<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN"
"http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head><meta http-equiv="content-type" content="text/html; charset=utf-8" />
<title>[163765] trunk/Source/JavaScriptCore</title>
</head>
<body>

<style type="text/css"><!--
#msg dl.meta { border: 1px #006 solid; background: #369; padding: 6px; color: #fff; }
#msg dl.meta dt { float: left; width: 6em; font-weight: bold; }
#msg dt:after { content:':';}
#msg dl, #msg dt, #msg ul, #msg li, #header, #footer, #logmsg { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt;  }
#msg dl a { font-weight: bold}
#msg dl a:link    { color:#fc3; }
#msg dl a:active  { color:#ff0; }
#msg dl a:visited { color:#cc6; }
h3 { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; font-weight: bold; }
#msg pre { overflow: auto; background: #ffc; border: 1px #fa0 solid; padding: 6px; }
#logmsg { background: #ffc; border: 1px #fa0 solid; padding: 1em 1em 0 1em; }
#logmsg p, #logmsg pre, #logmsg blockquote { margin: 0 0 1em 0; }
#logmsg p, #logmsg li, #logmsg dt, #logmsg dd { line-height: 14pt; }
#logmsg h1, #logmsg h2, #logmsg h3, #logmsg h4, #logmsg h5, #logmsg h6 { margin: .5em 0; }
#logmsg h1:first-child, #logmsg h2:first-child, #logmsg h3:first-child, #logmsg h4:first-child, #logmsg h5:first-child, #logmsg h6:first-child { margin-top: 0; }
#logmsg ul, #logmsg ol { padding: 0; list-style-position: inside; margin: 0 0 0 1em; }
#logmsg ul { text-indent: -1em; padding-left: 1em; }#logmsg ol { text-indent: -1.5em; padding-left: 1.5em; }
#logmsg > ul, #logmsg > ol { margin: 0 0 1em 0; }
#logmsg pre { background: #eee; padding: 1em; }
#logmsg blockquote { border: 1px solid #fa0; border-left-width: 10px; padding: 1em 1em 0 1em; background: white;}
#logmsg dl { margin: 0; }
#logmsg dt { font-weight: bold; }
#logmsg dd { margin: 0; padding: 0 0 0.5em 0; }
#logmsg dd:before { content:'\00bb';}
#logmsg table { border-spacing: 0px; border-collapse: collapse; border-top: 4px solid #fa0; border-bottom: 1px solid #fa0; background: #fff; }
#logmsg table th { text-align: left; font-weight: normal; padding: 0.2em 0.5em; border-top: 1px dotted #fa0; }
#logmsg table td { text-align: right; border-top: 1px dotted #fa0; padding: 0.2em 0.5em; }
#logmsg table thead th { text-align: center; border-bottom: 1px solid #fa0; }
#logmsg table th.Corner { text-align: left; }
#logmsg hr { border: none 0; border-top: 2px dashed #fa0; height: 1px; }
#header, #footer { color: #fff; background: #636; border: 1px #300 solid; padding: 6px; }
#patch { width: 100%; }
#patch h4 {font-family: verdana,arial,helvetica,sans-serif;font-size:10pt;padding:8px;background:#369;color:#fff;margin:0;}
#patch .propset h4, #patch .binary h4 {margin:0;}
#patch pre {padding:0;line-height:1.2em;margin:0;}
#patch .diff {width:100%;background:#eee;padding: 0 0 10px 0;overflow:auto;}
#patch .propset .diff, #patch .binary .diff  {padding:10px 0;}
#patch span {display:block;padding:0 10px;}
#patch .modfile, #patch .addfile, #patch .delfile, #patch .propset, #patch .binary, #patch .copfile {border:1px solid #ccc;margin:10px 0;}
#patch ins {background:#dfd;text-decoration:none;display:block;padding:0 10px;}
#patch del {background:#fdd;text-decoration:none;display:block;padding:0 10px;}
#patch .lines, .info {color:#888;background:#fff;}
--></style>
<div id="msg">
<dl class="meta">
<dt>Revision</dt> <dd><a href="http://trac.webkit.org/projects/webkit/changeset/163765">163765</a></dd>
<dt>Author</dt> <dd>fpizlo@apple.com</dd>
<dt>Date</dt> <dd>2014-02-09 23:21:09 -0800 (Sun, 09 Feb 2014)</dd>
</dl>

<h3>Log Message</h3>
<pre>GC blocks on FTL and then badness
https://bugs.webkit.org/show_bug.cgi?id=128291

Reviewed by Oliver Hunt.
        
Introduce the notion of a DFG::Safepoint, which allows you to unlock the rightToRun
mutex for your JIT thread, while supplying the GC with all of the information it would
need to scan you at that moment in time. The default way of using this is
DFG::GraphSafepoint, where you just supply the Graph. There's a lot of machinery in
this patch just to make the Graph scannable.
        
We then use DFG::GraphSafepoint in just two places for now: (1) while initializing LLVM
and (2) while invoking LLVM' optimizer and backend.
        
This is a 30% speed-up on Octane/typescript and a 10% speed-up on Octane/gbemu. 2-3%
speed-up overall on Octane.
        
* CMakeLists.txt:
* GNUmakefile.list.am:
* JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
* JavaScriptCore.xcodeproj/project.pbxproj:
* dfg/DFGDriver.cpp:
(JSC::DFG::compileImpl):
* dfg/DFGGraph.cpp:
(JSC::DFG::Graph::visitChildren):
* dfg/DFGGraph.h:
* dfg/DFGGraphSafepoint.cpp: Added.
(JSC::DFG::GraphSafepoint::GraphSafepoint):
(JSC::DFG::GraphSafepoint::~GraphSafepoint):
* dfg/DFGGraphSafepoint.h: Added.
* dfg/DFGOperations.h:
* dfg/DFGPlan.cpp:
(JSC::DFG::Plan::compileInThread):
(JSC::DFG::Plan::compileInThreadImpl):
* dfg/DFGPlan.h:
* dfg/DFGSafepoint.cpp: Added.
(JSC::DFG::Safepoint::Safepoint):
(JSC::DFG::Safepoint::~Safepoint):
(JSC::DFG::Safepoint::add):
(JSC::DFG::Safepoint::begin):
(JSC::DFG::Safepoint::visitChildren):
* dfg/DFGSafepoint.h: Added.
* dfg/DFGScannable.h: Added.
(JSC::DFG::Scannable::Scannable):
(JSC::DFG::Scannable::~Scannable):
* dfg/DFGThreadData.cpp: Added.
(JSC::DFG::ThreadData::ThreadData):
(JSC::DFG::ThreadData::~ThreadData):
* dfg/DFGThreadData.h: Added.
* dfg/DFGWorklist.cpp:
(JSC::DFG::Worklist::finishCreation):
(JSC::DFG::Worklist::visitChildren):
(JSC::DFG::Worklist::runThread):
* dfg/DFGWorklist.h:
* ftl/FTLCompile.cpp:
(JSC::FTL::compile):
* heap/SlotVisitor.h:
* heap/SlotVisitorInlines.h:
(JSC::SlotVisitor::appendUnbarrieredReadOnlyPointer):
(JSC::SlotVisitor::appendUnbarrieredReadOnlyValue):</pre>

<h3>Modified Paths</h3>
<ul>
<li><a href="#trunkSourceJavaScriptCoreCMakeListstxt">trunk/Source/JavaScriptCore/CMakeLists.txt</a></li>
<li><a href="#trunkSourceJavaScriptCoreChangeLog">trunk/Source/JavaScriptCore/ChangeLog</a></li>
<li><a href="#trunkSourceJavaScriptCoreGNUmakefilelistam">trunk/Source/JavaScriptCore/GNUmakefile.list.am</a></li>
<li><a href="#trunkSourceJavaScriptCoreJavaScriptCorevcxprojJavaScriptCorevcxproj">trunk/Source/JavaScriptCore/JavaScriptCore.vcxproj/JavaScriptCore.vcxproj</a></li>
<li><a href="#trunkSourceJavaScriptCoreJavaScriptCorexcodeprojprojectpbxproj">trunk/Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGDrivercpp">trunk/Source/JavaScriptCore/dfg/DFGDriver.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGGraphcpp">trunk/Source/JavaScriptCore/dfg/DFGGraph.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGGraphh">trunk/Source/JavaScriptCore/dfg/DFGGraph.h</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGOperationsh">trunk/Source/JavaScriptCore/dfg/DFGOperations.h</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGPlancpp">trunk/Source/JavaScriptCore/dfg/DFGPlan.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGPlanh">trunk/Source/JavaScriptCore/dfg/DFGPlan.h</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGWorklistcpp">trunk/Source/JavaScriptCore/dfg/DFGWorklist.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGWorklisth">trunk/Source/JavaScriptCore/dfg/DFGWorklist.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreftlFTLCompilecpp">trunk/Source/JavaScriptCore/ftl/FTLCompile.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreheapSlotVisitorh">trunk/Source/JavaScriptCore/heap/SlotVisitor.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreheapSlotVisitorInlinesh">trunk/Source/JavaScriptCore/heap/SlotVisitorInlines.h</a></li>
</ul>

<h3>Added Paths</h3>
<ul>
<li><a href="#trunkSourceJavaScriptCoredfgDFGGraphSafepointcpp">trunk/Source/JavaScriptCore/dfg/DFGGraphSafepoint.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGGraphSafepointh">trunk/Source/JavaScriptCore/dfg/DFGGraphSafepoint.h</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGSafepointcpp">trunk/Source/JavaScriptCore/dfg/DFGSafepoint.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGSafepointh">trunk/Source/JavaScriptCore/dfg/DFGSafepoint.h</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGScannableh">trunk/Source/JavaScriptCore/dfg/DFGScannable.h</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGThreadDatacpp">trunk/Source/JavaScriptCore/dfg/DFGThreadData.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGThreadDatah">trunk/Source/JavaScriptCore/dfg/DFGThreadData.h</a></li>
</ul>

</div>
<div id="patch">
<h3>Diff</h3>
<a id="trunkSourceJavaScriptCoreCMakeListstxt"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/CMakeLists.txt (163764 => 163765)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/CMakeLists.txt        2014-02-10 06:02:42 UTC (rev 163764)
+++ trunk/Source/JavaScriptCore/CMakeLists.txt        2014-02-10 07:21:09 UTC (rev 163765)
</span><span class="lines">@@ -138,6 +138,7 @@
</span><span class="cx">     dfg/DFGFlushLivenessAnalysisPhase.cpp
</span><span class="cx">     dfg/DFGFlushedAt.cpp
</span><span class="cx">     dfg/DFGGraph.cpp
</span><ins>+    dfg/DFGGraphSafepoint.cpp
</ins><span class="cx">     dfg/DFGInPlaceAbstractState.cpp
</span><span class="cx">     dfg/DFGInvalidationPointInjectionPhase.cpp
</span><span class="cx">     dfg/DFGJITCode.cpp
</span><span class="lines">@@ -172,12 +173,14 @@
</span><span class="cx">     dfg/DFGResurrectionForValidationPhase.cpp
</span><span class="cx">     dfg/DFGSSAConversionPhase.cpp
</span><span class="cx">     dfg/DFGSSALoweringPhase.cpp
</span><ins>+    dfg/DFGSafepoint.cpp
</ins><span class="cx">     dfg/DFGSpeculativeJIT.cpp
</span><span class="cx">     dfg/DFGSpeculativeJIT32_64.cpp
</span><span class="cx">     dfg/DFGSpeculativeJIT64.cpp
</span><span class="cx">     dfg/DFGStackLayoutPhase.cpp
</span><span class="cx">     dfg/DFGStoreBarrierElisionPhase.cpp
</span><span class="cx">     dfg/DFGStrengthReductionPhase.cpp
</span><ins>+    dfg/DFGThreadData.cpp
</ins><span class="cx">     dfg/DFGThunks.cpp
</span><span class="cx">     dfg/DFGTierUpCheckInjectionPhase.cpp
</span><span class="cx">     dfg/DFGTypeCheckHoistingPhase.cpp
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreChangeLog"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/ChangeLog (163764 => 163765)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/ChangeLog        2014-02-10 06:02:42 UTC (rev 163764)
+++ trunk/Source/JavaScriptCore/ChangeLog        2014-02-10 07:21:09 UTC (rev 163765)
</span><span class="lines">@@ -1,5 +1,68 @@
</span><span class="cx"> 2014-02-09  Filip Pizlo  &lt;fpizlo@apple.com&gt;
</span><span class="cx"> 
</span><ins>+        GC blocks on FTL and then badness
+        https://bugs.webkit.org/show_bug.cgi?id=128291
+
+        Reviewed by Oliver Hunt.
+        
+        Introduce the notion of a DFG::Safepoint, which allows you to unlock the rightToRun
+        mutex for your JIT thread, while supplying the GC with all of the information it would
+        need to scan you at that moment in time. The default way of using this is
+        DFG::GraphSafepoint, where you just supply the Graph. There's a lot of machinery in
+        this patch just to make the Graph scannable.
+        
+        We then use DFG::GraphSafepoint in just two places for now: (1) while initializing LLVM
+        and (2) while invoking LLVM' optimizer and backend.
+        
+        This is a 30% speed-up on Octane/typescript and a 10% speed-up on Octane/gbemu. 2-3%
+        speed-up overall on Octane.
+        
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * dfg/DFGDriver.cpp:
+        (JSC::DFG::compileImpl):
+        * dfg/DFGGraph.cpp:
+        (JSC::DFG::Graph::visitChildren):
+        * dfg/DFGGraph.h:
+        * dfg/DFGGraphSafepoint.cpp: Added.
+        (JSC::DFG::GraphSafepoint::GraphSafepoint):
+        (JSC::DFG::GraphSafepoint::~GraphSafepoint):
+        * dfg/DFGGraphSafepoint.h: Added.
+        * dfg/DFGOperations.h:
+        * dfg/DFGPlan.cpp:
+        (JSC::DFG::Plan::compileInThread):
+        (JSC::DFG::Plan::compileInThreadImpl):
+        * dfg/DFGPlan.h:
+        * dfg/DFGSafepoint.cpp: Added.
+        (JSC::DFG::Safepoint::Safepoint):
+        (JSC::DFG::Safepoint::~Safepoint):
+        (JSC::DFG::Safepoint::add):
+        (JSC::DFG::Safepoint::begin):
+        (JSC::DFG::Safepoint::visitChildren):
+        * dfg/DFGSafepoint.h: Added.
+        * dfg/DFGScannable.h: Added.
+        (JSC::DFG::Scannable::Scannable):
+        (JSC::DFG::Scannable::~Scannable):
+        * dfg/DFGThreadData.cpp: Added.
+        (JSC::DFG::ThreadData::ThreadData):
+        (JSC::DFG::ThreadData::~ThreadData):
+        * dfg/DFGThreadData.h: Added.
+        * dfg/DFGWorklist.cpp:
+        (JSC::DFG::Worklist::finishCreation):
+        (JSC::DFG::Worklist::visitChildren):
+        (JSC::DFG::Worklist::runThread):
+        * dfg/DFGWorklist.h:
+        * ftl/FTLCompile.cpp:
+        (JSC::FTL::compile):
+        * heap/SlotVisitor.h:
+        * heap/SlotVisitorInlines.h:
+        (JSC::SlotVisitor::appendUnbarrieredReadOnlyPointer):
+        (JSC::SlotVisitor::appendUnbarrieredReadOnlyValue):
+
+2014-02-09  Filip Pizlo  &lt;fpizlo@apple.com&gt;
+
</ins><span class="cx">         Never include *Inlines.h files in interface headers, and never include *Inlines.h when you could include Operations.h instead
</span><span class="cx">         https://bugs.webkit.org/show_bug.cgi?id=128505
</span><span class="cx"> 
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreGNUmakefilelistam"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/GNUmakefile.list.am (163764 => 163765)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/GNUmakefile.list.am        2014-02-10 06:02:42 UTC (rev 163764)
+++ trunk/Source/JavaScriptCore/GNUmakefile.list.am        2014-02-10 07:21:09 UTC (rev 163765)
</span><span class="lines">@@ -304,6 +304,8 @@
</span><span class="cx">         Source/JavaScriptCore/dfg/DFGGenerationInfo.h \
</span><span class="cx">         Source/JavaScriptCore/dfg/DFGGraph.cpp \
</span><span class="cx">         Source/JavaScriptCore/dfg/DFGGraph.h \
</span><ins>+        Source/JavaScriptCore/dfg/DFGGraphSafepoint.cpp \
+        Source/JavaScriptCore/dfg/DFGGraphSafepoint.h \
</ins><span class="cx">         Source/JavaScriptCore/dfg/DFGInPlaceAbstractState.cpp \
</span><span class="cx">         Source/JavaScriptCore/dfg/DFGInPlaceAbstractState.h \
</span><span class="cx">         Source/JavaScriptCore/dfg/DFGInlineCacheWrapper.h \
</span><span class="lines">@@ -377,7 +379,10 @@
</span><span class="cx">         Source/JavaScriptCore/dfg/DFGResurrectionForValidationPhase.cpp \
</span><span class="cx">         Source/JavaScriptCore/dfg/DFGResurrectionForValidationPhase.h \
</span><span class="cx">         Source/JavaScriptCore/dfg/DFGSafeToExecute.h \
</span><ins>+        Source/JavaScriptCore/dfg/DFGSafepoint.cpp \
+        Source/JavaScriptCore/dfg/DFGSafepoint.h \
</ins><span class="cx">         Source/JavaScriptCore/dfg/DFGSaneStringGetByValSlowPathGenerator.h \
</span><ins>+        Source/JavaScriptCore/dfg/DFGScannable.h \
</ins><span class="cx">         Source/JavaScriptCore/dfg/DFGScoreBoard.h \
</span><span class="cx">         Source/JavaScriptCore/dfg/DFGSilentRegisterSavePlan.h \
</span><span class="cx">         Source/JavaScriptCore/dfg/DFGSlowPathGenerator.h \
</span><span class="lines">@@ -398,6 +403,8 @@
</span><span class="cx">         Source/JavaScriptCore/dfg/DFGStructureAbstractValue.h \
</span><span class="cx">         Source/JavaScriptCore/dfg/DFGTierUpCheckInjectionPhase.cpp \
</span><span class="cx">         Source/JavaScriptCore/dfg/DFGTierUpCheckInjectionPhase.h \
</span><ins>+        Source/JavaScriptCore/dfg/DFGThreadData.cpp \
+        Source/JavaScriptCore/dfg/DFGThreadData.h \
</ins><span class="cx">         Source/JavaScriptCore/dfg/DFGThunks.cpp \
</span><span class="cx">         Source/JavaScriptCore/dfg/DFGThunks.h \
</span><span class="cx">         Source/JavaScriptCore/dfg/DFGToFTLDeferredCompilationCallback.cpp \
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreJavaScriptCorevcxprojJavaScriptCorevcxproj"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/JavaScriptCore.vcxproj/JavaScriptCore.vcxproj (163764 => 163765)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/JavaScriptCore.vcxproj/JavaScriptCore.vcxproj        2014-02-10 06:02:42 UTC (rev 163764)
+++ trunk/Source/JavaScriptCore/JavaScriptCore.vcxproj/JavaScriptCore.vcxproj        2014-02-10 07:21:09 UTC (rev 163765)
</span><span class="lines">@@ -392,6 +392,7 @@
</span><span class="cx">     &lt;ClCompile Include=&quot;..\dfg\DFGFlushFormat.cpp&quot; /&gt;
</span><span class="cx">     &lt;ClCompile Include=&quot;..\dfg\DFGFlushLivenessAnalysisPhase.cpp&quot; /&gt;
</span><span class="cx">     &lt;ClCompile Include=&quot;..\dfg\DFGGraph.cpp&quot; /&gt;
</span><ins>+    &lt;ClCompile Include=&quot;..\dfg\DFGGraphSafepoint.cpp&quot; /&gt;
</ins><span class="cx">     &lt;ClCompile Include=&quot;..\dfg\DFGInPlaceAbstractState.cpp&quot; /&gt;
</span><span class="cx">     &lt;ClCompile Include=&quot;..\dfg\DFGInvalidationPointInjectionPhase.cpp&quot; /&gt;
</span><span class="cx">     &lt;ClCompile Include=&quot;..\dfg\DFGJITCode.cpp&quot; /&gt;
</span><span class="lines">@@ -424,6 +425,7 @@
</span><span class="cx">     &lt;ClCompile Include=&quot;..\dfg\DFGPredictionInjectionPhase.cpp&quot; /&gt;
</span><span class="cx">     &lt;ClCompile Include=&quot;..\dfg\DFGPredictionPropagationPhase.cpp&quot; /&gt;
</span><span class="cx">     &lt;ClCompile Include=&quot;..\dfg\DFGResurrectionForValidationPhase.cpp&quot; /&gt;
</span><ins>+    &lt;ClCompile Include=&quot;..\dfg\DFGSafepoint.cpp&quot; /&gt;
</ins><span class="cx">     &lt;ClCompile Include=&quot;..\dfg\DFGSpeculativeJIT.cpp&quot; /&gt;
</span><span class="cx">     &lt;ClCompile Include=&quot;..\dfg\DFGSpeculativeJIT32_64.cpp&quot; /&gt;
</span><span class="cx">     &lt;ClCompile Include=&quot;..\dfg\DFGSpeculativeJIT64.cpp&quot; /&gt;
</span><span class="lines">@@ -432,6 +434,7 @@
</span><span class="cx">     &lt;ClCompile Include=&quot;..\dfg\DFGStackLayoutPhase.cpp&quot; /&gt;
</span><span class="cx">     &lt;ClCompile Include=&quot;..\dfg\DFGStoreBarrierElisionPhase.cpp&quot; /&gt;
</span><span class="cx">     &lt;ClCompile Include=&quot;..\dfg\DFGStrengthReductionPhase.cpp&quot; /&gt;
</span><ins>+    &lt;ClCompile Include=&quot;..\dfg\DFGThreadData.cpp&quot; /&gt;
</ins><span class="cx">     &lt;ClCompile Include=&quot;..\dfg\DFGThunks.cpp&quot; /&gt;
</span><span class="cx">     &lt;ClCompile Include=&quot;..\dfg\DFGTierUpCheckInjectionPhase.cpp&quot; /&gt;
</span><span class="cx">     &lt;ClCompile Include=&quot;..\dfg\DFGToFTLDeferredCompilationCallback.cpp&quot; /&gt;
</span><span class="lines">@@ -929,6 +932,7 @@
</span><span class="cx">     &lt;ClInclude Include=&quot;..\dfg\DFGGenerationInfo.h&quot; /&gt;
</span><span class="cx">     &lt;ClInclude Include=&quot;..\dfg\DFGGPRInfo.h&quot; /&gt;
</span><span class="cx">     &lt;ClInclude Include=&quot;..\dfg\DFGGraph.h&quot; /&gt;
</span><ins>+    &lt;ClInclude Include=&quot;..\dfg\DFGGraphSafepoint.h&quot; /&gt;
</ins><span class="cx">     &lt;ClInclude Include=&quot;..\dfg\DFGInPlaceAbstractState.h&quot; /&gt;
</span><span class="cx">     &lt;ClInclude Include=&quot;..\dfg\DFGInsertionSet.h&quot; /&gt;
</span><span class="cx">     &lt;ClInclude Include=&quot;..\dfg\DFGInvalidationPointInjectionPhase.h&quot; /&gt;
</span><span class="lines">@@ -969,7 +973,9 @@
</span><span class="cx">     &lt;ClInclude Include=&quot;..\dfg\DFGRegisterSet.h&quot; /&gt;
</span><span class="cx">     &lt;ClInclude Include=&quot;..\dfg\DFGResurrectionForValidationPhase.h&quot; /&gt;
</span><span class="cx">     &lt;ClInclude Include=&quot;..\dfg\DFGSafeToExecute.h&quot; /&gt;
</span><ins>+    &lt;ClInclude Include=&quot;..\dfg\DFGSafepoint.h&quot; /&gt;
</ins><span class="cx">     &lt;ClInclude Include=&quot;..\dfg\DFGSaneStringGetByValSlowPathGenerator.h&quot; /&gt;
</span><ins>+    &lt;ClInclude Include=&quot;..\dfg\DFGScannable.h&quot; /&gt;
</ins><span class="cx">     &lt;ClInclude Include=&quot;..\dfg\DFGScoreBoard.h&quot; /&gt;
</span><span class="cx">     &lt;ClInclude Include=&quot;..\dfg\DFGScratchRegisterAllocator.h&quot; /&gt;
</span><span class="cx">     &lt;ClInclude Include=&quot;..\dfg\DFGSilentRegisterSavePlan.h&quot; /&gt;
</span><span class="lines">@@ -981,6 +987,7 @@
</span><span class="cx">     &lt;ClInclude Include=&quot;..\dfg\DFGStoreBarrierElisionPhase.h&quot; /&gt;
</span><span class="cx">     &lt;ClInclude Include=&quot;..\dfg\DFGStrengthReductionPhase.h&quot; /&gt;
</span><span class="cx">     &lt;ClInclude Include=&quot;..\dfg\DFGStructureAbstractValue.h&quot; /&gt;
</span><ins>+    &lt;ClInclude Include=&quot;..\dfg\DFGThreadData.h&quot; /&gt;
</ins><span class="cx">     &lt;ClInclude Include=&quot;..\dfg\DFGThunks.h&quot; /&gt;
</span><span class="cx">     &lt;ClInclude Include=&quot;..\dfg\DFGTierUpCheckInjectionPhase.h&quot; /&gt;
</span><span class="cx">     &lt;ClInclude Include=&quot;..\dfg\DFGToFTLDeferredCompilationCallback.h&quot; /&gt;
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreJavaScriptCorexcodeprojprojectpbxproj"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj (163764 => 163765)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj        2014-02-10 06:02:42 UTC (rev 163764)
+++ trunk/Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj        2014-02-10 07:21:09 UTC (rev 163765)
</span><span class="lines">@@ -202,6 +202,13 @@
</span><span class="cx">                 0F2E892D16D02BAF009E4FD2 /* DFGMinifiedID.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FB4B51016B3A964003F696B /* DFGMinifiedID.h */; settings = {ATTRIBUTES = (Private, ); }; };
</span><span class="cx">                 0F2FC77216E12F710038D976 /* DFGDCEPhase.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F2FC77016E12F6F0038D976 /* DFGDCEPhase.cpp */; };
</span><span class="cx">                 0F2FC77316E12F740038D976 /* DFGDCEPhase.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F2FC77116E12F6F0038D976 /* DFGDCEPhase.h */; settings = {ATTRIBUTES = (Private, ); }; };
</span><ins>+                0F2FCCF918A60070001A27F8 /* DFGGraphSafepoint.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F2FCCF218A60070001A27F8 /* DFGGraphSafepoint.cpp */; };
+                0F2FCCFA18A60070001A27F8 /* DFGGraphSafepoint.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F2FCCF318A60070001A27F8 /* DFGGraphSafepoint.h */; settings = {ATTRIBUTES = (Private, ); }; };
+                0F2FCCFB18A60070001A27F8 /* DFGSafepoint.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F2FCCF418A60070001A27F8 /* DFGSafepoint.cpp */; };
+                0F2FCCFC18A60070001A27F8 /* DFGSafepoint.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F2FCCF518A60070001A27F8 /* DFGSafepoint.h */; settings = {ATTRIBUTES = (Private, ); }; };
+                0F2FCCFD18A60070001A27F8 /* DFGScannable.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F2FCCF618A60070001A27F8 /* DFGScannable.h */; settings = {ATTRIBUTES = (Private, ); }; };
+                0F2FCCFE18A60070001A27F8 /* DFGThreadData.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F2FCCF718A60070001A27F8 /* DFGThreadData.cpp */; };
+                0F2FCCFF18A60070001A27F8 /* DFGThreadData.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F2FCCF818A60070001A27F8 /* DFGThreadData.h */; settings = {ATTRIBUTES = (Private, ); }; };
</ins><span class="cx">                 0F34B14916D42010001CDA5A /* DFGUseKind.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F34B14716D4200E001CDA5A /* DFGUseKind.cpp */; };
</span><span class="cx">                 0F34B14A16D42013001CDA5A /* DFGUseKind.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F34B14816D4200E001CDA5A /* DFGUseKind.h */; settings = {ATTRIBUTES = (Private, ); }; };
</span><span class="cx">                 0F34B14C16D43E0D001CDA5A /* PolymorphicAccessStructureList.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F34B14B16D43E0C001CDA5A /* PolymorphicAccessStructureList.h */; settings = {ATTRIBUTES = (Private, ); }; };
</span><span class="lines">@@ -1645,6 +1652,13 @@
</span><span class="cx">                 0F2BDC5015228FFA00CD8910 /* DFGVariableEvent.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGVariableEvent.cpp; path = dfg/DFGVariableEvent.cpp; sourceTree = &quot;&lt;group&gt;&quot;; };
</span><span class="cx">                 0F2FC77016E12F6F0038D976 /* DFGDCEPhase.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGDCEPhase.cpp; path = dfg/DFGDCEPhase.cpp; sourceTree = &quot;&lt;group&gt;&quot;; };
</span><span class="cx">                 0F2FC77116E12F6F0038D976 /* DFGDCEPhase.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGDCEPhase.h; path = dfg/DFGDCEPhase.h; sourceTree = &quot;&lt;group&gt;&quot;; };
</span><ins>+                0F2FCCF218A60070001A27F8 /* DFGGraphSafepoint.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGGraphSafepoint.cpp; path = dfg/DFGGraphSafepoint.cpp; sourceTree = &quot;&lt;group&gt;&quot;; };
