuleLoaderPrototype.js
diff --git a/Source/JavaScriptCore/ChangeLog b/Source/JavaScriptCore/ChangeLog
index 1230dad..bc9729c 100644
--- a/Source/JavaScriptCore/ChangeLog
+++ b/Source/JavaScriptCore/ChangeLog
@@ -1,5 +1,18 @@
2016-11-11 Chris Dumez <cdumez@apple.com>
+ Unreviewed, rolling out r208584.
+
+ Seems to have regressed Speedometer by 1% on Mac
+
+ Reverted changeset:
+
+ "We should have a more concise way of determining when we're
+ varargs calling a function using rest parameters"
+ https://bugs.webkit.org/show_bug.cgi?id=164258
+ http://trac.webkit.org/changeset/208584
+
+2016-11-11 Chris Dumez <cdumez@apple.com>
+
Unreviewed, rolling out r208117 and r208160.
Regressed Speedometer by >1.5%
diff --git a/Source/JavaScriptCore/DerivedSources.make b/Source/JavaScriptCore/DerivedSources.make
index 569cc1a..b30c305 100644
--- a/Source/JavaScriptCore/DerivedSources.make
+++ b/Source/JavaScriptCore/DerivedSources.make
@@ -99,7 +99,6 @@
$(JavaScriptCore)/builtins/GlobalOperations.js \
$(JavaScriptCore)/builtins/InspectorInstrumentationObject.js \
$(JavaScriptCore)/builtins/InternalPromiseConstructor.js \
- $(JavaScriptCore)/builtins/IteratorHelpers.js \
$(JavaScriptCore)/builtins/IteratorPrototype.js \
$(JavaScriptCore)/builtins/MapPrototype.js \
$(JavaScriptCore)/builtins/ModuleLoaderPrototype.js \
diff --git a/Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj b/Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj
index 14423d3..c73acc5 100644
--- a/Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj
+++ b/Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj
@@ -1256,8 +1256,6 @@
52B310FF1975B4240080857C /* TypeLocationCache.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 52B310FE1975B4240080857C /* TypeLocationCache.cpp */; };
52B311011975B4670080857C /* TypeLocationCache.h in Headers */ = {isa = PBXBuildFile; fileRef = 52B311001975B4670080857C /* TypeLocationCache.h */; settings = {ATTRIBUTES = (Private, ); }; };
52B717B51A0597E1007AF4F3 /* ControlFlowProfiler.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 52B717B41A0597E1007AF4F3 /* ControlFlowProfiler.cpp */; };
- 52B74B4A1DCC04690034157D /* ArrayIteratorAdaptiveWatchpoint.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 52B74B481DCC04690034157D /* ArrayIteratorAdaptiveWatchpoint.cpp */; };
- 52B74B4B1DCC04690034157D /* ArrayIteratorAdaptiveWatchpoint.h in Headers */ = {isa = PBXBuildFile; fileRef = 52B74B491DCC04690034157D /* ArrayIteratorAdaptiveWatchpoint.h */; settings = {ATTRIBUTES = (Private, ); }; };
52C0611F1AA51E1C00B4ADBA /* RuntimeType.h in Headers */ = {isa = PBXBuildFile; fileRef = 52C0611D1AA51E1B00B4ADBA /* RuntimeType.h */; settings = {ATTRIBUTES = (Private, ); }; };
52C952B719A289850069B386 /* TypeProfiler.h in Headers */ = {isa = PBXBuildFile; fileRef = 52C952B619A289850069B386 /* TypeProfiler.h */; settings = {ATTRIBUTES = (Private, ); }; };
52C952B919A28A1C0069B386 /* TypeProfiler.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 52C952B819A28A1C0069B386 /* TypeProfiler.cpp */; };
@@ -1405,8 +1403,6 @@
7964656A1B952FF0003059EE /* GetPutInfo.h in Headers */ = {isa = PBXBuildFile; fileRef = 796465681B952FF0003059EE /* GetPutInfo.h */; settings = {ATTRIBUTES = (Private, ); }; };
797E07A91B8FCFB9008400BA /* JSGlobalLexicalEnvironment.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 797E07A71B8FCFB9008400BA /* JSGlobalLexicalEnvironment.cpp */; };
797E07AA1B8FCFB9008400BA /* JSGlobalLexicalEnvironment.h in Headers */ = {isa = PBXBuildFile; fileRef = 797E07A81B8FCFB9008400BA /* JSGlobalLexicalEnvironment.h */; settings = {ATTRIBUTES = (Private, ); }; };
- 798937781DCAB57300F8D4FB /* JSFixedArray.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 798937761DCAB57300F8D4FB /* JSFixedArray.cpp */; };
- 798937791DCAB57300F8D4FB /* JSFixedArray.h in Headers */ = {isa = PBXBuildFile; fileRef = 798937771DCAB57300F8D4FB /* JSFixedArray.h */; settings = {ATTRIBUTES = (Private, ); }; };
799EF7C41C56ED96002B0534 /* B3PCToOriginMap.h in Headers */ = {isa = PBXBuildFile; fileRef = 799EF7C31C56ED96002B0534 /* B3PCToOriginMap.h */; settings = {ATTRIBUTES = (Private, ); }; };
79A0907F1D768465008B889B /* HashMapImpl.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 79A0907D1D768465008B889B /* HashMapImpl.cpp */; };
79A090801D768465008B889B /* HashMapImpl.h in Headers */ = {isa = PBXBuildFile; fileRef = 79A0907E1D768465008B889B /* HashMapImpl.h */; settings = {ATTRIBUTES = (Private, ); }; };
@@ -1418,7 +1414,6 @@
79B00CBE1C6AB07E0088C65D /* ProxyObject.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 79B00CBA1C6AB07E0088C65D /* ProxyObject.cpp */; settings = {COMPILER_FLAGS = "-fno-optimize-sibling-calls"; }; };
79B00CBF1C6AB07E0088C65D /* ProxyObject.h in Headers */ = {isa = PBXBuildFile; fileRef = 79B00CBB1C6AB07E0088C65D /* ProxyObject.h */; settings = {ATTRIBUTES = (Private, ); }; };
79B1788E1D399B8000B1A567 /* JITMathICForwards.h in Headers */ = {isa = PBXBuildFile; fileRef = 79A899FE1D38612E00D18C73 /* JITMathICForwards.h */; settings = {ATTRIBUTES = (Private, ); }; };
- 79B819931DD25CF500DDC714 /* JSGlobalObjectInlines.h in Headers */ = {isa = PBXBuildFile; fileRef = 79B819921DD25CF500DDC714 /* JSGlobalObjectInlines.h */; settings = {ATTRIBUTES = (Private, ); }; };
79C4B15D1BA2158F00FD592E /* DFGLiveCatchVariablePreservationPhase.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 79C4B15B1BA2158F00FD592E /* DFGLiveCatchVariablePreservationPhase.cpp */; };
79C4B15E1BA2158F00FD592E /* DFGLiveCatchVariablePreservationPhase.h in Headers */ = {isa = PBXBuildFile; fileRef = 79C4B15C1BA2158F00FD592E /* DFGLiveCatchVariablePreservationPhase.h */; settings = {ATTRIBUTES = (Private, ); }; };
79CFC6F01C33B10000C768EA /* LLIntPCRanges.h in Headers */ = {isa = PBXBuildFile; fileRef = 79CFC6EF1C33B10000C768EA /* LLIntPCRanges.h */; settings = {ATTRIBUTES = (Private, ); }; };
@@ -3625,8 +3620,6 @@
52B310FE1975B4240080857C /* TypeLocationCache.cpp */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.cpp.cpp; path = TypeLocationCache.cpp; sourceTree = "<group>"; };
52B311001975B4670080857C /* TypeLocationCache.h */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.c.h; path = TypeLocationCache.h; sourceTree = "<group>"; };
52B717B41A0597E1007AF4F3 /* ControlFlowProfiler.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ControlFlowProfiler.cpp; sourceTree = "<group>"; };
- 52B74B481DCC04690034157D /* ArrayIteratorAdaptiveWatchpoint.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ArrayIteratorAdaptiveWatchpoint.cpp; sourceTree = "<group>"; };
- 52B74B491DCC04690034157D /* ArrayIteratorAdaptiveWatchpoint.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ArrayIteratorAdaptiveWatchpoint.h; sourceTree = "<group>"; };
52C0611D1AA51E1B00B4ADBA /* RuntimeType.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = RuntimeType.h; sourceTree = "<group>"; };
52C952B619A289850069B386 /* TypeProfiler.h */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.c.h; path = TypeProfiler.h; sourceTree = "<group>"; };
52C952B819A28A1C0069B386 /* TypeProfiler.cpp */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.cpp.cpp; path = TypeProfiler.cpp; sourceTree = "<group>"; };
@@ -3816,8 +3809,6 @@
796465681B952FF0003059EE /* GetPutInfo.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = GetPutInfo.h; sourceTree = "<group>"; };
797E07A71B8FCFB9008400BA /* JSGlobalLexicalEnvironment.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSGlobalLexicalEnvironment.cpp; sourceTree = "<group>"; };
797E07A81B8FCFB9008400BA /* JSGlobalLexicalEnvironment.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSGlobalLexicalEnvironment.h; sourceTree = "<group>"; };
- 798937761DCAB57300F8D4FB /* JSFixedArray.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSFixedArray.cpp; sourceTree = "<group>"; };
- 798937771DCAB57300F8D4FB /* JSFixedArray.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSFixedArray.h; sourceTree = "<group>"; };
799EF7C31C56ED96002B0534 /* B3PCToOriginMap.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = B3PCToOriginMap.h; path = b3/B3PCToOriginMap.h; sourceTree = "<group>"; };
79A0907D1D768465008B889B /* HashMapImpl.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = HashMapImpl.cpp; sourceTree = "<group>"; };
79A0907E1D768465008B889B /* HashMapImpl.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = HashMapImpl.h; sourceTree = "<group>"; };
@@ -3829,7 +3820,6 @@
79B00CB91C6AB07E0088C65D /* ProxyConstructor.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ProxyConstructor.h; sourceTree = "<group>"; };
79B00CBA1C6AB07E0088C65D /* ProxyObject.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ProxyObject.cpp; sourceTree = "<group>"; };
79B00CBB1C6AB07E0088C65D /* ProxyObject.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ProxyObject.h; sourceTree = "<group>"; };
- 79B819921DD25CF500DDC714 /* JSGlobalObjectInlines.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSGlobalObjectInlines.h; sourceTree = "<group>"; };
79C4B15B1BA2158F00FD592E /* DFGLiveCatchVariablePreservationPhase.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGLiveCatchVariablePreservationPhase.cpp; path = dfg/DFGLiveCatchVariablePreservationPhase.cpp; sourceTree = "<group>"; };
79C4B15C1BA2158F00FD592E /* DFGLiveCatchVariablePreservationPhase.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGLiveCatchVariablePreservationPhase.h; path = dfg/DFGLiveCatchVariablePreservationPhase.h; sourceTree = "<group>"; };
79CFC6EF1C33B10000C768EA /* LLIntPCRanges.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = LLIntPCRanges.h; path = llint/LLIntPCRanges.h; sourceTree = "<group>"; };
@@ -6055,8 +6045,6 @@
BC7952070E15E8A800A898AB /* ArrayConstructor.h */,
0FB415831D78F98200DF8D09 /* ArrayConventions.cpp */,
0FB7F38915ED8E3800F167B2 /* ArrayConventions.h */,
- 52B74B481DCC04690034157D /* ArrayIteratorAdaptiveWatchpoint.cpp */,
- 52B74B491DCC04690034157D /* ArrayIteratorAdaptiveWatchpoint.h */,
A7BDAEC217F4EA1400F6140C /* ArrayIteratorPrototype.cpp */,
A7BDAEC317F4EA1400F6140C /* ArrayIteratorPrototype.h */,
F692A84D0255597D01FF60F7 /* ArrayPrototype.cpp */,
@@ -6283,8 +6271,6 @@
BC22A39A0E16E14800AF21C8 /* JSEnvironmentRecord.cpp */,
14F252560D08DD8D004ECFFF /* JSEnvironmentRecord.h */,
A7B4ACAE1484C9CE00B38A36 /* JSExportMacros.h */,
- 798937761DCAB57300F8D4FB /* JSFixedArray.cpp */,
- 798937771DCAB57300F8D4FB /* JSFixedArray.h */,
0F2B66C117B6B5AB00A7AE3F /* JSFloat32Array.h */,
0F2B66C217B6B5AB00A7AE3F /* JSFloat64Array.h */,
F692A85E0255597D01FF60F7 /* JSFunction.cpp */,
@@ -6303,7 +6289,6 @@
797E07A81B8FCFB9008400BA /* JSGlobalLexicalEnvironment.h */,
14DE0D680D02431400AACCA2 /* JSGlobalObject.cpp */,
A8E894330CD0603F00367179 /* JSGlobalObject.h */,
- 79B819921DD25CF500DDC714 /* JSGlobalObjectInlines.h */,
A59455901824744700CC3843 /* JSGlobalObjectDebuggable.cpp */,
A59455911824744700CC3843 /* JSGlobalObjectDebuggable.h */,
BC756FC60E2031B200DE7D12 /* JSGlobalObjectFunctions.cpp */,
@@ -8034,7 +8019,6 @@
0F2E892D16D02BAF009E4FD2 /* DFGMinifiedID.h in Headers */,
0F2BDC461522802000CD8910 /* DFGMinifiedNode.h in Headers */,
0F8F14361ADF090100ED792C /* DFGMovHintRemovalPhase.h in Headers */,
- 52B74B4B1DCC04690034157D /* ArrayIteratorAdaptiveWatchpoint.h in Headers */,
AD2FCBEF1DB58DAD00B3E736 /* WebAssemblyCompileErrorPrototype.h in Headers */,
0FF2CD5C1B61A4F8004955A8 /* DFGMultiGetByOffsetData.h in Headers */,
A737810E1799EA2E00817533 /* DFGNaturalLoops.h in Headers */,
@@ -8640,7 +8624,6 @@
142D6F1213539A4100B02E86 /* MarkStack.h in Headers */,
0F2017891DCB942400EA5950 /* DFGNodeAbstractValuePair.h in Headers */,
8612E4CD152389EC00C836BE /* MatchResult.h in Headers */,
- 79B819931DD25CF500DDC714 /* JSGlobalObjectInlines.h in Headers */,
4340A4851A9051AF00D73CCA /* MathCommon.h in Headers */,
BC18C43C0E16F5CD00B34460 /* MathObject.h in Headers */,
14AD91221DCA9FA40014F9FE /* UnlinkedGlobalCodeBlock.h in Headers */,
@@ -8834,7 +8817,6 @@
14AD91271DCA9FA40014F9FE /* UnlinkedFunctionExecutable.h in Headers */,
FE6491371D78F01D00A694D4 /* ExceptionScope.h in Headers */,
2AAAA31218BD49D100394CC8 /* StructureIDBlob.h in Headers */,
- 798937791DCAB57300F8D4FB /* JSFixedArray.h in Headers */,
436E54531C468E7400B5AF73 /* B3LegalizeMemoryOffsets.h in Headers */,
2AF7382D18BBBF92008A5A37 /* StructureIDTable.h in Headers */,
0FD2C92416D01EE900C7803F /* StructureInlines.h in Headers */,
@@ -10158,7 +10140,6 @@
14469DE3107EC7E700650446 /* NumberObject.cpp in Sources */,
14469DE4107EC7E700650446 /* NumberPrototype.cpp in Sources */,
86F3EEBE168CDE930077B92A /* ObjCCallbackFunction.mm in Sources */,
- 798937781DCAB57300F8D4FB /* JSFixedArray.cpp in Sources */,
14469DE5107EC7E700650446 /* ObjectConstructor.cpp in Sources */,
0FD3E4091B618B6600C80E1E /* ObjectPropertyCondition.cpp in Sources */,
0FD3E40B1B618B6600C80E1E /* ObjectPropertyConditionSet.cpp in Sources */,
@@ -10185,7 +10166,6 @@
0F190CAC189D82F6000AE5F0 /* ProfilerJettisonReason.cpp in Sources */,
0FF729B3166AD35C000F5BA3 /* ProfilerOrigin.cpp in Sources */,
0FF729B4166AD35C000F5BA3 /* ProfilerOriginStack.cpp in Sources */,
- 52B74B4A1DCC04690034157D /* ArrayIteratorAdaptiveWatchpoint.cpp in Sources */,
AD2FCBE61DB58DAD00B3E736 /* JSWebAssemblyMemory.cpp in Sources */,
0F9D4C0C1C3E1C11006CD984 /* FTLExceptionTarget.cpp in Sources */,
0FB1058B1675483100F8AB6E /* ProfilerOSRExit.cpp in Sources */,
diff --git a/Source/JavaScriptCore/builtins/IteratorHelpers.js b/Source/JavaScriptCore/builtins/IteratorHelpers.js
deleted file mode 100644
index f565d44..0000000
--- a/Source/JavaScriptCore/builtins/IteratorHelpers.js
+++ /dev/null
@@ -1,46 +0,0 @@
-/*
- * Copyright (C) 2016 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- * notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- * notice, this list of conditions and the following disclaimer in the
- * documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-function performIteration(iterable)
-{
- "use strict";
- // This is performing a spread operation on the iterable passed in,
- // and returning the result in an array.
