Revert "Fix Array.prototype.sort speed regression"

This reverts commit c88994f84c.

Reason for revert: Seems to break AccessibilitySelectionTest.List in webkit_unit_tests (https://ci.chromium.org/p/v8/builders/luci.v8.ci/V8-Blink%20Mac/15618)

Original change's description:
> Fix Array.prototype.sort speed regression
> 
> CanUseSameAccessor<ElementsAccessor: type> is array-sort.tq is super
> performance-critical. Reverting the type-safe cleanup made in this
> function while landing Array.prototype.slice.
> 
> Bug=chromium:852764
> 
> Change-Id: I1252d2ff8e431581f916794807e59abb39248abb
> Reviewed-on: https://chromium-review.googlesource.com/c/1317815
> Reviewed-by: Jakob Gruber <jgruber@chromium.org>
> Commit-Queue: Daniel Clifford <danno@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#57248}

TBR=danno@chromium.org,jgruber@chromium.org

Change-Id: Ie447fd0382fee344326d928398595aa450ccdcca
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/1319577
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57265}
This commit is contained in:
Leszek Swirski 2018-11-06 09:49:57 +00:00 committed by Commit Bot
parent 2fbbf7ebc7
commit aeb74d1ca0

View File

@ -325,12 +325,12 @@ module array {
builtin CanUseSameAccessor<ElementsAccessor: type>(
context: Context, receiver: JSReceiver, initialReceiverMap: Object,
initialReceiverLength: Number): Boolean {
const a: JSArray = UnsafeCast<JSArray>(receiver);
const a: JSArray = Cast<JSArray>(receiver) otherwise unreachable;
if (a.map != initialReceiverMap) return False;
assert(TaggedIsSmi(initialReceiverLength));
let originalLength: Smi = UnsafeCast<Smi>(initialReceiverLength);
if (UnsafeCast<Smi>(a.length) != originalLength) return False;
if (a.length != originalLength) return False;
return True;
}