Changeset 266778 in webkit for trunk/Source/JavaScriptCore/bytecompiler

Timestamp:

Sep 9, 2020, 6:37:16 AM (5 years ago)

Author:

Alexey Shvayka

Message:

Don't emitDirectBinding() if there is a [...rest] element binding
​https://bugs.webkit.org/show_bug.cgi?id=216228

Reviewed by Darin Adler.

JSTests:

• test262/expectations.yaml: Mark 12 test cases as passing.

Source/JavaScriptCore:

emitDirectBinding() is up for removal due to not respecting overriden or removed
Array.prototype[Symbol.iterator]. However, dropping it slows down popular swap pattern
[a, b] = [b, a] by 40% with DFG/FTL, and by a factor of 6 with baseline JIT only.

Until we figure out the best way to preserve common case performance, this patch
prevents let [...rest] = [1] from ending up as a number instead of an array,
aligning JSC with V8 and SpiderMonkey.

• bytecompiler/NodesCodegen.cpp:

(JSC::ArrayPatternNode::emitDirectBinding):

File:

• trunk/Source/JavaScriptCore/bytecompiler/NodesCodegen.cpp (modified) (1 diff)

trunk/Source/JavaScriptCore/bytecompiler/NodesCodegen.cpp

@@ -5107 +5107 @@
         return nullptr;
 
+    if (m_targetPatterns.findMatching([&] (auto& target) { return target.bindingType == BindingType::RestElement; }) != notFound)
+        return nullptr;
+
     ElementNode* elementNodes = static_cast<ArrayNode*>(rhs)->elements();
     Vector<ExpressionNode*> elements;