- // https://tc39.github.io/ecma262/#sec-runtime-semantics-arrayaccumulation
-
- let result = [];
-
- let iterator = iterable.@iteratorSymbol();
- let item;
- let index = 0;
- while (true) {
- item = iterator.next();
- if (!@isObject(item))
- @throwTypeError("Iterator result interface is not an object");
- if (item.done)
- return result;
- @putByValDirect(result, index++, item.value);
- }
-}
diff --git a/Source/JavaScriptCore/bytecode/BytecodeList.json b/Source/JavaScriptCore/bytecode/BytecodeList.json
index fafded7..28467ea 100644
--- a/Source/JavaScriptCore/bytecode/BytecodeList.json
+++ b/Source/JavaScriptCore/bytecode/BytecodeList.json
@@ -16,8 +16,6 @@
{ "name" : "op_new_object", "length" : 4 },
{ "name" : "op_new_array", "length" : 5 },
{ "name" : "op_new_array_with_size", "length" : 4 },
- { "name" : "op_new_array_with_spread", "length" : 5 },
- { "name" : "op_spread", "length" : 3 },
{ "name" : "op_new_array_buffer", "length" : 5 },
{ "name" : "op_new_regexp", "length" : 3 },
{ "name" : "op_mov", "length" : 3 },
diff --git a/Source/JavaScriptCore/bytecode/BytecodeUseDef.h b/Source/JavaScriptCore/bytecode/BytecodeUseDef.h
index 99b9394..9907148 100644
--- a/Source/JavaScriptCore/bytecode/BytecodeUseDef.h
+++ b/Source/JavaScriptCore/bytecode/BytecodeUseDef.h
@@ -161,7 +161,6 @@
functor(codeBlock, instruction, opcodeID, instruction[5].u.operand);
return;
}
- case op_spread:
case op_get_property_enumerator:
case op_get_enumerable_length:
case op_new_func_exp:
@@ -278,7 +277,6 @@
functor(codeBlock, instruction, opcodeID, instruction[3].u.operand);
return;
}
- case op_new_array_with_spread:
case op_new_array:
case op_strcat: {
int base = instruction[2].u.operand;
@@ -386,8 +384,6 @@
case op_to_primitive:
case op_create_this:
case op_new_array:
- case op_new_array_with_spread:
- case op_spread:
case op_new_array_buffer:
case op_new_array_with_size:
case op_new_regexp:
diff --git a/Source/JavaScriptCore/bytecode/CodeBlock.cpp b/Source/JavaScriptCore/bytecode/CodeBlock.cpp
index 30ab028..9e1d919 100644
--- a/Source/JavaScriptCore/bytecode/CodeBlock.cpp
+++ b/Source/JavaScriptCore/bytecode/CodeBlock.cpp
@@ -838,30 +838,6 @@
++it; // Skip array allocation profile.
break;
}
- case op_new_array_with_spread: {
- int dst = (++it)->u.operand;
- int argv = (++it)->u.operand;
- int argc = (++it)->u.operand;
- printLocationAndOp(out, exec, location, it, "new_array_with_spread");
- out.printf("%s, %s, %d, ", registerName(dst).data(), registerName(argv).data(), argc);
- unsigned bitVectorIndex = (++it)->u.unsignedValue;
- const BitVector& bitVector = m_unlinkedCode->bitVector(bitVectorIndex);
- out.print("BitVector:", bitVectorIndex, ":");
- for (unsigned i = 0; i < static_cast<unsigned>(argc); i++) {
- if (bitVector.get(i))
- out.print("1");
- else
- out.print("0");
- }
- break;
- }
- case op_spread: {
- int dst = (++it)->u.operand;
- int arg = (++it)->u.operand;
- printLocationAndOp(out, exec, location, it, "spread");
- out.printf("%s, %s", registerName(dst).data(), registerName(arg).data());
- break;
- }
case op_new_array_with_size: {
int dst = (++it)->u.operand;
int length = (++it)->u.operand;
diff --git a/Source/JavaScriptCore/bytecode/ObjectPropertyConditionSet.cpp b/Source/JavaScriptCore/bytecode/ObjectPropertyConditionSet.cpp
index e2e4a8f..bb1ddd7 100644
--- a/Source/JavaScriptCore/bytecode/ObjectPropertyConditionSet.cpp
+++ b/Source/JavaScriptCore/bytecode/ObjectPropertyConditionSet.cpp
@@ -421,11 +421,5 @@
}, Concurrent);
}
-ObjectPropertyCondition generateConditionForSelfEquivalence(
- VM& vm, JSCell* owner, JSObject* object, UniquedStringImpl* uid)
-{
- return generateCondition(vm, owner, object, uid, PropertyCondition::Equivalence);
-}
-
} // namespace JSC
diff --git a/Source/JavaScriptCore/bytecode/ObjectPropertyConditionSet.h b/Source/JavaScriptCore/bytecode/ObjectPropertyConditionSet.h
index 2b15965..15a3dd8 100644
--- a/Source/JavaScriptCore/bytecode/ObjectPropertyConditionSet.h
+++ b/Source/JavaScriptCore/bytecode/ObjectPropertyConditionSet.h
@@ -156,9 +156,6 @@
RefPtr<Data> m_data;
};
-ObjectPropertyCondition generateConditionForSelfEquivalence(
- VM&, JSCell* owner, JSObject* object, UniquedStringImpl* uid);
-
ObjectPropertyConditionSet generateConditionsForPropertyMiss(
VM&, JSCell* owner, ExecState*, Structure* headStructure, UniquedStringImpl* uid);
ObjectPropertyConditionSet generateConditionsForPropertySetterMiss(
diff --git a/Source/JavaScriptCore/bytecode/TrackedReferences.cpp b/Source/JavaScriptCore/bytecode/TrackedReferences.cpp
index ae213d5..d98fa97 100644
--- a/Source/JavaScriptCore/bytecode/TrackedReferences.cpp
+++ b/Source/JavaScriptCore/bytecode/TrackedReferences.cpp
@@ -59,7 +59,7 @@
if (m_references.contains(cell))
return;
- dataLog("Found untracked reference: ", JSValue(cell), "\n");
+ dataLog("Found untracked reference: ", RawPointer(cell), "\n");
dataLog("All tracked references: ", *this, "\n");
RELEASE_ASSERT_NOT_REACHED();
}
diff --git a/Source/JavaScriptCore/bytecode/UnlinkedCodeBlock.h b/Source/JavaScriptCore/bytecode/UnlinkedCodeBlock.h
index 225c9ae..909ab81 100644
--- a/Source/JavaScriptCore/bytecode/UnlinkedCodeBlock.h
+++ b/Source/JavaScriptCore/bytecode/UnlinkedCodeBlock.h
@@ -40,7 +40,6 @@
#include "UnlinkedFunctionExecutable.h"
#include "VariableEnvironment.h"
#include "VirtualRegister.h"
-#include <wtf/BitVector.h>
#include <wtf/TriState.h>
#include <wtf/Vector.h>
@@ -172,14 +171,6 @@
const Identifier& identifier(int index) const { return m_identifiers[index]; }
const Vector<Identifier>& identifiers() const { return m_identifiers; }
- const Vector<BitVector>& bitVectors() const { return m_bitVectors; }
- BitVector& bitVector(size_t i) { return m_bitVectors[i]; }
- unsigned addBitVector(BitVector&& bitVector)
- {
- m_bitVectors.append(WTFMove(bitVector));
- return m_bitVectors.size() - 1;
- }
-
unsigned addConstant(JSValue v, SourceCodeRepresentation sourceCodeRepresentation = SourceCodeRepresentation::Other)
{
unsigned result = m_constantRegisters.size();
@@ -229,7 +220,6 @@
{
m_jumpTargets.shrinkToFit();
m_identifiers.shrinkToFit();
- m_bitVectors.shrinkToFit();
m_constantRegisters.shrinkToFit();
m_constantsSourceCodeRepresentation.shrinkToFit();
m_functionDecls.shrinkToFit();
@@ -451,7 +441,6 @@
// Constant Pools
Vector<Identifier> m_identifiers;
- Vector<BitVector> m_bitVectors;
Vector<WriteBarrier<Unknown>> m_constantRegisters;
Vector<SourceCodeRepresentation> m_constantsSourceCodeRepresentation;
typedef Vector<WriteBarrier<UnlinkedFunctionExecutable>> FunctionExpressionVector;
diff --git a/Source/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp b/Source/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp
index 69b2539..04e4cab 100644
--- a/Source/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp
+++ b/Source/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp
@@ -52,7 +52,6 @@
#include "UnlinkedInstructionStream.h"
#include "UnlinkedModuleProgramCodeBlock.h"
#include "UnlinkedProgramCodeBlock.h"
-#include <wtf/BitVector.h>
#include <wtf/CommaPrinter.h>
#include <wtf/SmallPtrSet.h>
#include <wtf/StdLibExtras.h>
@@ -3047,49 +3046,6 @@
return dst;
}
-RegisterID* BytecodeGenerator::emitNewArrayWithSpread(RegisterID* dst, ElementNode* elements)
-{
- BitVector bitVector;
- Vector<RefPtr<RegisterID>, 16> argv;
- for (ElementNode* node = elements; node; node = node->next()) {
- bitVector.set(argv.size(), node->value()->isSpreadExpression());
-
- argv.append(newTemporary());
- // op_new_array_with_spread requires the initial values to be a sequential range of registers.
- RELEASE_ASSERT(argv.size() == 1 || argv[argv.size() - 1]->index() == argv[argv.size() - 2]->index() - 1);
- }
-
- RELEASE_ASSERT(argv.size());
-
- {
- unsigned i = 0;
- for (ElementNode* node = elements; node; node = node->next()) {
- if (node->value()->isSpreadExpression()) {
- ExpressionNode* expression = static_cast<SpreadExpressionNode*>(node->value())->expression();
- RefPtr<RegisterID> tmp = newTemporary();
- emitNode(tmp.get(), expression);
-
- emitOpcode(op_spread);
- instructions().append(argv[i].get()->index());
- instructions().append(tmp.get()->index());
- } else {
- ExpressionNode* expression = node->value();
- emitNode(argv[i].get(), expression);
- }
- i++;
- }
- }
-
- unsigned bitVectorIndex = m_codeBlock->addBitVector(WTFMove(bitVector));
- emitOpcode(op_new_array_with_spread);
- instructions().append(dst->index());
- instructions().append(argv[0]->index()); // argv
- instructions().append(argv.size()); // argc
- instructions().append(bitVectorIndex);
-
- return dst;
-}
-
RegisterID* BytecodeGenerator::emitNewArrayWithSize(RegisterID* dst, RegisterID* length)
{
emitOpcode(op_new_array_with_size);
diff --git a/Source/JavaScriptCore/bytecompiler/BytecodeGenerator.h b/Source/JavaScriptCore/bytecompiler/BytecodeGenerator.h
index 721b396..6346118 100644
--- a/Source/JavaScriptCore/bytecompiler/BytecodeGenerator.h
+++ b/Source/JavaScriptCore/bytecompiler/BytecodeGenerator.h
@@ -527,7 +527,6 @@
void liftTDZCheckIfPossible(const Variable&);
RegisterID* emitNewObject(RegisterID* dst);
RegisterID* emitNewArray(RegisterID* dst, ElementNode*, unsigned length); // stops at first elision
- RegisterID* emitNewArrayWithSpread(RegisterID* dst, ElementNode*);
RegisterID* emitNewArrayWithSize(RegisterID* dst, RegisterID* length);
RegisterID* emitNewFunction(RegisterID* dst, FunctionMetadataNode*);
diff --git a/Source/JavaScriptCore/bytecompiler/NodesCodegen.cpp b/Source/JavaScriptCore/bytecompiler/NodesCodegen.cpp
index d3595cf..65c86e8 100644
--- a/Source/JavaScriptCore/bytecompiler/NodesCodegen.cpp
+++ b/Source/JavaScriptCore/bytecompiler/NodesCodegen.cpp
@@ -365,21 +365,6 @@
if (!firstPutElement && !m_elision)
return generator.emitNewArray(generator.finalDestination(dst), m_element, length);
- if (firstPutElement && firstPutElement->value()->isSpreadExpression()) {
- bool hasElision = false;
- for (ElementNode* node = m_element; node; node = node->next()) {
- if (!!node->elision()) {
- hasElision = true;
- break;
- }
- }
- if (!!m_elision)
- hasElision = true;
-
- if (!hasElision)
- return generator.emitNewArrayWithSpread(generator.finalDestination(dst), m_element);
- }
-
RefPtr<RegisterID> array = generator.emitNewArray(generator.tempDestination(dst), m_element, length);
ElementNode* n = firstPutElement;
for (; n; n = n->next()) {
diff --git a/Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h b/Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h
index 8c7e631..03f85bd 100644
--- a/Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h
+++ b/Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h
@@ -1869,27 +1869,6 @@
m_graph,
m_graph.globalObjectFor(node->origin.semantic)->arrayStructureForIndexingTypeDuringAllocation(node->indexingType()));
break;
-
- case NewArrayWithSpread:
- if (m_graph.isWatchingHavingABadTimeWatchpoint(node)) {
- // We've compiled assuming we're not having a bad time, so to be consistent
- // with StructureRegisterationPhase we must say we produce an original array
- // allocation structure.
