Changeset 49005 in webkit for trunk/JavaScriptCore/jit/JITPropertyAccess.cpp

Timestamp:

Oct 1, 2009, 4:49:28 PM (16 years ago)

Author:

[email protected]

Message:

Roll out r49004 since it broke the debug build.

File:

• trunk/JavaScriptCore/jit/JITPropertyAccess.cpp (modified) (3 diffs)

trunk/JavaScriptCore/jit/JITPropertyAccess.cpp

@@ -311 +311 @@
     load32(BaseIndex(regT0, regT2, TimesEight, OBJECT_OFFSETOF(ArrayStorage, m_vector[0]) + 4), regT1); // tag
     load32(BaseIndex(regT0, regT2, TimesEight, OBJECT_OFFSETOF(ArrayStorage, m_vector[0])), regT0); // payload
-    branch32(Equal, regT1, Imm32(JSValue::EmptyValueTag)).linkTo(callGetByValJITStub, this);
-
+
+    // FIXME: Maybe we can optimize this comparison to JSValue().
+    Jump skip = branch32(NotEqual, regT0, Imm32(0));
+    branch32(Equal, regT1, Imm32(JSValue::CellTag), callGetByValJITStub);
+
+    skip.link(this);
     emitStore(dst, regT1, regT0);
 }
@@ -330 +334 @@
 
     Jump inFastVector = branch32(Below, regT2, Address(regT0, OBJECT_OFFSETOF(JSArray, m_fastAccessCutoff)));
-    
+
     // Check if the access is within the vector.
     addSlowCase(branch32(AboveOrEqual, regT2, Address(regT3, OBJECT_OFFSETOF(ArrayStorage, m_vectorLength))));
@@ -336 +340 @@
     // This is a write to the slow part of the vector; first, we have to check if this would be the first write to this location.
     // FIXME: should be able to handle initial write to array; increment the the number of items in the array, and potentially update fast access cutoff. 
-    addSlowCase(branch32(Equal, BaseIndex(regT3, regT2, TimesEight, OBJECT_OFFSETOF(ArrayStorage, m_vector[0]) + 4), Imm32(JSValue::EmptyValueTag)));
+    Jump skip = branch32(NotEqual, BaseIndex(regT3, regT2, TimesEight, OBJECT_OFFSETOF(ArrayStorage, m_vector[0]) + 4), Imm32(JSValue::CellTag));
+    addSlowCase(branch32(Equal, BaseIndex(regT3, regT2, TimesEight, OBJECT_OFFSETOF(ArrayStorage, m_vector[0])), Imm32(0)));
+    skip.link(this);
 
     inFastVector.link(this);