<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN"
"http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head><meta http-equiv="content-type" content="text/html; charset=utf-8" />
<title>[171380] trunk</title>
</head>
<body>
<style type="text/css"><!--
#msg dl.meta { border: 1px #006 solid; background: #369; padding: 6px; color: #fff; }
#msg dl.meta dt { float: left; width: 6em; font-weight: bold; }
#msg dt:after { content:':';}
#msg dl, #msg dt, #msg ul, #msg li, #header, #footer, #logmsg { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; }
#msg dl a { font-weight: bold}
#msg dl a:link { color:#fc3; }
#msg dl a:active { color:#ff0; }
#msg dl a:visited { color:#cc6; }
h3 { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; font-weight: bold; }
#msg pre { overflow: auto; background: #ffc; border: 1px #fa0 solid; padding: 6px; }
#logmsg { background: #ffc; border: 1px #fa0 solid; padding: 1em 1em 0 1em; }
#logmsg p, #logmsg pre, #logmsg blockquote { margin: 0 0 1em 0; }
#logmsg p, #logmsg li, #logmsg dt, #logmsg dd { line-height: 14pt; }
#logmsg h1, #logmsg h2, #logmsg h3, #logmsg h4, #logmsg h5, #logmsg h6 { margin: .5em 0; }
#logmsg h1:first-child, #logmsg h2:first-child, #logmsg h3:first-child, #logmsg h4:first-child, #logmsg h5:first-child, #logmsg h6:first-child { margin-top: 0; }
#logmsg ul, #logmsg ol { padding: 0; list-style-position: inside; margin: 0 0 0 1em; }
#logmsg ul { text-indent: -1em; padding-left: 1em; }#logmsg ol { text-indent: -1.5em; padding-left: 1.5em; }
#logmsg > ul, #logmsg > ol { margin: 0 0 1em 0; }
#logmsg pre { background: #eee; padding: 1em; }
#logmsg blockquote { border: 1px solid #fa0; border-left-width: 10px; padding: 1em 1em 0 1em; background: white;}
#logmsg dl { margin: 0; }
#logmsg dt { font-weight: bold; }
#logmsg dd { margin: 0; padding: 0 0 0.5em 0; }
#logmsg dd:before { content:'\00bb';}
#logmsg table { border-spacing: 0px; border-collapse: collapse; border-top: 4px solid #fa0; border-bottom: 1px solid #fa0; background: #fff; }
#logmsg table th { text-align: left; font-weight: normal; padding: 0.2em 0.5em; border-top: 1px dotted #fa0; }
#logmsg table td { text-align: right; border-top: 1px dotted #fa0; padding: 0.2em 0.5em; }
#logmsg table thead th { text-align: center; border-bottom: 1px solid #fa0; }
#logmsg table th.Corner { text-align: left; }
#logmsg hr { border: none 0; border-top: 2px dashed #fa0; height: 1px; }
#header, #footer { color: #fff; background: #636; border: 1px #300 solid; padding: 6px; }
#patch { width: 100%; }
#patch h4 {font-family: verdana,arial,helvetica,sans-serif;font-size:10pt;padding:8px;background:#369;color:#fff;margin:0;}
#patch .propset h4, #patch .binary h4 {margin:0;}
#patch pre {padding:0;line-height:1.2em;margin:0;}
#patch .diff {width:100%;background:#eee;padding: 0 0 10px 0;overflow:auto;}
#patch .propset .diff, #patch .binary .diff {padding:10px 0;}
#patch span {display:block;padding:0 10px;}
#patch .modfile, #patch .addfile, #patch .delfile, #patch .propset, #patch .binary, #patch .copfile {border:1px solid #ccc;margin:10px 0;}
#patch ins {background:#dfd;text-decoration:none;display:block;padding:0 10px;}
#patch del {background:#fdd;text-decoration:none;display:block;padding:0 10px;}
#patch .lines, .info {color:#888;background:#fff;}
--></style>
<div id="msg">
<dl class="meta">
<dt>Revision</dt> <dd><a href="http://trac.webkit.org/projects/webkit/changeset/171380">171380</a></dd>
<dt>Author</dt> <dd>fpizlo@apple.com</dd>
<dt>Date</dt> <dd>2014-07-22 18:19:50 -0700 (Tue, 22 Jul 2014)</dd>
</dl>
<h3>Log Message</h3>
<pre>Merge <a href="http://trac.webkit.org/projects/webkit/changeset/169148">r169148</a>, <a href="http://trac.webkit.org/projects/webkit/changeset/169185">r169185</a>, <a href="http://trac.webkit.org/projects/webkit/changeset/169188">r169188</a>, <a href="http://trac.webkit.org/projects/webkit/changeset/169578">r169578</a>, <a href="http://trac.webkit.org/projects/webkit/changeset/169582">r169582</a>, <a href="http://trac.webkit.org/projects/webkit/changeset/169584">r169584</a>, <a href="http://trac.webkit.org/projects/webkit/changeset/169588">r169588</a>, <a href="http://trac.webkit.org/projects/webkit/changeset/169753">r169753</a> from ftlopt.
Source/JavaScriptCore:
Note that <a href="http://trac.webkit.org/projects/webkit/changeset/169753">r169753</a> is merged out of order because it fixes a bug in <a href="http://trac.webkit.org/projects/webkit/changeset/169588">r169588</a>.
2014-06-10 Filip Pizlo <fpizlo@apple.com>
[ftlopt] Structure::dfgShouldWatchIfPossible() is unsound
https://bugs.webkit.org/show_bug.cgi?id=133624
Reviewed by Mark Hahnenberg.
* runtime/Structure.h:
(JSC::Structure::dfgShouldWatchIfPossible): Make it sound and add some verbiage.
2014-06-04 Filip Pizlo <fpizlo@apple.com>
[ftlopt] AI should be able track structure sets larger than 1
https://bugs.webkit.org/show_bug.cgi?id=128073
Reviewed by Oliver Hunt.
This makes two major changes to how AI (abstract interpreter) proves that a value has
some structure:
- StructureAbstractValue can now track an arbitrary number of structures. A set whose
size is greater than one means that the value may have any of the structures, and we
don't know which - but we do know that it cannot be any structure not in the set. The
structure abstract value can still be TOP, which means the set of all structures. We
artificially limit the set size to StructureAbstractValue::polymorphismLimit to guard
memory explosion on pathological programs. This limit is big enough that it wouldn't
kick in for normal code, since we have other heuristics that limit the number of
structures that we would allow an inline cache to know about.
- We eagerly set watchpoints on all watchable structures and then we assume that
watchable structures are being watched, and that the watchpoint will jettison the code.
This allows tracking of watchable structures to be far simpler than before. Previously,
a structure being tracked as "future possible" was predicated on it being watchable but
we might not actually watch it. This makes algebra over sets of future possible
structures quite weird. But watching all watchable structures means that we simple say
that a structure set can be in the following states: unclobbered, which means it's just
a set of structures and it doesn't matter what is watchable or what isn't because we've
proven that the value must have one of these structures right now; and clobbered, which
means that we have a set of structures, plus all possible structures temporarily, with
invalidation removing the "plus all possible structures". Clobbering a set means that
if any of its structures are unwatchable, the set just becomes TOP; but if all
structures in the set are watchable then we just set the clobbered bit to add the "plus
all possible structures temporarily" thing. This precisely tracks the exact meaning of
watchability and invalidation points.
Slight SunSpider slow-down, neutral on Octane, slight AsmBench speed-up. I believe that
we will ultimately undo the SunSpider slow-down by making further improvements to the set
representation. I believe that Octane perfromance will ultimately improve once we remove
remaining singleton special-cases. The ultimate goal of this is to remove the need to
try quite so desperately hard to make everything monomorphic as we do currently.
* CMakeLists.txt:
* JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
* JavaScriptCore.xcodeproj/project.pbxproj:
* bytecode/StructureSet.cpp:
(JSC::StructureSet::clear):
(JSC::StructureSet::remove):
(JSC::StructureSet::filter):
(JSC::StructureSet::copyFromOutOfLine):
(JSC::StructureSet::StructureSet): Deleted.
(JSC::StructureSet::operator=): Deleted.
(JSC::StructureSet::copyFrom): Deleted.
* bytecode/StructureSet.h:
(JSC::StructureSet::StructureSet):
(JSC::StructureSet::operator=):
(JSC::StructureSet::isEmpty):
(JSC::StructureSet::genericFilter):
(JSC::StructureSet::ContainsOutOfLine::ContainsOutOfLine):
(JSC::StructureSet::ContainsOutOfLine::operator()):
(JSC::StructureSet::copyFrom):
(JSC::StructureSet::deleteStructureListIfNecessary):
(JSC::StructureSet::setEmpty):
(JSC::StructureSet::getReservedFlag):
(JSC::StructureSet::setReservedFlag):
* dfg/DFGAbstractInterpreter.h:
(JSC::DFG::AbstractInterpreter::setBuiltInConstant):
* dfg/DFGAbstractInterpreterInlines.h:
(JSC::DFG::AbstractInterpreter<AbstractStateType>::booleanResult):
(JSC::DFG::AbstractInterpreter<AbstractStateType>::verifyEdge):
(JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
(JSC::DFG::AbstractInterpreter<AbstractStateType>::clobberCapturedVars):
(JSC::DFG::AbstractInterpreter<AbstractStateType>::forAllValues):
(JSC::DFG::AbstractInterpreter<AbstractStateType>::clobberStructures):
(JSC::DFG::AbstractInterpreter<AbstractStateType>::observeTransition):
(JSC::DFG::AbstractInterpreter<AbstractStateType>::observeTransitions):
(JSC::DFG::AbstractInterpreter<AbstractStateType>::setDidClobber):
(JSC::DFG::AbstractInterpreter<AbstractStateType>::dump):
* dfg/DFGAbstractValue.cpp:
(JSC::DFG::AbstractValue::observeTransitions):
(JSC::DFG::AbstractValue::setMostSpecific):
(JSC::DFG::AbstractValue::set):
(JSC::DFG::AbstractValue::filter):
(JSC::DFG::AbstractValue::shouldBeClear):
(JSC::DFG::AbstractValue::normalizeClarity):
(JSC::DFG::AbstractValue::checkConsistency):
(JSC::DFG::AbstractValue::assertIsWatched):
(JSC::DFG::AbstractValue::dumpInContext):
(JSC::DFG::AbstractValue::setFuturePossibleStructure): Deleted.
* dfg/DFGAbstractValue.h:
(JSC::DFG::AbstractValue::clear):
(JSC::DFG::AbstractValue::clobberStructures):
(JSC::DFG::AbstractValue::clobberStructuresFor):
(JSC::DFG::AbstractValue::observeInvalidationPoint):
(JSC::DFG::AbstractValue::observeInvalidationPointFor):
(JSC::DFG::AbstractValue::observeTransition):
(JSC::DFG::AbstractValue::TransitionObserver::TransitionObserver):
(JSC::DFG::AbstractValue::TransitionObserver::operator()):
(JSC::DFG::AbstractValue::TransitionsObserver::TransitionsObserver):
(JSC::DFG::AbstractValue::TransitionsObserver::operator()):
(JSC::DFG::AbstractValue::isHeapTop):
(JSC::DFG::AbstractValue::setType):
(JSC::DFG::AbstractValue::operator==):
(JSC::DFG::AbstractValue::merge):
(JSC::DFG::AbstractValue::validate):
(JSC::DFG::AbstractValue::hasClobberableState):
(JSC::DFG::AbstractValue::assertIsWatched):
(JSC::DFG::AbstractValue::observeIndexingTypeTransition):
(JSC::DFG::AbstractValue::makeTop):
(JSC::DFG::AbstractValue::bestProvenStructure): Deleted.
* dfg/DFGAllocator.h:
* dfg/DFGArgumentsSimplificationPhase.cpp:
(JSC::DFG::ArgumentsSimplificationPhase::run):
* dfg/DFGArrayMode.cpp:
(JSC::DFG::ArrayMode::alreadyChecked):
* dfg/DFGAtTailAbstractState.h:
(JSC::DFG::AtTailAbstractState::structureClobberState):
(JSC::DFG::AtTailAbstractState::setStructureClobberState):
(JSC::DFG::AtTailAbstractState::setFoundConstants):
(JSC::DFG::AtTailAbstractState::haveStructures): Deleted.
(JSC::DFG::AtTailAbstractState::setHaveStructures): Deleted.
* dfg/DFGBasicBlock.cpp:
(JSC::DFG::BasicBlock::BasicBlock):
* dfg/DFGBasicBlock.h:
* dfg/DFGBranchDirection.h:
(JSC::DFG::branchDirectionToString):
(WTF::printInternal):
* dfg/DFGByteCodeParser.cpp:
(JSC::DFG::ByteCodeParser::handlePutById):
* dfg/DFGCFAPhase.cpp:
(JSC::DFG::CFAPhase::performBlockCFA):
* dfg/DFGCSEPhase.cpp:
(JSC::DFG::CSEPhase::checkStructureElimination):
(JSC::DFG::CSEPhase::structureTransitionWatchpointElimination):
(JSC::DFG::CSEPhase::performNodeCSE):
* dfg/DFGClobberize.h:
(JSC::DFG::clobberize):
* dfg/DFGCommon.cpp:
(JSC::DFG::startCrashing):
(JSC::DFG::isCrashing):
* dfg/DFGCommon.h:
* dfg/DFGCommonData.cpp:
(JSC::DFG::CommonData::notifyCompilingStructureTransition):
* dfg/DFGConstantFoldingPhase.cpp:
(JSC::DFG::ConstantFoldingPhase::foldConstants):
(JSC::DFG::ConstantFoldingPhase::emitGetByOffset):
(JSC::DFG::ConstantFoldingPhase::emitPutByOffset):
(JSC::DFG::ConstantFoldingPhase::addStructureTransitionCheck):
* dfg/DFGDesiredWatchpoints.cpp:
(JSC::DFG::DesiredWatchpoints::consider):
(JSC::DFG::DesiredWatchpoints::addLazily): Deleted.
* dfg/DFGDesiredWatchpoints.h:
(JSC::DFG::GenericDesiredWatchpoints::reallyAdd):
(JSC::DFG::GenericDesiredWatchpoints::areStillValid):
(JSC::DFG::GenericDesiredWatchpoints::isWatched):
(JSC::DFG::DesiredWatchpoints::isWatched):
(JSC::DFG::WatchpointForGenericWatchpointSet::WatchpointForGenericWatchpointSet): Deleted.
(JSC::DFG::GenericDesiredWatchpoints::addLazily): Deleted.
(JSC::DFG::GenericDesiredWatchpoints::isStillValid): Deleted.
(JSC::DFG::GenericDesiredWatchpoints::shouldAssumeMixedState): Deleted.
(JSC::DFG::GenericDesiredWatchpoints::isValidOrMixed): Deleted.
(JSC::DFG::DesiredWatchpoints::isStillValid): Deleted.
(JSC::DFG::DesiredWatchpoints::shouldAssumeMixedState): Deleted.
(JSC::DFG::DesiredWatchpoints::isValidOrMixed): Deleted.
* dfg/DFGDoesGC.cpp:
(JSC::DFG::doesGC):
* dfg/DFGFixupPhase.cpp:
(JSC::DFG::FixupPhase::fixupNode):
(JSC::DFG::FixupPhase::canOptimizeStringObjectAccess):
(JSC::DFG::FixupPhase::injectTypeConversionsForEdge):
* dfg/DFGGraph.cpp:
(JSC::DFG::Graph::~Graph):
(JSC::DFG::Graph::dump):
(JSC::DFG::Graph::dumpBlockHeader):
(JSC::DFG::Graph::tryGetFoldableView):
(JSC::DFG::Graph::visitChildren):
(JSC::DFG::Graph::assertIsWatched):
(JSC::DFG::Graph::handleAssertionFailure):
* dfg/DFGGraph.h:
(JSC::DFG::Graph::convertToConstant):
(JSC::DFG::Graph::masqueradesAsUndefinedWatchpointIsStillValid):
(JSC::DFG::Graph::addStructureTransitionData): Deleted.
* dfg/DFGInPlaceAbstractState.cpp:
(JSC::DFG::InPlaceAbstractState::beginBasicBlock):
(JSC::DFG::InPlaceAbstractState::initialize):
(JSC::DFG::InPlaceAbstractState::endBasicBlock):
(JSC::DFG::InPlaceAbstractState::reset):
(JSC::DFG::InPlaceAbstractState::merge):
* dfg/DFGInPlaceAbstractState.h:
(JSC::DFG::InPlaceAbstractState::structureClobberState):
(JSC::DFG::InPlaceAbstractState::setStructureClobberState):
(JSC::DFG::InPlaceAbstractState::setFoundConstants):
(JSC::DFG::InPlaceAbstractState::haveStructures): Deleted.
(JSC::DFG::InPlaceAbstractState::setHaveStructures): Deleted.
* dfg/DFGLivenessAnalysisPhase.cpp:
(JSC::DFG::LivenessAnalysisPhase::run):
* dfg/DFGNode.h:
(JSC::DFG::Node::hasTransition):
(JSC::DFG::Node::transition):
(JSC::DFG::Node::hasStructure):
(JSC::DFG::StructureTransitionData::StructureTransitionData): Deleted.
(JSC::DFG::Node::convertToStructureTransitionWatchpoint): Deleted.
(JSC::DFG::Node::hasStructureTransitionData): Deleted.
(JSC::DFG::Node::structureTransitionData): Deleted.
* dfg/DFGNodeType.h:
* dfg/DFGPlan.cpp:
(JSC::DFG::Plan::compileInThreadImpl):
* dfg/DFGPredictionPropagationPhase.cpp:
(JSC::DFG::PredictionPropagationPhase::propagate):
* dfg/DFGSafeToExecute.h:
(JSC::DFG::safeToExecute):
* dfg/DFGSpeculativeJIT.cpp:
(JSC::DFG::SpeculativeJIT::compileAllocatePropertyStorage):
(JSC::DFG::SpeculativeJIT::compileReallocatePropertyStorage):
* dfg/DFGSpeculativeJIT.h:
(JSC::DFG::SpeculativeJIT::speculateStringObjectForStructure):
* dfg/DFGSpeculativeJIT32_64.cpp:
(JSC::DFG::SpeculativeJIT::compile):
* dfg/DFGSpeculativeJIT64.cpp:
(JSC::DFG::SpeculativeJIT::compile):
* dfg/DFGStructureAbstractValue.cpp: Added.
(JSC::DFG::StructureAbstractValue::assertIsWatched):
(JSC::DFG::StructureAbstractValue::clobber):
(JSC::DFG::StructureAbstractValue::observeTransition):
(JSC::DFG::StructureAbstractValue::observeTransitions):
(JSC::DFG::StructureAbstractValue::add):
(JSC::DFG::StructureAbstractValue::merge):
(JSC::DFG::StructureAbstractValue::mergeSlow):
(JSC::DFG::StructureAbstractValue::mergeNotTop):
(JSC::DFG::StructureAbstractValue::filter):
(JSC::DFG::StructureAbstractValue::filterSlow):
(JSC::DFG::StructureAbstractValue::contains):
(JSC::DFG::StructureAbstractValue::isSubsetOf):
(JSC::DFG::StructureAbstractValue::isSupersetOf):
(JSC::DFG::StructureAbstractValue::overlaps):
(JSC::DFG::StructureAbstractValue::equalsSlow):
(JSC::DFG::StructureAbstractValue::dumpInContext):
(JSC::DFG::StructureAbstractValue::dump):
* dfg/DFGStructureAbstractValue.h:
(JSC::DFG::StructureAbstractValue::StructureAbstractValue):
(JSC::DFG::StructureAbstractValue::operator=):
(JSC::DFG::StructureAbstractValue::clear):
(JSC::DFG::StructureAbstractValue::makeTop):
(JSC::DFG::StructureAbstractValue::assertIsWatched):
(JSC::DFG::StructureAbstractValue::observeInvalidationPoint):
(JSC::DFG::StructureAbstractValue::top):
(JSC::DFG::StructureAbstractValue::isClear):
(JSC::DFG::StructureAbstractValue::isTop):
(JSC::DFG::StructureAbstractValue::isNeitherClearNorTop):
(JSC::DFG::StructureAbstractValue::isClobbered):
(JSC::DFG::StructureAbstractValue::merge):
(JSC::DFG::StructureAbstractValue::filter):
(JSC::DFG::StructureAbstractValue::operator==):
(JSC::DFG::StructureAbstractValue::size):
(JSC::DFG::StructureAbstractValue::at):
(JSC::DFG::StructureAbstractValue::operator[]):
(JSC::DFG::StructureAbstractValue::onlyStructure):
(JSC::DFG::StructureAbstractValue::isSupersetOf):
(JSC::DFG::StructureAbstractValue::makeTopWhenThin):
(JSC::DFG::StructureAbstractValue::setClobbered):
(JSC::DFG::StructureAbstractValue::add): Deleted.
(JSC::DFG::StructureAbstractValue::addAll): Deleted.
(JSC::DFG::StructureAbstractValue::contains): Deleted.
(JSC::DFG::StructureAbstractValue::isSubsetOf): Deleted.
(JSC::DFG::StructureAbstractValue::doesNotContainAnyOtherThan): Deleted.
(JSC::DFG::StructureAbstractValue::isClearOrTop): Deleted.
(JSC::DFG::StructureAbstractValue::last): Deleted.
(JSC::DFG::StructureAbstractValue::speculationFromStructures): Deleted.
(JSC::DFG::StructureAbstractValue::isValidOffset): Deleted.
(JSC::DFG::StructureAbstractValue::hasSingleton): Deleted.
(JSC::DFG::StructureAbstractValue::singleton): Deleted.
(JSC::DFG::StructureAbstractValue::dumpInContext): Deleted.
(JSC::DFG::StructureAbstractValue::dump): Deleted.
(JSC::DFG::StructureAbstractValue::topValue): Deleted.
* dfg/DFGStructureClobberState.h: Added.
(JSC::DFG::merge):
(WTF::printInternal):
* dfg/DFGTransition.cpp: Added.
(JSC::DFG::Transition::dumpInContext):
(JSC::DFG::Transition::dump):
* dfg/DFGTransition.h: Added.
(JSC::DFG::Transition::Transition):
* dfg/DFGTypeCheckHoistingPhase.cpp:
(JSC::DFG::TypeCheckHoistingPhase::identifyRedundantStructureChecks):
(JSC::DFG::TypeCheckHoistingPhase::identifyRedundantArrayChecks):
* dfg/DFGWatchableStructureWatchingPhase.cpp: Added.
(JSC::DFG::WatchableStructureWatchingPhase::WatchableStructureWatchingPhase):
(JSC::DFG::WatchableStructureWatchingPhase::run):
(JSC::DFG::WatchableStructureWatchingPhase::tryWatch):
(JSC::DFG::performWatchableStructureWatching):
* dfg/DFGWatchableStructureWatchingPhase.h: Added.
* dfg/DFGWatchpointCollectionPhase.cpp:
(JSC::DFG::WatchpointCollectionPhase::handle):
(JSC::DFG::WatchpointCollectionPhase::handleEdge): Deleted.
* ftl/FTLCapabilities.cpp:
(JSC::FTL::canCompile):
* ftl/FTLIntrinsicRepository.h:
* ftl/FTLLowerDFGToLLVM.cpp:
(JSC::FTL::ftlUnreachable):
(JSC::FTL::LowerDFGToLLVM::createPhiVariables):
(JSC::FTL::LowerDFGToLLVM::compileBlock):
(JSC::FTL::LowerDFGToLLVM::compileNode):
(JSC::FTL::LowerDFGToLLVM::compileUpsilon):
(JSC::FTL::LowerDFGToLLVM::compilePhi):
(JSC::FTL::LowerDFGToLLVM::compileDoubleRep):
(JSC::FTL::LowerDFGToLLVM::compileValueRep):
(JSC::FTL::LowerDFGToLLVM::compileValueToInt32):
(JSC::FTL::LowerDFGToLLVM::compileGetArgument):
(JSC::FTL::LowerDFGToLLVM::compileGetLocal):
(JSC::FTL::LowerDFGToLLVM::compileSetLocal):
(JSC::FTL::LowerDFGToLLVM::compileArithAddOrSub):
(JSC::FTL::LowerDFGToLLVM::compileArithMul):
(JSC::FTL::LowerDFGToLLVM::compileArithDiv):
(JSC::FTL::LowerDFGToLLVM::compileArithMod):
(JSC::FTL::LowerDFGToLLVM::compileArithMinOrMax):
(JSC::FTL::LowerDFGToLLVM::compileArithAbs):
(JSC::FTL::LowerDFGToLLVM::compileArithNegate):
(JSC::FTL::LowerDFGToLLVM::compileArrayifyToStructure):
(JSC::FTL::LowerDFGToLLVM::compilePutStructure):
(JSC::FTL::LowerDFGToLLVM::compileGetById):
(JSC::FTL::LowerDFGToLLVM::compileGetMyArgumentsLength):
(JSC::FTL::LowerDFGToLLVM::compileGetMyArgumentByVal):
(JSC::FTL::LowerDFGToLLVM::compileGetArrayLength):
(JSC::FTL::LowerDFGToLLVM::compileGetByVal):
(JSC::FTL::LowerDFGToLLVM::compilePutByVal):
(JSC::FTL::LowerDFGToLLVM::compileArrayPush):
(JSC::FTL::LowerDFGToLLVM::compileArrayPop):
(JSC::FTL::LowerDFGToLLVM::compileNewArray):
(JSC::FTL::LowerDFGToLLVM::compileNewArrayBuffer):
(JSC::FTL::LowerDFGToLLVM::compileAllocatePropertyStorage):
(JSC::FTL::LowerDFGToLLVM::compileReallocatePropertyStorage):
(JSC::FTL::LowerDFGToLLVM::compileToString):
(JSC::FTL::LowerDFGToLLVM::compileMakeRope):
(JSC::FTL::LowerDFGToLLVM::compileMultiGetByOffset):
(JSC::FTL::LowerDFGToLLVM::compileMultiPutByOffset):
(JSC::FTL::LowerDFGToLLVM::compileCompareEq):
(JSC::FTL::LowerDFGToLLVM::compileCompareStrictEq):
(JSC::FTL::LowerDFGToLLVM::compileSwitch):
(JSC::FTL::LowerDFGToLLVM::compare):
(JSC::FTL::LowerDFGToLLVM::boolify):
(JSC::FTL::LowerDFGToLLVM::terminate):
(JSC::FTL::LowerDFGToLLVM::lowInt32):
(JSC::FTL::LowerDFGToLLVM::lowInt52):
(JSC::FTL::LowerDFGToLLVM::opposite):
(JSC::FTL::LowerDFGToLLVM::lowCell):
(JSC::FTL::LowerDFGToLLVM::lowBoolean):
(JSC::FTL::LowerDFGToLLVM::lowDouble):
(JSC::FTL::LowerDFGToLLVM::lowJSValue):
(JSC::FTL::LowerDFGToLLVM::speculate):
(JSC::FTL::LowerDFGToLLVM::isArrayType):
(JSC::FTL::LowerDFGToLLVM::speculateStringObjectForStructureID):
(JSC::FTL::LowerDFGToLLVM::callCheck):
(JSC::FTL::LowerDFGToLLVM::buildExitArguments):
(JSC::FTL::LowerDFGToLLVM::addExitArgumentForNode):
(JSC::FTL::LowerDFGToLLVM::setInt52):
(JSC::FTL::LowerDFGToLLVM::crash):
(JSC::FTL::LowerDFGToLLVM::compileStructureTransitionWatchpoint): Deleted.
* ftl/FTLOutput.cpp:
(JSC::FTL::Output::crashNonTerminal): Deleted.
* ftl/FTLOutput.h:
(JSC::FTL::Output::crash): Deleted.
* jit/JITOperations.h:
* jsc.cpp:
(WTF::jscExit):
(functionQuit):
(main):
(printUsageStatement):
(CommandLine::parseArguments):
* runtime/Structure.h:
(JSC::Structure::dfgShouldWatchIfPossible):
(JSC::Structure::dfgShouldWatch):
* tests/stress/arrayify-to-structure-contradiction.js: Added.
(foo):
* tests/stress/ftl-getmyargumentslength-inline.js: Added.
(foo):
* tests/stress/multi-put-by-offset-multiple-transitions.js: Added.
(foo):
(Foo):
* tests/stress/throw-from-ftl-in-loop.js: Added.
* tests/stress/throw-from-ftl.js: Added.
(foo):
2014-06-03 Filip Pizlo <fpizlo@apple.com>
[ftlopt] Unreviewed, roll out <a href="http://trac.webkit.org/projects/webkit/changeset/169578">r169578</a>. The build system needs some more love.
* InlineRuntimeSymbolTable.h: Removed.
* JavaScriptCore.xcodeproj/project.pbxproj:
* build-symbol-table-index.py:
* build-symbol-table-index.sh:
* copy-llvm-ir-to-derived-sources.sh:
* dfg/DFGByteCodeParser.cpp:
(JSC::DFG::ByteCodeParser::handleCall):
* dfg/DFGNode.h:
(JSC::DFG::Node::canBeKnownFunction): Deleted.
(JSC::DFG::Node::hasKnownFunction): Deleted.
(JSC::DFG::Node::knownFunction): Deleted.
(JSC::DFG::Node::giveKnownFunction): Deleted.
* ftl/FTLAbbreviatedTypes.h:
* ftl/FTLCompile.cpp:
(JSC::FTL::compile):
* ftl/FTLLowerDFGToLLVM.cpp:
(JSC::FTL::LowerDFGToLLVM::LowerDFGToLLVM):
(JSC::FTL::LowerDFGToLLVM::lower):
(JSC::FTL::LowerDFGToLLVM::compileCallOrConstruct):
(JSC::FTL::LowerDFGToLLVM::possiblyCompileInlineableNativeCall): Deleted.
(JSC::FTL::LowerDFGToLLVM::getFunctionBySymbol): Deleted.
(JSC::FTL::LowerDFGToLLVM::getModuleByPathForSymbol): Deleted.
(JSC::FTL::LowerDFGToLLVM::isInlinableSize): Deleted.
* ftl/FTLState.cpp:
(JSC::FTL::State::State):
* ftl/FTLState.h:
* heap/HandleStack.h:
* llvm/InitializeLLVM.h:
* llvm/InitializeLLVMMac.cpp: Removed.
* llvm/InitializeLLVMMac.mm: Added.
(JSC::initializeLLVMImpl):
* llvm/LLVMAPIFunctions.h:
* llvm/LLVMHeaders.h:
* runtime/BundlePath.h: Removed.
* runtime/BundlePath.mm: Removed.
* runtime/DateConversion.h:
* runtime/DateInstance.h:
* runtime/ExceptionHelpers.h:
* runtime/JSArray.h:
* runtime/JSCJSValue.h:
(JSC::JSValue::toFloat):
* runtime/JSDateMath.h:
* runtime/JSObject.h:
* runtime/JSWrapperObject.h:
* runtime/Options.h:
* runtime/RegExp.h:
* runtime/StringObject.h:
* runtime/Structure.h:
* tested-symbols.symlst: Removed.
2014-06-03 Filip Pizlo <fpizlo@apple.com>
[ftlopt] FTL native inlining tests take far too long
https://bugs.webkit.org/show_bug.cgi?id=133498
Unreviewed test gardening.
Added a new exceptions test since the other one appears to not work.
* tests/stress/ftl-library-exception.js:
* tests/stress/ftl-library-inline-gettimezoneoffset.js: Added.
(foo):
* tests/stress/ftl-library-inlining-exceptions-dataview.js: Added.
(foo):
* tests/stress/ftl-library-inlining-exceptions.js: Copied from LayoutTests/js/regress/script-tests/ftl-library-inlining-exceptions.js.
* tests/stress/ftl-library-inlining-loops.js: Copied from LayoutTests/js/regress/script-tests/ftl-library-inlining-loops.js.
* tests/stress/ftl-library-inlining-random.js:
* tests/stress/ftl-library-substring.js:
2014-06-03 Matthew Mirman <mmirman@apple.com>
[ftlopt] Added system for inlining native functions via the FTL.
https://bugs.webkit.org/show_bug.cgi?id=131515
Reviewed by Filip Pizlo.
Also fixed the build to not compress the bitcode and to
include all of the relevant runtime. With GCC_GENERATE_DEBUGGING_SYMBOLS = NO,
the produced bitcode files are a 100th the size they were before.
Now we can include all of the relevant runtime files with only a 3mb overhead.
This is the same overhead as for two compressed files before,
but done more efficiently (on both ends) and with less code.
Deciding whether to inline native functions is left up to LLVM.
The entire module containing the function is linked into the current
compiled JS so that inlining the native functions shouldn't make them smaller.
Rather than loading Runtime.symtbl at runtime FTLState.cpp now includes a file
InlineRuntimeSymbolTable.h which statically builds the symbol table hash table.
Currently build-symbol-table-index.py updates this file from the
contents of tested-symbols.symlst when done building as a matter of convenience.
However, in order to include the new contents of the file in the build
you'd need to build twice. This will be fixed in future versions.
* JavaScriptCore.xcodeproj/project.pbxproj: Added back runtime files to compile.
* build-symbol-table-index.py: Changed bitcode suffix.
Added inclusion of only tested symbols.
Added output to InlineRuntimeSymbolTable.h.
* build-symbol-table-index.sh: Changed bitcode suffix.
* copy-llvm-ir-to-derived-sources.sh: Removed gzip compression.
* tested-symbols.symlst: Added.
* dfg/DFGByteCodeParser.cpp:
(JSC::DFG::ByteCodeParser::handleCall):
Now sets the knownFunction of the call node if such a function exists
and emits a check that during runtime the callee is in fact known.
* dfg/DFGNode.h:
Added functions to set the known function of a call node.
(JSC::DFG::Node::canBeKnownFunction): Added.
(JSC::DFG::Node::hasKnownFunction): Added.
(JSC::DFG::Node::knownFunction): Added.
(JSC::DFG::Node::giveKnownFunction): Added.
* ftl/FTLAbbreviatedTypes.h: Added a typedef for LLVMMemoryBufferRef
* ftl/FTLLowerDFGToLLVM.cpp:
(JSC::FTL::LowerDFGToLLVM::isInlinableSize): Added. Hardcoded threshold to 275.
(JSC::FTL::LowerDFGToLLVM::getModuleByPathForSymbol): Added.
(JSC::FTL::LowerDFGToLLVM::getFunctionBySymbol): Added.
(JSC::FTL::LowerDFGToLLVM::possiblyCompileInlineableNativeCall): Added.
(JSC::FTL::LowerDFGToLLVM::compileCallOrConstruct):
Added call to possiblyCompileInlineableNativeCall
* ftl/FTLOutput.h:
(JSC::FTL::Output::allocaName): Added. Useful for debugging.
* ftl/FTLState.cpp:
(JSC::FTL::State::State): Added an include for InlineRuntimeSymbolTable.h
* ftl/FTLState.h: Added symbol table hash table.
* ftl/FTLCompile.cpp:
(JSC::FTL::compile): Added inlining and dead function elimination passes.
* heap/HandleStack.h: Added JS_EXPORT_PRIVATE to a few functions to get inlining to compile.
* InlineRuntimeSymbolTable.h: Added.
* llvm/InitializeLLVMMac.mm: Deleted.
* llvm/InitializeLLVMMac.cpp: Added.
* llvm/LLVMAPIFunctions.h: Added macros to include Bitcode parsing and linking functions.
* llvm/LLVMHeaders.h: Added includes for Bitcode parsing and linking.
* runtime/BundlePath.h: Added.
* runtime/BundlePath.mm: Added.
* runtime/DateInstance.h: Added JS_EXPORT_PRIVATE to a few functions to get inlining to compile.
* runtime/DateInstance.h: ditto.
* runtime/DateConversion.h: ditto.
* runtime/ExceptionHelpers.h: ditto.
* runtime/JSCJSValue.h: ditto.
* runtime/JSArray.h: ditto.
* runtime/JSDateMath.h: ditto.
* runtime/JSObject.h: ditto.
* runtime/JSObject.h: ditto.
* runtime/RegExp.h: ditto.
* runtime/Structure.h: ditto.
* runtime/Options.h: Added maximumLLVMInstructionCountForNativeInlining.
* tests/stress/ftl-library-inlining-random.js: Added.
* tests/stress/ftl-library-substring.js: Added.
2014-05-21 Filip Pizlo <fpizlo@apple.com>
[ftlopt] DFG::clobberize should be blind to the effects of GC
https://bugs.webkit.org/show_bug.cgi?id=133166
Reviewed by Goeffrey Garen.
Move the computation of where GCs happen to DFG::doesGC().
Large (>5x) speed-up on programs that do loop-invariant string concatenations.
* CMakeLists.txt:
* JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
* JavaScriptCore.xcodeproj/project.pbxproj:
* dfg/DFGAbstractHeap.h:
* dfg/DFGClobberize.h:
(JSC::DFG::clobberize):
(JSC::DFG::clobberizeForAllocation): Deleted.
* dfg/DFGDoesGC.cpp: Added.
(JSC::DFG::doesGC):
* dfg/DFGDoesGC.h: Added.
* dfg/DFGStoreBarrierElisionPhase.cpp:
(JSC::DFG::StoreBarrierElisionPhase::handleNode):
(JSC::DFG::StoreBarrierElisionPhase::couldCauseGC): Deleted.
2014-05-16 Filip Pizlo <fpizlo@apple.com>
[ftlopt] A StructureSet with one element should only require one word and no allocation
https://bugs.webkit.org/show_bug.cgi?id=133014
Reviewed by Oliver Hunt.
This makes it more efficient to use StructureSet in situations where the common case is
just one structure.
I also took the opportunity to use the same set terminology we use in BitVector: merge,
filter, exclude, contains, etc.
Eventually, this will be used to implement StructureAbstractValue as well.
* CMakeLists.txt:
* JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
* JavaScriptCore.xcodeproj/project.pbxproj:
* bytecode/StructureSet.cpp: Added.
(JSC::StructureSet::StructureSet):
(JSC::StructureSet::operator=):
(JSC::StructureSet::clear):
(JSC::StructureSet::add):
(JSC::StructureSet::remove):
(JSC::StructureSet::contains):
(JSC::StructureSet::merge):
(JSC::StructureSet::filter):
(JSC::StructureSet::exclude):
(JSC::StructureSet::isSubsetOf):
(JSC::StructureSet::overlaps):
(JSC::StructureSet::operator==):
(JSC::StructureSet::speculationFromStructures):
(JSC::StructureSet::arrayModesFromStructures):
(JSC::StructureSet::dumpInContext):
(JSC::StructureSet::dump):
(JSC::StructureSet::addOutOfLine):
(JSC::StructureSet::containsOutOfLine):
(JSC::StructureSet::copyFrom):
(JSC::StructureSet::OutOfLineList::create):
(JSC::StructureSet::OutOfLineList::destroy):
* bytecode/StructureSet.h:
(JSC::StructureSet::StructureSet):
(JSC::StructureSet::~StructureSet):
(JSC::StructureSet::onlyStructure):
(JSC::StructureSet::isEmpty):
(JSC::StructureSet::size):
(JSC::StructureSet::at):
(JSC::StructureSet::operator[]):
(JSC::StructureSet::last):
(JSC::StructureSet::OutOfLineList::list):
(JSC::StructureSet::OutOfLineList::OutOfLineList):
(JSC::StructureSet::deleteStructureListIfNecessary):
(JSC::StructureSet::isThin):
(JSC::StructureSet::pointer):
(JSC::StructureSet::singleStructure):
(JSC::StructureSet::structureList):
(JSC::StructureSet::set):
(JSC::StructureSet::clear): Deleted.
(JSC::StructureSet::add): Deleted.
(JSC::StructureSet::addAll): Deleted.
(JSC::StructureSet::remove): Deleted.
(JSC::StructureSet::contains): Deleted.
(JSC::StructureSet::containsOnly): Deleted.
(JSC::StructureSet::isSubsetOf): Deleted.
(JSC::StructureSet::overlaps): Deleted.
(JSC::StructureSet::singletonStructure): Deleted.
(JSC::StructureSet::speculationFromStructures): Deleted.
(JSC::StructureSet::arrayModesFromStructures): Deleted.
(JSC::StructureSet::operator==): Deleted.
(JSC::StructureSet::dumpInContext): Deleted.
(JSC::StructureSet::dump): Deleted.
* dfg/DFGAbstractInterpreterInlines.h:
(JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
* dfg/DFGByteCodeParser.cpp:
(JSC::DFG::ByteCodeParser::emitPrototypeChecks):
(JSC::DFG::ByteCodeParser::handleGetById):
(JSC::DFG::ByteCodeParser::parseBlock):
* dfg/DFGCSEPhase.cpp:
(JSC::DFG::CSEPhase::structureTransitionWatchpointElimination):
* dfg/DFGNode.h:
(JSC::DFG::Node::convertToStructureTransitionWatchpoint):
* dfg/DFGTypeCheckHoistingPhase.cpp:
(JSC::DFG::TypeCheckHoistingPhase::noticeStructureCheck):
Source/WTF:
2014-06-04 Filip Pizlo <fpizlo@apple.com>
[ftlopt] AI should be able track structure sets larger than 1
https://bugs.webkit.org/show_bug.cgi?id=128073
Reviewed by Oliver Hunt.
* wtf/Bag.h:
(WTF::Bag::Node::Node):
(WTF::Bag::add):
LayoutTests:
2014-06-04 Filip Pizlo <fpizlo@apple.com>
[ftlopt] AI should be able track structure sets larger than 1
https://bugs.webkit.org/show_bug.cgi?id=128073
Reviewed by Oliver Hunt.
* js/regress/get-by-id-bimorphic-check-structure-elimination-expected.txt: Added.
* js/regress/get-by-id-bimorphic-check-structure-elimination-simple-expected.txt: Added.
* js/regress/get-by-id-bimorphic-check-structure-elimination-simple.html: Added.
* js/regress/get-by-id-bimorphic-check-structure-elimination.html: Added.
* js/regress/get-by-id-check-structure-elimination-expected.txt: Added.
* js/regress/get-by-id-check-structure-elimination.html: Added.
* js/regress/get-by-id-quadmorphic-check-structure-elimination-simple-expected.txt: Added.
* js/regress/get-by-id-quadmorphic-check-structure-elimination-simple.html: Added.
* js/regress/script-tests/get-by-id-bimorphic-check-structure-elimination-simple.js: Added.
* js/regress/script-tests/get-by-id-bimorphic-check-structure-elimination.js: Added.
* js/regress/script-tests/get-by-id-check-structure-elimination.js: Added.
* js/regress/script-tests/get-by-id-quadmorphic-check-structure-elimination-simple.js: Added.
2014-06-03 Filip Pizlo <fpizlo@apple.com>
[ftlopt] FTL native inlining tests take far too long
https://bugs.webkit.org/show_bug.cgi?id=133498
Unreviewed test gardening.
Move long-running tests that focus on correctness into JSC/tests/stress.
Speed up the performance tests by reducing allocation and call overhead.
* js/regress/ftl-library-inlining-exceptions-expected.txt: Removed.
* js/regress/ftl-library-inlining-exceptions.html: Removed.
* js/regress/ftl-library-inlining-folding-expected.txt: Removed.
* js/regress/ftl-library-inlining-folding.html: Removed.
* js/regress/ftl-library-inlining-loops-expected.txt: Removed.
* js/regress/ftl-library-inlining-loops.html: Removed.
* js/regress/script-tests/ftl-library-inlining-dataview.js:
(foo): Deleted.
* js/regress/script-tests/ftl-library-inlining-exceptions.js: Removed.
* js/regress/script-tests/ftl-library-inlining-folding.js: Removed.
* js/regress/script-tests/ftl-library-inlining-loops.js: Removed.
* js/regress/script-tests/ftl-library-inlining.js:
(foo): Deleted.
2014-06-03 Matthew Mirman <mmirman@apple.com>
[ftlopt] Added system for inlining native functions via the FTL.
https://bugs.webkit.org/show_bug.cgi?id=131515
Reviewed by Filip Pizlo.
Adds microbenchmarks.
* js/regress/script-tests/ftl-library-inlining.js: Added.
* js/regress/ftl-library-inlining-expected.txt: Added.
* js/regress/ftl-library-inlining.html: Added.
* js/regress/script-tests/ftl-library-inlining-dataview.js: Added.
* js/regress/ftl-library-inlining-dataview-expected.txt: Added.
* js/regress/ftl-library-inlining-dataview.html: Added.
* js/regress/script-tests/ftl-library-inlining-exceptions.js: Added.
* js/regress/ftl-library-inlining-exceptions-expected.txt: Added.
* js/regress/ftl-library-inlining-exceptions.html: Added.
* js/regress/script-tests/ftl-library-inlining-folding.js: Added.
* js/regress/ftl-library-inlining-folding-expected.txt: Added.
* js/regress/ftl-library-inlining-folding-expected.html: Added.
* js/regress/script-tests/ftl-library-inlining-loops.js: Added.
* js/regress/ftl-library-inlining-loops-expected.txt: Added.
* js/regress/ftl-library-inlining-loops.html: Added.
2014-05-21 Filip Pizlo <fpizlo@apple.com>
[ftlopt] DFG::clobberize should be blind to the effects of GC
https://bugs.webkit.org/show_bug.cgi?id=133166
Reviewed by Geoffrey Garen.
