From aeb74d1ca0bf8c124b397bcef863552b215d0fa2 Mon Sep 17 00:00:00 2001 From: Leszek Swirski Date: Tue, 6 Nov 2018 09:49:57 +0000 Subject: [PATCH] Revert "Fix Array.prototype.sort speed regression" This reverts commit c88994f84cd920cd310ceab3ccb3cf1fd4ed6a62. Reason for revert: Seems to break AccessibilitySelectionTest.List in webkit_unit_tests (https://ci.chromium.org/p/v8/builders/luci.v8.ci/V8-Blink%20Mac/15618) Original change's description: > Fix Array.prototype.sort speed regression > > CanUseSameAccessor is array-sort.tq is super > performance-critical. Reverting the type-safe cleanup made in this > function while landing Array.prototype.slice. > > Bug=chromium:852764 > > Change-Id: I1252d2ff8e431581f916794807e59abb39248abb > Reviewed-on: https://chromium-review.googlesource.com/c/1317815 > Reviewed-by: Jakob Gruber > Commit-Queue: Daniel Clifford > Cr-Commit-Position: refs/heads/master@{#57248} TBR=danno@chromium.org,jgruber@chromium.org Change-Id: Ie447fd0382fee344326d928398595aa450ccdcca No-Presubmit: true No-Tree-Checks: true No-Try: true Reviewed-on: https://chromium-review.googlesource.com/c/1319577 Reviewed-by: Leszek Swirski Commit-Queue: Leszek Swirski Cr-Commit-Position: refs/heads/master@{#57265} --- third_party/v8/builtins/array-sort.tq | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/third_party/v8/builtins/array-sort.tq b/third_party/v8/builtins/array-sort.tq index 0f6c720646..6c5da6da39 100644 --- a/third_party/v8/builtins/array-sort.tq +++ b/third_party/v8/builtins/array-sort.tq @@ -325,12 +325,12 @@ module array { builtin CanUseSameAccessor( context: Context, receiver: JSReceiver, initialReceiverMap: Object, initialReceiverLength: Number): Boolean { - const a: JSArray = UnsafeCast(receiver); + const a: JSArray = Cast(receiver) otherwise unreachable; if (a.map != initialReceiverMap) return False; assert(TaggedIsSmi(initialReceiverLength)); let originalLength: Smi = UnsafeCast(initialReceiverLength); - if (UnsafeCast(a.length) != originalLength) return False; + if (a.length != originalLength) return False; return True; }