+                0F2FCCF318A60070001A27F8 /* DFGGraphSafepoint.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGGraphSafepoint.h; path = dfg/DFGGraphSafepoint.h; sourceTree = &quot;&lt;group&gt;&quot;; };
+                0F2FCCF418A60070001A27F8 /* DFGSafepoint.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGSafepoint.cpp; path = dfg/DFGSafepoint.cpp; sourceTree = &quot;&lt;group&gt;&quot;; };
+                0F2FCCF518A60070001A27F8 /* DFGSafepoint.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGSafepoint.h; path = dfg/DFGSafepoint.h; sourceTree = &quot;&lt;group&gt;&quot;; };
+                0F2FCCF618A60070001A27F8 /* DFGScannable.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGScannable.h; path = dfg/DFGScannable.h; sourceTree = &quot;&lt;group&gt;&quot;; };
+                0F2FCCF718A60070001A27F8 /* DFGThreadData.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGThreadData.cpp; path = dfg/DFGThreadData.cpp; sourceTree = &quot;&lt;group&gt;&quot;; };
+                0F2FCCF818A60070001A27F8 /* DFGThreadData.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGThreadData.h; path = dfg/DFGThreadData.h; sourceTree = &quot;&lt;group&gt;&quot;; };
</ins><span class="cx">                 0F34B14716D4200E001CDA5A /* DFGUseKind.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGUseKind.cpp; path = dfg/DFGUseKind.cpp; sourceTree = &quot;&lt;group&gt;&quot;; };
</span><span class="cx">                 0F34B14816D4200E001CDA5A /* DFGUseKind.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGUseKind.h; path = dfg/DFGUseKind.h; sourceTree = &quot;&lt;group&gt;&quot;; };
</span><span class="cx">                 0F34B14B16D43E0C001CDA5A /* PolymorphicAccessStructureList.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = PolymorphicAccessStructureList.h; sourceTree = &quot;&lt;group&gt;&quot;; };
</span><span class="lines">@@ -4092,8 +4106,6 @@
</span><span class="cx">                 86EC9DB31328DF44002B2AD7 /* dfg */ = {
</span><span class="cx">                         isa = PBXGroup;
</span><span class="cx">                         children = (
</span><del>-                                2ACCF3DC185FE26B0083E2AD /* DFGStoreBarrierElisionPhase.cpp */,
-                                2ACCF3DD185FE26B0083E2AD /* DFGStoreBarrierElisionPhase.h */,
</del><span class="cx">                                 A77A423617A0BBFD00A8DB81 /* DFGAbstractHeap.cpp */,
</span><span class="cx">                                 A77A423717A0BBFD00A8DB81 /* DFGAbstractHeap.h */,
</span><span class="cx">                                 A704D8FE17A0BAA8006BA554 /* DFGAbstractInterpreter.h */,
</span><span class="lines">@@ -4195,6 +4207,8 @@
</span><span class="cx">                                 86EC9DB61328DF82002B2AD7 /* DFGGenerationInfo.h */,
</span><span class="cx">                                 86EC9DB71328DF82002B2AD7 /* DFGGraph.cpp */,
</span><span class="cx">                                 86EC9DB81328DF82002B2AD7 /* DFGGraph.h */,
</span><ins>+                                0F2FCCF218A60070001A27F8 /* DFGGraphSafepoint.cpp */,
+                                0F2FCCF318A60070001A27F8 /* DFGGraphSafepoint.h */,
</ins><span class="cx">                                 0FB14E201812570B009B6B4D /* DFGInlineCacheWrapper.h */,
</span><span class="cx">                                 0FB14E2218130955009B6B4D /* DFGInlineCacheWrapperInlines.h */,
</span><span class="cx">                                 A704D90017A0BAA8006BA554 /* DFGInPlaceAbstractState.cpp */,
</span><span class="lines">@@ -4267,8 +4281,11 @@
</span><span class="cx">                                 86EC9DC11328DF82002B2AD7 /* DFGRegisterBank.h */,
</span><span class="cx">                                 0F666ECA1836B37E00D017F1 /* DFGResurrectionForValidationPhase.cpp */,
</span><span class="cx">                                 0F666ECB1836B37E00D017F1 /* DFGResurrectionForValidationPhase.h */,
</span><ins>+                                0F2FCCF418A60070001A27F8 /* DFGSafepoint.cpp */,
+                                0F2FCCF518A60070001A27F8 /* DFGSafepoint.h */,
</ins><span class="cx">                                 A77A423C17A0BBFD00A8DB81 /* DFGSafeToExecute.h */,
</span><span class="cx">                                 A741017E179DAF80002EB8BA /* DFGSaneStringGetByValSlowPathGenerator.h */,
</span><ins>+                                0F2FCCF618A60070001A27F8 /* DFGScannable.h */,
</ins><span class="cx">                                 86ECA3F9132DF25A002B2AD7 /* DFGScoreBoard.h */,
</span><span class="cx">                                 0F1E3A65153A21DF000F9456 /* DFGSilentRegisterSavePlan.h */,
</span><span class="cx">                                 0F1E3A501537C2CB000F9456 /* DFGSlowPathGenerator.h */,
</span><span class="lines">@@ -4282,9 +4299,13 @@
</span><span class="cx">                                 0FC20CB818556A3500C9E954 /* DFGSSALoweringPhase.h */,
</span><span class="cx">                                 0F9FB4F217FCB91700CB67F8 /* DFGStackLayoutPhase.cpp */,
</span><span class="cx">                                 0F9FB4F317FCB91700CB67F8 /* DFGStackLayoutPhase.h */,
</span><ins>+                                2ACCF3DC185FE26B0083E2AD /* DFGStoreBarrierElisionPhase.cpp */,
+                                2ACCF3DD185FE26B0083E2AD /* DFGStoreBarrierElisionPhase.h */,
</ins><span class="cx">                                 0FC20CB31852E2C600C9E954 /* DFGStrengthReductionPhase.cpp */,
</span><span class="cx">                                 0FC20CB41852E2C600C9E954 /* DFGStrengthReductionPhase.h */,
</span><span class="cx">                                 0F63947615DCE347006A597C /* DFGStructureAbstractValue.h */,
</span><ins>+                                0F2FCCF718A60070001A27F8 /* DFGThreadData.cpp */,
+                                0F2FCCF818A60070001A27F8 /* DFGThreadData.h */,
</ins><span class="cx">                                 0FC0979F146B28C700CF2442 /* DFGThunks.cpp */,
</span><span class="cx">                                 0FC097A0146B28C700CF2442 /* DFGThunks.h */,
</span><span class="cx">                                 0FD8A31F17D51F5700CA2C40 /* DFGTierUpCheckInjectionPhase.cpp */,
</span><span class="lines">@@ -5082,6 +5103,7 @@
</span><span class="cx">                                 A790DD70182F499700588807 /* JSSetIterator.h in Headers */,
</span><span class="cx">                                 0F24E54E17EE274900ABB217 /* JITOperationWrappers.h in Headers */,
</span><span class="cx">                                 0F766D3115AA8112008F363E /* JITStubRoutine.h in Headers */,
</span><ins>+                                0F2FCCFA18A60070001A27F8 /* DFGGraphSafepoint.h in Headers */,
</ins><span class="cx">                                 0F766D2C15A8CC3A008F363E /* JITStubRoutineSet.h in Headers */,
</span><span class="cx">                                 14C5242B0F5355E900BA3D04 /* JITStubs.h in Headers */,
</span><span class="cx">                                 FEF6835E174343CC00A32E25 /* JITStubsARM.h in Headers */,
</span><span class="lines">@@ -5121,6 +5143,7 @@
</span><span class="cx">                                 86E3C613167BABD7006D760A /* JSContext.h in Headers */,
</span><span class="cx">                                 86E3C617167BABEE006D760A /* JSContextInternal.h in Headers */,
</span><span class="cx">                                 BC18C41E0E16F5CD00B34460 /* JSContextRef.h in Headers */,
</span><ins>+                                0F2FCCFF18A60070001A27F8 /* DFGThreadData.h in Headers */,
</ins><span class="cx">                                 148CD1D8108CF902008163C6 /* JSContextRefPrivate.h in Headers */,
</span><span class="cx">                                 A72028B81797601E0098028C /* JSCTestRunnerUtils.h in Headers */,
</span><span class="cx">                                 0F2B66EC17B6B5AB00A7AE3F /* JSDataView.h in Headers */,
</span><span class="lines">@@ -5241,6 +5264,7 @@
</span><span class="cx">                                 86C568E111A213EE0007F7F0 /* MacroAssemblerMIPS.h in Headers */,
</span><span class="cx">                                 86AE64A9135E5E1C00963012 /* MacroAssemblerSH4.h in Headers */,
</span><span class="cx">                                 860161E40F3A83C100F84710 /* MacroAssemblerX86.h in Headers */,
</span><ins>+                                0F2FCCFC18A60070001A27F8 /* DFGSafepoint.h in Headers */,
