<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN"
"http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head><meta http-equiv="content-type" content="text/html; charset=utf-8" />
<title>[169950] branches/ftlopt</title>
</head>
<body>

<style type="text/css"><!--
#msg dl.meta { border: 1px #006 solid; background: #369; padding: 6px; color: #fff; }
#msg dl.meta dt { float: left; width: 6em; font-weight: bold; }
#msg dt:after { content:':';}
#msg dl, #msg dt, #msg ul, #msg li, #header, #footer, #logmsg { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt;  }
#msg dl a { font-weight: bold}
#msg dl a:link    { color:#fc3; }
#msg dl a:active  { color:#ff0; }
#msg dl a:visited { color:#cc6; }
h3 { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; font-weight: bold; }
#msg pre { overflow: auto; background: #ffc; border: 1px #fa0 solid; padding: 6px; }
#logmsg { background: #ffc; border: 1px #fa0 solid; padding: 1em 1em 0 1em; }
#logmsg p, #logmsg pre, #logmsg blockquote { margin: 0 0 1em 0; }
#logmsg p, #logmsg li, #logmsg dt, #logmsg dd { line-height: 14pt; }
#logmsg h1, #logmsg h2, #logmsg h3, #logmsg h4, #logmsg h5, #logmsg h6 { margin: .5em 0; }
#logmsg h1:first-child, #logmsg h2:first-child, #logmsg h3:first-child, #logmsg h4:first-child, #logmsg h5:first-child, #logmsg h6:first-child { margin-top: 0; }
#logmsg ul, #logmsg ol { padding: 0; list-style-position: inside; margin: 0 0 0 1em; }
#logmsg ul { text-indent: -1em; padding-left: 1em; }#logmsg ol { text-indent: -1.5em; padding-left: 1.5em; }
#logmsg > ul, #logmsg > ol { margin: 0 0 1em 0; }
#logmsg pre { background: #eee; padding: 1em; }
#logmsg blockquote { border: 1px solid #fa0; border-left-width: 10px; padding: 1em 1em 0 1em; background: white;}
#logmsg dl { margin: 0; }
#logmsg dt { font-weight: bold; }
#logmsg dd { margin: 0; padding: 0 0 0.5em 0; }
#logmsg dd:before { content:'\00bb';}
#logmsg table { border-spacing: 0px; border-collapse: collapse; border-top: 4px solid #fa0; border-bottom: 1px solid #fa0; background: #fff; }
#logmsg table th { text-align: left; font-weight: normal; padding: 0.2em 0.5em; border-top: 1px dotted #fa0; }
#logmsg table td { text-align: right; border-top: 1px dotted #fa0; padding: 0.2em 0.5em; }
#logmsg table thead th { text-align: center; border-bottom: 1px solid #fa0; }
#logmsg table th.Corner { text-align: left; }
#logmsg hr { border: none 0; border-top: 2px dashed #fa0; height: 1px; }
#header, #footer { color: #fff; background: #636; border: 1px #300 solid; padding: 6px; }
#patch { width: 100%; }
#patch h4 {font-family: verdana,arial,helvetica,sans-serif;font-size:10pt;padding:8px;background:#369;color:#fff;margin:0;}
#patch .propset h4, #patch .binary h4 {margin:0;}
#patch pre {padding:0;line-height:1.2em;margin:0;}
#patch .diff {width:100%;background:#eee;padding: 0 0 10px 0;overflow:auto;}
#patch .propset .diff, #patch .binary .diff  {padding:10px 0;}
#patch span {display:block;padding:0 10px;}
#patch .modfile, #patch .addfile, #patch .delfile, #patch .propset, #patch .binary, #patch .copfile {border:1px solid #ccc;margin:10px 0;}
#patch ins {background:#dfd;text-decoration:none;display:block;padding:0 10px;}
#patch del {background:#fdd;text-decoration:none;display:block;padding:0 10px;}
#patch .lines, .info {color:#888;background:#fff;}
--></style>
<div id="msg">
<dl class="meta">
<dt>Revision</dt> <dd><a href="http://trac.webkit.org/projects/webkit/changeset/169950">169950</a></dd>
<dt>Author</dt> <dd>fpizlo@apple.com</dd>
<dt>Date</dt> <dd>2014-06-13 14:49:09 -0700 (Fri, 13 Jun 2014)</dd>
</dl>

<h3>Log Message</h3>
<pre>[ftlopt] A DFG inlined ById access variant should not speak of a chain, but only of what structures to test the base for, whether to use a constant as an alternate base for the actual access, and what structures to check on what additional cell constants
https://bugs.webkit.org/show_bug.cgi?id=133821

Reviewed by Mark Hahnenberg.

Source/JavaScriptCore: 
        
This allows us to efficiently cache accesses that differ only in the prototypes on the path
from the base to the prototype that has the field.
        
It also simplifies a bunch of code - IntendedStructureChain is now just an intermediate
data structure.

* CMakeLists.txt:
* JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
* JavaScriptCore.xcodeproj/project.pbxproj:
* bytecode/ConstantStructureCheck.cpp: Added.
(JSC::ConstantStructureCheck::dumpInContext):
(JSC::ConstantStructureCheck::dump):
(JSC::structureFor):
(JSC::areCompatible):
(JSC::mergeInto):
* bytecode/ConstantStructureCheck.h: Added.
(JSC::ConstantStructureCheck::ConstantStructureCheck):
(JSC::ConstantStructureCheck::operator!):
(JSC::ConstantStructureCheck::constant):
(JSC::ConstantStructureCheck::structure):
* bytecode/GetByIdStatus.cpp:
(JSC::GetByIdStatus::computeForStubInfo):
* bytecode/GetByIdVariant.cpp:
(JSC::GetByIdVariant::GetByIdVariant):
(JSC::GetByIdVariant::operator=):
(JSC::GetByIdVariant::attemptToMerge):
(JSC::GetByIdVariant::dumpInContext):
* bytecode/GetByIdVariant.h:
(JSC::GetByIdVariant::constantChecks):
(JSC::GetByIdVariant::alternateBase):
(JSC::GetByIdVariant::GetByIdVariant): Deleted.
(JSC::GetByIdVariant::chain): Deleted.
* bytecode/PutByIdVariant.cpp:
(JSC::PutByIdVariant::dumpInContext):
* bytecode/PutByIdVariant.h:
(JSC::PutByIdVariant::transition):
(JSC::PutByIdVariant::constantChecks):
(JSC::PutByIdVariant::structureChain): Deleted.
* dfg/DFGAbstractInterpreterInlines.h:
(JSC::DFG::AbstractInterpreter&lt;AbstractStateType&gt;::executeEffects):
* dfg/DFGByteCodeParser.cpp:
(JSC::DFG::ByteCodeParser::emitChecks):
(JSC::DFG::ByteCodeParser::handleGetById):
(JSC::DFG::ByteCodeParser::handlePutById):
(JSC::DFG::ByteCodeParser::cellConstantWithStructureCheck): Deleted.
(JSC::DFG::ByteCodeParser::structureChainIsStillValid): Deleted.
(JSC::DFG::ByteCodeParser::emitPrototypeChecks): Deleted.
* dfg/DFGConstantFoldingPhase.cpp:
(JSC::DFG::ConstantFoldingPhase::foldConstants):
(JSC::DFG::ConstantFoldingPhase::emitGetByOffset):
(JSC::DFG::ConstantFoldingPhase::emitPutByOffset):
(JSC::DFG::ConstantFoldingPhase::addStructureTransitionCheck):
* dfg/DFGDesiredStructureChains.cpp: Removed.
* dfg/DFGDesiredStructureChains.h: Removed.
* dfg/DFGGraph.h:
(JSC::DFG::Graph::watchpoints):
(JSC::DFG::Graph::chains): Deleted.
* dfg/DFGPlan.cpp:
(JSC::DFG::Plan::isStillValid):
(JSC::DFG::Plan::checkLivenessAndVisitChildren):
(JSC::DFG::Plan::cancel):
* dfg/DFGPlan.h:
* ftl/FTLLowerDFGToLLVM.cpp:
(JSC::FTL::LowerDFGToLLVM::compileMultiGetByOffset):
* runtime/IntendedStructureChain.cpp:
(JSC::IntendedStructureChain::gatherChecks):
* runtime/IntendedStructureChain.h:
(JSC::IntendedStructureChain::at):
(JSC::IntendedStructureChain::operator[]):

LayoutTests: 

* js/regress/poly-chain-access-different-prototypes-expected.txt: Added.
* js/regress/poly-chain-access-different-prototypes-simple-expected.txt: Added.
* js/regress/poly-chain-access-different-prototypes-simple.html: Added.
* js/regress/poly-chain-access-different-prototypes.html: Added.
* js/regress/script-tests/poly-chain-access-different-prototypes-simple.js: Added.
