Ignore:
Timestamp:
Aug 8, 2017, 9:00:06 AM (8 years ago)
Author:
Ryan Haddad
Message:

Unreviewed, rolling out r220368.

This change caused WK1 tests to exit early with crashes.

Reverted changeset:

"Baseline JIT should do caging"
​https://bugs.webkit.org/show_bug.cgi?id=175037
​http://trac.webkit.org/changeset/220368

File:
1 edited

Legend:

Unmodified
Added
Removed

  • trunk/Source/JavaScriptCore/bytecode/InlineAccess.cpp

    r220368 r220404  
    5858            CCallHelpers::NotEqual, value, CCallHelpers::TrustedImm32(IsArray | ContiguousShape));
    5959        jit.loadPtr(CCallHelpers::Address(base, JSObject::butterflyOffset()), value);
    60         // FIXME: Do caging!
    61         // https://bugs.webkit.org/show_bug.cgi?id=175295
    6260        jit.load32(CCallHelpers::Address(value, ArrayStorage::lengthOffset()), value);
    6361        jit.boxInt32(scratchGPR, regs);
    … …  
    7674            CCallHelpers::Address(base, JSObject::butterflyOffset()),
    7775            value);
    78         // FIXME: Do caging!
    79         // https://bugs.webkit.org/show_bug.cgi?id=175295
    8076        GPRReg storageGPR = value;
    8177        jit.loadValue(
    … …  
    121117
    122118        jit.loadPtr(MacroAssembler::Address(base, JSObject::butterflyOffset()), value);
    123         // FIXME: Do caging!
    124         // https://bugs.webkit.org/show_bug.cgi?id=175295
    125119        jit.storeValue(
    126120            regs,
    … …  
    177171    else {
    178172        jit.loadPtr(CCallHelpers::Address(base, JSObject::butterflyOffset()), value.payloadGPR());
    179         // FIXME: Do caging!
    180         // https://bugs.webkit.org/show_bug.cgi?id=175295
    181173        storage = value.payloadGPR();
    182174    }
    … …  
    240232        ASSERT(storage != InvalidGPRReg);
    241233        jit.loadPtr(CCallHelpers::Address(base, JSObject::butterflyOffset()), storage);
    242         // FIXME: Do caging!
    243         // https://bugs.webkit.org/show_bug.cgi?id=175295
    244234    }
    245235
    … …  
    280270        CCallHelpers::NotEqual, scratch, CCallHelpers::TrustedImm32(array->indexingType()));
    281271    jit.loadPtr(CCallHelpers::Address(base, JSObject::butterflyOffset()), value.payloadGPR());
    282     // FIXME: Do caging!
    283     // https://bugs.webkit.org/show_bug.cgi?id=175295
    284272    jit.load32(CCallHelpers::Address(value.payloadGPR(), ArrayStorage::lengthOffset()), value.payloadGPR());
    285273    jit.boxInt32(value.payloadGPR(), value);
Note: See TracChangeset for help on using the changeset viewer.