</ins><span class="cx">                                 860161E50F3A83C100F84710 /* MacroAssemblerX86_64.h in Headers */,
</span><span class="cx">                                 860161E60F3A83C100F84710 /* MacroAssemblerX86Common.h in Headers */,
</span><span class="cx">                                 A700873A17CBE85300C3E643 /* MapConstructor.h in Headers */,
</span><span class="lines">@@ -5452,6 +5476,7 @@
</span><span class="cx">                                 0F242DA713F3B1E8007ADD4C /* WeakReferenceHarvester.h in Headers */,
</span><span class="cx">                                 14E84FA114EE1ACC00D6D5D4 /* WeakSet.h in Headers */,
</span><span class="cx">                                 14150133154BB13F005D8C98 /* WeakSetInlines.h in Headers */,
</span><ins>+                                0F2FCCFD18A60070001A27F8 /* DFGScannable.h in Headers */,
</ins><span class="cx">                                 BC18C47A0E16F5CD00B34460 /* WebKitAvailability.h in Headers */,
</span><span class="cx">                                 A74DEF92182D991400522C22 /* MapIteratorConstructor.h in Headers */,
</span><span class="cx">                                 A7DCB97312E5193F00911940 /* WriteBarrier.h in Headers */,
</span><span class="lines">@@ -6047,6 +6072,7 @@
</span><span class="cx">                                 A70447ED17A0BD7000F5898E /* DumpContext.cpp in Sources */,
</span><span class="cx">                                 147F39C7107EC37600427A48 /* Error.cpp in Sources */,
</span><span class="cx">                                 147F39C8107EC37600427A48 /* ErrorConstructor.cpp in Sources */,
</span><ins>+                                0F2FCCF918A60070001A27F8 /* DFGGraphSafepoint.cpp in Sources */,
</ins><span class="cx">                                 147F39C9107EC37600427A48 /* ErrorInstance.cpp in Sources */,
</span><span class="cx">                                 147F39CA107EC37600427A48 /* ErrorPrototype.cpp in Sources */,
</span><span class="cx">                                 A5FD0067189AFE9C00633231 /* ScriptArguments.cpp in Sources */,
</span><span class="lines">@@ -6217,6 +6243,7 @@
</span><span class="cx">                                 A7482B9411671147003B0712 /* JSWeakObjectMapRefPrivate.cpp in Sources */,
</span><span class="cx">                                 1442566115EDE98D0066A49B /* JSWithScope.cpp in Sources */,
</span><span class="cx">                                 A503FA1B188E0FB000110F14 /* JSJavaScriptCallFrame.cpp in Sources */,
</span><ins>+                                0F2FCCFE18A60070001A27F8 /* DFGThreadData.cpp in Sources */,
</ins><span class="cx">                                 86E3C618167BABEE006D760A /* JSWrapperMap.mm in Sources */,
</span><span class="cx">                                 14280870107EC1340013E7B2 /* JSWrapperObject.cpp in Sources */,
</span><span class="cx">                                 A57D23E91891B0770031C7FA /* JSGlobalObjectDebuggerAgent.cpp in Sources */,
</span><span class="lines">@@ -6328,6 +6355,7 @@
</span><span class="cx">                                 C225494315F7DBAA0065E898 /* SlotVisitor.cpp in Sources */,
</span><span class="cx">                                 9330402C0E6A764000786E6A /* SmallStrings.cpp in Sources */,
</span><span class="cx">                                 0F8F2B9E17306C8D007DBDA5 /* SourceCode.cpp in Sources */,
</span><ins>+                                0F2FCCFB18A60070001A27F8 /* DFGSafepoint.cpp in Sources */,
</ins><span class="cx">                                 A5FD0079189B051000633231 /* ConsoleMessage.cpp in Sources */,
</span><span class="cx">                                 0F493AFA16D0CAD30084508B /* SourceProvider.cpp in Sources */,
</span><span class="cx">                                 E49DC16B12EF293E00184A1F /* SourceProviderCache.cpp in Sources */,
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGDrivercpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGDriver.cpp (163764 => 163765)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGDriver.cpp        2014-02-10 06:02:42 UTC (rev 163764)
+++ trunk/Source/JavaScriptCore/dfg/DFGDriver.cpp        2014-02-10 07:21:09 UTC (rev 163765)
</span><span class="lines">@@ -121,7 +121,7 @@
</span><span class="cx">         return CompilationDeferred;
</span><span class="cx">     }
</span><span class="cx">     
</span><del>-    plan-&gt;compileInThread(*vm.dfgState);
</del><ins>+    plan-&gt;compileInThread(*vm.dfgState, 0);
</ins><span class="cx">     return plan-&gt;finalizeWithoutNotifyingCallback();
</span><span class="cx"> }
</span><span class="cx"> #else // ENABLE(DFG_JIT)
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGGraphcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGGraph.cpp (163764 => 163765)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGGraph.cpp        2014-02-10 06:02:42 UTC (rev 163764)
+++ trunk/Source/JavaScriptCore/dfg/DFGGraph.cpp        2014-02-10 07:21:09 UTC (rev 163765)
</span><span class="lines">@@ -791,6 +791,59 @@
</span><span class="cx">     return tryGetFoldableView(child(node, 0).node(), node-&gt;arrayMode());
</span><span class="cx"> }
</span><span class="cx"> 
</span><ins>+void Graph::visitChildren(SlotVisitor&amp; visitor)
+{
+    for (BlockIndex blockIndex = numBlocks(); blockIndex--;) {
+        BasicBlock* block = this-&gt;block(blockIndex);
+        if (!block)
+            continue;
+        
+        for (unsigned nodeIndex = 0; nodeIndex &lt; block-&gt;size(); ++nodeIndex) {
+            Node* node = block-&gt;at(nodeIndex);
+            
+            switch (node-&gt;op()) {
+            case JSConstant:
+            case WeakJSConstant:
+                visitor.appendUnbarrieredReadOnlyValue(valueOfJSConstant(node));
+                break;
+                
+            case CheckFunction:
+                visitor.appendUnbarrieredReadOnlyPointer(node-&gt;function());
+                break;
+                
+            case CheckExecutable:
+                visitor.appendUnbarrieredReadOnlyPointer(node-&gt;executable());
+                break;
+                
+            case CheckStructure:
+                for (unsigned i = node-&gt;structureSet().size(); i--;)
+                    visitor.appendUnbarrieredReadOnlyPointer(node-&gt;structureSet()[i]);
+                break;
+                
+            case StructureTransitionWatchpoint:
+            case NewObject:
+            case ArrayifyToStructure:
+            case NewStringObject:
+                visitor.appendUnbarrieredReadOnlyPointer(node-&gt;structure());
+                break;
+                
+            case PutStructure:
+            case PhantomPutStructure:
+            case AllocatePropertyStorage:
+            case ReallocatePropertyStorage:
+                visitor.appendUnbarrieredReadOnlyPointer(
+                    node-&gt;structureTransitionData().previousStructure);
+                visitor.appendUnbarrieredReadOnlyPointer(
+                    node-&gt;structureTransitionData().newStructure);
+                break;
+                
+            default:
+                break;
+            }
+        }
+    }
+}
+
</ins><span class="cx"> } } // namespace JSC::DFG
</span><span class="cx"> 
</span><span class="cx"> #endif // ENABLE(DFG_JIT)
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGGraphh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGGraph.h (163764 => 163765)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGGraph.h        2014-02-10 06:02:42 UTC (rev 163764)
+++ trunk/Source/JavaScriptCore/dfg/DFGGraph.h        2014-02-10 07:21:09 UTC (rev 163765)
</span><span class="lines">@@ -40,6 +40,7 @@
</span><span class="cx"> #include &quot;DFGNode.h&quot;
</span><span class="cx"> #include &quot;DFGNodeAllocator.h&quot;
</span><span class="cx"> #include &quot;DFGPlan.h&quot;
</span><ins>+#include &quot;DFGScannable.h&quot;
</ins><span class="cx"> #include &quot;DFGVariadicFunction.h&quot;
</span><span class="cx"> #include &quot;InlineCallFrameSet.h&quot;
</span><span class="cx"> #include &quot;JSStack.h&quot;
</span><span class="lines">@@ -78,7 +79,7 @@
</span><span class="cx"> //
</span><span class="cx"> // The order may be significant for nodes with side-effects (property accesses, value conversions).
</span><span class="cx"> // Nodes that are 'dead' remain in the vector with refCount 0.