* js/regress/script-tests/poly-chain-access-different-prototypes.js: Added.</pre>

<h3>Modified Paths</h3>
<ul>
<li><a href="#branchesftloptLayoutTestsChangeLog">branches/ftlopt/LayoutTests/ChangeLog</a></li>
<li><a href="#branchesftloptSourceJavaScriptCoreCMakeListstxt">branches/ftlopt/Source/JavaScriptCore/CMakeLists.txt</a></li>
<li><a href="#branchesftloptSourceJavaScriptCoreChangeLog">branches/ftlopt/Source/JavaScriptCore/ChangeLog</a></li>
<li><a href="#branchesftloptSourceJavaScriptCoreJavaScriptCorevcxprojJavaScriptCorevcxproj">branches/ftlopt/Source/JavaScriptCore/JavaScriptCore.vcxproj/JavaScriptCore.vcxproj</a></li>
<li><a href="#branchesftloptSourceJavaScriptCoreJavaScriptCorexcodeprojprojectpbxproj">branches/ftlopt/Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj</a></li>
<li><a href="#branchesftloptSourceJavaScriptCorebytecodeGetByIdStatuscpp">branches/ftlopt/Source/JavaScriptCore/bytecode/GetByIdStatus.cpp</a></li>
<li><a href="#branchesftloptSourceJavaScriptCorebytecodeGetByIdVariantcpp">branches/ftlopt/Source/JavaScriptCore/bytecode/GetByIdVariant.cpp</a></li>
<li><a href="#branchesftloptSourceJavaScriptCorebytecodeGetByIdVarianth">branches/ftlopt/Source/JavaScriptCore/bytecode/GetByIdVariant.h</a></li>
<li><a href="#branchesftloptSourceJavaScriptCorebytecodePutByIdVariantcpp">branches/ftlopt/Source/JavaScriptCore/bytecode/PutByIdVariant.cpp</a></li>
<li><a href="#branchesftloptSourceJavaScriptCorebytecodePutByIdVarianth">branches/ftlopt/Source/JavaScriptCore/bytecode/PutByIdVariant.h</a></li>
<li><a href="#branchesftloptSourceJavaScriptCoredfgDFGAbstractInterpreterInlinesh">branches/ftlopt/Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h</a></li>
<li><a href="#branchesftloptSourceJavaScriptCoredfgDFGByteCodeParsercpp">branches/ftlopt/Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp</a></li>
<li><a href="#branchesftloptSourceJavaScriptCoredfgDFGConstantFoldingPhasecpp">branches/ftlopt/Source/JavaScriptCore/dfg/DFGConstantFoldingPhase.cpp</a></li>
<li><a href="#branchesftloptSourceJavaScriptCoredfgDFGGraphh">branches/ftlopt/Source/JavaScriptCore/dfg/DFGGraph.h</a></li>
<li><a href="#branchesftloptSourceJavaScriptCoredfgDFGPlancpp">branches/ftlopt/Source/JavaScriptCore/dfg/DFGPlan.cpp</a></li>
<li><a href="#branchesftloptSourceJavaScriptCoredfgDFGPlanh">branches/ftlopt/Source/JavaScriptCore/dfg/DFGPlan.h</a></li>
<li><a href="#branchesftloptSourceJavaScriptCoreftlFTLLowerDFGToLLVMcpp">branches/ftlopt/Source/JavaScriptCore/ftl/FTLLowerDFGToLLVM.cpp</a></li>
<li><a href="#branchesftloptSourceJavaScriptCoreruntimeIntendedStructureChaincpp">branches/ftlopt/Source/JavaScriptCore/runtime/IntendedStructureChain.cpp</a></li>
<li><a href="#branchesftloptSourceJavaScriptCoreruntimeIntendedStructureChainh">branches/ftlopt/Source/JavaScriptCore/runtime/IntendedStructureChain.h</a></li>
<li><a href="#branchesftloptSourceWTFwtfListDumph">branches/ftlopt/Source/WTF/wtf/ListDump.h</a></li>
</ul>

<h3>Added Paths</h3>
<ul>
<li><a href="#branchesftloptLayoutTestsjsregresspolychainaccessdifferentprototypesexpectedtxt">branches/ftlopt/LayoutTests/js/regress/poly-chain-access-different-prototypes-expected.txt</a></li>
<li><a href="#branchesftloptLayoutTestsjsregresspolychainaccessdifferentprototypessimpleexpectedtxt">branches/ftlopt/LayoutTests/js/regress/poly-chain-access-different-prototypes-simple-expected.txt</a></li>
<li><a href="#branchesftloptLayoutTestsjsregresspolychainaccessdifferentprototypessimplehtml">branches/ftlopt/LayoutTests/js/regress/poly-chain-access-different-prototypes-simple.html</a></li>
<li><a href="#branchesftloptLayoutTestsjsregresspolychainaccessdifferentprototypeshtml">branches/ftlopt/LayoutTests/js/regress/poly-chain-access-different-prototypes.html</a></li>
<li><a href="#branchesftloptLayoutTestsjsregressscripttestspolychainaccessdifferentprototypessimplejs">branches/ftlopt/LayoutTests/js/regress/script-tests/poly-chain-access-different-prototypes-simple.js</a></li>
<li><a href="#branchesftloptLayoutTestsjsregressscripttestspolychainaccessdifferentprototypesjs">branches/ftlopt/LayoutTests/js/regress/script-tests/poly-chain-access-different-prototypes.js</a></li>
<li><a href="#branchesftloptSourceJavaScriptCorebytecodeConstantStructureCheckcpp">branches/ftlopt/Source/JavaScriptCore/bytecode/ConstantStructureCheck.cpp</a></li>
<li><a href="#branchesftloptSourceJavaScriptCorebytecodeConstantStructureCheckh">branches/ftlopt/Source/JavaScriptCore/bytecode/ConstantStructureCheck.h</a></li>
</ul>

<h3>Removed Paths</h3>
<ul>
<li><a href="#branchesftloptSourceJavaScriptCoredfgDFGDesiredStructureChainscpp">branches/ftlopt/Source/JavaScriptCore/dfg/DFGDesiredStructureChains.cpp</a></li>
<li><a href="#branchesftloptSourceJavaScriptCoredfgDFGDesiredStructureChainsh">branches/ftlopt/Source/JavaScriptCore/dfg/DFGDesiredStructureChains.h</a></li>
</ul>

</div>
<div id="patch">
<h3>Diff</h3>
<a id="branchesftloptLayoutTestsChangeLog"></a>
<div class="modfile"><h4>Modified: branches/ftlopt/LayoutTests/ChangeLog (169949 => 169950)</h4>
<pre class="diff"><span>
<span class="info">--- branches/ftlopt/LayoutTests/ChangeLog        2014-06-13 21:30:27 UTC (rev 169949)
+++ branches/ftlopt/LayoutTests/ChangeLog        2014-06-13 21:49:09 UTC (rev 169950)
</span><span class="lines">@@ -1,3 +1,17 @@
</span><ins>+2014-06-12  Filip Pizlo  &lt;fpizlo@apple.com&gt;
+
+        [ftlopt] A DFG inlined ById access variant should not speak of a chain, but only of what structures to test the base for, whether to use a constant as an alternate base for the actual access, and what structures to check on what additional cell constants
+        https://bugs.webkit.org/show_bug.cgi?id=133821
+
+        Reviewed by Mark Hahnenberg.
+
+        * js/regress/poly-chain-access-different-prototypes-expected.txt: Added.
+        * js/regress/poly-chain-access-different-prototypes-simple-expected.txt: Added.
+        * js/regress/poly-chain-access-different-prototypes-simple.html: Added.
+        * js/regress/poly-chain-access-different-prototypes.html: Added.
+        * js/regress/script-tests/poly-chain-access-different-prototypes-simple.js: Added.
+        * js/regress/script-tests/poly-chain-access-different-prototypes.js: Added.
+
</ins><span class="cx"> 2014-06-11  Filip Pizlo  &lt;fpizlo@apple.com&gt;
</span><span class="cx"> 
</span><span class="cx">         [ftlopt] DFG get_by_id should inline chain accesses with a slightly polymorphic base
</span></span></pre></div>
<a id="branchesftloptLayoutTestsjsregresspolychainaccessdifferentprototypesexpectedtxt"></a>
<div class="addfile"><h4>Added: branches/ftlopt/LayoutTests/js/regress/poly-chain-access-different-prototypes-expected.txt (0 => 169950)</h4>
<pre class="diff"><span>
<span class="info">--- branches/ftlopt/LayoutTests/js/regress/poly-chain-access-different-prototypes-expected.txt                                (rev 0)
+++ branches/ftlopt/LayoutTests/js/regress/poly-chain-access-different-prototypes-expected.txt        2014-06-13 21:49:09 UTC (rev 169950)
</span><span class="lines">@@ -0,0 +1,10 @@
</span><ins>+JSRegress/poly-chain-access-different-prototypes
+
+On success, you will see a series of &quot;PASS&quot; messages, followed by &quot;TEST COMPLETE&quot;.
+
+
+PASS no exception thrown
+PASS successfullyParsed is true
+
+TEST COMPLETE
+
</ins></span></pre></div>
<a id="branchesftloptLayoutTestsjsregresspolychainaccessdifferentprototypessimpleexpectedtxt"></a>
<div class="addfile"><h4>Added: branches/ftlopt/LayoutTests/js/regress/poly-chain-access-different-prototypes-simple-expected.txt (0 => 169950)</h4>
<pre class="diff"><span>
<span class="info">--- branches/ftlopt/LayoutTests/js/regress/poly-chain-access-different-prototypes-simple-expected.txt                                (rev 0)
+++ branches/ftlopt/LayoutTests/js/regress/poly-chain-access-different-prototypes-simple-expected.txt        2014-06-13 21:49:09 UTC (rev 169950)
</span><span class="lines">@@ -0,0 +1,10 @@
</span><ins>+JSRegress/poly-chain-access-different-prototypes-simple
+
+On success, you will see a series of &quot;PASS&quot; messages, followed by &quot;TEST COMPLETE&quot;.
+
+
+PASS no exception thrown
+PASS successfullyParsed is true
+
+TEST COMPLETE
+
</ins></span></pre></div>
<a id="branchesftloptLayoutTestsjsregresspolychainaccessdifferentprototypessimplehtml"></a>
<div class="addfile"><h4>Added: branches/ftlopt/LayoutTests/js/regress/poly-chain-access-different-prototypes-simple.html (0 => 169950)</h4>
<pre class="diff"><span>
<span class="info">--- branches/ftlopt/LayoutTests/js/regress/poly-chain-access-different-prototypes-simple.html                                (rev 0)
+++ branches/ftlopt/LayoutTests/js/regress/poly-chain-access-different-prototypes-simple.html        2014-06-13 21:49:09 UTC (rev 169950)
</span><span class="lines">@@ -0,0 +1,12 @@
</span><ins>+&lt;!DOCTYPE HTML PUBLIC &quot;-//IETF//DTD HTML//EN&quot;&gt;
+&lt;html&gt;
+&lt;head&gt;
+&lt;script src=&quot;../../resources/js-test-pre.js&quot;&gt;&lt;/script&gt;
+&lt;/head&gt;
+&lt;body&gt;
+&lt;script src=&quot;../../resources/regress-pre.js&quot;&gt;&lt;/script&gt;
+&lt;script src=&quot;script-tests/poly-chain-access-different-prototypes-simple.js&quot;&gt;&lt;/script&gt;
+&lt;script src=&quot;../../resources/regress-post.js&quot;&gt;&lt;/script&gt;
+&lt;script src=&quot;../../resources/js-test-post.js&quot;&gt;&lt;/script&gt;
+&lt;/body&gt;
+&lt;/html&gt;
</ins></span></pre></div>
<a id="branchesftloptLayoutTestsjsregresspolychainaccessdifferentprototypeshtml"></a>
<div class="addfile"><h4>Added: branches/ftlopt/LayoutTests/js/regress/poly-chain-access-different-prototypes.html (0 => 169950)</h4>
<pre class="diff"><span>
<span class="info">--- branches/ftlopt/LayoutTests/js/regress/poly-chain-access-different-prototypes.html                                (rev 0)
+++ branches/ftlopt/LayoutTests/js/regress/poly-chain-access-different-prototypes.html        2014-06-13 21:49:09 UTC (rev 169950)
</span><span class="lines">@@ -0,0 +1,12 @@
</span><ins>+&lt;!DOCTYPE HTML PUBLIC &quot;-//IETF//DTD HTML//EN&quot;&gt;
+&lt;html&gt;
+&lt;head&gt;
+&lt;script src=&quot;../../resources/js-test-pre.js&quot;&gt;&lt;/script&gt;
+&lt;/head&gt;
+&lt;body&gt;
+&lt;script src=&quot;../../resources/regress-pre.js&quot;&gt;&lt;/script&gt;
+&lt;script src=&quot;script-tests/poly-chain-access-different-prototypes.js&quot;&gt;&lt;/script&gt;
+&lt;script src=&quot;../../resources/regress-post.js&quot;&gt;&lt;/script&gt;
+&lt;script src=&quot;../../resources/js-test-post.js&quot;&gt;&lt;/script&gt;
+&lt;/body&gt;
+&lt;/html&gt;
</ins></span></pre></div>
<a id="branchesftloptLayoutTestsjsregressscripttestspolychainaccessdifferentprototypessimplejs"></a>
<div class="addfile"><h4>Added: branches/ftlopt/LayoutTests/js/regress/script-tests/poly-chain-access-different-prototypes-simple.js (0 => 169950)</h4>
<pre class="diff"><span>
<span class="info">--- branches/ftlopt/LayoutTests/js/regress/script-tests/poly-chain-access-different-prototypes-simple.js                                (rev 0)
+++ branches/ftlopt/LayoutTests/js/regress/script-tests/poly-chain-access-different-prototypes-simple.js        2014-06-13 21:49:09 UTC (rev 169950)
</span><span class="lines">@@ -0,0 +1,24 @@
</span><ins>+(function() {
+    function Foo() { }
+    Foo.prototype.f = 42;
+    function Bar() { }
+    Bar.prototype = new Foo();
+    function Baz() { }
+    Baz.prototype = new Foo();
+    
+    function foo(o, p) {
+        var n = 1000000;
+        var result = 0;
+        for (var i = 0; i &lt; n; ++i) {
+            result += o.f;
+            var tmp = o;
+            o = p;
+            p = tmp;
+        }
+        
+        if (result != n * 42)
+            throw &quot;Error: bad result: &quot; + result;
+    }
+
+    foo(new Bar(), new Baz());
+})();
</ins></span></pre></div>
<a id="branchesftloptLayoutTestsjsregressscripttestspolychainaccessdifferentprototypesjs"></a>
<div class="addfile"><h4>Added: branches/ftlopt/LayoutTests/js/regress/script-tests/poly-chain-access-different-prototypes.js (0 => 169950)</h4>
<pre class="diff"><span>
<span class="info">--- branches/ftlopt/LayoutTests/js/regress/script-tests/poly-chain-access-different-prototypes.js                                (rev 0)
+++ branches/ftlopt/LayoutTests/js/regress/script-tests/poly-chain-access-different-prototypes.js        2014-06-13 21:49:09 UTC (rev 169950)
</span><span class="lines">@@ -0,0 +1,23 @@
</span><ins>+(function() {
+    function Foo() { }
+    Foo.prototype.f = 42;
+    function Bar() { }
+    Bar.prototype = new Foo();
+    function Baz() { }
+    Baz.prototype = new Foo();
+    
+    var o = new Bar();
+    var p = new Baz();
+    
+    var n = 1000000;
+    var result = 0;
+    for (var i = 0; i &lt; n; ++i) {
+        result += o.f;
+        var tmp = o;
+        o = p;
+        p = tmp;
+    }
+    
+    if (result != n * 42)
+        throw &quot;Error: bad result: &quot; + result;
+})();
</ins></span></pre></div>
<a id="branchesftloptSourceJavaScriptCoreCMakeListstxt"></a>
<div class="modfile"><h4>Modified: branches/ftlopt/Source/JavaScriptCore/CMakeLists.txt (169949 => 169950)</h4>
<pre class="diff"><span>
<span class="info">--- branches/ftlopt/Source/JavaScriptCore/CMakeLists.txt        2014-06-13 21:30:27 UTC (rev 169949)
+++ branches/ftlopt/Source/JavaScriptCore/CMakeLists.txt        2014-06-13 21:49:09 UTC (rev 169950)
</span><span class="lines">@@ -67,6 +67,7 @@
</span><span class="cx">     bytecode/CodeBlockJettisoningWatchpoint.cpp
</span><span class="cx">     bytecode/CodeOrigin.cpp
</span><span class="cx">     bytecode/CodeType.cpp
</span><ins>+    bytecode/ConstantStructureCheck.cpp
</ins><span class="cx">     bytecode/DFGExitProfile.cpp
</span><span class="cx">     bytecode/DeferredCompilationCallback.cpp
</span><span class="cx">     bytecode/ExecutionCounter.cpp
</span><span class="lines">@@ -131,7 +132,6 @@
</span><span class="cx">     dfg/DFGCriticalEdgeBreakingPhase.cpp
</span><span class="cx">     dfg/DFGDCEPhase.cpp
</span><span class="cx">     dfg/DFGDesiredIdentifiers.cpp
</span><del>-    dfg/DFGDesiredStructureChains.cpp
</del><span class="cx">     dfg/DFGDesiredTransitions.cpp
</span><span class="cx">     dfg/DFGDesiredWatchpoints.cpp
</span><span class="cx">     dfg/DFGDesiredWeakReferences.cpp
</span></span></pre></div>
<a id="branchesftloptSourceJavaScriptCoreChangeLog"></a>
<div class="modfile"><h4>Modified: branches/ftlopt/Source/JavaScriptCore/ChangeLog (169949 => 169950)</h4>
<pre class="diff"><span>
<span class="info">--- branches/ftlopt/Source/JavaScriptCore/ChangeLog        2014-06-13 21:30:27 UTC (rev 169949)
+++ branches/ftlopt/Source/JavaScriptCore/ChangeLog        2014-06-13 21:49:09 UTC (rev 169950)
</span><span class="lines">@@ -1,5 +1,82 @@
</span><span class="cx"> 2014-06-12  Filip Pizlo  &lt;fpizlo@apple.com&gt;
</span><span class="cx"> 
</span><ins>+        [ftlopt] A DFG inlined ById access variant should not speak of a chain, but only of what structures to test the base for, whether to use a constant as an alternate base for the actual access, and what structures to check on what additional cell constants
+        https://bugs.webkit.org/show_bug.cgi?id=133821
+
+        Reviewed by Mark Hahnenberg.
