[JSC] Use GetArrayLength for JSArray.length even when the array type is undecided
authorcommit-queue@webkit.org <commit-queue@webkit.org@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Mon, 12 Sep 2016 22:13:37 +0000 (22:13 +0000)
committercommit-queue@webkit.org <commit-queue@webkit.org@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Mon, 12 Sep 2016 22:13:37 +0000 (22:13 +0000)
commitf264d713b5cd961a0886014b5e36e7d5549a9250
treeb590d5f4bb1ff18f61c657c112931e043597e939
parentd086f2616954e88ef4443ae848ac549e78dc1f35
[JSC] Use GetArrayLength for JSArray.length even when the array type is undecided
https://bugs.webkit.org/show_bug.cgi?id=161671

Patch by Benjamin Poulain <bpoulain@apple.com> on 2016-09-12
Reviewed by Geoffrey Garen.

JSTests:

* stress/get-array-length-on-undecided.js: Added.

Source/JavaScriptCore:

UndecidedShape is a type with storage. When we allocate an uninitialized JSArray,
it gets a butterfly with its length.
When we were querying that length, we were generating a generic GetById with inline cache.

This patch adds the missing bits to treat Undecided like the other types with storage.

* dfg/DFGArrayMode.cpp:
(JSC::DFG::canBecomeGetArrayLength):
(JSC::DFG::ArrayMode::refine):
* dfg/DFGArrayMode.h:
(JSC::DFG::ArrayMode::usesButterfly):
(JSC::DFG::ArrayMode::lengthNeedsStorage):
* dfg/DFGClobberize.h:
(JSC::DFG::clobberize):
* dfg/DFGFixupPhase.cpp:
(JSC::DFG::FixupPhase::checkArray):
* dfg/DFGSpeculativeJIT.cpp:
(JSC::DFG::SpeculativeJIT::compileGetArrayLength):
* ftl/FTLCapabilities.cpp:
(JSC::FTL::canCompile):
* ftl/FTLLowerDFGToB3.cpp:
(JSC::FTL::DFG::LowerDFGToB3::compileGetArrayLength):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@205830 268f45cc-cd09-0410-ab3c-d52691b4dbfc
JSTests/ChangeLog
JSTests/stress/get-array-length-on-undecided.js [new file with mode: 0644]
Source/JavaScriptCore/ChangeLog
Source/JavaScriptCore/dfg/DFGArrayMode.cpp
Source/JavaScriptCore/dfg/DFGArrayMode.h
Source/JavaScriptCore/dfg/DFGClobberize.h
Source/JavaScriptCore/dfg/DFGFixupPhase.cpp
Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp
Source/JavaScriptCore/ftl/FTLCapabilities.cpp
Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp