<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN"
"http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head><meta http-equiv="content-type" content="text/html; charset=utf-8" />
<title>[153292] trunk/Source/JavaScriptCore</title>
</head>
<body>

<style type="text/css"><!--
#msg dl.meta { border: 1px #006 solid; background: #369; padding: 6px; color: #fff; }
#msg dl.meta dt { float: left; width: 6em; font-weight: bold; }
#msg dt:after { content:':';}
#msg dl, #msg dt, #msg ul, #msg li, #header, #footer, #logmsg { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt;  }
#msg dl a { font-weight: bold}
#msg dl a:link    { color:#fc3; }
#msg dl a:active  { color:#ff0; }
#msg dl a:visited { color:#cc6; }
h3 { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; font-weight: bold; }
#msg pre { overflow: auto; background: #ffc; border: 1px #fa0 solid; padding: 6px; }
#logmsg { background: #ffc; border: 1px #fa0 solid; padding: 1em 1em 0 1em; }
#logmsg p, #logmsg pre, #logmsg blockquote { margin: 0 0 1em 0; }
#logmsg p, #logmsg li, #logmsg dt, #logmsg dd { line-height: 14pt; }
#logmsg h1, #logmsg h2, #logmsg h3, #logmsg h4, #logmsg h5, #logmsg h6 { margin: .5em 0; }
#logmsg h1:first-child, #logmsg h2:first-child, #logmsg h3:first-child, #logmsg h4:first-child, #logmsg h5:first-child, #logmsg h6:first-child { margin-top: 0; }
#logmsg ul, #logmsg ol { padding: 0; list-style-position: inside; margin: 0 0 0 1em; }
#logmsg ul { text-indent: -1em; padding-left: 1em; }#logmsg ol { text-indent: -1.5em; padding-left: 1.5em; }
#logmsg > ul, #logmsg > ol { margin: 0 0 1em 0; }
#logmsg pre { background: #eee; padding: 1em; }
#logmsg blockquote { border: 1px solid #fa0; border-left-width: 10px; padding: 1em 1em 0 1em; background: white;}
#logmsg dl { margin: 0; }
#logmsg dt { font-weight: bold; }
#logmsg dd { margin: 0; padding: 0 0 0.5em 0; }
#logmsg dd:before { content:'\00bb';}
#logmsg table { border-spacing: 0px; border-collapse: collapse; border-top: 4px solid #fa0; border-bottom: 1px solid #fa0; background: #fff; }
#logmsg table th { text-align: left; font-weight: normal; padding: 0.2em 0.5em; border-top: 1px dotted #fa0; }
#logmsg table td { text-align: right; border-top: 1px dotted #fa0; padding: 0.2em 0.5em; }
#logmsg table thead th { text-align: center; border-bottom: 1px solid #fa0; }
#logmsg table th.Corner { text-align: left; }
#logmsg hr { border: none 0; border-top: 2px dashed #fa0; height: 1px; }
#header, #footer { color: #fff; background: #636; border: 1px #300 solid; padding: 6px; }
#patch { width: 100%; }
#patch h4 {font-family: verdana,arial,helvetica,sans-serif;font-size:10pt;padding:8px;background:#369;color:#fff;margin:0;}
#patch .propset h4, #patch .binary h4 {margin:0;}
#patch pre {padding:0;line-height:1.2em;margin:0;}
#patch .diff {width:100%;background:#eee;padding: 0 0 10px 0;overflow:auto;}
#patch .propset .diff, #patch .binary .diff  {padding:10px 0;}
#patch span {display:block;padding:0 10px;}
#patch .modfile, #patch .addfile, #patch .delfile, #patch .propset, #patch .binary, #patch .copfile {border:1px solid #ccc;margin:10px 0;}
#patch ins {background:#dfd;text-decoration:none;display:block;padding:0 10px;}
#patch del {background:#fdd;text-decoration:none;display:block;padding:0 10px;}
#patch .lines, .info {color:#888;background:#fff;}
--></style>
<div id="msg">
<dl class="meta">
<dt>Revision</dt> <dd><a href="http://trac.webkit.org/projects/webkit/changeset/153292">153292</a></dd>
<dt>Author</dt> <dd>oliver@apple.com</dd>
<dt>Date</dt> <dd>2013-07-24 21:05:25 -0700 (Wed, 24 Jul 2013)</dd>
</dl>

<h3>Log Message</h3>
<pre>fourthTier: NodeExitsForward shouldn't be duplicated in NodeType
https://bugs.webkit.org/show_bug.cgi?id=118956

Reviewed by Sam Weinig.

We had two way of expressing that something exits forward: the NodeExitsForward
flag and the word 'Forward' in the NodeType. That's kind of dumb. This patch
makes it just be a flag.

* dfg/DFGAbstractInterpreterInlines.h:
(JSC::DFG::::executeEffects):
* dfg/DFGArgumentsSimplificationPhase.cpp:
(JSC::DFG::ArgumentsSimplificationPhase::run):
* dfg/DFGCSEPhase.cpp:
(JSC::DFG::CSEPhase::int32ToDoubleCSE):
(JSC::DFG::CSEPhase::checkStructureElimination):
(JSC::DFG::CSEPhase::structureTransitionWatchpointElimination):
(JSC::DFG::CSEPhase::putStructureStoreElimination):
(JSC::DFG::CSEPhase::checkArrayElimination):
(JSC::DFG::CSEPhase::performNodeCSE):
* dfg/DFGConstantFoldingPhase.cpp:
(JSC::DFG::ConstantFoldingPhase::foldConstants):
* dfg/DFGFixupPhase.cpp:
(JSC::DFG::FixupPhase::fixupNode):
(JSC::DFG::FixupPhase::injectInt32ToDoubleNode):
* dfg/DFGMinifiedNode.h:
(JSC::DFG::belongsInMinifiedGraph):
(JSC::DFG::MinifiedNode::hasChild):
* dfg/DFGNode.h:
(JSC::DFG::Node::convertToStructureTransitionWatchpoint):
(JSC::DFG::Node::hasStructureSet):
(JSC::DFG::Node::hasStructure):
(JSC::DFG::Node::hasArrayMode):
(JSC::DFG::Node::willHaveCodeGenOrOSR):
* dfg/DFGNodeType.h:
(DFG):
(JSC::DFG::needsOSRForwardRewiring):
* dfg/DFGPredictionPropagationPhase.cpp:
(JSC::DFG::PredictionPropagationPhase::propagate):
* dfg/DFGSafeToExecute.h:
(JSC::DFG::safeToExecute):
* dfg/DFGSpeculativeJIT.cpp:
(JSC::DFG::SpeculativeJIT::compileInt32ToDouble):
* dfg/DFGSpeculativeJIT32_64.cpp:
(JSC::DFG::SpeculativeJIT::compile):
* dfg/DFGSpeculativeJIT64.cpp:
(JSC::DFG::SpeculativeJIT::compile):
* dfg/DFGTypeCheckHoistingPhase.cpp:
(JSC::DFG::TypeCheckHoistingPhase::run):
(JSC::DFG::TypeCheckHoistingPhase::identifyRedundantStructureChecks):
(JSC::DFG::TypeCheckHoistingPhase::identifyRedundantArrayChecks):
* dfg/DFGVariableEventStream.cpp:
(JSC::DFG::VariableEventStream::reconstruct):
* ftl/FTLCapabilities.cpp:
(JSC::FTL::canCompile):
* ftl/FTLLowerDFGToLLVM.cpp:
(JSC::FTL::LowerDFGToLLVM::compileNode):
(JSC::FTL::LowerDFGToLLVM::addExitArgumentForNode):</pre>

<h3>Modified Paths</h3>
<ul>