* js/regress/hoist-make-rope-expected.txt: Added.
* js/regress/hoist-make-rope.html: Added.
* js/regress/script-tests/hoist-make-rope.js: Added.
(foo):</pre>
<h3>Modified Paths</h3>
<ul>
<li><a href="#trunkLayoutTestsChangeLog">trunk/LayoutTests/ChangeLog</a></li>
<li><a href="#trunkSourceJavaScriptCoreCMakeListstxt">trunk/Source/JavaScriptCore/CMakeLists.txt</a></li>
<li><a href="#trunkSourceJavaScriptCoreChangeLog">trunk/Source/JavaScriptCore/ChangeLog</a></li>
<li><a href="#trunkSourceJavaScriptCoreJavaScriptCorevcxprojJavaScriptCorevcxproj">trunk/Source/JavaScriptCore/JavaScriptCore.vcxproj/JavaScriptCore.vcxproj</a></li>
<li><a href="#trunkSourceJavaScriptCoreJavaScriptCorexcodeprojprojectpbxproj">trunk/Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj</a></li>
<li><a href="#trunkSourceJavaScriptCorebytecodeStructureSeth">trunk/Source/JavaScriptCore/bytecode/StructureSet.h</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGAbstractHeaph">trunk/Source/JavaScriptCore/dfg/DFGAbstractHeap.h</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGAbstractInterpreterh">trunk/Source/JavaScriptCore/dfg/DFGAbstractInterpreter.h</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGAbstractInterpreterInlinesh">trunk/Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGAbstractValuecpp">trunk/Source/JavaScriptCore/dfg/DFGAbstractValue.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGAbstractValueh">trunk/Source/JavaScriptCore/dfg/DFGAbstractValue.h</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGAllocatorh">trunk/Source/JavaScriptCore/dfg/DFGAllocator.h</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGArgumentsSimplificationPhasecpp">trunk/Source/JavaScriptCore/dfg/DFGArgumentsSimplificationPhase.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGArrayModecpp">trunk/Source/JavaScriptCore/dfg/DFGArrayMode.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGAtTailAbstractStateh">trunk/Source/JavaScriptCore/dfg/DFGAtTailAbstractState.h</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGBasicBlockcpp">trunk/Source/JavaScriptCore/dfg/DFGBasicBlock.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGBasicBlockh">trunk/Source/JavaScriptCore/dfg/DFGBasicBlock.h</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGBranchDirectionh">trunk/Source/JavaScriptCore/dfg/DFGBranchDirection.h</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGByteCodeParsercpp">trunk/Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGCFAPhasecpp">trunk/Source/JavaScriptCore/dfg/DFGCFAPhase.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGCSEPhasecpp">trunk/Source/JavaScriptCore/dfg/DFGCSEPhase.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGClobberizeh">trunk/Source/JavaScriptCore/dfg/DFGClobberize.h</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGCommoncpp">trunk/Source/JavaScriptCore/dfg/DFGCommon.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGCommonh">trunk/Source/JavaScriptCore/dfg/DFGCommon.h</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGCommonDatacpp">trunk/Source/JavaScriptCore/dfg/DFGCommonData.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGConstantFoldingPhasecpp">trunk/Source/JavaScriptCore/dfg/DFGConstantFoldingPhase.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGDesiredWatchpointscpp">trunk/Source/JavaScriptCore/dfg/DFGDesiredWatchpoints.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGDesiredWatchpointsh">trunk/Source/JavaScriptCore/dfg/DFGDesiredWatchpoints.h</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGFixupPhasecpp">trunk/Source/JavaScriptCore/dfg/DFGFixupPhase.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGGraphcpp">trunk/Source/JavaScriptCore/dfg/DFGGraph.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGGraphh">trunk/Source/JavaScriptCore/dfg/DFGGraph.h</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGInPlaceAbstractStatecpp">trunk/Source/JavaScriptCore/dfg/DFGInPlaceAbstractState.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGInPlaceAbstractStateh">trunk/Source/JavaScriptCore/dfg/DFGInPlaceAbstractState.h</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGLivenessAnalysisPhasecpp">trunk/Source/JavaScriptCore/dfg/DFGLivenessAnalysisPhase.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGNodeh">trunk/Source/JavaScriptCore/dfg/DFGNode.h</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGNodeTypeh">trunk/Source/JavaScriptCore/dfg/DFGNodeType.h</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGPlancpp">trunk/Source/JavaScriptCore/dfg/DFGPlan.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGPredictionPropagationPhasecpp">trunk/Source/JavaScriptCore/dfg/DFGPredictionPropagationPhase.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGSafeToExecuteh">trunk/Source/JavaScriptCore/dfg/DFGSafeToExecute.h</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGSpeculativeJITcpp">trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGSpeculativeJITh">trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGSpeculativeJIT32_64cpp">trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGSpeculativeJIT64cpp">trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGStoreBarrierElisionPhasecpp">trunk/Source/JavaScriptCore/dfg/DFGStoreBarrierElisionPhase.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGStructureAbstractValueh">trunk/Source/JavaScriptCore/dfg/DFGStructureAbstractValue.h</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGTypeCheckHoistingPhasecpp">trunk/Source/JavaScriptCore/dfg/DFGTypeCheckHoistingPhase.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGWatchpointCollectionPhasecpp">trunk/Source/JavaScriptCore/dfg/DFGWatchpointCollectionPhase.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreftlFTLCapabilitiescpp">trunk/Source/JavaScriptCore/ftl/FTLCapabilities.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreftlFTLIntrinsicRepositoryh">trunk/Source/JavaScriptCore/ftl/FTLIntrinsicRepository.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreftlFTLLowerDFGToLLVMcpp">trunk/Source/JavaScriptCore/ftl/FTLLowerDFGToLLVM.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreftlFTLOutputcpp">trunk/Source/JavaScriptCore/ftl/FTLOutput.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreftlFTLOutputh">trunk/Source/JavaScriptCore/ftl/FTLOutput.h</a></li>
<li><a href="#trunkSourceJavaScriptCorejitJITOperationsh">trunk/Source/JavaScriptCore/jit/JITOperations.h</a></li>
<li><a href="#trunkSourceJavaScriptCorejsccpp">trunk/Source/JavaScriptCore/jsc.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeStructureh">trunk/Source/JavaScriptCore/runtime/Structure.h</a></li>
<li><a href="#trunkSourceWTFChangeLog">trunk/Source/WTF/ChangeLog</a></li>
<li><a href="#trunkSourceWTFwtfBagh">trunk/Source/WTF/wtf/Bag.h</a></li>
</ul>
<h3>Added Paths</h3>
<ul>
<li><a href="#trunkLayoutTestsjsregressftllibraryinliningdataviewexpectedtxt">trunk/LayoutTests/js/regress/ftl-library-inlining-dataview-expected.txt</a></li>
<li><a href="#trunkLayoutTestsjsregressftllibraryinliningdataviewhtml">trunk/LayoutTests/js/regress/ftl-library-inlining-dataview.html</a></li>
<li><a href="#trunkLayoutTestsjsregressftllibraryinliningexpectedtxt">trunk/LayoutTests/js/regress/ftl-library-inlining-expected.txt</a></li>
<li><a href="#trunkLayoutTestsjsregressftllibraryinlininghtml">trunk/LayoutTests/js/regress/ftl-library-inlining.html</a></li>
<li><a href="#trunkLayoutTestsjsregressgetbyidbimorphiccheckstructureeliminationexpectedtxt">trunk/LayoutTests/js/regress/get-by-id-bimorphic-check-structure-elimination-expected.txt</a></li>
<li><a href="#trunkLayoutTestsjsregressgetbyidbimorphiccheckstructureeliminationsimpleexpectedtxt">trunk/LayoutTests/js/regress/get-by-id-bimorphic-check-structure-elimination-simple-expected.txt</a></li>
<li><a href="#trunkLayoutTestsjsregressgetbyidbimorphiccheckstructureeliminationsimplehtml">trunk/LayoutTests/js/regress/get-by-id-bimorphic-check-structure-elimination-simple.html</a></li>
<li><a href="#trunkLayoutTestsjsregressgetbyidbimorphiccheckstructureeliminationhtml">trunk/LayoutTests/js/regress/get-by-id-bimorphic-check-structure-elimination.html</a></li>
<li><a href="#trunkLayoutTestsjsregressgetbyidcheckstructureeliminationexpectedtxt">trunk/LayoutTests/js/regress/get-by-id-check-structure-elimination-expected.txt</a></li>
<li><a href="#trunkLayoutTestsjsregressgetbyidcheckstructureeliminationhtml">trunk/LayoutTests/js/regress/get-by-id-check-structure-elimination.html</a></li>
<li><a href="#trunkLayoutTestsjsregressgetbyidquadmorphiccheckstructureeliminationsimpleexpectedtxt">trunk/LayoutTests/js/regress/get-by-id-quadmorphic-check-structure-elimination-simple-expected.txt</a></li>
<li><a href="#trunkLayoutTestsjsregressgetbyidquadmorphiccheckstructureeliminationsimplehtml">trunk/LayoutTests/js/regress/get-by-id-quadmorphic-check-structure-elimination-simple.html</a></li>
<li><a href="#trunkLayoutTestsjsregresshoistmakeropeexpectedtxt">trunk/LayoutTests/js/regress/hoist-make-rope-expected.txt</a></li>
<li><a href="#trunkLayoutTestsjsregresshoistmakeropehtml">trunk/LayoutTests/js/regress/hoist-make-rope.html</a></li>
<li><a href="#trunkLayoutTestsjsregressscripttestsftllibraryinliningdataviewjs">trunk/LayoutTests/js/regress/script-tests/ftl-library-inlining-dataview.js</a></li>
<li><a href="#trunkLayoutTestsjsregressscripttestsftllibraryinliningjs">trunk/LayoutTests/js/regress/script-tests/ftl-library-inlining.js</a></li>
<li><a href="#trunkLayoutTestsjsregressscripttestsgetbyidbimorphiccheckstructureeliminationsimplejs">trunk/LayoutTests/js/regress/script-tests/get-by-id-bimorphic-check-structure-elimination-simple.js</a></li>
<li><a href="#trunkLayoutTestsjsregressscripttestsgetbyidbimorphiccheckstructureeliminationjs">trunk/LayoutTests/js/regress/script-tests/get-by-id-bimorphic-check-structure-elimination.js</a></li>
<li><a href="#trunkLayoutTestsjsregressscripttestsgetbyidcheckstructureeliminationjs">trunk/LayoutTests/js/regress/script-tests/get-by-id-check-structure-elimination.js</a></li>
<li><a href="#trunkLayoutTestsjsregressscripttestsgetbyidquadmorphiccheckstructureeliminationsimplejs">trunk/LayoutTests/js/regress/script-tests/get-by-id-quadmorphic-check-structure-elimination-simple.js</a></li>
<li><a href="#trunkLayoutTestsjsregressscripttestshoistmakeropejs">trunk/LayoutTests/js/regress/script-tests/hoist-make-rope.js</a></li>
<li><a href="#trunkSourceJavaScriptCorebytecodeStructureSetcpp">trunk/Source/JavaScriptCore/bytecode/StructureSet.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGDoesGCcpp">trunk/Source/JavaScriptCore/dfg/DFGDoesGC.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGDoesGCh">trunk/Source/JavaScriptCore/dfg/DFGDoesGC.h</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGStructureAbstractValuecpp">trunk/Source/JavaScriptCore/dfg/DFGStructureAbstractValue.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGStructureClobberStateh">trunk/Source/JavaScriptCore/dfg/DFGStructureClobberState.h</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGTransitioncpp">trunk/Source/JavaScriptCore/dfg/DFGTransition.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGTransitionh">trunk/Source/JavaScriptCore/dfg/DFGTransition.h</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGWatchableStructureWatchingPhasecpp">trunk/Source/JavaScriptCore/dfg/DFGWatchableStructureWatchingPhase.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGWatchableStructureWatchingPhaseh">trunk/Source/JavaScriptCore/dfg/DFGWatchableStructureWatchingPhase.h</a></li>
<li><a href="#trunkSourceJavaScriptCoretestsstressarrayifytostructurecontradictionjs">trunk/Source/JavaScriptCore/tests/stress/arrayify-to-structure-contradiction.js</a></li>
<li><a href="#trunkSourceJavaScriptCoretestsstressftlgetmyargumentslengthinlinejs">trunk/Source/JavaScriptCore/tests/stress/ftl-getmyargumentslength-inline.js</a></li>
<li><a href="#trunkSourceJavaScriptCoretestsstressftllibraryexceptionjs">trunk/Source/JavaScriptCore/tests/stress/ftl-library-exception.js</a></li>
<li><a href="#trunkSourceJavaScriptCoretestsstressftllibraryinlinegettimezoneoffsetjs">trunk/Source/JavaScriptCore/tests/stress/ftl-library-inline-gettimezoneoffset.js</a></li>
<li><a href="#trunkSourceJavaScriptCoretestsstressftllibraryinliningexceptionsdataviewjs">trunk/Source/JavaScriptCore/tests/stress/ftl-library-inlining-exceptions-dataview.js</a></li>
<li><a href="#trunkSourceJavaScriptCoretestsstressftllibraryinliningexceptionsjs">trunk/Source/JavaScriptCore/tests/stress/ftl-library-inlining-exceptions.js</a></li>
<li><a href="#trunkSourceJavaScriptCoretestsstressftllibraryinliningloopsjs">trunk/Source/JavaScriptCore/tests/stress/ftl-library-inlining-loops.js</a></li>
<li><a href="#trunkSourceJavaScriptCoretestsstressftllibraryinliningrandomjs">trunk/Source/JavaScriptCore/tests/stress/ftl-library-inlining-random.js</a></li>
<li><a href="#trunkSourceJavaScriptCoretestsstressftllibrarysubstringjs">trunk/Source/JavaScriptCore/tests/stress/ftl-library-substring.js</a></li>
<li><a href="#trunkSourceJavaScriptCoretestsstressmultiputbyoffsetmultipletransitionsjs">trunk/Source/JavaScriptCore/tests/stress/multi-put-by-offset-multiple-transitions.js</a></li>
<li><a href="#trunkSourceJavaScriptCoretestsstressthrowfromftlinloopjs">trunk/Source/JavaScriptCore/tests/stress/throw-from-ftl-in-loop.js</a></li>
<li><a href="#trunkSourceJavaScriptCoretestsstressthrowfromftljs">trunk/Source/JavaScriptCore/tests/stress/throw-from-ftl.js</a></li>
</ul>
</div>
<div id="patch">
<h3>Diff</h3>
<a id="trunkLayoutTestsChangeLog"></a>
<div class="modfile"><h4>Modified: trunk/LayoutTests/ChangeLog (171379 => 171380)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/ChangeLog 2014-07-23 01:12:32 UTC (rev 171379)
+++ trunk/LayoutTests/ChangeLog 2014-07-23 01:19:50 UTC (rev 171380)
</span><span class="lines">@@ -1,3 +1,88 @@
</span><ins>+2014-07-22 Filip Pizlo <fpizlo@apple.com>
+
+ Merge r169148, r169185, r169188, r169578, r169582, r169584, r169588, r169753 from ftlopt.
+
+ 2014-06-04 Filip Pizlo <fpizlo@apple.com>
+
+ [ftlopt] AI should be able track structure sets larger than 1
+ https://bugs.webkit.org/show_bug.cgi?id=128073
+
+ Reviewed by Oliver Hunt.
+
+ * js/regress/get-by-id-bimorphic-check-structure-elimination-expected.txt: Added.
+ * js/regress/get-by-id-bimorphic-check-structure-elimination-simple-expected.txt: Added.
+ * js/regress/get-by-id-bimorphic-check-structure-elimination-simple.html: Added.
+ * js/regress/get-by-id-bimorphic-check-structure-elimination.html: Added.
+ * js/regress/get-by-id-check-structure-elimination-expected.txt: Added.
+ * js/regress/get-by-id-check-structure-elimination.html: Added.
+ * js/regress/get-by-id-quadmorphic-check-structure-elimination-simple-expected.txt: Added.
+ * js/regress/get-by-id-quadmorphic-check-structure-elimination-simple.html: Added.
+ * js/regress/script-tests/get-by-id-bimorphic-check-structure-elimination-simple.js: Added.
+ * js/regress/script-tests/get-by-id-bimorphic-check-structure-elimination.js: Added.
+ * js/regress/script-tests/get-by-id-check-structure-elimination.js: Added.
+ * js/regress/script-tests/get-by-id-quadmorphic-check-structure-elimination-simple.js: Added.
+
+ 2014-06-03 Filip Pizlo <fpizlo@apple.com>
+
+ [ftlopt] FTL native inlining tests take far too long
+ https://bugs.webkit.org/show_bug.cgi?id=133498
+
+ Unreviewed test gardening.
+
+ Move long-running tests that focus on correctness into JSC/tests/stress.
+ Speed up the performance tests by reducing allocation and call overhead.
+
+ * js/regress/ftl-library-inlining-exceptions-expected.txt: Removed.
+ * js/regress/ftl-library-inlining-exceptions.html: Removed.
+ * js/regress/ftl-library-inlining-folding-expected.txt: Removed.
+ * js/regress/ftl-library-inlining-folding.html: Removed.
+ * js/regress/ftl-library-inlining-loops-expected.txt: Removed.
+ * js/regress/ftl-library-inlining-loops.html: Removed.
+ * js/regress/script-tests/ftl-library-inlining-dataview.js:
+ (foo): Deleted.
+ * js/regress/script-tests/ftl-library-inlining-exceptions.js: Removed.
+ * js/regress/script-tests/ftl-library-inlining-folding.js: Removed.
+ * js/regress/script-tests/ftl-library-inlining-loops.js: Removed.
+ * js/regress/script-tests/ftl-library-inlining.js:
+ (foo): Deleted.
+
+ 2014-06-03 Matthew Mirman <mmirman@apple.com>
+
+ [ftlopt] Added system for inlining native functions via the FTL.
+ https://bugs.webkit.org/show_bug.cgi?id=131515
+
+ Reviewed by Filip Pizlo.
+
+ Adds microbenchmarks.
+
+ * js/regress/script-tests/ftl-library-inlining.js: Added.
+ * js/regress/ftl-library-inlining-expected.txt: Added.
+ * js/regress/ftl-library-inlining.html: Added.
+ * js/regress/script-tests/ftl-library-inlining-dataview.js: Added.
+ * js/regress/ftl-library-inlining-dataview-expected.txt: Added.
+ * js/regress/ftl-library-inlining-dataview.html: Added.
+ * js/regress/script-tests/ftl-library-inlining-exceptions.js: Added.
+ * js/regress/ftl-library-inlining-exceptions-expected.txt: Added.
+ * js/regress/ftl-library-inlining-exceptions.html: Added.
+ * js/regress/script-tests/ftl-library-inlining-folding.js: Added.
+ * js/regress/ftl-library-inlining-folding-expected.txt: Added.
+ * js/regress/ftl-library-inlining-folding-expected.html: Added.
+ * js/regress/script-tests/ftl-library-inlining-loops.js: Added.
+ * js/regress/ftl-library-inlining-loops-expected.txt: Added.
+ * js/regress/ftl-library-inlining-loops.html: Added.
+
+ 2014-05-21 Filip Pizlo <fpizlo@apple.com>
+
+ [ftlopt] DFG::clobberize should be blind to the effects of GC
+ https://bugs.webkit.org/show_bug.cgi?id=133166
+
+ Reviewed by Geoffrey Garen.
+
+ * js/regress/hoist-make-rope-expected.txt: Added.
+ * js/regress/hoist-make-rope.html: Added.
+ * js/regress/script-tests/hoist-make-rope.js: Added.
+ (foo):
+
</ins><span class="cx"> 2014-07-22 Alex Christensen <achristensen@webkit.org>
</span><span class="cx">
</span><span class="cx"> Fix window-inactive css selectors when using querySelector.
</span></span></pre></div>
<a id="trunkLayoutTestsjsregressftllibraryinliningdataviewexpectedtxt"></a>
<div class="addfile"><h4>Added: trunk/LayoutTests/js/regress/ftl-library-inlining-dataview-expected.txt (0 => 171380)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/regress/ftl-library-inlining-dataview-expected.txt (rev 0)
+++ trunk/LayoutTests/js/regress/ftl-library-inlining-dataview-expected.txt 2014-07-23 01:19:50 UTC (rev 171380)
</span><span class="lines">@@ -0,0 +1,10 @@
</span><ins>+JSRegress/ftl-library-inlining-dataview
+
+On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
+
+
+PASS no exception thrown
+PASS successfullyParsed is true
+
+TEST COMPLETE
+
</ins></span></pre></div>
<a id="trunkLayoutTestsjsregressftllibraryinliningdataviewhtml"></a>
<div class="addfile"><h4>Added: trunk/LayoutTests/js/regress/ftl-library-inlining-dataview.html (0 => 171380)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/regress/ftl-library-inlining-dataview.html (rev 0)
+++ trunk/LayoutTests/js/regress/ftl-library-inlining-dataview.html 2014-07-23 01:19:50 UTC (rev 171380)
</span><span class="lines">@@ -0,0 +1,12 @@
</span><ins>+<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
+<html>
+<head>
+<script src="../../resources/js-test-pre.js"></script>
+</head>
+<body>
+<script src="../../resources/regress-pre.js"></script>
+<script src="script-tests/ftl-library-inlining-dataview.js"></script>
+<script src="../../resources/regress-post.js"></script>
+<script src="../../resources/js-test-post.js"></script>
+</body>
+</html>
</ins></span></pre></div>
<a id="trunkLayoutTestsjsregressftllibraryinliningexpectedtxt"></a>
<div class="addfile"><h4>Added: trunk/LayoutTests/js/regress/ftl-library-inlining-expected.txt (0 => 171380)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/regress/ftl-library-inlining-expected.txt (rev 0)
+++ trunk/LayoutTests/js/regress/ftl-library-inlining-expected.txt 2014-07-23 01:19:50 UTC (rev 171380)
</span><span class="lines">@@ -0,0 +1,10 @@
</span><ins>+JSRegress/ftl-library-inlining
+
+On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
+
+
+PASS no exception thrown
+PASS successfullyParsed is true
+
+TEST COMPLETE
+
</ins></span></pre></div>
<a id="trunkLayoutTestsjsregressftllibraryinlininghtml"></a>
<div class="addfile"><h4>Added: trunk/LayoutTests/js/regress/ftl-library-inlining.html (0 => 171380)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/regress/ftl-library-inlining.html (rev 0)
+++ trunk/LayoutTests/js/regress/ftl-library-inlining.html 2014-07-23 01:19:50 UTC (rev 171380)
</span><span class="lines">@@ -0,0 +1,12 @@
</span><ins>+<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
+<html>
+<head>
+<script src="../../resources/js-test-pre.js"></script>
+</head>
+<body>
+<script src="../../resources/regress-pre.js"></script>
+<script src="script-tests/ftl-library-inlining.js"></script>
+<script src="../../resources/regress-post.js"></script>
+<script src="../../resources/js-test-post.js"></script>
+</body>
+</html>
</ins></span></pre></div>
<a id="trunkLayoutTestsjsregressgetbyidbimorphiccheckstructureeliminationexpectedtxt"></a>
<div class="addfile"><h4>Added: trunk/LayoutTests/js/regress/get-by-id-bimorphic-check-structure-elimination-expected.txt (0 => 171380)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/regress/get-by-id-bimorphic-check-structure-elimination-expected.txt (rev 0)
+++ trunk/LayoutTests/js/regress/get-by-id-bimorphic-check-structure-elimination-expected.txt 2014-07-23 01:19:50 UTC (rev 171380)
</span><span class="lines">@@ -0,0 +1,10 @@
</span><ins>+JSRegress/get-by-id-bimorphic-check-structure-elimination
+
+On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
+
+
+PASS no exception thrown
+PASS successfullyParsed is true
+
+TEST COMPLETE
+
</ins></span></pre></div>
<a id="trunkLayoutTestsjsregressgetbyidbimorphiccheckstructureeliminationsimpleexpectedtxt"></a>
<div class="addfile"><h4>Added: trunk/LayoutTests/js/regress/get-by-id-bimorphic-check-structure-elimination-simple-expected.txt (0 => 171380)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/regress/get-by-id-bimorphic-check-structure-elimination-simple-expected.txt (rev 0)
+++ trunk/LayoutTests/js/regress/get-by-id-bimorphic-check-structure-elimination-simple-expected.txt 2014-07-23 01:19:50 UTC (rev 171380)
</span><span class="lines">@@ -0,0 +1,10 @@
</span><ins>+JSRegress/get-by-id-bimorphic-check-structure-elimination-simple
+
+On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
+
+
+PASS no exception thrown
+PASS successfullyParsed is true
+
+TEST COMPLETE
+
</ins></span></pre></div>
<a id="trunkLayoutTestsjsregressgetbyidbimorphiccheckstructureeliminationsimplehtml"></a>
<div class="addfile"><h4>Added: trunk/LayoutTests/js/regress/get-by-id-bimorphic-check-structure-elimination-simple.html (0 => 171380)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/regress/get-by-id-bimorphic-check-structure-elimination-simple.html (rev 0)
+++ trunk/LayoutTests/js/regress/get-by-id-bimorphic-check-structure-elimination-simple.html 2014-07-23 01:19:50 UTC (rev 171380)
</span><span class="lines">@@ -0,0 +1,12 @@
</span><ins>+<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
+<html>
+<head>
+<script src="../../resources/js-test-pre.js"></script>
+</head>
+<body>
+<script src="../../resources/regress-pre.js"></script>
+<script src="script-tests/get-by-id-bimorphic-check-structure-elimination-simple.js"></script>
+<script src="../../resources/regress-post.js"></script>
+<script src="../../resources/js-test-post.js"></script>
+</body>
+</html>
</ins></span></pre></div>
<a id="trunkLayoutTestsjsregressgetbyidbimorphiccheckstructureeliminationhtml"></a>
<div class="addfile"><h4>Added: trunk/LayoutTests/js/regress/get-by-id-bimorphic-check-structure-elimination.html (0 => 171380)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/regress/get-by-id-bimorphic-check-structure-elimination.html (rev 0)
+++ trunk/LayoutTests/js/regress/get-by-id-bimorphic-check-structure-elimination.html 2014-07-23 01:19:50 UTC (rev 171380)
</span><span class="lines">@@ -0,0 +1,12 @@
</span><ins>+<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
+<html>
+<head>
+<script src="../../resources/js-test-pre.js"></script>
+</head>
+<body>
+<script src="../../resources/regress-pre.js"></script>
+<script src="script-tests/get-by-id-bimorphic-check-structure-elimination.js"></script>
+<script src="../../resources/regress-post.js"></script>
+<script src="../../resources/js-test-post.js"></script>
+</body>
+</html>
</ins></span></pre></div>
<a id="trunkLayoutTestsjsregressgetbyidcheckstructureeliminationexpectedtxt"></a>
<div class="addfile"><h4>Added: trunk/LayoutTests/js/regress/get-by-id-check-structure-elimination-expected.txt (0 => 171380)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/regress/get-by-id-check-structure-elimination-expected.txt (rev 0)
+++ trunk/LayoutTests/js/regress/get-by-id-check-structure-elimination-expected.txt 2014-07-23 01:19:50 UTC (rev 171380)
</span><span class="lines">@@ -0,0 +1,10 @@
</span><ins>+JSRegress/get-by-id-check-structure-elimination
+
+On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
+
+
+PASS no exception thrown
+PASS successfullyParsed is true
+
+TEST COMPLETE
+
</ins></span></pre></div>
<a id="trunkLayoutTestsjsregressgetbyidcheckstructureeliminationhtml"></a>
<div class="addfile"><h4>Added: trunk/LayoutTests/js/regress/get-by-id-check-structure-elimination.html (0 => 171380)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/regress/get-by-id-check-structure-elimination.html (rev 0)
+++ trunk/LayoutTests/js/regress/get-by-id-check-structure-elimination.html 2014-07-23 01:19:50 UTC (rev 171380)
</span><span class="lines">@@ -0,0 +1,12 @@
</span><ins>+<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
+<html>
+<head>
+<script src="../../resources/js-test-pre.js"></script>
+</head>
+<body>
+<script src="../../resources/regress-pre.js"></script>
+<script src="script-tests/get-by-id-check-structure-elimination.js"></script>
+<script src="../../resources/regress-post.js"></script>
+<script src="../../resources/js-test-post.js"></script>
+</body>
+</html>
</ins></span></pre></div>
<a id="trunkLayoutTestsjsregressgetbyidquadmorphiccheckstructureeliminationsimpleexpectedtxt"></a>
<div class="addfile"><h4>Added: trunk/LayoutTests/js/regress/get-by-id-quadmorphic-check-structure-elimination-simple-expected.txt (0 => 171380)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/regress/get-by-id-quadmorphic-check-structure-elimination-simple-expected.txt (rev 0)
+++ trunk/LayoutTests/js/regress/get-by-id-quadmorphic-check-structure-elimination-simple-expected.txt 2014-07-23 01:19:50 UTC (rev 171380)
</span><span class="lines">@@ -0,0 +1,10 @@
</span><ins>+JSRegress/get-by-id-quadmorphic-check-structure-elimination-simple
+
+On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
+
+
+PASS no exception thrown
+PASS successfullyParsed is true
+
+TEST COMPLETE
+
</ins></span></pre></div>
<a id="trunkLayoutTestsjsregressgetbyidquadmorphiccheckstructureeliminationsimplehtml"></a>
<div class="addfile"><h4>Added: trunk/LayoutTests/js/regress/get-by-id-quadmorphic-check-structure-elimination-simple.html (0 => 171380)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/regress/get-by-id-quadmorphic-check-structure-elimination-simple.html (rev 0)
+++ trunk/LayoutTests/js/regress/get-by-id-quadmorphic-check-structure-elimination-simple.html 2014-07-23 01:19:50 UTC (rev 171380)
</span><span class="lines">@@ -0,0 +1,12 @@
</span><ins>+<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
+<html>
+<head>
+<script src="../../resources/js-test-pre.js"></script>
+</head>
+<body>
+<script src="../../resources/regress-pre.js"></script>
+<script src="script-tests/get-by-id-quadmorphic-check-structure-elimination-simple.js"></script>
+<script src="../../resources/regress-post.js"></script>
+<script src="../../resources/js-test-post.js"></script>
+</body>
+</html>
</ins></span></pre></div>
<a id="trunkLayoutTestsjsregresshoistmakeropeexpectedtxt"></a>
<div class="addfile"><h4>Added: trunk/LayoutTests/js/regress/hoist-make-rope-expected.txt (0 => 171380)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/regress/hoist-make-rope-expected.txt (rev 0)
+++ trunk/LayoutTests/js/regress/hoist-make-rope-expected.txt 2014-07-23 01:19:50 UTC (rev 171380)
</span><span class="lines">@@ -0,0 +1,10 @@
</span><ins>+JSRegress/hoist-make-rope
+
+On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
+
+
+PASS no exception thrown
+PASS successfullyParsed is true
+
+TEST COMPLETE
+
</ins></span></pre></div>
<a id="trunkLayoutTestsjsregresshoistmakeropehtml"></a>
<div class="addfile"><h4>Added: trunk/LayoutTests/js/regress/hoist-make-rope.html (0 => 171380)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/regress/hoist-make-rope.html (rev 0)
+++ trunk/LayoutTests/js/regress/hoist-make-rope.html 2014-07-23 01:19:50 UTC (rev 171380)
</span><span class="lines">@@ -0,0 +1,12 @@
</span><ins>+<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
+<html>
+<head>
+<script src="../../resources/js-test-pre.js"></script>
+</head>
+<body>
+<script src="../../resources/regress-pre.js"></script>
+<script src="script-tests/hoist-make-rope.js"></script>
+<script src="../../resources/regress-post.js"></script>
+<script src="../../resources/js-test-post.js"></script>
+</body>
+</html>
</ins></span></pre></div>
<a id="trunkLayoutTestsjsregressscripttestsftllibraryinliningdataviewjs"></a>
<div class="addfile"><h4>Added: trunk/LayoutTests/js/regress/script-tests/ftl-library-inlining-dataview.js (0 => 171380)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/regress/script-tests/ftl-library-inlining-dataview.js (rev 0)
+++ trunk/LayoutTests/js/regress/script-tests/ftl-library-inlining-dataview.js 2014-07-23 01:19:50 UTC (rev 171380)
</span><span class="lines">@@ -0,0 +1,13 @@
</span><ins>+(function() {
+ var result = 0;
+ var d = new DataView(new ArrayBuffer(5));
+ for (var i = 0; i < 1000000; i++) {
+ d.setInt8(0, 4);
+ d.setInt8(1, 2);
+ d.setInt8(2, 6);
+ d.setInt16(0, 20);
+ result += d.getInt8(2) + d.getInt8(0);
+ }
+ if (result != 6000000)
+ throw "Bad result: " + result;
+})();
</ins></span></pre></div>
<a id="trunkLayoutTestsjsregressscripttestsftllibraryinliningjs"></a>
<div class="addfile"><h4>Added: trunk/LayoutTests/js/regress/script-tests/ftl-library-inlining.js (0 => 171380)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/regress/script-tests/ftl-library-inlining.js (rev 0)
+++ trunk/LayoutTests/js/regress/script-tests/ftl-library-inlining.js 2014-07-23 01:19:50 UTC (rev 171380)
</span><span class="lines">@@ -0,0 +1,4 @@
</span><ins>+(function() {
+ for (var i = 0 ; i < 10000000; i++)
+ Math.random();
+})();
</ins></span></pre></div>
<a id="trunkLayoutTestsjsregressscripttestsgetbyidbimorphiccheckstructureeliminationsimplejs"></a>
<div class="addfile"><h4>Added: trunk/LayoutTests/js/regress/script-tests/get-by-id-bimorphic-check-structure-elimination-simple.js (0 => 171380)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/regress/script-tests/get-by-id-bimorphic-check-structure-elimination-simple.js (rev 0)
+++ trunk/LayoutTests/js/regress/script-tests/get-by-id-bimorphic-check-structure-elimination-simple.js 2014-07-23 01:19:50 UTC (rev 171380)
</span><span class="lines">@@ -0,0 +1,13 @@
</span><ins>+(function() {
+ var o = {a:1};
+ var p = {a:2, l:13};
+ var result = 0;
+ for (var i = 0; i < 1000000; ++i) {
+ result ^= o.a;
+ var tmp = o;
+ o = p;
+ p = tmp;
+ }
+ if (result != 0)
+ throw "Error: bad result: " + result;
+})();
</ins></span></pre></div>
<a id="trunkLayoutTestsjsregressscripttestsgetbyidbimorphiccheckstructureeliminationjs"></a>
<div class="addfile"><h4>Added: trunk/LayoutTests/js/regress/script-tests/get-by-id-bimorphic-check-structure-elimination.js (0 => 171380)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/regress/script-tests/get-by-id-bimorphic-check-structure-elimination.js (rev 0)
+++ trunk/LayoutTests/js/regress/script-tests/get-by-id-bimorphic-check-structure-elimination.js 2014-07-23 01:19:50 UTC (rev 171380)
</span><span class="lines">@@ -0,0 +1,13 @@
</span><ins>+(function() {
+ var o = {a:1, b:2, c:3, d:4, e:5, f:6, g:7, h:8, i:9, j:10, k:11};
+ var p = {a:2, b:3, c:4, d:5, e:6, f:7, g:8, h:9, i:10, j:11, k:12, l:13};
+ var result = 0;
+ for (var i = 0; i < 1000000; ++i) {
+ result += o.a ^ o.b ^ o.c ^ o.d ^ o.e ^ o.f ^ o.g ^ o.h ^ o.i ^ o.j ^ o.k;
+ var tmp = o;
+ o = p;
+ p = tmp;
+ }
+ if (result != 6500000)
+ throw "Error: bad result: " + result;
+})();
</ins></span></pre></div>
<a id="trunkLayoutTestsjsregressscripttestsgetbyidcheckstructureeliminationjs"></a>
<div class="addfile"><h4>Added: trunk/LayoutTests/js/regress/script-tests/get-by-id-check-structure-elimination.js (0 => 171380)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/regress/script-tests/get-by-id-check-structure-elimination.js (rev 0)
+++ trunk/LayoutTests/js/regress/script-tests/get-by-id-check-structure-elimination.js 2014-07-23 01:19:50 UTC (rev 171380)
</span><span class="lines">@@ -0,0 +1,8 @@
</span><ins>+(function() {
+ var o = {a:1, b:2, c:3, d:4, e:5, f:6, g:7, h:8, i:9, j:10, k:11};
+ var result = 0;
+ for (var i = 0; i < 1000000; ++i)
+ result += o.a ^ o.b | o.c ^ o.d & o.e ^ o.f | o.g ^ o.h & o.i ^ o.j | o.k;
+ if (result != 15000000)
+ throw "Error: bad result: " + result;
+})();
</ins></span></pre></div>
<a id="trunkLayoutTestsjsregressscripttestsgetbyidquadmorphiccheckstructureeliminationsimplejs"></a>
<div class="addfile"><h4>Added: trunk/LayoutTests/js/regress/script-tests/get-by-id-quadmorphic-check-structure-elimination-simple.js (0 => 171380)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/regress/script-tests/get-by-id-quadmorphic-check-structure-elimination-simple.js (rev 0)
+++ trunk/LayoutTests/js/regress/script-tests/get-by-id-quadmorphic-check-structure-elimination-simple.js 2014-07-23 01:19:50 UTC (rev 171380)
</span><span class="lines">@@ -0,0 +1,17 @@
</span><ins>+(function() {
+ var o = {a:1};
+ var p = {a:2, l:13};
+ var q = {a:3, b:3};
+ var r = {a:4, c:5};
+ var result = 0;
+ for (var i = 0; i < 1000000; ++i) {
+ result ^= o.a;
+ var tmp = o;
+ o = p;
+ p = q;
+ q = r;
+ r = tmp;
+ }
+ if (result != 0)
+ throw "Error: bad result: " + result;
+})();
</ins></span></pre></div>
<a id="trunkLayoutTestsjsregressscripttestshoistmakeropejs"></a>
<div class="addfile"><h4>Added: trunk/LayoutTests/js/regress/script-tests/hoist-make-rope.js (0 => 171380)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/regress/script-tests/hoist-make-rope.js (rev 0)
+++ trunk/LayoutTests/js/regress/script-tests/hoist-make-rope.js 2014-07-23 01:19:50 UTC (rev 171380)
</span><span class="lines">@@ -0,0 +1,14 @@
</span><ins>+function foo(a, b) {
+ var result;
+ for (var i = 0; i < 10000; ++i)
+ result = a + b;
+ return result;
+}
+
+noInline(foo);
+
+for (var i = 0; i < 500; ++i) {
+ var result = foo("hello ", "world!");
+ if (result != "hello world!")
+ throw "Error: bad result: " + result;
+}
</ins></span></pre></div>
<a id="trunkSourceJavaScriptCoreCMakeListstxt"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/CMakeLists.txt (171379 => 171380)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/CMakeLists.txt 2014-07-23 01:12:32 UTC (rev 171379)
+++ trunk/Source/JavaScriptCore/CMakeLists.txt 2014-07-23 01:19:50 UTC (rev 171380)
</span><span class="lines">@@ -90,6 +90,7 @@
</span><span class="cx"> bytecode/SamplingTool.cpp
</span><span class="cx"> bytecode/SpecialPointer.cpp
</span><span class="cx"> bytecode/SpeculatedType.cpp
</span><ins>+ bytecode/StructureSet.cpp
</ins><span class="cx"> bytecode/StructureStubClearingWatchpoint.cpp
</span><span class="cx"> bytecode/StructureStubInfo.cpp
</span><span class="cx"> bytecode/UnlinkedCodeBlock.cpp
</span><span class="lines">@@ -137,6 +138,7 @@
</span><span class="cx"> dfg/DFGDesiredWeakReferences.cpp
</span><span class="cx"> dfg/DFGDesiredWriteBarriers.cpp
</span><span class="cx"> dfg/DFGDisassembler.cpp
</span><ins>+ dfg/DFGDoesGC.cpp
</ins><span class="cx"> dfg/DFGDominators.cpp
</span><span class="cx"> dfg/DFGDriver.cpp
</span><span class="cx"> dfg/DFGEdge.cpp
</span><span class="lines">@@ -191,9 +193,11 @@
</span><span class="cx"> dfg/DFGStaticExecutionCountEstimationPhase.cpp
</span><span class="cx"> dfg/DFGStoreBarrierElisionPhase.cpp
</span><span class="cx"> dfg/DFGStrengthReductionPhase.cpp
</span><ins>+ dfg/DFGStructureAbstractValue.cpp
</ins><span class="cx"> dfg/DFGThreadData.cpp
</span><span class="cx"> dfg/DFGThunks.cpp
</span><span class="cx"> dfg/DFGTierUpCheckInjectionPhase.cpp
</span><ins>+ dfg/DFGTransition.cpp
</ins><span class="cx"> dfg/DFGTypeCheckHoistingPhase.cpp
</span><span class="cx"> dfg/DFGUnificationPhase.cpp
</span><span class="cx"> dfg/DFGUseKind.cpp
</span><span class="lines">@@ -204,6 +208,7 @@
</span><span class="cx"> dfg/DFGVariableEvent.cpp
</span><span class="cx"> dfg/DFGVariableEventStream.cpp
</span><span class="cx"> dfg/DFGVirtualRegisterAllocationPhase.cpp
</span><ins>+ dfg/DFGWatchableStructureWatchingPhase.cpp
</ins><span class="cx"> dfg/DFGWatchpointCollectionPhase.cpp
</span><span class="cx"> dfg/DFGWorklist.cpp
</span><span class="cx">
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreChangeLog"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/ChangeLog (171379 => 171380)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/ChangeLog 2014-07-23 01:12:32 UTC (rev 171379)
+++ trunk/Source/JavaScriptCore/ChangeLog 2014-07-23 01:19:50 UTC (rev 171380)
</span><span class="lines">@@ -1,3 +1,662 @@
</span><ins>+2014-07-22 Filip Pizlo <fpizlo@apple.com>
+
+ Merge r169148, r169185, r169188, r169578, r169582, r169584, r169588, r169753 from ftlopt.
+
+ Note that r169753 is merged out of order because it fixes a bug in r169588.
+
+ 2014-06-10 Filip Pizlo <fpizlo@apple.com>
+
+ [ftlopt] Structure::dfgShouldWatchIfPossible() is unsound
+ https://bugs.webkit.org/show_bug.cgi?id=133624
+
+ Reviewed by Mark Hahnenberg.
+
+ * runtime/Structure.h:
+ (JSC::Structure::dfgShouldWatchIfPossible): Make it sound and add some verbiage.
+
+ 2014-06-04 Filip Pizlo <fpizlo@apple.com>
+
+ [ftlopt] AI should be able track structure sets larger than 1
+ https://bugs.webkit.org/show_bug.cgi?id=128073
+
+ Reviewed by Oliver Hunt.
+
+ This makes two major changes to how AI (abstract interpreter) proves that a value has
+ some structure:
+
+ - StructureAbstractValue can now track an arbitrary number of structures. A set whose
+ size is greater than one means that the value may have any of the structures, and we
+ don't know which - but we do know that it cannot be any structure not in the set. The
+ structure abstract value can still be TOP, which means the set of all structures. We
+ artificially limit the set size to StructureAbstractValue::polymorphismLimit to guard
+ memory explosion on pathological programs. This limit is big enough that it wouldn't
+ kick in for normal code, since we have other heuristics that limit the number of
+ structures that we would allow an inline cache to know about.
+
+ - We eagerly set watchpoints on all watchable structures and then we assume that
+ watchable structures are being watched, and that the watchpoint will jettison the code.
+ This allows tracking of watchable structures to be far simpler than before. Previously,
+ a structure being tracked as "future possible" was predicated on it being watchable but
+ we might not actually watch it. This makes algebra over sets of future possible
+ structures quite weird. But watching all watchable structures means that we simple say
+ that a structure set can be in the following states: unclobbered, which means it's just
+ a set of structures and it doesn't matter what is watchable or what isn't because we've
+ proven that the value must have one of these structures right now; and clobbered, which
+ means that we have a set of structures, plus all possible structures temporarily, with
+ invalidation removing the "plus all possible structures". Clobbering a set means that
+ if any of its structures are unwatchable, the set just becomes TOP; but if all
+ structures in the set are watchable then we just set the clobbered bit to add the "plus
+ all possible structures temporarily" thing. This precisely tracks the exact meaning of
+ watchability and invalidation points.
+
+ Slight SunSpider slow-down, neutral on Octane, slight AsmBench speed-up. I believe that
+ we will ultimately undo the SunSpider slow-down by making further improvements to the set
+ representation. I believe that Octane perfromance will ultimately improve once we remove
+ remaining singleton special-cases. The ultimate goal of this is to remove the need to
+ try quite so desperately hard to make everything monomorphic as we do currently.
+
+ * CMakeLists.txt:
+ * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+ * JavaScriptCore.xcodeproj/project.pbxproj:
+ * bytecode/StructureSet.cpp:
+ (JSC::StructureSet::clear):
+ (JSC::StructureSet::remove):
+ (JSC::StructureSet::filter):
+ (JSC::StructureSet::copyFromOutOfLine):
+ (JSC::StructureSet::StructureSet): Deleted.