</span><del>-class Graph {
</del><ins>+class Graph : public virtual Scannable {
</ins><span class="cx"> public:
</span><span class="cx">     Graph(VM&amp;, Plan&amp;, LongLivedState&amp;);
</span><span class="cx">     ~Graph();
</span><span class="lines">@@ -799,6 +800,8 @@
</span><span class="cx">     JSArrayBufferView* tryGetFoldableView(Node*, ArrayMode);
</span><span class="cx">     JSArrayBufferView* tryGetFoldableViewForChild1(Node*);
</span><span class="cx">     
</span><ins>+    virtual void visitChildren(SlotVisitor&amp;) override;
+    
</ins><span class="cx">     VM&amp; m_vm;
</span><span class="cx">     Plan&amp; m_plan;
</span><span class="cx">     CodeBlock* m_codeBlock;
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGGraphSafepointcpp"></a>
<div class="addfile"><h4>Added: trunk/Source/JavaScriptCore/dfg/DFGGraphSafepoint.cpp (0 => 163765)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGGraphSafepoint.cpp                                (rev 0)
+++ trunk/Source/JavaScriptCore/dfg/DFGGraphSafepoint.cpp        2014-02-10 07:21:09 UTC (rev 163765)
</span><span class="lines">@@ -0,0 +1,49 @@
</span><ins>+/*
+ * Copyright (C) 2014 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include &quot;config.h&quot;
+
+#if ENABLE(DFG_JIT)
+
+#include &quot;DFGGraphSafepoint.h&quot;
+
+#include &quot;DFGGraph.h&quot;
+#include &quot;Operations.h&quot;
+
+namespace JSC { namespace DFG {
+
+GraphSafepoint::GraphSafepoint(Graph&amp; graph)
+    : m_safepoint(graph.m_plan)
+{
+    m_safepoint.add(&amp;graph);
+    m_safepoint.begin();
+}
+
+GraphSafepoint::~GraphSafepoint() { }
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
+
</ins></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGGraphSafepointh"></a>
<div class="addfile"><h4>Added: trunk/Source/JavaScriptCore/dfg/DFGGraphSafepoint.h (0 => 163765)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGGraphSafepoint.h                                (rev 0)
+++ trunk/Source/JavaScriptCore/dfg/DFGGraphSafepoint.h        2014-02-10 07:21:09 UTC (rev 163765)
</span><span class="lines">@@ -0,0 +1,51 @@
</span><ins>+/*
+ * Copyright (C) 2014 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef DFGGraphSafepoint_h
+#define DFGGraphSafepoint_h
+
+#if ENABLE(DFG_JIT)
+
+#include &quot;DFGSafepoint.h&quot;
+
+namespace JSC { namespace DFG {
+
+class Graph;
+
+class GraphSafepoint {
+public:
+    GraphSafepoint(Graph&amp;);
+    ~GraphSafepoint();
+    
+private:
+    Safepoint m_safepoint;
+};
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
+
+#endif // DFGGraphSafepoint_h
+
</ins></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGOperationsh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGOperations.h (163764 => 163765)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGOperations.h        2014-02-10 06:02:42 UTC (rev 163764)
+++ trunk/Source/JavaScriptCore/dfg/DFGOperations.h        2014-02-10 07:21:09 UTC (rev 163765)
</span><span class="lines">@@ -1,5 +1,5 @@
</span><span class="cx"> /*
</span><del>- * Copyright (C) 2011, 2013 Apple Inc. All rights reserved.
</del><ins>+ * Copyright (C) 2011, 2013, 2014 Apple Inc. All rights reserved.
</ins><span class="cx">  *
</span><span class="cx">  * Redistribution and use in source and binary forms, with or without
</span><span class="cx">  * modification, are permitted provided that the following conditions
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGPlancpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGPlan.cpp (163764 => 163765)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGPlan.cpp        2014-02-10 06:02:42 UTC (rev 163764)
+++ trunk/Source/JavaScriptCore/dfg/DFGPlan.cpp        2014-02-10 07:21:09 UTC (rev 163765)
</span><span class="lines">@@ -42,6 +42,7 @@
</span><span class="cx"> #include &quot;DFGFailedFinalizer.h&quot;
</span><span class="cx"> #include &quot;DFGFlushLivenessAnalysisPhase.h&quot;
</span><span class="cx"> #include &quot;DFGFixupPhase.h&quot;
</span><ins>+#include &quot;DFGGraphSafepoint.h&quot;
</ins><span class="cx"> #include &quot;DFGInvalidationPointInjectionPhase.h&quot;
</span><span class="cx"> #include &quot;DFGJITCompiler.h&quot;
</span><span class="cx"> #include &quot;DFGLICMPhase.h&quot;
</span><span class="lines">@@ -136,8 +137,10 @@
</span><span class="cx">         || (Options::reportFTLCompileTimes() &amp;&amp; isFTL(mode));
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-void Plan::compileInThread(LongLivedState&amp; longLivedState)
</del><ins>+void Plan::compileInThread(LongLivedState&amp; longLivedState, ThreadData* threadData)
</ins><span class="cx"> {
</span><ins>+    this-&gt;threadData = threadData;
+    
</ins><span class="cx">     double before = 0;
</span><span class="cx">     if (reportCompileTimes())
</span><span class="cx">         before = currentTimeMS();
</span><span class="lines">@@ -314,8 +317,11 @@
</span><span class="cx">         
</span><span class="cx">         dumpAndVerifyGraph(dfg, &quot;Graph just before FTL lowering:&quot;);
</span><span class="cx">         
</span><del>-        initializeLLVM();
-        
</del><ins>+        {
+            GraphSafepoint safepoint(dfg);
+            initializeLLVM();
+        }
+            
</ins><span class="cx">         FTL::State state(dfg);
</span><span class="cx">         FTL::lowerDFGToLLVM(state);
</span><span class="cx">         
</span><span class="lines">@@ -328,7 +334,7 @@
</span><span class="cx">         }
</span><span class="cx">         
</span><span class="cx">         FTL::compile(state);
</span><del>-
</del><ins>+            
</ins><span class="cx">         if (Options::llvmAlwaysFailsBeforeLink()) {
</span><span class="cx">             FTL::fail(state);
</span><span class="cx">             return FTLPath;
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGPlanh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGPlan.h (163764 => 163765)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGPlan.h        2014-02-10 06:02:42 UTC (rev 163764)
+++ trunk/Source/JavaScriptCore/dfg/DFGPlan.h        2014-02-10 07:21:09 UTC (rev 163765)
</span><span class="lines">@@ -52,6 +52,7 @@
</span><span class="cx"> namespace DFG {
</span><span class="cx"> 
</span><span class="cx"> class LongLivedState;
</span><ins>+class ThreadData;
</ins><span class="cx"> 
</span><span class="cx"> #if ENABLE(DFG_JIT)
</span><span class="cx"> 
</span><span class="lines">@@ -62,7 +63,7 @@
</span><span class="cx">         const Operands&lt;JSValue&gt;&amp; mustHandleValues);
</span><span class="cx">     ~Plan();
</span><span class="cx">     
</span><del>-    void compileInThread(LongLivedState&amp;);
</del><ins>+    void compileInThread(LongLivedState&amp;, ThreadData*);
</ins><span class="cx">     
</span><span class="cx">     CompilationResult finalizeWithoutNotifyingCallback();
</span><span class="cx">     void finalizeAndNotifyCallback();
</span><span class="lines">@@ -79,6 +80,8 @@
</span><span class="cx">     CompilationMode mode;
</span><span class="cx">     const unsigned osrEntryBytecodeIndex;
</span><span class="cx">     Operands&lt;JSValue&gt; mustHandleValues;
</span><ins>+    
+    ThreadData* threadData;
</ins><span class="cx"> 
</span><span class="cx">     RefPtr&lt;Profiler::Compilation&gt; compilation;
</span><span class="cx"> 
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGSafepointcpp"></a>
<div class="addfile"><h4>Added: trunk/Source/JavaScriptCore/dfg/DFGSafepoint.cpp (0 => 163765)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGSafepoint.cpp                                (rev 0)
+++ trunk/Source/JavaScriptCore/dfg/DFGSafepoint.cpp        2014-02-10 07:21:09 UTC (rev 163765)
</span><span class="lines">@@ -0,0 +1,76 @@
</span><ins>+/*
+ * Copyright (C) 2014 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include &quot;config.h&quot;
+
+#if ENABLE(DFG_JIT)
+
+#include &quot;DFGSafepoint.h&quot;
+
+#include &quot;DFGPlan.h&quot;
+#include &quot;DFGScannable.h&quot;
+#include &quot;DFGThreadData.h&quot;
+#include &quot;Operations.h&quot;
+
+namespace JSC { namespace DFG {
+
+Safepoint::Safepoint(Plan&amp; plan)
+    : m_plan(plan)
+    , m_didCallBegin(false)
+{
+}
+
+Safepoint::~Safepoint()
+{
+    RELEASE_ASSERT(m_didCallBegin);
+    if (ThreadData* data = m_plan.threadData)
+        data-&gt;m_rightToRun.lock();
+}
+
+void Safepoint::add(Scannable* scannable)
+{
+    RELEASE_ASSERT(!m_didCallBegin);
+    m_scannables.append(scannable);
+}
+
+void Safepoint::begin()
+{
+    RELEASE_ASSERT(!m_didCallBegin);
+    if (ThreadData* data = m_plan.threadData)
+        data-&gt;m_rightToRun.unlock();
+    m_didCallBegin = true;
+}
+
+void Safepoint::visitChildren(SlotVisitor&amp; visitor)
+{
+    RELEASE_ASSERT(m_didCallBegin);
+    for (unsigned i = m_scannables.size(); i--;)
+        m_scannables[i]-&gt;visitChildren(visitor);
+}
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
+
</ins></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGSafepointh"></a>
<div class="addfile"><h4>Added: trunk/Source/JavaScriptCore/dfg/DFGSafepoint.h (0 => 163765)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGSafepoint.h                                (rev 0)