<li><a href="#trunkSourceJavaScriptCoreChangeLog">trunk/Source/JavaScriptCore/ChangeLog</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGAbstractInterpreterInlinesh">trunk/Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGArgumentsSimplificationPhasecpp">trunk/Source/JavaScriptCore/dfg/DFGArgumentsSimplificationPhase.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGCSEPhasecpp">trunk/Source/JavaScriptCore/dfg/DFGCSEPhase.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGConstantFoldingPhasecpp">trunk/Source/JavaScriptCore/dfg/DFGConstantFoldingPhase.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGFixupPhasecpp">trunk/Source/JavaScriptCore/dfg/DFGFixupPhase.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGMinifiedNodeh">trunk/Source/JavaScriptCore/dfg/DFGMinifiedNode.h</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGNodeh">trunk/Source/JavaScriptCore/dfg/DFGNode.h</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGNodeTypeh">trunk/Source/JavaScriptCore/dfg/DFGNodeType.h</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGPredictionPropagationPhasecpp">trunk/Source/JavaScriptCore/dfg/DFGPredictionPropagationPhase.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGSafeToExecuteh">trunk/Source/JavaScriptCore/dfg/DFGSafeToExecute.h</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGSpeculativeJITcpp">trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGSpeculativeJIT32_64cpp">trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGSpeculativeJIT64cpp">trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGTypeCheckHoistingPhasecpp">trunk/Source/JavaScriptCore/dfg/DFGTypeCheckHoistingPhase.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGVariableEventStreamcpp">trunk/Source/JavaScriptCore/dfg/DFGVariableEventStream.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreftlFTLCapabilitiescpp">trunk/Source/JavaScriptCore/ftl/FTLCapabilities.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreftlFTLLowerDFGToLLVMcpp">trunk/Source/JavaScriptCore/ftl/FTLLowerDFGToLLVM.cpp</a></li>
</ul>

</div>
<div id="patch">
<h3>Diff</h3>
<a id="trunkSourceJavaScriptCoreChangeLog"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/ChangeLog (153291 => 153292)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/ChangeLog        2013-07-25 04:05:22 UTC (rev 153291)
+++ trunk/Source/JavaScriptCore/ChangeLog        2013-07-25 04:05:25 UTC (rev 153292)
</span><span class="lines">@@ -1,5 +1,66 @@
</span><span class="cx"> 2013-07-21  Filip Pizlo  &lt;fpizlo@apple.com&gt;
</span><span class="cx"> 
</span><ins>+        fourthTier: NodeExitsForward shouldn't be duplicated in NodeType
+        https://bugs.webkit.org/show_bug.cgi?id=118956
+
+        Reviewed by Sam Weinig.
+        
+        We had two way of expressing that something exits forward: the NodeExitsForward
+        flag and the word 'Forward' in the NodeType. That's kind of dumb. This patch
+        makes it just be a flag.
+
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::::executeEffects):
+        * dfg/DFGArgumentsSimplificationPhase.cpp:
+        (JSC::DFG::ArgumentsSimplificationPhase::run):
+        * dfg/DFGCSEPhase.cpp:
+        (JSC::DFG::CSEPhase::int32ToDoubleCSE):
+        (JSC::DFG::CSEPhase::checkStructureElimination):
+        (JSC::DFG::CSEPhase::structureTransitionWatchpointElimination):
+        (JSC::DFG::CSEPhase::putStructureStoreElimination):
+        (JSC::DFG::CSEPhase::checkArrayElimination):
+        (JSC::DFG::CSEPhase::performNodeCSE):
+        * dfg/DFGConstantFoldingPhase.cpp:
+        (JSC::DFG::ConstantFoldingPhase::foldConstants):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        (JSC::DFG::FixupPhase::injectInt32ToDoubleNode):
+        * dfg/DFGMinifiedNode.h:
+        (JSC::DFG::belongsInMinifiedGraph):
+        (JSC::DFG::MinifiedNode::hasChild):
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::convertToStructureTransitionWatchpoint):
+        (JSC::DFG::Node::hasStructureSet):
+        (JSC::DFG::Node::hasStructure):
+        (JSC::DFG::Node::hasArrayMode):
+        (JSC::DFG::Node::willHaveCodeGenOrOSR):
+        * dfg/DFGNodeType.h:
+        (DFG):
+        (JSC::DFG::needsOSRForwardRewiring):
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        (JSC::DFG::PredictionPropagationPhase::propagate):
+        * dfg/DFGSafeToExecute.h:
+        (JSC::DFG::safeToExecute):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileInt32ToDouble):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGTypeCheckHoistingPhase.cpp:
+        (JSC::DFG::TypeCheckHoistingPhase::run):
+        (JSC::DFG::TypeCheckHoistingPhase::identifyRedundantStructureChecks):
+        (JSC::DFG::TypeCheckHoistingPhase::identifyRedundantArrayChecks):
+        * dfg/DFGVariableEventStream.cpp:
+        (JSC::DFG::VariableEventStream::reconstruct):
+        * ftl/FTLCapabilities.cpp:
+        (JSC::FTL::canCompile):
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::LowerDFGToLLVM::compileNode):
+        (JSC::FTL::LowerDFGToLLVM::addExitArgumentForNode):
+
+2013-07-21  Filip Pizlo  &lt;fpizlo@apple.com&gt;
+
</ins><span class="cx">         fourthTier: It should be possible for a DFG::Node to claim to exit to one CodeOrigin, but then claim that it belongs to a different CodeOrigin for all other purposes
</span><span class="cx">         https://bugs.webkit.org/show_bug.cgi?id=118946
</span><span class="cx"> 
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGAbstractInterpreterInlinesh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h (153291 => 153292)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h        2013-07-25 04:05:22 UTC (rev 153291)
+++ trunk/Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h        2013-07-25 04:05:25 UTC (rev 153292)
</span><span class="lines">@@ -293,9 +293,8 @@
</span><span class="cx">         forNode(node).setType(SpecInt32);
</span><span class="cx">         break;
</span><span class="cx">     }
</span><del>-
-    case Int32ToDouble:
-    case ForwardInt32ToDouble: {
</del><ins>+        
+    case Int32ToDouble: {
</ins><span class="cx">         JSValue child = forNode(node-&gt;child1()).value();
</span><span class="cx">         if (child &amp;&amp; child.isNumber()
</span><span class="cx">             &amp;&amp; trySetConstant(node, JSValue(JSValue::EncodeAsDouble, child.asNumber()))) {
</span><span class="lines">@@ -1244,8 +1243,7 @@
</span><span class="cx">         break;
</span><span class="cx">     }
</span><span class="cx"> 
</span><del>-    case CheckStructure:
-    case ForwardCheckStructure: {
</del><ins>+    case CheckStructure: {
</ins><span class="cx">         // FIXME: We should be able to propagate the structure sets of constants (i.e. prototypes).