- forNode(node).set(
- m_graph,
- m_graph.globalObjectFor(node->origin.semantic)->originalArrayStructureForIndexingType(ArrayWithContiguous));
- } else {
- forNode(node).set(
- m_graph,
- m_graph.globalObjectFor(node->origin.semantic)->arrayStructureForIndexingTypeDuringAllocation(ArrayWithContiguous));
- }
-
- break;
-
- case Spread:
- forNode(node).set(
- m_graph, m_graph.m_vm.fixedArrayStructure.get());
- break;
case NewArrayBuffer:
forNode(node).set(
diff --git a/Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp b/Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp
index 39fc9a3..835e499 100644
--- a/Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp
+++ b/Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp
@@ -785,7 +785,7 @@
return addToGraph(result);
}
- Node* addToGraph(Node::VarArgTag, NodeType op, OpInfo info1, OpInfo info2 = OpInfo())
+ Node* addToGraph(Node::VarArgTag, NodeType op, OpInfo info1, OpInfo info2)
{
Node* result = m_graph.addNode(
Node::VarArg, op, currentNodeOrigin(), info1, info2,
@@ -3830,27 +3830,6 @@
set(VirtualRegister(currentInstruction[1].u.operand), addToGraph(Node::VarArg, NewArray, OpInfo(profile->selectIndexingType()), OpInfo(0)));
NEXT_OPCODE(op_new_array);
}
-
- case op_new_array_with_spread: {
- int startOperand = currentInstruction[2].u.operand;
- int numOperands = currentInstruction[3].u.operand;
- const BitVector& bitVector = m_inlineStackTop->m_profiledBlock->unlinkedCodeBlock()->bitVector(currentInstruction[4].u.unsignedValue);
- for (int operandIdx = startOperand; operandIdx > startOperand - numOperands; --operandIdx)
- addVarArgChild(get(VirtualRegister(operandIdx)));
-
- BitVector* copy = m_graph.m_bitVectors.add(bitVector);
- ASSERT(*copy == bitVector);
-
- set(VirtualRegister(currentInstruction[1].u.operand),
- addToGraph(Node::VarArg, NewArrayWithSpread, OpInfo(copy)));
- NEXT_OPCODE(op_new_array_with_spread);
- }
-
- case op_spread: {
- set(VirtualRegister(currentInstruction[1].u.operand),
- addToGraph(Spread, get(VirtualRegister(currentInstruction[2].u.operand))));
- NEXT_OPCODE(op_spread);
- }
case op_new_array_with_size: {
int lengthOperand = currentInstruction[2].u.operand;
diff --git a/Source/JavaScriptCore/dfg/DFGCapabilities.cpp b/Source/JavaScriptCore/dfg/DFGCapabilities.cpp
index bfb7019..6023782 100644
--- a/Source/JavaScriptCore/dfg/DFGCapabilities.cpp
+++ b/Source/JavaScriptCore/dfg/DFGCapabilities.cpp
@@ -198,8 +198,6 @@
case op_new_array:
case op_new_array_with_size:
case op_new_array_buffer:
- case op_new_array_with_spread:
- case op_spread:
case op_strcat:
case op_to_primitive:
case op_throw:
diff --git a/Source/JavaScriptCore/dfg/DFGClobberize.h b/Source/JavaScriptCore/dfg/DFGClobberize.h
index e12dfa8..0e4417b 100644
--- a/Source/JavaScriptCore/dfg/DFGClobberize.h
+++ b/Source/JavaScriptCore/dfg/DFGClobberize.h
@@ -1126,35 +1126,6 @@
write(HeapObjectCount);
return;
- case NewArrayWithSpread: {
- // This also reads from JSFixedArray's data store, but we don't have any way of describing that yet.
- read(HeapObjectCount);
- write(HeapObjectCount);
- return;
- }
-
- case Spread: {
- if (node->child1().useKind() == ArrayUse) {
- // FIXME: We can probably CSE these together, but we need to construct the right rules
- // to prove that nobody writes to child1() in between two Spreads: https://bugs.webkit.org/show_bug.cgi?id=164531
- read(HeapObjectCount);
- read(JSCell_indexingType);
- read(JSObject_butterfly);
- read(Butterfly_publicLength);
- read(IndexedDoubleProperties);
- read(IndexedInt32Properties);
- read(IndexedContiguousProperties);
- read(IndexedArrayStorageProperties);
-
- write(HeapObjectCount);
- return;
- }
-
- read(World);
- write(Heap);
- return;
- }
-
case NewArray: {
read(HeapObjectCount);
write(HeapObjectCount);
diff --git a/Source/JavaScriptCore/dfg/DFGDoesGC.cpp b/Source/JavaScriptCore/dfg/DFGDoesGC.cpp
index 9e853e3..be6b1a4 100644
--- a/Source/JavaScriptCore/dfg/DFGDoesGC.cpp
+++ b/Source/JavaScriptCore/dfg/DFGDoesGC.cpp
@@ -279,8 +279,6 @@
case ArrayifyToStructure:
case NewObject:
case NewArray:
- case NewArrayWithSpread:
- case Spread:
case NewArrayWithSize:
case NewArrayBuffer:
case NewRegexp:
diff --git a/Source/JavaScriptCore/dfg/DFGFixupPhase.cpp b/Source/JavaScriptCore/dfg/DFGFixupPhase.cpp
index cbf7b0e..c3b72cd 100644
--- a/Source/JavaScriptCore/dfg/DFGFixupPhase.cpp
+++ b/Source/JavaScriptCore/dfg/DFGFixupPhase.cpp
@@ -1050,45 +1050,6 @@
fixEdge<KnownStringUse>(node->child1());
break;
}
-
- case NewArrayWithSpread: {
- watchHavingABadTime(node);
-
- BitVector* bitVector = node->bitVector();
- for (unsigned i = node->numChildren(); i--;) {
- if (bitVector->get(i))
- fixEdge<KnownCellUse>(m_graph.m_varArgChildren[node->firstChild() + i]);
- else
- fixEdge<UntypedUse>(m_graph.m_varArgChildren[node->firstChild() + i]);
- }
-
- break;
- }
-
- case Spread: {
- // Note: We care about performing the protocol on our child's global object, not necessarily ours.
-
- watchHavingABadTime(node->child1().node());
-
- JSGlobalObject* globalObject = m_graph.globalObjectFor(node->child1()->origin.semantic);
- // When we go down the fast path, we don't consult the prototype chain, so we must prove
- // that it doesn't contain any indexed properties, and that any holes will result in
- // jsUndefined().
- InlineWatchpointSet& objectPrototypeTransition = globalObject->objectPrototype()->structure()->transitionWatchpointSet();
- InlineWatchpointSet& arrayPrototypeTransition = globalObject->arrayPrototype()->structure()->transitionWatchpointSet();
- if (node->child1()->shouldSpeculateArray()
- && arrayPrototypeTransition.isStillValid()
- && objectPrototypeTransition.isStillValid()
- && globalObject->arrayPrototypeChainIsSane()
- && m_graph.isWatchingArrayIteratorProtocolWatchpoint(node->child1().node())
- && m_graph.isWatchingHavingABadTimeWatchpoint(node->child1().node())) {
- m_graph.watchpoints().addLazily(objectPrototypeTransition);
- m_graph.watchpoints().addLazily(arrayPrototypeTransition);
- fixEdge<ArrayUse>(node->child1());
- } else
- fixEdge<CellUse>(node->child1());
- break;
- }
case NewArray: {
watchHavingABadTime(node);
@@ -1863,10 +1824,8 @@
// optimizing, the code just gets thrown out. Doing this at FixupPhase is just early enough, since
// prior to this point nobody should have been doing optimizations based on the indexing type of
// the allocation.
- if (!globalObject->isHavingABadTime()) {
+ if (!globalObject->isHavingABadTime())
m_graph.watchpoints().addLazily(globalObject->havingABadTimeWatchpoint());
- m_graph.freeze(globalObject);
- }
}
template<UseKind useKind>
diff --git a/Source/JavaScriptCore/dfg/DFGGraph.h b/Source/JavaScriptCore/dfg/DFGGraph.h
index d3047f3..6417b85 100644
--- a/Source/JavaScriptCore/dfg/DFGGraph.h
+++ b/Source/JavaScriptCore/dfg/DFGGraph.h
@@ -665,26 +665,6 @@
JSGlobalObject* globalObject = globalObjectFor(node->origin.semantic);
return watchpoints().isWatched(globalObject->havingABadTimeWatchpoint());
}
-
- bool isWatchingArrayIteratorProtocolWatchpoint(Node* node)
- {
- JSGlobalObject* globalObject = globalObjectFor(node->origin.semantic);
- InlineWatchpointSet& set = globalObject->arrayIteratorProtocolWatchpoint();
- if (watchpoints().isWatched(set))
- return true;
-
- if (set.isStillValid()) {
- // Since the global object owns this watchpoint, we make ourselves have a weak pointer to it.
- // If the global object got deallocated, it wouldn't fire the watchpoint. It's unlikely the
- // global object would get deallocated without this code ever getting thrown away, however,
- // it's more sound logically to depend on the global object lifetime weakly.
- freeze(globalObject);
- watchpoints().addLazily(set);
- return true;
- }
-
- return false;
- }
Profiler::Compilation* compilation() { return m_plan.compilation.get(); }
@@ -923,7 +903,6 @@
Bag<StackAccessData> m_stackAccessData;
Bag<LazyJSValue> m_lazyJSValues;
Bag<CallDOMGetterData> m_callDOMGetterData;
- Bag<BitVector> m_bitVectors;
Vector<InlineVariableData, 4> m_inlineVariableData;
HashMap<CodeBlock*, std::unique_ptr<FullBytecodeLiveness>> m_bytecodeLiveness;
HashMap<CodeBlock*, std::unique_ptr<BytecodeKills>> m_bytecodeKills;
diff --git a/Source/JavaScriptCore/dfg/DFGNode.h b/Source/JavaScriptCore/dfg/DFGNode.h
index 1b21de9..6cdd160 100644
--- a/Source/JavaScriptCore/dfg/DFGNode.h
+++ b/Source/JavaScriptCore/dfg/DFGNode.h
@@ -1061,12 +1061,6 @@
}
}
- BitVector* bitVector()
- {
- ASSERT(op() == NewArrayWithSpread);
- return m_opInfo.as<BitVector*>();
- }
-
// Return the indexing type that an array allocation *wants* to use. It may end up using a different
// type if we're having a bad time. You can determine the actual indexing type by asking the global
// object:
diff --git a/Source/JavaScriptCore/dfg/DFGNodeType.h b/Source/JavaScriptCore/dfg/DFGNodeType.h
index 005af66..d433417 100644
--- a/Source/JavaScriptCore/dfg/DFGNodeType.h
+++ b/Source/JavaScriptCore/dfg/DFGNodeType.h
@@ -290,7 +290,6 @@
/* Allocations. */\
macro(NewObject, NodeResultJS) \
macro(NewArray, NodeResultJS | NodeHasVarArgs) \
- macro(NewArrayWithSpread, NodeResultJS | NodeHasVarArgs) \
macro(NewArrayWithSize, NodeResultJS | NodeMustGenerate) \
macro(NewArrayBuffer, NodeResultJS) \
macro(NewTypedArray, NodeResultJS | NodeMustGenerate) \
@@ -299,7 +298,6 @@
macro(GetRestLength, NodeResultInt32) \
macro(CreateRest, NodeResultJS | NodeMustGenerate) \
\
- macro(Spread, NodeResultJS | NodeMustGenerate) \
/* Support for allocation sinking. */\
macro(PhantomNewObject, NodeResultJS | NodeMustGenerate) \
macro(PutHint, NodeMustGenerate) \
diff --git a/Source/JavaScriptCore/dfg/DFGOperations.cpp b/Source/JavaScriptCore/dfg/DFGOperations.cpp
index dd24b24..e204d3e9 100644
--- a/Source/JavaScriptCore/dfg/DFGOperations.cpp
+++ b/Source/JavaScriptCore/dfg/DFGOperations.cpp
@@ -48,7 +48,6 @@
#include "JIT.h"
#include "JITExceptions.h"
#include "JSCInlines.h"
-#include "JSFixedArray.h"
#include "JSGenericTypedArrayViewConstructorInlines.h"
#include "JSLexicalEnvironment.h"
#include "JSMap.h"
@@ -1881,96 +1880,6 @@
return result;
}
-JSCell* JIT_OPERATION operationNewArrayWithSpreadSlow(ExecState* exec, void* buffer, uint32_t numItems)
-{
- VM& vm = exec->vm();
- NativeCallFrameTracer tracer(&vm, exec);
- auto scope = DECLARE_THROW_SCOPE(vm);
-
- EncodedJSValue* values = static_cast<EncodedJSValue*>(buffer);
- unsigned length = 0;
- for (unsigned i = 0; i < numItems; i++) {
- JSValue value = JSValue::decode(values[i]);
- if (JSFixedArray* array = jsDynamicCast<JSFixedArray*>(value))
- length += array->size();
- else
- ++length;
- }
-
-
- JSGlobalObject* globalObject = exec->lexicalGlobalObject();
- Structure* structure = globalObject->arrayStructureForIndexingTypeDuringAllocation(ArrayWithContiguous);
-
- JSArray* result = JSArray::tryCreateUninitialized(vm, structure, length);
- RETURN_IF_EXCEPTION(scope, nullptr);
-
- unsigned index = 0;
- for (unsigned i = 0; i < numItems; i++) {
- JSValue value = JSValue::decode(values[i]);
- if (JSFixedArray* array = jsDynamicCast<JSFixedArray*>(value)) {
- // We are spreading.
- for (unsigned i = 0; i < array->size(); i++) {
- result->initializeIndex(vm, index, array->get(i));
- ++index;
- }
- } else {
- // We are not spreading.