+ (JSC::StructureSet::operator=): Deleted.
+ (JSC::StructureSet::copyFrom): Deleted.
+ * bytecode/StructureSet.h:
+ (JSC::StructureSet::StructureSet):
+ (JSC::StructureSet::operator=):
+ (JSC::StructureSet::isEmpty):
+ (JSC::StructureSet::genericFilter):
+ (JSC::StructureSet::ContainsOutOfLine::ContainsOutOfLine):
+ (JSC::StructureSet::ContainsOutOfLine::operator()):
+ (JSC::StructureSet::copyFrom):
+ (JSC::StructureSet::deleteStructureListIfNecessary):
+ (JSC::StructureSet::setEmpty):
+ (JSC::StructureSet::getReservedFlag):
+ (JSC::StructureSet::setReservedFlag):
+ * dfg/DFGAbstractInterpreter.h:
+ (JSC::DFG::AbstractInterpreter::setBuiltInConstant):
+ * dfg/DFGAbstractInterpreterInlines.h:
+ (JSC::DFG::AbstractInterpreter<AbstractStateType>::booleanResult):
+ (JSC::DFG::AbstractInterpreter<AbstractStateType>::verifyEdge):
+ (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+ (JSC::DFG::AbstractInterpreter<AbstractStateType>::clobberCapturedVars):
+ (JSC::DFG::AbstractInterpreter<AbstractStateType>::forAllValues):
+ (JSC::DFG::AbstractInterpreter<AbstractStateType>::clobberStructures):
+ (JSC::DFG::AbstractInterpreter<AbstractStateType>::observeTransition):
+ (JSC::DFG::AbstractInterpreter<AbstractStateType>::observeTransitions):
+ (JSC::DFG::AbstractInterpreter<AbstractStateType>::setDidClobber):
+ (JSC::DFG::AbstractInterpreter<AbstractStateType>::dump):
+ * dfg/DFGAbstractValue.cpp:
+ (JSC::DFG::AbstractValue::observeTransitions):
+ (JSC::DFG::AbstractValue::setMostSpecific):
+ (JSC::DFG::AbstractValue::set):
+ (JSC::DFG::AbstractValue::filter):
+ (JSC::DFG::AbstractValue::shouldBeClear):
+ (JSC::DFG::AbstractValue::normalizeClarity):
+ (JSC::DFG::AbstractValue::checkConsistency):
+ (JSC::DFG::AbstractValue::assertIsWatched):
+ (JSC::DFG::AbstractValue::dumpInContext):
+ (JSC::DFG::AbstractValue::setFuturePossibleStructure): Deleted.
+ * dfg/DFGAbstractValue.h:
+ (JSC::DFG::AbstractValue::clear):
+ (JSC::DFG::AbstractValue::clobberStructures):
+ (JSC::DFG::AbstractValue::clobberStructuresFor):
+ (JSC::DFG::AbstractValue::observeInvalidationPoint):
+ (JSC::DFG::AbstractValue::observeInvalidationPointFor):
+ (JSC::DFG::AbstractValue::observeTransition):
+ (JSC::DFG::AbstractValue::TransitionObserver::TransitionObserver):
+ (JSC::DFG::AbstractValue::TransitionObserver::operator()):
+ (JSC::DFG::AbstractValue::TransitionsObserver::TransitionsObserver):
+ (JSC::DFG::AbstractValue::TransitionsObserver::operator()):
+ (JSC::DFG::AbstractValue::isHeapTop):
+ (JSC::DFG::AbstractValue::setType):
+ (JSC::DFG::AbstractValue::operator==):
+ (JSC::DFG::AbstractValue::merge):
+ (JSC::DFG::AbstractValue::validate):
+ (JSC::DFG::AbstractValue::hasClobberableState):
+ (JSC::DFG::AbstractValue::assertIsWatched):
+ (JSC::DFG::AbstractValue::observeIndexingTypeTransition):
+ (JSC::DFG::AbstractValue::makeTop):
+ (JSC::DFG::AbstractValue::bestProvenStructure): Deleted.
+ * dfg/DFGAllocator.h:
+ * dfg/DFGArgumentsSimplificationPhase.cpp:
+ (JSC::DFG::ArgumentsSimplificationPhase::run):
+ * dfg/DFGArrayMode.cpp:
+ (JSC::DFG::ArrayMode::alreadyChecked):
+ * dfg/DFGAtTailAbstractState.h:
+ (JSC::DFG::AtTailAbstractState::structureClobberState):
+ (JSC::DFG::AtTailAbstractState::setStructureClobberState):
+ (JSC::DFG::AtTailAbstractState::setFoundConstants):
+ (JSC::DFG::AtTailAbstractState::haveStructures): Deleted.
+ (JSC::DFG::AtTailAbstractState::setHaveStructures): Deleted.
+ * dfg/DFGBasicBlock.cpp:
+ (JSC::DFG::BasicBlock::BasicBlock):
+ * dfg/DFGBasicBlock.h:
+ * dfg/DFGBranchDirection.h:
+ (JSC::DFG::branchDirectionToString):
+ (WTF::printInternal):
+ * dfg/DFGByteCodeParser.cpp:
+ (JSC::DFG::ByteCodeParser::handlePutById):
+ * dfg/DFGCFAPhase.cpp:
+ (JSC::DFG::CFAPhase::performBlockCFA):
+ * dfg/DFGCSEPhase.cpp:
+ (JSC::DFG::CSEPhase::checkStructureElimination):
+ (JSC::DFG::CSEPhase::structureTransitionWatchpointElimination):
+ (JSC::DFG::CSEPhase::performNodeCSE):
+ * dfg/DFGClobberize.h:
+ (JSC::DFG::clobberize):
+ * dfg/DFGCommon.cpp:
+ (JSC::DFG::startCrashing):
+ (JSC::DFG::isCrashing):
+ * dfg/DFGCommon.h:
+ * dfg/DFGCommonData.cpp:
+ (JSC::DFG::CommonData::notifyCompilingStructureTransition):
+ * dfg/DFGConstantFoldingPhase.cpp:
+ (JSC::DFG::ConstantFoldingPhase::foldConstants):
+ (JSC::DFG::ConstantFoldingPhase::emitGetByOffset):
+ (JSC::DFG::ConstantFoldingPhase::emitPutByOffset):
+ (JSC::DFG::ConstantFoldingPhase::addStructureTransitionCheck):
+ * dfg/DFGDesiredWatchpoints.cpp:
+ (JSC::DFG::DesiredWatchpoints::consider):
+ (JSC::DFG::DesiredWatchpoints::addLazily): Deleted.
+ * dfg/DFGDesiredWatchpoints.h:
+ (JSC::DFG::GenericDesiredWatchpoints::reallyAdd):
+ (JSC::DFG::GenericDesiredWatchpoints::areStillValid):
+ (JSC::DFG::GenericDesiredWatchpoints::isWatched):
+ (JSC::DFG::DesiredWatchpoints::isWatched):
+ (JSC::DFG::WatchpointForGenericWatchpointSet::WatchpointForGenericWatchpointSet): Deleted.
+ (JSC::DFG::GenericDesiredWatchpoints::addLazily): Deleted.
+ (JSC::DFG::GenericDesiredWatchpoints::isStillValid): Deleted.
+ (JSC::DFG::GenericDesiredWatchpoints::shouldAssumeMixedState): Deleted.
+ (JSC::DFG::GenericDesiredWatchpoints::isValidOrMixed): Deleted.
+ (JSC::DFG::DesiredWatchpoints::isStillValid): Deleted.
+ (JSC::DFG::DesiredWatchpoints::shouldAssumeMixedState): Deleted.
+ (JSC::DFG::DesiredWatchpoints::isValidOrMixed): Deleted.
+ * dfg/DFGDoesGC.cpp:
+ (JSC::DFG::doesGC):
+ * dfg/DFGFixupPhase.cpp:
+ (JSC::DFG::FixupPhase::fixupNode):
+ (JSC::DFG::FixupPhase::canOptimizeStringObjectAccess):
+ (JSC::DFG::FixupPhase::injectTypeConversionsForEdge):
+ * dfg/DFGGraph.cpp:
+ (JSC::DFG::Graph::~Graph):
+ (JSC::DFG::Graph::dump):
+ (JSC::DFG::Graph::dumpBlockHeader):
+ (JSC::DFG::Graph::tryGetFoldableView):
+ (JSC::DFG::Graph::visitChildren):
+ (JSC::DFG::Graph::assertIsWatched):
+ (JSC::DFG::Graph::handleAssertionFailure):
+ * dfg/DFGGraph.h:
+ (JSC::DFG::Graph::convertToConstant):
+ (JSC::DFG::Graph::masqueradesAsUndefinedWatchpointIsStillValid):
+ (JSC::DFG::Graph::addStructureTransitionData): Deleted.
+ * dfg/DFGInPlaceAbstractState.cpp:
+ (JSC::DFG::InPlaceAbstractState::beginBasicBlock):
+ (JSC::DFG::InPlaceAbstractState::initialize):
+ (JSC::DFG::InPlaceAbstractState::endBasicBlock):
+ (JSC::DFG::InPlaceAbstractState::reset):
+ (JSC::DFG::InPlaceAbstractState::merge):
+ * dfg/DFGInPlaceAbstractState.h:
+ (JSC::DFG::InPlaceAbstractState::structureClobberState):
+ (JSC::DFG::InPlaceAbstractState::setStructureClobberState):
+ (JSC::DFG::InPlaceAbstractState::setFoundConstants):
+ (JSC::DFG::InPlaceAbstractState::haveStructures): Deleted.
+ (JSC::DFG::InPlaceAbstractState::setHaveStructures): Deleted.
+ * dfg/DFGLivenessAnalysisPhase.cpp:
+ (JSC::DFG::LivenessAnalysisPhase::run):
+ * dfg/DFGNode.h:
+ (JSC::DFG::Node::hasTransition):
+ (JSC::DFG::Node::transition):
+ (JSC::DFG::Node::hasStructure):
+ (JSC::DFG::StructureTransitionData::StructureTransitionData): Deleted.
+ (JSC::DFG::Node::convertToStructureTransitionWatchpoint): Deleted.
+ (JSC::DFG::Node::hasStructureTransitionData): Deleted.
+ (JSC::DFG::Node::structureTransitionData): Deleted.
+ * dfg/DFGNodeType.h:
+ * dfg/DFGPlan.cpp:
+ (JSC::DFG::Plan::compileInThreadImpl):
+ * dfg/DFGPredictionPropagationPhase.cpp:
+ (JSC::DFG::PredictionPropagationPhase::propagate):
+ * dfg/DFGSafeToExecute.h:
+ (JSC::DFG::safeToExecute):
+ * dfg/DFGSpeculativeJIT.cpp:
+ (JSC::DFG::SpeculativeJIT::compileAllocatePropertyStorage):
+ (JSC::DFG::SpeculativeJIT::compileReallocatePropertyStorage):
+ * dfg/DFGSpeculativeJIT.h:
+ (JSC::DFG::SpeculativeJIT::speculateStringObjectForStructure):
+ * dfg/DFGSpeculativeJIT32_64.cpp:
+ (JSC::DFG::SpeculativeJIT::compile):
+ * dfg/DFGSpeculativeJIT64.cpp:
+ (JSC::DFG::SpeculativeJIT::compile):
+ * dfg/DFGStructureAbstractValue.cpp: Added.
+ (JSC::DFG::StructureAbstractValue::assertIsWatched):
+ (JSC::DFG::StructureAbstractValue::clobber):
+ (JSC::DFG::StructureAbstractValue::observeTransition):
+ (JSC::DFG::StructureAbstractValue::observeTransitions):
+ (JSC::DFG::StructureAbstractValue::add):
+ (JSC::DFG::StructureAbstractValue::merge):
+ (JSC::DFG::StructureAbstractValue::mergeSlow):
+ (JSC::DFG::StructureAbstractValue::mergeNotTop):
+ (JSC::DFG::StructureAbstractValue::filter):
+ (JSC::DFG::StructureAbstractValue::filterSlow):
+ (JSC::DFG::StructureAbstractValue::contains):
+ (JSC::DFG::StructureAbstractValue::isSubsetOf):
+ (JSC::DFG::StructureAbstractValue::isSupersetOf):
+ (JSC::DFG::StructureAbstractValue::overlaps):
+ (JSC::DFG::StructureAbstractValue::equalsSlow):
+ (JSC::DFG::StructureAbstractValue::dumpInContext):
+ (JSC::DFG::StructureAbstractValue::dump):
+ * dfg/DFGStructureAbstractValue.h:
+ (JSC::DFG::StructureAbstractValue::StructureAbstractValue):
+ (JSC::DFG::StructureAbstractValue::operator=):
+ (JSC::DFG::StructureAbstractValue::clear):
+ (JSC::DFG::StructureAbstractValue::makeTop):
+ (JSC::DFG::StructureAbstractValue::assertIsWatched):
+ (JSC::DFG::StructureAbstractValue::observeInvalidationPoint):
+ (JSC::DFG::StructureAbstractValue::top):
+ (JSC::DFG::StructureAbstractValue::isClear):
+ (JSC::DFG::StructureAbstractValue::isTop):
+ (JSC::DFG::StructureAbstractValue::isNeitherClearNorTop):
+ (JSC::DFG::StructureAbstractValue::isClobbered):
+ (JSC::DFG::StructureAbstractValue::merge):
+ (JSC::DFG::StructureAbstractValue::filter):
+ (JSC::DFG::StructureAbstractValue::operator==):
+ (JSC::DFG::StructureAbstractValue::size):
+ (JSC::DFG::StructureAbstractValue::at):
+ (JSC::DFG::StructureAbstractValue::operator[]):
+ (JSC::DFG::StructureAbstractValue::onlyStructure):
+ (JSC::DFG::StructureAbstractValue::isSupersetOf):
+ (JSC::DFG::StructureAbstractValue::makeTopWhenThin):
+ (JSC::DFG::StructureAbstractValue::setClobbered):
+ (JSC::DFG::StructureAbstractValue::add): Deleted.
+ (JSC::DFG::StructureAbstractValue::addAll): Deleted.
+ (JSC::DFG::StructureAbstractValue::contains): Deleted.
+ (JSC::DFG::StructureAbstractValue::isSubsetOf): Deleted.
+ (JSC::DFG::StructureAbstractValue::doesNotContainAnyOtherThan): Deleted.
+ (JSC::DFG::StructureAbstractValue::isClearOrTop): Deleted.
+ (JSC::DFG::StructureAbstractValue::last): Deleted.
+ (JSC::DFG::StructureAbstractValue::speculationFromStructures): Deleted.
+ (JSC::DFG::StructureAbstractValue::isValidOffset): Deleted.
+ (JSC::DFG::StructureAbstractValue::hasSingleton): Deleted.
+ (JSC::DFG::StructureAbstractValue::singleton): Deleted.
+ (JSC::DFG::StructureAbstractValue::dumpInContext): Deleted.
+ (JSC::DFG::StructureAbstractValue::dump): Deleted.
+ (JSC::DFG::StructureAbstractValue::topValue): Deleted.
+ * dfg/DFGStructureClobberState.h: Added.
+ (JSC::DFG::merge):
+ (WTF::printInternal):
+ * dfg/DFGTransition.cpp: Added.
+ (JSC::DFG::Transition::dumpInContext):
+ (JSC::DFG::Transition::dump):
+ * dfg/DFGTransition.h: Added.
+ (JSC::DFG::Transition::Transition):
+ * dfg/DFGTypeCheckHoistingPhase.cpp:
+ (JSC::DFG::TypeCheckHoistingPhase::identifyRedundantStructureChecks):
+ (JSC::DFG::TypeCheckHoistingPhase::identifyRedundantArrayChecks):
+ * dfg/DFGWatchableStructureWatchingPhase.cpp: Added.
+ (JSC::DFG::WatchableStructureWatchingPhase::WatchableStructureWatchingPhase):
+ (JSC::DFG::WatchableStructureWatchingPhase::run):
+ (JSC::DFG::WatchableStructureWatchingPhase::tryWatch):
+ (JSC::DFG::performWatchableStructureWatching):
+ * dfg/DFGWatchableStructureWatchingPhase.h: Added.
+ * dfg/DFGWatchpointCollectionPhase.cpp:
+ (JSC::DFG::WatchpointCollectionPhase::handle):
+ (JSC::DFG::WatchpointCollectionPhase::handleEdge): Deleted.
+ * ftl/FTLCapabilities.cpp:
+ (JSC::FTL::canCompile):
+ * ftl/FTLIntrinsicRepository.h:
+ * ftl/FTLLowerDFGToLLVM.cpp:
+ (JSC::FTL::ftlUnreachable):
+ (JSC::FTL::LowerDFGToLLVM::createPhiVariables):
+ (JSC::FTL::LowerDFGToLLVM::compileBlock):
+ (JSC::FTL::LowerDFGToLLVM::compileNode):
+ (JSC::FTL::LowerDFGToLLVM::compileUpsilon):
+ (JSC::FTL::LowerDFGToLLVM::compilePhi):
+ (JSC::FTL::LowerDFGToLLVM::compileDoubleRep):
+ (JSC::FTL::LowerDFGToLLVM::compileValueRep):
+ (JSC::FTL::LowerDFGToLLVM::compileValueToInt32):
+ (JSC::FTL::LowerDFGToLLVM::compileGetArgument):
+ (JSC::FTL::LowerDFGToLLVM::compileGetLocal):
+ (JSC::FTL::LowerDFGToLLVM::compileSetLocal):
+ (JSC::FTL::LowerDFGToLLVM::compileArithAddOrSub):
+ (JSC::FTL::LowerDFGToLLVM::compileArithMul):
+ (JSC::FTL::LowerDFGToLLVM::compileArithDiv):
+ (JSC::FTL::LowerDFGToLLVM::compileArithMod):
+ (JSC::FTL::LowerDFGToLLVM::compileArithMinOrMax):
+ (JSC::FTL::LowerDFGToLLVM::compileArithAbs):
+ (JSC::FTL::LowerDFGToLLVM::compileArithNegate):
+ (JSC::FTL::LowerDFGToLLVM::compileArrayifyToStructure):
+ (JSC::FTL::LowerDFGToLLVM::compilePutStructure):
+ (JSC::FTL::LowerDFGToLLVM::compileGetById):
+ (JSC::FTL::LowerDFGToLLVM::compileGetMyArgumentsLength):
+ (JSC::FTL::LowerDFGToLLVM::compileGetMyArgumentByVal):
+ (JSC::FTL::LowerDFGToLLVM::compileGetArrayLength):
+ (JSC::FTL::LowerDFGToLLVM::compileGetByVal):
+ (JSC::FTL::LowerDFGToLLVM::compilePutByVal):
+ (JSC::FTL::LowerDFGToLLVM::compileArrayPush):
+ (JSC::FTL::LowerDFGToLLVM::compileArrayPop):
+ (JSC::FTL::LowerDFGToLLVM::compileNewArray):
+ (JSC::FTL::LowerDFGToLLVM::compileNewArrayBuffer):
+ (JSC::FTL::LowerDFGToLLVM::compileAllocatePropertyStorage):
+ (JSC::FTL::LowerDFGToLLVM::compileReallocatePropertyStorage):
+ (JSC::FTL::LowerDFGToLLVM::compileToString):
+ (JSC::FTL::LowerDFGToLLVM::compileMakeRope):
+ (JSC::FTL::LowerDFGToLLVM::compileMultiGetByOffset):
+ (JSC::FTL::LowerDFGToLLVM::compileMultiPutByOffset):
+ (JSC::FTL::LowerDFGToLLVM::compileCompareEq):
+ (JSC::FTL::LowerDFGToLLVM::compileCompareStrictEq):
+ (JSC::FTL::LowerDFGToLLVM::compileSwitch):
+ (JSC::FTL::LowerDFGToLLVM::compare):
+ (JSC::FTL::LowerDFGToLLVM::boolify):
+ (JSC::FTL::LowerDFGToLLVM::terminate):
+ (JSC::FTL::LowerDFGToLLVM::lowInt32):
+ (JSC::FTL::LowerDFGToLLVM::lowInt52):
+ (JSC::FTL::LowerDFGToLLVM::opposite):
+ (JSC::FTL::LowerDFGToLLVM::lowCell):
+ (JSC::FTL::LowerDFGToLLVM::lowBoolean):
+ (JSC::FTL::LowerDFGToLLVM::lowDouble):
+ (JSC::FTL::LowerDFGToLLVM::lowJSValue):
+ (JSC::FTL::LowerDFGToLLVM::speculate):
+ (JSC::FTL::LowerDFGToLLVM::isArrayType):
+ (JSC::FTL::LowerDFGToLLVM::speculateStringObjectForStructureID):
+ (JSC::FTL::LowerDFGToLLVM::callCheck):
+ (JSC::FTL::LowerDFGToLLVM::buildExitArguments):
+ (JSC::FTL::LowerDFGToLLVM::addExitArgumentForNode):
+ (JSC::FTL::LowerDFGToLLVM::setInt52):
+ (JSC::FTL::LowerDFGToLLVM::crash):
+ (JSC::FTL::LowerDFGToLLVM::compileStructureTransitionWatchpoint): Deleted.
+ * ftl/FTLOutput.cpp:
+ (JSC::FTL::Output::crashNonTerminal): Deleted.
+ * ftl/FTLOutput.h:
+ (JSC::FTL::Output::crash): Deleted.
+ * jit/JITOperations.h:
+ * jsc.cpp:
+ (WTF::jscExit):
+ (functionQuit):
+ (main):
+ (printUsageStatement):
+ (CommandLine::parseArguments):
+ * runtime/Structure.h:
+ (JSC::Structure::dfgShouldWatchIfPossible):
+ (JSC::Structure::dfgShouldWatch):
+ * tests/stress/arrayify-to-structure-contradiction.js: Added.
+ (foo):
+ * tests/stress/ftl-getmyargumentslength-inline.js: Added.
+ (foo):
+ * tests/stress/multi-put-by-offset-multiple-transitions.js: Added.
+ (foo):
+ (Foo):
+ * tests/stress/throw-from-ftl-in-loop.js: Added.
+ * tests/stress/throw-from-ftl.js: Added.
+ (foo):
+
+ 2014-06-03 Filip Pizlo <fpizlo@apple.com>
+
+ [ftlopt] Unreviewed, roll out r169578. The build system needs some more love.
+
+ * InlineRuntimeSymbolTable.h: Removed.
+ * JavaScriptCore.xcodeproj/project.pbxproj:
+ * build-symbol-table-index.py:
+ * build-symbol-table-index.sh:
+ * copy-llvm-ir-to-derived-sources.sh:
+ * dfg/DFGByteCodeParser.cpp:
+ (JSC::DFG::ByteCodeParser::handleCall):
+ * dfg/DFGNode.h:
+ (JSC::DFG::Node::canBeKnownFunction): Deleted.
+ (JSC::DFG::Node::hasKnownFunction): Deleted.
+ (JSC::DFG::Node::knownFunction): Deleted.
+ (JSC::DFG::Node::giveKnownFunction): Deleted.
+ * ftl/FTLAbbreviatedTypes.h:
+ * ftl/FTLCompile.cpp:
+ (JSC::FTL::compile):
+ * ftl/FTLLowerDFGToLLVM.cpp:
+ (JSC::FTL::LowerDFGToLLVM::LowerDFGToLLVM):
+ (JSC::FTL::LowerDFGToLLVM::lower):
+ (JSC::FTL::LowerDFGToLLVM::compileCallOrConstruct):
+ (JSC::FTL::LowerDFGToLLVM::possiblyCompileInlineableNativeCall): Deleted.
+ (JSC::FTL::LowerDFGToLLVM::getFunctionBySymbol): Deleted.
+ (JSC::FTL::LowerDFGToLLVM::getModuleByPathForSymbol): Deleted.
+ (JSC::FTL::LowerDFGToLLVM::isInlinableSize): Deleted.
+ * ftl/FTLState.cpp:
+ (JSC::FTL::State::State):
+ * ftl/FTLState.h:
+ * heap/HandleStack.h:
+ * llvm/InitializeLLVM.h:
+ * llvm/InitializeLLVMMac.cpp: Removed.
+ * llvm/InitializeLLVMMac.mm: Added.
+ (JSC::initializeLLVMImpl):
+ * llvm/LLVMAPIFunctions.h:
+ * llvm/LLVMHeaders.h:
+ * runtime/BundlePath.h: Removed.
+ * runtime/BundlePath.mm: Removed.
+ * runtime/DateConversion.h:
+ * runtime/DateInstance.h:
+ * runtime/ExceptionHelpers.h:
+ * runtime/JSArray.h:
+ * runtime/JSCJSValue.h:
+ (JSC::JSValue::toFloat):
+ * runtime/JSDateMath.h:
+ * runtime/JSObject.h:
+ * runtime/JSWrapperObject.h:
+ * runtime/Options.h:
+ * runtime/RegExp.h:
+ * runtime/StringObject.h:
+ * runtime/Structure.h:
+ * tested-symbols.symlst: Removed.
+
+ 2014-06-03 Filip Pizlo <fpizlo@apple.com>
+
+ [ftlopt] FTL native inlining tests take far too long
+ https://bugs.webkit.org/show_bug.cgi?id=133498
+
+ Unreviewed test gardening.
+
+ Added a new exceptions test since the other one appears to not work.
+
+ * tests/stress/ftl-library-exception.js:
+ * tests/stress/ftl-library-inline-gettimezoneoffset.js: Added.
+ (foo):
+ * tests/stress/ftl-library-inlining-exceptions-dataview.js: Added.
+ (foo):
+ * tests/stress/ftl-library-inlining-exceptions.js: Copied from LayoutTests/js/regress/script-tests/ftl-library-inlining-exceptions.js.
+ * tests/stress/ftl-library-inlining-loops.js: Copied from LayoutTests/js/regress/script-tests/ftl-library-inlining-loops.js.
+ * tests/stress/ftl-library-inlining-random.js:
+ * tests/stress/ftl-library-substring.js:
+
+ 2014-06-03 Matthew Mirman <mmirman@apple.com>
+
+ [ftlopt] Added system for inlining native functions via the FTL.
+ https://bugs.webkit.org/show_bug.cgi?id=131515
+
+ Reviewed by Filip Pizlo.
+
+ Also fixed the build to not compress the bitcode and to
+ include all of the relevant runtime. With GCC_GENERATE_DEBUGGING_SYMBOLS = NO,
+ the produced bitcode files are a 100th the size they were before.
+ Now we can include all of the relevant runtime files with only a 3mb overhead.
+ This is the same overhead as for two compressed files before,
+ but done more efficiently (on both ends) and with less code.
+
+ Deciding whether to inline native functions is left up to LLVM.
+ The entire module containing the function is linked into the current
+ compiled JS so that inlining the native functions shouldn't make them smaller.
+
+ Rather than loading Runtime.symtbl at runtime FTLState.cpp now includes a file
+ InlineRuntimeSymbolTable.h which statically builds the symbol table hash table.
+ Currently build-symbol-table-index.py updates this file from the
+ contents of tested-symbols.symlst when done building as a matter of convenience.
+ However, in order to include the new contents of the file in the build
+ you'd need to build twice. This will be fixed in future versions.
+
+ * JavaScriptCore.xcodeproj/project.pbxproj: Added back runtime files to compile.
+ * build-symbol-table-index.py: Changed bitcode suffix.
+ Added inclusion of only tested symbols.
+ Added output to InlineRuntimeSymbolTable.h.
+ * build-symbol-table-index.sh: Changed bitcode suffix.
+ * copy-llvm-ir-to-derived-sources.sh: Removed gzip compression.
+ * tested-symbols.symlst: Added.
+ * dfg/DFGByteCodeParser.cpp:
+ (JSC::DFG::ByteCodeParser::handleCall):
+ Now sets the knownFunction of the call node if such a function exists
+ and emits a check that during runtime the callee is in fact known.
+ * dfg/DFGNode.h:
+ Added functions to set the known function of a call node.
+ (JSC::DFG::Node::canBeKnownFunction): Added.
+ (JSC::DFG::Node::hasKnownFunction): Added.
+ (JSC::DFG::Node::knownFunction): Added.
+ (JSC::DFG::Node::giveKnownFunction): Added.
+ * ftl/FTLAbbreviatedTypes.h: Added a typedef for LLVMMemoryBufferRef
+ * ftl/FTLLowerDFGToLLVM.cpp:
+ (JSC::FTL::LowerDFGToLLVM::isInlinableSize): Added. Hardcoded threshold to 275.
+ (JSC::FTL::LowerDFGToLLVM::getModuleByPathForSymbol): Added.
+ (JSC::FTL::LowerDFGToLLVM::getFunctionBySymbol): Added.
+ (JSC::FTL::LowerDFGToLLVM::possiblyCompileInlineableNativeCall): Added.
+ (JSC::FTL::LowerDFGToLLVM::compileCallOrConstruct):
+ Added call to possiblyCompileInlineableNativeCall
+ * ftl/FTLOutput.h:
+ (JSC::FTL::Output::allocaName): Added. Useful for debugging.
+ * ftl/FTLState.cpp:
+ (JSC::FTL::State::State): Added an include for InlineRuntimeSymbolTable.h
+ * ftl/FTLState.h: Added symbol table hash table.
+ * ftl/FTLCompile.cpp:
+ (JSC::FTL::compile): Added inlining and dead function elimination passes.
+ * heap/HandleStack.h: Added JS_EXPORT_PRIVATE to a few functions to get inlining to compile.
+ * InlineRuntimeSymbolTable.h: Added.
+ * llvm/InitializeLLVMMac.mm: Deleted.
+ * llvm/InitializeLLVMMac.cpp: Added.
+ * llvm/LLVMAPIFunctions.h: Added macros to include Bitcode parsing and linking functions.
+ * llvm/LLVMHeaders.h: Added includes for Bitcode parsing and linking.
+ * runtime/BundlePath.h: Added.
+ * runtime/BundlePath.mm: Added.
+ * runtime/DateInstance.h: Added JS_EXPORT_PRIVATE to a few functions to get inlining to compile.
+ * runtime/DateInstance.h: ditto.
+ * runtime/DateConversion.h: ditto.
+ * runtime/ExceptionHelpers.h: ditto.
+ * runtime/JSCJSValue.h: ditto.
+ * runtime/JSArray.h: ditto.
+ * runtime/JSDateMath.h: ditto.
+ * runtime/JSObject.h: ditto.
+ * runtime/JSObject.h: ditto.
+ * runtime/RegExp.h: ditto.
+ * runtime/Structure.h: ditto.
+ * runtime/Options.h: Added maximumLLVMInstructionCountForNativeInlining.
+ * tests/stress/ftl-library-inlining-random.js: Added.
+ * tests/stress/ftl-library-substring.js: Added.
+
+ 2014-05-21 Filip Pizlo <fpizlo@apple.com>
+
+ [ftlopt] DFG::clobberize should be blind to the effects of GC
+ https://bugs.webkit.org/show_bug.cgi?id=133166
+
+ Reviewed by Goeffrey Garen.
+
+ Move the computation of where GCs happen to DFG::doesGC().
+
+ Large (>5x) speed-up on programs that do loop-invariant string concatenations.
+
+ * CMakeLists.txt:
+ * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+ * JavaScriptCore.xcodeproj/project.pbxproj:
+ * dfg/DFGAbstractHeap.h:
+ * dfg/DFGClobberize.h:
+ (JSC::DFG::clobberize):
+ (JSC::DFG::clobberizeForAllocation): Deleted.
+ * dfg/DFGDoesGC.cpp: Added.
+ (JSC::DFG::doesGC):
+ * dfg/DFGDoesGC.h: Added.
+ * dfg/DFGStoreBarrierElisionPhase.cpp:
+ (JSC::DFG::StoreBarrierElisionPhase::handleNode):
+ (JSC::DFG::StoreBarrierElisionPhase::couldCauseGC): Deleted.
+
+ 2014-05-16 Filip Pizlo <fpizlo@apple.com>
+
+ [ftlopt] A StructureSet with one element should only require one word and no allocation
+ https://bugs.webkit.org/show_bug.cgi?id=133014
+
+ Reviewed by Oliver Hunt.
+
+ This makes it more efficient to use StructureSet in situations where the common case is
+ just one structure.
+
+ I also took the opportunity to use the same set terminology we use in BitVector: merge,
+ filter, exclude, contains, etc.
+
+ Eventually, this will be used to implement StructureAbstractValue as well.
+
+ * CMakeLists.txt:
+ * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+ * JavaScriptCore.xcodeproj/project.pbxproj:
+ * bytecode/StructureSet.cpp: Added.
+ (JSC::StructureSet::StructureSet):
+ (JSC::StructureSet::operator=):
+ (JSC::StructureSet::clear):
+ (JSC::StructureSet::add):
+ (JSC::StructureSet::remove):
+ (JSC::StructureSet::contains):
+ (JSC::StructureSet::merge):
+ (JSC::StructureSet::filter):
+ (JSC::StructureSet::exclude):
+ (JSC::StructureSet::isSubsetOf):
+ (JSC::StructureSet::overlaps):
+ (JSC::StructureSet::operator==):
+ (JSC::StructureSet::speculationFromStructures):
+ (JSC::StructureSet::arrayModesFromStructures):
+ (JSC::StructureSet::dumpInContext):
+ (JSC::StructureSet::dump):
+ (JSC::StructureSet::addOutOfLine):
+ (JSC::StructureSet::containsOutOfLine):
+ (JSC::StructureSet::copyFrom):
+ (JSC::StructureSet::OutOfLineList::create):
+ (JSC::StructureSet::OutOfLineList::destroy):
+ * bytecode/StructureSet.h:
+ (JSC::StructureSet::StructureSet):
+ (JSC::StructureSet::~StructureSet):
+ (JSC::StructureSet::onlyStructure):
+ (JSC::StructureSet::isEmpty):
+ (JSC::StructureSet::size):
+ (JSC::StructureSet::at):
+ (JSC::StructureSet::operator[]):
+ (JSC::StructureSet::last):
+ (JSC::StructureSet::OutOfLineList::list):
+ (JSC::StructureSet::OutOfLineList::OutOfLineList):
+ (JSC::StructureSet::deleteStructureListIfNecessary):
+ (JSC::StructureSet::isThin):
+ (JSC::StructureSet::pointer):
+ (JSC::StructureSet::singleStructure):
+ (JSC::StructureSet::structureList):
+ (JSC::StructureSet::set):
+ (JSC::StructureSet::clear): Deleted.
+ (JSC::StructureSet::add): Deleted.
+ (JSC::StructureSet::addAll): Deleted.
+ (JSC::StructureSet::remove): Deleted.
+ (JSC::StructureSet::contains): Deleted.
+ (JSC::StructureSet::containsOnly): Deleted.
+ (JSC::StructureSet::isSubsetOf): Deleted.
+ (JSC::StructureSet::overlaps): Deleted.
+ (JSC::StructureSet::singletonStructure): Deleted.
+ (JSC::StructureSet::speculationFromStructures): Deleted.
+ (JSC::StructureSet::arrayModesFromStructures): Deleted.
+ (JSC::StructureSet::operator==): Deleted.
+ (JSC::StructureSet::dumpInContext): Deleted.
+ (JSC::StructureSet::dump): Deleted.
+ * dfg/DFGAbstractInterpreterInlines.h:
+ (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+ * dfg/DFGByteCodeParser.cpp:
+ (JSC::DFG::ByteCodeParser::emitPrototypeChecks):
+ (JSC::DFG::ByteCodeParser::handleGetById):
+ (JSC::DFG::ByteCodeParser::parseBlock):
+ * dfg/DFGCSEPhase.cpp:
+ (JSC::DFG::CSEPhase::structureTransitionWatchpointElimination):
+ * dfg/DFGNode.h:
+ (JSC::DFG::Node::convertToStructureTransitionWatchpoint):
+ * dfg/DFGTypeCheckHoistingPhase.cpp:
+ (JSC::DFG::TypeCheckHoistingPhase::noticeStructureCheck):
+
</ins><span class="cx"> 2014-07-22 Ryuan Choi <ryuan.choi@samsung.com>
</span><span class="cx">
</span><span class="cx"> Unreviewed build fix attempt on the EFL port after r171362.