</span><span class="cx">         AbstractValue&amp; value = forNode(node-&gt;child1());
</span><span class="cx">         ASSERT(!(value.m_type &amp; ~SpecCell)); // Edge filtering should have already ensured this.
</span><span class="lines">@@ -1274,8 +1272,7 @@
</span><span class="cx">         break;
</span><span class="cx">     }
</span><span class="cx">         
</span><del>-    case StructureTransitionWatchpoint:
-    case ForwardStructureTransitionWatchpoint: {
</del><ins>+    case StructureTransitionWatchpoint: {
</ins><span class="cx">         AbstractValue&amp; value = forNode(node-&gt;child1());
</span><span class="cx"> 
</span><span class="cx">         // It's only valid to issue a structure transition watchpoint if we already
</span><span class="lines">@@ -1307,7 +1304,6 @@
</span><span class="cx">     case ReallocatePropertyStorage:
</span><span class="cx">         forNode(node).clear(); // The result is not a JS value.
</span><span class="cx">         break;
</span><del>-    case ForwardCheckArray:
</del><span class="cx">     case CheckArray: {
</span><span class="cx">         if (node-&gt;arrayMode().alreadyChecked(m_graph, node, forNode(node-&gt;child1()))) {
</span><span class="cx">             m_state.setFoundConstants(true);
</span><span class="lines">@@ -1495,7 +1491,6 @@
</span><span class="cx">         break;
</span><span class="cx"> 
</span><span class="cx">     case ForceOSRExit:
</span><del>-    case ForwardForceOSRExit:
</del><span class="cx">         node-&gt;setCanExit(true);
</span><span class="cx">         m_state.setIsValid(false);
</span><span class="cx">         break;
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGArgumentsSimplificationPhasecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGArgumentsSimplificationPhase.cpp (153291 => 153292)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGArgumentsSimplificationPhase.cpp        2013-07-25 04:05:22 UTC (rev 153291)
+++ trunk/Source/JavaScriptCore/dfg/DFGArgumentsSimplificationPhase.cpp        2013-07-25 04:05:25 UTC (rev 153292)
</span><span class="lines">@@ -327,11 +327,8 @@
</span><span class="cx">                     break;
</span><span class="cx">                     
</span><span class="cx">                 case CheckStructure:
</span><del>-                case ForwardCheckStructure:
</del><span class="cx">                 case StructureTransitionWatchpoint:
</span><del>-                case ForwardStructureTransitionWatchpoint:
</del><span class="cx">                 case CheckArray:
</span><del>-                case ForwardCheckArray:
</del><span class="cx">                     // We don't care about these because if we get uses of the relevant
</span><span class="cx">                     // variable then we can safely get rid of these, too. This of course
</span><span class="cx">                     // relies on there not being any information transferred by the CFA
</span><span class="lines">@@ -517,11 +514,8 @@
</span><span class="cx">                 }
</span><span class="cx">                     
</span><span class="cx">                 case CheckStructure:
</span><del>-                case ForwardCheckStructure:
</del><span class="cx">                 case StructureTransitionWatchpoint:
</span><del>-                case ForwardStructureTransitionWatchpoint:
-                case CheckArray:
-                case ForwardCheckArray: {
</del><ins>+                case CheckArray: {
</ins><span class="cx">                     // We can just get rid of this node, if it references a phantom argument.
</span><span class="cx">                     if (!isOKToOptimize(node-&gt;child1().node()))
</span><span class="cx">                         break;
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGCSEPhasecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGCSEPhase.cpp (153291 => 153292)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGCSEPhase.cpp        2013-07-25 04:05:22 UTC (rev 153291)
+++ trunk/Source/JavaScriptCore/dfg/DFGCSEPhase.cpp        2013-07-25 04:05:25 UTC (rev 153292)
</span><span class="lines">@@ -140,7 +140,6 @@
</span><span class="cx">                 return 0;
</span><span class="cx">             switch (otherNode-&gt;op()) {
</span><span class="cx">             case Int32ToDouble:
</span><del>-            case ForwardInt32ToDouble:
</del><span class="cx">                 if (otherNode-&gt;child1() == node-&gt;child1())
</span><span class="cx">                     return otherNode;
</span><span class="cx">                 break;
</span><span class="lines">@@ -448,14 +447,12 @@
</span><span class="cx"> 
</span><span class="cx">             switch (node-&gt;op()) {
</span><span class="cx">             case CheckStructure:
</span><del>-            case ForwardCheckStructure:
</del><span class="cx">                 if (node-&gt;child1() == child1
</span><span class="cx">                     &amp;&amp; structureSet.isSupersetOf(node-&gt;structureSet()))
</span><span class="cx">                     return true;
</span><span class="cx">                 break;
</span><span class="cx">                 
</span><span class="cx">             case StructureTransitionWatchpoint:
</span><del>-            case ForwardStructureTransitionWatchpoint:
</del><span class="cx">                 if (node-&gt;child1() == child1
</span><span class="cx">                     &amp;&amp; structureSet.contains(node-&gt;structure()))
</span><span class="cx">                     return true;
</span><span class="lines">@@ -507,7 +504,6 @@
</span><span class="cx"> 
</span><span class="cx">             switch (node-&gt;op()) {
</span><span class="cx">             case CheckStructure:
</span><del>-            case ForwardCheckStructure:
</del><span class="cx">                 if (node-&gt;child1() == child1
</span><span class="cx">                     &amp;&amp; node-&gt;structureSet().containsOnly(structure))
</span><span class="cx">                     return true;
</span><span class="lines">@@ -532,7 +528,6 @@
</span><span class="cx">                 return false;
</span><span class="cx">                 
</span><span class="cx">             case StructureTransitionWatchpoint:
</span><del>-            case ForwardStructureTransitionWatchpoint:
</del><span class="cx">                 if (node-&gt;structure() == structure &amp;&amp; node-&gt;child1() == child1)
</span><span class="cx">                     return true;
</span><span class="cx">                 break;
</span><span class="lines">@@ -560,7 +555,6 @@
</span><span class="cx">                 break;
</span><span class="cx">             switch (node-&gt;op()) {
</span><span class="cx">             case CheckStructure:
</span><del>-            case ForwardCheckStructure:
</del><span class="cx">                 return 0;
</span><span class="cx">                 
</span><span class="cx">             case PhantomPutStructure:
</span><span class="lines">@@ -776,7 +770,6 @@
</span><span class="cx">                 break;
</span><span class="cx">                 
</span><span class="cx">             case CheckArray:
</span><del>-            case ForwardCheckArray:
</del><span class="cx">                 if (node-&gt;child1() == child1 &amp;&amp; node-&gt;arrayMode() == arrayMode)
</span><span class="cx">                     return true;
</span><span class="cx">                 break;
</span><span class="lines">@@ -1104,7 +1097,6 @@
</span><span class="cx">             break;
</span><span class="cx">             
</span><span class="cx">         case Int32ToDouble:
</span><del>-        case ForwardInt32ToDouble:
</del><span class="cx">             if (cseMode == StoreElimination)
</span><span class="cx">                 break;
</span><span class="cx">             setReplacement(int32ToDoubleCSE(node));
</span><span class="lines">@@ -1305,7 +1297,6 @@
</span><span class="cx">         }
</span><span class="cx">             
</span><span class="cx">         case CheckStructure:
</span><del>-        case ForwardCheckStructure:
</del><span class="cx">             if (cseMode == StoreElimination)
</span><span class="cx">                 break;
</span><span class="cx">             if (checkStructureElimination(node-&gt;structureSet(), node-&gt;child1().node()))
</span><span class="lines">@@ -1313,7 +1304,6 @@
</span><span class="cx">             break;
</span><span class="cx">             
</span><span class="cx">         case StructureTransitionWatchpoint:
</span><del>-        case ForwardStructureTransitionWatchpoint:
</del><span class="cx">             if (cseMode == StoreElimination)
</span><span class="cx">                 break;
</span><span class="cx">             if (structureTransitionWatchpointElimination(node-&gt;structure(), node-&gt;child1().node()))
</span><span class="lines">@@ -1341,7 +1331,6 @@
</span><span class="cx">             break;
</span><span class="cx">                 
</span><span class="cx">         case CheckArray:
</span><del>-        case ForwardCheckArray:
</del><span class="cx">             if (cseMode == StoreElimination)
</span><span class="cx">                 break;
</span><span class="cx">             if (checkArrayElimination(node-&gt;child1().node(), node-&gt;arrayMode()))
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGConstantFoldingPhasecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGConstantFoldingPhase.cpp (153291 => 153292)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGConstantFoldingPhase.cpp        2013-07-25 04:05:22 UTC (rev 153291)
+++ trunk/Source/JavaScriptCore/dfg/DFGConstantFoldingPhase.cpp        2013-07-25 04:05:25 UTC (rev 153292)
</span><span class="lines">@@ -93,7 +93,6 @@
</span><span class="cx">             }
</span><span class="cx">                     
</span><span class="cx">             case CheckStructure:
</span><del>-            case ForwardCheckStructure:
</del><span class="cx">             case ArrayifyToStructure: {
</span><span class="cx">                 AbstractValue&amp; value = m_state.forNode(node-&gt;child1());
</span><span class="cx">                 StructureSet set;
</span><span class="lines">@@ -130,7 +129,6 @@
</span><span class="cx">             }
</span><span class="cx">                 
</span><span class="cx">             case CheckArray:
</span><del>-            case ForwardCheckArray:
</del><span class="cx">             case Arrayify: {
</span><span class="cx">                 if (!node-&gt;arrayMode().alreadyChecked(m_graph, node, m_state.forNode(node-&gt;child1())))
</span><span class="cx">                     break;
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGFixupPhasecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGFixupPhase.cpp (153291 => 153292)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGFixupPhase.cpp        2013-07-25 04:05:22 UTC (rev 153291)
+++ trunk/Source/JavaScriptCore/dfg/DFGFixupPhase.cpp        2013-07-25 04:05:25 UTC (rev 153292)
</span><span class="lines">@@ -785,9 +785,7 @@
</span><span class="cx">             
</span><span class="cx">         case CheckExecutable:
</span><span class="cx">         case CheckStructure:
</span><del>-        case ForwardCheckStructure:
</del><span class="cx">         case StructureTransitionWatchpoint:
</span><del>-        case ForwardStructureTransitionWatchpoint:
</del><span class="cx">         case CheckFunction:
</span><span class="cx">         case PutById:
</span><span class="cx">         case PutByIdDirect:
</span><span class="lines">@@ -796,8 +794,7 @@
</span><span class="cx">             break;
</span><span class="cx">         }
</span><span class="cx">             
</span><del>-        case CheckArray:
-        case ForwardCheckArray: {
</del><ins>+        case CheckArray: {
</ins><span class="cx">             switch (node-&gt;arrayMode().type()) {
</span><span class="cx">             case Array::String:
</span><span class="cx">                 setUseKindAndUnboxIfProfitable&lt;StringUse&gt;(node-&gt;child1());
</span><span class="lines">@@ -866,7 +863,6 @@
</span><span class="cx">         case Phi:
</span><span class="cx">         case Upsilon:
</span><span class="cx">         case GetArgument:
</span><del>-        case ForwardInt32ToDouble:
</del><span class="cx">         case PhantomPutStructure:
</span><span class="cx">         case GetIndexedPropertyStorage:
</span><span class="cx">         case LastNodeType:
</span><span class="lines">@@ -923,7 +919,6 @@
</span><span class="cx">         case ThrowReferenceError:
</span><span class="cx">         case CountExecution:
</span><span class="cx">         case ForceOSRExit:
</span><del>-        case ForwardForceOSRExit:
</del><span class="cx">         case CheckWatchdogTimer:
</span><span class="cx">             break;
</span><span class="cx"> #else
</span><span class="lines">@@ -1391,9 +1386,10 @@
</span><span class="cx">     void injectInt32ToDoubleNode(Edge&amp; edge, UseKind useKind = NumberUse, SpeculationDirection direction = BackwardSpeculation)
</span><span class="cx">     {
</span><span class="cx">         Node* result = m_insertionSet.insertNode(
</span><del>-            m_indexInBlock, SpecDouble, 
-            direction == BackwardSpeculation ? Int32ToDouble : ForwardInt32ToDouble,
</del><ins>+            m_indexInBlock, SpecDouble, Int32ToDouble,
</ins><span class="cx">             m_currentNode-&gt;codeOrigin, Edge(edge.node(), NumberUse));
</span><ins>+        if (direction == ForwardSpeculation)
+            result-&gt;mergeFlags(NodeExitsForward);
</ins><span class="cx">         
</span><span class="cx"> #if DFG_ENABLE(DEBUG_PROPAGATION_VERBOSE)
</span><span class="cx">         dataLogF(
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGMinifiedNodeh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGMinifiedNode.h (153291 => 153292)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGMinifiedNode.h        2013-07-25 04:05:22 UTC (rev 153291)
+++ trunk/Source/JavaScriptCore/dfg/DFGMinifiedNode.h        2013-07-25 04:05:25 UTC (rev 153292)
</span><span class="lines">@@ -45,7 +45,6 @@
</span><span class="cx">     case WeakJSConstant:
</span><span class="cx">     case ValueToInt32:
</span><span class="cx">     case Int32ToDouble:
</span><del>-    case ForwardInt32ToDouble:
</del><span class="cx">     case UInt32ToNumber:
</span><span class="cx">     case DoubleAsInt32:
</span><span class="cx">     case PhantomArguments:
</span><span class="lines">@@ -103,7 +102,6 @@
</span><span class="cx">         switch (type) {
</span><span class="cx">         case ValueToInt32:
</span><span class="cx">         case Int32ToDouble:
</span><del>-        case ForwardInt32ToDouble:
</del><span class="cx">         case UInt32ToNumber:
