Changeset 222382 in webkit for trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp

Timestamp:

Sep 22, 2017, 3:25:58 AM (8 years ago)

Author:

Yusuke Suzuki

Message:

Unreviewed, rolling out r222380.
​https://bugs.webkit.org/show_bug.cgi?id=177352

Octane/box2d shows 8% regression (Requested by yusukesuzuki on
#webkit).

Reverted changeset:

"[DFG][FTL] Profile array vector length for array allocation"
​https://bugs.webkit.org/show_bug.cgi?id=177051
​http://trac.webkit.org/changeset/222380

Patch by Commit Queue <​[email protected]> on 2017-09-22

File:

• trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp (modified) (2 diffs)

trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp

@@ -4239 +4239 @@
         if (!globalObject->isHavingABadTime() && !hasAnyArrayStorage(indexingType)) {
             unsigned numElements = node->numConstants();
-            unsigned vectorLengthHint = node->vectorLengthHint();
-            ASSERT(vectorLengthHint >= numElements);
             
             GPRTemporary result(this);
@@ -4248 +4246 @@
             GPRReg storageGPR = storage.gpr();
 
-            emitAllocateRawObject(resultGPR, m_jit.graph().registerStructure(globalObject->arrayStructureForIndexingTypeDuringAllocation(indexingType)), storageGPR, numElements, vectorLengthHint);
+            emitAllocateRawObject(resultGPR, m_jit.graph().registerStructure(globalObject->arrayStructureForIndexingTypeDuringAllocation(indexingType)), storageGPR, numElements, numElements);
             
             DFG_ASSERT(m_jit.graph(), node, indexingType & IsArray);