+        
+        This allows us to efficiently cache accesses that differ only in the prototypes on the path
+        from the base to the prototype that has the field.
+        
+        It also simplifies a bunch of code - IntendedStructureChain is now just an intermediate
+        data structure.
+
+        * CMakeLists.txt:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * bytecode/ConstantStructureCheck.cpp: Added.
+        (JSC::ConstantStructureCheck::dumpInContext):
+        (JSC::ConstantStructureCheck::dump):
+        (JSC::structureFor):
+        (JSC::areCompatible):
+        (JSC::mergeInto):
+        * bytecode/ConstantStructureCheck.h: Added.
+        (JSC::ConstantStructureCheck::ConstantStructureCheck):
+        (JSC::ConstantStructureCheck::operator!):
+        (JSC::ConstantStructureCheck::constant):
+        (JSC::ConstantStructureCheck::structure):
+        * bytecode/GetByIdStatus.cpp:
+        (JSC::GetByIdStatus::computeForStubInfo):
+        * bytecode/GetByIdVariant.cpp:
+        (JSC::GetByIdVariant::GetByIdVariant):
+        (JSC::GetByIdVariant::operator=):
+        (JSC::GetByIdVariant::attemptToMerge):
+        (JSC::GetByIdVariant::dumpInContext):
+        * bytecode/GetByIdVariant.h:
+        (JSC::GetByIdVariant::constantChecks):
+        (JSC::GetByIdVariant::alternateBase):
+        (JSC::GetByIdVariant::GetByIdVariant): Deleted.
+        (JSC::GetByIdVariant::chain): Deleted.
+        * bytecode/PutByIdVariant.cpp:
+        (JSC::PutByIdVariant::dumpInContext):
+        * bytecode/PutByIdVariant.h:
+        (JSC::PutByIdVariant::transition):
+        (JSC::PutByIdVariant::constantChecks):
+        (JSC::PutByIdVariant::structureChain): Deleted.
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::AbstractInterpreter&lt;AbstractStateType&gt;::executeEffects):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::emitChecks):
+        (JSC::DFG::ByteCodeParser::handleGetById):
+        (JSC::DFG::ByteCodeParser::handlePutById):
+        (JSC::DFG::ByteCodeParser::cellConstantWithStructureCheck): Deleted.
+        (JSC::DFG::ByteCodeParser::structureChainIsStillValid): Deleted.
+        (JSC::DFG::ByteCodeParser::emitPrototypeChecks): Deleted.
+        * dfg/DFGConstantFoldingPhase.cpp:
+        (JSC::DFG::ConstantFoldingPhase::foldConstants):
+        (JSC::DFG::ConstantFoldingPhase::emitGetByOffset):
+        (JSC::DFG::ConstantFoldingPhase::emitPutByOffset):
+        (JSC::DFG::ConstantFoldingPhase::addStructureTransitionCheck):
+        * dfg/DFGDesiredStructureChains.cpp: Removed.
+        * dfg/DFGDesiredStructureChains.h: Removed.
+        * dfg/DFGGraph.h:
+        (JSC::DFG::Graph::watchpoints):
+        (JSC::DFG::Graph::chains): Deleted.
+        * dfg/DFGPlan.cpp:
+        (JSC::DFG::Plan::isStillValid):
+        (JSC::DFG::Plan::checkLivenessAndVisitChildren):
+        (JSC::DFG::Plan::cancel):
+        * dfg/DFGPlan.h:
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::LowerDFGToLLVM::compileMultiGetByOffset):
+        * runtime/IntendedStructureChain.cpp:
+        (JSC::IntendedStructureChain::gatherChecks):
+        * runtime/IntendedStructureChain.h:
+        (JSC::IntendedStructureChain::at):
+        (JSC::IntendedStructureChain::operator[]):
+
+2014-06-12  Filip Pizlo  &lt;fpizlo@apple.com&gt;
+
</ins><span class="cx">         [ftlopt] Constant folding and strength reduction should work in SSA
</span><span class="cx">         https://bugs.webkit.org/show_bug.cgi?id=133839
</span><span class="cx"> 
</span></span></pre></div>
<a id="branchesftloptSourceJavaScriptCoreJavaScriptCorevcxprojJavaScriptCorevcxproj"></a>
<div class="modfile"><h4>Modified: branches/ftlopt/Source/JavaScriptCore/JavaScriptCore.vcxproj/JavaScriptCore.vcxproj (169949 => 169950)</h4>
<pre class="diff"><span>
<span class="info">--- branches/ftlopt/Source/JavaScriptCore/JavaScriptCore.vcxproj/JavaScriptCore.vcxproj        2014-06-13 21:30:27 UTC (rev 169949)
+++ branches/ftlopt/Source/JavaScriptCore/JavaScriptCore.vcxproj/JavaScriptCore.vcxproj        2014-06-13 21:49:09 UTC (rev 169950)
</span><span class="lines">@@ -321,6 +321,7 @@
</span><span class="cx">     &lt;ClCompile Include=&quot;..\bytecode\CodeBlockJettisoningWatchpoint.cpp&quot; /&gt;
</span><span class="cx">     &lt;ClCompile Include=&quot;..\bytecode\CodeOrigin.cpp&quot; /&gt;
</span><span class="cx">     &lt;ClCompile Include=&quot;..\bytecode\CodeType.cpp&quot; /&gt;
</span><ins>+    &lt;ClCompile Include=&quot;..\bytecode\ConstantStructureCheck.cpp&quot; /&gt;
</ins><span class="cx">     &lt;ClCompile Include=&quot;..\bytecode\DeferredCompilationCallback.cpp&quot; /&gt;
</span><span class="cx">     &lt;ClCompile Include=&quot;..\bytecode\DFGExitProfile.cpp&quot; /&gt;
</span><span class="cx">     &lt;ClCompile Include=&quot;..\bytecode\ExecutionCounter.cpp&quot; /&gt;
</span><span class="lines">@@ -382,7 +383,6 @@
</span><span class="cx">     &lt;ClCompile Include=&quot;..\dfg\DFGCSEPhase.cpp&quot; /&gt;
</span><span class="cx">     &lt;ClCompile Include=&quot;..\dfg\DFGDCEPhase.cpp&quot; /&gt;
</span><span class="cx">     &lt;ClCompile Include=&quot;..\dfg\DFGDesiredIdentifiers.cpp&quot; /&gt;
</span><del>-    &lt;ClCompile Include=&quot;..\dfg\DFGDesiredStructureChains.cpp&quot; /&gt;
</del><span class="cx">     &lt;ClCompile Include=&quot;..\dfg\DFGDesiredTransitions.cpp&quot; /&gt;
</span><span class="cx">     &lt;ClCompile Include=&quot;..\dfg\DFGDesiredWatchpoints.cpp&quot; /&gt;
</span><span class="cx">     &lt;ClCompile Include=&quot;..\dfg\DFGDesiredWeakReferences.cpp&quot; /&gt;
</span><span class="lines">@@ -856,6 +856,7 @@
</span><span class="cx">     &lt;ClInclude Include=&quot;..\bytecode\CodeOrigin.h&quot; /&gt;
</span><span class="cx">     &lt;ClInclude Include=&quot;..\bytecode\CodeType.h&quot; /&gt;
</span><span class="cx">     &lt;ClInclude Include=&quot;..\bytecode\Comment.h&quot; /&gt;
</span><ins>+    &lt;ClInclude Include=&quot;..\bytecode\ConstantStructureCheck.h&quot; /&gt;
</ins><span class="cx">     &lt;ClInclude Include=&quot;..\bytecode\DataFormat.h&quot; /&gt;
</span><span class="cx">     &lt;ClInclude Include=&quot;..\bytecode\DeferredCompilationCallback.h&quot; /&gt;
</span><span class="cx">     &lt;ClInclude Include=&quot;..\bytecode\DFGExitProfile.h&quot; /&gt;
</span><span class="lines">@@ -943,7 +944,6 @@
</span><span class="cx">     &lt;ClInclude Include=&quot;..\dfg\DFGCSEPhase.h&quot; /&gt;
</span><span class="cx">     &lt;ClInclude Include=&quot;..\dfg\DFGDCEPhase.h&quot; /&gt;
</span><span class="cx">     &lt;ClInclude Include=&quot;..\dfg\DFGDesiredIdentifiers.h&quot; /&gt;
</span><del>-    &lt;ClInclude Include=&quot;..\dfg\DFGDesiredStructureChains.h&quot; /&gt;
</del><span class="cx">     &lt;ClInclude Include=&quot;..\dfg\DFGDesiredTransitions.h&quot; /&gt;
</span><span class="cx">     &lt;ClInclude Include=&quot;..\dfg\DFGDesiredWatchpoints.h&quot; /&gt;
</span><span class="cx">     &lt;ClInclude Include=&quot;..\dfg\DFGDesiredWeakReferences.h&quot; /&gt;
</span></span></pre></div>
<a id="branchesftloptSourceJavaScriptCoreJavaScriptCorexcodeprojprojectpbxproj"></a>
<div class="modfile"><h4>Modified: branches/ftlopt/Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj (169949 => 169950)</h4>
<pre class="diff"><span>
<span class="info">--- branches/ftlopt/Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj        2014-06-13 21:30:27 UTC (rev 169949)
+++ branches/ftlopt/Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj        2014-06-13 21:49:09 UTC (rev 169950)
</span><span class="lines">@@ -251,6 +251,8 @@
</span><span class="cx">                 0F3B3A281544C997003ED0FF /* DFGCFGSimplificationPhase.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F3B3A251544C991003ED0FF /* DFGCFGSimplificationPhase.h */; settings = {ATTRIBUTES = (Private, ); }; };
</span><span class="cx">                 0F3B3A2B15475000003ED0FF /* DFGValidate.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F3B3A2915474FF4003ED0FF /* DFGValidate.cpp */; };
</span><span class="cx">                 0F3B3A2C15475002003ED0FF /* DFGValidate.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F3B3A2A15474FF4003ED0FF /* DFGValidate.h */; settings = {ATTRIBUTES = (Private, ); }; };
</span><ins>+                0F3D0BBC194A414300FC9CF9 /* ConstantStructureCheck.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F3D0BBA194A414300FC9CF9 /* ConstantStructureCheck.cpp */; };
+                0F3D0BBD194A414300FC9CF9 /* ConstantStructureCheck.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F3D0BBB194A414300FC9CF9 /* ConstantStructureCheck.h */; settings = {ATTRIBUTES = (Private, ); }; };
</ins><span class="cx">                 0F426A481460CBB300131F8F /* ValueRecovery.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F426A451460CBAB00131F8F /* ValueRecovery.h */; settings = {ATTRIBUTES = (Private, ); }; };
</span><span class="cx">                 0F426A491460CBB700131F8F /* VirtualRegister.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F426A461460CBAB00131F8F /* VirtualRegister.h */; settings = {ATTRIBUTES = (Private, ); }; };
</span><span class="cx">                 0F426A4B1460CD6E00131F8F /* DataFormat.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F426A4A1460CD6B00131F8F /* DataFormat.h */; settings = {ATTRIBUTES = (Private, ); }; };
</span><span class="lines">@@ -1723,8 +1725,6 @@
</span><span class="cx">                 A7386556118697B400540279 /* ThunkGenerators.h in Headers */ = {isa = PBXBuildFile; fileRef = A7386553118697B400540279 /* ThunkGenerators.h */; settings = {ATTRIBUTES = (Private, ); }; };
</span><span class="cx">                 A73A535A1799CD5D00170C19 /* DFGLazyJSValue.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A73A53581799CD5D00170C19 /* DFGLazyJSValue.cpp */; };
</span><span class="cx">                 A73A535B1799CD5D00170C19 /* DFGLazyJSValue.h in Headers */ = {isa = PBXBuildFile; fileRef = A73A53591799CD5D00170C19 /* DFGLazyJSValue.h */; settings = {ATTRIBUTES = (Private, ); }; };
</span><del>-                A73E1330179624CD00E4DEA8 /* DFGDesiredStructureChains.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A73E132C179624CD00E4DEA8 /* DFGDesiredStructureChains.cpp */; };
-                A73E1331179624CD00E4DEA8 /* DFGDesiredStructureChains.h in Headers */ = {isa = PBXBuildFile; fileRef = A73E132D179624CD00E4DEA8 /* DFGDesiredStructureChains.h */; settings = {ATTRIBUTES = (Private, ); }; };
</del><span class="cx">                 A741017F179DAF80002EB8BA /* DFGSaneStringGetByValSlowPathGenerator.h in Headers */ = {isa = PBXBuildFile; fileRef = A741017E179DAF80002EB8BA /* DFGSaneStringGetByValSlowPathGenerator.h */; settings = {ATTRIBUTES = (Private, ); }; };