+++ trunk/Source/JavaScriptCore/dfg/DFGSafepoint.h        2014-02-10 07:21:09 UTC (rev 163765)
</span><span class="lines">@@ -0,0 +1,64 @@
</span><ins>+/*
+ * Copyright (C) 2014 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef DFGSafepoint_h
+#define DFGSafepoint_h
+
+#if ENABLE(DFG_JIT)
+
+#include &lt;wtf/Vector.h&gt;
+
+namespace JSC {
+
+class SlotVisitor;
+
+namespace DFG {
+
+class Scannable;
+struct Plan;
+
+class Safepoint {
+public:
+    Safepoint(Plan&amp;);
+    ~Safepoint();
+    
+    void add(Scannable*);
+    
+    void begin();
+    
+    void visitChildren(SlotVisitor&amp;);
+    
+private:
+    Plan&amp; m_plan;
+    Vector&lt;Scannable*&gt; m_scannables;
+    bool m_didCallBegin;
+};
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
+
+#endif // DFGSafepoint_h
+
</ins></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGScannableh"></a>
<div class="addfile"><h4>Added: trunk/Source/JavaScriptCore/dfg/DFGScannable.h (0 => 163765)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGScannable.h                                (rev 0)
+++ trunk/Source/JavaScriptCore/dfg/DFGScannable.h        2014-02-10 07:21:09 UTC (rev 163765)
</span><span class="lines">@@ -0,0 +1,50 @@
</span><ins>+/*
+ * Copyright (C) 2014 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef DFGScannable_h
+#define DFGScannable_h
+
+#if ENABLE(DFG_JIT)
+
+namespace JSC {
+
+class SlotVisitor;
+
+namespace DFG {
+
+class Scannable {
+public:
+    Scannable() { }
+    virtual ~Scannable() { }
+    
+    virtual void visitChildren(SlotVisitor&amp;) = 0;
+};
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
+
+#endif // DFGScannable_h
+
</ins></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGThreadDatacpp"></a>
<div class="addfile"><h4>Added: trunk/Source/JavaScriptCore/dfg/DFGThreadData.cpp (0 => 163765)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGThreadData.cpp                                (rev 0)
+++ trunk/Source/JavaScriptCore/dfg/DFGThreadData.cpp        2014-02-10 07:21:09 UTC (rev 163765)
</span><span class="lines">@@ -0,0 +1,50 @@
</span><ins>+/*
+ * Copyright (C) 2014 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include &quot;config.h&quot;
+
+#if ENABLE(DFG_JIT)
+
+#include &quot;DFGThreadData.h&quot;
+
+#include &quot;Operations.h&quot;
+
+namespace JSC { namespace DFG {
+
+ThreadData::ThreadData(Worklist* worklist)
+    : m_worklist(worklist)
+    , m_identifier(0)
+    , m_safepoint(nullptr)
+{
+}
+
+ThreadData::~ThreadData()
+{
+}
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
+
</ins></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGThreadDatah"></a>
<div class="addfile"><h4>Added: trunk/Source/JavaScriptCore/dfg/DFGThreadData.h (0 => 163765)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGThreadData.h                                (rev 0)
+++ trunk/Source/JavaScriptCore/dfg/DFGThreadData.h        2014-02-10 07:21:09 UTC (rev 163765)
</span><span class="lines">@@ -0,0 +1,59 @@
</span><ins>+/*
+ * Copyright (C) 2014 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef DFGThreadData_h
+#define DFGThreadData_h
+
+#if ENABLE(DFG_JIT)
+
+#include &lt;wtf/Threading.h&gt;
+#include &lt;wtf/ThreadingPrimitives.h&gt;
+
+namespace JSC { namespace DFG {
+
+class Safepoint;
+class Worklist;
+
+class ThreadData {
+public:
+    ThreadData(Worklist*);
+    ~ThreadData();
+    
+private:
+    friend class Safepoint;
+    friend class Worklist;
+    
+    Worklist* m_worklist;
+    ThreadIdentifier m_identifier;
+    Mutex m_rightToRun;
+    Safepoint* m_safepoint;
+};
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
+
+#endif // DFGThreadData_h
+
</ins></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGWorklistcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGWorklist.cpp (163764 => 163765)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGWorklist.cpp        2014-02-10 06:02:42 UTC (rev 163764)
+++ trunk/Source/JavaScriptCore/dfg/DFGWorklist.cpp        2014-02-10 07:21:09 UTC (rev 163765)
</span><span class="lines">@@ -32,6 +32,7 @@
</span><span class="cx"> #include &quot;CodeBlock.h&quot;
</span><span class="cx"> #include &quot;DeferGC.h&quot;
</span><span class="cx"> #include &quot;DFGLongLivedState.h&quot;
</span><ins>+#include &quot;DFGSafepoint.h&quot;
</ins><span class="cx"> #include &quot;Operations.h&quot;
</span><span class="cx"> #include &lt;mutex&gt;
</span><span class="cx"> 
</span><span class="lines">@@ -59,8 +60,7 @@
</span><span class="cx"> {
</span><span class="cx">     RELEASE_ASSERT(numberOfThreads);
</span><span class="cx">     for (unsigned i = numberOfThreads; i--;) {
</span><del>-        std::unique_ptr&lt;ThreadData&gt; data = std::make_unique&lt;ThreadData&gt;();
-        data-&gt;m_worklist = this;
</del><ins>+        std::unique_ptr&lt;ThreadData&gt; data = std::make_unique&lt;ThreadData&gt;(this);
</ins><span class="cx">         data-&gt;m_identifier = createThread(threadFunction, data.get(), &quot;JSC Compilation Thread&quot;);
</span><span class="cx">         m_threads.append(std::move(data));
</span><span class="cx">     }
</span><span class="lines">@@ -212,6 +212,12 @@
</span><span class="cx">         iter-&gt;key.visitChildren(codeBlocks);
</span><span class="cx">         iter-&gt;value-&gt;visitChildren(visitor, codeBlocks);
</span><span class="cx">     }
</span><ins>+    
+    for (unsigned i = m_threads.size(); i--;) {
+        ThreadData* data = m_threads[i].get();
+        if (Safepoint* safepoint = data-&gt;m_safepoint)
+            safepoint-&gt;visitChildren(visitor);
+    }
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> size_t Worklist::queueLength()
</span><span class="lines">@@ -267,7 +273,7 @@
</span><span class="cx">             if (Options::verboseCompilationQueue())
</span><span class="cx">                 dataLog(*this, &quot;: Compiling &quot;, plan-&gt;key(), &quot; asynchronously\n&quot;);
</span><span class="cx">         
</span><del>-            plan-&gt;compileInThread(longLivedState);
</del><ins>+            plan-&gt;compileInThread(longLivedState, data);
</ins><span class="cx">         }
</span><span class="cx">         
</span><span class="cx">         {
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGWorklisth"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGWorklist.h (163764 => 163765)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGWorklist.h        2014-02-10 06:02:42 UTC (rev 163764)
+++ trunk/Source/JavaScriptCore/dfg/DFGWorklist.h        2014-02-10 07:21:09 UTC (rev 163765)
</span><span class="lines">@@ -31,6 +31,7 @@
</span><span class="cx"> #if ENABLE(DFG_JIT)
</span><span class="cx"> 
</span><span class="cx"> #include &quot;DFGPlan.h&quot;
</span><ins>+#include &quot;DFGThreadData.h&quot;
</ins><span class="cx"> #include &lt;wtf/Deque.h&gt;
</span><span class="cx"> #include &lt;wtf/HashMap.h&gt;
</span><span class="cx"> #include &lt;wtf/Noncopyable.h&gt;
</span><span class="lines">@@ -77,12 +78,6 @@
</span><span class="cx">     void dump(PrintStream&amp;) const;
</span><span class="cx">     
</span><span class="cx"> private:
</span><del>-    struct ThreadData {
-        Worklist* m_worklist;
-        ThreadIdentifier m_identifier;
-        Mutex m_rightToRun;
-    };
-    
</del><span class="cx">     Worklist();
</span><span class="cx">     void finishCreation(unsigned numberOfThreads);
</span><span class="cx">     
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreftlFTLCompilecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/ftl/FTLCompile.cpp (163764 => 163765)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/ftl/FTLCompile.cpp        2014-02-10 06:02:42 UTC (rev 163764)
+++ trunk/Source/JavaScriptCore/ftl/FTLCompile.cpp        2014-02-10 07:21:09 UTC (rev 163765)
</span><span class="lines">@@ -31,6 +31,7 @@
</span><span class="cx"> #include &quot;CodeBlockWithJITType.h&quot;
</span><span class="cx"> #include &quot;CCallHelpers.h&quot;
</span><span class="cx"> #include &quot;DFGCommon.h&quot;
</span><ins>+#include &quot;DFGGraphSafepoint.h&quot;
</ins><span class="cx"> #include &quot;DataView.h&quot;
</span><span class="cx"> #include &quot;Disassembler.h&quot;
</span><span class="cx"> #include &quot;FTLExitThunkGenerator.h&quot;
</span><span class="lines">@@ -452,70 +453,74 @@
</span><span class="cx"> {
</span><span class="cx">     char* error = 0;
</span><span class="cx">     
</span><del>-    LLVMMCJITCompilerOptions options;
-    llvm-&gt;InitializeMCJITCompilerOptions(&amp;options, sizeof(options));
-    options.OptLevel = Options::llvmBackendOptimizationLevel();
-    options.NoFramePointerElim = true;
-    if (Options::useLLVMSmallCodeModel())
-        options.CodeModel = LLVMCodeModelSmall;
-    options.EnableFastISel = Options::enableLLVMFastISel();
-    options.MCJMM = llvm-&gt;CreateSimpleMCJITMemoryManager(
-        &amp;state, mmAllocateCodeSection, mmAllocateDataSection, mmApplyPermissions, mmDestroy);
</del><ins>+    {
+        GraphSafepoint safepoint(state.graph);
+        
+        LLVMMCJITCompilerOptions options;
+        llvm-&gt;InitializeMCJITCompilerOptions(&amp;options, sizeof(options));