</span><span class="cx">         case DoubleAsInt32:
</span><span class="cx">             return true;
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGNodeh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGNode.h (153291 => 153292)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGNode.h        2013-07-25 04:05:22 UTC (rev 153291)
+++ trunk/Source/JavaScriptCore/dfg/DFGNode.h        2013-07-25 04:05:25 UTC (rev 153292)
</span><span class="lines">@@ -396,14 +396,11 @@
</span><span class="cx">     
</span><span class="cx">     void convertToStructureTransitionWatchpoint(Structure* structure)
</span><span class="cx">     {
</span><del>-        ASSERT(m_op == CheckStructure || m_op == ForwardCheckStructure || m_op == ArrayifyToStructure);
</del><ins>+        ASSERT(m_op == CheckStructure || m_op == ArrayifyToStructure);
</ins><span class="cx">         ASSERT(!child2());
</span><span class="cx">         ASSERT(!child3());
</span><span class="cx">         m_opInfo = bitwise_cast&lt;uintptr_t&gt;(structure);
</span><del>-        if (m_op == CheckStructure || m_op == ArrayifyToStructure)
-            m_op = StructureTransitionWatchpoint;
-        else
-            m_op = ForwardStructureTransitionWatchpoint;
</del><ins>+        m_op = StructureTransitionWatchpoint;
</ins><span class="cx">     }
</span><span class="cx">     
</span><span class="cx">     void convertToStructureTransitionWatchpoint()
</span><span class="lines">@@ -927,7 +924,6 @@
</span><span class="cx">     {
</span><span class="cx">         switch (op()) {
</span><span class="cx">         case CheckStructure:
</span><del>-        case ForwardCheckStructure:
</del><span class="cx">             return true;
</span><span class="cx">         default:
</span><span class="cx">             return false;
</span><span class="lines">@@ -944,7 +940,6 @@
</span><span class="cx">     {
</span><span class="cx">         switch (op()) {
</span><span class="cx">         case StructureTransitionWatchpoint:
</span><del>-        case ForwardStructureTransitionWatchpoint:
</del><span class="cx">         case ArrayifyToStructure:
</span><span class="cx">         case NewObject:
</span><span class="cx">         case NewStringObject:
</span><span class="lines">@@ -1005,7 +1000,6 @@
</span><span class="cx">         case StringCharAt:
</span><span class="cx">         case StringCharCodeAt:
</span><span class="cx">         case CheckArray:
</span><del>-        case ForwardCheckArray:
</del><span class="cx">         case Arrayify:
</span><span class="cx">         case ArrayifyToStructure:
</span><span class="cx">         case ArrayPush:
</span><span class="lines">@@ -1086,7 +1080,6 @@
</span><span class="cx">         case ZombieHint:
</span><span class="cx">         case MovHintAndCheck:
</span><span class="cx">         case Int32ToDouble:
</span><del>-        case ForwardInt32ToDouble:
</del><span class="cx">         case ValueToInt32:
</span><span class="cx">         case UInt32ToNumber:
</span><span class="cx">         case DoubleAsInt32:
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGNodeTypeh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGNodeType.h (153291 => 153292)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGNodeType.h        2013-07-25 04:05:22 UTC (rev 153291)
+++ trunk/Source/JavaScriptCore/dfg/DFGNodeType.h        2013-07-25 04:05:25 UTC (rev 153292)
</span><span class="lines">@@ -97,7 +97,6 @@
</span><span class="cx">     /* Used to cast known integers to doubles, so as to separate the double form */\
</span><span class="cx">     /* of the value from the integer form. */\
</span><span class="cx">     macro(Int32ToDouble, NodeResultNumber) \
</span><del>-    macro(ForwardInt32ToDouble, NodeResultNumber | NodeExitsForward) \
</del><span class="cx">     /* Used to speculate that a double value is actually an integer. */\
</span><span class="cx">     macro(DoubleAsInt32, NodeResultInt32 | NodeExitsForward) \
</span><span class="cx">     \
</span><span class="lines">@@ -131,7 +130,6 @@
</span><span class="cx">     macro(PutByIdDirect, NodeMustGenerate | NodeClobbersWorld) \
</span><span class="cx">     macro(CheckStructure, NodeMustGenerate) \
</span><span class="cx">     macro(CheckExecutable, NodeMustGenerate) \
</span><del>-    macro(ForwardCheckStructure, NodeMustGenerate | NodeExitsForward) \
</del><span class="cx">     /* Transition watchpoints are a contract between the party setting the watchpoint */\
</span><span class="cx">     /* and the runtime system, where the party promises that the child object once had */\
</span><span class="cx">     /* the structure being watched, and the runtime system in turn promises that the */\
</span><span class="lines">@@ -144,14 +142,12 @@
</span><span class="cx">     /* the object's structure does not need to be rechecked due to side-effecting */\
</span><span class="cx">     /* (clobbering) operations. */\
</span><span class="cx">     macro(StructureTransitionWatchpoint, NodeMustGenerate) \
</span><del>-    macro(ForwardStructureTransitionWatchpoint, NodeMustGenerate | NodeExitsForward) \
</del><span class="cx">     macro(PutStructure, NodeMustGenerate) \
</span><span class="cx">     macro(PhantomPutStructure, NodeMustGenerate | NodeDoesNotExit) \
</span><span class="cx">     macro(AllocatePropertyStorage, NodeMustGenerate | NodeDoesNotExit | NodeResultStorage) \
</span><span class="cx">     macro(ReallocatePropertyStorage, NodeMustGenerate | NodeDoesNotExit | NodeResultStorage) \
</span><span class="cx">     macro(GetButterfly, NodeResultStorage) \
</span><span class="cx">     macro(CheckArray, NodeMustGenerate) \
</span><del>-    macro(ForwardCheckArray, NodeMustGenerate | NodeExitsForward) \
</del><span class="cx">     macro(Arrayify, NodeMustGenerate) \
</span><span class="cx">     macro(ArrayifyToStructure, NodeMustGenerate) \
</span><span class="cx">     macro(GetIndexedPropertyStorage, NodeResultStorage) \
</span><span class="lines">@@ -262,7 +258,6 @@
</span><span class="cx">     /* this point, but execution does continue in the basic block - just in a */\
</span><span class="cx">     /* different compiler. */\
</span><span class="cx">     macro(ForceOSRExit, NodeMustGenerate) \
</span><del>-    macro(ForwardForceOSRExit, NodeMustGenerate | NodeExitsForward) \
</del><span class="cx">     \
</span><span class="cx">     /* Checks the watchdog timer. If the timer has fired, we OSR exit to the */ \
</span><span class="cx">     /* baseline JIT to redo the watchdog timer check, and service the timer. */ \
</span><span class="lines">@@ -299,7 +294,6 @@
</span><span class="cx"> {
</span><span class="cx">     switch (op) {
</span><span class="cx">     case Int32ToDouble:
</span><del>-    case ForwardInt32ToDouble:
</del><span class="cx">     case ValueToInt32:
</span><span class="cx">     case UInt32ToNumber:
</span><span class="cx">     case DoubleAsInt32:
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGPredictionPropagationPhasecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGPredictionPropagationPhase.cpp (153291 => 153292)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGPredictionPropagationPhase.cpp        2013-07-25 04:05:22 UTC (rev 153291)
+++ trunk/Source/JavaScriptCore/dfg/DFGPredictionPropagationPhase.cpp        2013-07-25 04:05:25 UTC (rev 153292)
</span><span class="lines">@@ -467,7 +467,6 @@
