tree cf57439aaf8cc168ca65b9098a7f8eeaef409700
parent 5c872d712e827c7a871568bf12c0ca04f5ad2899
author ysuzuki@apple.com <ysuzuki@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc> 1575526760 +0000
committer ysuzuki@apple.com <ysuzuki@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc> 1575526760 +0000

[JSC] Put TypedArrays in IsoSubspace
https://bugs.webkit.org/show_bug.cgi?id=204867

Reviewed by Mark Lam.

This patch puts TypedArrays in IsoSubspace.

    - JSArrayBuffer
    - JSDataView
    - JSInt8Array
    - JSInt16Array
    - JSInt32Array
    - JSUint8Array
    - JSUint8ClampedArray
    - JSUint16Array
    - JSUint32Array
    - JSFloat32Array
    - JSFloat64Array

* dfg/DFGSpeculativeJIT.cpp:
(JSC::DFG::SpeculativeJIT::compileNewTypedArrayWithSize):
* ftl/FTLLowerDFGToB3.cpp:
(JSC::FTL::DFG::LowerDFGToB3::compileNewTypedArray):
* runtime/JSArrayBuffer.h:
* runtime/JSArrayBufferView.h:
(JSC::JSArrayBufferView::subspaceFor):
* runtime/JSDataView.h:
* runtime/JSGenericTypedArrayView.h:
* runtime/JSTypedArrays.h:
* runtime/TypedArrayAdaptors.h:
* runtime/VM.cpp:
* runtime/VM.h:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@253143 268f45cc-cd09-0410-ab3c-d52691b4dbfc