</span><span class="cx">                 A7482B9311671147003B0712 /* JSWeakObjectMapRefPrivate.h in Headers */ = {isa = PBXBuildFile; fileRef = A7482B791166CDEA003B0712 /* JSWeakObjectMapRefPrivate.h */; settings = {ATTRIBUTES = (Private, ); }; };
</span><span class="cx">                 A7482B9411671147003B0712 /* JSWeakObjectMapRefPrivate.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A7482B7A1166CDEA003B0712 /* JSWeakObjectMapRefPrivate.cpp */; };
</span><span class="lines">@@ -2415,6 +2415,8 @@
</span><span class="cx">                 0F3B3A251544C991003ED0FF /* DFGCFGSimplificationPhase.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGCFGSimplificationPhase.h; path = dfg/DFGCFGSimplificationPhase.h; sourceTree = &quot;&lt;group&gt;&quot;; };
</span><span class="cx">                 0F3B3A2915474FF4003ED0FF /* DFGValidate.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGValidate.cpp; path = dfg/DFGValidate.cpp; sourceTree = &quot;&lt;group&gt;&quot;; };
</span><span class="cx">                 0F3B3A2A15474FF4003ED0FF /* DFGValidate.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGValidate.h; path = dfg/DFGValidate.h; sourceTree = &quot;&lt;group&gt;&quot;; };
</span><ins>+                0F3D0BBA194A414300FC9CF9 /* ConstantStructureCheck.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ConstantStructureCheck.cpp; sourceTree = &quot;&lt;group&gt;&quot;; };
+                0F3D0BBB194A414300FC9CF9 /* ConstantStructureCheck.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ConstantStructureCheck.h; sourceTree = &quot;&lt;group&gt;&quot;; };
</ins><span class="cx">                 0F426A451460CBAB00131F8F /* ValueRecovery.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ValueRecovery.h; sourceTree = &quot;&lt;group&gt;&quot;; };
</span><span class="cx">                 0F426A461460CBAB00131F8F /* VirtualRegister.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = VirtualRegister.h; sourceTree = &quot;&lt;group&gt;&quot;; };
</span><span class="cx">                 0F426A4A1460CD6B00131F8F /* DataFormat.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DataFormat.h; sourceTree = &quot;&lt;group&gt;&quot;; };
</span><span class="lines">@@ -3366,8 +3368,6 @@
</span><span class="cx">                 A7386553118697B400540279 /* ThunkGenerators.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ThunkGenerators.h; sourceTree = &quot;&lt;group&gt;&quot;; };
</span><span class="cx">                 A73A53581799CD5D00170C19 /* DFGLazyJSValue.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGLazyJSValue.cpp; path = dfg/DFGLazyJSValue.cpp; sourceTree = &quot;&lt;group&gt;&quot;; };
</span><span class="cx">                 A73A53591799CD5D00170C19 /* DFGLazyJSValue.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGLazyJSValue.h; path = dfg/DFGLazyJSValue.h; sourceTree = &quot;&lt;group&gt;&quot;; };
</span><del>-                A73E132C179624CD00E4DEA8 /* DFGDesiredStructureChains.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGDesiredStructureChains.cpp; path = dfg/DFGDesiredStructureChains.cpp; sourceTree = &quot;&lt;group&gt;&quot;; };
-                A73E132D179624CD00E4DEA8 /* DFGDesiredStructureChains.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGDesiredStructureChains.h; path = dfg/DFGDesiredStructureChains.h; sourceTree = &quot;&lt;group&gt;&quot;; };
</del><span class="cx">                 A741017E179DAF80002EB8BA /* DFGSaneStringGetByValSlowPathGenerator.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGSaneStringGetByValSlowPathGenerator.h; path = dfg/DFGSaneStringGetByValSlowPathGenerator.h; sourceTree = &quot;&lt;group&gt;&quot;; };
</span><span class="cx">                 A7482B791166CDEA003B0712 /* JSWeakObjectMapRefPrivate.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSWeakObjectMapRefPrivate.h; sourceTree = &quot;&lt;group&gt;&quot;; };
</span><span class="cx">                 A7482B7A1166CDEA003B0712 /* JSWeakObjectMapRefPrivate.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSWeakObjectMapRefPrivate.cpp; sourceTree = &quot;&lt;group&gt;&quot;; };
</span><span class="lines">@@ -5038,8 +5038,6 @@
</span><span class="cx">                                 0F2FC77116E12F6F0038D976 /* DFGDCEPhase.h */,
</span><span class="cx">                                 0F8F2B97172F04FD007DBDA5 /* DFGDesiredIdentifiers.cpp */,
</span><span class="cx">                                 0F8F2B98172F04FD007DBDA5 /* DFGDesiredIdentifiers.h */,
</span><del>-                                A73E132C179624CD00E4DEA8 /* DFGDesiredStructureChains.cpp */,
-                                A73E132D179624CD00E4DEA8 /* DFGDesiredStructureChains.h */,
</del><span class="cx">                                 C2C0F7CB17BBFC5B00464FE4 /* DFGDesiredTransitions.cpp */,
</span><span class="cx">                                 C2C0F7CC17BBFC5B00464FE4 /* DFGDesiredTransitions.h */,
</span><span class="cx">                                 0FE853491723CDA500B618F5 /* DFGDesiredWatchpoints.cpp */,
</span><span class="lines">@@ -5352,6 +5350,8 @@
</span><span class="cx">                                 0FBD7E671447998F00481315 /* CodeOrigin.h */,
</span><span class="cx">                                 0F8F943F1667632D00D61971 /* CodeType.cpp */,
</span><span class="cx">                                 0F0B83A514BCF50400885B4F /* CodeType.h */,
</span><ins>+                                0F3D0BBA194A414300FC9CF9 /* ConstantStructureCheck.cpp */,
+                                0F3D0BBB194A414300FC9CF9 /* ConstantStructureCheck.h */,
</ins><span class="cx">                                 0F426A4A1460CD6B00131F8F /* DataFormat.h */,
</span><span class="cx">                                 0FC712DC17CD8778008CC93C /* DeferredCompilationCallback.cpp */,
</span><span class="cx">                                 0FC712DD17CD8778008CC93C /* DeferredCompilationCallback.h */,
</span><span class="lines">@@ -6032,7 +6032,6 @@
</span><span class="cx">                                 0FFFC95A14EF90A900C72532 /* DFGCSEPhase.h in Headers */,
</span><span class="cx">                                 0F2FC77316E12F740038D976 /* DFGDCEPhase.h in Headers */,
</span><span class="cx">                                 0F8F2B9A172F0501007DBDA5 /* DFGDesiredIdentifiers.h in Headers */,
</span><del>-                                A73E1331179624CD00E4DEA8 /* DFGDesiredStructureChains.h in Headers */,
</del><span class="cx">                                 C2C0F7CE17BBFC5B00464FE4 /* DFGDesiredTransitions.h in Headers */,
</span><span class="cx">                                 0FE8534C1723CDA500B618F5 /* DFGDesiredWatchpoints.h in Headers */,
</span><span class="cx">                                 C2981FD917BAEE4B00A3BC98 /* DFGDesiredWeakReferences.h in Headers */,
</span><span class="lines">@@ -6483,6 +6482,7 @@
</span><span class="cx">                                 BC18C43C0E16F5CD00B34460 /* MathObject.h in Headers */,
</span><span class="cx">                                 90213E3E123A40C200D422F3 /* MemoryStatistics.h in Headers */,
</span><span class="cx">                                 0FB5467B14F5C7E1002C2989 /* MethodOfGettingAValueProfile.h in Headers */,
</span><ins>+                                0F3D0BBD194A414300FC9CF9 /* ConstantStructureCheck.h in Headers */,
</ins><span class="cx">                                 7C008CE7187631B600955C24 /* Microtask.h in Headers */,
</span><span class="cx">                                 86C568E211A213EE0007F7F0 /* MIPSAssembler.h in Headers */,
</span><span class="cx">                                 86EBF3001560F06A008E9222 /* NameConstructor.h in Headers */,
</span><span class="lines">@@ -7618,7 +7618,6 @@
</span><span class="cx">                                 0FFFC95914EF90A600C72532 /* DFGCSEPhase.cpp in Sources */,
</span><span class="cx">                                 0F2FC77216E12F710038D976 /* DFGDCEPhase.cpp in Sources */,
</span><span class="cx">                                 0F8F2B99172F04FF007DBDA5 /* DFGDesiredIdentifiers.cpp in Sources */,
</span><del>-                                A73E1330179624CD00E4DEA8 /* DFGDesiredStructureChains.cpp in Sources */,
</del><span class="cx">                                 C2C0F7CD17BBFC5B00464FE4 /* DFGDesiredTransitions.cpp in Sources */,
</span><span class="cx">                                 0FE8534B1723CDA500B618F5 /* DFGDesiredWatchpoints.cpp in Sources */,
</span><span class="cx">                                 C2981FD817BAEE4B00A3BC98 /* DFGDesiredWeakReferences.cpp in Sources */,
</span><span class="lines">@@ -7856,6 +7855,7 @@
</span><span class="cx">                                 A503FA1B188E0FB000110F14 /* JSJavaScriptCallFrame.cpp in Sources */,
</span><span class="cx">                                 A503FA1D188E0FB000110F14 /* JSJavaScriptCallFramePrototype.cpp in Sources */,
</span><span class="cx">                                 14280875107EC13E0013E7B2 /* JSLock.cpp in Sources */,
</span><ins>+                                0F3D0BBC194A414300FC9CF9 /* ConstantStructureCheck.cpp in Sources */,
</ins><span class="cx">                                 C25D709B16DE99F400FCA6BC /* JSManagedValue.mm in Sources */,
</span><span class="cx">                                 A700874117CBE8EB00C3E643 /* JSMap.cpp in Sources */,
</span><span class="cx">                                 A74DEF95182D991400522C22 /* JSMapIterator.cpp in Sources */,
</span></span></pre></div>
<a id="branchesftloptSourceJavaScriptCorebytecodeConstantStructureCheckcpp"></a>
<div class="addfile"><h4>Added: branches/ftlopt/Source/JavaScriptCore/bytecode/ConstantStructureCheck.cpp (0 => 169950)</h4>
<pre class="diff"><span>
<span class="info">--- branches/ftlopt/Source/JavaScriptCore/bytecode/ConstantStructureCheck.cpp                                (rev 0)
+++ branches/ftlopt/Source/JavaScriptCore/bytecode/ConstantStructureCheck.cpp        2014-06-13 21:49:09 UTC (rev 169950)
</span><span class="lines">@@ -0,0 +1,76 @@
</span><ins>+/*
+ * Copyright (C) 2014 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include &quot;config.h&quot;
+#include &quot;ConstantStructureCheck.h&quot;
+
+#include &quot;JSCInlines.h&quot;
+
+namespace JSC {
+
+void ConstantStructureCheck::dumpInContext(PrintStream&amp; out, DumpContext* context) const
+{
+    out.print(
+        &quot;(Check if &quot;, inContext(JSValue(m_constant), context), &quot; has structure &quot;,
+        pointerDumpInContext(m_structure, context), &quot;)&quot;);
+}
+
+void ConstantStructureCheck::dump(PrintStream&amp; out) const
+{
+    dumpInContext(out, nullptr);
+}
+
+Structure* structureFor(const ConstantStructureCheckVector&amp; vector, JSCell* constant)