</span><span class="cx">         case PutByValAlias:
</span><span class="cx">         case GetArrayLength:
</span><span class="cx">         case Int32ToDouble:
</span><del>-        case ForwardInt32ToDouble:
</del><span class="cx">         case DoubleAsInt32:
</span><span class="cx">         case GetLocalUnlinked:
</span><span class="cx">         case GetMyArgumentsLength:
</span><span class="lines">@@ -475,7 +474,6 @@
</span><span class="cx">         case PhantomPutStructure:
</span><span class="cx">         case PhantomArguments:
</span><span class="cx">         case CheckArray:
</span><del>-        case ForwardCheckArray:
</del><span class="cx">         case Arrayify:
</span><span class="cx">         case ArrayifyToStructure:
</span><span class="cx">         case MovHint:
</span><span class="lines">@@ -529,13 +527,10 @@
</span><span class="cx">         case CheckHasInstance:
</span><span class="cx">         case ThrowReferenceError:
</span><span class="cx">         case ForceOSRExit:
</span><del>-        case ForwardForceOSRExit:
</del><span class="cx">         case SetArgument:
</span><span class="cx">         case CheckStructure:
</span><span class="cx">         case CheckExecutable:
</span><del>-        case ForwardCheckStructure:
</del><span class="cx">         case StructureTransitionWatchpoint:
</span><del>-        case ForwardStructureTransitionWatchpoint:
</del><span class="cx">         case CheckFunction:
</span><span class="cx">         case PutStructure:
</span><span class="cx">         case TearOffActivation:
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGSafeToExecuteh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGSafeToExecute.h (153291 => 153292)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGSafeToExecute.h        2013-07-25 04:05:22 UTC (rev 153291)
+++ trunk/Source/JavaScriptCore/dfg/DFGSafeToExecute.h        2013-07-25 04:05:25 UTC (rev 153292)
</span><span class="lines">@@ -138,7 +138,6 @@
</span><span class="cx">     case ValueToInt32:
</span><span class="cx">     case UInt32ToNumber:
</span><span class="cx">     case Int32ToDouble:
</span><del>-    case ForwardInt32ToDouble:
</del><span class="cx">     case DoubleAsInt32:
</span><span class="cx">     case ArithAdd:
</span><span class="cx">     case ArithSub:
</span><span class="lines">@@ -158,10 +157,8 @@
</span><span class="cx">     case PutByIdDirect:
</span><span class="cx">     case CheckStructure:
</span><span class="cx">     case CheckExecutable:
</span><del>-    case ForwardCheckStructure:
</del><span class="cx">     case GetButterfly:
</span><span class="cx">     case CheckArray:
</span><del>-    case ForwardCheckArray:
</del><span class="cx">     case Arrayify:
</span><span class="cx">     case ArrayifyToStructure:
</span><span class="cx">     case GetScope:
</span><span class="lines">@@ -232,7 +229,6 @@
</span><span class="cx">     case ThrowReferenceError:
</span><span class="cx">     case CountExecution:
</span><span class="cx">     case ForceOSRExit:
</span><del>-    case ForwardForceOSRExit:
</del><span class="cx">     case CheckWatchdogTimer:
</span><span class="cx">     case StringFromCharCode:
</span><span class="cx">         return true;
</span><span class="lines">@@ -252,7 +248,6 @@
</span><span class="cx">             graph, node, state.forNode(graph.varArgChild(node, 0)));
</span><span class="cx"> 
</span><span class="cx">     case StructureTransitionWatchpoint:
</span><del>-    case ForwardStructureTransitionWatchpoint:
</del><span class="cx">         return state.forNode(node-&gt;child1()).m_futurePossibleStructure.isSubsetOf(
</span><span class="cx">             StructureSet(node-&gt;structure()));
</span><span class="cx">         
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGSpeculativeJITcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp (153291 => 153292)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp        2013-07-25 04:05:22 UTC (rev 153291)
+++ trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp        2013-07-25 04:05:25 UTC (rev 153292)
</span><span class="lines">@@ -2488,7 +2488,7 @@
</span><span class="cx">         MacroAssembler::AboveOrEqual, op1GPR, GPRInfo::tagTypeNumberRegister);
</span><span class="cx">     
</span><span class="cx">     if (needsTypeCheck(node-&gt;child1(), SpecNumber)) {
</span><del>-        if (node-&gt;op() == ForwardInt32ToDouble) {
</del><ins>+        if (node-&gt;flags() &amp; NodeExitsForward) {
</ins><span class="cx">             forwardTypeCheck(
</span><span class="cx">                 JSValueRegs(op1GPR), node-&gt;child1(), SpecNumber,
</span><span class="cx">                 m_jit.branchTest64(MacroAssembler::Zero, op1GPR, GPRInfo::tagTypeNumberRegister),
</span><span class="lines">@@ -2519,7 +2519,7 @@
</span><span class="cx">         MacroAssembler::Equal, op1TagGPR, TrustedImm32(JSValue::Int32Tag));
</span><span class="cx">     
</span><span class="cx">     if (needsTypeCheck(node-&gt;child1(), SpecNumber)) {
</span><del>-        if (node-&gt;op() == ForwardInt32ToDouble) {
</del><ins>+        if (node-&gt;flags() &amp; NodeExitsForward) {
</ins><span class="cx">             forwardTypeCheck(
</span><span class="cx">                 JSValueRegs(op1TagGPR, op1PayloadGPR), node-&gt;child1(), SpecNumber,
</span><span class="cx">                 m_jit.branch32(MacroAssembler::AboveOrEqual, op1TagGPR, TrustedImm32(JSValue::LowestTag)),
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGSpeculativeJIT32_64cpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp (153291 => 153292)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp        2013-07-25 04:05:22 UTC (rev 153291)
+++ trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp        2013-07-25 04:05:25 UTC (rev 153292)
</span><span class="lines">@@ -2220,8 +2220,7 @@
</span><span class="cx">         break;
</span><span class="cx">     }
</span><span class="cx">         
</span><del>-    case Int32ToDouble:
-    case ForwardInt32ToDouble: {
</del><ins>+    case Int32ToDouble: {
</ins><span class="cx">         compileInt32ToDouble(node);
</span><span class="cx">         break;
</span><span class="cx">     }
</span><span class="lines">@@ -2436,7 +2435,6 @@
</span><span class="cx">         break;
</span><span class="cx">     }
</span><span class="cx">         
</span><del>-    case ForwardCheckArray:
</del><span class="cx">     case CheckArray: {
</span><span class="cx">         checkArray(node);
</span><span class="cx">         break;
</span><span class="lines">@@ -3971,8 +3969,7 @@
</span><span class="cx">         break;
</span><span class="cx">     }
</span><span class="cx">         
</span><del>-    case CheckStructure:
-    case ForwardCheckStructure: {
</del><ins>+    case CheckStructure: {
</ins><span class="cx">         SpeculateCellOperand base(this, node-&gt;child1());
</span><span class="cx">         
</span><span class="cx">         ASSERT(node-&gt;structureSet().size());
</span><span class="lines">@@ -4006,8 +4003,7 @@
</span><span class="cx">         break;
</span><span class="cx">     }
</span><span class="cx">         
</span><del>-    case StructureTransitionWatchpoint:
-    case ForwardStructureTransitionWatchpoint: {
</del><ins>+    case StructureTransitionWatchpoint: {
</ins><span class="cx">         // There is a fascinating question here of what to do about array profiling.
