Add the ability to disable indexed property access to simplify testing.
<rdar://problem/36328842>
Created attachment 330599 [details] Patch
Comment on attachment 330599 [details] Patch View in context: https://bugs.webkit.org/attachment.cgi?id=330599&action=review r=me with a nit. > Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp:13159 > + if (m_indexMaskingMode == IndexMaskingEnabled) { > + LValue mask = m_out.load32(base, m_heaps.JSObject_butterflyMask); > + offset = m_out.shl(m_out.zeroExtPtr(m_out.bitAnd(mask, index)), m_out.constIntPtr(logElementSize(type))); > + } else > + offset = m_out.shl(m_out.zeroExtPtr(index), m_out.constIntPtr(logElementSize(type))); I think you can just make this. if (m_indexMaskingMode == IndexMaskingEnabled) index = m_out.bitAnd(index, m_out.load32(base, m_heaps.JSObject_butterflyMask)); LValue offset = m_out.shl(m_out.zeroExtPtr(index), m_out.constIntPtr(logElementSize(type)));
(In reply to Keith Miller from comment #3) > Comment on attachment 330599 [details] > Patch > > View in context: > https://bugs.webkit.org/attachment.cgi?id=330599&action=review > > r=me with a nit. > > > Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp:13159 > > + if (m_indexMaskingMode == IndexMaskingEnabled) { > > + LValue mask = m_out.load32(base, m_heaps.JSObject_butterflyMask); > > + offset = m_out.shl(m_out.zeroExtPtr(m_out.bitAnd(mask, index)), m_out.constIntPtr(logElementSize(type))); > > + } else > > + offset = m_out.shl(m_out.zeroExtPtr(index), m_out.constIntPtr(logElementSize(type))); > > I think you can just make this. > > if (m_indexMaskingMode == IndexMaskingEnabled) > index = m_out.bitAnd(index, m_out.load32(base, > m_heaps.JSObject_butterflyMask)); > LValue offset = m_out.shl(m_out.zeroExtPtr(index), > m_out.constIntPtr(logElementSize(type))); Sure. Done locally.
Committed r226474: <https://trac.webkit.org/changeset/226474>