1. 06 Jan, 2012 10 commits
  2. 05 Jan, 2012 17 commits
  3. 04 Jan, 2012 7 commits
  4. 03 Jan, 2012 6 commits
    • fpizlo@apple.com's avatar
      REGRESSION (r98196-98236): Incorrect layout of iGoogle with RSS feeds · 4c09900b
      fpizlo@apple.com authored
      https://bugs.webkit.org/show_bug.cgi?id=75303
      <rdar://problem/10633533>
      
      Source/JavaScriptCore: 
      
      Reviewed by Gavin Barraclough.
              
      The this argument was not being kept alive in some cases during inlining and intrinsic
      optimizations.
      
      * dfg/DFGByteCodeParser.cpp:
      (JSC::DFG::ByteCodeParser::handleCall):
      (JSC::DFG::ByteCodeParser::emitFunctionCheck):
      (JSC::DFG::ByteCodeParser::handleInlining):
      
      LayoutTests: 
      
      Reviewed by Gavin Barraclough.
      
      * fast/js/dfg-inline-unused-this-expected.txt: Added.
      * fast/js/dfg-inline-unused-this-method-check-expected.txt: Added.
      * fast/js/dfg-inline-unused-this-method-check.html: Added.
      * fast/js/dfg-inline-unused-this.html: Added.
      * fast/js/dfg-intrinsic-unused-this-expected.txt: Added.
      * fast/js/dfg-intrinsic-unused-this-method-check-expected.txt: Added.
      * fast/js/dfg-intrinsic-unused-this-method-check.html: Added.
      * fast/js/dfg-intrinsic-unused-this.html: Added.
      * fast/js/script-tests/dfg-inline-unused-this-method-check.js: Added.
      (foo):
      (bar):
      (baz):
      * fast/js/script-tests/dfg-inline-unused-this.js: Added.
      (foo):
      (bar):
      (baz):
      * fast/js/script-tests/dfg-intrinsic-unused-this-method-check.js: Added.
      (bar):
      (baz):
      * fast/js/script-tests/dfg-intrinsic-unused-this.js: Added.
      (bar):
      (baz):
      
      
      
      git-svn-id: http://svn.webkit.org/repository/webkit/trunk@103981 268f45cc-cd09-0410-ab3c-d52691b4dbfc
      4c09900b
    • barraclough@apple.com's avatar
      Windows build fix. · a22a6952
      barraclough@apple.com authored
      * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
      
      
      
      git-svn-id: http://svn.webkit.org/repository/webkit/trunk@103977 268f45cc-cd09-0410-ab3c-d52691b4dbfc
      a22a6952
    • barraclough@apple.com's avatar
      Windows build fix. · 58bd432d
      barraclough@apple.com authored
      * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
      
      
      
      git-svn-id: http://svn.webkit.org/repository/webkit/trunk@103969 268f45cc-cd09-0410-ab3c-d52691b4dbfc
      58bd432d
    • barraclough@apple.com's avatar
      https://bugs.webkit.org/show_bug.cgi?id=75140 · cf553561
      barraclough@apple.com authored
      Reviewed by Sam Weinig.
      
      Rewrite JSArray::putSlowCase to be much cleaner & simpler.
      
      This rewrite only significantly changes behaviour for sparse array, specifically
      in how sparse arrays are reified back to vector form. This does not affect arrays
      with less than 10000 entries (since these always use a vector). The more common
      cases of sparse array behavior (though large sparse arrays are rare) - arrays that
      always remain sparse, and arrays that are filled in reverse sequential order -
      should be just as fast or faster (since reification is simpler & no longer
      requires map lookups) after these changes.
      
      Simplifying this code allows all cases of putByIndex that need to grow the vector
      to do so via increaseVectorLength, which means that this method can encapsulate
      the policy of determining how the vector should be grown.
      
      No performance impact.
      
      * runtime/JSArray.cpp:
      (JSC::isDenseEnoughForVector):
          - any array of length <= MIN_SPARSE_ARRAY_INDEX is dense enough for a vector.
      (JSC::JSArray::putByIndex):
          - simplify & comment.
      (JSC::JSArray::putByIndexBeyondVectorLength):
          - Re-written to be much clearer & simpler.
      (JSC::JSArray::increaseVectorLength):
      (JSC::JSArray::increaseVectorPrefixLength):
          - add explicit checks against MAX_STORAGE_VECTOR_LENGTH, so clients do not need do so.
      (JSC::JSArray::push):
          - simplify & comment.
      * runtime/JSArray.h:
          - removed SparseArrayValueMap::take.
      
      
      
      git-svn-id: http://svn.webkit.org/repository/webkit/trunk@103964 268f45cc-cd09-0410-ab3c-d52691b4dbfc
      cf553561
    • barraclough@apple.com's avatar
      Windows build fix. · e67eb327
      barraclough@apple.com authored
      * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
      
      
      
      git-svn-id: http://svn.webkit.org/repository/webkit/trunk@103961 268f45cc-cd09-0410-ab3c-d52691b4dbfc
      e67eb327
    • barraclough@apple.com's avatar
      https://bugs.webkit.org/show_bug.cgi?id=75140 · 535d8bb7
      barraclough@apple.com authored
      Reviewed by Sam Weinig.
      
      Simplify JSArray creation - remove ArgsList/JSValue* create methods
      (this functionality can be implemented in terms of tryCreateUninitialized).
      
      * JavaScriptCore.exp:
      * runtime/ArrayConstructor.cpp:
          - use constructArray/constructEmptyArray instead of calling JSArray::create directly
      (JSC::constructArrayWithSizeQuirk):
      * runtime/JSArray.cpp:
      * runtime/JSArray.h:
          - removed ArgsList/JSValue* create methods
      * runtime/JSGlobalObject.h:
      (JSC::constructEmptyArray):
      (JSC::constructArray):
          - changed to be implemented in terms of JSArray::tryCreateUninitialized
      
      
      
      git-svn-id: http://svn.webkit.org/repository/webkit/trunk@103960 268f45cc-cd09-0410-ab3c-d52691b4dbfc
      535d8bb7