</span><span class="cx">         // We *could* try to tell the OSR exit about where the base of the access is.
</span><span class="cx">         // The DFG will have kept it alive, though it may not be in a register, and
</span><span class="lines">@@ -4812,8 +4808,7 @@
</span><span class="cx">         compileIn(node);
</span><span class="cx">         break;
</span><span class="cx"> 
</span><del>-    case ForceOSRExit:
-    case ForwardForceOSRExit: {
</del><ins>+    case ForceOSRExit: {
</ins><span class="cx">         terminateSpeculativeExecution(InadequateCoverage, JSValueRegs(), 0);
</span><span class="cx">         break;
</span><span class="cx">     }
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGSpeculativeJIT64cpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp (153291 => 153292)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp        2013-07-25 04:05:22 UTC (rev 153291)
+++ trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp        2013-07-25 04:05:25 UTC (rev 153292)
</span><span class="lines">@@ -2161,8 +2161,7 @@
</span><span class="cx">         break;
</span><span class="cx">     }
</span><span class="cx">         
</span><del>-    case Int32ToDouble:
-    case ForwardInt32ToDouble: {
</del><ins>+    case Int32ToDouble: {
</ins><span class="cx">         compileInt32ToDouble(node);
</span><span class="cx">         break;
</span><span class="cx">     }
</span><span class="lines">@@ -2372,7 +2371,6 @@
</span><span class="cx">         break;
</span><span class="cx">     }
</span><span class="cx">         
</span><del>-    case ForwardCheckArray:
</del><span class="cx">     case CheckArray: {
</span><span class="cx">         checkArray(node);
</span><span class="cx">         break;
</span><span class="lines">@@ -3880,8 +3878,7 @@
</span><span class="cx">         break;
</span><span class="cx">     }
</span><span class="cx">         
</span><del>-    case CheckStructure:
-    case ForwardCheckStructure: {
</del><ins>+    case CheckStructure: {
</ins><span class="cx">         SpeculateCellOperand base(this, node-&gt;child1());
</span><span class="cx">         
</span><span class="cx">         ASSERT(node-&gt;structureSet().size());
</span><span class="lines">@@ -3921,8 +3918,7 @@
</span><span class="cx">         break;
</span><span class="cx">     }
</span><span class="cx">         
</span><del>-    case StructureTransitionWatchpoint:
-    case ForwardStructureTransitionWatchpoint: {
</del><ins>+    case StructureTransitionWatchpoint: {
</ins><span class="cx">         // There is a fascinating question here of what to do about array profiling.
</span><span class="cx">         // We *could* try to tell the OSR exit about where the base of the access is.
</span><span class="cx">         // The DFG will have kept it alive, though it may not be in a register, and
</span><span class="lines">@@ -4674,8 +4670,7 @@
</span><span class="cx">         m_jit.add64(TrustedImm32(1), MacroAssembler::AbsoluteAddress(node-&gt;executionCounter()-&gt;address()));
</span><span class="cx">         break;
</span><span class="cx"> 
</span><del>-    case ForceOSRExit:
-    case ForwardForceOSRExit: {
</del><ins>+    case ForceOSRExit: {
</ins><span class="cx">         terminateSpeculativeExecution(InadequateCoverage, JSValueRegs(), 0);
</span><span class="cx">         break;
</span><span class="cx">     }
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGTypeCheckHoistingPhasecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGTypeCheckHoistingPhase.cpp (153291 => 153292)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGTypeCheckHoistingPhase.cpp        2013-07-25 04:05:22 UTC (rev 153291)
+++ trunk/Source/JavaScriptCore/dfg/DFGTypeCheckHoistingPhase.cpp        2013-07-25 04:05:25 UTC (rev 153292)
</span><span class="lines">@@ -173,21 +173,23 @@
</span><span class="cx">                     insertionSet.insertNode(
</span><span class="cx">                         indexInBlock, SpecNone, SetLocal, codeOrigin, OpInfo(variable), child1);
</span><span class="cx"> 
</span><del>-                    // Use a ForwardCheckStructure or ForwardCheckArray to indicate that we should exit to the
-                    // next bytecode instruction rather than reexecuting the current one.
</del><ins>+                    // Use NodeExitsForward to indicate that we should exit to the next
+                    // bytecode instruction rather than reexecuting the current one.
+                    Node* newNode = 0;
</ins><span class="cx">                     if (iter-&gt;value.m_structure) {
</span><del>-                        insertionSet.insertNode(
-                            indexInBlock, SpecNone, ForwardCheckStructure, codeOrigin,
</del><ins>+                        newNode = insertionSet.insertNode(
+                            indexInBlock, SpecNone, CheckStructure, codeOrigin,
</ins><span class="cx">                             OpInfo(m_graph.addStructureSet(iter-&gt;value.m_structure)),
</span><span class="cx">                             Edge(child1.node(), CellUse));
</span><span class="cx">                     } else if (iter-&gt;value.m_arrayModeIsValid) {
</span><span class="cx">                         ASSERT(iter-&gt;value.m_arrayModeHoistingOkay);
</span><del>-                        insertionSet.insertNode(
-                            indexInBlock, SpecNone, ForwardCheckArray, codeOrigin,
</del><ins>+                        newNode = insertionSet.insertNode(
+                            indexInBlock, SpecNone, CheckArray, codeOrigin,
</ins><span class="cx">                             OpInfo(iter-&gt;value.m_arrayMode.asWord()),
</span><span class="cx">                             Edge(child1.node(), CellUse));
</span><span class="cx">                     } else
</span><span class="cx">                         RELEASE_ASSERT_NOT_REACHED();
</span><ins>+                    newNode-&gt;mergeFlags(NodeExitsForward);
</ins><span class="cx">                     changed = true;
</span><span class="cx">                     break;
</span><span class="cx">                 }
</span><span class="lines">@@ -226,6 +228,9 @@
</span><span class="cx">                 switch (node-&gt;op()) {
</span><span class="cx">                 case CheckStructure:
</span><span class="cx">                 case StructureTransitionWatchpoint: {
</span><ins>+                    // We currently rely on the fact that we're the only ones who would
+                    // insert these nodes with NodeExitsForward.
