Spread for phantom nodes generates JSFixedArray. So previously, our PhantomNewArrayBuffer returns a fixed array stored in this node. But now, it holds JSImmutableButterfly, but FTL lowering phase mixes JSFixedArray and JSImmutableButterfly. I think we can generate JSImmutableButterfly instead of JSFixedArray in Spread.
Created attachment 342801 [details] Patch
Comment on attachment 342801 [details] Patch View in context: https://bugs.webkit.org/attachment.cgi?id=342801&action=review r=me > Source/JavaScriptCore/ChangeLog:8 > + Spread(PhantomNewArrayBuffer) returns JSImmutableButterfly. But it is wrong. Do we do the right thing when we exit for PhantomSpread(PhantomNewArrayBuffer)? > Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp:5718 > + ValueFromBlock slowFixedArray = m_out.anchor(vmCall(Int64, m_out.operation(operationCreateFixedArray), m_callFrame, m_out.constInt32(immutableButterfly->length()))); IntPtr > Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp:5722 > + LValue fixedArray = m_out.phi(Int64, fastFixedArray, slowFixedArray); IntPtr
Comment on attachment 342801 [details] Patch Attachment 342801 [details] did not pass win-ews (win): Output: http://webkit-queues.webkit.org/results/8200408 New failing tests: http/tests/preload/onload_event.html
Created attachment 342834 [details] Archive of layout-test-results from ews202 for win-future The attached test failures were seen while running run-webkit-tests on the win-ews. Bot: ews202 Port: win-future Platform: CYGWIN_NT-6.1-2.9.0-0.318-5-3-x86_64-64bit
Comment on attachment 342801 [details] Patch View in context: https://bugs.webkit.org/attachment.cgi?id=342801&action=review >> Source/JavaScriptCore/ChangeLog:8 >> + Spread(PhantomNewArrayBuffer) returns JSImmutableButterfly. But it is wrong. > > Do we do the right thing when we exit for PhantomSpread(PhantomNewArrayBuffer)? Yeah, PhantomNewArrayBuffer generates an array from JSImmutableButterfly. And PhantomSread generates JSFixedArray from JSArray. >> Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp:5718 >> + ValueFromBlock slowFixedArray = m_out.anchor(vmCall(Int64, m_out.operation(operationCreateFixedArray), m_callFrame, m_out.constInt32(immutableButterfly->length()))); > > IntPtr Fixed. >> Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp:5722 >> + LValue fixedArray = m_out.phi(Int64, fastFixedArray, slowFixedArray); > > IntPtr Fixed.
Committed r232902: <https://trac.webkit.org/changeset/232902>
<rdar://problem/41186005>