Unreviewed, rolling out r199128 and r199141.
authorcommit-queue@webkit.org <commit-queue@webkit.org@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Thu, 7 Apr 2016 18:06:42 +0000 (18:06 +0000)
committercommit-queue@webkit.org <commit-queue@webkit.org@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Thu, 7 Apr 2016 18:06:42 +0000 (18:06 +0000)
commitc3f68357470227376c4606efaf3747937d81157b
tree6dacebeecf292393a96d965c0b89059cd4de5639
parentd95bc9b194c5009503ea21855379f1ae55fb72c7
Unreviewed, rolling out r199128 and r199141.
https://bugs.webkit.org/show_bug.cgi?id=156348

Causes crashes on multiple webpages (Requested by keith_mi_ on
#webkit).

Reverted changesets:

"[ES6] Add support for Symbol.isConcatSpreadable."
https://bugs.webkit.org/show_bug.cgi?id=155351
http://trac.webkit.org/changeset/199128

"Unreviewed, uncomment accidentally commented line in test."
http://trac.webkit.org/changeset/199141

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@199164 268f45cc-cd09-0410-ab3c-d52691b4dbfc
47 files changed:
LayoutTests/ChangeLog
LayoutTests/js/Object-getOwnPropertyNames-expected.txt
LayoutTests/js/dom/array-prototype-properties-expected.txt
LayoutTests/js/script-tests/Object-getOwnPropertyNames.js
Source/JavaScriptCore/ChangeLog
Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj
Source/JavaScriptCore/builtins/ArrayPrototype.js
Source/JavaScriptCore/bytecode/BytecodeIntrinsicRegistry.cpp
Source/JavaScriptCore/bytecode/BytecodeIntrinsicRegistry.h
Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h
Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp
Source/JavaScriptCore/dfg/DFGClobberize.h
Source/JavaScriptCore/dfg/DFGDoesGC.cpp
Source/JavaScriptCore/dfg/DFGFixupPhase.cpp
Source/JavaScriptCore/dfg/DFGNodeType.h
Source/JavaScriptCore/dfg/DFGOperations.cpp
Source/JavaScriptCore/dfg/DFGOperations.h
Source/JavaScriptCore/dfg/DFGPredictionPropagationPhase.cpp
Source/JavaScriptCore/dfg/DFGSafeToExecute.h
Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp
Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h
Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp
Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp
Source/JavaScriptCore/ftl/FTLCapabilities.cpp
Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp
Source/JavaScriptCore/jit/JITOperations.h
Source/JavaScriptCore/jsc.cpp
Source/JavaScriptCore/runtime/ArrayConstructor.cpp
Source/JavaScriptCore/runtime/ArrayConstructor.h
Source/JavaScriptCore/runtime/ArrayPrototype.cpp
Source/JavaScriptCore/runtime/ArrayPrototype.h
Source/JavaScriptCore/runtime/CommonIdentifiers.h
Source/JavaScriptCore/runtime/Intrinsic.h
Source/JavaScriptCore/runtime/JSArray.cpp
Source/JavaScriptCore/runtime/JSArray.h
Source/JavaScriptCore/runtime/JSArrayInlines.h [deleted file]
Source/JavaScriptCore/runtime/JSGlobalObject.cpp
Source/JavaScriptCore/runtime/JSType.h
Source/JavaScriptCore/runtime/ObjectConstructor.h
Source/JavaScriptCore/tests/es6.yaml
Source/JavaScriptCore/tests/stress/array-concat-spread-object.js [deleted file]
Source/JavaScriptCore/tests/stress/array-concat-spread-proxy-exception-check.js [deleted file]
Source/JavaScriptCore/tests/stress/array-concat-spread-proxy.js [deleted file]
Source/JavaScriptCore/tests/stress/array-concat-with-slow-indexingtypes.js [deleted file]
Source/JavaScriptCore/tests/stress/array-species-config-array-constructor.js
Source/WebCore/ChangeLog
Source/WebCore/bridge/runtime_array.h