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreJavaScriptCorevcxprojJavaScriptCorevcxproj"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/JavaScriptCore.vcxproj/JavaScriptCore.vcxproj (171379 => 171380)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/JavaScriptCore.vcxproj/JavaScriptCore.vcxproj 2014-07-23 01:12:32 UTC (rev 171379)
+++ trunk/Source/JavaScriptCore/JavaScriptCore.vcxproj/JavaScriptCore.vcxproj 2014-07-23 01:19:50 UTC (rev 171380)
</span><span class="lines">@@ -343,6 +343,7 @@
</span><span class="cx"> <ClCompile Include="..\bytecode\SamplingTool.cpp" />
</span><span class="cx"> <ClCompile Include="..\bytecode\SpecialPointer.cpp" />
</span><span class="cx"> <ClCompile Include="..\bytecode\SpeculatedType.cpp" />
</span><ins>+ <ClCompile Include="..\bytecode\StructureSet.cpp" />
</ins><span class="cx"> <ClCompile Include="..\bytecode\StructureStubClearingWatchpoint.cpp" />
</span><span class="cx"> <ClCompile Include="..\bytecode\StructureStubInfo.cpp" />
</span><span class="cx"> <ClCompile Include="..\bytecode\UnlinkedCodeBlock.cpp" />
</span><span class="lines">@@ -387,6 +388,7 @@
</span><span class="cx"> <ClCompile Include="..\dfg\DFGDesiredWeakReferences.cpp" />
</span><span class="cx"> <ClCompile Include="..\dfg\DFGDesiredWriteBarriers.cpp" />
</span><span class="cx"> <ClCompile Include="..\dfg\DFGDisassembler.cpp" />
</span><ins>+ <ClCompile Include="..\dfg\DFGDoesGC.cpp" />
</ins><span class="cx"> <ClCompile Include="..\dfg\DFGDominators.cpp" />
</span><span class="cx"> <ClCompile Include="..\dfg\DFGDriver.cpp" />
</span><span class="cx"> <ClCompile Include="..\dfg\DFGEdge.cpp" />
</span><span class="lines">@@ -441,11 +443,13 @@
</span><span class="cx"> <ClCompile Include="..\dfg\DFGStaticExecutionCountEstimationPhase.cpp" />
</span><span class="cx"> <ClCompile Include="..\dfg\DFGStoreBarrierElisionPhase.cpp" />
</span><span class="cx"> <ClCompile Include="..\dfg\DFGStrengthReductionPhase.cpp" />
</span><ins>+ <ClCompile Include="..\dfg\DFGStructureAbstractValue.cpp" />
</ins><span class="cx"> <ClCompile Include="..\dfg\DFGThreadData.cpp" />
</span><span class="cx"> <ClCompile Include="..\dfg\DFGThunks.cpp" />
</span><span class="cx"> <ClCompile Include="..\dfg\DFGTierUpCheckInjectionPhase.cpp" />
</span><span class="cx"> <ClCompile Include="..\dfg\DFGToFTLDeferredCompilationCallback.cpp" />
</span><span class="cx"> <ClCompile Include="..\dfg\DFGToFTLForOSREntryDeferredCompilationCallback.cpp" />
</span><ins>+ <ClCompile Include="..\dfg\DFGTransition.cpp" />
</ins><span class="cx"> <ClCompile Include="..\dfg\DFGTypeCheckHoistingPhase.cpp" />
</span><span class="cx"> <ClCompile Include="..\dfg\DFGUnificationPhase.cpp" />
</span><span class="cx"> <ClCompile Include="..\dfg\DFGUseKind.cpp" />
</span><span class="lines">@@ -457,6 +461,7 @@
</span><span class="cx"> <ClCompile Include="..\dfg\DFGVariableEventStream.cpp" />
</span><span class="cx"> <ClCompile Include="..\dfg\DFGVirtualRegisterAllocationPhase.cpp" />
</span><span class="cx"> <ClCompile Include="..\dfg\DFGWatchpointCollectionPhase.cpp" />
</span><ins>+ <ClCompile Include="..\dfg\DFGWatchableStructureWatchingPhase.cpp" />
</ins><span class="cx"> <ClCompile Include="..\dfg\DFGWorklist.cpp" />
</span><span class="cx"> <ClCompile Include="..\disassembler\Disassembler.cpp" />
</span><span class="cx"> <ClCompile Include="..\disassembler\LLVMDisassembler.cpp" />
</span><span class="lines">@@ -989,6 +994,7 @@
</span><span class="cx"> <ClInclude Include="..\dfg\DFGDesiredWeakReferences.h" />
</span><span class="cx"> <ClInclude Include="..\dfg\DFGDesiredWriteBarriers.h" />
</span><span class="cx"> <ClInclude Include="..\dfg\DFGDisassembler.h" />
</span><ins>+ <ClInclude Include="..\dfg\DFGDoesGC.h" />
</ins><span class="cx"> <ClInclude Include="..\dfg\DFGDominators.h" />
</span><span class="cx"> <ClInclude Include="..\dfg\DFGDoubleFormatState.h" />
</span><span class="cx"> <ClInclude Include="..\dfg\DFGDriver.h" />
</span><span class="lines">@@ -1064,11 +1070,13 @@
</span><span class="cx"> <ClInclude Include="..\dfg\DFGStoreBarrierElisionPhase.h" />
</span><span class="cx"> <ClInclude Include="..\dfg\DFGStrengthReductionPhase.h" />
</span><span class="cx"> <ClInclude Include="..\dfg\DFGStructureAbstractValue.h" />
</span><ins>+ <ClInclude Include="..\dfg\DFGStructureClobberState.h" />
</ins><span class="cx"> <ClInclude Include="..\dfg\DFGThreadData.h" />
</span><span class="cx"> <ClInclude Include="..\dfg\DFGThunks.h" />
</span><span class="cx"> <ClInclude Include="..\dfg\DFGTierUpCheckInjectionPhase.h" />
</span><span class="cx"> <ClInclude Include="..\dfg\DFGToFTLDeferredCompilationCallback.h" />
</span><span class="cx"> <ClInclude Include="..\dfg\DFGToFTLForOSREntryDeferredCompilationCallback.h" />
</span><ins>+ <ClInclude Include="..\dfg\DFGTransition.h" />
</ins><span class="cx"> <ClInclude Include="..\dfg\DFGTypeCheckHoistingPhase.h" />
</span><span class="cx"> <ClInclude Include="..\dfg\DFGUnificationPhase.h" />
</span><span class="cx"> <ClInclude Include="..\dfg\DFGUseKind.h" />
</span><span class="lines">@@ -1081,6 +1089,7 @@
</span><span class="cx"> <ClInclude Include="..\dfg\DFGVariableEventStream.h" />
</span><span class="cx"> <ClInclude Include="..\dfg\DFGVariadicFunction.h" />
</span><span class="cx"> <ClInclude Include="..\dfg\DFGVirtualRegisterAllocationPhase.h" />
</span><ins>+ <ClInclude Include="..\dfg\DFGWatchableStructureWatchingPhase.h" />
</ins><span class="cx"> <ClInclude Include="..\dfg\DFGWatchpointCollectionPhase.h" />
</span><span class="cx"> <ClInclude Include="..\dfg\DFGWorklist.h" />
</span><span class="cx"> <ClInclude Include="..\disassembler\Disassembler.h" />
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreJavaScriptCorexcodeprojprojectpbxproj"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj (171379 => 171380)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj 2014-07-23 01:12:32 UTC (rev 171379)
+++ trunk/Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj 2014-07-23 01:19:50 UTC (rev 171380)
</span><span class="lines">@@ -282,6 +282,7 @@
</span><span class="cx"> 0F4CED5F18CEA7AB00802FE0 /* PolymorphicGetByIdList.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F4CED5D18CEA7AB00802FE0 /* PolymorphicGetByIdList.h */; settings = {ATTRIBUTES = (Private, ); }; };
</span><span class="cx"> 0F4F29DF18B6AD1C0057BC15 /* DFGStaticExecutionCountEstimationPhase.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F4F29DD18B6AD1C0057BC15 /* DFGStaticExecutionCountEstimationPhase.cpp */; };
</span><span class="cx"> 0F4F29E018B6AD1C0057BC15 /* DFGStaticExecutionCountEstimationPhase.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F4F29DE18B6AD1C0057BC15 /* DFGStaticExecutionCountEstimationPhase.h */; settings = {ATTRIBUTES = (Private, ); }; };
</span><ins>+ 0F50AF3C193E8B3900674EE8 /* DFGStructureClobberState.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F50AF3B193E8B3900674EE8 /* DFGStructureClobberState.h */; settings = {ATTRIBUTES = (Private, ); }; };
</ins><span class="cx"> 0F5541B11613C1FB00CE3E25 /* SpecialPointer.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F5541AF1613C1FB00CE3E25 /* SpecialPointer.cpp */; };
</span><span class="cx"> 0F5541B21613C1FB00CE3E25 /* SpecialPointer.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F5541B01613C1FB00CE3E25 /* SpecialPointer.h */; settings = {ATTRIBUTES = (Private, ); }; };
</span><span class="cx"> 0F55989817C86C5800A1E543 /* ToNativeFromValue.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F55989717C86C5600A1E543 /* ToNativeFromValue.h */; settings = {ATTRIBUTES = (Private, ); }; };
</span><span class="lines">@@ -292,6 +293,8 @@
</span><span class="cx"> 0F56A1D515001CF4002992B1 /* ExecutionCounter.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F56A1D415001CF2002992B1 /* ExecutionCounter.cpp */; };
</span><span class="cx"> 0F572D4F16879FDD00E57FBD /* ThunkGenerator.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F572D4D16879FDB00E57FBD /* ThunkGenerator.h */; settings = {ATTRIBUTES = (Private, ); }; };
</span><span class="cx"> 0F5780A218FE1E98001E72D9 /* PureNaN.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F5780A118FE1E98001E72D9 /* PureNaN.h */; settings = {ATTRIBUTES = (Private, ); }; };
</span><ins>+ 0F5A1273192D9FDF008764A3 /* DFGDoesGC.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F5A1271192D9FDF008764A3 /* DFGDoesGC.cpp */; };
+ 0F5A1274192D9FDF008764A3 /* DFGDoesGC.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F5A1272192D9FDF008764A3 /* DFGDoesGC.h */; settings = {ATTRIBUTES = (Private, ); }; };
</ins><span class="cx"> 0F5A52D017ADD717008ECB2D /* CopyToken.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F5A52CF17ADD717008ECB2D /* CopyToken.h */; settings = {ATTRIBUTES = (Private, ); }; };
</span><span class="cx"> 0F5A6283188C98D40072C9DF /* FTLValueRange.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F5A6281188C98D40072C9DF /* FTLValueRange.cpp */; };
</span><span class="cx"> 0F5A6284188C98D40072C9DF /* FTLValueRange.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F5A6282188C98D40072C9DF /* FTLValueRange.h */; settings = {ATTRIBUTES = (Private, ); }; };
</span><span class="lines">@@ -354,6 +357,7 @@
</span><span class="cx"> 0F8335B81639C1EA001443B5 /* ArrayAllocationProfile.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F8335B51639C1E3001443B5 /* ArrayAllocationProfile.h */; settings = {ATTRIBUTES = (Private, ); }; };
</span><span class="cx"> 0F8364B7164B0C110053329A /* DFGBranchDirection.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F8364B5164B0C0E0053329A /* DFGBranchDirection.h */; settings = {ATTRIBUTES = (Private, ); }; };
</span><span class="cx"> 0F885E111849A3BE00F1E3FA /* BytecodeUseDef.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F885E101849A3BE00F1E3FA /* BytecodeUseDef.h */; settings = {ATTRIBUTES = (Private, ); }; };
</span><ins>+ 0F893BDB1936E23C001211F4 /* DFGStructureAbstractValue.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F893BDA1936E23C001211F4 /* DFGStructureAbstractValue.cpp */; };
</ins><span class="cx"> 0F8F2B95172E04A0007DBDA5 /* FTLLink.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F8F2B93172E049E007DBDA5 /* FTLLink.cpp */; };
</span><span class="cx"> 0F8F2B96172E04A3007DBDA5 /* FTLLink.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F8F2B94172E049E007DBDA5 /* FTLLink.h */; settings = {ATTRIBUTES = (Private, ); }; };
</span><span class="cx"> 0F8F2B99172F04FF007DBDA5 /* DFGDesiredIdentifiers.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F8F2B97172F04FD007DBDA5 /* DFGDesiredIdentifiers.cpp */; };
</span><span class="lines">@@ -419,6 +423,7 @@
</span><span class="cx"> 0FB14E1F18124ACE009B6B4D /* JITInlineCacheGenerator.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FB14E1D18124ACE009B6B4D /* JITInlineCacheGenerator.h */; settings = {ATTRIBUTES = (Private, ); }; };
</span><span class="cx"> 0FB14E211812570B009B6B4D /* DFGInlineCacheWrapper.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FB14E201812570B009B6B4D /* DFGInlineCacheWrapper.h */; settings = {ATTRIBUTES = (Private, ); }; };
</span><span class="cx"> 0FB14E2318130955009B6B4D /* DFGInlineCacheWrapperInlines.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FB14E2218130955009B6B4D /* DFGInlineCacheWrapperInlines.h */; settings = {ATTRIBUTES = (Private, ); }; };
</span><ins>+ 0FB438A319270B1D00E1FBC9 /* StructureSet.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0FB438A219270B1D00E1FBC9 /* StructureSet.cpp */; };
</ins><span class="cx"> 0FB5467714F59B5C002C2989 /* LazyOperandValueProfile.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FB5467614F59AD1002C2989 /* LazyOperandValueProfile.h */; settings = {ATTRIBUTES = (Private, ); }; };
</span><span class="cx"> 0FB5467914F5C46B002C2989 /* LazyOperandValueProfile.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0FB5467814F5C468002C2989 /* LazyOperandValueProfile.cpp */; };
</span><span class="cx"> 0FB5467B14F5C7E1002C2989 /* MethodOfGettingAValueProfile.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FB5467A14F5C7D4002C2989 /* MethodOfGettingAValueProfile.h */; settings = {ATTRIBUTES = (Private, ); }; };
</span><span class="lines">@@ -495,6 +500,8 @@
</span><span class="cx"> 0FCEFADF180738C000472CE4 /* FTLLocation.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0FCEFADD180738C000472CE4 /* FTLLocation.cpp */; };
</span><span class="cx"> 0FCEFAE0180738C000472CE4 /* FTLLocation.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FCEFADE180738C000472CE4 /* FTLLocation.h */; settings = {ATTRIBUTES = (Private, ); }; };
</span><span class="cx"> 0FD2C92416D01EE900C7803F /* StructureInlines.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FD2C92316D01EE900C7803F /* StructureInlines.h */; settings = {ATTRIBUTES = (Private, ); }; };
</span><ins>+ 0FD2D4FE192FEE5800A178BF /* DFGWatchableStructureWatchingPhase.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0FD2D4FC192FEE5800A178BF /* DFGWatchableStructureWatchingPhase.cpp */; };
+ 0FD2D4FF192FEE5800A178BF /* DFGWatchableStructureWatchingPhase.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FD2D4FD192FEE5800A178BF /* DFGWatchableStructureWatchingPhase.h */; settings = {ATTRIBUTES = (Private, ); }; };
</ins><span class="cx"> 0FD3C82614115D4000FD81CB /* DFGDriver.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0FD3C82014115CF800FD81CB /* DFGDriver.cpp */; };
</span><span class="cx"> 0FD3C82814115D4F00FD81CB /* DFGDriver.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FD3C82214115D0E00FD81CB /* DFGDriver.h */; };
</span><span class="cx"> 0FD81AD2154FB4EE00983E72 /* DFGDominators.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0FD81ACF154FB4EB00983E72 /* DFGDominators.cpp */; };
</span><span class="lines">@@ -528,6 +535,8 @@
</span><span class="cx"> 0FDDBFB61666EEDA00C55FEF /* DFGVariableAccessDataDump.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FDDBFB31666EED500C55FEF /* DFGVariableAccessDataDump.h */; settings = {ATTRIBUTES = (Private, ); }; };
</span><span class="cx"> 0FE228ED1436AB2700196C48 /* Options.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FE228EB1436AB2300196C48 /* Options.h */; settings = {ATTRIBUTES = (Private, ); }; };
</span><span class="cx"> 0FE228EE1436AB2C00196C48 /* Options.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0FE228EA1436AB2300196C48 /* Options.cpp */; };
</span><ins>+ 0FE7211D193B9C590031F6ED /* DFGTransition.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0FE7211B193B9C590031F6ED /* DFGTransition.cpp */; };
+ 0FE7211E193B9C590031F6ED /* DFGTransition.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FE7211C193B9C590031F6ED /* DFGTransition.h */; settings = {ATTRIBUTES = (Private, ); }; };
</ins><span class="cx"> 0FE8534B1723CDA500B618F5 /* DFGDesiredWatchpoints.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0FE853491723CDA500B618F5 /* DFGDesiredWatchpoints.cpp */; };
</span><span class="cx"> 0FE8534C1723CDA500B618F5 /* DFGDesiredWatchpoints.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FE8534A1723CDA500B618F5 /* DFGDesiredWatchpoints.h */; settings = {ATTRIBUTES = (Private, ); }; };
</span><span class="cx"> 0FE95F7918B5694700B531FB /* FTLDataSection.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0FE95F7718B5694700B531FB /* FTLDataSection.cpp */; };
</span><span class="lines">@@ -2094,6 +2103,7 @@
</span><span class="cx"> 0F4CED5D18CEA7AB00802FE0 /* PolymorphicGetByIdList.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = PolymorphicGetByIdList.h; sourceTree = "<group>"; };
</span><span class="cx"> 0F4F29DD18B6AD1C0057BC15 /* DFGStaticExecutionCountEstimationPhase.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGStaticExecutionCountEstimationPhase.cpp; path = dfg/DFGStaticExecutionCountEstimationPhase.cpp; sourceTree = "<group>"; };
</span><span class="cx"> 0F4F29DE18B6AD1C0057BC15 /* DFGStaticExecutionCountEstimationPhase.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGStaticExecutionCountEstimationPhase.h; path = dfg/DFGStaticExecutionCountEstimationPhase.h; sourceTree = "<group>"; };
</span><ins>+ 0F50AF3B193E8B3900674EE8 /* DFGStructureClobberState.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGStructureClobberState.h; path = dfg/DFGStructureClobberState.h; sourceTree = "<group>"; };
</ins><span class="cx"> 0F5541AF1613C1FB00CE3E25 /* SpecialPointer.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = SpecialPointer.cpp; sourceTree = "<group>"; };
</span><span class="cx"> 0F5541B01613C1FB00CE3E25 /* SpecialPointer.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = SpecialPointer.h; sourceTree = "<group>"; };
</span><span class="cx"> 0F55989717C86C5600A1E543 /* ToNativeFromValue.h */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.c.h; path = ToNativeFromValue.h; sourceTree = "<group>"; };
</span><span class="lines">@@ -2104,6 +2114,8 @@
</span><span class="cx"> 0F56A1D415001CF2002992B1 /* ExecutionCounter.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ExecutionCounter.cpp; sourceTree = "<group>"; };
</span><span class="cx"> 0F572D4D16879FDB00E57FBD /* ThunkGenerator.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ThunkGenerator.h; sourceTree = "<group>"; };
</span><span class="cx"> 0F5780A118FE1E98001E72D9 /* PureNaN.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = PureNaN.h; sourceTree = "<group>"; };
</span><ins>+ 0F5A1271192D9FDF008764A3 /* DFGDoesGC.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGDoesGC.cpp; path = dfg/DFGDoesGC.cpp; sourceTree = "<group>"; };
+ 0F5A1272192D9FDF008764A3 /* DFGDoesGC.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGDoesGC.h; path = dfg/DFGDoesGC.h; sourceTree = "<group>"; };
</ins><span class="cx"> 0F5A52CF17ADD717008ECB2D /* CopyToken.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = CopyToken.h; sourceTree = "<group>"; };
</span><span class="cx"> 0F5A6281188C98D40072C9DF /* FTLValueRange.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = FTLValueRange.cpp; path = ftl/FTLValueRange.cpp; sourceTree = "<group>"; };
</span><span class="cx"> 0F5A6282188C98D40072C9DF /* FTLValueRange.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = FTLValueRange.h; path = ftl/FTLValueRange.h; sourceTree = "<group>"; };
</span><span class="lines">@@ -2164,6 +2176,7 @@
</span><span class="cx"> 0F8335B51639C1E3001443B5 /* ArrayAllocationProfile.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ArrayAllocationProfile.h; sourceTree = "<group>"; };
</span><span class="cx"> 0F8364B5164B0C0E0053329A /* DFGBranchDirection.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGBranchDirection.h; path = dfg/DFGBranchDirection.h; sourceTree = "<group>"; };
</span><span class="cx"> 0F885E101849A3BE00F1E3FA /* BytecodeUseDef.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = BytecodeUseDef.h; sourceTree = "<group>"; };
</span><ins>+ 0F893BDA1936E23C001211F4 /* DFGStructureAbstractValue.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGStructureAbstractValue.cpp; path = dfg/DFGStructureAbstractValue.cpp; sourceTree = "<group>"; };
</ins><span class="cx"> 0F8F2B93172E049E007DBDA5 /* FTLLink.cpp */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.cpp.cpp; name = FTLLink.cpp; path = ftl/FTLLink.cpp; sourceTree = "<group>"; };
</span><span class="cx"> 0F8F2B94172E049E007DBDA5 /* FTLLink.h */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.c.h; name = FTLLink.h; path = ftl/FTLLink.h; sourceTree = "<group>"; };
</span><span class="cx"> 0F8F2B97172F04FD007DBDA5 /* DFGDesiredIdentifiers.cpp */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.cpp.cpp; name = DFGDesiredIdentifiers.cpp; path = dfg/DFGDesiredIdentifiers.cpp; sourceTree = "<group>"; };
</span><span class="lines">@@ -2229,6 +2242,7 @@
</span><span class="cx"> 0FB14E1D18124ACE009B6B4D /* JITInlineCacheGenerator.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JITInlineCacheGenerator.h; sourceTree = "<group>"; };
</span><span class="cx"> 0FB14E201812570B009B6B4D /* DFGInlineCacheWrapper.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGInlineCacheWrapper.h; path = dfg/DFGInlineCacheWrapper.h; sourceTree = "<group>"; };
</span><span class="cx"> 0FB14E2218130955009B6B4D /* DFGInlineCacheWrapperInlines.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGInlineCacheWrapperInlines.h; path = dfg/DFGInlineCacheWrapperInlines.h; sourceTree = "<group>"; };
</span><ins>+ 0FB438A219270B1D00E1FBC9 /* StructureSet.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = StructureSet.cpp; sourceTree = "<group>"; };
</ins><span class="cx"> 0FB4B51016B3A964003F696B /* DFGMinifiedID.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGMinifiedID.h; path = dfg/DFGMinifiedID.h; sourceTree = "<group>"; };
</span><span class="cx"> 0FB4B51916B62772003F696B /* DFGAllocator.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGAllocator.h; path = dfg/DFGAllocator.h; sourceTree = "<group>"; };
</span><span class="cx"> 0FB4B51A16B62772003F696B /* DFGCommon.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGCommon.cpp; path = dfg/DFGCommon.cpp; sourceTree = "<group>"; };
</span><span class="lines">@@ -2316,6 +2330,8 @@
</span><span class="cx"> 0FCEFADD180738C000472CE4 /* FTLLocation.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = FTLLocation.cpp; path = ftl/FTLLocation.cpp; sourceTree = "<group>"; };
</span><span class="cx"> 0FCEFADE180738C000472CE4 /* FTLLocation.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = FTLLocation.h; path = ftl/FTLLocation.h; sourceTree = "<group>"; };
</span><span class="cx"> 0FD2C92316D01EE900C7803F /* StructureInlines.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = StructureInlines.h; sourceTree = "<group>"; };
</span><ins>+ 0FD2D4FC192FEE5800A178BF /* DFGWatchableStructureWatchingPhase.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGWatchableStructureWatchingPhase.cpp; path = dfg/DFGWatchableStructureWatchingPhase.cpp; sourceTree = "<group>"; };
+ 0FD2D4FD192FEE5800A178BF /* DFGWatchableStructureWatchingPhase.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGWatchableStructureWatchingPhase.h; path = dfg/DFGWatchableStructureWatchingPhase.h; sourceTree = "<group>"; };
</ins><span class="cx"> 0FD3C82014115CF800FD81CB /* DFGDriver.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGDriver.cpp; path = dfg/DFGDriver.cpp; sourceTree = "<group>"; };
</span><span class="cx"> 0FD3C82214115D0E00FD81CB /* DFGDriver.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGDriver.h; path = dfg/DFGDriver.h; sourceTree = "<group>"; };
</span><span class="cx"> 0FD5652216AB780A00197653 /* DFGBasicBlockInlines.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGBasicBlockInlines.h; path = dfg/DFGBasicBlockInlines.h; sourceTree = "<group>"; };
</span><span class="lines">@@ -2351,6 +2367,8 @@
</span><span class="cx"> 0FDDBFB31666EED500C55FEF /* DFGVariableAccessDataDump.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGVariableAccessDataDump.h; path = dfg/DFGVariableAccessDataDump.h; sourceTree = "<group>"; };
</span><span class="cx"> 0FE228EA1436AB2300196C48 /* Options.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = Options.cpp; sourceTree = "<group>"; };
</span><span class="cx"> 0FE228EB1436AB2300196C48 /* Options.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = Options.h; sourceTree = "<group>"; };
</span><ins>+ 0FE7211B193B9C590031F6ED /* DFGTransition.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGTransition.cpp; path = dfg/DFGTransition.cpp; sourceTree = "<group>"; };
+ 0FE7211C193B9C590031F6ED /* DFGTransition.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGTransition.h; path = dfg/DFGTransition.h; sourceTree = "<group>"; };
</ins><span class="cx"> 0FE853491723CDA500B618F5 /* DFGDesiredWatchpoints.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGDesiredWatchpoints.cpp; path = dfg/DFGDesiredWatchpoints.cpp; sourceTree = "<group>"; };
</span><span class="cx"> 0FE8534A1723CDA500B618F5 /* DFGDesiredWatchpoints.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGDesiredWatchpoints.h; path = dfg/DFGDesiredWatchpoints.h; sourceTree = "<group>"; };
</span><span class="cx"> 0FE95F7718B5694700B531FB /* FTLDataSection.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = FTLDataSection.cpp; path = ftl/FTLDataSection.cpp; sourceTree = "<group>"; };
</span><span class="lines">@@ -4689,6 +4707,8 @@
</span><span class="cx"> C2981FDB17BAFF4400A3BC98 /* DFGDesiredWriteBarriers.h */,
</span><span class="cx"> 0FF427611591A1C9004CB9FF /* DFGDisassembler.cpp */,
</span><span class="cx"> 0FF427621591A1C9004CB9FF /* DFGDisassembler.h */,
</span><ins>+ 0F5A1271192D9FDF008764A3 /* DFGDoesGC.cpp */,
+ 0F5A1272192D9FDF008764A3 /* DFGDoesGC.h */,
</ins><span class="cx"> 0FD81ACF154FB4EB00983E72 /* DFGDominators.cpp */,
</span><span class="cx"> 0FD81AD0154FB4EB00983E72 /* DFGDominators.h */,
</span><span class="cx"> 0F1E3A441534CBAD000F9456 /* DFGDoubleFormatState.h */,
</span><span class="lines">@@ -4709,6 +4729,8 @@
</span><span class="cx"> 0F9D339517FFC4E60073C2BC /* DFGFlushedAt.h */,
</span><span class="cx"> A7D89CE817A0B8CC00773AD8 /* DFGFlushFormat.cpp */,
</span><span class="cx"> A7D89CE917A0B8CC00773AD8 /* DFGFlushFormat.h */,
</span><ins>+ 2A88067619107D5500CB0BBB /* DFGFunctionWhitelist.cpp */,
+ 2A88067719107D5500CB0BBB /* DFGFunctionWhitelist.h */,
</ins><span class="cx"> 86EC9DB61328DF82002B2AD7 /* DFGGenerationInfo.h */,
</span><span class="cx"> 86EC9DB71328DF82002B2AD7 /* DFGGraph.cpp */,
</span><span class="cx"> 86EC9DB81328DF82002B2AD7 /* DFGGraph.h */,
</span><span class="lines">@@ -4813,7 +4835,9 @@
</span><span class="cx"> 2ACCF3DD185FE26B0083E2AD /* DFGStoreBarrierElisionPhase.h */,
</span><span class="cx"> 0FC20CB31852E2C600C9E954 /* DFGStrengthReductionPhase.cpp */,
</span><span class="cx"> 0FC20CB41852E2C600C9E954 /* DFGStrengthReductionPhase.h */,
</span><ins>+ 0F893BDA1936E23C001211F4 /* DFGStructureAbstractValue.cpp */,
</ins><span class="cx"> 0F63947615DCE347006A597C /* DFGStructureAbstractValue.h */,
</span><ins>+ 0F50AF3B193E8B3900674EE8 /* DFGStructureClobberState.h */,
</ins><span class="cx"> 0F2FCCF718A60070001A27F8 /* DFGThreadData.cpp */,
</span><span class="cx"> 0F2FCCF818A60070001A27F8 /* DFGThreadData.h */,
</span><span class="cx"> 0FC0979F146B28C700CF2442 /* DFGThunks.cpp */,
</span><span class="lines">@@ -4824,6 +4848,8 @@
</span><span class="cx"> 0FD8A32217D51F5700CA2C40 /* DFGToFTLDeferredCompilationCallback.h */,
</span><span class="cx"> 0FD8A32317D51F5700CA2C40 /* DFGToFTLForOSREntryDeferredCompilationCallback.cpp */,
</span><span class="cx"> 0FD8A32417D51F5700CA2C40 /* DFGToFTLForOSREntryDeferredCompilationCallback.h */,
</span><ins>+ 0FE7211B193B9C590031F6ED /* DFGTransition.cpp */,
+ 0FE7211C193B9C590031F6ED /* DFGTransition.h */,
</ins><span class="cx"> 0F63943C15C75F14006A597C /* DFGTypeCheckHoistingPhase.cpp */,
</span><span class="cx"> 0F63943D15C75F14006A597C /* DFGTypeCheckHoistingPhase.h */,
</span><span class="cx"> 0FBE0F6F16C1DB010082C5E8 /* DFGUnificationPhase.cpp */,
</span><span class="lines">@@ -4845,12 +4871,12 @@
</span><span class="cx"> 0F2BDC431522801700CD8910 /* DFGVariableEventStream.h */,
</span><span class="cx"> 0FFFC95314EF909500C72532 /* DFGVirtualRegisterAllocationPhase.cpp */,
</span><span class="cx"> 0FFFC95414EF909500C72532 /* DFGVirtualRegisterAllocationPhase.h */,
</span><ins>+ 0FD2D4FC192FEE5800A178BF /* DFGWatchableStructureWatchingPhase.cpp */,
+ 0FD2D4FD192FEE5800A178BF /* DFGWatchableStructureWatchingPhase.h */,
</ins><span class="cx"> 0FC97F3B18202119002C9B26 /* DFGWatchpointCollectionPhase.cpp */,
</span><span class="cx"> 0FC97F3C18202119002C9B26 /* DFGWatchpointCollectionPhase.h */,
</span><span class="cx"> 0FDB2CE5174830A2007B3C1B /* DFGWorklist.cpp */,
</span><span class="cx"> 0FDB2CE6174830A2007B3C1B /* DFGWorklist.h */,
</span><del>- 2A88067619107D5500CB0BBB /* DFGFunctionWhitelist.cpp */,
- 2A88067719107D5500CB0BBB /* DFGFunctionWhitelist.h */,
</del><span class="cx"> );
</span><span class="cx"> name = dfg;
</span><span class="cx"> sourceTree = "<group>";
</span><span class="lines">@@ -5036,6 +5062,7 @@
</span><span class="cx"> 0F5541B01613C1FB00CE3E25 /* SpecialPointer.h */,
</span><span class="cx"> 0FD82E84141F3FDA00179C94 /* SpeculatedType.cpp */,
</span><span class="cx"> 0FD82E4F141DAEA100179C94 /* SpeculatedType.h */,
</span><ins>+ 0FB438A219270B1D00E1FBC9 /* StructureSet.cpp */,
</ins><span class="cx"> 0F93329B14CA7DC10085F3C6 /* StructureSet.h */,
</span><span class="cx"> 0F766D3615AE4A1A008F363E /* StructureStubClearingWatchpoint.cpp */,
</span><span class="cx"> 0F766D3715AE4A1A008F363E /* StructureStubClearingWatchpoint.h */,
</span><span class="lines">@@ -5787,6 +5814,7 @@
</span><span class="cx"> 0F485328187DFDEC0083B687 /* FTLAvailableRecovery.h in Headers */,
</span><span class="cx"> 0FEA0A0A170513DB00BB722C /* FTLCapabilities.h in Headers */,
</span><span class="cx"> 0FEA0A231709606900BB722C /* FTLCommonValues.h in Headers */,
</span><ins>+ 0FD2D4FF192FEE5800A178BF /* DFGWatchableStructureWatchingPhase.h in Headers */,
</ins><span class="cx"> 0FEA0A0C170513DB00BB722C /* FTLCompile.h in Headers */,
</span><span class="cx"> 0FE95F7A18B5694700B531FB /* FTLDataSection.h in Headers */,
</span><span class="cx"> 2AC922BC18A16182003CE0FB /* FTLDWARFDebugLineInfo.h in Headers */,
</span><span class="lines">@@ -5828,6 +5856,7 @@
</span><span class="cx"> 0F6B1CC61862C47800845D97 /* FTLUnwindInfo.h in Headers */,
</span><span class="cx"> 0F235BE417178E1C00690C7F /* FTLValueFormat.h in Headers */,
</span><span class="cx"> 0FDB2CCA173DA523007B3C1B /* FTLValueFromBlock.h in Headers */,
</span><ins>+ 0FE7211E193B9C590031F6ED /* DFGTransition.h in Headers */,
</ins><span class="cx"> 0F5A6284188C98D40072C9DF /* FTLValueRange.h in Headers */,
</span><span class="cx"> 0F0332C618B53FA9005F979A /* FTLWeight.h in Headers */,
</span><span class="cx"> 0F0332C818B546EC005F979A /* FTLWeightedTarget.h in Headers */,
</span><span class="lines">@@ -5978,6 +6007,7 @@
</span><span class="cx"> 0F2B66F217B6B5AB00A7AE3F /* JSGenericTypedArrayViewConstructor.h in Headers */,
</span><span class="cx"> 0F2B66F317B6B5AB00A7AE3F /* JSGenericTypedArrayViewConstructorInlines.h in Headers */,
</span><span class="cx"> 0F2B66F417B6B5AB00A7AE3F /* JSGenericTypedArrayViewInlines.h in Headers */,
</span><ins>+ 0F5A1274192D9FDF008764A3 /* DFGDoesGC.h in Headers */,
</ins><span class="cx"> 0F2B66F517B6B5AB00A7AE3F /* JSGenericTypedArrayViewPrototype.h in Headers */,
</span><span class="cx"> 0F2B66F617B6B5AB00A7AE3F /* JSGenericTypedArrayViewPrototypeInlines.h in Headers */,
</span><span class="cx"> BC18C4210E16F5CD00B34460 /* JSGlobalObject.h in Headers */,
</span><span class="lines">@@ -6196,6 +6226,7 @@
</span><span class="cx"> 0F6B1CBA1861244C00845D97 /* RegisterPreservationMode.h in Headers */,
</span><span class="cx"> 0F6B1CBE1861246A00845D97 /* RegisterPreservationWrapperGenerator.h in Headers */,
</span><span class="cx"> 0FC314121814559100033232 /* RegisterSet.h in Headers */,
</span><ins>+ 0F50AF3C193E8B3900674EE8 /* DFGStructureClobberState.h in Headers */,
</ins><span class="cx"> A57D23EE1891B5540031C7FA /* RegularExpression.h in Headers */,
</span><span class="cx"> 0FB7F39D15ED8E4600F167B2 /* Reject.h in Headers */,
</span><span class="cx"> A5BA15E8182340B300A82E69 /* RemoteInspector.h in Headers */,
</span><span class="lines">@@ -6969,6 +7000,7 @@
</span><span class="cx"> 0FF0F19916B729F6005DF95B /* DFGLongLivedState.cpp in Sources */,
</span><span class="cx"> A767B5B517A0B9650063D940 /* DFGLoopPreHeaderCreationPhase.cpp in Sources */,
</span><span class="cx"> 0F2BDC4D1522818600CD8910 /* DFGMinifiedNode.cpp in Sources */,
</span><ins>+ 0FD2D4FE192FEE5800A178BF /* DFGWatchableStructureWatchingPhase.cpp in Sources */,
</ins><span class="cx"> A737810D1799EA2E00817533 /* DFGNaturalLoops.cpp in Sources */,
</span><span class="cx"> 0FF0F19C16B72A03005DF95B /* DFGNode.cpp in Sources */,
</span><span class="cx"> 0FA581BA150E952C00B9A2D9 /* DFGNodeFlags.cpp in Sources */,
</span><span class="lines">@@ -6998,6 +7030,7 @@
</span><span class="cx"> 0FC20CB918556A3500C9E954 /* DFGSSALoweringPhase.cpp in Sources */,
</span><span class="cx"> 0F9FB4F417FCB91700CB67F8 /* DFGStackLayoutPhase.cpp in Sources */,
</span><span class="cx"> 0F4F29DF18B6AD1C0057BC15 /* DFGStaticExecutionCountEstimationPhase.cpp in Sources */,
</span><ins>+ 0FE7211D193B9C590031F6ED /* DFGTransition.cpp in Sources */,
</ins><span class="cx"> 2ACCF3DE185FE26B0083E2AD /* DFGStoreBarrierElisionPhase.cpp in Sources */,
</span><span class="cx"> 0FC20CB51852E2C600C9E954 /* DFGStrengthReductionPhase.cpp in Sources */,
</span><span class="cx"> 0F2FCCFE18A60070001A27F8 /* DFGThreadData.cpp in Sources */,
</span><span class="lines">@@ -7070,6 +7103,7 @@
</span><span class="cx"> 0F235BE117178E1C00690C7F /* FTLThunks.cpp in Sources */,
</span><span class="cx"> 0F6B1CC51862C47800845D97 /* FTLUnwindInfo.cpp in Sources */,
</span><span class="cx"> 0F235BE317178E1C00690C7F /* FTLValueFormat.cpp in Sources */,
</span><ins>+ 0F5A1273192D9FDF008764A3 /* DFGDoesGC.cpp in Sources */,
</ins><span class="cx"> A53CE08718BC1A5600BEDF76 /* JSConsole.cpp in Sources */,
</span><span class="cx"> 0F5A6283188C98D40072C9DF /* FTLValueRange.cpp in Sources */,
</span><span class="cx"> 147F39CB107EC37600427A48 /* FunctionConstructor.cpp in Sources */,
</span><span class="lines">@@ -7187,6 +7221,7 @@
</span><span class="cx"> 95F6E6950E5B5F970091E860 /* JSProfilerPrivate.cpp in Sources */,
</span><span class="cx"> 7C184E1A17BEDBD3007CB63A /* JSPromise.cpp in Sources */,
</span><span class="cx"> 7C184E2217BEE240007CB63A /* JSPromiseConstructor.cpp in Sources */,
</span><ins>+ 0F893BDB1936E23C001211F4 /* DFGStructureAbstractValue.cpp in Sources */,
</ins><span class="cx"> 7C008CDA187124BB00955C24 /* JSPromiseDeferred.cpp in Sources */,
</span><span class="cx"> 7C008CD2186F8A9300955C24 /* JSPromiseFunctions.cpp in Sources */,
</span><span class="cx"> 7C184E1E17BEE22E007CB63A /* JSPromisePrototype.cpp in Sources */,
</span><span class="lines">@@ -7202,6 +7237,7 @@
</span><span class="cx"> 2A83638918D7D0FE0000EBCC /* FullGCActivityCallback.cpp in Sources */,
</span><span class="cx"> 1428083A107EC0750013E7B2 /* JSStack.cpp in Sources */,
</span><span class="cx"> 147F39D5107EC37600427A48 /* JSString.cpp in Sources */,
</span><ins>+ 0FB438A319270B1D00E1FBC9 /* StructureSet.cpp in Sources */,
</ins><span class="cx"> 2600B5A6152BAAA70091EE5F /* JSStringJoiner.cpp in Sources */,
</span><span class="cx"> 1482B74E0A43032800517CFC /* JSStringRef.cpp in Sources */,
</span><span class="cx"> 146AAB380B66A94400E55F16 /* JSStringRefCF.cpp in Sources */,
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorebytecodeStructureSetcpp"></a>
<div class="addfile"><h4>Added: trunk/Source/JavaScriptCore/bytecode/StructureSet.cpp (0 => 171380)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/bytecode/StructureSet.cpp (rev 0)
+++ trunk/Source/JavaScriptCore/bytecode/StructureSet.cpp 2014-07-23 01:19:50 UTC (rev 171380)
</span><span class="lines">@@ -0,0 +1,317 @@
</span><ins>+/*
+ * Copyright (C) 2014 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ * notice, this list of conditions and the following disclaimer in the
+ * documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "StructureSet.h"
+
+#include <wtf/CommaPrinter.h>
+
+namespace JSC {
+
+void StructureSet::clear()
+{
+ deleteStructureListIfNecessary();
+ setEmpty();
+}
+
+bool StructureSet::add(Structure* structure)
+{
+ ASSERT(structure);
+ if (isThin()) {
+ if (singleStructure() == structure)
+ return false;
+ if (!singleStructure()) {
+ set(structure);
+ return true;
+ }
+ OutOfLineList* list = OutOfLineList::create(defaultStartingSize);
+ list->m_length = 2;
+ list->list()[0] = singleStructure();
+ list->list()[1] = structure;
+ set(list);
+ return true;
+ }
+
+ return addOutOfLine(structure);
+}
+
+bool StructureSet::remove(Structure* structure)
+{
+ if (isThin()) {
+ if (singleStructure() == structure) {
+ setEmpty();
+ return true;
+ }
+ return false;
+ }
+
+ OutOfLineList* list = structureList();
+ for (unsigned i = 0; i < list->m_length; ++i) {
+ if (list->list()[i] != structure)
+ continue;
+ list->list()[i] = list->list()[--list->m_length];
+ if (!list->m_length) {
+ OutOfLineList::destroy(list);
+ setEmpty();
+ }
+ return true;
+ }
+ return false;
+}
+
+bool StructureSet::contains(Structure* structure) const
+{
+ if (isThin())
+ return singleStructure() == structure;
+
+ return containsOutOfLine(structure);
+}
+
+bool StructureSet::merge(const StructureSet& other)
+{
+ if (other.isThin()) {
+ if (other.singleStructure())
+ return add(other.singleStructure());
+ return false;
+ }
+
+ OutOfLineList* list = other.structureList();
+ if (list->m_length >= 2) {
+ if (isThin()) {
+ OutOfLineList* myNewList = OutOfLineList::create(
+ list->m_length + !!singleStructure());
+ if (singleStructure()) {
+ myNewList->m_length = 1;
+ myNewList->list()[0] = singleStructure();
+ }
+ set(myNewList);
+ }
+ bool changed = false;
+ for (unsigned i = 0; i < list->m_length; ++i)
+ changed |= addOutOfLine(list->list()[i]);
+ return changed;
+ }
+
+ ASSERT(list->m_length);
+ return add(list->list()[0]);
+}
+
+void StructureSet::filter(const StructureSet& other)
+{
+ if (other.isThin()) {
+ if (!other.singleStructure() || !contains(other.singleStructure()))
+ clear();
+ else {
+ clear();
+ set(other.singleStructure());
+ }
+ return;
+ }
+
+ ContainsOutOfLine containsOutOfLine(other);
+ genericFilter(containsOutOfLine);
+}
+
+void StructureSet::exclude(const StructureSet& other)
+{
+ if (other.isThin()) {
+ if (other.singleStructure())
+ remove(other.singleStructure());
+ return;
+ }
+
+ if (isThin()) {
+ if (!singleStructure())
+ return;
+ if (other.contains(singleStructure()))
+ clear();
+ return;
+ }
+
+ OutOfLineList* list = structureList();
+ for (unsigned i = 0; i < list->m_length; ++i) {
+ if (!other.containsOutOfLine(list->list()[i]))
+ continue;
+ list->list()[i--] = list->list()[--list->m_length];
+ }
+ if (!list->m_length)
+ clear();
+}
+
+bool StructureSet::isSubsetOf(const StructureSet& other) const
+{
+ if (isThin()) {
+ if (!singleStructure())
+ return true;
+ return other.contains(singleStructure());
+ }
+
+ if (other.isThin()) {
+ if (!other.singleStructure())
+ return false;
+ OutOfLineList* list = structureList();
+ if (list->m_length >= 2)
+ return false;
+ if (list->list()[0] == other.singleStructure())
+ return true;
+ return false;
+ }
+
+ OutOfLineList* list = structureList();
+ for (unsigned i = 0; i < list->m_length; ++i) {
+ if (!other.containsOutOfLine(list->list()[i]))
+ return false;
+ }
+ return true;
+}
+
+bool StructureSet::overlaps(const StructureSet& other) const
+{
+ if (isThin()) {
+ if (!singleStructure())
+ return false;
+ return other.contains(singleStructure());
+ }
+
+ if (other.isThin()) {
+ if (!other.singleStructure())
+ return false;
+ return containsOutOfLine(other.singleStructure());
+ }
+
+ OutOfLineList* list = structureList();
+ for (unsigned i = 0; i < list->m_length; ++i) {
+ if (other.containsOutOfLine(list->list()[i]))
+ return true;
+ }
+ return false;
+}
+
+bool StructureSet::operator==(const StructureSet& other) const
+{
+ if (size() != other.size())
+ return false;
+ return isSubsetOf(other);
+}
+
+SpeculatedType StructureSet::speculationFromStructures() const
+{
+ if (isThin()) {
+ if (!singleStructure())
+ return SpecNone;
+ return speculationFromStructure(singleStructure());
+ }
+
+ SpeculatedType result = SpecNone;
+ OutOfLineList* list = structureList();
+ for (unsigned i = 0; i < list->m_length; ++i)
+ mergeSpeculation(result, speculationFromStructure(list->list()[i]));
+ return result;
+}
+
+ArrayModes StructureSet::arrayModesFromStructures() const
+{
+ if (isThin()) {
+ if (!singleStructure())
+ return 0;
+ return asArrayModes(singleStructure()->indexingType());
+ }
+
+ ArrayModes result = 0;
+ OutOfLineList* list = structureList();
+ for (unsigned i = 0; i < list->m_length; ++i)
+ mergeArrayModes(result, asArrayModes(list->list()[i]->indexingType()));
+ return result;
+}
+
+void StructureSet::dumpInContext(PrintStream& out, DumpContext* context) const
+{
+ CommaPrinter comma;
+ out.print("[");
+ for (size_t i = 0; i < size(); ++i)
+ out.print(comma, inContext(*at(i), context));
+ out.print("]");
+}
+
+void StructureSet::dump(PrintStream& out) const
+{
+ dumpInContext(out, nullptr);
+}
+
+bool StructureSet::addOutOfLine(Structure* structure)
+{
+ OutOfLineList* list = structureList();
+ for (unsigned i = 0; i < list->m_length; ++i) {
+ if (list->list()[i] == structure)
+ return false;
+ }
+
+ if (list->m_length < list->m_capacity) {
+ list->list()[list->m_length++] = structure;
+ return true;
+ }
+
+ OutOfLineList* newList = OutOfLineList::create(list->m_capacity * 2);
+ newList->m_length = list->m_length + 1;
+ for (unsigned i = list->m_length; i--;)
+ newList->list()[i] = list->list()[i];
+ newList->list()[list->m_length] = structure;
+ set(newList);
+ return true;
+}
+
+bool StructureSet::containsOutOfLine(Structure* structure) const
+{
+ OutOfLineList* list = structureList();
+ for (unsigned i = 0; i < list->m_length; ++i) {
+ if (list->list()[i] == structure)
+ return true;
+ }
+ return false;
+}
+
+void StructureSet::copyFromOutOfLine(const StructureSet& other)
+{
+ ASSERT(!other.isThin() && other.m_pointer != reservedValue);
+ OutOfLineList* otherList = other.structureList();
+ OutOfLineList* myList = OutOfLineList::create(otherList->m_length);
+ myList->m_length = otherList->m_length;
+ for (unsigned i = otherList->m_length; i--;)
+ myList->list()[i] = otherList->list()[i];
+ set(myList);
+}
+
+StructureSet::OutOfLineList* StructureSet::OutOfLineList::create(unsigned capacity)
+{
+ return new (NotNull, fastMalloc(sizeof(OutOfLineList) + capacity * sizeof(Structure*))) OutOfLineList(0, capacity);
+}
+
+void StructureSet::OutOfLineList::destroy(OutOfLineList* list)
+{
+ fastFree(list);
+}
+
+} // namespace JSC
+
</ins></span></pre></div>
<a id="trunkSourceJavaScriptCorebytecodeStructureSeth"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/bytecode/StructureSet.h (171379 => 171380)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/bytecode/StructureSet.h 2014-07-23 01:12:32 UTC (rev 171379)
+++ trunk/Source/JavaScriptCore/bytecode/StructureSet.h 2014-07-23 01:19:50 UTC (rev 171380)
</span><span class="lines">@@ -1,5 +1,5 @@
</span><span class="cx"> /*
</span><del>- * Copyright (C) 2011, 2013 Apple Inc. All rights reserved.
</del><ins>+ * Copyright (C) 2011, 2013, 2014 Apple Inc. All rights reserved.
</ins><span class="cx"> *
</span><span class="cx"> * Redistribution and use in source and binary forms, with or without
</span><span class="cx"> * modification, are permitted provided that the following conditions
</span><span class="lines">@@ -30,8 +30,6 @@
</span><span class="cx"> #include "SpeculatedType.h"
</span><span class="cx"> #include "Structure.h"
</span><span class="cx"> #include "DumpContext.h"
</span><del>-#include <wtf/CommaPrinter.h>
-#include <wtf/Vector.h>
</del><span class="cx">
</span><span class="cx"> namespace JSC {
</span><span class="cx">
</span><span class="lines">@@ -41,156 +39,238 @@
</span><span class="cx">
</span><span class="cx"> class StructureSet {
</span><span class="cx"> public:
</span><del>- StructureSet() { }
-
- StructureSet(Structure* structure)
</del><ins>+ StructureSet()
</ins><span class="cx"> {
</span><del>- ASSERT(structure);
- m_structures.append(structure);
</del><ins>+ setEmpty();
</ins><span class="cx"> }
</span><span class="cx">
</span><del>- void clear()
</del><ins>+ StructureSet(Structure* structure)
</ins><span class="cx"> {
</span><del>- m_structures.clear();
</del><ins>+ set(structure);
</ins><span class="cx"> }
</span><span class="cx">
</span><del>- void add(Structure* structure)
</del><ins>+ ALWAYS_INLINE StructureSet(const StructureSet& other)
</ins><span class="cx"> {
</span><del>- ASSERT(structure);
- ASSERT(!contains(structure));
- m_structures.append(structure);
</del><ins>+ copyFrom(other);
</ins><span class="cx"> }
</span><span class="cx">
</span><del>- bool addAll(const StructureSet& other)
</del><ins>+ ALWAYS_INLINE StructureSet& operator=(const StructureSet& other)
</ins><span class="cx"> {
</span><del>- bool changed = false;
- for (size_t i = 0; i < other.size(); ++i) {
- if (contains(other[i]))
- continue;
- add(other[i]);
- changed = true;
- }
- return changed;
</del><ins>+ if (this == &other)
+ return *this;
+ deleteStructureListIfNecessary();
+ copyFrom(other);
+ return *this;
</ins><span class="cx"> }
</span><span class="cx">
</span><del>- void remove(Structure* structure)
</del><ins>+ ~StructureSet()
</ins><span class="cx"> {
</span><del>- for (size_t i = 0; i < m_structures.size(); ++i) {
- if (m_structures[i] != structure)
- continue;
-
- m_structures[i] = m_structures.last();
- m_structures.removeLast();
- return;
- }
</del><ins>+ deleteStructureListIfNecessary();
</ins><span class="cx"> }
</span><span class="cx">
</span><del>- bool contains(Structure* structure) const
</del><ins>+ void clear();
+
+ Structure* onlyStructure() const
</ins><span class="cx"> {
</span><del>- for (size_t i = 0; i < m_structures.size(); ++i) {
- if (m_structures[i] == structure)
- return true;
</del><ins>+ if (isThin()) {
+ ASSERT(singleStructure());
+ return singleStructure();
</ins><span class="cx"> }
</span><del>- return false;
</del><ins>+ ASSERT(structureList()->m_length == 1);
+ return structureList()->list()[0];
</ins><span class="cx"> }
</span><span class="cx">
</span><del>- bool containsOnly(Structure* structure) const
</del><ins>+ bool isEmpty() const
</ins><span class="cx"> {
</span><del>- if (size() != 1)
- return false;
- return singletonStructure() == structure;
</del><ins>+ bool result = isThin() && !singleStructure();
+ if (result)
+ ASSERT(m_pointer != reservedValue);
+ return result;
</ins><span class="cx"> }
</span><span class="cx">
</span><del>- bool isSubsetOf(const StructureSet& other) const
</del><ins>+ bool add(Structure*);
+ bool remove(Structure*);
+ bool contains(Structure*) const;
+
+ bool merge(const StructureSet&);
+ void filter(const StructureSet&);
+ void exclude(const StructureSet&);
+
+ template<typename Functor>
+ void genericFilter(Functor& functor)
</ins><span class="cx"> {
</span><del>- for (size_t i = 0; i < m_structures.size(); ++i) {
- if (!other.contains(m_structures[i]))
- return false;
</del><ins>+ if (isThin()) {
+ if (!singleStructure())
+ return;
+ if (functor(singleStructure()))
+ return;
+ clear();
+ return;
</ins><span class="cx"> }
</span><del>- return true;
</del><ins>+
+ OutOfLineList* list = structureList();
+ for (unsigned i = 0; i < list->m_length; ++i) {
+ if (functor(list->list()[i]))
+ continue;
+ list->list()[i--] = list->list()[--list->m_length];
+ }
+ if (!list->m_length)
+ clear();
</ins><span class="cx"> }
</span><span class="cx">
</span><ins>+ bool isSubsetOf(const StructureSet&) const;
</ins><span class="cx"> bool isSupersetOf(const StructureSet& other) const
</span><span class="cx"> {
</span><span class="cx"> return other.isSubsetOf(*this);
</span><span class="cx"> }
</span><span class="cx">
</span><del>- bool overlaps(const StructureSet& other) const
</del><ins>+ bool overlaps(const StructureSet&) const;
+
+ size_t size() const
</ins><span class="cx"> {
</span><del>- for (size_t i = 0; i < m_structures.size(); ++i) {
- if (other.contains(m_structures[i]))
- return true;
</del><ins>+ if (isThin())
+ return !!singleStructure();
+ return structureList()->m_length;
+ }
+
+ Structure* at(size_t i) const
+ {
+ if (isThin()) {
+ ASSERT(!i);
+ ASSERT(singleStructure());
+ return singleStructure();
</ins><span class="cx"> }
</span><del>- return false;
</del><ins>+ ASSERT(i < structureList()->m_length);
+ return structureList()->list()[i];
</ins><span class="cx"> }
</span><span class="cx">
</span><del>- size_t size() const { return m_structures.size(); }
</del><ins>+ Structure* operator[](size_t i) const { return at(i); }
</ins><span class="cx">
</span><del>- // Call this if you know that the structure set must consist of exactly
- // one structure.