+{
+    for (unsigned i = vector.size(); i--;) {
+        if (vector[i].constant() == constant)
+            return vector[i].structure();
+    }
+    return nullptr;
+}
+
+bool areCompatible(const ConstantStructureCheckVector&amp; a, const ConstantStructureCheckVector&amp; b)
+{
+    for (unsigned i = a.size(); i--;) {
+        Structure* otherStructure = structureFor(b, a[i].constant());
+        if (!otherStructure)
+            continue;
+        if (a[i].structure() != otherStructure)
+            return false;
+    }
+    return true;
+}
+
+void mergeInto(const ConstantStructureCheckVector&amp; source, ConstantStructureCheckVector&amp; target)
+{
+    for (unsigned i = source.size(); i--;) {
+        if (structureFor(target, source[i].constant()))
+            continue;
+        target.append(source[i]);
+    }
+}
+
+} // namespace JSC
+
</ins></span></pre></div>
<a id="branchesftloptSourceJavaScriptCorebytecodeConstantStructureCheckh"></a>
<div class="addfile"><h4>Added: branches/ftlopt/Source/JavaScriptCore/bytecode/ConstantStructureCheck.h (0 => 169950)</h4>
<pre class="diff"><span>
<span class="info">--- branches/ftlopt/Source/JavaScriptCore/bytecode/ConstantStructureCheck.h                                (rev 0)
+++ branches/ftlopt/Source/JavaScriptCore/bytecode/ConstantStructureCheck.h        2014-06-13 21:49:09 UTC (rev 169950)
</span><span class="lines">@@ -0,0 +1,74 @@
</span><ins>+/*
+ * Copyright (C) 2014 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef ConstantStructureCheck_h
+#define ConstantStructureCheck_h
+
+#include &quot;DumpContext.h&quot;
+#include &quot;JSCell.h&quot;
+#include &quot;Structure.h&quot;
+#include &lt;wtf/PrintStream.h&gt;
+#include &lt;wtf/Vector.h&gt;
+
+namespace JSC {
+
+class ConstantStructureCheck {
+public:
+    ConstantStructureCheck()
+        : m_constant(nullptr)
+        , m_structure(nullptr)
+    {
+    }
+    
+    ConstantStructureCheck(JSCell* constant, Structure* structure)
+        : m_constant(constant)
+        , m_structure(structure)
+    {
+        ASSERT(!!m_constant == !!m_structure);
+    }
+    
+    bool operator!() const { return !m_constant; }
+    
+    JSCell* constant() const { return m_constant; }
+    Structure* structure() const { return m_structure; }
+    
+    void dumpInContext(PrintStream&amp;, DumpContext*) const;
+    void dump(PrintStream&amp;) const;
+    
+private:
+    JSCell* m_constant;
+    Structure* m_structure;
+};
+
+typedef Vector&lt;ConstantStructureCheck, 2&gt; ConstantStructureCheckVector;
+
+Structure* structureFor(const ConstantStructureCheckVector&amp; vector, JSCell* constant);
+bool areCompatible(const ConstantStructureCheckVector&amp;, const ConstantStructureCheckVector&amp;);
+void mergeInto(const ConstantStructureCheckVector&amp; source, ConstantStructureCheckVector&amp; target);
+
+} // namespace JSC
+
+#endif // ConstantStructureCheck_h
+
</ins></span></pre></div>
<a id="branchesftloptSourceJavaScriptCorebytecodeGetByIdStatuscpp"></a>
<div class="modfile"><h4>Modified: branches/ftlopt/Source/JavaScriptCore/bytecode/GetByIdStatus.cpp (169949 => 169950)</h4>
<pre class="diff"><span>
<span class="info">--- branches/ftlopt/Source/JavaScriptCore/bytecode/GetByIdStatus.cpp        2014-06-13 21:30:27 UTC (rev 169949)
+++ branches/ftlopt/Source/JavaScriptCore/bytecode/GetByIdStatus.cpp        2014-06-13 21:49:09 UTC (rev 169950)
</span><span class="lines">@@ -253,7 +253,7 @@
</span><span class="cx">             }
</span><span class="cx">             
</span><span class="cx">             GetByIdVariant variant(
</span><del>-                StructureSet(structure), myOffset, specificValue, chain,
</del><ins>+                StructureSet(structure), myOffset, specificValue, chain.get(),
</ins><span class="cx">                 std::move(callLinkStatus));
</span><span class="cx">             
</span><span class="cx">             if (!result.appendVariant(variant))
</span></span></pre></div>
<a id="branchesftloptSourceJavaScriptCorebytecodeGetByIdVariantcpp"></a>
<div class="modfile"><h4>Modified: branches/ftlopt/Source/JavaScriptCore/bytecode/GetByIdVariant.cpp (169949 => 169950)</h4>
<pre class="diff"><span>
<span class="info">--- branches/ftlopt/Source/JavaScriptCore/bytecode/GetByIdVariant.cpp        2014-06-13 21:30:27 UTC (rev 169949)
+++ branches/ftlopt/Source/JavaScriptCore/bytecode/GetByIdVariant.cpp        2014-06-13 21:49:09 UTC (rev 169950)
</span><span class="lines">@@ -28,9 +28,31 @@
</span><span class="cx"> 
</span><span class="cx"> #include &quot;CallLinkStatus.h&quot;
</span><span class="cx"> #include &quot;JSCInlines.h&quot;
</span><ins>+#include &lt;wtf/ListDump.h&gt;
</ins><span class="cx"> 
</span><span class="cx"> namespace JSC {
</span><span class="cx"> 
</span><ins>+GetByIdVariant::GetByIdVariant(
+    const StructureSet&amp; structureSet, PropertyOffset offset, JSValue specificValue,
+    const IntendedStructureChain* chain, std::unique_ptr&lt;CallLinkStatus&gt; callLinkStatus)
+    : m_structureSet(structureSet)
+    , m_alternateBase(nullptr)
+    , m_specificValue(specificValue)
+    , m_offset(offset)
+    , m_callLinkStatus(std::move(callLinkStatus))
+{
+    if (!structureSet.size()) {
+        ASSERT(offset == invalidOffset);
+        ASSERT(!specificValue);
+        ASSERT(!chain);
+    }
+    
+    if (chain &amp;&amp; chain-&gt;size()) {
+        m_alternateBase = chain-&gt;terminalPrototype();
+        chain-&gt;gatherChecks(m_constantChecks);
+    }
+}
+
</ins><span class="cx"> GetByIdVariant::~GetByIdVariant() { }
</span><span class="cx"> 
</span><span class="cx"> GetByIdVariant::GetByIdVariant(const GetByIdVariant&amp; other)
</span><span class="lines">@@ -41,7 +63,8 @@
</span><span class="cx"> GetByIdVariant&amp; GetByIdVariant::operator=(const GetByIdVariant&amp; other)
</span><span class="cx"> {
</span><span class="cx">     m_structureSet = other.m_structureSet;
</span><del>-    m_chain = other.m_chain;
</del><ins>+    m_constantChecks = other.m_constantChecks;
+    m_alternateBase = other.m_alternateBase;
</ins><span class="cx">     m_specificValue = other.m_specificValue;
</span><span class="cx">     m_offset = other.m_offset;
</span><span class="cx">     if (other.m_callLinkStatus)
</span><span class="lines">@@ -53,18 +76,19 @@
</span><span class="cx"> 
</span><span class="cx"> bool GetByIdVariant::attemptToMerge(const GetByIdVariant&amp; other)
</span><span class="cx"> {
</span><del>-    if (!!m_chain != !!other.m_chain)
</del><ins>+    if (m_alternateBase != other.m_alternateBase)
</ins><span class="cx">         return false;
</span><del>-    if (m_chain &amp;&amp; *m_chain != *other.m_chain)
-        return false;
</del><span class="cx">     if (m_offset != other.m_offset)
</span><span class="cx">         return false;
</span><span class="cx">     if (m_callLinkStatus || other.m_callLinkStatus)
</span><span class="cx">         return false;
</span><ins>+    if (!areCompatible(m_constantChecks, other.m_constantChecks))
+        return false;
</ins><span class="cx">     
</span><span class="cx">     if (m_specificValue != other.m_specificValue)
</span><span class="cx">         m_specificValue = JSValue();
</span><span class="cx"> 
</span><ins>+    mergeInto(other.m_constantChecks, m_constantChecks);
</ins><span class="cx">     m_structureSet.merge(other.m_structureSet);
</span><span class="cx">     
</span><span class="cx">     return true;
</span><span class="lines">@@ -84,10 +108,12 @@
</span><span class="cx">     
</span><span class="cx">     out.print(
</span><span class="cx">         &quot;&lt;&quot;, inContext(structureSet(), context), &quot;, &quot;,
</span><del>-        pointerDumpInContext(chain(), context), &quot;, &quot;,
-        inContext(specificValue(), context), &quot;, &quot;, offset());
</del><ins>+        &quot;[&quot;, listDumpInContext(m_constantChecks, context), &quot;], &quot;,
+        &quot;alternateBase = &quot;, inContext(JSValue(m_alternateBase), context), &quot;, &quot;,
+        &quot;specificValue = &quot;, inContext(specificValue(), context), &quot;, &quot;,
+        &quot;offset = &quot;, offset());
</ins><span class="cx">     if (m_callLinkStatus)
</span><del>-        out.print(&quot;call: &quot;, *m_callLinkStatus);
</del><ins>+        out.print(&quot;call = &quot;, *m_callLinkStatus);
</ins><span class="cx">     out.print(&quot;&gt;&quot;);
</span><span class="cx"> }
</span><span class="cx"> 
</span></span></pre></div>
<a id="branchesftloptSourceJavaScriptCorebytecodeGetByIdVarianth"></a>
<div class="modfile"><h4>Modified: branches/ftlopt/Source/JavaScriptCore/bytecode/GetByIdVariant.h (169949 => 169950)</h4>
<pre class="diff"><span>
<span class="info">--- branches/ftlopt/Source/JavaScriptCore/bytecode/GetByIdVariant.h        2014-06-13 21:30:27 UTC (rev 169949)
+++ branches/ftlopt/Source/JavaScriptCore/bytecode/GetByIdVariant.h        2014-06-13 21:49:09 UTC (rev 169950)
</span><span class="lines">@@ -27,6 +27,7 @@
</span><span class="cx"> #define GetByIdVariant_h
</span><span class="cx"> 
</span><span class="cx"> #include &quot;CallLinkStatus.h&quot;
</span><ins>+#include &quot;ConstantStructureCheck.h&quot;
</ins><span class="cx"> #include &quot;IntendedStructureChain.h&quot;
</span><span class="cx"> #include &quot;JSCJSValue.h&quot;
</span><span class="cx"> #include &quot;PropertyOffset.h&quot;
</span><span class="lines">@@ -43,20 +44,8 @@
</span><span class="cx">     GetByIdVariant(
</span><span class="cx">         const StructureSet&amp; structureSet = StructureSet(),
</span><span class="cx">         PropertyOffset offset = invalidOffset, JSValue specificValue = JSValue(),
</span><del>-        PassRefPtr&lt;IntendedStructureChain&gt; chain = nullptr,
-        std::unique_ptr&lt;CallLinkStatus&gt; callLinkStatus = nullptr)
-        : m_structureSet(structureSet)
-        , m_chain(chain)
-        , m_specificValue(specificValue)
-        , m_offset(offset)
-        , m_callLinkStatus(std::move(callLinkStatus))
-    {
-        if (!structureSet.size()) {
-            ASSERT(offset == invalidOffset);
-            ASSERT(!specificValue);
-            ASSERT(!chain);
-        }
-    }
</del><ins>+        const IntendedStructureChain* chain = nullptr,
+        std::unique_ptr&lt;CallLinkStatus&gt; callLinkStatus = nullptr);
</ins><span class="cx">     
</span><span class="cx">     ~GetByIdVariant();
</span><span class="cx">     
</span><span class="lines">@@ -66,7 +55,8 @@
</span><span class="cx">     bool isSet() const { return !!m_structureSet.size(); }
</span><span class="cx">     bool operator!() const { return !isSet(); }
</span><span class="cx">     const StructureSet&amp; structureSet() const { return m_structureSet; }
