Changeset 222382 in webkit for trunk/Source/JavaScriptCore/dfg/DFGOperations.cpp

Timestamp:

Sep 22, 2017, 3:25:58 AM (8 years ago)

Author:

Yusuke Suzuki

Message:

Unreviewed, rolling out r222380.
​https://bugs.webkit.org/show_bug.cgi?id=177352

Octane/box2d shows 8% regression (Requested by yusukesuzuki on
#webkit).

Reverted changeset:

"[DFG][FTL] Profile array vector length for array allocation"
​https://bugs.webkit.org/show_bug.cgi?id=177051
​http://trac.webkit.org/changeset/222380

Patch by Commit Queue <​[email protected]> on 2017-09-22

File:

• trunk/Source/JavaScriptCore/dfg/DFGOperations.cpp (modified) (1 diff)

trunk/Source/JavaScriptCore/dfg/DFGOperations.cpp

@@ -1312 +1312 @@
 }
 
-char* JIT_OPERATION operationNewArrayWithSizeAndHint(ExecState* exec, Structure* arrayStructure, int32_t size, int32_t vectorLengthHint, Butterfly* butterfly)
-{
-    VM& vm = exec->vm();
-    NativeCallFrameTracer tracer(&vm, exec);
-    auto scope = DECLARE_THROW_SCOPE(vm);
-
-    if (UNLIKELY(size < 0))
-        return bitwise_cast<char*>(throwException(exec, scope, createRangeError(exec, ASCIILiteral("Array size is not a small enough positive integer."))));
-
-    JSArray* result;
-    if (butterfly)
-        result = JSArray::createWithButterfly(vm, nullptr, arrayStructure, butterfly);
-    else {
-        result = JSArray::tryCreate(vm, arrayStructure, size, vectorLengthHint);
-        ASSERT(result);
-    }
-    return bitwise_cast<char*>(result);
-}
-
 char* JIT_OPERATION operationNewArrayBuffer(ExecState* exec, Structure* arrayStructure, size_t start, size_t size)
 {