- result->initializeIndex(vm, index, value);
- ++index;
- }
- }
-
- return result;
-}
-
-JSCell* JIT_OPERATION operationSpreadGeneric(ExecState* exec, JSCell* iterable)
-{
- VM& vm = exec->vm();
- NativeCallFrameTracer tracer(&vm, exec);
-
- auto throwScope = DECLARE_THROW_SCOPE(vm);
-
- JSGlobalObject* globalObject = iterable->structure(vm)->globalObject();
- if (!globalObject)
- globalObject = exec->lexicalGlobalObject();
-
- if (isJSArray(iterable) && globalObject->isArrayIteratorProtocolFastAndNonObservable()) {
- JSArray* array = jsCast<JSArray*>(iterable);
- return JSFixedArray::createFromArray(exec, vm, array);
- }
-
- // FIXME: we can probably make this path faster by having our caller JS code call directly into
- // the iteration protocol builtin: https://bugs.webkit.org/show_bug.cgi?id=164520
-
- JSArray* array;
- {
- JSFunction* iterationFunction = globalObject->iteratorProtocolFunction();
- CallData callData;
- CallType callType = JSC::getCallData(iterationFunction, callData);
- ASSERT(callType != CallType::None);
-
- MarkedArgumentBuffer arguments;
- arguments.append(iterable);
- JSValue arrayResult = call(exec, iterationFunction, callType, callData, jsNull(), arguments);
- RETURN_IF_EXCEPTION(throwScope, nullptr);
- array = jsCast<JSArray*>(arrayResult);
- }
-
- return JSFixedArray::createFromArray(exec, vm, array);
-}
-
-JSCell* JIT_OPERATION operationSpreadFastArray(ExecState* exec, JSCell* cell)
-{
- VM& vm = exec->vm();
- NativeCallFrameTracer tracer(&vm, exec);
-
- ASSERT(isJSArray(cell));
- JSArray* array = jsCast<JSArray*>(cell);
- ASSERT(array->globalObject()->isArrayIteratorProtocolFastAndNonObservable());
-
- return JSFixedArray::createFromArray(exec, vm, array);
-}
-
void JIT_OPERATION operationProcessTypeProfilerLogDFG(ExecState* exec)
{
VM& vm = exec->vm();
diff --git a/Source/JavaScriptCore/dfg/DFGOperations.h b/Source/JavaScriptCore/dfg/DFGOperations.h
index 1d6d1c1..9578cae 100644
--- a/Source/JavaScriptCore/dfg/DFGOperations.h
+++ b/Source/JavaScriptCore/dfg/DFGOperations.h
@@ -188,10 +188,6 @@
int32_t JIT_OPERATION operationHasOwnProperty(ExecState*, JSObject*, EncodedJSValue);
-JSCell* JIT_OPERATION operationSpreadFastArray(ExecState*, JSCell*);
-JSCell* JIT_OPERATION operationSpreadGeneric(ExecState*, JSCell*);
-JSCell* JIT_OPERATION operationNewArrayWithSpreadSlow(ExecState*, void*, uint32_t);
-
JSCell* JIT_OPERATION operationResolveScope(ExecState*, JSScope*, UniquedStringImpl*);
EncodedJSValue JIT_OPERATION operationGetDynamicVar(ExecState*, JSObject* scope, UniquedStringImpl*, unsigned);
void JIT_OPERATION operationPutDynamicVar(ExecState*, JSObject* scope, EncodedJSValue, UniquedStringImpl*, unsigned);
diff --git a/Source/JavaScriptCore/dfg/DFGPredictionPropagationPhase.cpp b/Source/JavaScriptCore/dfg/DFGPredictionPropagationPhase.cpp
index 0907b9f..dc13a1f 100644
--- a/Source/JavaScriptCore/dfg/DFGPredictionPropagationPhase.cpp
+++ b/Source/JavaScriptCore/dfg/DFGPredictionPropagationPhase.cpp
@@ -859,7 +859,6 @@
break;
}
- case NewArrayWithSpread:
case NewArray:
case NewArrayWithSize:
case CreateRest:
@@ -867,10 +866,6 @@
setPrediction(SpecArray);
break;
}
-
- case Spread:
- setPrediction(SpecCellOther);
- break;
case NewTypedArray: {
setPrediction(speculationFromTypedArrayType(m_currentNode->typedArrayType()));
diff --git a/Source/JavaScriptCore/dfg/DFGSafeToExecute.h b/Source/JavaScriptCore/dfg/DFGSafeToExecute.h
index 065e665..9a8444a 100644
--- a/Source/JavaScriptCore/dfg/DFGSafeToExecute.h
+++ b/Source/JavaScriptCore/dfg/DFGSafeToExecute.h
@@ -263,8 +263,6 @@
case NewArray:
case NewArrayWithSize:
case NewArrayBuffer:
- case NewArrayWithSpread:
- case Spread:
case NewRegexp:
case ProfileType:
case ProfileControlFlow:
diff --git a/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp b/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp
index d308b98..b887f32 100644
--- a/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp
+++ b/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp
@@ -52,7 +52,6 @@
#include "JITSubGenerator.h"
#include "JSCInlines.h"
#include "JSEnvironmentRecord.h"
-#include "JSFixedArray.h"
#include "JSGeneratorFunction.h"
#include "JSLexicalEnvironment.h"
#include "LinkBuffer.h"
@@ -60,7 +59,6 @@
#include "ScopedArguments.h"
#include "ScratchRegisterAllocator.h"
#include "WriteBarrierBuffer.h"
-#include <wtf/BitVector.h>
#include <wtf/Box.h>
#include <wtf/MathExtras.h>
@@ -6886,247 +6884,6 @@
cellResult(resultGPR, node);
}
-void SpeculativeJIT::compileSpread(Node* node)
-{
- ASSERT(node->op() == Spread);
-
- SpeculateCellOperand operand(this, node->child1());
- GPRReg argument = operand.gpr();
-
- if (node->child1().useKind() == ArrayUse) {
- // Note: we only speculate on ArrayUse when we've set up the necessary watchpoints
- // to prove that the iteration protocol is non-observable.
- speculateArray(node->child1(), argument);
-
-#if USE(JSVALUE64)
- GPRTemporary result(this);
- GPRTemporary scratch1(this);
- GPRTemporary scratch2(this);
- GPRTemporary length(this);
- FPRTemporary doubleRegister(this);
-
- GPRReg resultGPR = result.gpr();
- GPRReg scratch1GPR = scratch1.gpr();
- GPRReg scratch2GPR = scratch2.gpr();
- GPRReg lengthGPR = length.gpr();
- FPRReg doubleFPR = doubleRegister.fpr();
-
- MacroAssembler::JumpList slowPath;
-
- m_jit.load8(MacroAssembler::Address(argument, JSCell::indexingTypeOffset()), scratch1GPR);
- m_jit.and32(TrustedImm32(IndexingShapeMask), scratch1GPR);
- m_jit.sub32(TrustedImm32(Int32Shape), scratch1GPR);
-
- slowPath.append(m_jit.branch32(MacroAssembler::Above, scratch1GPR, TrustedImm32(ContiguousShape - Int32Shape)));
-
- m_jit.loadPtr(MacroAssembler::Address(argument, JSObject::butterflyOffset()), lengthGPR);
- m_jit.load32(MacroAssembler::Address(lengthGPR, Butterfly::offsetOfPublicLength()), lengthGPR);
- static_assert(sizeof(JSValue) == 8 && 1 << 3 == 8, "This is strongly assumed in the code below.");
- m_jit.move(lengthGPR, scratch1GPR);
- m_jit.lshift32(TrustedImm32(3), scratch1GPR);
- m_jit.add32(TrustedImm32(JSFixedArray::offsetOfData()), scratch1GPR);
-
- m_jit.emitAllocateVariableSizedCell<JSFixedArray>(resultGPR, TrustedImmPtr(m_jit.graph().m_vm.fixedArrayStructure.get()), scratch1GPR, scratch1GPR, scratch2GPR, slowPath);
- m_jit.store32(lengthGPR, MacroAssembler::Address(resultGPR, JSFixedArray::offsetOfSize()));
-
- m_jit.loadPtr(MacroAssembler::Address(argument, JSObject::butterflyOffset()), scratch1GPR);
-
- MacroAssembler::JumpList done;
-
- m_jit.load8(MacroAssembler::Address(argument, JSCell::indexingTypeOffset()), scratch2GPR);
- m_jit.and32(TrustedImm32(IndexingShapeMask), scratch2GPR);
- auto isDoubleArray = m_jit.branch32(MacroAssembler::Equal, scratch2GPR, TrustedImm32(DoubleShape));
-
- {
- done.append(m_jit.branchTest32(MacroAssembler::Zero, lengthGPR));
- auto loopStart = m_jit.label();
- m_jit.sub32(TrustedImm32(1), lengthGPR);
- m_jit.load64(MacroAssembler::BaseIndex(scratch1GPR, lengthGPR, MacroAssembler::TimesEight), scratch2GPR);
- auto notEmpty = m_jit.branchTest64(MacroAssembler::NonZero, scratch2GPR);
- m_jit.move(TrustedImm64(JSValue::encode(jsUndefined())), scratch2GPR);
- notEmpty.link(&m_jit);
- m_jit.store64(scratch2GPR, MacroAssembler::BaseIndex(resultGPR, lengthGPR, MacroAssembler::TimesEight, JSFixedArray::offsetOfData()));
- m_jit.branchTest32(MacroAssembler::NonZero, lengthGPR).linkTo(loopStart, &m_jit);
- done.append(m_jit.jump());
- }
-
- isDoubleArray.link(&m_jit);
- {
-
- done.append(m_jit.branchTest32(MacroAssembler::Zero, lengthGPR));
- auto loopStart = m_jit.label();
- m_jit.sub32(TrustedImm32(1), lengthGPR);
- m_jit.loadDouble(MacroAssembler::BaseIndex(scratch1GPR, lengthGPR, MacroAssembler::TimesEight), doubleFPR);
- auto notEmpty = m_jit.branchDouble(JITCompiler::DoubleEqual, doubleFPR, doubleFPR);
- m_jit.move(TrustedImm64(JSValue::encode(jsUndefined())), scratch2GPR);
- auto doStore = m_jit.jump();
- notEmpty.link(&m_jit);
- m_jit.boxDouble(doubleFPR, scratch2GPR);
- doStore.link(&m_jit);
- m_jit.store64(scratch2GPR, MacroAssembler::BaseIndex(resultGPR, lengthGPR, MacroAssembler::TimesEight, JSFixedArray::offsetOfData()));
- m_jit.branchTest32(MacroAssembler::NonZero, lengthGPR).linkTo(loopStart, &m_jit);
- done.append(m_jit.jump());
- }
-
- slowPath.link(&m_jit);
- addSlowPathGenerator(slowPathCall(m_jit.jump(), this, operationSpreadFastArray, resultGPR, argument));
-
- done.link(&m_jit);
- cellResult(resultGPR, node);
-#else
- flushRegisters();
-
- GPRFlushedCallResult result(this);
- GPRReg resultGPR = result.gpr();
- callOperation(operationSpreadFastArray, resultGPR, argument);
- m_jit.exceptionCheck();
- cellResult(resultGPR, node);
-#endif // USE(JSVALUE64)
- } else {
- flushRegisters();
-
- GPRFlushedCallResult result(this);
- GPRReg resultGPR = result.gpr();
- callOperation(operationSpreadGeneric, resultGPR, argument);
- m_jit.exceptionCheck();
- cellResult(resultGPR, node);
- }
-}
-
-void SpeculativeJIT::compileNewArrayWithSpread(Node* node)
-{
- ASSERT(node->op() == NewArrayWithSpread);
-
-#if USE(JSVALUE64)
- if (m_jit.graph().isWatchingHavingABadTimeWatchpoint(node)) {
- GPRTemporary result(this);
- GPRReg resultGPR = result.gpr();
-
- BitVector* bitVector = node->bitVector();
- {
- unsigned startLength = 0;
- for (unsigned i = 0; i < node->numChildren(); ++i) {
- if (!bitVector->get(i))
- ++startLength;
- }
-
- GPRTemporary length(this);
- GPRReg lengthGPR = length.gpr();
- m_jit.move(TrustedImm32(startLength), lengthGPR);
-
- for (unsigned i = 0; i < node->numChildren(); ++i) {
- if (bitVector->get(i)) {
- Edge use = m_jit.graph().varArgChild(node, i);
- SpeculateCellOperand fixedArray(this, use);
- GPRReg fixedArrayGPR = fixedArray.gpr();
- m_jit.add32(MacroAssembler::Address(fixedArrayGPR, JSFixedArray::offsetOfSize()), lengthGPR);
- }
- }
-
-
- bool shouldAllowForArrayStorageStructureForLargeArrays = false;
- ASSERT(m_jit.graph().globalObjectFor(node->origin.semantic)->restParameterStructure()->indexingType() == ArrayWithContiguous);
- compileAllocateNewArrayWithSize(m_jit.graph().globalObjectFor(node->origin.semantic), resultGPR, lengthGPR, ArrayWithContiguous, shouldAllowForArrayStorageStructureForLargeArrays);
- }
-
- GPRTemporary index(this);
- GPRReg indexGPR = index.gpr();
-
- GPRTemporary storage(this);
- GPRReg storageGPR = storage.gpr();
-
- m_jit.move(TrustedImm32(0), indexGPR);
- m_jit.loadPtr(MacroAssembler::Address(resultGPR, JSObject::butterflyOffset()), storageGPR);
-
- for (unsigned i = 0; i < node->numChildren(); ++i) {
- Edge use = m_jit.graph().varArgChild(node, i);
- if (bitVector->get(i)) {
- SpeculateCellOperand fixedArray(this, use);
- GPRReg fixedArrayGPR = fixedArray.gpr();
-
- GPRTemporary fixedIndex(this);
- GPRReg fixedIndexGPR = fixedIndex.gpr();
-
- GPRTemporary item(this);
- GPRReg itemGPR = item.gpr();
-
- GPRTemporary fixedLength(this);
- GPRReg fixedLengthGPR = fixedLength.gpr();
-
- m_jit.load32(MacroAssembler::Address(fixedArrayGPR, JSFixedArray::offsetOfSize()), fixedLengthGPR);
- m_jit.move(TrustedImm32(0), fixedIndexGPR);
- auto done = m_jit.branchPtr(MacroAssembler::AboveOrEqual, fixedIndexGPR, fixedLengthGPR);
- auto loopStart = m_jit.label();
- m_jit.load64(
- MacroAssembler::BaseIndex(fixedArrayGPR, fixedIndexGPR, MacroAssembler::TimesEight, JSFixedArray::offsetOfData()),
- itemGPR);
-
- m_jit.store64(itemGPR, MacroAssembler::BaseIndex(storageGPR, indexGPR, MacroAssembler::TimesEight));
- m_jit.addPtr(TrustedImm32(1), fixedIndexGPR);
- m_jit.addPtr(TrustedImm32(1), indexGPR);
- m_jit.branchPtr(MacroAssembler::Below, fixedIndexGPR, fixedLengthGPR).linkTo(loopStart, &m_jit);
-
- done.link(&m_jit);
- } else {
- JSValueOperand item(this, use);
- GPRReg itemGPR = item.gpr();
- m_jit.store64(itemGPR, MacroAssembler::BaseIndex(storageGPR, indexGPR, MacroAssembler::TimesEight));
- m_jit.addPtr(TrustedImm32(1), indexGPR);
- }
- }
-
- cellResult(resultGPR, node);
- return;
- }
-#endif // USE(JSVALUE64)
-
- ASSERT(node->numChildren());
- size_t scratchSize = sizeof(EncodedJSValue) * node->numChildren();
- ScratchBuffer* scratchBuffer = m_jit.vm()->scratchBufferForSize(scratchSize);
- EncodedJSValue* buffer = static_cast<EncodedJSValue*>(scratchBuffer->dataBuffer());
-
- BitVector* bitVector = node->bitVector();
- for (unsigned i = 0; i < node->numChildren(); ++i) {
- Edge use = m_jit.graph().m_varArgChildren[node->firstChild() + i];
- if (bitVector->get(i)) {
- SpeculateCellOperand fixedArray(this, use);
- GPRReg arrayGPR = fixedArray.gpr();
-#if USE(JSVALUE64)
- m_jit.store64(arrayGPR, &buffer[i]);
-#else
- char* pointer = static_cast<char*>(static_cast<void*>(&buffer[i]));
- m_jit.store32(arrayGPR, pointer + PayloadOffset);
- m_jit.store32(TrustedImm32(JSValue::CellTag), pointer + TagOffset);