</span><del>-    IntendedStructureChain* chain() const { return const_cast&lt;IntendedStructureChain*&gt;(m_chain.get()); }
</del><ins>+    const ConstantStructureCheckVector&amp; constantChecks() const { return m_constantChecks; }
+    JSObject* alternateBase() const { return m_alternateBase; }
</ins><span class="cx">     JSValue specificValue() const { return m_specificValue; }
</span><span class="cx">     PropertyOffset offset() const { return m_offset; }
</span><span class="cx">     CallLinkStatus* callLinkStatus() const { return m_callLinkStatus.get(); }
</span><span class="lines">@@ -80,7 +70,8 @@
</span><span class="cx">     friend class GetByIdStatus;
</span><span class="cx">     
</span><span class="cx">     StructureSet m_structureSet;
</span><del>-    RefPtr&lt;IntendedStructureChain&gt; m_chain;
</del><ins>+    ConstantStructureCheckVector m_constantChecks;
+    JSObject* m_alternateBase;
</ins><span class="cx">     JSValue m_specificValue;
</span><span class="cx">     PropertyOffset m_offset;
</span><span class="cx">     std::unique_ptr&lt;CallLinkStatus&gt; m_callLinkStatus;
</span></span></pre></div>
<a id="branchesftloptSourceJavaScriptCorebytecodePutByIdVariantcpp"></a>
<div class="modfile"><h4>Modified: branches/ftlopt/Source/JavaScriptCore/bytecode/PutByIdVariant.cpp (169949 => 169950)</h4>
<pre class="diff"><span>
<span class="info">--- branches/ftlopt/Source/JavaScriptCore/bytecode/PutByIdVariant.cpp        2014-06-13 21:30:27 UTC (rev 169949)
+++ branches/ftlopt/Source/JavaScriptCore/bytecode/PutByIdVariant.cpp        2014-06-13 21:49:09 UTC (rev 169950)
</span><span class="lines">@@ -26,6 +26,8 @@
</span><span class="cx"> #include &quot;config.h&quot;
</span><span class="cx"> #include &quot;PutByIdVariant.h&quot;
</span><span class="cx"> 
</span><ins>+#include &lt;wtf/ListDump.h&gt;
+
</ins><span class="cx"> namespace JSC {
</span><span class="cx"> 
</span><span class="cx"> void PutByIdVariant::dump(PrintStream&amp; out) const
</span><span class="lines">@@ -48,8 +50,8 @@
</span><span class="cx">     case Transition:
</span><span class="cx">         out.print(
</span><span class="cx">             &quot;&lt;Transition: &quot;, pointerDumpInContext(oldStructure(), context), &quot; -&gt; &quot;,
</span><del>-            pointerDumpInContext(newStructure(), context), &quot;, &quot;,
-            pointerDumpInContext(structureChain(), context), &quot;, &quot;, offset(), &quot;&gt;&quot;);
</del><ins>+            pointerDumpInContext(newStructure(), context), &quot;, [&quot;,
+            listDumpInContext(constantChecks(), context), &quot;], &quot;, offset(), &quot;&gt;&quot;);
</ins><span class="cx">         return;
</span><span class="cx">     }
</span><span class="cx">     
</span></span></pre></div>
<a id="branchesftloptSourceJavaScriptCorebytecodePutByIdVarianth"></a>
<div class="modfile"><h4>Modified: branches/ftlopt/Source/JavaScriptCore/bytecode/PutByIdVariant.h (169949 => 169950)</h4>
<pre class="diff"><span>
<span class="info">--- branches/ftlopt/Source/JavaScriptCore/bytecode/PutByIdVariant.h        2014-06-13 21:30:27 UTC (rev 169949)
+++ branches/ftlopt/Source/JavaScriptCore/bytecode/PutByIdVariant.h        2014-06-13 21:49:09 UTC (rev 169950)
</span><span class="lines">@@ -64,7 +64,8 @@
</span><span class="cx">         result.m_kind = Transition;
</span><span class="cx">         result.m_oldStructure = oldStructure;
</span><span class="cx">         result.m_newStructure = newStructure;
</span><del>-        result.m_structureChain = structureChain;
</del><ins>+        if (structureChain)
+            structureChain-&gt;gatherChecks(result.m_constantChecks);
</ins><span class="cx">         result.m_offset = offset;
</span><span class="cx">         return result;
</span><span class="cx">     }
</span><span class="lines">@@ -92,10 +93,10 @@
</span><span class="cx">         return m_newStructure;
</span><span class="cx">     }
</span><span class="cx">     
</span><del>-    IntendedStructureChain* structureChain() const
</del><ins>+    const ConstantStructureCheckVector&amp; constantChecks() const
</ins><span class="cx">     {
</span><span class="cx">         ASSERT(kind() == Transition);
</span><del>-        return m_structureChain.get();
</del><ins>+        return m_constantChecks;
</ins><span class="cx">     }
</span><span class="cx">     
</span><span class="cx">     PropertyOffset offset() const
</span><span class="lines">@@ -111,7 +112,7 @@
</span><span class="cx">     Kind m_kind;
</span><span class="cx">     Structure* m_oldStructure;
</span><span class="cx">     Structure* m_newStructure;
</span><del>-    RefPtr&lt;IntendedStructureChain&gt; m_structureChain;
</del><ins>+    ConstantStructureCheckVector m_constantChecks;
</ins><span class="cx">     PropertyOffset m_offset;
</span><span class="cx"> };
</span><span class="cx"> 
</span></span></pre></div>
<a id="branchesftloptSourceJavaScriptCoredfgDFGAbstractInterpreterInlinesh"></a>
<div class="modfile"><h4>Modified: branches/ftlopt/Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h (169949 => 169950)</h4>
<pre class="diff"><span>
<span class="info">--- branches/ftlopt/Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h        2014-06-13 21:30:27 UTC (rev 169949)
+++ branches/ftlopt/Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h        2014-06-13 21:49:09 UTC (rev 169950)
</span><span class="lines">@@ -1471,7 +1471,8 @@
</span><span class="cx">                     // Assert things that we can't handle and that the computeFor() method
</span><span class="cx">                     // above won't be able to return.
</span><span class="cx">                     ASSERT(status[0].structureSet().size() == 1);
</span><del>-                    ASSERT(!status[0].chain());
</del><ins>+                    ASSERT(status[0].constantChecks().isEmpty());
+                    ASSERT(!status[0].alternateBase());
</ins><span class="cx">                     
</span><span class="cx">                     if (status[0].specificValue()) {
</span><span class="cx">                         if (status[0].specificValue().isCell()) {
</span><span class="lines">@@ -1679,7 +1680,7 @@
</span><span class="cx">                 if (!variant.structureSet().contains(structure))
</span><span class="cx">                     continue;
</span><span class="cx">                 
</span><del>-                if (variant.chain())
</del><ins>+                if (variant.alternateBase())
</ins><span class="cx">                     break;
</span><span class="cx">                 
</span><span class="cx">                 filter(value, structure);
</span></span></pre></div>
<a id="branchesftloptSourceJavaScriptCoredfgDFGByteCodeParsercpp"></a>
<div class="modfile"><h4>Modified: branches/ftlopt/Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp (169949 => 169950)</h4>
<pre class="diff"><span>
<span class="info">--- branches/ftlopt/Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp        2014-06-13 21:30:27 UTC (rev 169949)
+++ branches/ftlopt/Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp        2014-06-13 21:49:09 UTC (rev 169950)
</span><span class="lines">@@ -192,7 +192,7 @@
</span><span class="cx">     void handlePutById(
</span><span class="cx">         Node* base, unsigned identifierNumber, Node* value, const PutByIdStatus&amp;,
</span><span class="cx">         bool isDirect);
</span><del>-    Node* emitPrototypeChecks(IntendedStructureChain*);
</del><ins>+    void emitChecks(const ConstantStructureCheckVector&amp;);
</ins><span class="cx"> 
</span><span class="cx">     Node* getScope(bool skipTop, unsigned skipCount);
</span><span class="cx">     
</span><span class="lines">@@ -665,11 +665,6 @@
</span><span class="cx">         return objectNode;
</span><span class="cx">     }
</span><span class="cx">     
</span><del>-    Node* cellConstantWithStructureCheck(JSCell* object)
-    {
-        return cellConstantWithStructureCheck(object, m_graph.freeze(object)-&gt;structure());
-    }
-
</del><span class="cx">     SpeculatedType getPredictionWithoutOSRExit(unsigned bytecodeIndex)
</span><span class="cx">     {
</span><span class="cx">         ConcurrentJITLocker locker(m_inlineStackTop-&gt;m_profiledBlock-&gt;m_lock);
</span><span class="lines">@@ -798,22 +793,6 @@
</span><span class="cx">         return node;
</span><span class="cx">     }
</span><span class="cx">     
</span><del>-    bool structureChainIsStillValid(bool direct, Structure* previousStructure, StructureChain* chain)
-    {
-        if (direct)
-            return true;
-        
-        if (!previousStructure-&gt;storedPrototype().isNull() &amp;&amp; previousStructure-&gt;storedPrototype().asCell()-&gt;structure() != chain-&gt;head()-&gt;get())
-            return false;
-        
-        for (WriteBarrier&lt;Structure&gt;* it = chain-&gt;head(); *it; ++it) {
-            if (!(*it)-&gt;storedPrototype().isNull() &amp;&amp; (*it)-&gt;storedPrototype().asCell()-&gt;structure() != it[1].get())
-                return false;
-        }
-        
-        return true;
-    }
-    
</del><span class="cx">     void buildOperandMapsIfNecessary();
</span><span class="cx">     
</span><span class="cx">     VM* m_vm;
</span><span class="lines">@@ -1705,20 +1684,10 @@
</span><span class="cx">     return result;
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-Node* ByteCodeParser::emitPrototypeChecks(IntendedStructureChain* chain)
</del><ins>+void ByteCodeParser::emitChecks(const ConstantStructureCheckVector&amp; vector)
</ins><span class="cx"> {
</span><del>-    m_graph.chains().addLazily(chain);
-    JSValue prototype = chain-&gt;prototype();
-    if (prototype.isNull())
-        return nullptr;
-    Node* base = nullptr;
-    for (unsigned i = 0; i &lt; chain-&gt;size(); ++i) {
-        JSObject* currentObject = asObject(prototype);
-        Structure* currentStructure = chain-&gt;at(i);
-        base = cellConstantWithStructureCheck(currentObject, currentStructure);
-        prototype = currentStructure-&gt;prototypeForLookup(m_inlineStackTop-&gt;m_codeBlock);
-    }
-    return base;
</del><ins>+    for (unsigned i = 0; i &lt; vector.size(); ++i)
+        cellConstantWithStructureCheck(vector[i].constant(), vector[i].structure());
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> void ByteCodeParser::handleGetById(
</span><span class="lines">@@ -1747,10 +1716,8 @@
</span><span class="cx">         // 1) Emit prototype structure checks for all chains. This could sort of maybe not be
</span><span class="cx">         //    optimal, if there is some rarely executed case in the chain that requires a lot
</span><span class="cx">         //    of checks and those checks are not watchpointable.
