ChangeLog

2014-04-14  Andreas Kling  <akling@apple.com>

        Array.prototype.concat should allocate output storage only once.

        <https://webkit.org/b/131609>

        Do a first pass across 'this' and any arguments to compute the

        final size of the resulting array from Array.prototype.concat.

        This avoids having to grow the output incrementally as we go.

        This also includes two other micro-optimizations:

        - Mark getProperty() with ALWAYS_INLINE.

        - Use JSArray::length() instead of taking the generic property

          lookup path when we know an argument is an Array.

        My MBP says ~3% progression on Dromaeo/jslib-traverse-jquery.

        Reviewed by NOBODY (OOPS!).

        * runtime/ArrayPrototype.cpp:

        (JSC::getProperty):

        (JSC::arrayProtoFuncConcat):

2014-04-14  Commit Queue  <commit-queue@webkit.org>

        Unreviewed, rolling out r167249.

Source/JavaScriptCore/runtime/ArrayPrototype.cpp

@@bool ArrayPrototype::getOwnPropertySlot(JSObject* object, ExecState* exec, Prope

// ------------------------------ Array Functions ----------------------------

// Helper function

149 static JSValue getProperty(ExecState* exec, JSObject* obj, unsigned index)

149static ALWAYS_INLINE JSValue getProperty(ExecState* exec, JSObject* obj, unsigned index)

{

    PropertySlot slot(obj);

    if (!obj->getPropertySlot(exec, index, slot))

@@EncodedJSValue JSC_HOST_CALL arrayProtoFuncJoin(ExecState* exec)

EncodedJSValue JSC_HOST_CALL arrayProtoFuncConcat(ExecState* exec)

{

    JSValue thisValue = exec->thisValue().toThis(exec, StrictMode);

419 JSArray* arr = constructEmptyArray(exec, nullptr);

420 unsigned n = 0;

419 size_t argCount = exec->argumentCount();

421420 JSValue curArg = thisValue.toObject(exec);

    unsigned finalArraySize = 0;

    for (size_t i = 0;;) {

        if (JSArray* currentArray = jsDynamicCast<JSArray*>(curArg))

            finalArraySize += currentArray->length();

        else

            finalArraySize++;

        if (i == argCount)

            break;

        curArg = exec->uncheckedArgument(i);

        ++i;

    }

    JSArray* arr = constructEmptyArray(exec, nullptr, finalArraySize);

422435 if (exec->hadException())

423436 return JSValue::encode(jsUndefined());

    size_t i = 0;

    size_t argCount = exec->argumentCount();

    while (1) {

        if (curArg.inherits(JSArray::info())) {

            unsigned length = curArg.get(exec, exec->propertyNames().length).toUInt32(exec);

            JSObject* curObject = curArg.toObject(exec);

    curArg = thisValue.toObject(exec);

    unsigned n = 0;

    for (size_t i = 0;;) {

        if (JSArray* currentArray = jsDynamicCast<JSArray*>(curArg)) {

            unsigned length = currentArray->length();

430443 for (unsigned k = 0; k < length; ++k) {

431 JSValue v = getProperty(exec, cur~~Obj~~ect, k);

444 JSValue v = getProperty(exec, currentArray, k);

                if (exec->hadException())

                    return JSValue::encode(jsUndefined());

                if (v)