- Structure* singletonStructure() const
</del><ins>+ Structure* last() const
</ins><span class="cx"> {
</span><del>- ASSERT(m_structures.size() == 1);
- return m_structures[0];
</del><ins>+ if (isThin()) {
+ ASSERT(singleStructure());
+ return singleStructure();
+ }
+ return structureList()->list()[structureList()->m_length - 1];
</ins><span class="cx"> }
</span><span class="cx">
</span><del>- Structure* at(size_t i) const { return m_structures.at(i); }
</del><ins>+ bool operator==(const StructureSet& other) const;
</ins><span class="cx">
</span><del>- Structure* operator[](size_t i) const { return at(i); }
</del><ins>+ SpeculatedType speculationFromStructures() const;
+ ArrayModes arrayModesFromStructures() const;
</ins><span class="cx">
</span><del>- Structure* last() const { return m_structures.last(); }
</del><ins>+ void dumpInContext(PrintStream&, DumpContext*) const;
+ void dump(PrintStream&) const;
+
+private:
+ friend class DFG::StructureAbstractValue;
+
+ static const uintptr_t thinFlag = 1;
+ static const uintptr_t reservedFlag = 2;
+ static const uintptr_t flags = thinFlag | reservedFlag;
+ static const uintptr_t reservedValue = 4;
</ins><span class="cx">
</span><del>- SpeculatedType speculationFromStructures() const
</del><ins>+ static const unsigned defaultStartingSize = 4;
+
+ bool addOutOfLine(Structure*);
+ bool containsOutOfLine(Structure*) const;
+
+ class ContainsOutOfLine {
+ public:
+ ContainsOutOfLine(const StructureSet& set)
+ : m_set(set)
+ {
+ }
+
+ bool operator()(Structure* structure)
+ {
+ return m_set.containsOutOfLine(structure);
+ }
+ private:
+ const StructureSet& m_set;
+ };
+
+ ALWAYS_INLINE void copyFrom(const StructureSet& other)
</ins><span class="cx"> {
</span><del>- SpeculatedType result = SpecNone;
</del><ins>+ if (other.isThin() || other.m_pointer == reservedValue) {
+ bool value = getReservedFlag();
+ m_pointer = other.m_pointer;
+ setReservedFlag(value);
+ return;
+ }
+ copyFromOutOfLine(other);
+ }
+ void copyFromOutOfLine(const StructureSet& other);
+
+ class OutOfLineList {
+ public:
+ static OutOfLineList* create(unsigned capacity);
+ static void destroy(OutOfLineList*);
</ins><span class="cx">
</span><del>- for (size_t i = 0; i < m_structures.size(); ++i)
- mergeSpeculation(result, speculationFromStructure(m_structures[i]));
</del><ins>+ Structure** list() { return bitwise_cast<Structure**>(this + 1); }
</ins><span class="cx">
</span><del>- return result;
</del><ins>+ OutOfLineList(unsigned length, unsigned capacity)
+ : m_length(length)
+ , m_capacity(capacity)
+ {
+ }
+
+ unsigned m_length;
+ unsigned m_capacity;
+ };
+
+ ALWAYS_INLINE void deleteStructureListIfNecessary()
+ {
+ if (!isThin() && m_pointer != reservedValue)
+ OutOfLineList::destroy(structureList());
</ins><span class="cx"> }
</span><span class="cx">
</span><del>- ArrayModes arrayModesFromStructures() const
</del><ins>+ bool isThin() const { return m_pointer & thinFlag; }
+
+ void* pointer() const
</ins><span class="cx"> {
</span><del>- ArrayModes result = 0;
-
- for (size_t i = 0; i < m_structures.size(); ++i)
- mergeArrayModes(result, asArrayModes(m_structures[i]->indexingType()));
-
- return result;
</del><ins>+ return bitwise_cast<void*>(m_pointer & ~flags);
</ins><span class="cx"> }
</span><span class="cx">
</span><del>- bool operator==(const StructureSet& other) const
</del><ins>+ Structure* singleStructure() const
</ins><span class="cx"> {
</span><del>- if (m_structures.size() != other.m_structures.size())
- return false;
-
- for (size_t i = 0; i < m_structures.size(); ++i) {
- if (!other.contains(m_structures[i]))
- return false;
- }
-
- return true;
</del><ins>+ ASSERT(isThin());
+ return static_cast<Structure*>(pointer());
</ins><span class="cx"> }
</span><span class="cx">
</span><del>- void dumpInContext(PrintStream& out, DumpContext* context) const
</del><ins>+ OutOfLineList* structureList() const
</ins><span class="cx"> {
</span><del>- CommaPrinter comma;
- out.print("[");
- for (size_t i = 0; i < m_structures.size(); ++i)
- out.print(comma, inContext(*m_structures[i], context));
- out.print("]");
</del><ins>+ ASSERT(!isThin());
+ return static_cast<OutOfLineList*>(pointer());
</ins><span class="cx"> }
</span><span class="cx">
</span><del>- void dump(PrintStream& out) const
</del><ins>+ void set(Structure* structure)
</ins><span class="cx"> {
</span><del>- dumpInContext(out, 0);
</del><ins>+ set(bitwise_cast<uintptr_t>(structure), true);
</ins><span class="cx"> }
</span><del>-
-private:
- friend class DFG::StructureAbstractValue;
-
- Vector<Structure*, 2> m_structures;
</del><ins>+ void set(OutOfLineList* structures)
+ {
+ set(bitwise_cast<uintptr_t>(structures), false);
+ }
+ void setEmpty()
+ {
+ set(0, true);
+ }
+ void set(uintptr_t pointer, bool singleStructure)
+ {
+ m_pointer = pointer | (singleStructure ? thinFlag : 0) | (m_pointer & reservedFlag);
+ }
+ bool getReservedFlag() const { return m_pointer & reservedFlag; }
+ void setReservedFlag(bool value)
+ {
+ if (value)
+ m_pointer |= reservedFlag;
+ else
+ m_pointer &= ~reservedFlag;
+ }
+
+ uintptr_t m_pointer;
</ins><span class="cx"> };
</span><span class="cx">
</span><span class="cx"> } // namespace JSC
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGAbstractHeaph"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGAbstractHeap.h (171379 => 171380)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGAbstractHeap.h 2014-07-23 01:12:32 UTC (rev 171379)
+++ trunk/Source/JavaScriptCore/dfg/DFGAbstractHeap.h 2014-07-23 01:19:50 UTC (rev 171380)
</span><span class="lines">@@ -70,8 +70,7 @@
</span><span class="cx"> macro(ArrayStorageProperties) \
</span><span class="cx"> macro(Variables) \
</span><span class="cx"> macro(TypedArrayProperties) \
</span><del>- macro(GCState) \
- macro(BarrierState) \
</del><ins>+ macro(HeapObjectCount) /* Used to reflect the fact that some allocations reveal object identity */\
</ins><span class="cx"> macro(RegExpState) \
</span><span class="cx"> macro(InternalState) \
</span><span class="cx"> macro(Absolute) \
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGAbstractInterpreterh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGAbstractInterpreter.h (171379 => 171380)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGAbstractInterpreter.h 2014-07-23 01:12:32 UTC (rev 171379)
+++ trunk/Source/JavaScriptCore/dfg/DFGAbstractInterpreter.h 2014-07-23 01:19:50 UTC (rev 171380)
</span><span class="lines">@@ -114,6 +114,7 @@
</span><span class="cx"> bool executeEffects(unsigned indexInBlock);
</span><span class="cx"> bool executeEffects(unsigned clobberLimit, Node*);
</span><span class="cx">
</span><ins>+ void dump(PrintStream& out) const;
</ins><span class="cx"> void dump(PrintStream& out);
</span><span class="cx">
</span><span class="cx"> template<typename T>
</span><span class="lines">@@ -148,7 +149,14 @@
</span><span class="cx"> private:
</span><span class="cx"> void clobberWorld(const CodeOrigin&, unsigned indexInBlock);
</span><span class="cx"> void clobberCapturedVars(const CodeOrigin&);
</span><ins>+
+ template<typename Functor>
+ void forAllValues(unsigned indexInBlock, Functor&);
+
</ins><span class="cx"> void clobberStructures(unsigned indexInBlock);
</span><ins>+ void observeTransition(unsigned indexInBlock, Structure* from, Structure* to);
+ void observeTransitions(unsigned indexInBlock, const TransitionVector&);
+ void setDidClobber();
</ins><span class="cx">
</span><span class="cx"> enum BooleanResult {
</span><span class="cx"> UnknownBooleanResult,
</span><span class="lines">@@ -160,7 +168,7 @@
</span><span class="cx"> void setBuiltInConstant(Node* node, JSValue value)
</span><span class="cx"> {
</span><span class="cx"> AbstractValue& abstractValue = forNode(node);
</span><del>- abstractValue.set(m_graph, value);
</del><ins>+ abstractValue.set(m_graph, value, m_state.structureClobberState());
</ins><span class="cx"> abstractValue.fixTypeForRepresentation(node);
</span><span class="cx"> }
</span><span class="cx">
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGAbstractInterpreterInlinesh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h (171379 => 171380)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h 2014-07-23 01:12:32 UTC (rev 171379)
+++ trunk/Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h 2014-07-23 01:19:50 UTC (rev 171380)
</span><span class="lines">@@ -62,11 +62,17 @@
</span><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> // Next check if we can fold because we know that the source is an object or string and does not equal undefined.
</span><del>- if (isCellSpeculation(value.m_type)
- && value.m_currentKnownStructure.hasSingleton()) {
- Structure* structure = value.m_currentKnownStructure.singleton();
- if (!structure->masqueradesAsUndefined(m_codeBlock->globalObjectFor(node->origin.semantic))
- && structure->typeInfo().type() != StringType)
</del><ins>+ if (isCellSpeculation(value.m_type) && !value.m_structure.isTop()) {
+ bool allTrue = true;
+ for (unsigned i = value.m_structure.size(); i--;) {
+ Structure* structure = value.m_structure[i];
+ if (structure->masqueradesAsUndefined(m_codeBlock->globalObjectFor(node->origin.semantic))
+ || structure->typeInfo().type() == StringType) {
+ allTrue = false;
+ break;
+ }
+ }
+ if (allTrue)
</ins><span class="cx"> return DefinitelyTrue;
</span><span class="cx"> }
</span><span class="cx">
</span><span class="lines">@@ -105,9 +111,12 @@
</span><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> template<typename AbstractStateType>
</span><del>-void AbstractInterpreter<AbstractStateType>::verifyEdge(Node*, Edge edge)
</del><ins>+void AbstractInterpreter<AbstractStateType>::verifyEdge(Node* node, Edge edge)
</ins><span class="cx"> {
</span><del>- RELEASE_ASSERT(!(forNode(edge).m_type & ~typeFilterFor(edge.useKind())));
</del><ins>+ if (!(forNode(edge).m_type & ~typeFilterFor(edge.useKind())))
+ return;
+
+ DFG_CRASH(m_graph, node, toCString("Edge verification error: ", node, "->", edge, " was expected to have type ", SpeculationDump(typeFilterFor(edge.useKind())), " but has type ", SpeculationDump(forNode(edge).m_type)).data());
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> template<typename AbstractStateType>
</span><span class="lines">@@ -1273,7 +1282,6 @@
</span><span class="cx"> forNode(node).set(
</span><span class="cx"> m_graph,
</span><span class="cx"> m_graph.globalObjectFor(node->origin.semantic)->arrayStructureForIndexingTypeDuringAllocation(node->indexingType()));
</span><del>- m_state.setHaveStructures(true);
</del><span class="cx"> break;
</span><span class="cx">
</span><span class="cx"> case NewArrayBuffer:
</span><span class="lines">@@ -1281,13 +1289,11 @@
</span><span class="cx"> forNode(node).set(
</span><span class="cx"> m_graph,
</span><span class="cx"> m_graph.globalObjectFor(node->origin.semantic)->arrayStructureForIndexingTypeDuringAllocation(node->indexingType()));
</span><del>- m_state.setHaveStructures(true);
</del><span class="cx"> break;
</span><span class="cx">
</span><span class="cx"> case NewArrayWithSize:
</span><span class="cx"> node->setCanExit(true);
</span><span class="cx"> forNode(node).setType(SpecArray);
</span><del>- m_state.setHaveStructures(true);
</del><span class="cx"> break;
</span><span class="cx">
</span><span class="cx"> case NewTypedArray:
</span><span class="lines">@@ -1305,12 +1311,10 @@
</span><span class="cx"> m_graph,
</span><span class="cx"> m_graph.globalObjectFor(node->origin.semantic)->typedArrayStructure(
</span><span class="cx"> node->typedArrayType()));
</span><del>- m_state.setHaveStructures(true);
</del><span class="cx"> break;
</span><span class="cx">
</span><span class="cx"> case NewRegexp:
</span><span class="cx"> forNode(node).set(m_graph, m_graph.globalObjectFor(node->origin.semantic)->regExpStructure());
</span><del>- m_state.setHaveStructures(true);
</del><span class="cx"> break;
</span><span class="cx">
</span><span class="cx"> case ToThis: {
</span><span class="lines">@@ -1338,13 +1342,11 @@
</span><span class="cx"> case NewObject:
</span><span class="cx"> ASSERT(node->structure());
</span><span class="cx"> forNode(node).set(m_graph, node->structure());
</span><del>- m_state.setHaveStructures(true);
</del><span class="cx"> break;
</span><span class="cx">
</span><span class="cx"> case CreateActivation:
</span><span class="cx"> forNode(node).set(
</span><span class="cx"> m_graph, m_codeBlock->globalObjectFor(node->origin.semantic)->activationStructure());
</span><del>- m_state.setHaveStructures(true);
</del><span class="cx"> break;
</span><span class="cx">
</span><span class="cx"> case FunctionReentryWatchpoint:
</span><span class="lines">@@ -1377,8 +1379,9 @@
</span><span class="cx"> // of GetMyArgumentsLength, because GetMyArgumentsLength is a clobbering operation.
</span><span class="cx"> // We perform further optimizations on this later on.
</span><span class="cx"> if (node->origin.semantic.inlineCallFrame) {
</span><del>- forNode(node).set(
- m_graph, jsNumber(node->origin.semantic.inlineCallFrame->arguments.size() - 1));
</del><ins>+ setConstant(
+ node, jsNumber(node->origin.semantic.inlineCallFrame->arguments.size() - 1));
+ m_state.setDidClobber(true); // Pretend that we clobbered to prevent constant folding.
</ins><span class="cx"> } else
</span><span class="cx"> forNode(node).setType(SpecInt32);
</span><span class="cx"> node->setCanExit(
</span><span class="lines">@@ -1474,7 +1477,12 @@
</span><span class="cx"> break;
</span><span class="cx"> }
</span><span class="cx"> if (isCellSpeculation(node->child1()->prediction())) {
</span><del>- if (Structure* structure = forNode(node->child1()).bestProvenStructure()) {
</del><ins>+ // This use of onlyStructure() should be replaced by giving GetByIdStatus the ability
+ // to compute things based on a StructureSet, and then to factor ByteCodeParser's
+ // ability to generate code based on a GetByIdStatus out of ByteCodeParser so that
+ // ConstantFoldingPhase can use it.
+ // https://bugs.webkit.org/show_bug.cgi?id=133229
+ if (Structure* structure = forNode(node->child1()).m_structure.onlyStructure()) {
</ins><span class="cx"> GetByIdStatus status = GetByIdStatus::computeFor(
</span><span class="cx"> m_graph.m_vm, structure,
</span><span class="cx"> m_graph.identifiers()[node->identifierNumber()]);
</span><span class="lines">@@ -1484,14 +1492,17 @@
</span><span class="cx"> ASSERT(status[0].structureSet().size() == 1);
</span><span class="cx"> ASSERT(!status[0].chain());
</span><span class="cx">
</span><del>- if (status[0].specificValue())
</del><ins>+ if (status[0].specificValue()) {
+ if (status[0].specificValue().isCell()) {
+ Structure* structure = status[0].specificValue().asCell()->structure();
+ m_graph.watchpoints().consider(structure);
+ }
</ins><span class="cx"> setConstant(node, status[0].specificValue());
</span><del>- else
</del><ins>+ } else
</ins><span class="cx"> forNode(node).makeHeapTop();
</span><span class="cx"> filter(node->child1(), status[0].structureSet());
</span><span class="cx">
</span><span class="cx"> m_state.setFoundConstants(true);
</span><del>- m_state.setHaveStructures(true);
</del><span class="cx"> break;
</span><span class="cx"> }
</span><span class="cx"> }
</span><span class="lines">@@ -1520,44 +1531,28 @@
</span><span class="cx"> ASSERT(!(value.m_type & ~SpecCell)); // Edge filtering should have already ensured this.
</span><span class="cx">
</span><span class="cx"> StructureSet& set = node->structureSet();
</span><del>-
- if (value.m_currentKnownStructure.isSubsetOf(set)) {
</del><ins>+
+ // It's interesting that we could have proven that the object has a larger structure set
+ // that includes the set we're testing. In that case we could make the structure check
+ // more efficient. We currently don't.
+
+ if (value.m_structure.isSubsetOf(set)) {
</ins><span class="cx"> m_state.setFoundConstants(true);
</span><span class="cx"> break;
</span><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> node->setCanExit(true);
</span><del>- m_state.setHaveStructures(true);
</del><span class="cx">
</span><del>- // If this structure check is attempting to prove knowledge already held in
- // the futurePossibleStructure set then the constant folding phase should
- // turn this into a watchpoint instead.
- if (value.m_futurePossibleStructure.isSubsetOf(set)
- && value.m_futurePossibleStructure.hasSingleton()) {
- m_state.setFoundConstants(true);
- filter(value, value.m_futurePossibleStructure.singleton());
- break;
- }
-
</del><span class="cx"> filter(value, set);
</span><span class="cx"> break;
</span><span class="cx"> }
</span><span class="cx">
</span><del>- case StructureTransitionWatchpoint: {
- AbstractValue& value = forNode(node->child1());
-
- filter(value, node->structure());
- m_state.setHaveStructures(true);
- node->setCanExit(true);
- break;
- }
-
</del><span class="cx"> case PutStructure:
</span><span class="cx"> case PhantomPutStructure:
</span><del>- if (!forNode(node->child1()).m_currentKnownStructure.isClear()) {
- clobberStructures(clobberLimit);
- forNode(node->child1()).set(m_graph, node->structureTransitionData().newStructure);
- m_state.setHaveStructures(true);
</del><ins>+ if (!forNode(node->child1()).m_structure.isClear()) {
+ observeTransition(
+ clobberLimit, node->transition()->previous, node->transition()->next);
+ forNode(node->child1()).set(m_graph, node->transition()->next);
</ins><span class="cx"> }
</span><span class="cx"> break;
</span><span class="cx"> case GetButterfly:
</span><span class="lines">@@ -1616,7 +1611,6 @@
</span><span class="cx"> break;
</span><span class="cx"> }
</span><span class="cx"> filterArrayModes(node->child1(), node->arrayMode().arrayModesThatPassFiltering());
</span><del>- m_state.setHaveStructures(true);
</del><span class="cx"> break;
</span><span class="cx"> }
</span><span class="cx"> case Arrayify: {
</span><span class="lines">@@ -1629,19 +1623,43 @@
</span><span class="cx"> node->setCanExit(true);
</span><span class="cx"> clobberStructures(clobberLimit);
</span><span class="cx"> filterArrayModes(node->child1(), node->arrayMode().arrayModesThatPassFiltering());
</span><del>- m_state.setHaveStructures(true);
</del><span class="cx"> break;
</span><span class="cx"> }
</span><span class="cx"> case ArrayifyToStructure: {
</span><span class="cx"> AbstractValue& value = forNode(node->child1());
</span><del>- StructureSet set = node->structure();
- if (value.m_futurePossibleStructure.isSubsetOf(set)
- || value.m_currentKnownStructure.isSubsetOf(set))
</del><ins>+ if (value.m_structure.isSubsetOf(StructureSet(node->structure())))
</ins><span class="cx"> m_state.setFoundConstants(true);
</span><span class="cx"> node->setCanExit(true);
</span><span class="cx"> clobberStructures(clobberLimit);
</span><del>- filter(value, set);
- m_state.setHaveStructures(true);
</del><ins>+
+ // We have a bunch of options of how to express the abstract set at this point. Let set S
+ // be the set of structures that the value had before clobbering and assume that all of
+ // them are watchable. The new value should be the least expressible upper bound of the
+ // intersection of "values that currently have structure = node->structure()" and "values
+ // that have structure in S plus any structure transition-reachable from S". Assume that
+ // node->structure() is not in S but it is transition-reachable from S. Then we would
+ // like to say that the result is "values that have structure = node->structure() until
+ // we invalidate", but there is no way to express this using the AbstractValue syntax. So
+ // we must choose between:
+ //
+ // 1) "values that currently have structure = node->structure()". This is a valid
+ // superset of the value that we really want, and it's specific enough to satisfy the
+ // preconditions of the array access that this is guarding. It's also specific enough
+ // to allow relevant optimizations in the case that we didn't have a contradiction
+ // like in this example. Notice that in the abscence of any contradiction, this result
+ // is precise rather than being a conservative LUB.
+ //
+ // 2) "values that currently hava structure in S plus any structure transition-reachable
+ // from S". This is also a valid superset of the value that we really want, but it's
+ // not specific enough to satisfy the preconditions of the array access that this is
+ // guarding - so playing such shenanigans would preclude us from having assertions on
+ // the typing preconditions of any array accesses. This would also not be a desirable
+ // answer in the absence of a contradiction.
+ //
+ // Note that it's tempting to simply say that the resulting value is BOTTOM because of
+ // the contradiction. That would be wrong, since we haven't hit an invalidation point,
+ // yet.
+ value.set(m_graph, node->structure());
</ins><span class="cx"> break;
</span><span class="cx"> }
</span><span class="cx"> case GetIndexedPropertyStorage:
</span><span class="lines">@@ -1669,7 +1687,11 @@
</span><span class="cx"> AbstractValue& value = forNode(node->child1());
</span><span class="cx"> ASSERT(!(value.m_type & ~SpecCell)); // Edge filtering should have already ensured this.
</span><span class="cx">
</span><del>- if (Structure* structure = value.bestProvenStructure()) {
</del><ins>+ // This should just filter down the cases in MultiGetByOffset. If that results in all
+ // cases having the same offset then we should strength reduce it to a CheckStructure +
+ // GetByOffset.
+ // https://bugs.webkit.org/show_bug.cgi?id=133229
+ if (Structure* structure = value.m_structure.onlyStructure()) {
</ins><span class="cx"> bool done = false;
</span><span class="cx"> for (unsigned i = node->multiGetByOffsetData().variants.size(); i--;) {
</span><span class="cx"> const GetByIdVariant& variant = node->multiGetByOffsetData().variants[i];
</span><span class="lines">@@ -1691,7 +1713,7 @@
</span><span class="cx">
</span><span class="cx"> StructureSet set;
</span><span class="cx"> for (unsigned i = node->multiGetByOffsetData().variants.size(); i--;)
</span><del>- set.addAll(node->multiGetByOffsetData().variants[i].structureSet());
</del><ins>+ set.merge(node->multiGetByOffsetData().variants[i].structureSet());
</ins><span class="cx">
</span><span class="cx"> filter(node->child1(), set);
</span><span class="cx"> forNode(node).makeHeapTop();
</span><span class="lines">@@ -1706,7 +1728,12 @@
</span><span class="cx"> AbstractValue& value = forNode(node->child1());
</span><span class="cx"> ASSERT(!(value.m_type & ~SpecCell)); // Edge filtering should have already ensured this.
</span><span class="cx">
</span><del>- if (Structure* structure = value.bestProvenStructure()) {
</del><ins>+ // This should just filter down the cases in MultiPutByOffset. If that results in either
+ // one case, or nothing but replace cases and they have the same offset, then we should
+ // just strength reduce it to the appropriate combination of CheckStructure,
+ // [Re]AllocatePropertyStorage, PutStructure, and PutByOffset.
+ // https://bugs.webkit.org/show_bug.cgi?id=133229
+ if (Structure* structure = value.m_structure.onlyStructure()) {
</ins><span class="cx"> bool done = false;
</span><span class="cx"> for (unsigned i = node->multiPutByOffsetData().variants.size(); i--;) {
</span><span class="cx"> const PutByIdVariant& variant = node->multiPutByOffsetData().variants[i];
</span><span class="lines">@@ -1716,7 +1743,6 @@
</span><span class="cx"> if (variant.kind() == PutByIdVariant::Replace) {
</span><span class="cx"> filter(node->child1(), structure);
</span><span class="cx"> m_state.setFoundConstants(true);
</span><del>- m_state.setHaveStructures(true);
</del><span class="cx"> done = true;
</span><span class="cx"> break;
</span><span class="cx"> }
</span><span class="lines">@@ -1725,7 +1751,6 @@
</span><span class="cx"> clobberStructures(clobberLimit);
</span><span class="cx"> forNode(node->child1()).set(m_graph, variant.newStructure());
</span><span class="cx"> m_state.setFoundConstants(true);
</span><del>- m_state.setHaveStructures(true);
</del><span class="cx"> done = true;
</span><span class="cx"> break;
</span><span class="cx"> }
</span><span class="lines">@@ -1733,25 +1758,24 @@
</span><span class="cx"> break;
</span><span class="cx"> }
</span><span class="cx">
</span><del>- clobberStructures(clobberLimit);
-
</del><ins>+ StructureSet oldSet;
</ins><span class="cx"> StructureSet newSet;
</span><ins>+ TransitionVector transitions;
</ins><span class="cx"> for (unsigned i = node->multiPutByOffsetData().variants.size(); i--;) {
</span><span class="cx"> const PutByIdVariant& variant = node->multiPutByOffsetData().variants[i];
</span><del>- if (variant.kind() == PutByIdVariant::Replace) {
- if (value.m_currentKnownStructure.contains(variant.structure()))
- newSet.addAll(variant.structure());
- continue;
</del><ins>+ oldSet.add(variant.oldStructure());
+ if (variant.kind() == PutByIdVariant::Transition) {
+ transitions.append(Transition(variant.oldStructure(), variant.newStructure()));
+ newSet.add(variant.newStructure());
+ } else {
+ ASSERT(variant.kind() == PutByIdVariant::Replace);
+ newSet.add(variant.oldStructure());
</ins><span class="cx"> }
</span><del>- ASSERT(variant.kind() == PutByIdVariant::Transition);
- if (value.m_currentKnownStructure.contains(variant.oldStructure()))
- newSet.addAll(variant.newStructure());
</del><span class="cx"> }
</span><span class="cx">
</span><del>- // Use filter(value, set) as a way of setting the structure set. This works because
- // we would have already made the set be TOP before this. Filtering top is another
- // way of setting.
- filter(node->child1(), newSet);
</del><ins>+ filter(node->child1(), oldSet);
+ observeTransitions(clobberLimit, transitions);
+ forNode(node->child1()).set(m_graph, newSet);
</ins><span class="cx"> break;
</span><span class="cx"> }
</span><span class="cx">
</span><span class="lines">@@ -1785,7 +1809,12 @@
</span><span class="cx"> case PutByIdFlush:
</span><span class="cx"> case PutByIdDirect:
</span><span class="cx"> node->setCanExit(true);
</span><del>- if (Structure* structure = forNode(node->child1()).bestProvenStructure()) {
</del><ins>+ // This use of onlyStructure() should be replaced by giving PutByIdStatus the ability
+ // to compute things based on a StructureSet, and then to factor ByteCodeParser's
+ // ability to generate code based on a PutByIdStatus out of ByteCodeParser so that
+ // ConstantFoldingPhase can use it.
+ // https://bugs.webkit.org/show_bug.cgi?id=133229
+ if (Structure* structure = forNode(node->child1()).m_structure.onlyStructure()) {
</ins><span class="cx"> PutByIdStatus status = PutByIdStatus::computeFor(
</span><span class="cx"> m_graph.m_vm,
</span><span class="cx"> m_graph.globalObjectFor(node->origin.semantic),
</span><span class="lines">@@ -1796,13 +1825,13 @@
</span><span class="cx"> if (status[0].kind() == PutByIdVariant::Replace) {
</span><span class="cx"> filter(node->child1(), structure);
</span><span class="cx"> m_state.setFoundConstants(true);
</span><del>- m_state.setHaveStructures(true);
</del><span class="cx"> break;
</span><span class="cx"> }
</span><del>- if (status[0].kind() == PutByIdVariant::Transition) {
</del><ins>+ if (status[0].kind() == PutByIdVariant::Transition
+ && structure->transitionWatchpointSetHasBeenInvalidated()) {
+ m_graph.watchpoints().consider(status[0].newStructure());
</ins><span class="cx"> clobberStructures(clobberLimit);
</span><span class="cx"> forNode(node->child1()).set(m_graph, status[0].newStructure());
</span><del>- m_state.setHaveStructures(true);
</del><span class="cx"> m_state.setFoundConstants(true);
</span><span class="cx"> break;
</span><span class="cx"> }
</span><span class="lines">@@ -1849,7 +1878,7 @@
</span><span class="cx">
</span><span class="cx"> case Upsilon: {
</span><span class="cx"> m_state.createValueForNode(node->phi());
</span><del>- AbstractValue& value = forNode(node->child1());
</del><ins>+ AbstractValue value = forNode(node->child1());
</ins><span class="cx"> forNode(node) = value;
</span><span class="cx"> forNode(node->phi()) = value;
</span><span class="cx"> break;
</span><span class="lines">@@ -1873,6 +1902,8 @@
</span><span class="cx">
</span><span class="cx"> case InvalidationPoint:
</span><span class="cx"> node->setCanExit(true);
</span><ins>+ forAllValues(clobberLimit, AbstractValue::observeInvalidationPointFor);
+ m_state.setStructureClobberState(StructuresAreWatched);
</ins><span class="cx"> break;
</span><span class="cx">
</span><span class="cx"> case CheckWatchdogTimer:
</span><span class="lines">@@ -1955,6 +1986,7 @@
</span><span class="cx"> template<typename AbstractStateType>
</span><span class="cx"> void AbstractInterpreter<AbstractStateType>::clobberCapturedVars(const CodeOrigin& codeOrigin)
</span><span class="cx"> {
</span><ins>+ SamplingRegion samplingRegion("DFG AI Clobber Captured Vars");
</ins><span class="cx"> if (codeOrigin.inlineCallFrame) {
</span><span class="cx"> const BitVector& capturedVars = codeOrigin.inlineCallFrame->capturedVars;
</span><span class="cx"> for (size_t i = capturedVars.size(); i--;) {
</span><span class="lines">@@ -1976,40 +2008,80 @@
</span><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> template<typename AbstractStateType>
</span><del>-void AbstractInterpreter<AbstractStateType>::clobberStructures(unsigned clobberLimit)
</del><ins>+template<typename Functor>
+void AbstractInterpreter<AbstractStateType>::forAllValues(
+ unsigned clobberLimit, Functor& functor)
</ins><span class="cx"> {
</span><del>- if (!m_state.haveStructures())
- return;
</del><ins>+ SamplingRegion samplingRegion("DFG AI For All Values");
</ins><span class="cx"> if (clobberLimit >= m_state.block()->size())
</span><span class="cx"> clobberLimit = m_state.block()->size();
</span><span class="cx"> else
</span><span class="cx"> clobberLimit++;
</span><span class="cx"> ASSERT(clobberLimit <= m_state.block()->size());
</span><span class="cx"> for (size_t i = clobberLimit; i--;)
</span><del>- forNode(m_state.block()->at(i)).clobberStructures();
</del><ins>+ functor(forNode(m_state.block()->at(i)));
</ins><span class="cx"> if (m_graph.m_form == SSA) {
</span><span class="cx"> HashSet<Node*>::iterator iter = m_state.block()->ssa->liveAtHead.begin();
</span><span class="cx"> HashSet<Node*>::iterator end = m_state.block()->ssa->liveAtHead.end();
</span><span class="cx"> for (; iter != end; ++iter)
</span><del>- forNode(*iter).clobberStructures();
</del><ins>+ functor(forNode(*iter));
</ins><span class="cx"> }
</span><span class="cx"> for (size_t i = m_state.variables().numberOfArguments(); i--;)
</span><del>- m_state.variables().argument(i).clobberStructures();
</del><ins>+ functor(m_state.variables().argument(i));
</ins><span class="cx"> for (size_t i = m_state.variables().numberOfLocals(); i--;)
</span><del>- m_state.variables().local(i).clobberStructures();
- m_state.setHaveStructures(true);
</del><ins>+ functor(m_state.variables().local(i));
+}
+
+template<typename AbstractStateType>
+void AbstractInterpreter<AbstractStateType>::clobberStructures(unsigned clobberLimit)
+{
+ SamplingRegion samplingRegion("DFG AI Clobber Structures");
+ forAllValues(clobberLimit, AbstractValue::clobberStructuresFor);
+ setDidClobber();
+}
+
+template<typename AbstractStateType>
+void AbstractInterpreter<AbstractStateType>::observeTransition(
+ unsigned clobberLimit, Structure* from, Structure* to)
+{
+ AbstractValue::TransitionObserver transitionObserver(from, to);
+ forAllValues(clobberLimit, transitionObserver);
+ setDidClobber();
+}
+
+template<typename AbstractStateType>
+void AbstractInterpreter<AbstractStateType>::observeTransitions(
+ unsigned clobberLimit, const TransitionVector& vector)
+{
+ AbstractValue::TransitionsObserver transitionsObserver(vector);
+ forAllValues(clobberLimit, transitionsObserver);
+ setDidClobber();
+}
+
+template<typename AbstractStateType>
+void AbstractInterpreter<AbstractStateType>::setDidClobber()
+{
</ins><span class="cx"> m_state.setDidClobber(true);
</span><ins>+ m_state.setStructureClobberState(StructuresAreClobbered);
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> template<typename AbstractStateType>
</span><ins>+void AbstractInterpreter<AbstractStateType>::dump(PrintStream& out) const
+{
+ const_cast<AbstractInterpreter<AbstractStateType>*>(this)->dump(out);
+}
+
+template<typename AbstractStateType>
</ins><span class="cx"> void AbstractInterpreter<AbstractStateType>::dump(PrintStream& out)
</span><span class="cx"> {
</span><span class="cx"> CommaPrinter comma(" ");
</span><ins>+ HashSet<Node*> seen;
</ins><span class="cx"> if (m_graph.m_form == SSA) {
</span><span class="cx"> HashSet<Node*>::iterator iter = m_state.block()->ssa->liveAtHead.begin();
</span><span class="cx"> HashSet<Node*>::iterator end = m_state.block()->ssa->liveAtHead.end();
</span><span class="cx"> for (; iter != end; ++iter) {
</span><span class="cx"> Node* node = *iter;
</span><ins>+ seen.add(node);
</ins><span class="cx"> AbstractValue& value = forNode(node);
</span><span class="cx"> if (value.isClear())
</span><span class="cx"> continue;
</span><span class="lines">@@ -2018,11 +2090,25 @@
</span><span class="cx"> }
</span><span class="cx"> for (size_t i = 0; i < m_state.block()->size(); ++i) {
</span><span class="cx"> Node* node = m_state.block()->at(i);
</span><ins>+ seen.add(node);
</ins><span class="cx"> AbstractValue& value = forNode(node);
</span><span class="cx"> if (value.isClear())
</span><span class="cx"> continue;
</span><span class="cx"> out.print(comma, node, ":", value);
</span><span class="cx"> }
</span><ins>+ if (m_graph.m_form == SSA) {
+ HashSet<Node*>::iterator iter = m_state.block()->ssa->liveAtTail.begin();
+ HashSet<Node*>::iterator end = m_state.block()->ssa->liveAtTail.end();
+ for (; iter != end; ++iter) {
+ Node* node = *iter;
+ if (seen.contains(node))
+ continue;
+ AbstractValue& value = forNode(node);
+ if (value.isClear())
+ continue;
+ out.print(comma, node, ":", value);
+ }
+ }
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> template<typename AbstractStateType>
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGAbstractValuecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGAbstractValue.cpp (171379 => 171380)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGAbstractValue.cpp 2014-07-23 01:12:32 UTC (rev 171379)
+++ trunk/Source/JavaScriptCore/dfg/DFGAbstractValue.cpp 2014-07-23 01:19:50 UTC (rev 171380)
</span><span class="lines">@@ -33,16 +33,29 @@
</span><span class="cx">
</span><span class="cx"> namespace JSC { namespace DFG {
</span><span class="cx">
</span><ins>+void AbstractValue::observeTransitions(const TransitionVector& vector)
+{
+ if (m_type & SpecCell) {
+ m_structure.observeTransitions(vector);
+ ArrayModes newModes = 0;
+ for (unsigned i = vector.size(); i--;) {
+ if (m_arrayModes & asArrayModes(vector[i].previous->indexingType()))
+ newModes |= asArrayModes(vector[i].next->indexingType());
+ }
+ m_arrayModes |= newModes;
+ }
+ checkConsistency();
+}
+
</ins><span class="cx"> void AbstractValue::setMostSpecific(Graph& graph, JSValue value)
</span><span class="cx"> {
</span><span class="cx"> if (!!value && value.isCell()) {
</span><span class="cx"> Structure* structure = value.asCell()->structure();
</span><del>- m_currentKnownStructure = structure;
- setFuturePossibleStructure(graph, structure);
</del><ins>+ graph.watchpoints().consider(structure);
+ m_structure = structure;
</ins><span class="cx"> m_arrayModes = asArrayModes(structure->indexingType());
</span><span class="cx"> } else {
</span><del>- m_currentKnownStructure.clear();
- m_futurePossibleStructure.clear();
</del><ins>+ m_structure.clear();
</ins><span class="cx"> m_arrayModes = 0;
</span><span class="cx"> }
</span><span class="cx">
</span><span class="lines">@@ -50,19 +63,30 @@
</span><span class="cx"> m_value = value;
</span><span class="cx">
</span><span class="cx"> checkConsistency();
</span><ins>+ assertIsWatched(graph);
</ins><span class="cx"> }
</span><span class="cx">
</span><del>-void AbstractValue::set(Graph& graph, JSValue value)
</del><ins>+void AbstractValue::set(Graph& graph, JSValue value, StructureClobberState clobberState)
</ins><span class="cx"> {
</span><span class="cx"> if (!!value && value.isCell()) {
</span><del>- m_currentKnownStructure.makeTop();
</del><span class="cx"> Structure* structure = value.asCell()->structure();
</span><del>- setFuturePossibleStructure(graph, structure);
- m_arrayModes = asArrayModes(structure->indexingType());
- clobberArrayModes();
</del><ins>+ if (graph.watchpoints().consider(structure)) {
+ // We should be able to assume that the watchpoint for this has already been set.
+ // But we can't because our view of what structure a value has keeps changing. That's
+ // why we call consider().
+ // https://bugs.webkit.org/show_bug.cgi?id=133426
+ m_structure = structure;
+ if (clobberState == StructuresAreClobbered) {
+ m_arrayModes = ALL_ARRAY_MODES;
+ m_structure.clobber();
+ } else
+ m_arrayModes = asArrayModes(structure->indexingType());
+ } else {
+ m_structure.makeTop();
+ m_arrayModes = ALL_ARRAY_MODES;
+ }
</ins><span class="cx"> } else {
</span><del>- m_currentKnownStructure.clear();
- m_futurePossibleStructure.clear();
</del><ins>+ m_structure.clear();
</ins><span class="cx"> m_arrayModes = 0;
</span><span class="cx"> }
</span><span class="cx">
</span><span class="lines">@@ -70,19 +94,31 @@
</span><span class="cx"> m_value = value;
</span><span class="cx">
</span><span class="cx"> checkConsistency();
</span><ins>+ assertIsWatched(graph);
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> void AbstractValue::set(Graph& graph, Structure* structure)
</span><span class="cx"> {
</span><del>- m_currentKnownStructure = structure;
- setFuturePossibleStructure(graph, structure);
</del><ins>+ m_structure = structure;
</ins><span class="cx"> m_arrayModes = asArrayModes(structure->indexingType());
</span><span class="cx"> m_type = speculationFromStructure(structure);
</span><span class="cx"> m_value = JSValue();
</span><span class="cx">
</span><span class="cx"> checkConsistency();
</span><ins>+ assertIsWatched(graph);
</ins><span class="cx"> }
</span><span class="cx">
</span><ins>+void AbstractValue::set(Graph& graph, const StructureSet& set)
+{
+ m_structure = set;
+ m_arrayModes = set.arrayModesFromStructures();
+ m_type = set.speculationFromStructures();
+ m_value = JSValue();
+
+ checkConsistency();
+ assertIsWatched(graph);
+}
+
</ins><span class="cx"> void AbstractValue::fixTypeForRepresentation(NodeFlags representation)
</span><span class="cx"> {
</span><span class="cx"> if (representation == NodeResultDouble) {
</span><span class="lines">@@ -141,21 +177,18 @@
</span><span class="cx">
</span><span class="cx"> m_type &= other.speculationFromStructures();
</span><span class="cx"> m_arrayModes &= other.arrayModesFromStructures();
</span><del>- m_currentKnownStructure.filter(other);
</del><ins>+ m_structure.filter(other);
</ins><span class="cx">
</span><span class="cx"> // It's possible that prior to the above two statements we had (Foo, TOP), where
</span><span class="cx"> // Foo is a SpeculatedType that is disjoint with the passed StructureSet. In that
</span><span class="cx"> // case, we will now have (None, [someStructure]). In general, we need to make
</span><span class="cx"> // sure that new information gleaned from the SpeculatedType needs to be fed back
</span><span class="cx"> // into the information gleaned from the StructureSet.
</span><del>- m_currentKnownStructure.filter(m_type);
</del><ins>+ m_structure.filter(m_type);
</ins><span class="cx">
</span><del>- if (m_currentKnownStructure.hasSingleton())
- setFuturePossibleStructure(graph, m_currentKnownStructure.singleton());
-
</del><span class="cx"> filterArrayModesByType();
</span><span class="cx"> filterValueByType();
</span><del>- return normalizeClarity();
</del><ins>+ return normalizeClarity(graph);
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> FiltrationResult AbstractValue::filterArrayModes(ArrayModes arrayModes)
</span><span class="lines">@@ -175,14 +208,26 @@
</span><span class="cx"> if ((m_type & type) == m_type)
</span><span class="cx"> return FiltrationOK;
</span><span class="cx">
</span><ins>+ // Fast path for the case that we don't even have a cell.
+ if (!(m_type & SpecCell)) {
+ m_type &= type;
+ FiltrationResult result;
+ if (m_type == SpecNone) {
+ clear();
+ result = Contradiction;
+ } else
+ result = FiltrationOK;
+ checkConsistency();
+ return result;
+ }
+
</ins><span class="cx"> m_type &= type;
</span><span class="cx">
</span><span class="cx"> // It's possible that prior to this filter() call we had, say, (Final, TOP), and
</span><span class="cx"> // the passed type is Array. At this point we'll have (None, TOP). The best way
</span><span class="cx"> // to ensure that the structure filtering does the right thing is to filter on
</span><span class="cx"> // the new type (None) rather than the one passed (Array).