</span><del>-        for (unsigned variantIndex = getByIdStatus.numVariants(); variantIndex--;) {
-            if (getByIdStatus[variantIndex].chain())
-                emitPrototypeChecks(getByIdStatus[variantIndex].chain());
-        }
</del><ins>+        for (unsigned variantIndex = getByIdStatus.numVariants(); variantIndex--;)
+            emitChecks(getByIdStatus[variantIndex].constantChecks());
</ins><span class="cx">         
</span><span class="cx">         // 2) Emit a MultiGetByOffset
</span><span class="cx">         MultiGetByOffsetData* data = m_graph.m_multiGetByOffsetData.add();
</span><span class="lines">@@ -1771,8 +1738,10 @@
</span><span class="cx">                 
</span><span class="cx">     addToGraph(CheckStructure, OpInfo(m_graph.addStructureSet(variant.structureSet())), base);
</span><span class="cx">     
</span><del>-    if (variant.chain())
-        base = emitPrototypeChecks(variant.chain());
</del><ins>+    emitChecks(variant.constantChecks());
+
+    if (variant.alternateBase())
+        base = weakJSConstant(variant.alternateBase());
</ins><span class="cx">     
</span><span class="cx">     // Unless we want bugs like https://bugs.webkit.org/show_bug.cgi?id=88783, we need to
</span><span class="cx">     // ensure that the base of the original get_by_id is kept alive until we're done with
</span><span class="lines">@@ -1869,9 +1838,7 @@
</span><span class="cx">             for (unsigned variantIndex = putByIdStatus.numVariants(); variantIndex--;) {
</span><span class="cx">                 if (putByIdStatus[variantIndex].kind() != PutByIdVariant::Transition)
</span><span class="cx">                     continue;
</span><del>-                if (!putByIdStatus[variantIndex].structureChain())
-                    continue;
-                emitPrototypeChecks(putByIdStatus[variantIndex].structureChain());
</del><ins>+                emitChecks(putByIdStatus[variantIndex].constantChecks());
</ins><span class="cx">             }
</span><span class="cx">         }
</span><span class="cx">         
</span><span class="lines">@@ -1898,16 +1865,8 @@
</span><span class="cx">         return;
</span><span class="cx">     }
</span><span class="cx"> 
</span><del>-    if (variant.structureChain() &amp;&amp; !variant.structureChain()-&gt;isStillValid()) {
-        emitPutById(base, identifierNumber, value, putByIdStatus, isDirect);
-        return;
-    }
-    
-    m_graph.chains().addLazily(variant.structureChain());
-                
</del><span class="cx">     addToGraph(CheckStructure, OpInfo(m_graph.addStructureSet(variant.oldStructure())), base);
</span><del>-    if (!isDirect)
-        emitPrototypeChecks(variant.structureChain());
</del><ins>+    emitChecks(variant.constantChecks());
</ins><span class="cx"> 
</span><span class="cx">     ASSERT(variant.oldStructure()-&gt;transitionWatchpointSetHasBeenInvalidated());
</span><span class="cx">     
</span></span></pre></div>
<a id="branchesftloptSourceJavaScriptCoredfgDFGConstantFoldingPhasecpp"></a>
<div class="modfile"><h4>Modified: branches/ftlopt/Source/JavaScriptCore/dfg/DFGConstantFoldingPhase.cpp (169949 => 169950)</h4>
<pre class="diff"><span>
<span class="info">--- branches/ftlopt/Source/JavaScriptCore/dfg/DFGConstantFoldingPhase.cpp        2014-06-13 21:30:27 UTC (rev 169949)
+++ branches/ftlopt/Source/JavaScriptCore/dfg/DFGConstantFoldingPhase.cpp        2014-06-13 21:49:09 UTC (rev 169950)
</span><span class="lines">@@ -150,7 +150,7 @@
</span><span class="cx">                     if (!variant.structureSet().contains(structure))
</span><span class="cx">                         continue;
</span><span class="cx">                     
</span><del>-                    if (variant.chain())
</del><ins>+                    if (variant.alternateBase())
</ins><span class="cx">                         break;
</span><span class="cx">                     
</span><span class="cx">                     emitGetByOffset(indexInBlock, node, structure, variant, data.identifierNumber);
</span><span class="lines">@@ -197,7 +197,8 @@
</span><span class="cx">                 GetByIdStatus status = GetByIdStatus::computeFor(
</span><span class="cx">                     vm(), structure, m_graph.identifiers()[identifierNumber]);
</span><span class="cx">                 
</span><del>-                if (!status.isSimple() || status.numVariants() != 1) {
</del><ins>+                if (!status.isSimple() || status.numVariants() != 1 ||
+                    !status[0].constantChecks().isEmpty() || status[0].alternateBase()) {
</ins><span class="cx">                     // FIXME: We could handle prototype cases.
</span><span class="cx">                     // https://bugs.webkit.org/show_bug.cgi?id=110386
</span><span class="cx">                     break;
</span><span class="lines">@@ -314,7 +315,7 @@
</span><span class="cx"> 
</span><span class="cx">         bool needsCellCheck = m_state.forNode(child).m_type &amp; ~SpecCell;
</span><span class="cx">         
</span><del>-        ASSERT(!variant.chain());
</del><ins>+        ASSERT(!variant.alternateBase());
</ins><span class="cx">         ASSERT_UNUSED(structure, variant.structureSet().contains(structure));
</span><span class="cx">         
</span><span class="cx">         // Now before we do anything else, push the CFA forward over the GetById
</span><span class="lines">@@ -377,23 +378,11 @@
</span><span class="cx">         if (variant.kind() == PutByIdVariant::Transition) {
</span><span class="cx">             transition = m_graph.m_transitions.add(structure, variant.newStructure());
</span><span class="cx"> 
</span><del>-            if (node-&gt;op() == PutById) {
-                if (!structure-&gt;storedPrototype().isNull()) {
-                    addStructureTransitionCheck(
-                        origin, indexInBlock,
-                        structure-&gt;storedPrototype().asCell());
-                }
-
-                m_graph.chains().addLazily(variant.structureChain());
-
-                for (unsigned i = 0; i &lt; variant.structureChain()-&gt;size(); ++i) {
-                    JSValue prototype = variant.structureChain()-&gt;at(i)-&gt;storedPrototype();
-                    if (prototype.isNull())
-                        continue;
-                    ASSERT(prototype.isCell());
-                    addStructureTransitionCheck(
-                        origin, indexInBlock, prototype.asCell());
-                }
</del><ins>+            for (unsigned i = 0; i &lt; variant.constantChecks().size(); ++i) {
+                addStructureTransitionCheck(
+                    origin, indexInBlock,
+                    variant.constantChecks()[i].constant(),
+                    variant.constantChecks()[i].structure());
</ins><span class="cx">             }
</span><span class="cx">         }
</span><span class="cx"> 
</span><span class="lines">@@ -445,7 +434,7 @@
</span><span class="cx">         m_graph.m_storageAccessData.append(storageAccessData);
</span><span class="cx">     }
</span><span class="cx"> 
</span><del>-    void addStructureTransitionCheck(NodeOrigin origin, unsigned indexInBlock, JSCell* cell)
</del><ins>+    void addStructureTransitionCheck(NodeOrigin origin, unsigned indexInBlock, JSCell* cell, Structure* structure)
</ins><span class="cx">     {
</span><span class="cx">         if (m_graph.watchpoints().consider(cell-&gt;structure()))
</span><span class="cx">             return;
</span><span class="lines">@@ -456,7 +445,7 @@
</span><span class="cx">         
</span><span class="cx">         m_insertionSet.insertNode(
</span><span class="cx">             indexInBlock, SpecNone, CheckStructure, origin,
</span><del>-            OpInfo(m_graph.addStructureSet(cell-&gt;structure())), Edge(weakConstant, CellUse));
</del><ins>+            OpInfo(m_graph.addStructureSet(structure)), Edge(weakConstant, CellUse));
</ins><span class="cx">     }
</span><span class="cx">     
</span><span class="cx">     InPlaceAbstractState m_state;
</span></span></pre></div>
<a id="branchesftloptSourceJavaScriptCoredfgDFGDesiredStructureChainscpp"></a>
<div class="delfile"><h4>Deleted: branches/ftlopt/Source/JavaScriptCore/dfg/DFGDesiredStructureChains.cpp (169949 => 169950)</h4>
<pre class="diff"><span>
<span class="info">--- branches/ftlopt/Source/JavaScriptCore/dfg/DFGDesiredStructureChains.cpp        2014-06-13 21:30:27 UTC (rev 169949)
+++ branches/ftlopt/Source/JavaScriptCore/dfg/DFGDesiredStructureChains.cpp        2014-06-13 21:49:09 UTC (rev 169950)
</span><span class="lines">@@ -1,56 +0,0 @@
</span><del>-/*
- * Copyright (C) 2013, 2014 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-
-#include &quot;config.h&quot;
-#include &quot;DFGDesiredStructureChains.h&quot;
-
-#if ENABLE(DFG_JIT)
-
-#include &quot;JSCInlines.h&quot;
-
-namespace JSC { namespace DFG {
-
-DesiredStructureChains::DesiredStructureChains() { }
-DesiredStructureChains::~DesiredStructureChains() { }
-
-bool DesiredStructureChains::areStillValid() const
-{
-    for (unsigned i = 0; i &lt; m_vector.size(); ++i) {
-        if (!m_vector[i]-&gt;isStillValid())
-            return false;
-    }
-    return true;
-}
-
-void DesiredStructureChains::visitChildren(SlotVisitor&amp; visitor)
-{
-    for (unsigned i = m_vector.size(); i--;)
-        m_vector[i]-&gt;visitChildren(visitor);
-}
-
-} } // namespace JSC::DFG
-
-#endif // ENABLE(DFG_JIT)
-
</del></span></pre></div>
<a id="branchesftloptSourceJavaScriptCoredfgDFGDesiredStructureChainsh"></a>
<div class="delfile"><h4>Deleted: branches/ftlopt/Source/JavaScriptCore/dfg/DFGDesiredStructureChains.h (169949 => 169950)</h4>
<pre class="diff"><span>
<span class="info">--- branches/ftlopt/Source/JavaScriptCore/dfg/DFGDesiredStructureChains.h        2014-06-13 21:30:27 UTC (rev 169949)
+++ branches/ftlopt/Source/JavaScriptCore/dfg/DFGDesiredStructureChains.h        2014-06-13 21:49:09 UTC (rev 169950)
</span><span class="lines">@@ -1,59 +0,0 @@
</span><del>-/*
- * Copyright (C) 2013, 2014 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-
-#ifndef DFGDesiredStructureChains_h
-#define DFGDesiredStructureChains_h
-
-#if ENABLE(DFG_JIT)
-
-#include &quot;IntendedStructureChain.h&quot;
-#include &lt;wtf/Vector.h&gt;
-
-namespace JSC { namespace DFG {
-
-class DesiredStructureChains {
-public:
-    DesiredStructureChains();
-    ~DesiredStructureChains();
-    
-    void addLazily(PassRefPtr&lt;IntendedStructureChain&gt; chain)
-    {
-        m_vector.append(chain);
-    }
-    
-    bool areStillValid() const;
-    
-    void visitChildren(SlotVisitor&amp;);
-    
-private:
-    Vector&lt;RefPtr&lt;IntendedStructureChain&gt;&gt; m_vector;
-};
-
-} } // namespace JSC::DFG