-#endif
- } else {
- JSValueOperand input(this, use);
- JSValueRegs inputRegs = input.jsValueRegs();
- m_jit.storeValue(inputRegs, &buffer[i]);
- }
- }
-
- {
- GPRTemporary scratch(this);
- m_jit.move(TrustedImmPtr(scratchBuffer->activeLengthPtr()), scratch.gpr());
- m_jit.storePtr(TrustedImmPtr(scratchSize), MacroAssembler::Address(scratch.gpr()));
- }
-
- flushRegisters();
-
- GPRFlushedCallResult result(this);
- GPRReg resultGPR = result.gpr();
-
- callOperation(operationNewArrayWithSpreadSlow, resultGPR, buffer, node->numChildren());
- m_jit.exceptionCheck();
- {
- GPRTemporary scratch(this);
- m_jit.move(TrustedImmPtr(scratchBuffer->activeLengthPtr()), scratch.gpr());
- m_jit.storePtr(TrustedImmPtr(0), MacroAssembler::Address(scratch.gpr()));
- }
-
- cellResult(resultGPR, node);
-}
-
void SpeculativeJIT::compileGetRestLength(Node* node)
{
ASSERT(node->op() == GetRestLength);
diff --git a/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h b/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h
index c8c9ef3..18c2880 100644
--- a/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h
+++ b/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h
@@ -960,11 +960,6 @@
m_jit.setupArgumentsWithExecState(old, TrustedImmPtr(size));
return appendCallSetResult(operation, result);
}
- JITCompiler::Call callOperation(C_JITOperation_EPUi operation, GPRReg result, void* arg1, uint32_t arg2)
- {
- m_jit.setupArgumentsWithExecState(TrustedImmPtr(arg1), TrustedImm32(arg2));
- return appendCallSetResult(operation, result);
- }
JITCompiler::Call callOperation(P_JITOperation_ES operation, GPRReg result, size_t size)
{
m_jit.setupArgumentsWithExecState(TrustedImmPtr(size));
@@ -2676,8 +2671,6 @@
void compileCreateScopedArguments(Node*);
void compileCreateClonedArguments(Node*);
void compileCreateRest(Node*);
- void compileSpread(Node*);
- void compileNewArrayWithSpread(Node*);
void compileGetRestLength(Node*);
void compileNotifyWrite(Node*);
bool compileRegExpExec(Node*);
diff --git a/Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp b/Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp
index a4e7c10..a5d24b3 100644
--- a/Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp
+++ b/Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp
@@ -3939,16 +3939,6 @@
break;
}
- case NewArrayWithSpread: {
- compileNewArrayWithSpread(node);
- break;
- }
-
- case Spread: {
- compileSpread(node);
- break;
- }
-
case NewArrayWithSize: {
JSGlobalObject* globalObject = m_jit.graph().globalObjectFor(node->origin.semantic);
if (!globalObject->isHavingABadTime() && !hasAnyArrayStorage(node->indexingType())) {
diff --git a/Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp b/Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp
index c12143a..8d765af 100644
--- a/Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp
+++ b/Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp
@@ -3920,16 +3920,6 @@
cellResult(result.gpr(), node, UseChildrenCalledExplicitly);
break;
}
-
- case NewArrayWithSpread: {
- compileNewArrayWithSpread(node);
- break;
- }
-
- case Spread: {
- compileSpread(node);
- break;
- }
case NewArrayWithSize: {
JSGlobalObject* globalObject = m_jit.graph().globalObjectFor(node->origin.semantic);
diff --git a/Source/JavaScriptCore/dfg/DFGStructureRegistrationPhase.cpp b/Source/JavaScriptCore/dfg/DFGStructureRegistrationPhase.cpp
index bed19f5..86b50dd 100644
--- a/Source/JavaScriptCore/dfg/DFGStructureRegistrationPhase.cpp
+++ b/Source/JavaScriptCore/dfg/DFGStructureRegistrationPhase.cpp
@@ -119,22 +119,6 @@
break;
}
- case NewArrayWithSpread: {
- JSGlobalObject* globalObject = m_graph.globalObjectFor(node->origin.semantic);
- if (m_graph.isWatchingHavingABadTimeWatchpoint(node)) {
- // We've compiled assuming we're not having a bad time, so to be consistent
- // with AI we must say we produce an original array allocation structure.
- registerStructure(globalObject->originalArrayStructureForIndexingType(ArrayWithContiguous));
- } else
- registerStructure(globalObject->arrayStructureForIndexingTypeDuringAllocation(ArrayWithContiguous));
- break;
- }
-
- case Spread: {
- registerStructure(m_graph.m_vm.fixedArrayStructure.get());
- break;
- }
-
case CreateRest: {
if (m_graph.isWatchingHavingABadTimeWatchpoint(node)) {
JSGlobalObject* globalObject = m_graph.globalObjectFor(node->origin.semantic);
diff --git a/Source/JavaScriptCore/ftl/FTLAbstractHeapRepository.h b/Source/JavaScriptCore/ftl/FTLAbstractHeapRepository.h
index bc25ec0..fe6b1c6 100644
--- a/Source/JavaScriptCore/ftl/FTLAbstractHeapRepository.h
+++ b/Source/JavaScriptCore/ftl/FTLAbstractHeapRepository.h
@@ -32,7 +32,6 @@
#include "FTLAbstractHeap.h"
#include "HasOwnPropertyCache.h"
#include "IndexingType.h"
-#include "JSFixedArray.h"
#include "JSMap.h"
#include "JSSet.h"
#include "Symbol.h"
@@ -114,7 +113,6 @@
macro(HashMapBucket_value, HashMapBucket<HashMapBucketDataKeyValue>::offsetOfValue()) \
macro(HashMapBucket_key, HashMapBucket<HashMapBucketDataKeyValue>::offsetOfKey()) \
macro(Symbol_symbolImpl, Symbol::offsetOfSymbolImpl()) \
- macro(JSFixedArray_size, JSFixedArray::offsetOfSize()) \
#define FOR_EACH_INDEXED_ABSTRACT_HEAP(macro) \
macro(DirectArguments_storage, DirectArguments::storageOffset(), sizeof(EncodedJSValue)) \
@@ -135,7 +133,6 @@
macro(structureTable, 0, sizeof(Structure*)) \
macro(variables, 0, sizeof(Register)) \
macro(HasOwnPropertyCache, 0, sizeof(HasOwnPropertyCache::Entry)) \
- macro(JSFixedArray_buffer, JSFixedArray::offsetOfData(), sizeof(EncodedJSValue)) \
#define FOR_EACH_NUMBERED_ABSTRACT_HEAP(macro) \
macro(properties)
diff --git a/Source/JavaScriptCore/ftl/FTLCapabilities.cpp b/Source/JavaScriptCore/ftl/FTLCapabilities.cpp
index bce38a6..d05a9f58 100644
--- a/Source/JavaScriptCore/ftl/FTLCapabilities.cpp
+++ b/Source/JavaScriptCore/ftl/FTLCapabilities.cpp
@@ -71,8 +71,6 @@
case GetButterfly:
case NewObject:
case NewArray:
- case NewArrayWithSpread:
- case Spread:
case NewArrayBuffer:
case NewTypedArray:
case GetByOffset:
diff --git a/Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp b/Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp
index fd8a90b..60e04a0 100644
--- a/Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp
+++ b/Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp
@@ -727,12 +727,6 @@
case NewArray:
compileNewArray();
break;
- case NewArrayWithSpread:
- compileNewArrayWithSpread();
- break;
- case Spread:
- compileSpread();
- break;
case NewArrayBuffer:
compileNewArrayBuffer();
break;
@@ -4302,195 +4296,6 @@
setJSValue(result);
}
-
- void compileNewArrayWithSpread()
- {
- if (m_graph.isWatchingHavingABadTimeWatchpoint(m_node)) {
- unsigned startLength = 0;
- BitVector* bitVector = m_node->bitVector();
- for (unsigned i = 0; i < m_node->numChildren(); ++i) {
- if (!bitVector->get(i))
- ++startLength;
- }
-
- LValue length = m_out.constInt32(startLength);
-
- for (unsigned i = 0; i < m_node->numChildren(); ++i) {
- if (bitVector->get(i)) {
- Edge use = m_graph.varArgChild(m_node, i);
- LValue fixedArray = lowCell(use);
- length = m_out.add(length, m_out.load32(fixedArray, m_heaps.JSFixedArray_size));
- }
- }
-
- Structure* structure = m_graph.globalObjectFor(m_node->origin.semantic)->originalArrayStructureForIndexingType(ArrayWithContiguous);
- ArrayValues arrayValues = allocateUninitializedContiguousJSArray(length, structure);
- LValue result = arrayValues.array;
- LValue storage = arrayValues.butterfly;
- LValue index = m_out.constIntPtr(0);
-
- for (unsigned i = 0; i < m_node->numChildren(); ++i) {
- Edge use = m_graph.varArgChild(m_node, i);
- if (bitVector->get(i)) {
- LBasicBlock loopStart = m_out.newBlock();
- LBasicBlock continuation = m_out.newBlock();
-
- LValue fixedArray = lowCell(use);
-
- ValueFromBlock fixedIndexStart = m_out.anchor(m_out.constIntPtr(0));
- ValueFromBlock arrayIndexStart = m_out.anchor(index);
- ValueFromBlock arrayIndexStartForFinish = m_out.anchor(index);
-
- LValue fixedArraySize = m_out.zeroExtPtr(m_out.load32(fixedArray, m_heaps.JSFixedArray_size));
-
- m_out.branch(
- m_out.isZero64(fixedArraySize),
- unsure(continuation), unsure(loopStart));
-
- LBasicBlock lastNext = m_out.appendTo(loopStart, continuation);
-
- LValue arrayIndex = m_out.phi(pointerType(), arrayIndexStart);
- LValue fixedArrayIndex = m_out.phi(pointerType(), fixedIndexStart);
-
- LValue item = m_out.load64(m_out.baseIndex(m_heaps.JSFixedArray_buffer, fixedArray, fixedArrayIndex));
- m_out.store64(item, m_out.baseIndex(m_heaps.indexedContiguousProperties, storage, arrayIndex));
-
- LValue nextArrayIndex = m_out.add(arrayIndex, m_out.constIntPtr(1));
- LValue nextFixedArrayIndex = m_out.add(fixedArrayIndex, m_out.constIntPtr(1));
- ValueFromBlock arrayIndexLoopForFinish = m_out.anchor(nextArrayIndex);
-
- m_out.addIncomingToPhi(fixedArrayIndex, m_out.anchor(nextFixedArrayIndex));
- m_out.addIncomingToPhi(arrayIndex, m_out.anchor(nextArrayIndex));
-
- m_out.branch(
- m_out.below(nextFixedArrayIndex, fixedArraySize),
- unsure(loopStart), unsure(continuation));
-
- m_out.appendTo(continuation, lastNext);
- index = m_out.phi(pointerType(), arrayIndexStartForFinish, arrayIndexLoopForFinish);
- } else {
- IndexedAbstractHeap& heap = m_heaps.indexedContiguousProperties;
- LValue item = lowJSValue(use);
- m_out.store64(item, m_out.baseIndex(heap, storage, index));
- index = m_out.add(index, m_out.constIntPtr(1));
- }
- }
-
- setJSValue(result);
- return;
- }
-
- ASSERT(m_node->numChildren());
- size_t scratchSize = sizeof(EncodedJSValue) * m_node->numChildren();
- ScratchBuffer* scratchBuffer = vm().scratchBufferForSize(scratchSize);
- EncodedJSValue* buffer = static_cast<EncodedJSValue*>(scratchBuffer->dataBuffer());
- BitVector* bitVector = m_node->bitVector();
- for (unsigned i = 0; i < m_node->numChildren(); ++i) {
- Edge use = m_graph.m_varArgChildren[m_node->firstChild() + i];
- LValue value;
- if (bitVector->get(i))
- value = lowCell(use);
- else
- value = lowJSValue(use);
- m_out.store64(value, m_out.absolute(&buffer[i]));
- }
-
- m_out.storePtr(m_out.constIntPtr(scratchSize), m_out.absolute(scratchBuffer->activeLengthPtr()));
- LValue result = vmCall(Int64, m_out.operation(operationNewArrayWithSpreadSlow), m_callFrame, m_out.constIntPtr(buffer), m_out.constInt32(m_node->numChildren()));
- m_out.storePtr(m_out.constIntPtr(0), m_out.absolute(scratchBuffer->activeLengthPtr()));
-
- setJSValue(result);
- }
-
- void compileSpread()
- {
- LValue argument = lowCell(m_node->child1());
-
- LValue result;
- if (m_node->child1().useKind() == ArrayUse) {
- speculateArray(m_node->child1());
-
- LBasicBlock preLoop = m_out.newBlock();
- LBasicBlock loopSelection = m_out.newBlock();
- LBasicBlock contiguousLoopStart = m_out.newBlock();
- LBasicBlock doubleLoopStart = m_out.newBlock();
- LBasicBlock slowPath = m_out.newBlock();
- LBasicBlock continuation = m_out.newBlock();
-
- LValue indexingShape = m_out.load8ZeroExt32(argument, m_heaps.JSCell_indexingType);
- indexingShape = m_out.bitAnd(indexingShape, m_out.constInt32(IndexingShapeMask));
- LValue isOKIndexingType = m_out.belowOrEqual(
- m_out.sub(indexingShape, m_out.constInt32(Int32Shape)),
- m_out.constInt32(ContiguousShape - Int32Shape));
-
- m_out.branch(isOKIndexingType, unsure(preLoop), unsure(slowPath));
- LBasicBlock lastNext = m_out.appendTo(preLoop, loopSelection);
-
- LValue butterfly = m_out.loadPtr(argument, m_heaps.JSObject_butterfly);
- LValue length = m_out.load32NonNegative(butterfly, m_heaps.Butterfly_publicLength);
- static_assert(sizeof(JSValue) == 8 && 1 << 3 == 8, "Assumed in the code below.");
- LValue size = m_out.add(
- m_out.shl(m_out.zeroExtPtr(length), m_out.constInt32(3)),
- m_out.constIntPtr(JSFixedArray::offsetOfData()));
-
- LValue fastAllocation = allocateVariableSizedCell<JSFixedArray>(size, m_graph.m_vm.fixedArrayStructure.get(), slowPath);
- ValueFromBlock fastResult = m_out.anchor(fastAllocation);
- m_out.store32(length, fastAllocation, m_heaps.JSFixedArray_size);
-
- ValueFromBlock startIndexForContiguous = m_out.anchor(m_out.constIntPtr(0));
- ValueFromBlock startIndexForDouble = m_out.anchor(m_out.constIntPtr(0));
-
- m_out.branch(m_out.isZero32(length), unsure(continuation), unsure(loopSelection));
-
- m_out.appendTo(loopSelection, contiguousLoopStart);
- m_out.branch(m_out.equal(indexingShape, m_out.constInt32(DoubleShape)),
- unsure(doubleLoopStart), unsure(contiguousLoopStart));
-
- {
- m_out.appendTo(contiguousLoopStart, doubleLoopStart);
- LValue index = m_out.phi(pointerType(), startIndexForContiguous);
-
- TypedPointer loadSite = m_out.baseIndex(m_heaps.root, butterfly, index, ScaleEight); // We read TOP here since we can be reading either int32 or contiguous properties.