+                    RELEASE_ASSERT(!(node-&gt;flags() &amp; NodeExitsForward));
</ins><span class="cx">                     Node* child = node-&gt;child1().node();
</span><span class="cx">                     if (child-&gt;op() != GetLocal)
</span><span class="cx">                         break;
</span><span class="lines">@@ -237,13 +242,6 @@
</span><span class="cx">                     break;
</span><span class="cx">                 }
</span><span class="cx">                     
</span><del>-                case ForwardCheckStructure:
-                case ForwardStructureTransitionWatchpoint:
-                    // We currently rely on the fact that we're the only ones who would
-                    // insert this node.
-                    RELEASE_ASSERT_NOT_REACHED();
-                    break;
-                    
</del><span class="cx">                 case GetByOffset:
</span><span class="cx">                 case PutByOffset:
</span><span class="cx">                 case PutStructure:
</span><span class="lines">@@ -329,6 +327,9 @@
</span><span class="cx">                 Node* node = block-&gt;at(indexInBlock);
</span><span class="cx">                 switch (node-&gt;op()) {
</span><span class="cx">                 case CheckArray: {
</span><ins>+                    // We currently rely on the fact that we're the only ones who would
+                    // insert these nodes with NodeExitsForward.
+                    RELEASE_ASSERT(!(node-&gt;flags() &amp; NodeExitsForward));
</ins><span class="cx">                     Node* child = node-&gt;child1().node();
</span><span class="cx">                     if (child-&gt;op() != GetLocal)
</span><span class="cx">                         break;
</span><span class="lines">@@ -340,12 +341,6 @@
</span><span class="cx">                     break;
</span><span class="cx">                 }
</span><span class="cx"> 
</span><del>-                case ForwardCheckArray:
-                    // We currently rely on the fact that we're the only ones who would
-                    // insert this node.
-                    RELEASE_ASSERT_NOT_REACHED();
-                    break;
-                    
</del><span class="cx">                 case CheckStructure:
</span><span class="cx">                 case StructureTransitionWatchpoint:
</span><span class="cx">                 case GetByOffset:
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGVariableEventStreamcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGVariableEventStream.cpp (153291 => 153292)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGVariableEventStream.cpp        2013-07-25 04:05:22 UTC (rev 153291)
+++ trunk/Source/JavaScriptCore/dfg/DFGVariableEventStream.cpp        2013-07-25 04:05:25 UTC (rev 153292)
</span><span class="lines">@@ -244,7 +244,6 @@
</span><span class="cx">                         continue;
</span><span class="cx">                     switch (node-&gt;op()) {
</span><span class="cx">                     case Int32ToDouble:
</span><del>-                    case ForwardInt32ToDouble:
</del><span class="cx">                         int32ToDoubleID = id;
</span><span class="cx">                         break;
</span><span class="cx">                     case ValueToInt32:
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreftlFTLCapabilitiescpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/ftl/FTLCapabilities.cpp (153291 => 153292)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/ftl/FTLCapabilities.cpp        2013-07-25 04:05:22 UTC (rev 153291)
+++ trunk/Source/JavaScriptCore/ftl/FTLCapabilities.cpp        2013-07-25 04:05:25 UTC (rev 153292)
</span><span class="lines">@@ -54,9 +54,7 @@
</span><span class="cx">     case BitLShift:
</span><span class="cx">     case BitURShift:
</span><span class="cx">     case CheckStructure:
</span><del>-    case ForwardCheckStructure:
</del><span class="cx">     case StructureTransitionWatchpoint:
</span><del>-    case ForwardStructureTransitionWatchpoint:
</del><span class="cx">     case ArrayifyToStructure:
</span><span class="cx">     case PutStructure:
</span><span class="cx">     case PhantomPutStructure:
</span><span class="lines">@@ -81,7 +79,6 @@
</span><span class="cx">     case CompareStrictEqConstant:
</span><span class="cx">     case Jump:
</span><span class="cx">     case ForceOSRExit:
</span><del>-    case ForwardForceOSRExit:
</del><span class="cx">     case Phi:
</span><span class="cx">     case Upsilon:
</span><span class="cx">         // These are OK.
</span><span class="lines">@@ -226,7 +223,7 @@
</span><span class="cx">             }
</span><span class="cx">             
</span><span class="cx">             // We don't care if we can compile anything after a force-exit.
</span><del>-            if (node-&gt;op() == ForceOSRExit || node-&gt;op() == ForwardForceOSRExit)
</del><ins>+            if (node-&gt;op() == ForceOSRExit)
</ins><span class="cx">                 break;
</span><span class="cx">         }
</span><span class="cx">     }
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreftlFTLLowerDFGToLLVMcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/ftl/FTLLowerDFGToLLVM.cpp (153291 => 153292)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/ftl/FTLLowerDFGToLLVM.cpp        2013-07-25 04:05:22 UTC (rev 153291)
+++ trunk/Source/JavaScriptCore/ftl/FTLLowerDFGToLLVM.cpp        2013-07-25 04:05:25 UTC (rev 153292)
</span><span class="lines">@@ -315,11 +315,9 @@
</span><span class="cx">             compileInt32ToDouble();
</span><span class="cx">             break;
</span><span class="cx">         case CheckStructure:
</span><del>-        case ForwardCheckStructure:
</del><span class="cx">             compileCheckStructure();
</span><span class="cx">             break;
</span><span class="cx">         case StructureTransitionWatchpoint:
</span><del>-        case ForwardStructureTransitionWatchpoint:
</del><span class="cx">             compileStructureTransitionWatchpoint();
</span><span class="cx">             break;
</span><span class="cx">         case ArrayifyToStructure:
</span><span class="lines">@@ -396,7 +394,6 @@
</span><span class="cx">             compileReturn();
</span><span class="cx">             break;
</span><span class="cx">         case ForceOSRExit:
</span><del>-        case ForwardForceOSRExit:
</del><span class="cx">             compileForceOSRExit();
</span><span class="cx">             break;
</span><span class="cx">         default:
</span><span class="lines">@@ -2623,7 +2620,6 @@
</span><span class="cx">                         continue;
</span><span class="cx">                     switch (candidate-&gt;op()) {
</span><span class="cx">                     case Int32ToDouble:
</span><del>-                    case ForwardInt32ToDouble:
</del><span class="cx">                         int32ToDouble = candidate;
</span><span class="cx">                         break;
</span><span class="cx">                     case ValueToInt32:
</span></span></pre>
</div>
</div>

</body>
</html>