-
-#endif // ENABLE(DFG_JIT)
-
-#endif // DFGDesiredStructureChains_h
-
</del></span></pre></div>
<a id="branchesftloptSourceJavaScriptCoredfgDFGGraphh"></a>
<div class="modfile"><h4>Modified: branches/ftlopt/Source/JavaScriptCore/dfg/DFGGraph.h (169949 => 169950)</h4>
<pre class="diff"><span>
<span class="info">--- branches/ftlopt/Source/JavaScriptCore/dfg/DFGGraph.h        2014-06-13 21:30:27 UTC (rev 169949)
+++ branches/ftlopt/Source/JavaScriptCore/dfg/DFGGraph.h        2014-06-13 21:49:09 UTC (rev 169950)
</span><span class="lines">@@ -671,7 +671,6 @@
</span><span class="cx">     
</span><span class="cx">     DesiredIdentifiers&amp; identifiers() { return m_plan.identifiers; }
</span><span class="cx">     DesiredWatchpoints&amp; watchpoints() { return m_plan.watchpoints; }
</span><del>-    DesiredStructureChains&amp; chains() { return m_plan.chains; }
</del><span class="cx">     
</span><span class="cx">     FullBytecodeLiveness&amp; livenessFor(CodeBlock*);
</span><span class="cx">     FullBytecodeLiveness&amp; livenessFor(InlineCallFrame*);
</span></span></pre></div>
<a id="branchesftloptSourceJavaScriptCoredfgDFGPlancpp"></a>
<div class="modfile"><h4>Modified: branches/ftlopt/Source/JavaScriptCore/dfg/DFGPlan.cpp (169949 => 169950)</h4>
<pre class="diff"><span>
<span class="info">--- branches/ftlopt/Source/JavaScriptCore/dfg/DFGPlan.cpp        2014-06-13 21:30:27 UTC (rev 169949)
+++ branches/ftlopt/Source/JavaScriptCore/dfg/DFGPlan.cpp        2014-06-13 21:49:09 UTC (rev 169950)
</span><span class="lines">@@ -408,8 +408,6 @@
</span><span class="cx">         return false;
</span><span class="cx">     if (!watchpoints.areStillValid())
</span><span class="cx">         return false;
</span><del>-    if (!chains.areStillValid())
-        return false;
</del><span class="cx">     return true;
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="lines">@@ -479,7 +477,6 @@
</span><span class="cx">     codeBlocks.mark(codeBlock.get());
</span><span class="cx">     codeBlocks.mark(profiledDFGCodeBlock.get());
</span><span class="cx">     
</span><del>-    chains.visitChildren(visitor);
</del><span class="cx">     weakReferences.visitChildren(visitor);
</span><span class="cx">     writeBarriers.visitChildren(visitor);
</span><span class="cx">     transitions.visitChildren(visitor);
</span><span class="lines">@@ -508,7 +505,6 @@
</span><span class="cx">     inlineCallFrames = nullptr;
</span><span class="cx">     watchpoints = DesiredWatchpoints();
</span><span class="cx">     identifiers = DesiredIdentifiers();
</span><del>-    chains = DesiredStructureChains();
</del><span class="cx">     weakReferences = DesiredWeakReferences();
</span><span class="cx">     writeBarriers = DesiredWriteBarriers();
</span><span class="cx">     transitions = DesiredTransitions();
</span></span></pre></div>
<a id="branchesftloptSourceJavaScriptCoredfgDFGPlanh"></a>
<div class="modfile"><h4>Modified: branches/ftlopt/Source/JavaScriptCore/dfg/DFGPlan.h (169949 => 169950)</h4>
<pre class="diff"><span>
<span class="info">--- branches/ftlopt/Source/JavaScriptCore/dfg/DFGPlan.h        2014-06-13 21:30:27 UTC (rev 169949)
+++ branches/ftlopt/Source/JavaScriptCore/dfg/DFGPlan.h        2014-06-13 21:49:09 UTC (rev 169950)
</span><span class="lines">@@ -30,7 +30,6 @@
</span><span class="cx"> #include &quot;DFGCompilationKey.h&quot;
</span><span class="cx"> #include &quot;DFGCompilationMode.h&quot;
</span><span class="cx"> #include &quot;DFGDesiredIdentifiers.h&quot;
</span><del>-#include &quot;DFGDesiredStructureChains.h&quot;
</del><span class="cx"> #include &quot;DFGDesiredTransitions.h&quot;
</span><span class="cx"> #include &quot;DFGDesiredWatchpoints.h&quot;
</span><span class="cx"> #include &quot;DFGDesiredWeakReferences.h&quot;
</span><span class="lines">@@ -92,7 +91,6 @@
</span><span class="cx">     RefPtr&lt;InlineCallFrameSet&gt; inlineCallFrames;
</span><span class="cx">     DesiredWatchpoints watchpoints;
</span><span class="cx">     DesiredIdentifiers identifiers;
</span><del>-    DesiredStructureChains chains;
</del><span class="cx">     DesiredWeakReferences weakReferences;
</span><span class="cx">     DesiredWriteBarriers writeBarriers;
</span><span class="cx">     DesiredTransitions transitions;
</span></span></pre></div>
<a id="branchesftloptSourceJavaScriptCoreftlFTLLowerDFGToLLVMcpp"></a>
<div class="modfile"><h4>Modified: branches/ftlopt/Source/JavaScriptCore/ftl/FTLLowerDFGToLLVM.cpp (169949 => 169950)</h4>
<pre class="diff"><span>
<span class="info">--- branches/ftlopt/Source/JavaScriptCore/ftl/FTLLowerDFGToLLVM.cpp        2014-06-13 21:30:27 UTC (rev 169949)
+++ branches/ftlopt/Source/JavaScriptCore/ftl/FTLLowerDFGToLLVM.cpp        2014-06-13 21:49:09 UTC (rev 169950)
</span><span class="lines">@@ -3240,8 +3240,8 @@
</span><span class="cx">                 result = m_out.constInt64(JSValue::encode(variant.specificValue()));
</span><span class="cx">             else {
</span><span class="cx">                 LValue propertyBase;
</span><del>-                if (variant.chain())
-                    propertyBase = weakPointer(variant.chain()-&gt;terminalPrototype());
</del><ins>+                if (variant.alternateBase())
+                    propertyBase = weakPointer(variant.alternateBase());
</ins><span class="cx">                 else
</span><span class="cx">                     propertyBase = base;
</span><span class="cx">                 if (!isInlineOffset(variant.offset()))
</span></span></pre></div>
<a id="branchesftloptSourceJavaScriptCoreruntimeIntendedStructureChaincpp"></a>
<div class="modfile"><h4>Modified: branches/ftlopt/Source/JavaScriptCore/runtime/IntendedStructureChain.cpp (169949 => 169950)</h4>
<pre class="diff"><span>
<span class="info">--- branches/ftlopt/Source/JavaScriptCore/runtime/IntendedStructureChain.cpp        2014-06-13 21:30:27 UTC (rev 169949)
+++ branches/ftlopt/Source/JavaScriptCore/runtime/IntendedStructureChain.cpp        2014-06-13 21:49:09 UTC (rev 169950)
</span><span class="lines">@@ -145,6 +145,17 @@
</span><span class="cx">         &amp;&amp; m_vector == other.m_vector;
</span><span class="cx"> }
</span><span class="cx"> 
</span><ins>+void IntendedStructureChain::gatherChecks(ConstantStructureCheckVector&amp; vector) const
+{
+    JSValue currentPrototype = m_prototype;
+    for (unsigned i = 0; i &lt; size(); ++i) {
+        JSObject* currentObject = asObject(currentPrototype);
+        Structure* currentStructure = at(i);
+        vector.append(ConstantStructureCheck(currentObject, currentStructure));
+        currentPrototype = currentStructure-&gt;prototypeForLookup(m_globalObject);
+    }
+}
+
</ins><span class="cx"> void IntendedStructureChain::visitChildren(SlotVisitor&amp; visitor)
</span><span class="cx"> {
</span><span class="cx">     visitor.appendUnbarrieredPointer(&amp;m_globalObject);
</span></span></pre></div>
<a id="branchesftloptSourceJavaScriptCoreruntimeIntendedStructureChainh"></a>
<div class="modfile"><h4>Modified: branches/ftlopt/Source/JavaScriptCore/runtime/IntendedStructureChain.h (169949 => 169950)</h4>
<pre class="diff"><span>
<span class="info">--- branches/ftlopt/Source/JavaScriptCore/runtime/IntendedStructureChain.h        2014-06-13 21:30:27 UTC (rev 169949)
+++ branches/ftlopt/Source/JavaScriptCore/runtime/IntendedStructureChain.h        2014-06-13 21:49:09 UTC (rev 169950)
</span><span class="lines">@@ -26,6 +26,7 @@
</span><span class="cx"> #ifndef IntendedStructureChain_h
</span><span class="cx"> #define IntendedStructureChain_h
</span><span class="cx"> 
</span><ins>+#include &quot;ConstantStructureCheck.h&quot;
</ins><span class="cx"> #include &quot;Structure.h&quot;
</span><span class="cx"> #include &lt;wtf/RefCounted.h&gt;
</span><span class="cx"> 
</span><span class="lines">@@ -54,8 +55,8 @@
</span><span class="cx">     JSValue prototype() const { return m_prototype; }
</span><span class="cx">     
</span><span class="cx">     size_t size() const { return m_vector.size(); }
</span><del>-    Structure* at(size_t index) { return m_vector[index]; }
-    Structure* operator[](size_t index) { return at(index); }
</del><ins>+    Structure* at(size_t index) const { return m_vector[index]; }
+    Structure* operator[](size_t index) const { return at(index); }
</ins><span class="cx">     
</span><span class="cx">     JSObject* terminalPrototype() const;
</span><span class="cx">     
</span><span class="lines">@@ -67,6 +68,8 @@
</span><span class="cx">         return !(*this == other);
</span><span class="cx">     }
</span><span class="cx">     
</span><ins>+    void gatherChecks(ConstantStructureCheckVector&amp;) const;
+    
</ins><span class="cx">     void visitChildren(SlotVisitor&amp;);
</span><span class="cx">     void dump(PrintStream&amp;) const;
</span><span class="cx">     void dumpInContext(PrintStream&amp;, DumpContext*) const;
</span></span></pre></div>
<a id="branchesftloptSourceWTFwtfListDumph"></a>
<div class="modfile"><h4>Modified: branches/ftlopt/Source/WTF/wtf/ListDump.h (169949 => 169950)</h4>
<pre class="diff"><span>
<span class="info">--- branches/ftlopt/Source/WTF/wtf/ListDump.h        2014-06-13 21:30:27 UTC (rev 169949)
+++ branches/ftlopt/Source/WTF/wtf/ListDump.h        2014-06-13 21:49:09 UTC (rev 169950)
</span><span class="lines">@@ -119,12 +119,42 @@
</span><span class="cx">     return out.toCString();
</span><span class="cx"> }
</span><span class="cx"> 
</span><ins>+template&lt;typename T, typename U&gt;
+class ListDumpInContext {
+public:
+    ListDumpInContext(const T&amp; list, U* context, const char* comma)
+        : m_list(list)
+        , m_context(context)
+        , m_comma(comma)
+    {
+    }
+    
+    void dump(PrintStream&amp; out) const
+    {
+        for (typename T::const_iterator iter = m_list.begin(); iter != m_list.end(); ++iter)
+            out.print(m_comma, inContext(*iter, m_context));
+    }
+
+private:
+    const T&amp; m_list;
+    U* m_context;
+    CommaPrinter m_comma;
+};
+
+template&lt;typename T, typename U&gt;
+ListDumpInContext&lt;T, U&gt; listDumpInContext(
+    const T&amp; list, U* context, const char* comma = &quot;, &quot;)
+{
+    return ListDumpInContext&lt;T, U&gt;(list, context, comma);
+}
+
</ins><span class="cx"> } // namespace WTF
</span><span class="cx"> 
</span><span class="cx"> using WTF::listDump;
</span><span class="cx"> using WTF::sortedListDump;
</span><span class="cx"> using WTF::mapDump;
</span><span class="cx"> using WTF::sortedMapDump;
</span><ins>+using WTF::listDumpInContext;
</ins><span class="cx"> 
</span><span class="cx"> #endif // ListDump_h
</span><span class="cx"> 
</span></span></pre>
</div>
</div>

</body>
</html>