- LValue value = m_out.load64(loadSite);
- value = m_out.select(m_out.isZero64(value), m_out.constInt64(JSValue::encode(jsUndefined())), value);
- m_out.store64(value, m_out.baseIndex(m_heaps.JSFixedArray_buffer, fastAllocation, index));
-
- LValue nextIndex = m_out.add(index, m_out.constIntPtr(1));
- m_out.addIncomingToPhi(index, m_out.anchor(nextIndex));
-
- m_out.branch(m_out.below(nextIndex, m_out.zeroExtPtr(length)),
- unsure(contiguousLoopStart), unsure(continuation));
- }
-
- {
- m_out.appendTo(doubleLoopStart, slowPath);
- LValue index = m_out.phi(pointerType(), startIndexForDouble);
-
- LValue value = m_out.loadDouble(m_out.baseIndex(m_heaps.indexedDoubleProperties, butterfly, index));
- LValue isNaN = m_out.doubleNotEqualOrUnordered(value, value);
- LValue holeResult = m_out.constInt64(JSValue::encode(jsUndefined()));
- LValue normalResult = boxDouble(value);
- value = m_out.select(isNaN, holeResult, normalResult);
- m_out.store64(value, m_out.baseIndex(m_heaps.JSFixedArray_buffer, fastAllocation, index));
-
- LValue nextIndex = m_out.add(index, m_out.constIntPtr(1));
- m_out.addIncomingToPhi(index, m_out.anchor(nextIndex));
-
- m_out.branch(m_out.below(nextIndex, m_out.zeroExtPtr(length)),
- unsure(doubleLoopStart), unsure(continuation));
- }
-
- m_out.appendTo(slowPath, continuation);
- ValueFromBlock slowResult = m_out.anchor(vmCall(Int64, m_out.operation(operationSpreadFastArray), m_callFrame, argument));
- m_out.jump(continuation);
-
- m_out.appendTo(continuation, lastNext);
- result = m_out.phi(Int64, fastResult, slowResult);
- } else
- result = vmCall(Int64, m_out.operation(operationSpreadGeneric), m_callFrame, argument);
-
- setJSValue(result);
- }
void compileNewArrayBuffer()
{
@@ -9936,15 +9741,6 @@
vm().heap.subspaceForObjectOfType<ClassType>(), size, slowPath);
return allocateObject(allocator, structure, butterfly, slowPath);
}
-
- template<typename ClassType>
- LValue allocateVariableSizedCell(
- LValue size, Structure* structure, LBasicBlock slowPath)
- {
- LValue allocator = allocatorForSize(
- vm().heap.subspaceForObjectOfType<ClassType>(), size, slowPath);
- return allocateCell(allocator, structure, slowPath);
- }
LValue allocateObject(Structure* structure)
{
diff --git a/Source/JavaScriptCore/jit/AssemblyHelpers.h b/Source/JavaScriptCore/jit/AssemblyHelpers.h
index 9672a2b..94d8d3f 100644
--- a/Source/JavaScriptCore/jit/AssemblyHelpers.h
+++ b/Source/JavaScriptCore/jit/AssemblyHelpers.h
@@ -1567,17 +1567,11 @@
}
template<typename ClassType, typename StructureType>
- void emitAllocateVariableSizedCell(GPRReg resultGPR, StructureType structure, GPRReg allocationSize, GPRReg scratchGPR1, GPRReg scratchGPR2, JumpList& slowPath)
+ void emitAllocateVariableSizedJSObject(GPRReg resultGPR, StructureType structure, GPRReg allocationSize, GPRReg scratchGPR1, GPRReg scratchGPR2, JumpList& slowPath)
{
MarkedSpace::Subspace& subspace = vm()->heap.template subspaceForObjectOfType<ClassType>();
emitAllocateVariableSized(resultGPR, subspace, allocationSize, scratchGPR1, scratchGPR2, slowPath);
emitStoreStructureWithTypeInfo(structure, resultGPR, scratchGPR2);
- }
-
- template<typename ClassType, typename StructureType>
- void emitAllocateVariableSizedJSObject(GPRReg resultGPR, StructureType structure, GPRReg allocationSize, GPRReg scratchGPR1, GPRReg scratchGPR2, JumpList& slowPath)
- {
- emitAllocateVariableSizedCell<ClassType>(resultGPR, structure, allocationSize, scratchGPR1, scratchGPR2, slowPath);
storePtr(TrustedImmPtr(0), Address(resultGPR, JSObject::butterflyOffset()));
}
diff --git a/Source/JavaScriptCore/jit/JIT.cpp b/Source/JavaScriptCore/jit/JIT.cpp
index f4c5f29..143927a 100644
--- a/Source/JavaScriptCore/jit/JIT.cpp
+++ b/Source/JavaScriptCore/jit/JIT.cpp
@@ -296,8 +296,6 @@
DEFINE_OP(op_new_array)
DEFINE_OP(op_new_array_with_size)
DEFINE_OP(op_new_array_buffer)
- DEFINE_OP(op_new_array_with_spread)
- DEFINE_OP(op_spread)
DEFINE_OP(op_new_func)
DEFINE_OP(op_new_func_exp)
DEFINE_OP(op_new_generator_func)
diff --git a/Source/JavaScriptCore/jit/JIT.h b/Source/JavaScriptCore/jit/JIT.h
index e6aa023..6b656bc 100644
--- a/Source/JavaScriptCore/jit/JIT.h
+++ b/Source/JavaScriptCore/jit/JIT.h
@@ -541,8 +541,6 @@
void emit_op_new_array(Instruction*);
void emit_op_new_array_with_size(Instruction*);
void emit_op_new_array_buffer(Instruction*);
- void emit_op_new_array_with_spread(Instruction*);
- void emit_op_spread(Instruction*);
void emit_op_new_func(Instruction*);
void emit_op_new_func_exp(Instruction*);
void emit_op_new_generator_func(Instruction*);
diff --git a/Source/JavaScriptCore/jit/JITOpcodes.cpp b/Source/JavaScriptCore/jit/JITOpcodes.cpp
index f32f02a..a3bd888 100644
--- a/Source/JavaScriptCore/jit/JITOpcodes.cpp
+++ b/Source/JavaScriptCore/jit/JITOpcodes.cpp
@@ -1074,18 +1074,6 @@
callOperation(operationNewArrayBufferWithProfile, dst, currentInstruction[4].u.arrayAllocationProfile, values, size);
}
-void JIT::emit_op_new_array_with_spread(Instruction* currentInstruction)
-{
- JITSlowPathCall slowPathCall(this, currentInstruction, slow_path_new_array_with_spread);
- slowPathCall.call();
-}
-
-void JIT::emit_op_spread(Instruction* currentInstruction)
-{
- JITSlowPathCall slowPathCall(this, currentInstruction, slow_path_spread);
- slowPathCall.call();
-}
-
#if USE(JSVALUE64)
void JIT::emit_op_has_structure_property(Instruction* currentInstruction)
{
diff --git a/Source/JavaScriptCore/jit/JITOperations.h b/Source/JavaScriptCore/jit/JITOperations.h
index 590b3c5..af10e97 100644
--- a/Source/JavaScriptCore/jit/JITOperations.h
+++ b/Source/JavaScriptCore/jit/JITOperations.h
@@ -174,7 +174,6 @@
typedef EncodedJSValue (JIT_OPERATION *J_JITOperation_EZSymtabJ)(ExecState*, int32_t, SymbolTable*, EncodedJSValue);
typedef EncodedJSValue (JIT_OPERATION *J_JITOperation_EOIUi)(ExecState*, JSObject*, UniquedStringImpl*, uint32_t);
typedef EncodedJSValue (JIT_OPERATION *J_JITOperation_EJJI)(ExecState*, EncodedJSValue, EncodedJSValue, UniquedStringImpl*);
-typedef JSCell* (JIT_OPERATION *C_JITOperation_EPUi)(ExecState*, void*, uint32_t);
typedef JSCell* (JIT_OPERATION *C_JITOperation_E)(ExecState*);
typedef JSCell* (JIT_OPERATION *C_JITOperation_EZ)(ExecState*, int32_t);
typedef JSCell* (JIT_OPERATION *C_JITOperation_EC)(ExecState*, JSCell*);
diff --git a/Source/JavaScriptCore/llint/LLIntData.cpp b/Source/JavaScriptCore/llint/LLIntData.cpp
index 579d2bb..3a2113a 100644
--- a/Source/JavaScriptCore/llint/LLIntData.cpp
+++ b/Source/JavaScriptCore/llint/LLIntData.cpp
@@ -156,21 +156,21 @@
STATIC_ASSERT(StringType == 6);
STATIC_ASSERT(SymbolType == 7);
- STATIC_ASSERT(ObjectType == 21);
- STATIC_ASSERT(FinalObjectType == 22);
- STATIC_ASSERT(JSFunctionType == 24);
- STATIC_ASSERT(ArrayType == 32);
- STATIC_ASSERT(DerivedArrayType == 33);
- STATIC_ASSERT(ProxyObjectType == 51);
- STATIC_ASSERT(Int8ArrayType == 34);
- STATIC_ASSERT(Int16ArrayType == 35);
- STATIC_ASSERT(Int32ArrayType == 36);
- STATIC_ASSERT(Uint8ArrayType == 37);
- STATIC_ASSERT(Uint8ClampedArrayType == 38);
- STATIC_ASSERT(Uint16ArrayType == 39);
- STATIC_ASSERT(Uint32ArrayType == 40);
- STATIC_ASSERT(Float32ArrayType == 41);
- STATIC_ASSERT(Float64ArrayType == 42);
+ STATIC_ASSERT(ObjectType == 20);
+ STATIC_ASSERT(FinalObjectType == 21);
+ STATIC_ASSERT(JSFunctionType == 23);
+ STATIC_ASSERT(ArrayType == 31);
+ STATIC_ASSERT(DerivedArrayType == 32);
+ STATIC_ASSERT(ProxyObjectType == 50);
+ STATIC_ASSERT(Int8ArrayType == 33);
+ STATIC_ASSERT(Int16ArrayType == 34);
+ STATIC_ASSERT(Int32ArrayType == 35);
+ STATIC_ASSERT(Uint8ArrayType == 36);
+ STATIC_ASSERT(Uint8ClampedArrayType == 37);
+ STATIC_ASSERT(Uint16ArrayType == 38);
+ STATIC_ASSERT(Uint32ArrayType == 39);
+ STATIC_ASSERT(Float32ArrayType == 40);
+ STATIC_ASSERT(Float64ArrayType == 41);
STATIC_ASSERT(MasqueradesAsUndefined == 1);
STATIC_ASSERT(ImplementsDefaultHasInstance == 2);
STATIC_ASSERT(FirstConstantRegisterIndex == 0x40000000);
diff --git a/Source/JavaScriptCore/llint/LLIntSlowPaths.cpp b/Source/JavaScriptCore/llint/LLIntSlowPaths.cpp
index 68ae154..a06225e 100644
--- a/Source/JavaScriptCore/llint/LLIntSlowPaths.cpp
+++ b/Source/JavaScriptCore/llint/LLIntSlowPaths.cpp
@@ -40,14 +40,12 @@
#include "GetterSetter.h"
#include "HostCallReturnValue.h"
#include "Interpreter.h"
-#include "IteratorOperations.h"
#include "JIT.h"
#include "JITExceptions.h"
#include "JITWorklist.h"
#include "JSAsyncFunction.h"
#include "JSCInlines.h"
#include "JSCJSValue.h"
-#include "JSFixedArray.h"
#include "JSGeneratorFunction.h"
#include "JSGlobalObjectFunctions.h"
#include "JSLexicalEnvironment.h"
diff --git a/Source/JavaScriptCore/llint/LowLevelInterpreter.asm b/Source/JavaScriptCore/llint/LowLevelInterpreter.asm
