Changeset 49030 in webkit for trunk/JavaScriptCore/jit/JITPropertyAccess.cpp

Timestamp:

Oct 2, 2009, 11:06:49 AM (16 years ago)

Author:

[email protected]

Message:

Rolled back in r49004 with the debug 64bit build fixed

File:

• trunk/JavaScriptCore/jit/JITPropertyAccess.cpp (modified) (3 diffs)

trunk/JavaScriptCore/jit/JITPropertyAccess.cpp

@@ -311 +311 @@
     load32(BaseIndex(regT0, regT2, TimesEight, OBJECT_OFFSETOF(ArrayStorage, m_vector[0]) + 4), regT1); // tag
     load32(BaseIndex(regT0, regT2, TimesEight, OBJECT_OFFSETOF(ArrayStorage, m_vector[0])), regT0); // payload
-
-    // FIXME: Maybe we can optimize this comparison to JSValue().
-    Jump skip = branch32(NotEqual, regT0, Imm32(0));
-    branch32(Equal, regT1, Imm32(JSValue::CellTag), callGetByValJITStub);
-
-    skip.link(this);
+    branch32(Equal, regT1, Imm32(JSValue::EmptyValueTag)).linkTo(callGetByValJITStub, this);
+
     emitStore(dst, regT1, regT0);
 }
@@ -334 +330 @@
 
     Jump inFastVector = branch32(Below, regT2, Address(regT0, OBJECT_OFFSETOF(JSArray, m_fastAccessCutoff)));
-
+    
     // Check if the access is within the vector.
     addSlowCase(branch32(AboveOrEqual, regT2, Address(regT3, OBJECT_OFFSETOF(ArrayStorage, m_vectorLength))));
@@ -340 +336 @@
     // This is a write to the slow part of the vector; first, we have to check if this would be the first write to this location.
     // FIXME: should be able to handle initial write to array; increment the the number of items in the array, and potentially update fast access cutoff. 
-    Jump skip = branch32(NotEqual, BaseIndex(regT3, regT2, TimesEight, OBJECT_OFFSETOF(ArrayStorage, m_vector[0]) + 4), Imm32(JSValue::CellTag));
-    addSlowCase(branch32(Equal, BaseIndex(regT3, regT2, TimesEight, OBJECT_OFFSETOF(ArrayStorage, m_vector[0])), Imm32(0)));
-    skip.link(this);
+    addSlowCase(branch32(Equal, BaseIndex(regT3, regT2, TimesEight, OBJECT_OFFSETOF(ArrayStorage, m_vector[0]) + 4), Imm32(JSValue::EmptyValueTag)));
 
     inFastVector.link(this);