</span><del>- m_currentKnownStructure.filter(m_type);
- m_futurePossibleStructure.filter(m_type);
</del><ins>+ m_structure.filter(type);
</ins><span class="cx"> filterArrayModesByType();
</span><span class="cx"> filterValueByType();
</span><span class="cx"> return normalizeClarity();
</span><span class="lines">@@ -196,15 +241,6 @@
</span><span class="cx"> return result;
</span><span class="cx"> }
</span><span class="cx">
</span><del>-void AbstractValue::setFuturePossibleStructure(Graph& graph, Structure* structure)
-{
- ASSERT(structure);
- if (graph.watchpoints().isStillValid(structure->transitionWatchpointSet()))
- m_futurePossibleStructure = structure;
- else
- m_futurePossibleStructure.makeTop();
-}
-
</del><span class="cx"> void AbstractValue::filterValueByType()
</span><span class="cx"> {
</span><span class="cx"> // We could go further, and ensure that if the futurePossibleStructure contravenes
</span><span class="lines">@@ -250,8 +286,7 @@
</span><span class="cx"> return true;
</span><span class="cx">
</span><span class="cx"> if (!(m_type & ~SpecCell)
</span><del>- && (!m_arrayModes
- || m_currentKnownStructure.isClear()))
</del><ins>+ && (!m_arrayModes || m_structure.isClear()))
</ins><span class="cx"> return true;
</span><span class="cx">
</span><span class="cx"> return false;
</span><span class="lines">@@ -275,12 +310,18 @@
</span><span class="cx"> return result;
</span><span class="cx"> }
</span><span class="cx">
</span><ins>+FiltrationResult AbstractValue::normalizeClarity(Graph& graph)
+{
+ FiltrationResult result = normalizeClarity();
+ assertIsWatched(graph);
+ return result;
+}
+
</ins><span class="cx"> #if !ASSERT_DISABLED
</span><span class="cx"> void AbstractValue::checkConsistency() const
</span><span class="cx"> {
</span><span class="cx"> if (!(m_type & SpecCell)) {
</span><del>- ASSERT(m_currentKnownStructure.isClear());
- ASSERT(m_futurePossibleStructure.isClear());
</del><ins>+ ASSERT(m_structure.isClear());
</ins><span class="cx"> ASSERT(!m_arrayModes);
</span><span class="cx"> }
</span><span class="cx">
</span><span class="lines">@@ -301,6 +342,11 @@
</span><span class="cx"> // we don't want to get pedantic about this as it would only increase the computational
</span><span class="cx"> // complexity of the code.
</span><span class="cx"> }
</span><ins>+
+void AbstractValue::assertIsWatched(Graph& graph) const
+{
+ m_structure.assertIsWatched(graph);
+}
</ins><span class="cx"> #endif
</span><span class="cx">
</span><span class="cx"> void AbstractValue::dump(PrintStream& out) const
</span><span class="lines">@@ -314,8 +360,7 @@
</span><span class="cx"> if (m_type & SpecCell) {
</span><span class="cx"> out.print(
</span><span class="cx"> ", ", ArrayModesDump(m_arrayModes), ", ",
</span><del>- inContext(m_currentKnownStructure, context), ", ",
- inContext(m_futurePossibleStructure, context));
</del><ins>+ inContext(m_structure, context));
</ins><span class="cx"> }
</span><span class="cx"> if (!!m_value)
</span><span class="cx"> out.print(", ", inContext(m_value, context));
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGAbstractValueh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGAbstractValue.h (171379 => 171380)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGAbstractValue.h 2014-07-23 01:12:32 UTC (rev 171379)
+++ trunk/Source/JavaScriptCore/dfg/DFGAbstractValue.h 2014-07-23 01:19:50 UTC (rev 171380)
</span><span class="lines">@@ -32,6 +32,7 @@
</span><span class="cx"> #include "DFGFiltrationResult.h"
</span><span class="cx"> #include "DFGNodeFlags.h"
</span><span class="cx"> #include "DFGStructureAbstractValue.h"
</span><ins>+#include "DFGStructureClobberState.h"
</ins><span class="cx"> #include "JSCell.h"
</span><span class="cx"> #include "SpeculatedType.h"
</span><span class="cx"> #include "DumpContext.h"
</span><span class="lines">@@ -53,8 +54,7 @@
</span><span class="cx"> {
</span><span class="cx"> m_type = SpecNone;
</span><span class="cx"> m_arrayModes = 0;
</span><del>- m_currentKnownStructure.clear();
- m_futurePossibleStructure.clear();
</del><ins>+ m_structure.clear();
</ins><span class="cx"> m_value = JSValue();
</span><span class="cx"> checkConsistency();
</span><span class="cx"> }
</span><span class="lines">@@ -75,15 +75,74 @@
</span><span class="cx"> void clobberStructures()
</span><span class="cx"> {
</span><span class="cx"> if (m_type & SpecCell) {
</span><del>- m_currentKnownStructure.makeTop();
</del><ins>+ m_structure.clobber();
</ins><span class="cx"> clobberArrayModes();
</span><span class="cx"> } else {
</span><del>- ASSERT(m_currentKnownStructure.isClear());
</del><ins>+ ASSERT(m_structure.isClear());
</ins><span class="cx"> ASSERT(!m_arrayModes);
</span><span class="cx"> }
</span><span class="cx"> checkConsistency();
</span><span class="cx"> }
</span><ins>+
+ static void clobberStructuresFor(AbstractValue& value)
+ {
+ value.clobberStructures();
+ }
+
+ void observeInvalidationPoint()
+ {
+ m_structure.observeInvalidationPoint();
+ checkConsistency();
+ }
+
+ static void observeInvalidationPointFor(AbstractValue& value)
+ {
+ value.observeInvalidationPoint();
+ }
+
+ void observeTransition(Structure* from, Structure* to)
+ {
+ if (m_type & SpecCell) {
+ m_structure.observeTransition(from, to);
+ observeIndexingTypeTransition(from->indexingType(), to->indexingType());
+ }
+ checkConsistency();
+ }
+
+ void observeTransitions(const TransitionVector& vector);
+
+ class TransitionObserver {
+ public:
+ TransitionObserver(Structure* from, Structure* to)
+ : m_from(from)
+ , m_to(to)
+ {
+ }
</ins><span class="cx">
</span><ins>+ void operator()(AbstractValue& value)
+ {
+ value.observeTransition(m_from, m_to);
+ }
+ private:
+ Structure* m_from;
+ Structure* m_to;
+ };
+
+ class TransitionsObserver {
+ public:
+ TransitionsObserver(const TransitionVector& vector)
+ : m_vector(vector)
+ {
+ }
+
+ void operator()(AbstractValue& value)
+ {
+ value.observeTransitions(m_vector);
+ }
+ private:
+ const TransitionVector& m_vector;
+ };
+
</ins><span class="cx"> void clobberValue()
</span><span class="cx"> {
</span><span class="cx"> m_value = JSValue();
</span><span class="lines">@@ -91,7 +150,10 @@
</span><span class="cx">
</span><span class="cx"> bool isHeapTop() const
</span><span class="cx"> {
</span><del>- return (m_type | SpecHeapTop) == m_type && m_currentKnownStructure.isTop() && m_futurePossibleStructure.isTop();
</del><ins>+ return (m_type | SpecHeapTop) == m_type
+ && m_structure.isTop()
+ && m_arrayModes == ALL_ARRAY_MODES
+ && !m_value;
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> bool valueIsTop() const
</span><span class="lines">@@ -112,18 +174,17 @@
</span><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> void setMostSpecific(Graph&, JSValue);
</span><del>- void set(Graph&, JSValue);
</del><ins>+ void set(Graph&, JSValue, StructureClobberState);
</ins><span class="cx"> void set(Graph&, Structure*);
</span><ins>+ void set(Graph&, const StructureSet&);
</ins><span class="cx">
</span><span class="cx"> void setType(SpeculatedType type)
</span><span class="cx"> {
</span><span class="cx"> if (type & SpecCell) {
</span><del>- m_currentKnownStructure.makeTop();
- m_futurePossibleStructure.makeTop();
</del><ins>+ m_structure.makeTop();
</ins><span class="cx"> m_arrayModes = ALL_ARRAY_MODES;
</span><span class="cx"> } else {
</span><del>- m_currentKnownStructure.clear();
- m_futurePossibleStructure.clear();
</del><ins>+ m_structure.clear();
</ins><span class="cx"> m_arrayModes = 0;
</span><span class="cx"> }
</span><span class="cx"> m_type = type;
</span><span class="lines">@@ -138,8 +199,7 @@
</span><span class="cx"> {
</span><span class="cx"> return m_type == other.m_type
</span><span class="cx"> && m_arrayModes == other.m_arrayModes
</span><del>- && m_currentKnownStructure == other.m_currentKnownStructure
- && m_futurePossibleStructure == other.m_futurePossibleStructure
</del><ins>+ && m_structure == other.m_structure
</ins><span class="cx"> && m_value == other.m_value;
</span><span class="cx"> }
</span><span class="cx"> bool operator!=(const AbstractValue& other) const
</span><span class="lines">@@ -162,8 +222,7 @@
</span><span class="cx"> } else {
</span><span class="cx"> result |= mergeSpeculation(m_type, other.m_type);
</span><span class="cx"> result |= mergeArrayModes(m_arrayModes, other.m_arrayModes);
</span><del>- result |= m_currentKnownStructure.addAll(other.m_currentKnownStructure);
- result |= m_futurePossibleStructure.addAll(other.m_futurePossibleStructure);
</del><ins>+ result |= m_structure.merge(other.m_structure);
</ins><span class="cx"> if (m_value != other.m_value) {
</span><span class="cx"> result |= !!m_value;
</span><span class="cx"> m_value = JSValue();
</span><span class="lines">@@ -179,8 +238,7 @@
</span><span class="cx"> mergeSpeculation(m_type, type);
</span><span class="cx">
</span><span class="cx"> if (type & SpecCell) {
</span><del>- m_currentKnownStructure.makeTop();
- m_futurePossibleStructure.makeTop();
</del><ins>+ m_structure.makeTop();
</ins><span class="cx"> m_arrayModes = ALL_ARRAY_MODES;
</span><span class="cx"> }
</span><span class="cx"> m_value = JSValue();
</span><span class="lines">@@ -225,75 +283,30 @@
</span><span class="cx"> if (!!value && value.isCell()) {
</span><span class="cx"> ASSERT(m_type & SpecCell);
</span><span class="cx"> Structure* structure = value.asCell()->structure();
</span><del>- return m_currentKnownStructure.contains(structure)
- && m_futurePossibleStructure.contains(structure)
</del><ins>+ return m_structure.contains(structure)
</ins><span class="cx"> && (m_arrayModes & asArrayModes(structure->indexingType()));
</span><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> return true;
</span><span class="cx"> }
</span><span class="cx">
</span><del>- Structure* bestProvenStructure() const
- {
- if (m_currentKnownStructure.hasSingleton())
- return m_currentKnownStructure.singleton();
- if (m_futurePossibleStructure.hasSingleton())
- return m_futurePossibleStructure.singleton();
- return 0;
- }
-
</del><span class="cx"> bool hasClobberableState() const
</span><span class="cx"> {
</span><del>- return m_currentKnownStructure.isNeitherClearNorTop()
</del><ins>+ return m_structure.isNeitherClearNorTop()
</ins><span class="cx"> || !arrayModesAreClearOrTop(m_arrayModes);
</span><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> #if ASSERT_DISABLED
</span><span class="cx"> void checkConsistency() const { }
</span><ins>+ void assertIsWatched(Graph&) const { }
</ins><span class="cx"> #else
</span><span class="cx"> void checkConsistency() const;
</span><ins>+ void assertIsWatched(Graph&) const;
</ins><span class="cx"> #endif
</span><span class="cx">
</span><span class="cx"> void dumpInContext(PrintStream&, DumpContext*) const;
</span><span class="cx"> void dump(PrintStream&) const;
</span><span class="cx">
</span><del>- // A great way to think about the difference between m_currentKnownStructure and
- // m_futurePossibleStructure is to consider these four examples:
- //
- // 1) x = foo();
- //
- // In this case x's m_currentKnownStructure and m_futurePossibleStructure will
- // both be TOP, since we don't know anything about x for sure, yet.
- //
- // 2) x = foo();
- // y = x.f;
- //
- // Where x will later have a new property added to it, 'g'. Because of the
- // known but not-yet-executed property addition, x's current structure will
- // not be watchpointable; hence we have no way of statically bounding the set
- // of possible structures that x may have if a clobbering event happens. So,
- // x's m_currentKnownStructure will be whatever structure we check to get
- // property 'f', and m_futurePossibleStructure will be TOP.
- //
- // 3) x = foo();
- // y = x.f;
- //
- // Where x has a terminal structure that is still watchpointable. In this case,
- // x's m_currentKnownStructure and m_futurePossibleStructure will both be
- // whatever structure we checked for when getting 'f'.
- //
- // 4) x = foo();
- // y = x.f;
- // bar();
- //
- // Where x has a terminal structure that is still watchpointable. In this
- // case, m_currentKnownStructure will be TOP because bar() may potentially
- // change x's structure and we have no way of proving otherwise, but
- // x's m_futurePossibleStructure will be whatever structure we had checked
- // when getting property 'f'.
-
- // NB. All fields in this struct must have trivial destructors.
-
</del><span class="cx"> // This is a proven constraint on the structures that this value can have right
</span><span class="cx"> // now. The structure of the current value must belong to this set. The set may
</span><span class="cx"> // be TOP, indicating that it is the set of all possible structures, in which
</span><span class="lines">@@ -301,30 +314,13 @@
</span><span class="cx"> // in which case this value cannot be a cell. This is all subject to change
</span><span class="cx"> // anytime a new value is assigned to this one, anytime there is a control flow
</span><span class="cx"> // merge, or most crucially, anytime a side-effect or structure check happens.
</span><del>- // In case of a side-effect, we typically must assume that any value may have
- // had its structure changed, hence contravening our proof. We make the proof
- // valid again by switching this to TOP (i.e. claiming that we have proved that
- // this value may have any structure). Of note is that the proof represented by
- // this field is not subject to structure transition watchpoints - even if one
- // fires, we can be sure that this proof is still valid.
- StructureAbstractValue m_currentKnownStructure;
</del><ins>+ // In case of a side-effect, we must assume that any value with a structure that
+ // isn't being watched may have had its structure changed, hence contravening
+ // our proof. In such a case we make the proof valid again by switching this to
+ // TOP (i.e. claiming that we have proved that this value may have any
+ // structure).
+ StructureAbstractValue m_structure;
</ins><span class="cx">
</span><del>- // This is a proven constraint on the structures that this value can have now
- // or any time in the future subject to the structure transition watchpoints of
- // all members of this set not having fired. This set is impervious to side-
- // effects; even if one happens the side-effect can only cause the value to
- // change to at worst another structure that is also a member of this set. But,
- // the theorem being proved by this field is predicated upon there not being
- // any new structure transitions introduced into any members of this set. In
- // cases where there is no way for us to guard this happening, the set must be
- // TOP. But in cases where we can guard new structure transitions (all members
- // of the set have still-valid structure transition watchpoints) then this set
- // will be finite. Anytime that we make use of the finite nature of this set,
- // we must first issue a structure transition watchpoint, which will effectively
- // result in m_currentKnownStructure being filtered according to
- // m_futurePossibleStructure.
- StructureAbstractValue m_futurePossibleStructure;
-
</del><span class="cx"> // This is a proven constraint on the possible types that this value can have
</span><span class="cx"> // now or any time in the future, unless it is reassigned. This field is
</span><span class="cx"> // impervious to side-effects unless the side-effect can reassign the value
</span><span class="lines">@@ -332,11 +328,11 @@
</span><span class="cx"> // between this field, and the structure fields above, is as follows. The
</span><span class="cx"> // fields above constraint the structures that a cell may have, but they say
</span><span class="cx"> // nothing about whether or not the value is known to be a cell. More formally,
</span><del>- // the m_currentKnownStructure is itself an abstract value that consists of the
</del><ins>+ // the m_structure is itself an abstract value that consists of the
</ins><span class="cx"> // union of the set of all non-cell values and the set of cell values that have
</span><span class="cx"> // the given structure. This abstract value is then the intersection of the
</span><del>- // m_currentKnownStructure and the set of values whose type is m_type. So, for
- // example if m_type is SpecFinal|SpecInt32 and m_currentKnownStructure is
</del><ins>+ // m_structure and the set of values whose type is m_type. So, for
+ // example if m_type is SpecFinal|SpecInt32 and m_structure is
</ins><span class="cx"> // [0x12345] then this abstract value corresponds to the set of all integers
</span><span class="cx"> // unified with the set of all objects with structure 0x12345.
</span><span class="cx"> SpeculatedType m_type;
</span><span class="lines">@@ -364,6 +360,12 @@
</span><span class="cx"> m_arrayModes = ALL_ARRAY_MODES;
</span><span class="cx"> }
</span><span class="cx">
</span><ins>+ void observeIndexingTypeTransition(IndexingType from, IndexingType to)
+ {
+ if (m_arrayModes & asArrayModes(from))
+ m_arrayModes |= asArrayModes(to);
+ }
+
</ins><span class="cx"> bool validateType(JSValue value) const
</span><span class="cx"> {
</span><span class="cx"> if (isHeapTop())
</span><span class="lines">@@ -391,19 +393,17 @@
</span><span class="cx"> {
</span><span class="cx"> m_type |= top;
</span><span class="cx"> m_arrayModes = ALL_ARRAY_MODES;
</span><del>- m_currentKnownStructure.makeTop();
- m_futurePossibleStructure.makeTop();
</del><ins>+ m_structure.makeTop();
</ins><span class="cx"> m_value = JSValue();
</span><span class="cx"> checkConsistency();
</span><span class="cx"> }
</span><span class="cx">
</span><del>- void setFuturePossibleStructure(Graph&, Structure*);
-
</del><span class="cx"> void filterValueByType();
</span><span class="cx"> void filterArrayModesByType();
</span><span class="cx">
</span><span class="cx"> bool shouldBeClear() const;
</span><span class="cx"> FiltrationResult normalizeClarity();
</span><ins>+ FiltrationResult normalizeClarity(Graph&);
</ins><span class="cx"> };
</span><span class="cx">
</span><span class="cx"> } } // namespace JSC::DFG
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGAllocatorh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGAllocator.h (171379 => 171380)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGAllocator.h 2014-07-23 01:12:32 UTC (rev 171379)
+++ trunk/Source/JavaScriptCore/dfg/DFGAllocator.h 2014-07-23 01:19:50 UTC (rev 171380)
</span><span class="lines">@@ -50,7 +50,7 @@
</span><span class="cx"> void* allocate(); // Use placement new to allocate, and avoid using this method.
</span><span class="cx"> void free(T*); // Call this method to delete; never use 'delete' directly.
</span><span class="cx">
</span><del>- void freeAll(); // Only call this if T has a trivial destructor.
</del><ins>+ void freeAll(); // Only call this if you've either freed everything or if T has a trivial destructor.
</ins><span class="cx"> void reset(); // Like freeAll(), but also returns all memory to the OS.
</span><span class="cx">
</span><span class="cx"> unsigned indexOf(const T*);
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGArgumentsSimplificationPhasecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGArgumentsSimplificationPhase.cpp (171379 => 171380)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGArgumentsSimplificationPhase.cpp 2014-07-23 01:12:32 UTC (rev 171379)
+++ trunk/Source/JavaScriptCore/dfg/DFGArgumentsSimplificationPhase.cpp 2014-07-23 01:19:50 UTC (rev 171380)
</span><span class="lines">@@ -325,7 +325,6 @@
</span><span class="cx"> break;
</span><span class="cx">
</span><span class="cx"> case CheckStructure:
</span><del>- case StructureTransitionWatchpoint:
</del><span class="cx"> case CheckArray:
</span><span class="cx"> // We don't care about these because if we get uses of the relevant
</span><span class="cx"> // variable then we can safely get rid of these, too. This of course
</span><span class="lines">@@ -441,7 +440,6 @@
</span><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> case CheckStructure:
</span><del>- case StructureTransitionWatchpoint:
</del><span class="cx"> case CheckArray: {
</span><span class="cx"> // We can just get rid of this node, if it references a phantom argument.
</span><span class="cx"> if (!isOKToOptimize(node->child1().node()))
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGArrayModecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGArrayMode.cpp (171379 => 171380)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGArrayMode.cpp 2014-07-23 01:12:32 UTC (rev 171379)
+++ trunk/Source/JavaScriptCore/dfg/DFGArrayMode.cpp 2014-07-23 01:19:50 UTC (rev 171380)
</span><span class="lines">@@ -289,25 +289,48 @@
</span><span class="cx"> bool ArrayMode::alreadyChecked(Graph& graph, Node* node, AbstractValue& value, IndexingType shape) const
</span><span class="cx"> {
</span><span class="cx"> switch (arrayClass()) {
</span><del>- case Array::OriginalArray:
- return value.m_currentKnownStructure.hasSingleton()
- && (value.m_currentKnownStructure.singleton()->indexingType() & IndexingShapeMask) == shape
- && (value.m_currentKnownStructure.singleton()->indexingType() & IsArray)
- && graph.globalObjectFor(node->origin.semantic)->isOriginalArrayStructure(value.m_currentKnownStructure.singleton());
</del><ins>+ case Array::OriginalArray: {
+ if (value.m_structure.isTop())
+ return false;
+ for (unsigned i = value.m_structure.size(); i--;) {
+ Structure* structure = value.m_structure[i];
+ if ((structure->indexingType() & IndexingShapeMask) != shape)
+ return false;
+ if (!(structure->indexingType() & IsArray))
+ return false;
+ if (!graph.globalObjectFor(node->origin.semantic)->isOriginalArrayStructure(structure))
+ return false;
+ }
+ return true;
+ }
</ins><span class="cx">
</span><del>- case Array::Array:
</del><ins>+ case Array::Array: {
</ins><span class="cx"> if (arrayModesAlreadyChecked(value.m_arrayModes, asArrayModes(shape | IsArray)))
</span><span class="cx"> return true;
</span><del>- return value.m_currentKnownStructure.hasSingleton()
- && (value.m_currentKnownStructure.singleton()->indexingType() & IndexingShapeMask) == shape
- && (value.m_currentKnownStructure.singleton()->indexingType() & IsArray);
</del><ins>+ if (value.m_structure.isTop())
+ return false;
+ for (unsigned i = value.m_structure.size(); i--;) {
+ Structure* structure = value.m_structure[i];
+ if ((structure->indexingType() & IndexingShapeMask) != shape)
+ return false;
+ if (!(structure->indexingType() & IsArray))
+ return false;
+ }
+ return true;
+ }
</ins><span class="cx">
</span><del>- default:
</del><ins>+ default: {
</ins><span class="cx"> if (arrayModesAlreadyChecked(value.m_arrayModes, asArrayModes(shape) | asArrayModes(shape | IsArray)))
</span><span class="cx"> return true;
</span><del>- return value.m_currentKnownStructure.hasSingleton()
- && (value.m_currentKnownStructure.singleton()->indexingType() & IndexingShapeMask) == shape;
- }
</del><ins>+ if (value.m_structure.isTop())
+ return false;
+ for (unsigned i = value.m_structure.size(); i--;) {
+ Structure* structure = value.m_structure[i];
+ if ((structure->indexingType() & IndexingShapeMask) != shape)
+ return false;
+ }
+ return true;
+ } }
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> bool ArrayMode::alreadyChecked(Graph& graph, Node* node, AbstractValue& value) const
</span><span class="lines">@@ -336,23 +359,38 @@
</span><span class="cx">
</span><span class="cx"> case Array::SlowPutArrayStorage:
</span><span class="cx"> switch (arrayClass()) {
</span><del>- case Array::OriginalArray:
</del><ins>+ case Array::OriginalArray: {
</ins><span class="cx"> CRASH();
</span><span class="cx"> return false;
</span><ins>+ }
</ins><span class="cx">
</span><del>- case Array::Array:
</del><ins>+ case Array::Array: {
</ins><span class="cx"> if (arrayModesAlreadyChecked(value.m_arrayModes, asArrayModes(ArrayWithArrayStorage) | asArrayModes(ArrayWithSlowPutArrayStorage)))
</span><span class="cx"> return true;
</span><del>- return value.m_currentKnownStructure.hasSingleton()
- && hasAnyArrayStorage(value.m_currentKnownStructure.singleton()->indexingType())
- && (value.m_currentKnownStructure.singleton()->indexingType() & IsArray);
</del><ins>+ if (value.m_structure.isTop())
+ return false;
+ for (unsigned i = value.m_structure.size(); i--;) {
+ Structure* structure = value.m_structure[i];
+ if (!hasAnyArrayStorage(structure->indexingType()))
+ return false;
+ if (!(structure->indexingType() & IsArray))
+ return false;
+ }
+ return true;
+ }
</ins><span class="cx">
</span><del>- default:
</del><ins>+ default: {
</ins><span class="cx"> if (arrayModesAlreadyChecked(value.m_arrayModes, asArrayModes(NonArrayWithArrayStorage) | asArrayModes(ArrayWithArrayStorage) | asArrayModes(NonArrayWithSlowPutArrayStorage) | asArrayModes(ArrayWithSlowPutArrayStorage)))
</span><span class="cx"> return true;
</span><del>- return value.m_currentKnownStructure.hasSingleton()
- && hasAnyArrayStorage(value.m_currentKnownStructure.singleton()->indexingType());
- }
</del><ins>+ if (value.m_structure.isTop())
+ return false;
+ for (unsigned i = value.m_structure.size(); i--;) {
+ Structure* structure = value.m_structure[i];
+ if (!hasAnyArrayStorage(structure->indexingType()))
+ return false;
+ }
+ return true;
+ } }
</ins><span class="cx">
</span><span class="cx"> case Array::Arguments:
</span><span class="cx"> return speculationChecked(value.m_type, SpecArguments);
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGAtTailAbstractStateh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGAtTailAbstractState.h (171379 => 171380)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGAtTailAbstractState.h 2014-07-23 01:12:32 UTC (rev 171379)
+++ trunk/Source/JavaScriptCore/dfg/DFGAtTailAbstractState.h 2014-07-23 01:19:50 UTC (rev 171380)
</span><span class="lines">@@ -54,12 +54,13 @@
</span><span class="cx">
</span><span class="cx"> bool isValid() { return m_block->cfaDidFinish; }
</span><span class="cx">
</span><ins>+ StructureClobberState structureClobberState() const { return m_block->cfaStructureClobberStateAtTail; }
+
</ins><span class="cx"> void setDidClobber(bool) { }
</span><ins>+ void setStructureClobberState(StructureClobberState state) { RELEASE_ASSERT(state == m_block->cfaStructureClobberStateAtTail); }
</ins><span class="cx"> void setIsValid(bool isValid) { m_block->cfaDidFinish = isValid; }
</span><span class="cx"> void setBranchDirection(BranchDirection) { }
</span><span class="cx"> void setFoundConstants(bool) { }
</span><del>- bool haveStructures() const { return true; } // It's always safe to return true.
- void setHaveStructures(bool) { }
</del><span class="cx">
</span><span class="cx"> private:
</span><span class="cx"> BasicBlock* m_block;
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGBasicBlockcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGBasicBlock.cpp (171379 => 171380)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGBasicBlock.cpp 2014-07-23 01:12:32 UTC (rev 171379)
+++ trunk/Source/JavaScriptCore/dfg/DFGBasicBlock.cpp 2014-07-23 01:19:50 UTC (rev 171380)
</span><span class="lines">@@ -41,6 +41,8 @@
</span><span class="cx"> , cfaShouldRevisit(false)
</span><span class="cx"> , cfaFoundConstants(false)
</span><span class="cx"> , cfaDidFinish(true)
</span><ins>+ , cfaStructureClobberStateAtHead(StructuresAreWatched)
+ , cfaStructureClobberStateAtTail(StructuresAreWatched)
</ins><span class="cx"> , cfaBranchDirection(InvalidBranchDirection)
</span><span class="cx"> #if !ASSERT_DISABLED
</span><span class="cx"> , isLinked(false)
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGBasicBlockh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGBasicBlock.h (171379 => 171380)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGBasicBlock.h 2014-07-23 01:12:32 UTC (rev 171379)
+++ trunk/Source/JavaScriptCore/dfg/DFGBasicBlock.h 2014-07-23 01:19:50 UTC (rev 171380)
</span><span class="lines">@@ -33,6 +33,7 @@
</span><span class="cx"> #include "DFGBranchDirection.h"
</span><span class="cx"> #include "DFGFlushedAt.h"
</span><span class="cx"> #include "DFGNode.h"
</span><ins>+#include "DFGStructureClobberState.h"
</ins><span class="cx"> #include "Operands.h"
</span><span class="cx"> #include <wtf/HashMap.h>
</span><span class="cx"> #include <wtf/HashSet.h>
</span><span class="lines">@@ -116,6 +117,8 @@
</span><span class="cx"> bool cfaShouldRevisit;
</span><span class="cx"> bool cfaFoundConstants;
</span><span class="cx"> bool cfaDidFinish;
</span><ins>+ StructureClobberState cfaStructureClobberStateAtHead;
+ StructureClobberState cfaStructureClobberStateAtTail;
</ins><span class="cx"> BranchDirection cfaBranchDirection;
</span><span class="cx"> #if !ASSERT_DISABLED
</span><span class="cx"> bool isLinked;
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGBranchDirectionh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGBranchDirection.h (171379 => 171380)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGBranchDirection.h 2014-07-23 01:12:32 UTC (rev 171379)
+++ trunk/Source/JavaScriptCore/dfg/DFGBranchDirection.h 2014-07-23 01:19:50 UTC (rev 171380)
</span><span class="lines">@@ -1,5 +1,5 @@
</span><span class="cx"> /*
</span><del>- * Copyright (C) 2012 Apple Inc. All rights reserved.
</del><ins>+ * Copyright (C) 2012, 2014 Apple Inc. All rights reserved.
</ins><span class="cx"> *
</span><span class="cx"> * Redistribution and use in source and binary forms, with or without
</span><span class="cx"> * modification, are permitted provided that the following conditions
</span><span class="lines">@@ -50,7 +50,7 @@
</span><span class="cx"> {
</span><span class="cx"> switch (branchDirection) {
</span><span class="cx"> case InvalidBranchDirection:
</span><del>- return "Invalid";
</del><ins>+ return "InvalidBranchDirection";
</ins><span class="cx"> case TakeTrue:
</span><span class="cx"> return "TakeTrue";
</span><span class="cx"> case TakeFalse:
</span><span class="lines">@@ -81,6 +81,15 @@
</span><span class="cx">
</span><span class="cx"> } } // namespace JSC::DFG
</span><span class="cx">
</span><ins>+namespace WTF {
+
+inline void printInternal(PrintStream& out, JSC::DFG::BranchDirection direction)
+{
+ out.print(JSC::DFG::branchDirectionToString(direction));
+}
+
+} // namespace WTF
+
</ins><span class="cx"> #endif // ENABLE(DFG_JIT)
</span><span class="cx">
</span><span class="cx"> #endif // DFGBranchDirection_h
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGByteCodeParsercpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp (171379 => 171380)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp 2014-07-23 01:12:32 UTC (rev 171379)
+++ trunk/Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp 2014-07-23 01:19:50 UTC (rev 171380)
</span><span class="lines">@@ -1921,6 +1921,7 @@
</span><span class="cx"> Node* ByteCodeParser::emitPrototypeChecks(
</span><span class="cx"> Structure* structure, IntendedStructureChain* chain)
</span><span class="cx"> {
</span><ins>+ ASSERT(structure);
</ins><span class="cx"> Node* base = 0;
</span><span class="cx"> m_graph.chains().addLazily(chain);
</span><span class="cx"> Structure* currentStructure = structure;
</span><span class="lines">@@ -1962,7 +1963,7 @@
</span><span class="cx"> for (unsigned variantIndex = getByIdStatus.numVariants(); variantIndex--;) {
</span><span class="cx"> if (getByIdStatus[variantIndex].chain()) {
</span><span class="cx"> emitPrototypeChecks(
</span><del>- getByIdStatus[variantIndex].structureSet().singletonStructure(),
</del><ins>+ getByIdStatus[variantIndex].structureSet().onlyStructure(),
</ins><span class="cx"> getByIdStatus[variantIndex].chain());
</span><span class="cx"> }
</span><span class="cx"> }
</span><span class="lines">@@ -1988,7 +1989,7 @@
</span><span class="cx">
</span><span class="cx"> if (variant.chain()) {
</span><span class="cx"> base = emitPrototypeChecks(
</span><del>- variant.structureSet().singletonStructure(), variant.chain());
</del><ins>+ variant.structureSet().onlyStructure(), variant.chain());
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> // Unless we want bugs like https://bugs.webkit.org/show_bug.cgi?id=88783, we need to
</span><span class="lines">@@ -2131,8 +2132,8 @@
</span><span class="cx"> ASSERT(variant.oldStructure()->transitionWatchpointSetHasBeenInvalidated());
</span><span class="cx">
</span><span class="cx"> Node* propertyStorage;
</span><del>- StructureTransitionData* transitionData = m_graph.addStructureTransitionData(
- StructureTransitionData(variant.oldStructure(), variant.newStructure()));
</del><ins>+ Transition* transition = m_graph.m_transitions.add(
+ variant.oldStructure(), variant.newStructure());
</ins><span class="cx">
</span><span class="cx"> if (variant.oldStructure()->outOfLineCapacity()
</span><span class="cx"> != variant.newStructure()->outOfLineCapacity()) {
</span><span class="lines">@@ -2143,10 +2144,10 @@
</span><span class="cx">
</span><span class="cx"> if (!variant.oldStructure()->outOfLineCapacity()) {
</span><span class="cx"> propertyStorage = addToGraph(
</span><del>- AllocatePropertyStorage, OpInfo(transitionData), base);
</del><ins>+ AllocatePropertyStorage, OpInfo(transition), base);
</ins><span class="cx"> } else {
</span><span class="cx"> propertyStorage = addToGraph(
</span><del>- ReallocatePropertyStorage, OpInfo(transitionData),
</del><ins>+ ReallocatePropertyStorage, OpInfo(transition),
</ins><span class="cx"> base, addToGraph(GetButterfly, base));
</span><span class="cx"> }
</span><span class="cx"> } else {
</span><span class="lines">@@ -2156,7 +2157,7 @@
</span><span class="cx"> propertyStorage = addToGraph(GetButterfly, base);
</span><span class="cx"> }
</span><span class="cx">
</span><del>- addToGraph(PutStructure, OpInfo(transitionData), base);
</del><ins>+ addToGraph(PutStructure, OpInfo(transition), base);
</ins><span class="cx">
</span><span class="cx"> addToGraph(
</span><span class="cx"> PutByOffset,
</span><span class="lines">@@ -3131,7 +3132,7 @@
</span><span class="cx"> set(VirtualRegister(dst), addToGraph(GetByIdFlush, OpInfo(identifierNumber), OpInfo(prediction), get(VirtualRegister(scope))));
</span><span class="cx"> break;
</span><span class="cx"> }
</span><del>- Node* base = cellConstantWithStructureCheck(globalObject, status[0].structureSet().singletonStructure());
</del><ins>+ Node* base = cellConstantWithStructureCheck(globalObject, status[0].structureSet().onlyStructure());
</ins><span class="cx"> addToGraph(Phantom, get(VirtualRegister(scope)));
</span><span class="cx"> if (JSValue specificValue = status[0].specificValue())
</span><span class="cx"> set(VirtualRegister(dst), cellConstant(specificValue.asCell()));
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGCFAPhasecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGCFAPhase.cpp (171379 => 171380)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGCFAPhase.cpp 2014-07-23 01:12:32 UTC (rev 171379)
+++ trunk/Source/JavaScriptCore/dfg/DFGCFAPhase.cpp 2014-07-23 01:19:50 UTC (rev 171380)
</span><span class="lines">@@ -1,5 +1,5 @@
</span><span class="cx"> /*
</span><del>- * Copyright (C) 2011, 2013 Apple Inc. All rights reserved.
</del><ins>+ * Copyright (C) 2011, 2013, 2014 Apple Inc. All rights reserved.
</ins><span class="cx"> *
</span><span class="cx"> * Redistribution and use in source and binary forms, with or without
</span><span class="cx"> * modification, are permitted provided that the following conditions
</span><span class="lines">@@ -92,8 +92,11 @@
</span><span class="cx"> if (m_verbose)
</span><span class="cx"> dataLog(" Block ", *block, ":\n");
</span><span class="cx"> m_state.beginBasicBlock(block);
</span><del>- if (m_verbose)
</del><ins>+ if (m_verbose) {
</ins><span class="cx"> dataLog(" head vars: ", block->valuesAtHead, "\n");
</span><ins>+ if (m_graph.m_form == SSA)
+ dataLog(" head regs: ", mapDump(block->ssa->valuesAtHead), "\n");
+ }
</ins><span class="cx"> for (unsigned i = 0; i < block->size(); ++i) {
</span><span class="cx"> if (m_verbose) {
</span><span class="cx"> Node* node = block->at(i);
</span><span class="lines">@@ -102,10 +105,8 @@
</span><span class="cx"> if (!safeToExecute(m_state, m_graph, node))
</span><span class="cx"> dataLog("(UNSAFE) ");
</span><span class="cx">
</span><del>- m_interpreter.dump(WTF::dataFile());
</del><ins>+ dataLog(m_state.variables(), " ", m_interpreter);
</ins><span class="cx">
</span><del>- if (m_state.haveStructures())
- dataLog(" (Have Structures)");
</del><span class="cx"> dataLogF("\n");
</span><span class="cx"> }
</span><span class="cx"> if (!m_interpreter.execute(i)) {
</span><span class="lines">@@ -121,8 +122,11 @@
</span><span class="cx"> }
</span><span class="cx"> m_changed |= m_state.endBasicBlock(MergeToSuccessors);
</span><span class="cx">
</span><del>- if (m_verbose)
</del><ins>+ if (m_verbose) {
</ins><span class="cx"> dataLog(" tail vars: ", block->valuesAtTail, "\n");
</span><ins>+ if (m_graph.m_form == SSA)
+ dataLog(" head regs: ", mapDump(block->ssa->valuesAtTail), "\n");
+ }
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> void performForwardCFA()
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGCSEPhasecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGCSEPhase.cpp (171379 => 171380)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGCSEPhase.cpp 2014-07-23 01:12:32 UTC (rev 171379)
+++ trunk/Source/JavaScriptCore/dfg/DFGCSEPhase.cpp 2014-07-23 01:19:50 UTC (rev 171380)
</span><span class="lines">@@ -460,17 +460,11 @@
</span><span class="cx"> return true;
</span><span class="cx"> break;
</span><span class="cx">
</span><del>- case StructureTransitionWatchpoint:
- if (node->child1() == child1
- && structureSet.contains(node->structure()))
- return true;
- break;
-
</del><span class="cx"> case PutStructure:
</span><span class="cx"> if (node->child1() == child1
</span><del>- && structureSet.contains(node->structureTransitionData().newStructure))
</del><ins>+ && structureSet.contains(node->transition()->next))
</ins><span class="cx"> return true;
</span><del>- if (structureSet.contains(node->structureTransitionData().previousStructure))
</del><ins>+ if (structureSet.contains(node->transition()->previous))
</ins><span class="cx"> return false;
</span><span class="cx"> break;
</span><span class="cx">
</span><span class="lines">@@ -519,12 +513,12 @@
</span><span class="cx"> switch (node->op()) {
</span><span class="cx"> case CheckStructure:
</span><span class="cx"> if (node->child1() == child1
</span><del>- && node->structureSet().containsOnly(structure))
</del><ins>+ && node->structureSet().isSubsetOf(StructureSet(structure)))
</ins><span class="cx"> return true;
</span><span class="cx"> break;
</span><span class="cx">
</span><span class="cx"> case PutStructure:
</span><del>- ASSERT(node->structureTransitionData().previousStructure != structure);
</del><ins>+ ASSERT(node->transition()->previous != structure);
</ins><span class="cx"> break;
</span><span class="cx">
</span><span class="cx"> case PutByOffset:
</span><span class="lines">@@ -547,11 +541,6 @@
</span><span class="cx"> }
</span><span class="cx"> return false;
</span><span class="cx">
</span><del>- case StructureTransitionWatchpoint:
- if (node->structure() == structure && node->child1() == child1)
- return true;
- break;
-
</del><span class="cx"> case Arrayify:
</span><span class="cx"> case ArrayifyToStructure:
</span><span class="cx"> // We could check if the arrayification could affect our structures.
</span><span class="lines">@@ -1423,13 +1412,6 @@
</span><span class="cx"> eliminate();
</span><span class="cx"> break;
</span><span class="cx">
</span><del>- case StructureTransitionWatchpoint:
- if (cseMode == StoreElimination)
- break;
- if (structureTransitionWatchpointElimination(node->structure(), node->child1().node()))
- eliminate();
- break;
-
</del><span class="cx"> case PutStructure:
</span><span class="cx"> if (cseMode == NormalCSE)
</span><span class="cx"> break;
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGClobberizeh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGClobberize.h (171379 => 171380)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGClobberize.h 2014-07-23 01:12:32 UTC (rev 171379)
+++ trunk/Source/JavaScriptCore/dfg/DFGClobberize.h 2014-07-23 01:19:50 UTC (rev 171380)
</span><span class="lines">@@ -35,15 +35,6 @@
</span><span class="cx"> namespace JSC { namespace DFG {
</span><span class="cx">
</span><span class="cx"> template<typename ReadFunctor, typename WriteFunctor>
</span><del>-void clobberizeForAllocation(ReadFunctor& read, WriteFunctor& write)
-{
- read(GCState);
- read(BarrierState);
- write(GCState);
- write(BarrierState);
-}
-
-template<typename ReadFunctor, typename WriteFunctor>
</del><span class="cx"> void clobberize(Graph& graph, Node* node, ReadFunctor& read, WriteFunctor& write)
</span><span class="cx"> {
</span><span class="cx"> // Some notes:
</span><span class="lines">@@ -133,6 +124,7 @@
</span><span class="cx"> case Int52Rep:
</span><span class="cx"> case BooleanToNumber:
</span><span class="cx"> case FiatInt52:
</span><ins>+ case MakeRope:
</ins><span class="cx"> return;
</span><span class="cx">
</span><span class="cx"> case MovHint:
</span><span class="lines">@@ -158,6 +150,8 @@
</span><span class="cx"> case Breakpoint:
</span><span class="cx"> case ProfileWillCall:
</span><span class="cx"> case ProfileDidCall:
</span><ins>+ case StoreBarrier:
+ case StoreBarrierWithNullCheck:
</ins><span class="cx"> write(SideState);
</span><span class="cx"> return;
</span><span class="cx">
</span><span class="lines">@@ -174,7 +168,8 @@
</span><span class="cx">
</span><span class="cx"> case CreateActivation:
</span><span class="cx"> case CreateArguments:
</span><del>- clobberizeForAllocation(read, write);
</del><ins>+ read(HeapObjectCount);
+ write(HeapObjectCount);
</ins><span class="cx"> write(SideState);
</span><span class="cx"> write(Watchpoint_fire);
</span><span class="cx"> return;
</span><span class="lines">@@ -186,7 +181,8 @@
</span><span class="cx"> case ToThis:
</span><span class="cx"> case CreateThis:
</span><span class="cx"> read(MiscFields);
</span><del>- clobberizeForAllocation(read, write);
</del><ins>+ read(HeapObjectCount);
+ write(HeapObjectCount);
</ins><span class="cx"> return;
</span><span class="cx">
</span><span class="cx"> case VarInjectionWatchpoint:
</span><span class="lines">@@ -424,7 +420,6 @@
</span><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> case CheckStructure:
</span><del>- case StructureTransitionWatchpoint:
</del><span class="cx"> case InstanceOf:
</span><span class="cx"> read(JSCell_structureID);
</span><span class="cx"> return;
</span><span class="lines">@@ -453,13 +448,11 @@
</span><span class="cx">
</span><span class="cx"> case AllocatePropertyStorage:
</span><span class="cx"> write(JSObject_butterfly);
</span><del>- clobberizeForAllocation(read, write);
</del><span class="cx"> return;
</span><span class="cx">
</span><span class="cx"> case ReallocatePropertyStorage:
</span><span class="cx"> read(JSObject_butterfly);
</span><span class="cx"> write(JSObject_butterfly);
</span><del>- clobberizeForAllocation(read, write);
</del><span class="cx"> return;
</span><span class="cx">
</span><span class="cx"> case GetButterfly:
</span><span class="lines">@@ -475,7 +468,6 @@
</span><span class="cx"> write(JSCell_indexingType);
</span><span class="cx"> write(JSObject_butterfly);
</span><span class="cx"> write(Watchpoint_fire);
</span><del>- clobberizeForAllocation(read, write);
</del><span class="cx"> return;
</span><span class="cx">
</span><span class="cx"> case GetIndexedPropertyStorage:
</span><span class="lines">@@ -508,10 +500,8 @@
</span><span class="cx"> write(AbstractHeap(NamedProperties, node->multiPutByOffsetData().identifierNumber));
</span><span class="cx"> if (node->multiPutByOffsetData().writesStructures())
</span><span class="cx"> write(JSCell_structureID);
</span><del>- if (node->multiPutByOffsetData().reallocatesStorage()) {
</del><ins>+ if (node->multiPutByOffsetData().reallocatesStorage())
</ins><span class="cx"> write(JSObject_butterfly);
</span><del>- clobberizeForAllocation(read, write);
- }
</del><span class="cx"> return;
</span><span class="cx">
</span><span class="cx"> case PutByOffset:
</span><span class="lines">@@ -577,15 +567,16 @@
</span><span class="cx"> case NewArrayBuffer:
</span><span class="cx"> case NewRegexp:
</span><span class="cx"> case NewStringObject:
</span><del>- case MakeRope:
</del><span class="cx"> case NewFunctionNoCheck:
</span><span class="cx"> case NewFunction:
</span><span class="cx"> case NewFunctionExpression:
</span><del>- clobberizeForAllocation(read, write);
</del><ins>+ read(HeapObjectCount);
+ write(HeapObjectCount);
</ins><span class="cx"> return;
</span><span class="cx">
</span><span class="cx"> case NewTypedArray:
</span><del>- clobberizeForAllocation(read, write);
</del><ins>+ read(HeapObjectCount);
+ write(HeapObjectCount);
</ins><span class="cx"> switch (node->child1().useKind()) {
</span><span class="cx"> case Int32Use:
</span><span class="cx"> return;
</span><span class="lines">@@ -663,7 +654,8 @@
</span><span class="cx">
</span><span class="cx"> case ThrowReferenceError:
</span><span class="cx"> write(SideState);
</span><del>- clobberizeForAllocation(read, write);
</del><ins>+ read(HeapObjectCount);
+ write(HeapObjectCount);
</ins><span class="cx"> return;
</span><span class="cx">
</span><span class="cx"> case CountExecution:
</span><span class="lines">@@ -671,12 +663,6 @@
</span><span class="cx"> read(InternalState);
</span><span class="cx"> write(InternalState);
</span><span class="cx"> return;
</span><del>-
- case StoreBarrier:
- case StoreBarrierWithNullCheck:
- read(BarrierState);
- write(BarrierState);
- return;
</del><span class="cx">
</span><span class="cx"> case LastNodeType:
</span><span class="cx"> RELEASE_ASSERT_NOT_REACHED();
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGCommoncpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGCommon.cpp (171379 => 171380)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGCommon.cpp 2014-07-23 01:12:32 UTC (rev 171379)
+++ trunk/Source/JavaScriptCore/dfg/DFGCommon.cpp 2014-07-23 01:19:50 UTC (rev 171380)
</span><span class="lines">@@ -33,15 +33,23 @@
</span><span class="cx">
</span><span class="cx"> namespace JSC { namespace DFG {
</span><span class="cx">
</span><ins>+static unsigned crashLock;
+
</ins><span class="cx"> void startCrashing()
</span><span class="cx"> {
</span><span class="cx"> #if ENABLE(COMPARE_AND_SWAP)
</span><del>- static unsigned lock;
- while (!WTF::weakCompareAndSwap(&lock, 0, 1))
</del><ins>+ while (!WTF::weakCompareAndSwap(&crashLock, 0, 1))
</ins><span class="cx"> std::this_thread::yield();
</span><ins>+#else
+ crashLock = 1;
</ins><span class="cx"> #endif
</span><span class="cx"> }
</span><span class="cx">
</span><ins>+bool isCrashing()
+{
+ return !!crashLock;
+}
+
</ins><span class="cx"> } } // namespace JSC::DFG
</span><span class="cx">
</span><span class="cx"> namespace WTF {
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGCommonh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGCommon.h (171379 => 171380)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGCommon.h 2014-07-23 01:12:32 UTC (rev 171379)
+++ trunk/Source/JavaScriptCore/dfg/DFGCommon.h 2014-07-23 01:19:50 UTC (rev 171380)
</span><span class="lines">@@ -259,6 +259,8 @@
</span><span class="cx"> // when you're forcing a crash with diagnostics.