index f40f038..6445a47 100644
--- a/Source/JavaScriptCore/llint/LowLevelInterpreter.asm
+++ b/Source/JavaScriptCore/llint/LowLevelInterpreter.asm
@@ -345,24 +345,24 @@
# Type constants.
const StringType = 6
const SymbolType = 7
-const ObjectType = 21
-const FinalObjectType = 22
-const JSFunctionType = 24
-const ArrayType = 32
-const DerivedArrayType = 33
-const ProxyObjectType = 51
+const ObjectType = 20
+const FinalObjectType = 21
+const JSFunctionType = 23
+const ArrayType = 31
+const DerivedArrayType = 32
+const ProxyObjectType = 50
# The typed array types need to be numbered in a particular order because of the manually written
# switch statement in get_by_val and put_by_val.
-const Int8ArrayType = 34
-const Int16ArrayType = 35
-const Int32ArrayType = 36
-const Uint8ArrayType = 37
-const Uint8ClampedArrayType = 38
-const Uint16ArrayType = 39
-const Uint32ArrayType = 40
-const Float32ArrayType = 41
-const Float64ArrayType = 42
+const Int8ArrayType = 33
+const Int16ArrayType = 34
+const Int32ArrayType = 35
+const Uint8ArrayType = 36
+const Uint8ClampedArrayType = 37
+const Uint16ArrayType = 38
+const Uint32ArrayType = 39
+const Float32ArrayType = 40
+const Float64ArrayType = 41
const FirstArrayType = Int8ArrayType
const LastArrayType = Float64ArrayType
@@ -1333,18 +1333,6 @@
dispatch(5)
-_llint_op_new_array_with_spread:
- traceExecution()
- callOpcodeSlowPath(_slow_path_new_array_with_spread)
- dispatch(5)
-
-
-_llint_op_spread:
- traceExecution()
- callOpcodeSlowPath(_slow_path_spread)
- dispatch(3)
-
-
_llint_op_new_array_with_size:
traceExecution()
callOpcodeSlowPath(_llint_slow_path_new_array_with_size)
diff --git a/Source/JavaScriptCore/runtime/ArrayIteratorAdaptiveWatchpoint.cpp b/Source/JavaScriptCore/runtime/ArrayIteratorAdaptiveWatchpoint.cpp
deleted file mode 100644
index 1fc8a7a..0000000
--- a/Source/JavaScriptCore/runtime/ArrayIteratorAdaptiveWatchpoint.cpp
+++ /dev/null
@@ -1,45 +0,0 @@
-/*
- * Copyright (C) 2016 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- * notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- * notice, this list of conditions and the following disclaimer in the
- * documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include "config.h"
-#include "ArrayIteratorAdaptiveWatchpoint.h"
-
-#include "JSGlobalObject.h"
-
-namespace JSC {
-
-ArrayIteratorAdaptiveWatchpoint::ArrayIteratorAdaptiveWatchpoint(const ObjectPropertyCondition& condition, JSGlobalObject* globalObject)
- : Base(condition)
- , m_globalObject(globalObject)
-{
- RELEASE_ASSERT(m_globalObject->arrayIteratorProtocolWatchpoint().stateOnJSThread() == IsWatched);
-}
-
-void ArrayIteratorAdaptiveWatchpoint::handleFire(const FireDetail&)
-{
- m_globalObject->arrayIteratorProtocolWatchpoint().fireAll(m_globalObject->vm(), StringFireDetail("Array iterator protocol changed."));
-}
-
-} // namespace JSC
diff --git a/Source/JavaScriptCore/runtime/ArrayIteratorAdaptiveWatchpoint.h b/Source/JavaScriptCore/runtime/ArrayIteratorAdaptiveWatchpoint.h
deleted file mode 100644
index a45cce2..0000000
--- a/Source/JavaScriptCore/runtime/ArrayIteratorAdaptiveWatchpoint.h
+++ /dev/null
@@ -1,45 +0,0 @@
-/*
- * Copyright (C) 2016 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- * notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- * notice, this list of conditions and the following disclaimer in the
- * documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#pragma once
-
-#include "AdaptiveInferredPropertyValueWatchpointBase.h"
-
-namespace JSC {
-
-class JSGlobalObject;
-
-class ArrayIteratorAdaptiveWatchpoint : public AdaptiveInferredPropertyValueWatchpointBase {
-public:
- typedef AdaptiveInferredPropertyValueWatchpointBase Base;
- ArrayIteratorAdaptiveWatchpoint(const ObjectPropertyCondition&, JSGlobalObject*);
-
-private:
- void handleFire(const FireDetail&) override;
-
- JSGlobalObject* m_globalObject;
-};
-
-} // namespace JSC
diff --git a/Source/JavaScriptCore/runtime/CommonSlowPaths.cpp b/Source/JavaScriptCore/runtime/CommonSlowPaths.cpp
index 4806a30..9f64da0 100644
--- a/Source/JavaScriptCore/runtime/CommonSlowPaths.cpp
+++ b/Source/JavaScriptCore/runtime/CommonSlowPaths.cpp
@@ -41,11 +41,9 @@
#include "GetterSetter.h"
#include "HostCallReturnValue.h"
#include "Interpreter.h"
-#include "IteratorOperations.h"
#include "JIT.h"
#include "JSCInlines.h"
#include "JSCJSValue.h"
-#include "JSFixedArray.h"
#include "JSGlobalObjectFunctions.h"
#include "JSLexicalEnvironment.h"
#include "JSPropertyNameEnumerator.h"
@@ -978,83 +976,4 @@
THROW(createError(exec, errorType, errorMessage));
}
-SLOW_PATH_DECL(slow_path_new_array_with_spread)
-{
- BEGIN();
- int numItems = pc[3].u.operand;
- ASSERT(numItems >= 0);
- const BitVector& bitVector = exec->codeBlock()->unlinkedCodeBlock()->bitVector(pc[4].u.unsignedValue);
-
- JSValue* values = bitwise_cast<JSValue*>(&OP(2));
-
- unsigned arraySize = 0;
- for (int i = 0; i < numItems; i++) {
- if (bitVector.get(i)) {
- JSValue value = values[-i];
- JSFixedArray* array = jsCast<JSFixedArray*>(value);
- arraySize += array->size();
- } else
- arraySize += 1;
- }
-
- JSGlobalObject* globalObject = exec->lexicalGlobalObject();
- Structure* structure = globalObject->arrayStructureForIndexingTypeDuringAllocation(ArrayWithContiguous);
-
- JSArray* result = JSArray::tryCreateUninitialized(vm, structure, arraySize);
- CHECK_EXCEPTION();
-
- unsigned index = 0;
- for (int i = 0; i < numItems; i++) {
- JSValue value = values[-i];
- if (bitVector.get(i)) {
- // We are spreading.
- JSFixedArray* array = jsCast<JSFixedArray*>(value);
- for (unsigned i = 0; i < array->size(); i++) {
- RELEASE_ASSERT(array->get(i));
- result->initializeIndex(vm, index, array->get(i));
- ++index;
- }
- } else {
- // We are not spreading.
- result->initializeIndex(vm, index, value);
- ++index;
- }
- }
-
- RETURN(result);
-}
-
-SLOW_PATH_DECL(slow_path_spread)
-{
- BEGIN();
-
- JSValue iterable = OP_C(2).jsValue();
-
- JSGlobalObject* globalObject = exec->lexicalGlobalObject();
-
- if (iterable.isCell() && isJSArray(iterable.asCell()) && globalObject->isArrayIteratorProtocolFastAndNonObservable()) {
- // JSFixedArray::createFromArray does not consult the prototype chain,
- // so we must be sure that not consulting the prototype chain would
- // produce the same value during iteration.
- JSArray* array = jsCast<JSArray*>(iterable);
- RETURN(JSFixedArray::createFromArray(exec, vm, array));
- }
-
- JSArray* array;
- {
- JSFunction* iterationFunction = globalObject->iteratorProtocolFunction();
- CallData callData;
- CallType callType = JSC::getCallData(iterationFunction, callData);
- ASSERT(callType != CallType::None);
-
- MarkedArgumentBuffer arguments;
- arguments.append(iterable);
- JSValue arrayResult = call(exec, iterationFunction, callType, callData, jsNull(), arguments);
- CHECK_EXCEPTION();
- array = jsCast<JSArray*>(arrayResult);
- }
-
- RETURN(JSFixedArray::createFromArray(exec, vm, array));
-}
-
} // namespace JSC
diff --git a/Source/JavaScriptCore/runtime/CommonSlowPaths.h b/Source/JavaScriptCore/runtime/CommonSlowPaths.h
index 9eed6f1..934017c 100644
--- a/Source/JavaScriptCore/runtime/CommonSlowPaths.h
+++ b/Source/JavaScriptCore/runtime/CommonSlowPaths.h
@@ -260,7 +260,5 @@
SLOW_PATH_HIDDEN_DECL(slow_path_define_data_property);
SLOW_PATH_HIDDEN_DECL(slow_path_define_accessor_property);
SLOW_PATH_HIDDEN_DECL(slow_path_throw_static_error);
-SLOW_PATH_HIDDEN_DECL(slow_path_new_array_with_spread);
-SLOW_PATH_HIDDEN_DECL(slow_path_spread);
} // namespace JSC
diff --git a/Source/JavaScriptCore/runtime/IteratorOperations.h b/Source/JavaScriptCore/runtime/IteratorOperations.h
index 7ac9a02..614ad79 100644
--- a/Source/JavaScriptCore/runtime/IteratorOperations.h
+++ b/Source/JavaScriptCore/runtime/IteratorOperations.h
@@ -45,24 +45,24 @@
JS_EXPORT_PRIVATE JSValue iteratorForIterable(ExecState*, JSValue iterable);
template <typename CallBackType>
-void forEachInIterable(ExecState* exec, JSValue iterable, const CallBackType& callback)
+void forEachInIterable(ExecState* state, JSValue iterable, const CallBackType& callback)
{
- auto& vm = exec->vm();
+ auto& vm = state->vm();
auto scope = DECLARE_THROW_SCOPE(vm);
- JSValue iterator = iteratorForIterable(exec, iterable);
+ JSValue iterator = iteratorForIterable(state, iterable);
RETURN_IF_EXCEPTION(scope, void());
while (true) {
- JSValue next = iteratorStep(exec, iterator);
+ JSValue next = iteratorStep(state, iterator);
if (next.isFalse() || UNLIKELY(scope.exception()))
return;
- JSValue nextValue = iteratorValue(exec, next);
+ JSValue nextValue = iteratorValue(state, next);
RETURN_IF_EXCEPTION(scope, void());
- callback(vm, exec, nextValue);
+ callback(vm, state, nextValue);
if (UNLIKELY(scope.exception())) {
- iteratorClose(exec, iterator);
+ iteratorClose(state, iterator);
return;
}
}
diff --git a/Source/JavaScriptCore/runtime/JSCInlines.h b/Source/JavaScriptCore/runtime/JSCInlines.h
index cb3db3d..a0104bb 100644
--- a/Source/JavaScriptCore/runtime/JSCInlines.h
+++ b/Source/JavaScriptCore/runtime/JSCInlines.h
@@ -43,7 +43,6 @@
#include "JSArrayBufferViewInlines.h"
#include "JSCJSValueInlines.h"
#include "JSFunctionInlines.h"
-#include "JSGlobalObjectInlines.h"
#include "JSObjectInlines.h"
#include "JSProxy.h"
#include "JSString.h"
diff --git a/Source/JavaScriptCore/runtime/JSFixedArray.cpp b/Source/JavaScriptCore/runtime/JSFixedArray.cpp
deleted file mode 100644
index 15d3e23..0000000
--- a/Source/JavaScriptCore/runtime/JSFixedArray.cpp
+++ /dev/null
@@ -1,43 +0,0 @@
-/*
- * Copyright (C) 2016 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- * notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- * notice, this list of conditions and the following disclaimer in the
- * documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include "config.h"
-#include "JSFixedArray.h"
-
-#include "JSCInlines.h"
-
-namespace JSC {
-
-const ClassInfo JSFixedArray::s_info = { "JSFixedArray", nullptr, nullptr, CREATE_METHOD_TABLE(JSFixedArray) };
-
-void JSFixedArray::visitChildren(JSCell* cell, SlotVisitor& visitor)
-{
- JSFixedArray* thisObject = jsCast<JSFixedArray*>(cell);
- ASSERT_GC_OBJECT_INHERITS(thisObject, info());
- Base::visitChildren(thisObject, visitor);
- visitor.appendValuesHidden(thisObject->buffer(), thisObject->size());
-}
-
-} // namespace JSC
diff --git a/Source/JavaScriptCore/runtime/JSFixedArray.h b/Source/JavaScriptCore/runtime/JSFixedArray.h
deleted file mode 100644
index cdb1ff1..0000000
--- a/Source/JavaScriptCore/runtime/JSFixedArray.h
+++ /dev/null
@@ -1,136 +0,0 @@
-/*
- * Copyright (C) 2016 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- * notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- * notice, this list of conditions and the following disclaimer in the
- * documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#pragma once
-
-#include "JSGlobalObject.h"
-#include "JSObject.h"
-
-namespace JSC {
-
-class JSFixedArray : public JSCell {
- typedef JSCell Base;
-
-public:
- static const unsigned StructureFlags = Base::StructureFlags | StructureIsImmortal;
-
- DECLARE_INFO;
-
- static Structure* createStructure(VM& vm, JSGlobalObject* globalObject, JSValue prototype)
- {
- return Structure::create(vm, globalObject, prototype, TypeInfo(JSFixedArrayType, StructureFlags), info());
- }
-
- ALWAYS_INLINE static JSFixedArray* createFromArray(ExecState* exec, VM& vm, JSArray* array)
- {
- IndexingType indexingType = array->indexingType() & IndexingShapeMask;
- unsigned length = array->length();
- JSFixedArray* result = JSFixedArray::create(vm, vm.fixedArrayStructure.get(), length);
-
- if (!length)
- return result;
-
- if (indexingType == ContiguousShape || indexingType == Int32Shape) {
- for (unsigned i = 0; i < length; i++) {
- JSValue value = array->butterfly()->contiguous()[i].get();
- value = !!value ? value : jsUndefined();
- result->buffer()[i].set(vm, result, value);
- }
- return result;
- }
-
- if (indexingType == DoubleShape) {
- for (unsigned i = 0; i < length; i++) {
- double d = array->butterfly()->contiguousDouble()[i];
- JSValue value = std::isnan(d) ? jsUndefined() : JSValue(JSValue::EncodeAsDouble, d);
- result->buffer()[i].set(vm, result, value);
- }
- return result;
- }
-
-
- auto throwScope = DECLARE_THROW_SCOPE(vm);
- for (unsigned i = 0; i < length; i++) {
- JSValue value = array->getDirectIndex(exec, i);
- if (!value) {
- // When we see a hole, we assume that it's safe to assume the get would have returned undefined.
- // We may still call into this function when !globalObject->isArrayIteratorProtocolFastAndNonObservable(),
- // however, if we do that, we ensure we're calling in with an array with all self properties between
- // [0, length).