+        options.OptLevel = Options::llvmBackendOptimizationLevel();
+        options.NoFramePointerElim = true;
+        if (Options::useLLVMSmallCodeModel())
+            options.CodeModel = LLVMCodeModelSmall;
+        options.EnableFastISel = Options::enableLLVMFastISel();
+        options.MCJMM = llvm-&gt;CreateSimpleMCJITMemoryManager(
+            &amp;state, mmAllocateCodeSection, mmAllocateDataSection, mmApplyPermissions, mmDestroy);
</ins><span class="cx">     
</span><del>-    LLVMExecutionEngineRef engine;
</del><ins>+        LLVMExecutionEngineRef engine;
</ins><span class="cx">     
</span><del>-    if (llvm-&gt;CreateMCJITCompilerForModule(&amp;engine, state.module, &amp;options, sizeof(options), &amp;error)) {
-        dataLog(&quot;FATAL: Could not create LLVM execution engine: &quot;, error, &quot;\n&quot;);
-        CRASH();
-    }
</del><ins>+        if (llvm-&gt;CreateMCJITCompilerForModule(&amp;engine, state.module, &amp;options, sizeof(options), &amp;error)) {
+            dataLog(&quot;FATAL: Could not create LLVM execution engine: &quot;, error, &quot;\n&quot;);
+            CRASH();
+        }
</ins><span class="cx"> 
</span><del>-    LLVMPassManagerRef functionPasses = 0;
-    LLVMPassManagerRef modulePasses;
</del><ins>+        LLVMPassManagerRef functionPasses = 0;
+        LLVMPassManagerRef modulePasses;
</ins><span class="cx">     
</span><del>-    if (Options::llvmSimpleOpt()) {
-        modulePasses = llvm-&gt;CreatePassManager();
-        llvm-&gt;AddTargetData(llvm-&gt;GetExecutionEngineTargetData(engine), modulePasses);
-        llvm-&gt;AddPromoteMemoryToRegisterPass(modulePasses);
-        llvm-&gt;AddConstantPropagationPass(modulePasses);
-        llvm-&gt;AddInstructionCombiningPass(modulePasses);
-        llvm-&gt;AddBasicAliasAnalysisPass(modulePasses);
-        llvm-&gt;AddTypeBasedAliasAnalysisPass(modulePasses);
-        llvm-&gt;AddGVNPass(modulePasses);
-        llvm-&gt;AddCFGSimplificationPass(modulePasses);
-        llvm-&gt;RunPassManager(modulePasses, state.module);
-    } else {
-        LLVMPassManagerBuilderRef passBuilder = llvm-&gt;PassManagerBuilderCreate();
-        llvm-&gt;PassManagerBuilderSetOptLevel(passBuilder, Options::llvmOptimizationLevel());
-        llvm-&gt;PassManagerBuilderSetSizeLevel(passBuilder, Options::llvmSizeLevel());
</del><ins>+        if (Options::llvmSimpleOpt()) {
+            modulePasses = llvm-&gt;CreatePassManager();
+            llvm-&gt;AddTargetData(llvm-&gt;GetExecutionEngineTargetData(engine), modulePasses);
+            llvm-&gt;AddPromoteMemoryToRegisterPass(modulePasses);
+            llvm-&gt;AddConstantPropagationPass(modulePasses);
+            llvm-&gt;AddInstructionCombiningPass(modulePasses);
+            llvm-&gt;AddBasicAliasAnalysisPass(modulePasses);
+            llvm-&gt;AddTypeBasedAliasAnalysisPass(modulePasses);
+            llvm-&gt;AddGVNPass(modulePasses);
+            llvm-&gt;AddCFGSimplificationPass(modulePasses);
+            llvm-&gt;RunPassManager(modulePasses, state.module);
+        } else {
+            LLVMPassManagerBuilderRef passBuilder = llvm-&gt;PassManagerBuilderCreate();
+            llvm-&gt;PassManagerBuilderSetOptLevel(passBuilder, Options::llvmOptimizationLevel());
+            llvm-&gt;PassManagerBuilderSetSizeLevel(passBuilder, Options::llvmSizeLevel());
</ins><span class="cx">         
</span><del>-        functionPasses = llvm-&gt;CreateFunctionPassManagerForModule(state.module);
-        modulePasses = llvm-&gt;CreatePassManager();
</del><ins>+            functionPasses = llvm-&gt;CreateFunctionPassManagerForModule(state.module);
+            modulePasses = llvm-&gt;CreatePassManager();
</ins><span class="cx">         
</span><del>-        llvm-&gt;AddTargetData(llvm-&gt;GetExecutionEngineTargetData(engine), modulePasses);
</del><ins>+            llvm-&gt;AddTargetData(llvm-&gt;GetExecutionEngineTargetData(engine), modulePasses);
</ins><span class="cx">         
</span><del>-        llvm-&gt;PassManagerBuilderPopulateFunctionPassManager(passBuilder, functionPasses);
-        llvm-&gt;PassManagerBuilderPopulateModulePassManager(passBuilder, modulePasses);
</del><ins>+            llvm-&gt;PassManagerBuilderPopulateFunctionPassManager(passBuilder, functionPasses);
+            llvm-&gt;PassManagerBuilderPopulateModulePassManager(passBuilder, modulePasses);
</ins><span class="cx">         
</span><del>-        llvm-&gt;PassManagerBuilderDispose(passBuilder);
</del><ins>+            llvm-&gt;PassManagerBuilderDispose(passBuilder);
</ins><span class="cx">         
</span><del>-        llvm-&gt;InitializeFunctionPassManager(functionPasses);
-        for (LValue function = llvm-&gt;GetFirstFunction(state.module); function; function = llvm-&gt;GetNextFunction(function))
-            llvm-&gt;RunFunctionPassManager(functionPasses, function);
-        llvm-&gt;FinalizeFunctionPassManager(functionPasses);
</del><ins>+            llvm-&gt;InitializeFunctionPassManager(functionPasses);
+            for (LValue function = llvm-&gt;GetFirstFunction(state.module); function; function = llvm-&gt;GetNextFunction(function))
+                llvm-&gt;RunFunctionPassManager(functionPasses, function);
+            llvm-&gt;FinalizeFunctionPassManager(functionPasses);
</ins><span class="cx">         
</span><del>-        llvm-&gt;RunPassManager(modulePasses, state.module);
-    }
</del><ins>+            llvm-&gt;RunPassManager(modulePasses, state.module);
+        }
</ins><span class="cx"> 
</span><del>-    if (DFG::shouldShowDisassembly() || DFG::verboseCompilationEnabled())
-        state.dumpState(&quot;after optimization&quot;);
</del><ins>+        if (DFG::shouldShowDisassembly() || DFG::verboseCompilationEnabled())
+            state.dumpState(&quot;after optimization&quot;);
</ins><span class="cx">     
</span><del>-    // FIXME: Need to add support for the case where JIT memory allocation failed.
-    // https://bugs.webkit.org/show_bug.cgi?id=113620
-    state.generatedFunction = reinterpret_cast&lt;GeneratedFunction&gt;(llvm-&gt;GetPointerToGlobal(engine, state.function));
-    if (functionPasses)
-        llvm-&gt;DisposePassManager(functionPasses);
-    llvm-&gt;DisposePassManager(modulePasses);
-    llvm-&gt;DisposeExecutionEngine(engine);
</del><ins>+        // FIXME: Need to add support for the case where JIT memory allocation failed.
+        // https://bugs.webkit.org/show_bug.cgi?id=113620
+        state.generatedFunction = reinterpret_cast&lt;GeneratedFunction&gt;(llvm-&gt;GetPointerToGlobal(engine, state.function));
+        if (functionPasses)
+            llvm-&gt;DisposePassManager(functionPasses);
+        llvm-&gt;DisposePassManager(modulePasses);
+        llvm-&gt;DisposeExecutionEngine(engine);
+    }
</ins><span class="cx"> 
</span><span class="cx">     if (shouldShowDisassembly()) {
</span><span class="cx">         for (unsigned i = 0; i &lt; state.jitCode-&gt;handles().size(); ++i) {
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreheapSlotVisitorh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/heap/SlotVisitor.h (163764 => 163765)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/heap/SlotVisitor.h        2014-02-10 06:02:42 UTC (rev 163764)
+++ trunk/Source/JavaScriptCore/heap/SlotVisitor.h        2014-02-10 07:21:09 UTC (rev 163765)
</span><span class="lines">@@ -68,6 +68,9 @@
</span><span class="cx">     void appendUnbarrieredValue(JSValue*);
</span><span class="cx">     template&lt;typename T&gt;
</span><span class="cx">     void appendUnbarrieredWeak(Weak&lt;T&gt;*);
</span><ins>+    template&lt;typename T&gt;
+    void appendUnbarrieredReadOnlyPointer(T*);
+    void appendUnbarrieredReadOnlyValue(JSValue);
</ins><span class="cx">     void unconditionallyAppend(JSCell*);
</span><span class="cx">     
</span><span class="cx">     void addOpaqueRoot(void*);
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreheapSlotVisitorInlinesh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/heap/SlotVisitorInlines.h (163764 => 163765)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/heap/SlotVisitorInlines.h        2014-02-10 06:02:42 UTC (rev 163764)
+++ trunk/Source/JavaScriptCore/heap/SlotVisitorInlines.h        2014-02-10 07:21:09 UTC (rev 163765)
</span><span class="lines">@@ -51,6 +51,12 @@
</span><span class="cx">     internalAppend(slot, cell);
</span><span class="cx"> }
</span><span class="cx"> 
</span><ins>+template&lt;typename T&gt;
+inline void SlotVisitor::appendUnbarrieredReadOnlyPointer(T* cell)
+{
+    internalAppend(0, cell);
+}
+
</ins><span class="cx"> ALWAYS_INLINE void SlotVisitor::append(JSValue* slot)
</span><span class="cx"> {
</span><span class="cx">     ASSERT(slot);
</span><span class="lines">@@ -63,6 +69,11 @@
</span><span class="cx">     internalAppend(slot, *slot);
</span><span class="cx"> }
</span><span class="cx"> 
</span><ins>+ALWAYS_INLINE void SlotVisitor::appendUnbarrieredReadOnlyValue(JSValue value)
+{
+    internalAppend(0, value);
+}
+
</ins><span class="cx"> ALWAYS_INLINE void SlotVisitor::append(JSCell** slot)
</span><span class="cx"> {
</span><span class="cx">     ASSERT(slot);
</span></span></pre>
</div>
</div>

</body>
</html>