</span><span class="cx"> void startCrashing();
</span><span class="cx">
</span><ins>+JS_EXPORT_PRIVATE bool isCrashing();
+
</ins><span class="cx"> } } // namespace JSC::DFG
</span><span class="cx">
</span><span class="cx"> namespace WTF {
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGCommonDatacpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGCommonData.cpp (171379 => 171380)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGCommonData.cpp 2014-07-23 01:12:32 UTC (rev 171379)
+++ trunk/Source/JavaScriptCore/dfg/DFGCommonData.cpp 2014-07-23 01:19:50 UTC (rev 171380)
</span><span class="lines">@@ -41,8 +41,8 @@
</span><span class="cx"> plan.transitions.addLazily(
</span><span class="cx"> codeBlock,
</span><span class="cx"> node->origin.semantic.codeOriginOwner(),
</span><del>- node->structureTransitionData().previousStructure,
- node->structureTransitionData().newStructure);
</del><ins>+ node->transition()->previous,
+ node->transition()->next);
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> unsigned CommonData::addCodeOrigin(CodeOrigin codeOrigin)
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGConstantFoldingPhasecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGConstantFoldingPhase.cpp (171379 => 171380)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGConstantFoldingPhase.cpp 2014-07-23 01:12:32 UTC (rev 171379)
+++ trunk/Source/JavaScriptCore/dfg/DFGConstantFoldingPhase.cpp 2014-07-23 01:19:50 UTC (rev 171380)
</span><span class="lines">@@ -104,27 +104,12 @@
</span><span class="cx"> set = node->structure();
</span><span class="cx"> else
</span><span class="cx"> set = node->structureSet();
</span><del>- if (value.m_currentKnownStructure.isSubsetOf(set)) {
</del><ins>+ if (value.m_structure.isSubsetOf(set)) {
</ins><span class="cx"> m_interpreter.execute(indexInBlock); // Catch the fact that we may filter on cell.
</span><span class="cx"> node->convertToPhantom();
</span><span class="cx"> eliminated = true;
</span><span class="cx"> break;
</span><span class="cx"> }
</span><del>- StructureAbstractValue& structureValue = value.m_futurePossibleStructure;
- if (structureValue.isSubsetOf(set)
- && structureValue.hasSingleton()) {
- Structure* structure = structureValue.singleton();
- m_interpreter.execute(indexInBlock); // Catch the fact that we may filter on cell.
- AdjacencyList children = node->children;
- children.removeEdge(0);
- if (!!children.child1())
- m_insertionSet.insertNode(indexInBlock, SpecNone, Phantom, node->origin, children);
- node->children.setChild2(Edge());
- node->children.setChild3(Edge());
- node->convertToStructureTransitionWatchpoint(structure);
- eliminated = true;
- break;
- }
</del><span class="cx"> break;
</span><span class="cx"> }
</span><span class="cx">
</span><span class="lines">@@ -163,7 +148,7 @@
</span><span class="cx"> Node* child = childEdge.node();
</span><span class="cx"> MultiGetByOffsetData& data = node->multiGetByOffsetData();
</span><span class="cx">
</span><del>- Structure* structure = m_state.forNode(child).bestProvenStructure();
</del><ins>+ Structure* structure = m_state.forNode(child).m_structure.onlyStructure();
</ins><span class="cx"> if (!structure)
</span><span class="cx"> break;
</span><span class="cx">
</span><span class="lines">@@ -187,7 +172,7 @@
</span><span class="cx"> Node* child = childEdge.node();
</span><span class="cx"> MultiPutByOffsetData& data = node->multiPutByOffsetData();
</span><span class="cx">
</span><del>- Structure* structure = m_state.forNode(child).bestProvenStructure();
</del><ins>+ Structure* structure = m_state.forNode(child).m_structure.onlyStructure();
</ins><span class="cx"> if (!structure)
</span><span class="cx"> break;
</span><span class="cx">
</span><span class="lines">@@ -212,7 +197,7 @@
</span><span class="cx"> if (childEdge.useKind() != CellUse)
</span><span class="cx"> break;
</span><span class="cx">
</span><del>- Structure* structure = m_state.forNode(child).bestProvenStructure();
</del><ins>+ Structure* structure = m_state.forNode(child).m_structure.onlyStructure();
</ins><span class="cx"> if (!structure)
</span><span class="cx"> break;
</span><span class="cx">
</span><span class="lines">@@ -239,7 +224,7 @@
</span><span class="cx">
</span><span class="cx"> ASSERT(childEdge.useKind() == CellUse);
</span><span class="cx">
</span><del>- Structure* structure = m_state.forNode(child).bestProvenStructure();
</del><ins>+ Structure* structure = m_state.forNode(child).m_structure.onlyStructure();
</ins><span class="cx"> if (!structure)
</span><span class="cx"> break;
</span><span class="cx">
</span><span class="lines">@@ -305,7 +290,7 @@
</span><span class="cx"> // then we refuse to fold.
</span><span class="cx"> AbstractValue oldValue = m_state.forNode(node);
</span><span class="cx"> AbstractValue constantValue;
</span><del>- constantValue.set(m_graph, value);
</del><ins>+ constantValue.set(m_graph, value, m_state.structureClobberState());
</ins><span class="cx"> constantValue.fixTypeForRepresentation(node);
</span><span class="cx"> if (oldValue.merge(constantValue))
</span><span class="cx"> continue;
</span><span class="lines">@@ -336,23 +321,18 @@
</span><span class="cx"> Edge childEdge = node->child1();
</span><span class="cx"> Node* child = childEdge.node();
</span><span class="cx">
</span><del>- bool needsWatchpoint = !m_state.forNode(child).m_currentKnownStructure.hasSingleton();
</del><span class="cx"> bool needsCellCheck = m_state.forNode(child).m_type & ~SpecCell;
</span><span class="cx">
</span><span class="cx"> ASSERT(!variant.chain());
</span><del>- ASSERT(variant.structureSet().contains(structure));
</del><ins>+ ASSERT_UNUSED(structure, variant.structureSet().contains(structure));
</ins><span class="cx">
</span><span class="cx"> // Now before we do anything else, push the CFA forward over the GetById
</span><span class="cx"> // and make sure we signal to the loop that it should continue and not
</span><span class="cx"> // do any eliminations.
</span><span class="cx"> m_interpreter.execute(indexInBlock);
</span><span class="cx">
</span><del>- if (needsWatchpoint) {
</del><ins>+ if (needsCellCheck) {
</ins><span class="cx"> m_insertionSet.insertNode(
</span><del>- indexInBlock, SpecNone, StructureTransitionWatchpoint, origin,
- OpInfo(structure), childEdge);
- } else if (needsCellCheck) {
- m_insertionSet.insertNode(
</del><span class="cx"> indexInBlock, SpecNone, Phantom, origin, childEdge);
</span><span class="cx"> }
</span><span class="cx">
</span><span class="lines">@@ -388,7 +368,6 @@
</span><span class="cx">
</span><span class="cx"> ASSERT(variant.oldStructure() == structure);
</span><span class="cx">
</span><del>- bool needsWatchpoint = !m_state.forNode(child).m_currentKnownStructure.hasSingleton();
</del><span class="cx"> bool needsCellCheck = m_state.forNode(child).m_type & ~SpecCell;
</span><span class="cx">
</span><span class="cx"> // Now before we do anything else, push the CFA forward over the PutById
</span><span class="lines">@@ -396,21 +375,16 @@
</span><span class="cx"> // do any eliminations.
</span><span class="cx"> m_interpreter.execute(indexInBlock);
</span><span class="cx">
</span><del>- if (needsWatchpoint) {
</del><ins>+ if (needsCellCheck) {
</ins><span class="cx"> m_insertionSet.insertNode(
</span><del>- indexInBlock, SpecNone, StructureTransitionWatchpoint, origin,
- OpInfo(structure), childEdge);
- } else if (needsCellCheck) {
- m_insertionSet.insertNode(
</del><span class="cx"> indexInBlock, SpecNone, Phantom, origin, childEdge);
</span><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> childEdge.setUseKind(KnownCellUse);
</span><span class="cx">
</span><del>- StructureTransitionData* transitionData = 0;
</del><ins>+ Transition* transition = 0;
</ins><span class="cx"> if (variant.kind() == PutByIdVariant::Transition) {
</span><del>- transitionData = m_graph.addStructureTransitionData(
- StructureTransitionData(structure, variant.newStructure()));
</del><ins>+ transition = m_graph.m_transitions.add(structure, variant.newStructure());
</ins><span class="cx">
</span><span class="cx"> if (node->op() == PutById) {
</span><span class="cx"> if (!structure->storedPrototype().isNull()) {
</span><span class="lines">@@ -446,7 +420,7 @@
</span><span class="cx"> ASSERT(!isInlineOffset(variant.offset()));
</span><span class="cx"> Node* allocatePropertyStorage = m_insertionSet.insertNode(
</span><span class="cx"> indexInBlock, SpecNone, AllocatePropertyStorage,
</span><del>- origin, OpInfo(transitionData), childEdge);
</del><ins>+ origin, OpInfo(transition), childEdge);
</ins><span class="cx"> m_insertionSet.insertNode(indexInBlock, SpecNone, StoreBarrier, origin, Edge(node->child1().node(), KnownCellUse));
</span><span class="cx"> propertyStorage = Edge(allocatePropertyStorage);
</span><span class="cx"> } else {
</span><span class="lines">@@ -456,7 +430,7 @@
</span><span class="cx">
</span><span class="cx"> Node* reallocatePropertyStorage = m_insertionSet.insertNode(
</span><span class="cx"> indexInBlock, SpecNone, ReallocatePropertyStorage, origin,
</span><del>- OpInfo(transitionData), childEdge,
</del><ins>+ OpInfo(transition), childEdge,
</ins><span class="cx"> Edge(m_insertionSet.insertNode(
</span><span class="cx"> indexInBlock, SpecNone, GetButterfly, origin, childEdge)));
</span><span class="cx"> m_insertionSet.insertNode(indexInBlock, SpecNone, StoreBarrier, origin, Edge(node->child1().node(), KnownCellUse));
</span><span class="lines">@@ -464,7 +438,7 @@
</span><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> if (variant.kind() == PutByIdVariant::Transition) {
</span><del>- Node* putStructure = m_graph.addNode(SpecNone, PutStructure, origin, OpInfo(transitionData), childEdge);
</del><ins>+ Node* putStructure = m_graph.addNode(SpecNone, PutStructure, origin, OpInfo(transition), childEdge);
</ins><span class="cx"> m_insertionSet.insertNode(indexInBlock, SpecNone, StoreBarrier, origin, Edge(node->child1().node(), KnownCellUse));
</span><span class="cx"> m_insertionSet.insert(indexInBlock, putStructure);
</span><span class="cx"> }
</span><span class="lines">@@ -482,16 +456,12 @@
</span><span class="cx">
</span><span class="cx"> void addStructureTransitionCheck(NodeOrigin origin, unsigned indexInBlock, JSCell* cell)
</span><span class="cx"> {
</span><ins>+ if (m_graph.watchpoints().consider(cell->structure()))
+ return;
+
</ins><span class="cx"> Node* weakConstant = m_insertionSet.insertNode(
</span><span class="cx"> indexInBlock, speculationFromValue(cell), WeakJSConstant, origin, OpInfo(cell));
</span><span class="cx">
</span><del>- if (m_graph.watchpoints().isStillValid(cell->structure()->transitionWatchpointSet())) {
- m_insertionSet.insertNode(
- indexInBlock, SpecNone, StructureTransitionWatchpoint, origin,
- OpInfo(cell->structure()), Edge(weakConstant, CellUse));
- return;
- }
-
</del><span class="cx"> m_insertionSet.insertNode(
</span><span class="cx"> indexInBlock, SpecNone, CheckStructure, origin,
</span><span class="cx"> OpInfo(m_graph.addStructureSet(cell->structure())), Edge(weakConstant, CellUse));
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGDesiredWatchpointscpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGDesiredWatchpoints.cpp (171379 => 171380)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGDesiredWatchpoints.cpp 2014-07-23 01:12:32 UTC (rev 171379)
+++ trunk/Source/JavaScriptCore/dfg/DFGDesiredWatchpoints.cpp 2014-07-23 01:19:50 UTC (rev 171380)
</span><span class="lines">@@ -1,5 +1,5 @@
</span><span class="cx"> /*
</span><del>- * Copyright (C) 2013 Apple Inc. All rights reserved.
</del><ins>+ * Copyright (C) 2013, 2014 Apple Inc. All rights reserved.
</ins><span class="cx"> *
</span><span class="cx"> * Redistribution and use in source and binary forms, with or without
</span><span class="cx"> * modification, are permitted provided that the following conditions
</span><span class="lines">@@ -62,16 +62,14 @@
</span><span class="cx"> m_bufferViews.addLazily(view);
</span><span class="cx"> }
</span><span class="cx">
</span><del>-void DesiredWatchpoints::addLazily(CodeOrigin codeOrigin, ExitKind exitKind, WatchpointSet* set)
</del><ins>+bool DesiredWatchpoints::consider(Structure* structure)
</ins><span class="cx"> {
</span><del>- m_sets.addLazily(codeOrigin, exitKind, set);
</del><ins>+ if (!structure->dfgShouldWatch())
+ return false;
+ addLazily(structure->transitionWatchpointSet());
+ return true;
</ins><span class="cx"> }
</span><span class="cx">
</span><del>-void DesiredWatchpoints::addLazily(CodeOrigin codeOrigin, ExitKind exitKind, InlineWatchpointSet& set)
-{
- m_inlineSets.addLazily(codeOrigin, exitKind, &set);
-}
-
</del><span class="cx"> void DesiredWatchpoints::reallyAdd(CodeBlock* codeBlock, CommonData& commonData)
</span><span class="cx"> {
</span><span class="cx"> m_sets.reallyAdd(codeBlock, commonData);
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGDesiredWatchpointsh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGDesiredWatchpoints.h (171379 => 171380)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGDesiredWatchpoints.h 2014-07-23 01:12:32 UTC (rev 171379)
+++ trunk/Source/JavaScriptCore/dfg/DFGDesiredWatchpoints.h 2014-07-23 01:19:50 UTC (rev 171380)
</span><span class="lines">@@ -1,5 +1,5 @@
</span><span class="cx"> /*
</span><del>- * Copyright (C) 2013 Apple Inc. All rights reserved.
</del><ins>+ * Copyright (C) 2013, 2014 Apple Inc. All rights reserved.
</ins><span class="cx"> *
</span><span class="cx"> * Redistribution and use in source and binary forms, with or without
</span><span class="cx"> * modification, are permitted provided that the following conditions
</span><span class="lines">@@ -39,26 +39,7 @@
</span><span class="cx">
</span><span class="cx"> namespace JSC { namespace DFG {
</span><span class="cx">
</span><del>-template<typename WatchpointSetType>
-struct WatchpointForGenericWatchpointSet {
- WatchpointForGenericWatchpointSet()
- : m_exitKind(ExitKindUnset)
- , m_set(0)
- {
- }
-
- WatchpointForGenericWatchpointSet(
- CodeOrigin codeOrigin, ExitKind exitKind, WatchpointSetType* set)
- : m_codeOrigin(codeOrigin)
- , m_exitKind(exitKind)
- , m_set(set)
- {
- }
-
- CodeOrigin m_codeOrigin;
- ExitKind m_exitKind;
- WatchpointSetType* m_set;
-};
</del><ins>+class Graph;
</ins><span class="cx">
</span><span class="cx"> template<typename T>
</span><span class="cx"> struct GenericSetAdaptor {
</span><span class="lines">@@ -95,12 +76,6 @@
</span><span class="cx"> m_sets.add(set);
</span><span class="cx"> }
</span><span class="cx">
</span><del>- void addLazily(CodeOrigin codeOrigin, ExitKind exitKind, WatchpointSetType* set)
- {
- m_profiledWatchpoints.append(
- WatchpointForGenericWatchpointSet<WatchpointSetType>(codeOrigin, exitKind, set));
- }
-
</del><span class="cx"> void reallyAdd(CodeBlock* codeBlock, CommonData& common)
</span><span class="cx"> {
</span><span class="cx"> RELEASE_ASSERT(!m_reallyAdded);
</span><span class="lines">@@ -112,14 +87,6 @@
</span><span class="cx"> Adaptor::add(codeBlock, *iter, &common.watchpoints.last());
</span><span class="cx"> }
</span><span class="cx">
</span><del>- for (unsigned i = m_profiledWatchpoints.size(); i--;) {
- WatchpointForGenericWatchpointSet<WatchpointSetType> watchpoint =
- m_profiledWatchpoints[i];
- common.profiledWatchpoints.append(
- ProfiledCodeBlockJettisoningWatchpoint(watchpoint.m_codeOrigin, watchpoint.m_exitKind, codeBlock));
- Adaptor::add(codeBlock, watchpoint.m_set, &common.profiledWatchpoints.last());
- }
-
</del><span class="cx"> m_reallyAdded = true;
</span><span class="cx"> }
</span><span class="cx">
</span><span class="lines">@@ -132,53 +99,16 @@
</span><span class="cx"> return false;
</span><span class="cx"> }
</span><span class="cx">
</span><del>- for (unsigned i = m_profiledWatchpoints.size(); i--;) {
- if (Adaptor::hasBeenInvalidated(m_profiledWatchpoints[i].m_set))
- return false;
- }
-
</del><span class="cx"> return true;
</span><span class="cx"> }
</span><span class="cx">
</span><del>-#if ASSERT_DISABLED
- bool isStillValid(WatchpointSetType* set)
</del><ins>+ bool isWatched(WatchpointSetType* set) const
</ins><span class="cx"> {
</span><del>- return !Adaptor::hasBeenInvalidated(set);
</del><ins>+ return m_sets.contains(set);
</ins><span class="cx"> }
</span><del>-
- bool shouldAssumeMixedState(WatchpointSetType*)
- {
- return true;
- }
-#else
- bool isStillValid(WatchpointSetType* set)
- {
- bool result = !Adaptor::hasBeenInvalidated(set);
- m_firstKnownState.add(set, result);
- return result;
- }
-
- bool shouldAssumeMixedState(WatchpointSetType* set)
- {
- typename StateMap::iterator iter = m_firstKnownState.find(set);
- if (iter == m_firstKnownState.end())
- return false;
-
- return iter->value != !Adaptor::hasBeenInvalidated(set);
- }
-#endif
-
- bool isValidOrMixed(WatchpointSetType* set)
- {
- return isStillValid(set) || shouldAssumeMixedState(set);
- }
</del><span class="cx">
</span><span class="cx"> private:
</span><del>- Vector<WatchpointForGenericWatchpointSet<WatchpointSetType>> m_profiledWatchpoints;
</del><span class="cx"> HashSet<WatchpointSetType*> m_sets;
</span><del>-#if !ASSERT_DISABLED
- StateMap m_firstKnownState;
-#endif
</del><span class="cx"> bool m_reallyAdded;
</span><span class="cx"> };
</span><span class="cx">
</span><span class="lines">@@ -190,49 +120,25 @@
</span><span class="cx"> void addLazily(WatchpointSet*);
</span><span class="cx"> void addLazily(InlineWatchpointSet&);
</span><span class="cx"> void addLazily(JSArrayBufferView*);
</span><del>- void addLazily(CodeOrigin, ExitKind, WatchpointSet*);
- void addLazily(CodeOrigin, ExitKind, InlineWatchpointSet&);
</del><span class="cx">
</span><ins>+ bool consider(Structure*);
+
</ins><span class="cx"> void reallyAdd(CodeBlock*, CommonData&);
</span><span class="cx">
</span><span class="cx"> bool areStillValid() const;
</span><span class="cx">
</span><del>- bool isStillValid(WatchpointSet* set)
</del><ins>+ bool isWatched(WatchpointSet* set)
</ins><span class="cx"> {
</span><del>- return m_sets.isStillValid(set);
</del><ins>+ return m_sets.isWatched(set);
</ins><span class="cx"> }
</span><del>- bool isStillValid(InlineWatchpointSet& set)
</del><ins>+ bool isWatched(InlineWatchpointSet& set)
</ins><span class="cx"> {
</span><del>- return m_inlineSets.isStillValid(&set);
</del><ins>+ return m_inlineSets.isWatched(&set);
</ins><span class="cx"> }
</span><del>- bool isStillValid(JSArrayBufferView* view)
</del><ins>+ bool isWatched(JSArrayBufferView* view)
</ins><span class="cx"> {
</span><del>- return m_bufferViews.isStillValid(view);
</del><ins>+ return m_bufferViews.isWatched(view);
</ins><span class="cx"> }
</span><del>- bool shouldAssumeMixedState(WatchpointSet* set)
- {
- return m_sets.shouldAssumeMixedState(set);
- }
- bool shouldAssumeMixedState(InlineWatchpointSet& set)
- {
- return m_inlineSets.shouldAssumeMixedState(&set);
- }
- bool shouldAssumeMixedState(JSArrayBufferView* view)
- {
- return m_bufferViews.shouldAssumeMixedState(view);
- }
- bool isValidOrMixed(WatchpointSet* set)
- {
- return m_sets.isValidOrMixed(set);
- }
- bool isValidOrMixed(InlineWatchpointSet& set)
- {
- return m_inlineSets.isValidOrMixed(&set);
- }
- bool isValidOrMixed(JSArrayBufferView* view)
- {
- return m_bufferViews.isValidOrMixed(view);
- }
</del><span class="cx">
</span><span class="cx"> private:
</span><span class="cx"> GenericDesiredWatchpoints<WatchpointSet> m_sets;
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGDoesGCcpp"></a>
<div class="addfile"><h4>Added: trunk/Source/JavaScriptCore/dfg/DFGDoesGC.cpp (0 => 171380)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGDoesGC.cpp (rev 0)
+++ trunk/Source/JavaScriptCore/dfg/DFGDoesGC.cpp 2014-07-23 01:19:50 UTC (rev 171380)
</span><span class="lines">@@ -0,0 +1,232 @@
</span><ins>+/*
+ * Copyright (C) 2014 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ * notice, this list of conditions and the following disclaimer in the
+ * documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "DFGDoesGC.h"
+
+#if ENABLE(DFG_JIT)
+
+#include "DFGGraph.h"
+#include "DFGNode.h"
+#include "Operations.h"
+
+namespace JSC { namespace DFG {
+
+bool doesGC(Graph& graph, Node* node)
+{
+ if (graph.clobbersWorld(node))
+ return true;
+
+ // Now consider nodes that don't clobber the world but that still may GC. This includes all
+ // nodes. By convention we put world-clobbering nodes in the block of "false" cases but we can
+ // put them anywhere.
+ switch (node->op()) {
+ case JSConstant:
+ case DoubleConstant:
+ case Int52Constant:
+ case WeakJSConstant:
+ case Identity:
+ case GetCallee:
+ case GetLocal:
+ case SetLocal:
+ case MovHint:
+ case ZombieHint:
+ case GetArgument:
+ case Phantom:
+ case HardPhantom:
+ case Upsilon:
+ case Phi:
+ case Flush:
+ case PhantomLocal:
+ case GetLocalUnlinked:
+ case SetArgument:
+ case BitAnd:
+ case BitOr:
+ case BitXor:
+ case BitLShift:
+ case BitRShift:
+ case BitURShift:
+ case ValueToInt32:
+ case UInt32ToNumber:
+ case DoubleAsInt32:
+ case ArithAdd:
+ case ArithSub:
+ case ArithNegate:
+ case ArithMul:
+ case ArithIMul:
+ case ArithDiv:
+ case ArithMod:
+ case ArithAbs:
+ case ArithMin:
+ case ArithMax:
+ case ArithSqrt:
+ case ArithFRound:
+ case ArithSin:
+ case ArithCos:
+ case ValueAdd:
+ case GetById:
+ case GetByIdFlush:
+ case PutById:
+ case PutByIdFlush:
+ case PutByIdDirect:
+ case CheckStructure:
+ case CheckExecutable:
+ case GetButterfly:
+ case CheckArray:
+ case GetScope:
+ case GetMyScope:
+ case SkipTopScope:
+ case SkipScope:
+ case GetClosureRegisters:
+ case GetClosureVar:
+ case PutClosureVar:
+ case GetGlobalVar:
+ case PutGlobalVar:
+ case VariableWatchpoint:
+ case VarInjectionWatchpoint:
+ case CheckFunction:
+ case AllocationProfileWatchpoint:
+ case RegExpExec:
+ case RegExpTest:
+ case CompareLess:
+ case CompareLessEq:
+ case CompareGreater:
+ case CompareGreaterEq:
+ case CompareEq:
+ case CompareEqConstant:
+ case CompareStrictEq:
+ case Call:
+ case Construct:
+ case Breakpoint:
+ case ProfileWillCall:
+ case ProfileDidCall:
+ case CheckHasInstance:
+ case InstanceOf:
+ case IsUndefined:
+ case IsBoolean:
+ case IsNumber:
+ case IsString:
+ case IsObject:
+ case IsFunction:
+ case TypeOf:
+ case LogicalNot:
+ case ToPrimitive:
+ case ToString:
+ case In:
+ case TearOffActivation:
+ case PhantomArguments:
+ case TearOffArguments:
+ case GetMyArgumentsLength:
+ case GetMyArgumentByVal:
+ case GetMyArgumentsLengthSafe:
+ case GetMyArgumentByValSafe:
+ case CheckArgumentsNotCreated:
+ case Jump:
+ case Branch:
+ case Switch:
+ case Return:
+ case Throw:
+ case CountExecution:
+ case ForceOSRExit:
+ case CheckWatchdogTimer:
+ case StringFromCharCode:
+ case Unreachable:
+ case ExtractOSREntryLocal:
+ case CheckTierUpInLoop:
+ case CheckTierUpAtReturn:
+ case CheckTierUpAndOSREnter:
+ case LoopHint:
+ case StoreBarrier:
+ case StoreBarrierWithNullCheck:
+ case InvalidationPoint:
+ case NotifyWrite:
+ case FunctionReentryWatchpoint:
+ case TypedArrayWatchpoint:
+ case CheckInBounds:
+ case ConstantStoragePointer:
+ case Check:
+ case MultiGetByOffset:
+ case ValueRep:
+ case DoubleRep:
+ case Int52Rep:
+ case GetGetter:
+ case GetSetter:
+ case GetByVal:
+ case GetIndexedPropertyStorage:
+ case GetArrayLength:
+ case ArrayPush:
+ case ArrayPop:
+ case StringCharAt:
+ case StringCharCodeAt:
+ case GetTypedArrayByteOffset:
+ case PutByValDirect:
+ case PutByVal:
+ case PutByValAlias:
+ case PutStructure:
+ case PhantomPutStructure:
+ case GetByOffset:
+ case GetGetterSetterByOffset:
+ case PutByOffset:
+ case FiatInt52:
+ case BooleanToNumber:
+ return false;
+
+ case CreateActivation:
+ case CreateArguments:
+ case ToThis:
+ case CreateThis:
+ case AllocatePropertyStorage:
+ case ReallocatePropertyStorage:
+ case Arrayify:
+ case ArrayifyToStructure:
+ case NewObject:
+ case NewArray:
+ case NewArrayWithSize:
+ case NewArrayBuffer:
+ case NewRegexp:
+ case NewStringObject:
+ case MakeRope:
+ case NewFunctionNoCheck:
+ case NewFunction:
+ case NewFunctionExpression:
+ case NewTypedArray:
+ case ThrowReferenceError:
+ return true;
+
+ case MultiPutByOffset:
+ return node->multiPutByOffsetData().reallocatesStorage();
+
+ case LastNodeType:
+ RELEASE_ASSERT_NOT_REACHED();
+ return true;
+ }
+
+ RELEASE_ASSERT_NOT_REACHED();
+ return true;
+}
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
</ins></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGDoesGCh"></a>
<div class="addfile"><h4>Added: trunk/Source/JavaScriptCore/dfg/DFGDoesGC.h (0 => 171380)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGDoesGC.h (rev 0)
+++ trunk/Source/JavaScriptCore/dfg/DFGDoesGC.h 2014-07-23 01:19:50 UTC (rev 171380)
</span><span class="lines">@@ -0,0 +1,43 @@
</span><ins>+/*
+ * Copyright (C) 2014 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ * notice, this list of conditions and the following disclaimer in the
+ * documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef DFGDoesGC_h
+#define DFGDoesGC_h
+
+#if ENABLE(DFG_JIT)
+
+namespace JSC { namespace DFG {
+
+class Graph;
+struct Node;
+
+bool doesGC(Graph&, Node*);
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
+
+#endif // DFGDoesGC_h
+
</ins></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGFixupPhasecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGFixupPhase.cpp (171379 => 171380)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGFixupPhase.cpp 2014-07-23 01:12:32 UTC (rev 171379)
+++ trunk/Source/JavaScriptCore/dfg/DFGFixupPhase.cpp 2014-07-23 01:19:50 UTC (rev 171380)
</span><span class="lines">@@ -927,7 +927,6 @@
</span><span class="cx">
</span><span class="cx"> case CheckExecutable:
</span><span class="cx"> case CheckStructure:
</span><del>- case StructureTransitionWatchpoint:
</del><span class="cx"> case CheckFunction:
</span><span class="cx"> case CheckHasInstance:
</span><span class="cx"> case CreateThis:
</span><span class="lines">@@ -1357,7 +1356,7 @@
</span><span class="cx">
</span><span class="cx"> JSObject* stringPrototypeObject = asObject(stringObjectStructure->storedPrototype());
</span><span class="cx"> Structure* stringPrototypeStructure = stringPrototypeObject->structure();
</span><del>- if (!m_graph.watchpoints().isStillValid(stringPrototypeStructure->transitionWatchpointSet()))
</del><ins>+ if (!m_graph.watchpoints().consider(stringPrototypeStructure))
</ins><span class="cx"> return false;
</span><span class="cx">
</span><span class="cx"> if (stringPrototypeStructure->isDictionary())
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGGraphcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGGraph.cpp (171379 => 171380)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGGraph.cpp 2014-07-23 01:12:32 UTC (rev 171379)
+++ trunk/Source/JavaScriptCore/dfg/DFGGraph.cpp 2014-07-23 01:19:50 UTC (rev 171380)
</span><span class="lines">@@ -77,6 +77,16 @@
</span><span class="cx">
</span><span class="cx"> Graph::~Graph()
</span><span class="cx"> {
</span><ins>+ for (BlockIndex blockIndex = numBlocks(); blockIndex--;) {
+ BasicBlock* block = this->block(blockIndex);
+ if (!block)
+ continue;
+
+ for (unsigned phiIndex = block->phis.size(); phiIndex--;)
+ m_allocator.free(block->phis[phiIndex]);
+ for (unsigned nodeIndex = block->size(); nodeIndex--;)
+ m_allocator.free(block->at(nodeIndex));
+ }
</ins><span class="cx"> m_allocator.freeAll();
</span><span class="cx"> }
</span><span class="cx">
</span><span class="lines">@@ -211,8 +221,8 @@
</span><span class="cx"> out.print(comma, inContext(node->structureSet(), context));
</span><span class="cx"> if (node->hasStructure())
</span><span class="cx"> out.print(comma, inContext(*node->structure(), context));
</span><del>- if (node->hasStructureTransitionData())
- out.print(comma, inContext(*node->structureTransitionData().previousStructure, context), " -> ", inContext(*node->structureTransitionData().newStructure, context));
</del><ins>+ if (node->hasTransition())
+ out.print(comma, pointerDumpInContext(node->transition(), context));
</ins><span class="cx"> if (node->hasFunction()) {
</span><span class="cx"> out.print(comma, "function(", RawPointer(node->function()), ", ");
</span><span class="cx"> if (node->function()->inherits(JSFunction::info())) {
</span><span class="lines">@@ -338,9 +348,11 @@
</span><span class="cx"> out.print(comma, "R:", sortedListDump(reads.direct(), ","));
</span><span class="cx"> if (!writes.isEmpty())
</span><span class="cx"> out.print(comma, "W:", sortedListDump(writes.direct(), ","));
</span><del>- out.print(comma, "bc#", node->origin.semantic.bytecodeIndex);
- if (node->origin.semantic != node->origin.forExit)
- out.print(comma, "exit: ", node->origin.forExit);
</del><ins>+ if (node->origin.isSet()) {
+ out.print(comma, "bc#", node->origin.semantic.bytecodeIndex);
+ if (node->origin.semantic != node->origin.forExit)
+ out.print(comma, "exit: ", node->origin.forExit);
+ }
</ins><span class="cx">
</span><span class="cx"> out.print(")");
</span><span class="cx">
</span><span class="lines">@@ -356,7 +368,7 @@
</span><span class="cx">
</span><span class="cx"> void Graph::dumpBlockHeader(PrintStream& out, const char* prefix, BasicBlock* block, PhiNodeDumpMode phiNodeDumpMode, DumpContext* context)
</span><span class="cx"> {
</span><del>- out.print(prefix, "Block ", *block, " (", inContext(block->at(0)->origin.semantic, context), "): ", block->isReachable ? "" : "(skipped)", block->isOSRTarget ? " (OSR target)" : "", "\n");
</del><ins>+ out.print(prefix, "Block ", *block, " (", inContext(block->at(0)->origin.semantic, context), "):", block->isReachable ? "" : " (skipped)", block->isOSRTarget ? " (OSR target)" : "", block->cfaHasVisited ? "" : " (CFA-unreachable)", "\n");
</ins><span class="cx"> if (block->executionCount == block->executionCount)
</span><span class="cx"> out.print(prefix, " Execution count: ", block->executionCount, "\n");
</span><span class="cx"> out.print(prefix, " Predecessors:");
</span><span class="lines">@@ -439,16 +451,17 @@
</span><span class="cx"> if (!block)
</span><span class="cx"> continue;
</span><span class="cx"> dumpBlockHeader(out, "", block, DumpAllPhis, context);
</span><ins>+ out.print(" States: ", block->cfaStructureClobberStateAtHead, "\n");
</ins><span class="cx"> switch (m_form) {
</span><span class="cx"> case LoadStore:
</span><span class="cx"> case ThreadedCPS: {
</span><del>- out.print(" vars before: ");
</del><ins>+ out.print(" Vars Before: ");
</ins><span class="cx"> if (block->cfaHasVisited)
</span><span class="cx"> out.print(inContext(block->valuesAtHead, context));
</span><span class="cx"> else
</span><span class="cx"> out.print("<empty>");
</span><span class="cx"> out.print("\n");
</span><del>- out.print(" var links: ", block->variablesAtHead, "\n");
</del><ins>+ out.print(" Var Links: ", block->variablesAtHead, "\n");
</ins><span class="cx"> break;
</span><span class="cx"> }
</span><span class="cx">
</span><span class="lines">@@ -464,16 +477,17 @@
</span><span class="cx"> dump(out, "", block->at(i), context);
</span><span class="cx"> lastNode = block->at(i);
</span><span class="cx"> }
</span><ins>+ out.print(" States: ", block->cfaBranchDirection, ", ", block->cfaStructureClobberStateAtTail, "\n");
</ins><span class="cx"> switch (m_form) {
</span><span class="cx"> case LoadStore:
</span><span class="cx"> case ThreadedCPS: {
</span><del>- out.print(" vars after: ");
</del><ins>+ out.print(" Vars After: ");
</ins><span class="cx"> if (block->cfaHasVisited)
</span><span class="cx"> out.print(inContext(block->valuesAtTail, context));
</span><span class="cx"> else
</span><span class="cx"> out.print("<empty>");
</span><span class="cx"> out.print("\n");
</span><del>- out.print(" var links: ", block->variablesAtTail, "\n");
</del><ins>+ out.print(" Var Links: ", block->variablesAtTail, "\n");
</ins><span class="cx"> break;
</span><span class="cx"> }
</span><span class="cx">
</span><span class="lines">@@ -800,8 +814,9 @@
</span><span class="cx"> JSArrayBufferView* view = jsDynamicCast<JSArrayBufferView*>(valueOfJSConstant(node));
</span><span class="cx"> if (!view)
</span><span class="cx"> return 0;
</span><del>- if (!watchpoints().isStillValid(view))
</del><ins>+ if (!view->length())
</ins><span class="cx"> return 0;
</span><ins>+ WTF::loadLoadFence();
</ins><span class="cx"> return view;
</span><span class="cx"> }
</span><span class="cx">
</span><span class="lines">@@ -846,7 +861,6 @@
</span><span class="cx"> visitor.appendUnbarrieredReadOnlyPointer(node->structureSet()[i]);
</span><span class="cx"> break;
</span><span class="cx">
</span><del>- case StructureTransitionWatchpoint:
</del><span class="cx"> case NewObject:
</span><span class="cx"> case ArrayifyToStructure:
</span><span class="cx"> case NewStringObject:
</span><span class="lines">@@ -858,11 +872,36 @@
</span><span class="cx"> case AllocatePropertyStorage:
</span><span class="cx"> case ReallocatePropertyStorage:
</span><span class="cx"> visitor.appendUnbarrieredReadOnlyPointer(
</span><del>- node->structureTransitionData().previousStructure);
</del><ins>+ node->transition()->previous);
</ins><span class="cx"> visitor.appendUnbarrieredReadOnlyPointer(
</span><del>- node->structureTransitionData().newStructure);
</del><ins>+ node->transition()->next);
</ins><span class="cx"> break;
</span><span class="cx">
</span><ins>+ case MultiGetByOffset:
+ for (unsigned i = node->multiGetByOffsetData().variants.size(); i--;) {
+ GetByIdVariant& variant = node->multiGetByOffsetData().variants[i];
+ visitor.appendUnbarrieredReadOnlyValue(variant.specificValue());
+ const StructureSet& set = variant.structureSet();
+ for (unsigned j = set.size(); j--;)
+ visitor.appendUnbarrieredReadOnlyPointer(set[j]);
+
+ // Don't need to mark anything in the structure chain because that would
+ // have been decomposed into CheckStructure's. Don't need to mark the
+ // callLinkStatus because we wouldn't use MultiGetByOffset if any of the
+ // variants did that.