- ASSERT(array->globalObject()->isArrayIteratorProtocolFastAndNonObservable());
- value = jsUndefined();
- }
- RETURN_IF_EXCEPTION(throwScope, nullptr);
- result->buffer()[i].set(vm, result, value);
- }
- return result;
- }
-
- ALWAYS_INLINE JSValue get(unsigned index)
- {
- ASSERT(index < m_size);
- return buffer()[index].get();
- }
-
- ALWAYS_INLINE WriteBarrier<Unknown>* buffer() { return bitwise_cast<WriteBarrier<Unknown>*>(bitwise_cast<char*>(this) + offsetOfData()); }
-
- static void visitChildren(JSCell*, SlotVisitor&);
-
- unsigned size() const { return m_size; }
-
- static size_t offsetOfSize() { return OBJECT_OFFSETOF(JSFixedArray, m_size); }
-
- static size_t offsetOfData()
- {
- return WTF::roundUpToMultipleOf<sizeof(WriteBarrier<Unknown>)>(sizeof(JSFixedArray));
- }
-
-private:
- unsigned m_size;
-
- ALWAYS_INLINE static JSFixedArray* create(VM& vm, Structure* structure, unsigned size)
- {
- JSFixedArray* result = new (NotNull, allocateCell<JSFixedArray>(vm.heap, allocationSize(size))) JSFixedArray(vm, structure, size);
- result->finishCreation(vm);
- return result;
- }
-
-
- JSFixedArray(VM& vm, Structure* structure, unsigned size)
- : Base(vm, structure)
- , m_size(size)
- {
- for (unsigned i = 0; i < m_size; i++)
- buffer()[i].setStartingValue(JSValue());
- }
-
-
- static size_t allocationSize(unsigned numItems)
- {
- return offsetOfData() + numItems * sizeof(WriteBarrier<Unknown>);
- }
-};
-
-} // namespace JSC
diff --git a/Source/JavaScriptCore/runtime/JSGlobalObject.cpp b/Source/JavaScriptCore/runtime/JSGlobalObject.cpp
index 8aa6c11..e9c9876 100644
--- a/Source/JavaScriptCore/runtime/JSGlobalObject.cpp
+++ b/Source/JavaScriptCore/runtime/JSGlobalObject.cpp
@@ -31,7 +31,6 @@
#include "JSGlobalObject.h"
#include "ArrayConstructor.h"
-#include "ArrayIteratorAdaptiveWatchpoint.h"
#include "ArrayIteratorPrototype.h"
#include "ArrayPrototype.h"
#include "AtomicsObject.h"
@@ -78,7 +77,6 @@
#include "JSDataViewPrototype.h"
#include "JSDollarVM.h"
#include "JSDollarVMPrototype.h"
-#include "JSFixedArray.h"
#include "JSFunction.h"
#include "JSGeneratorFunction.h"
#include "JSGenericTypedArrayViewConstructorInlines.h"
@@ -134,7 +132,6 @@
#include "NumberPrototype.h"
#include "ObjCCallbackFunction.h"
#include "ObjectConstructor.h"
-#include "ObjectPropertyConditionSet.h"
#include "ObjectPrototype.h"
#include "ParserError.h"
#include "ProxyConstructor.h"
@@ -316,7 +313,6 @@
, m_havingABadTimeWatchpoint(adoptRef(new WatchpointSet(IsWatched)))
, m_varInjectionWatchpoint(adoptRef(new WatchpointSet(IsWatched)))
, m_weakRandom(Options::forceWeakRandomSeed() ? Options::forcedWeakRandomSeed() : static_cast<unsigned>(randomNumber() * (std::numeric_limits<unsigned>::max() + 1.0)))
- , m_arrayIteratorProtocolWatchpoint(IsWatched)
, m_templateRegistry(vm)
, m_evalEnabled(true)
, m_runtimeFlags()
@@ -415,12 +411,6 @@
[] (const Initializer<JSFunction>& init) {
init.set(JSFunction::createBuiltinFunction(init.vm, promiseOperationsInitializePromiseCodeGenerator(init.vm), init.owner));
});
-
- m_iteratorProtocolFunction.initLater(
- [] (const Initializer<JSFunction>& init) {
- init.set(JSFunction::createBuiltinFunction(init.vm, iteratorHelpersPerformIterationCodeGenerator(init.vm), init.owner));
- });
-
m_newPromiseCapabilityFunction.set(vm, this, JSFunction::createBuiltinFunction(vm, promiseOperationsNewPromiseCapabilityCodeGenerator(vm), this));
m_functionProtoHasInstanceSymbolFunction.set(vm, this, hasInstanceSymbolFunction);
m_throwTypeErrorGetterSetter.initLater(
@@ -764,6 +754,7 @@
JSObject* arrayIteratorPrototype = ArrayIteratorPrototype::create(vm, this, ArrayIteratorPrototype::createStructure(vm, this, m_iteratorPrototype.get()));
createArrayIteratorPrivateFunction->putDirect(vm, vm.propertyNames->prototype, arrayIteratorPrototype);
+
GlobalPropertyInfo staticGlobals[] = {
#define INIT_PRIVATE_GLOBAL(name, code) GlobalPropertyInfo(vm.propertyNames->builtinNames().name ## PrivateName(), name ## PrivateFunction, DontEnum | DontDelete | ReadOnly),
JSC_FOREACH_BUILTIN_FUNCTION_PRIVATE_GLOBAL_NAME(INIT_PRIVATE_GLOBAL)
@@ -895,44 +886,6 @@
}
#endif // ENABLE(WEBASSEMBLY)
- {
- ExecState* exec = globalExec();
- auto scope = DECLARE_THROW_SCOPE(vm);
-
- auto setupAdaptiveWatchpoint = [&] (JSObject* base, const Identifier& ident) -> ObjectPropertyCondition {
- // Performing these gets should not throw.
- PropertySlot slot(base, PropertySlot::InternalMethodType::Get);
- bool result = base->getOwnPropertySlot(base, exec, ident, slot);
- ASSERT_UNUSED(result, result);
- ASSERT_UNUSED(scope, !scope.exception());
- RELEASE_ASSERT(slot.isCacheableValue());
- JSValue functionValue = slot.getValue(exec, ident);
- ASSERT_UNUSED(scope, !scope.exception());
- ASSERT(jsDynamicCast<JSFunction*>(functionValue));
-
- ObjectPropertyCondition condition = generateConditionForSelfEquivalence(m_vm, nullptr, base, ident.impl());
- RELEASE_ASSERT(condition.requiredValue() == functionValue);
-
- bool isWatchable = condition.isWatchable(PropertyCondition::EnsureWatchability);
- RELEASE_ASSERT(isWatchable); // We allow this to install the necessary watchpoints.
-
- return condition;
- };
-
- {
- ObjectPropertyCondition condition = setupAdaptiveWatchpoint(arrayIteratorPrototype, m_vm.propertyNames->next);
- m_arrayIteratorPrototypeNext = std::make_unique<ArrayIteratorAdaptiveWatchpoint>(condition, this);
- m_arrayIteratorPrototypeNext->install();
- }
-
- {
- ArrayPrototype* arrayPrototype = this->arrayPrototype();
- ObjectPropertyCondition condition = setupAdaptiveWatchpoint(arrayPrototype, m_vm.propertyNames->iteratorSymbol);
- m_arrayPrototypeSymbolIteratorWatchpoint = std::make_unique<ArrayIteratorAdaptiveWatchpoint>(condition, this);
- m_arrayPrototypeSymbolIteratorWatchpoint->install();
- }
- }
-
resetPrototype(vm, getPrototypeDirect());
}
@@ -1120,6 +1073,26 @@
}
}
+bool JSGlobalObject::objectPrototypeIsSane()
+{
+ return !hasIndexedProperties(m_objectPrototype->indexingType())
+ && m_objectPrototype->getPrototypeDirect().isNull();
+}
+
+bool JSGlobalObject::arrayPrototypeChainIsSane()
+{
+ return !hasIndexedProperties(m_arrayPrototype->indexingType())
+ && m_arrayPrototype->getPrototypeDirect() == m_objectPrototype.get()
+ && objectPrototypeIsSane();
+}
+
+bool JSGlobalObject::stringPrototypeChainIsSane()
+{
+ return !hasIndexedProperties(m_stringPrototype->indexingType())
+ && m_stringPrototype->getPrototypeDirect() == m_objectPrototype.get()
+ && objectPrototypeIsSane();
+}
+
// Set prototype, and also insert the object prototype at the end of the chain.
void JSGlobalObject::resetPrototype(VM& vm, JSValue prototype)
{
@@ -1169,7 +1142,6 @@
thisObject->m_arrayProtoToStringFunction.visit(visitor);
thisObject->m_arrayProtoValuesFunction.visit(visitor);
thisObject->m_initializePromiseFunction.visit(visitor);
- thisObject->m_iteratorProtocolFunction.visit(visitor);
visitor.append(&thisObject->m_newPromiseCapabilityFunction);
visitor.append(&thisObject->m_functionProtoHasInstanceSymbolFunction);
thisObject->m_throwTypeErrorGetterSetter.visit(visitor);
diff --git a/Source/JavaScriptCore/runtime/JSGlobalObject.h b/Source/JavaScriptCore/runtime/JSGlobalObject.h
index 6b1bff8..324bffb 100644
--- a/Source/JavaScriptCore/runtime/JSGlobalObject.h
+++ b/Source/JavaScriptCore/runtime/JSGlobalObject.h
@@ -54,9 +54,9 @@
}
namespace JSC {
+
class ArrayConstructor;
class ArrayPrototype;
-class ArrayIteratorAdaptiveWatchpoint;
class AsyncFunctionPrototype;
class BooleanPrototype;
class ConsoleClient;
@@ -259,7 +259,6 @@
LazyProperty<JSGlobalObject, JSFunction> m_arrayProtoToStringFunction;
LazyProperty<JSGlobalObject, JSFunction> m_arrayProtoValuesFunction;
LazyProperty<JSGlobalObject, JSFunction> m_initializePromiseFunction;
- LazyProperty<JSGlobalObject, JSFunction> m_iteratorProtocolFunction;
WriteBarrier<JSFunction> m_newPromiseCapabilityFunction;
WriteBarrier<JSFunction> m_functionProtoHasInstanceSymbolFunction;
LazyProperty<JSGlobalObject, GetterSetter> m_throwTypeErrorGetterSetter;
@@ -396,15 +395,6 @@
WeakRandom m_weakRandom;
- InlineWatchpointSet& arrayIteratorProtocolWatchpoint() { return m_arrayIteratorProtocolWatchpoint; }
- // If this hasn't been invalidated, it means the array iterator protocol
- // is not observable to user code yet.
- InlineWatchpointSet m_arrayIteratorProtocolWatchpoint;
- std::unique_ptr<ArrayIteratorAdaptiveWatchpoint> m_arrayPrototypeSymbolIteratorWatchpoint;
- std::unique_ptr<ArrayIteratorAdaptiveWatchpoint> m_arrayIteratorPrototypeNext;
-
- bool isArrayIteratorProtocolFastAndNonObservable();
-
TemplateRegistry m_templateRegistry;
bool m_evalEnabled;
@@ -523,7 +513,6 @@
JSFunction* arrayProtoToStringFunction() const { return m_arrayProtoToStringFunction.get(this); }
JSFunction* arrayProtoValuesFunction() const { return m_arrayProtoValuesFunction.get(this); }
JSFunction* initializePromiseFunction() const { return m_initializePromiseFunction.get(this); }
- JSFunction* iteratorProtocolFunction() const { return m_iteratorProtocolFunction.get(this); }
JSFunction* newPromiseCapabilityFunction() const { return m_newPromiseCapabilityFunction.get(); }
JSFunction* functionProtoHasInstanceSymbolFunction() const { return m_functionProtoHasInstanceSymbolFunction.get(); }
JSObject* regExpProtoExecFunction() const { return m_regExpProtoExec.get(); }
diff --git a/Source/JavaScriptCore/runtime/JSGlobalObjectInlines.h b/Source/JavaScriptCore/runtime/JSGlobalObjectInlines.h
deleted file mode 100644
index 7e334eb..0000000
--- a/Source/JavaScriptCore/runtime/JSGlobalObjectInlines.h
+++ /dev/null
@@ -1,69 +0,0 @@
-/*
- * Copyright (C) 2016 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- * notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- * notice, this list of conditions and the following disclaimer in the
- * documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#pragma once
-
-#include "JSGlobalObject.h"
-
-#include "ArrayPrototype.h"
-#include "ObjectPrototype.h"
-
-namespace JSC {
-
-ALWAYS_INLINE bool JSGlobalObject::objectPrototypeIsSane()
-{
- return !hasIndexedProperties(m_objectPrototype->indexingType())
- && m_objectPrototype->getPrototypeDirect().isNull();
-}
-
-ALWAYS_INLINE bool JSGlobalObject::arrayPrototypeChainIsSane()
-{
- return !hasIndexedProperties(m_arrayPrototype->indexingType())
- && m_arrayPrototype->getPrototypeDirect() == m_objectPrototype.get()
- && objectPrototypeIsSane();
-}
-
-ALWAYS_INLINE bool JSGlobalObject::stringPrototypeChainIsSane()
-{
- return !hasIndexedProperties(m_stringPrototype->indexingType())
- && m_stringPrototype->getPrototypeDirect() == m_objectPrototype.get()
- && objectPrototypeIsSane();
-}
-
-
-ALWAYS_INLINE bool JSGlobalObject::isArrayIteratorProtocolFastAndNonObservable()
-{
- // We're fast if we don't have any indexed properties on the prototype.
- // We're non-observable if the iteration protocol hasn't changed.
- //
- // Note: it only makes sense to call this from the main thread. If you're
- // trying to prove this behavior on the compiler thread, you'll want to
- // carefully set up watchpoints to have correct ordering while JS code is
- // executing concurrently.
-
- return arrayIteratorProtocolWatchpoint().isStillValid() && !isHavingABadTime() && arrayPrototypeChainIsSane();
-}
-
-} // namespace JSC
diff --git a/Source/JavaScriptCore/runtime/JSType.h b/Source/JavaScriptCore/runtime/JSType.h
index 05202f3..f8bb7af 100644
--- a/Source/JavaScriptCore/runtime/JSType.h
+++ b/Source/JavaScriptCore/runtime/JSType.h
@@ -49,8 +49,6 @@
UnlinkedEvalCodeBlockType,
UnlinkedFunctionCodeBlockType,
- JSFixedArrayType,
-
// The ObjectType value must come before any JSType that is a subclass of JSObject.
ObjectType,
FinalObjectType,
diff --git a/Source/JavaScriptCore/runtime/VM.cpp b/Source/JavaScriptCore/runtime/VM.cpp
index 34e8b95..7a2f0f2 100644
--- a/Source/JavaScriptCore/runtime/VM.cpp
+++ b/Source/JavaScriptCore/runtime/VM.cpp
@@ -63,7 +63,6 @@
#include "JSAPIValueWrapper.h"
#include "JSArray.h"
#include "JSCInlines.h"
-#include "JSFixedArray.h"
#include "JSFunction.h"
#include "JSGlobalObjectFunctions.h"
#include "JSInternalPromiseDeferred.h"
@@ -234,7 +233,6 @@
regExpStructure.set(*this, RegExp::createStructure(*this, 0, jsNull()));
symbolStructure.set(*this, Symbol::createStructure(*this, 0, jsNull()));
symbolTableStructure.set(*this, SymbolTable::createStructure(*this, 0, jsNull()));
- fixedArrayStructure.set(*this, JSFixedArray::createStructure(*this, 0, jsNull()));
structureChainStructure.set(*this, StructureChain::createStructure(*this, 0, jsNull()));
sparseArrayValueMapStructure.set(*this, SparseArrayValueMap::createStructure(*this, 0, jsNull()));
templateRegistryKeyStructure.set(*this, JSTemplateRegistryKey::createStructure(*this, 0, jsNull()));
diff --git a/Source/JavaScriptCore/runtime/VM.h b/Source/JavaScriptCore/runtime/VM.h
index 28a9b63..e14b885 100644
--- a/Source/JavaScriptCore/runtime/VM.h
+++ b/Source/JavaScriptCore/runtime/VM.h
@@ -314,7 +314,6 @@
Strong<Structure> regExpStructure;
Strong<Structure> symbolStructure;
Strong<Structure> symbolTableStructure;
- Strong<Structure> fixedArrayStructure;
Strong<Structure> structureChainStructure;
Strong<Structure> sparseArrayValueMapStructure;
Strong<Structure> templateRegistryKeyStructure;