+ ASSERT(!variant.callLinkStatus());
+ }
+ break;
+
+ case MultiPutByOffset:
+ for (unsigned i = node->multiPutByOffsetData().variants.size(); i--;) {
+ PutByIdVariant& variant = node->multiPutByOffsetData().variants[i];
+ visitor.appendUnbarrieredReadOnlyPointer(variant.oldStructure());
+ if (variant.kind() == PutByIdVariant::Transition)
+ visitor.appendUnbarrieredReadOnlyPointer(variant.newStructure());
+ }
+ break;
+
</ins><span class="cx"> default:
</span><span class="cx"> break;
</span><span class="cx"> }
</span><span class="lines">@@ -870,6 +909,35 @@
</span><span class="cx"> }
</span><span class="cx"> }
</span><span class="cx">
</span><ins>+void Graph::assertIsWatched(Structure* structure)
+{
+ if (!structure->dfgShouldWatch())
+ return;
+ if (watchpoints().isWatched(structure->transitionWatchpointSet()))
+ return;
+
+ DFG_CRASH(*this, nullptr, toCString("Structure ", pointerDump(structure), " is watchable but isn't being watched.").data());
+}
+
+void Graph::handleAssertionFailure(
+ Node* node, const char* file, int line, const char* function, const char* assertion)
+{
+ startCrashing();
+ dataLog("DFG ASSERTION FAILED: ", assertion, "\n");
+ dataLog(file, "(", line, ") : ", function, "\n");
+ dataLog("\n");
+ if (node) {
+ dataLog("While handling node ", node, "\n");
+ dataLog("\n");
+ }
+ dataLog("Graph at time of failure:\n");
+ dump();
+ dataLog("\n");
+ dataLog("DFG ASSERTION FAILED: ", assertion, "\n");
+ dataLog(file, "(", line, ") : ", function, "\n");
+ CRASH();
+}
+
</ins><span class="cx"> } } // namespace JSC::DFG
</span><span class="cx">
</span><span class="cx"> #endif // ENABLE(DFG_JIT)
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGGraphh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGGraph.h (171379 => 171380)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGGraph.h 2014-07-23 01:12:32 UTC (rev 171379)
+++ trunk/Source/JavaScriptCore/dfg/DFGGraph.h 2014-07-23 01:19:50 UTC (rev 171380)
</span><span class="lines">@@ -170,8 +170,12 @@
</span><span class="cx"> return constantRegister;
</span><span class="cx"> }
</span><span class="cx">
</span><ins>+ void assertIsWatched(Structure* structure);
+
</ins><span class="cx"> void convertToConstant(Node* node, JSValue value)
</span><span class="cx"> {
</span><ins>+ if (value.isCell())
+ assertIsWatched(value.asCell()->structure());
</ins><span class="cx"> if (value.isObject())
</span><span class="cx"> node->convertToWeakConstant(value.asCell());
</span><span class="cx"> else
</span><span class="lines">@@ -406,12 +410,6 @@
</span><span class="cx"> return &m_structureSet.last();
</span><span class="cx"> }
</span><span class="cx">
</span><del>- StructureTransitionData* addStructureTransitionData(const StructureTransitionData& structureTransitionData)
- {
- m_structureTransitionData.append(structureTransitionData);
- return &m_structureTransitionData.last();
- }
-
</del><span class="cx"> JSGlobalObject* globalObjectFor(CodeOrigin codeOrigin)
</span><span class="cx"> {
</span><span class="cx"> return m_codeBlock->globalObjectFor(codeOrigin);
</span><span class="lines">@@ -462,8 +460,7 @@
</span><span class="cx">
</span><span class="cx"> bool masqueradesAsUndefinedWatchpointIsStillValid(const CodeOrigin& codeOrigin)
</span><span class="cx"> {
</span><del>- return m_plan.watchpoints.isStillValid(
- globalObjectFor(codeOrigin)->masqueradesAsUndefinedWatchpoint());
</del><ins>+ return globalObjectFor(codeOrigin)->masqueradesAsUndefinedWatchpoint()->isStillValid();
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> bool hasGlobalExitSite(const CodeOrigin& codeOrigin, ExitKind exitKind)
</span><span class="lines">@@ -823,6 +820,10 @@
</span><span class="cx">
</span><span class="cx"> virtual void visitChildren(SlotVisitor&) override;
</span><span class="cx">
</span><ins>+ NO_RETURN_DUE_TO_CRASH void handleAssertionFailure(
+ Node* node, const char* file, int line, const char* function,
+ const char* assertion);
+
</ins><span class="cx"> VM& m_vm;
</span><span class="cx"> Plan& m_plan;
</span><span class="cx"> CodeBlock* m_codeBlock;
</span><span class="lines">@@ -839,7 +840,7 @@
</span><span class="cx"> SegmentedVector<VariableAccessData, 16> m_variableAccessData;
</span><span class="cx"> SegmentedVector<ArgumentPosition, 8> m_argumentPositions;
</span><span class="cx"> SegmentedVector<StructureSet, 16> m_structureSet;
</span><del>- SegmentedVector<StructureTransitionData, 8> m_structureTransitionData;
</del><ins>+ Bag<Transition> m_transitions;
</ins><span class="cx"> SegmentedVector<NewArrayBufferData, 4> m_newArrayBufferData;
</span><span class="cx"> Bag<BranchData> m_branchData;
</span><span class="cx"> Bag<SwitchData> m_switchData;
</span><span class="lines">@@ -925,6 +926,17 @@
</span><span class="cx"> } \
</span><span class="cx"> } while (false)
</span><span class="cx">
</span><ins>+#define DFG_ASSERT(graph, node, assertion) do { \
+ if (!!(assertion)) \
+ break; \
+ (graph).handleAssertionFailure( \
+ (node), __FILE__, __LINE__, WTF_PRETTY_FUNCTION, #assertion); \
+ } while (false)
+
+#define DFG_CRASH(graph, node, reason) \
+ (graph).handleAssertionFailure( \
+ (node), __FILE__, __LINE__, WTF_PRETTY_FUNCTION, (reason));
+
</ins><span class="cx"> } } // namespace JSC::DFG
</span><span class="cx">
</span><span class="cx"> #endif
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGInPlaceAbstractStatecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGInPlaceAbstractState.cpp (171379 => 171380)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGInPlaceAbstractState.cpp 2014-07-23 01:12:32 UTC (rev 171379)
+++ trunk/Source/JavaScriptCore/dfg/DFGInPlaceAbstractState.cpp 2014-07-23 01:19:50 UTC (rev 171380)
</span><span class="lines">@@ -37,6 +37,8 @@
</span><span class="cx">
</span><span class="cx"> namespace JSC { namespace DFG {
</span><span class="cx">
</span><ins>+static const bool verbose = false;
+
</ins><span class="cx"> InPlaceAbstractState::InPlaceAbstractState(Graph& graph)
</span><span class="cx"> : m_graph(graph)
</span><span class="cx"> , m_variables(m_graph.m_codeBlock->numParameters(), graph.m_localVars)
</span><span class="lines">@@ -58,36 +60,20 @@
</span><span class="cx"> forNode(basicBlock->at(i)).clear();
</span><span class="cx">
</span><span class="cx"> m_variables = basicBlock->valuesAtHead;
</span><del>- m_haveStructures = false;
- for (size_t i = 0; i < m_variables.numberOfArguments(); ++i) {
- if (m_variables.argument(i).hasClobberableState()) {
- m_haveStructures = true;
- break;
- }
- }
- for (size_t i = 0; i < m_variables.numberOfLocals(); ++i) {
- if (m_variables.local(i).hasClobberableState()) {
- m_haveStructures = true;
- break;
- }
- }
</del><span class="cx">
</span><span class="cx"> if (m_graph.m_form == SSA) {
</span><span class="cx"> HashMap<Node*, AbstractValue>::iterator iter = basicBlock->ssa->valuesAtHead.begin();
</span><span class="cx"> HashMap<Node*, AbstractValue>::iterator end = basicBlock->ssa->valuesAtHead.end();
</span><del>- for (; iter != end; ++iter) {
</del><ins>+ for (; iter != end; ++iter)
</ins><span class="cx"> forNode(iter->key) = iter->value;
</span><del>- if (iter->value.hasClobberableState())
- m_haveStructures = true;
- }
</del><span class="cx"> }
</span><del>-
</del><span class="cx"> basicBlock->cfaShouldRevisit = false;
</span><span class="cx"> basicBlock->cfaHasVisited = true;
</span><span class="cx"> m_block = basicBlock;
</span><span class="cx"> m_isValid = true;
</span><span class="cx"> m_foundConstants = false;
</span><span class="cx"> m_branchDirection = InvalidBranchDirection;
</span><ins>+ m_structureClobberState = basicBlock->cfaStructureClobberStateAtHead;
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> static void setLiveValues(HashMap<Node*, AbstractValue>& values, HashSet<Node*>& live)
</span><span class="lines">@@ -106,6 +92,8 @@
</span><span class="cx"> root->cfaShouldRevisit = true;
</span><span class="cx"> root->cfaHasVisited = false;
</span><span class="cx"> root->cfaFoundConstants = false;
</span><ins>+ root->cfaStructureClobberStateAtHead = StructuresAreWatched;
+ root->cfaStructureClobberStateAtTail = StructuresAreWatched;
</ins><span class="cx"> for (size_t i = 0; i < root->valuesAtHead.numberOfArguments(); ++i) {
</span><span class="cx"> root->valuesAtTail.argument(i).clear();
</span><span class="cx"> if (m_graph.m_form == SSA) {
</span><span class="lines">@@ -147,6 +135,8 @@
</span><span class="cx"> block->cfaShouldRevisit = false;
</span><span class="cx"> block->cfaHasVisited = false;
</span><span class="cx"> block->cfaFoundConstants = false;
</span><ins>+ block->cfaStructureClobberStateAtHead = StructuresAreWatched;
+ block->cfaStructureClobberStateAtTail = StructuresAreWatched;
</ins><span class="cx"> for (size_t i = 0; i < block->valuesAtHead.numberOfArguments(); ++i) {
</span><span class="cx"> block->valuesAtHead.argument(i).clear();
</span><span class="cx"> block->valuesAtTail.argument(i).clear();
</span><span class="lines">@@ -204,6 +194,8 @@
</span><span class="cx"> bool changed = false;
</span><span class="cx">
</span><span class="cx"> if (mergeMode != DontMerge || !ASSERT_DISABLED) {
</span><ins>+ changed |= checkAndSet(block->cfaStructureClobberStateAtTail, m_structureClobberState);
+
</ins><span class="cx"> switch (m_graph.m_form) {
</span><span class="cx"> case ThreadedCPS: {
</span><span class="cx"> for (size_t argument = 0; argument < block->variablesAtTail.numberOfArguments(); ++argument) {
</span><span class="lines">@@ -251,6 +243,7 @@
</span><span class="cx"> m_block = 0;
</span><span class="cx"> m_isValid = false;
</span><span class="cx"> m_branchDirection = InvalidBranchDirection;
</span><ins>+ m_structureClobberState = StructuresAreWatched;
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> bool InPlaceAbstractState::mergeStateAtTail(AbstractValue& destination, AbstractValue& inVariable, Node* node)
</span><span class="lines">@@ -311,11 +304,17 @@
</span><span class="cx">
</span><span class="cx"> bool InPlaceAbstractState::merge(BasicBlock* from, BasicBlock* to)
</span><span class="cx"> {
</span><ins>+ if (verbose)
+ dataLog(" Merging from ", pointerDump(from), " to ", pointerDump(to), "\n");
</ins><span class="cx"> ASSERT(from->variablesAtTail.numberOfArguments() == to->variablesAtHead.numberOfArguments());
</span><span class="cx"> ASSERT(from->variablesAtTail.numberOfLocals() == to->variablesAtHead.numberOfLocals());
</span><span class="cx">
</span><span class="cx"> bool changed = false;
</span><span class="cx">
</span><ins>+ changed |= checkAndSet(
+ to->cfaStructureClobberStateAtHead,
+ DFG::merge(from->cfaStructureClobberStateAtTail, to->cfaStructureClobberStateAtHead));
+
</ins><span class="cx"> switch (m_graph.m_form) {
</span><span class="cx"> case ThreadedCPS: {
</span><span class="cx"> for (size_t argument = 0; argument < from->variablesAtTail.numberOfArguments(); ++argument) {
</span><span class="lines">@@ -338,8 +337,12 @@
</span><span class="cx"> HashSet<Node*>::iterator end = to->ssa->liveAtHead.end();
</span><span class="cx"> for (; iter != end; ++iter) {
</span><span class="cx"> Node* node = *iter;
</span><ins>+ if (verbose)
+ dataLog(" Merging for ", node, ": from ", from->ssa->valuesAtTail.find(node)->value, " to ", to->ssa->valuesAtHead.find(node)->value, "\n");
</ins><span class="cx"> changed |= to->ssa->valuesAtHead.find(node)->value.merge(
</span><span class="cx"> from->ssa->valuesAtTail.find(node)->value);
</span><ins>+ if (verbose)
+ dataLog(" Result: ", to->ssa->valuesAtHead.find(node)->value, "\n");
</ins><span class="cx"> }
</span><span class="cx"> break;
</span><span class="cx"> }
</span><span class="lines">@@ -352,6 +355,8 @@
</span><span class="cx"> if (!to->cfaHasVisited)
</span><span class="cx"> changed = true;
</span><span class="cx">
</span><ins>+ if (verbose)
+ dataLog(" Will revisit: ", changed, "\n");
</ins><span class="cx"> to->cfaShouldRevisit |= changed;
</span><span class="cx">
</span><span class="cx"> return changed;
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGInPlaceAbstractStateh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGInPlaceAbstractState.h (171379 => 171380)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGInPlaceAbstractState.h 2014-07-23 01:12:32 UTC (rev 171379)
+++ trunk/Source/JavaScriptCore/dfg/DFGInPlaceAbstractState.h 2014-07-23 01:19:50 UTC (rev 171380)
</span><span class="lines">@@ -103,6 +103,9 @@
</span><span class="cx"> // Did the last executed node clobber the world?
</span><span class="cx"> bool didClobber() const { return m_didClobber; }
</span><span class="cx">
</span><ins>+ // Are structures currently clobbered?
+ StructureClobberState structureClobberState() const { return m_structureClobberState; }
+
</ins><span class="cx"> // Is the execution state still valid? This will be false if execute() has
</span><span class="cx"> // returned false previously.
</span><span class="cx"> bool isValid() const { return m_isValid; }
</span><span class="lines">@@ -122,11 +125,10 @@
</span><span class="cx">
</span><span class="cx"> // Methods intended to be called from AbstractInterpreter.
</span><span class="cx"> void setDidClobber(bool didClobber) { m_didClobber = didClobber; }
</span><ins>+ void setStructureClobberState(StructureClobberState value) { m_structureClobberState = value; }
</ins><span class="cx"> void setIsValid(bool isValid) { m_isValid = isValid; }
</span><span class="cx"> void setBranchDirection(BranchDirection branchDirection) { m_branchDirection = branchDirection; }
</span><span class="cx"> void setFoundConstants(bool foundConstants) { m_foundConstants = foundConstants; }
</span><del>- bool haveStructures() const { return m_haveStructures; } // It's always safe to return true.
- void setHaveStructures(bool haveStructures) { m_haveStructures = haveStructures; }
</del><span class="cx">
</span><span class="cx"> private:
</span><span class="cx"> bool mergeStateAtTail(AbstractValue& destination, AbstractValue& inVariable, Node*);
</span><span class="lines">@@ -138,11 +140,11 @@
</span><span class="cx"> Operands<AbstractValue> m_variables;
</span><span class="cx"> BasicBlock* m_block;
</span><span class="cx">
</span><del>- bool m_haveStructures;
</del><span class="cx"> bool m_foundConstants;
</span><span class="cx">
</span><span class="cx"> bool m_isValid;
</span><span class="cx"> bool m_didClobber;
</span><ins>+ StructureClobberState m_structureClobberState;
</ins><span class="cx">
</span><span class="cx"> BranchDirection m_branchDirection; // This is only set for blocks that end in Branch and that execute to completion (i.e. m_isValid == true).
</span><span class="cx"> };
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGLivenessAnalysisPhasecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGLivenessAnalysisPhase.cpp (171379 => 171380)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGLivenessAnalysisPhase.cpp 2014-07-23 01:12:32 UTC (rev 171379)
+++ trunk/Source/JavaScriptCore/dfg/DFGLivenessAnalysisPhase.cpp 2014-07-23 01:19:50 UTC (rev 171380)
</span><span class="lines">@@ -68,13 +68,11 @@
</span><span class="cx"> } while (m_changed);
</span><span class="cx">
</span><span class="cx"> if (!m_graph.block(0)->ssa->liveAtHead.isEmpty()) {
</span><del>- startCrashing();
- dataLog(
- "Bad liveness analysis result: live at root is not empty: ",
- nodeListDump(m_graph.block(0)->ssa->liveAtHead), "\n");
- dataLog("IR at time of error:\n");
- m_graph.dump();
- CRASH();
</del><ins>+ DFG_CRASH(
+ m_graph, nullptr,
+ toCString(
+ "Bad liveness analysis result: live at root is not empty: ",
+ nodeListDump(m_graph.block(0)->ssa->liveAtHead)).data());
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> return true;
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGNodeh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGNode.h (171379 => 171380)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGNode.h 2014-07-23 01:12:32 UTC (rev 171379)
+++ trunk/Source/JavaScriptCore/dfg/DFGNode.h 2014-07-23 01:19:50 UTC (rev 171380)
</span><span class="lines">@@ -38,6 +38,7 @@
</span><span class="cx"> #include "DFGNodeFlags.h"
</span><span class="cx"> #include "DFGNodeOrigin.h"
</span><span class="cx"> #include "DFGNodeType.h"
</span><ins>+#include "DFGTransition.h"
</ins><span class="cx"> #include "DFGUseKind.h"
</span><span class="cx"> #include "DFGVariableAccessData.h"
</span><span class="cx"> #include "GetByIdVariant.h"
</span><span class="lines">@@ -67,19 +68,6 @@
</span><span class="cx"> bool reallocatesStorage() const;
</span><span class="cx"> };
</span><span class="cx">
</span><del>-struct StructureTransitionData {
- Structure* previousStructure;
- Structure* newStructure;
-
- StructureTransitionData() { }
-
- StructureTransitionData(Structure* previousStructure, Structure* newStructure)
- : previousStructure(previousStructure)
- , newStructure(newStructure)
- {
- }
-};
-
</del><span class="cx"> struct NewArrayBufferData {
</span><span class="cx"> unsigned startConstant;
</span><span class="cx"> unsigned numConstants;
</span><span class="lines">@@ -485,20 +473,6 @@
</span><span class="cx"> children.reset();
</span><span class="cx"> }
</span><span class="cx">
</span><del>- void convertToStructureTransitionWatchpoint(Structure* structure)
- {
- ASSERT(m_op == CheckStructure || m_op == ArrayifyToStructure);
- ASSERT(!child2());
- ASSERT(!child3());
- m_opInfo = bitwise_cast<uintptr_t>(structure);
- m_op = StructureTransitionWatchpoint;
- }
-
- void convertToStructureTransitionWatchpoint()
- {
- convertToStructureTransitionWatchpoint(structureSet().singletonStructure());
- }
-
</del><span class="cx"> void convertToGetByOffset(unsigned storageAccessDataIndex, Edge storage)
</span><span class="cx"> {
</span><span class="cx"> ASSERT(m_op == GetById || m_op == GetByIdFlush || m_op == MultiGetByOffset);
</span><span class="lines">@@ -1101,7 +1075,7 @@
</span><span class="cx"> return reinterpret_cast<void*>(m_opInfo);
</span><span class="cx"> }
</span><span class="cx">
</span><del>- bool hasStructureTransitionData()
</del><ins>+ bool hasTransition()
</ins><span class="cx"> {
</span><span class="cx"> switch (op()) {
</span><span class="cx"> case PutStructure:
</span><span class="lines">@@ -1114,10 +1088,10 @@
</span><span class="cx"> }
</span><span class="cx"> }
</span><span class="cx">
</span><del>- StructureTransitionData& structureTransitionData()
</del><ins>+ Transition* transition()
</ins><span class="cx"> {
</span><del>- ASSERT(hasStructureTransitionData());
- return *reinterpret_cast<StructureTransitionData*>(m_opInfo);
</del><ins>+ ASSERT(hasTransition());
+ return reinterpret_cast<Transition*>(m_opInfo);
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> bool hasStructureSet()
</span><span class="lines">@@ -1139,7 +1113,6 @@
</span><span class="cx"> bool hasStructure()
</span><span class="cx"> {
</span><span class="cx"> switch (op()) {
</span><del>- case StructureTransitionWatchpoint:
</del><span class="cx"> case ArrayifyToStructure:
</span><span class="cx"> case NewObject:
</span><span class="cx"> case NewStringObject:
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGNodeTypeh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGNodeType.h (171379 => 171380)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGNodeType.h 2014-07-23 01:12:32 UTC (rev 171379)
+++ trunk/Source/JavaScriptCore/dfg/DFGNodeType.h 2014-07-23 01:19:50 UTC (rev 171380)
</span><span class="lines">@@ -158,18 +158,6 @@
</span><span class="cx"> macro(PutByIdDirect, NodeMustGenerate | NodeClobbersWorld) \
</span><span class="cx"> macro(CheckStructure, NodeMustGenerate) \
</span><span class="cx"> macro(CheckExecutable, NodeMustGenerate) \
</span><del>- /* Transition watchpoints are a contract between the party setting the watchpoint */\
- /* and the runtime system, where the party promises that the child object once had */\
- /* the structure being watched, and the runtime system in turn promises that the */\
- /* watchpoint will be turned into an OSR exit if any object with that structure */\
- /* ever transitions to a different structure. Hence, the child object must have */\
- /* previously had a CheckStructure executed on it or we're dealing with an object */\
- /* constant (WeakJSConstant) and the object was known to have that structure at */\
- /* compile-time. In the latter case this means that no structure checks have to be */\
- /* performed for this object by JITted code. In the former case this means that*/\
- /* the object's structure does not need to be rechecked due to side-effecting */\
- /* (clobbering) operations. */\
- macro(StructureTransitionWatchpoint, NodeMustGenerate) \
</del><span class="cx"> macro(PutStructure, NodeMustGenerate) \
</span><span class="cx"> macro(PhantomPutStructure, NodeMustGenerate | NodeDoesNotExit) \
</span><span class="cx"> macro(AllocatePropertyStorage, NodeMustGenerate | NodeDoesNotExit | NodeResultStorage) \
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGPlancpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGPlan.cpp (171379 => 171380)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGPlan.cpp 2014-07-23 01:12:32 UTC (rev 171379)
+++ trunk/Source/JavaScriptCore/dfg/DFGPlan.cpp 2014-07-23 01:19:50 UTC (rev 171380)
</span><span class="lines">@@ -63,6 +63,7 @@
</span><span class="cx"> #include "DFGUnificationPhase.h"
</span><span class="cx"> #include "DFGValidate.h"
</span><span class="cx"> #include "DFGVirtualRegisterAllocationPhase.h"
</span><ins>+#include "DFGWatchableStructureWatchingPhase.h"
</ins><span class="cx"> #include "DFGWatchpointCollectionPhase.h"
</span><span class="cx"> #include "Debugger.h"
</span><span class="cx"> #include "JSCInlines.h"
</span><span class="lines">@@ -234,6 +235,7 @@
</span><span class="cx"> performBackwardsPropagation(dfg);
</span><span class="cx"> performPredictionPropagation(dfg);
</span><span class="cx"> performFixup(dfg);
</span><ins>+ performWatchableStructureWatching(dfg);
</ins><span class="cx"> performInvalidationPointInjection(dfg);
</span><span class="cx"> performTypeCheckHoisting(dfg);
</span><span class="cx">
</span><span class="lines">@@ -311,6 +313,11 @@
</span><span class="cx"> performSSAConversion(dfg);
</span><span class="cx"> performSSALowering(dfg);
</span><span class="cx"> performCSE(dfg);
</span><ins>+
+ // At this point we're not allowed to do any further code motion because our reasoning
+ // about code motion assumes that it's OK to insert GC points in random places.
+
+ performStoreBarrierElision(dfg);
</ins><span class="cx"> performLivenessAnalysis(dfg);
</span><span class="cx"> performCFA(dfg);
</span><span class="cx"> performLICM(dfg);
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGPredictionPropagationPhasecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGPredictionPropagationPhase.cpp (171379 => 171380)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGPredictionPropagationPhase.cpp 2014-07-23 01:12:32 UTC (rev 171379)
+++ trunk/Source/JavaScriptCore/dfg/DFGPredictionPropagationPhase.cpp 2014-07-23 01:19:50 UTC (rev 171380)
</span><span class="lines">@@ -610,7 +610,6 @@
</span><span class="cx"> case SetArgument:
</span><span class="cx"> case CheckStructure:
</span><span class="cx"> case CheckExecutable:
</span><del>- case StructureTransitionWatchpoint:
</del><span class="cx"> case CheckFunction:
</span><span class="cx"> case PutStructure:
</span><span class="cx"> case TearOffActivation:
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGSafeToExecuteh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGSafeToExecute.h (171379 => 171380)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGSafeToExecute.h 2014-07-23 01:12:32 UTC (rev 171379)
+++ trunk/Source/JavaScriptCore/dfg/DFGSafeToExecute.h 2014-07-23 01:19:50 UTC (rev 171380)
</span><span class="lines">@@ -279,22 +279,26 @@
</span><span class="cx"> return node->arrayMode().modeForPut().alreadyChecked(
</span><span class="cx"> graph, node, state.forNode(graph.varArgChild(node, 0)));
</span><span class="cx">
</span><del>- case StructureTransitionWatchpoint:
- return state.forNode(node->child1()).m_futurePossibleStructure.isSubsetOf(
- StructureSet(node->structure()));
-
</del><span class="cx"> case PutStructure:
</span><span class="cx"> case PhantomPutStructure:
</span><span class="cx"> case AllocatePropertyStorage:
</span><span class="cx"> case ReallocatePropertyStorage:
</span><del>- return state.forNode(node->child1()).m_currentKnownStructure.isSubsetOf(
- StructureSet(node->structureTransitionData().previousStructure));
</del><ins>+ return state.forNode(node->child1()).m_structure.isSubsetOf(
+ StructureSet(node->transition()->previous));
</ins><span class="cx">
</span><span class="cx"> case GetByOffset:
</span><span class="cx"> case GetGetterSetterByOffset:
</span><del>- case PutByOffset:
- return state.forNode(node->child1()).m_currentKnownStructure.isValidOffset(
- graph.m_storageAccessData[node->storageAccessDataIndex()].offset);
</del><ins>+ case PutByOffset: {
+ StructureAbstractValue& value = state.forNode(node->child1()).m_structure;
+ if (value.isTop())
+ return false;
+ PropertyOffset offset = graph.m_storageAccessData[node->storageAccessDataIndex()].offset;
+ for (unsigned i = value.size(); i--;) {
+ if (!value[i]->isValidOffset(offset))
+ return false;
+ }
+ return true;
+ }
</ins><span class="cx">
</span><span class="cx"> case LastNodeType:
</span><span class="cx"> RELEASE_ASSERT_NOT_REACHED();
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGSpeculativeJITcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp (171379 => 171380)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp 2014-07-23 01:12:32 UTC (rev 171379)
+++ trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp 2014-07-23 01:19:50 UTC (rev 171380)
</span><span class="lines">@@ -4220,7 +4220,7 @@
</span><span class="cx">
</span><span class="cx"> void SpeculativeJIT::compileAllocatePropertyStorage(Node* node)
</span><span class="cx"> {
</span><del>- if (node->structureTransitionData().previousStructure->couldHaveIndexingHeader()) {
</del><ins>+ if (node->transition()->previous->couldHaveIndexingHeader()) {
</ins><span class="cx"> SpeculateCellOperand base(this, node->child1());
</span><span class="cx">
</span><span class="cx"> GPRReg baseGPR = base.gpr();
</span><span class="lines">@@ -4240,8 +4240,8 @@
</span><span class="cx"> GPRReg baseGPR = base.gpr();
</span><span class="cx"> GPRReg scratchGPR1 = scratch1.gpr();
</span><span class="cx">
</span><del>- ASSERT(!node->structureTransitionData().previousStructure->outOfLineCapacity());
- ASSERT(initialOutOfLineCapacity == node->structureTransitionData().newStructure->outOfLineCapacity());
</del><ins>+ ASSERT(!node->transition()->previous->outOfLineCapacity());
+ ASSERT(initialOutOfLineCapacity == node->transition()->next->outOfLineCapacity());
</ins><span class="cx">
</span><span class="cx"> JITCompiler::Jump slowPath =
</span><span class="cx"> emitAllocateBasicStorage(
</span><span class="lines">@@ -4259,11 +4259,11 @@
</span><span class="cx">
</span><span class="cx"> void SpeculativeJIT::compileReallocatePropertyStorage(Node* node)
</span><span class="cx"> {
</span><del>- size_t oldSize = node->structureTransitionData().previousStructure->outOfLineCapacity() * sizeof(JSValue);
</del><ins>+ size_t oldSize = node->transition()->previous->outOfLineCapacity() * sizeof(JSValue);
</ins><span class="cx"> size_t newSize = oldSize * outOfLineGrowthFactor;
</span><del>- ASSERT(newSize == node->structureTransitionData().newStructure->outOfLineCapacity() * sizeof(JSValue));
</del><ins>+ ASSERT(newSize == node->transition()->next->outOfLineCapacity() * sizeof(JSValue));
</ins><span class="cx">
</span><del>- if (node->structureTransitionData().previousStructure->couldHaveIndexingHeader()) {
</del><ins>+ if (node->transition()->previous->couldHaveIndexingHeader()) {
</ins><span class="cx"> SpeculateCellOperand base(this, node->child1());
</span><span class="cx">
</span><span class="cx"> GPRReg baseGPR = base.gpr();
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGSpeculativeJITh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h (171379 => 171380)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h 2014-07-23 01:12:32 UTC (rev 171379)
+++ trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h 2014-07-23 01:19:50 UTC (rev 171380)
</span><span class="lines">@@ -3130,7 +3130,7 @@
</span><span class="cx"> Structure* stringObjectStructure =
</span><span class="cx"> m_jit.globalObjectFor(m_currentNode->origin.semantic)->stringObjectStructure();
</span><span class="cx">
</span><del>- if (!m_state.forNode(edge).m_currentKnownStructure.isSubsetOf(StructureSet(stringObjectStructure))) {
</del><ins>+ if (!m_state.forNode(edge).m_structure.isSubsetOf(StructureSet(stringObjectStructure))) {
</ins><span class="cx"> speculationCheck(
</span><span class="cx"> NotStringObject, JSValueRegs(), 0,
</span><span class="cx"> m_jit.branchStructurePtr(
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGSpeculativeJIT32_64cpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp (171379 => 171380)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp 2014-07-23 01:12:32 UTC (rev 171379)
+++ trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp 2014-07-23 01:19:50 UTC (rev 171380)
</span><span class="lines">@@ -3739,29 +3739,6 @@
</span><span class="cx"> break;
</span><span class="cx"> }
</span><span class="cx">
</span><del>- case StructureTransitionWatchpoint: {
- // There is a fascinating question here of what to do about array profiling.
- // We *could* try to tell the OSR exit about where the base of the access is.
- // The DFG will have kept it alive, though it may not be in a register, and
- // we shouldn't really load it since that could be a waste. For now though,
- // we'll just rely on the fact that when a watchpoint fires then that's
- // quite a hint already.
-
- m_jit.addWeakReference(node->structure());
-
-#if !ASSERT_DISABLED
- SpeculateCellOperand op1(this, node->child1());
- JITCompiler::Jump isOK = m_jit.branchPtr(JITCompiler::Equal, JITCompiler::Address(op1.gpr(), JSCell::structureIDOffset()), TrustedImmPtr(node->structure()));
- m_jit.abortWithReason(DFGIneffectiveWatchpoint);
- isOK.link(&m_jit);
-#else
- speculateCell(node->child1());
-#endif
-
- noResult(node);
- break;
- }
-
</del><span class="cx"> case PhantomPutStructure: {
</span><span class="cx"> ASSERT(isKnownCell(node->child1().node()));
</span><span class="cx"> m_jit.jitCode()->common.notifyCompilingStructureTransition(m_jit.graph().m_plan, m_jit.codeBlock(), node);
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGSpeculativeJIT64cpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp (171379 => 171380)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp 2014-07-23 01:12:32 UTC (rev 171379)
+++ trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp 2014-07-23 01:19:50 UTC (rev 171380)
</span><span class="lines">@@ -3852,32 +3852,6 @@
</span><span class="cx"> break;
</span><span class="cx"> }
</span><span class="cx">
</span><del>- case StructureTransitionWatchpoint: {
- // There is a fascinating question here of what to do about array profiling.
- // We *could* try to tell the OSR exit about where the base of the access is.
- // The DFG will have kept it alive, though it may not be in a register, and
- // we shouldn't really load it since that could be a waste. For now though,
- // we'll just rely on the fact that when a watchpoint fires then that's
- // quite a hint already.
-
- m_jit.addWeakReference(node->structure());
-
-#if !ASSERT_DISABLED
- SpeculateCellOperand op1(this, node->child1());
- JITCompiler::Jump isOK = m_jit.branchStructurePtr(
- JITCompiler::Equal,
- JITCompiler::Address(op1.gpr(), JSCell::structureIDOffset()),
- node->structure());
- m_jit.abortWithReason(DFGIneffectiveWatchpoint);
- isOK.link(&m_jit);
-#else
- speculateCell(node->child1());
-#endif
-
- noResult(node);
- break;
- }
-
</del><span class="cx"> case PhantomPutStructure: {
</span><span class="cx"> ASSERT(isKnownCell(node->child1().node()));
</span><span class="cx"> m_jit.jitCode()->common.notifyCompilingStructureTransition(m_jit.graph().m_plan, m_jit.codeBlock(), node);
</span><span class="lines">@@ -3886,8 +3860,8 @@
</span><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> case PutStructure: {
</span><del>- Structure* oldStructure = node->structureTransitionData().previousStructure;
- Structure* newStructure = node->structureTransitionData().newStructure;
</del><ins>+ Structure* oldStructure = node->transition()->previous;
+ Structure* newStructure = node->transition()->next;
</ins><span class="cx">
</span><span class="cx"> m_jit.jitCode()->common.notifyCompilingStructureTransition(m_jit.graph().m_plan, m_jit.codeBlock(), node);
</span><span class="cx">
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGStoreBarrierElisionPhasecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGStoreBarrierElisionPhase.cpp (171379 => 171380)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGStoreBarrierElisionPhase.cpp 2014-07-23 01:12:32 UTC (rev 171379)
+++ trunk/Source/JavaScriptCore/dfg/DFGStoreBarrierElisionPhase.cpp 2014-07-23 01:19:50 UTC (rev 171380)
</span><span class="lines">@@ -30,6 +30,7 @@
</span><span class="cx">
</span><span class="cx"> #include "DFGBasicBlock.h"
</span><span class="cx"> #include "DFGClobberize.h"
</span><ins>+#include "DFGDoesGC.h"
</ins><span class="cx"> #include "DFGGraph.h"
</span><span class="cx"> #include "DFGPhase.h"
</span><span class="cx"> #include "JSCInlines.h"
</span><span class="lines">@@ -58,11 +59,6 @@
</span><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> private:
</span><del>- bool couldCauseGC(Node* node)
- {
- return writesOverlap(m_graph, node, GCState);
- }
-
</del><span class="cx"> bool allocatesFreshObject(Node* node)
</span><span class="cx"> {
</span><span class="cx"> switch (node->op()) {
</span><span class="lines">@@ -104,7 +100,7 @@
</span><span class="cx">
</span><span class="cx"> void handleNode(HashSet<Node*>& dontNeedBarriers, Node* node)
</span><span class="cx"> {
</span><del>- if (couldCauseGC(node))
</del><ins>+ if (doesGC(m_graph, node))
</ins><span class="cx"> dontNeedBarriers.clear();
</span><span class="cx">
</span><span class="cx"> if (allocatesFreshObject(node))
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGStructureAbstractValuecpp"></a>
<div class="addfile"><h4>Added: trunk/Source/JavaScriptCore/dfg/DFGStructureAbstractValue.cpp (0 => 171380)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGStructureAbstractValue.cpp (rev 0)
+++ trunk/Source/JavaScriptCore/dfg/DFGStructureAbstractValue.cpp 2014-07-23 01:19:50 UTC (rev 171380)
</span><span class="lines">@@ -0,0 +1,413 @@
</span><ins>+/*
+ * Copyright (C) 2014 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ * notice, this list of conditions and the following disclaimer in the
+ * documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "DFGStructureAbstractValue.h"
+
+#if ENABLE(DFG_JIT)
+
+#include "DFGGraph.h"
+
+namespace JSC { namespace DFG {
+
+// Comment out the empty SAMPLE() definition, and uncomment the one that uses SamplingRegion, if
+// you want extremely fine-grained profiling in this code.
+#define SAMPLE(name)
+//#define SAMPLE(name) SamplingRegion samplingRegion(name)
+
+#if !ASSERT_DISABLED
+void StructureAbstractValue::assertIsWatched(Graph& graph) const
+{
+ SAMPLE("StructureAbstractValue assertIsWatched");
+
+ if (isTop())
+ return;
+
+ for (unsigned i = size(); i--;)
+ graph.assertIsWatched(at(i));
+}
+#endif // !ASSERT_DISABLED
+
+void StructureAbstractValue::clobber()
+{
+ SAMPLE("StructureAbstractValue clobber");
+
+ // The premise of this approach to clobbering is that anytime we introduce
+ // a watchable structure into an abstract value, we watchpoint it. You can assert
+ // that this holds by calling assertIsWatched().
+
+ if (isTop())
+ return;
+
+ setClobbered(true);
+
+ if (m_set.isThin()) {
+ if (!m_set.singleStructure())
+ return;
+ if (!m_set.singleStructure()->dfgShouldWatch())
+ makeTopWhenThin();
+ return;
+ }
+
+ StructureSet::OutOfLineList* list = m_set.structureList();
+ for (unsigned i = list->m_length; i--;) {
+ if (!list->list()[i]->dfgShouldWatch()) {
+ makeTop();
+ return;
+ }
+ }
+}
+
+void StructureAbstractValue::observeTransition(Structure* from, Structure* to)
+{
+ SAMPLE("StructureAbstractValue observeTransition");
+
+ if (isTop())
+ return;
+
+ if (!m_set.contains(from))
+ return;
+
+ if (from->dfgShouldWatch()) {
+ setClobbered(true);
+ return;
+ }
+
+ if (!m_set.add(to))
+ return;
+
+ if (m_set.size() > polymorphismLimit)
+ makeTop();
+}
+
+void StructureAbstractValue::observeTransitions(const TransitionVector& vector)
+{
+ SAMPLE("StructureAbstractValue observeTransitions");
+
+ if (isTop())
+ return;
+
+ StructureSet newStructures;
+ for (unsigned i = vector.size(); i--;) {
+ if (!m_set.contains(vector[i].previous))
+ continue;
+
+ if (vector[i].previous->dfgShouldWatch())
+ setClobbered(true);
+ else
+ newStructures.add(vector[i].next);
+ }
+
+ if (!m_set.merge(newStructures))
+ return;
+
+ if (m_set.size() > polymorphismLimit)
+ makeTop();
+}
+
+bool StructureAbstractValue::add(Structure* structure)
+{
+ SAMPLE("StructureAbstractValue add");
+
+ if (isTop())
+ return false;
+
+ if (!m_set.add(structure))
+ return false;
+
+ if (m_set.size() > polymorphismLimit)
+ makeTop();
+
+ return true;
+}
+
+bool StructureAbstractValue::merge(const StructureSet& other)
+{
+ SAMPLE("StructureAbstractValue merge set");
+
+ if (isTop())
+ return false;
+
+ return mergeNotTop(other);
+}
+
+bool StructureAbstractValue::mergeSlow(const StructureAbstractValue& other)
+{
+ SAMPLE("StructureAbstractValue merge value slow");
+
+ // It isn't immediately obvious that the code below is doing the right thing, so let's go
+ // through it.
+ //
+ // This not clobbered, other not clobbered: Clearly, we don't want to make anything clobbered
+ // since we just have two sets and we are merging them. mergeNotTop() can handle this just
+ // fine.
+ //
+ // This clobbered, other clobbered: Clobbered means that we have a set of things, plus we
+ // temporarily have the set of all things but the latter will go away once we hit the next
+ // invalidation point. This allows us to merge two clobbered sets the natural way. For now
+ // the set will still be TOP (and so we keep the clobbered bit set), but we know that after
+ // invalidation, we will have the union of the this and other.
+ //
+ // This clobbered, other not clobbered: It's safe to merge in other for both before and after
+ // invalidation, so long as we leave the clobbered bit set. Before invalidation this has no
+ // effect since the set will still appear to have all things in it. The way to think about
+ // what invalidation would do is imagine if we had a set A that was clobbered and a set B
+ // that wasn't and we considered the following two cases. Note that we expect A to be the
+ // same at the end in both cases:
+ //
+ // A.merge(B) InvalidationPoint
+ // InvalidationPoint A.merge(B)
+ //
+ // The fact that we expect A to be the same in both cases means that we want to merge other
+ // into this but keep the clobbered bit.
+ //
+ // This not clobbered, other clobbered: This is just the converse of the previous case. We
+ // want to merge other into this and set the clobbered bit.
+
+ bool changed = false;
+
+ if (!isClobbered() && other.isClobbered()) {
+ setClobbered(true);
+ changed = true;
+ }
+
+ changed |= mergeNotTop(other.m_set);
+
+ return changed;
+}
+
+bool StructureAbstractValue::mergeNotTop(const StructureSet& other)
+{
+ SAMPLE("StructureAbstractValue merge not top");
+
+ if (!m_set.merge(other))
+ return false;
+
+ if (m_set.size() > polymorphismLimit)
+ makeTop();
+
+ return true;
+}
+
+void StructureAbstractValue::filter(const StructureSet& other)
+{
+ SAMPLE("StructureAbstractValue filter set");
+
+ if (isTop()) {
+ m_set = other;
+ return;
+ }
+
+ if (isClobbered()) {
+ // We have two choices here:
+ //
+ // Do nothing: It's legal to keep our set intact, which would essentially mean that for
+ // now, our set would behave like TOP but after the next invalidation point it wold be
+ // a finite set again. This may be a good choice if 'other' is much bigger than our
+ // m_set.
+ //
+ // Replace m_set with other and clear the clobber bit: This is also legal, and means that
+ // we're no longer clobbered. This is usually better because it immediately gives us a
+ // smaller set.
+ //
+ // This scenario should come up rarely. We usually don't do anything to an abstract value
+ // after it is clobbered. But we apply some heuristics.
+
+ if (other.size() > m_set.size() + clobberedSupremacyThreshold)
+ return; // Keep the clobbered set.
+
+ m_set = other;
+ setClobbered(false);
+ return;
+ }
+
+ m_set.filter(other);
+}
+
+void StructureAbstractValue::filter(const StructureAbstractValue& other)
+{
+ SAMPLE("StructureAbstractValue filter value");
+
+ if (other.isTop())
+ return;
+
+ if (other.isClobbered()) {
+ if (isTop())
+ return;
+
+ if (!isClobbered()) {
+ // See justification in filter(const StructureSet&), above. An unclobbered set is
+ // almost always better.
+ if (m_set.size() > other.m_set.size() + clobberedSupremacyThreshold)
+ *this = other; // Keep the clobbered set.
+ return;
+ }
+
+ m_set.filter(other.m_set);
+ return;
+ }
+
+ filter(other.m_set);
+}
+
+namespace {
+
+class ConformsToType {
+public:
+ ConformsToType(SpeculatedType type)
+ : m_type(type)
+ {
+ }
+
+ bool operator()(Structure* structure)
+ {
+ return !!(speculationFromStructure(structure) & m_type);
+ }
+private:
+ SpeculatedType m_type;
+};
+
+} // anonymous namespace
+
+void StructureAbstractValue::filterSlow(SpeculatedType type)
+{
+ SAMPLE("StructureAbstractValue filter type slow");
+
+ if (!(type & SpecCell)) {
+ clear();
+ return;
+ }
+
+ ASSERT(!isTop());
+
+ ConformsToType conformsToType(type);
+ m_set.genericFilter(conformsToType);
+}
+
+bool StructureAbstractValue::contains(Structure* structure) const
+{
+ SAMPLE("StructureAbstractValue contains");
+
+ if (isTop() || isClobbered())
+ return true;
+
+ return m_set.contains(structure);
+}
+
+bool StructureAbstractValue::isSubsetOf(const StructureSet& other) const
+{
+ SAMPLE("StructureAbstractValue isSubsetOf set");
+
+ if (isTop() || isClobbered())
+ return false;
+
+ return m_set.isSubsetOf(other);
+}
+
+bool StructureAbstractValue::isSubsetOf(const StructureAbstractValue& other) const
+{
+ SAMPLE("StructureAbstractValue isSubsetOf value");
+
+ if (isTop())
+ return false;
+
+ if (other.isTop())
+ return true;
+
+ if (isClobbered() == other.isClobbered())
+ return m_set.isSubsetOf(other.m_set);
+
+ // Here it gets tricky. If in doubt, return false!
+
+ if (isClobbered())
+ return false; // A clobbered set is never a subset of an unclobbered set.
+
+ // An unclobbered set is currently a subset of a clobbered set, but it may not be so after
+ // invalidation.
+ return m_set.isSubsetOf(other.m_set);
+}
+
+bool StructureAbstractValue::isSupersetOf(const StructureSet& other) const
+{
+ SAMPLE("StructureAbstractValue isSupersetOf set");
+
+ if (isTop() || isClobbered())
+ return true;
+
+ return m_set.isSupersetOf(other);
+}
+
+bool StructureAbstractValue::overlaps(const StructureSet& other) const
+{
+ SAMPLE("StructureAbstractValue overlaps set");
+
+ if (isTop() || isClobbered())
+ return true;
+
+ return m_set.overlaps(other);
+}
+
+bool StructureAbstractValue::overlaps(const StructureAbstractValue& other) const
+{
+ SAMPLE("StructureAbstractValue overlaps value");
+
+ if (other.isTop() || other.isClobbered())
+ return true;
+
+ return overlaps(other.m_set);
+}
+
+bool StructureAbstractValue::equalsSlow(const StructureAbstractValue& other) const
+{
+ SAMPLE("StructureAbstractValue equalsSlow");
+
+ ASSERT(m_set.m_pointer != other.m_set.m_pointer);
+ ASSERT(!isTop());
+ ASSERT(!other.isTop());
+
+ return m_set == other.m_set
+ && isClobbered() == other.isClobbered();
+}
+
+void StructureAbstractValue::dumpInContext(PrintStream& out, DumpContext* context) const
+{
+ if (isClobbered())
+ out.print("Clobbered:");
+
+ if (isTop())
+ out.print("TOP");
+ else
+ out.print(inContext(m_set, context));
+}
+
+void StructureAbstractValue::dump(PrintStream& out) const
+{
+ dumpInContext(out, 0);
+}
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
+
</ins></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGStructureAbstractValueh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGStructureAbstractValue.h (171379 => 171380)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGStructureAbstractValue.h 2014-07-23 01:12:32 UTC (rev 171379)
+++ trunk/Source/JavaScriptCore/dfg/DFGStructureAbstractValue.h 2014-07-23 01:19:50 UTC (rev 171380)
</span><span class="lines">@@ -1,5 +1,5 @@
</span><span class="cx"> /*
</span><del>- * Copyright (C) 2011, 2012, 2013 Apple Inc. All rights reserved.
</del><ins>+ * Copyright (C) 2011, 2012, 2013, 2014 Apple Inc. All rights reserved.
</ins><span class="cx"> *
</span><span class="cx"> * Redistribution and use in source and binary forms, with or without
</span><span class="cx"> * modification, are permitted provided that the following conditions
</span><span class="lines">@@ -28,6 +28,7 @@
</span><span class="cx">
</span><span class="cx"> #if ENABLE(DFG_JIT)
</span><span class="cx">
</span><ins>+#include "DFGTransition.h"
</ins><span class="cx"> #include "JSCell.h"
</span><span class="cx"> #include "SpeculatedType.h"
</span><span class="cx"> #include "DumpContext.h"
</span><span class="lines">@@ -37,300 +38,190 @@
</span><span class="cx">
</span><span class="cx"> class StructureAbstractValue {
</span><span class="cx"> public:
</span><del>- StructureAbstractValue()
- : m_structure(0)
</del><ins>+ StructureAbstractValue() { }
+ StructureAbstractValue(Structure* structure)
+ : m_set(structure)
</ins><span class="cx"> {
</span><ins>+ setClobbered(false);
</ins><span class="cx"> }
</span><del>-
- StructureAbstractValue(Structure* structure)
- : m_structure(structure)
</del><ins>+ StructureAbstractValue(const StructureSet& other)
+ : m_set(other)
</ins><span class="cx"> {
</span><ins>+ setClobbered(false);
</ins><span class="cx"> }
</span><ins>+ ALWAYS_INLINE StructureAbstractValue(const StructureAbstractValue& other)
+ : m_set(other.m_set)
+ {
+ setClobbered(other.isClobbered());
+ }
</ins><span class="cx">
</span><del>- StructureAbstractValue(const StructureSet& set)
</del><ins>+ ALWAYS_INLINE StructureAbstractValue& operator=(const StructureAbstractValue& other)
</ins><span class="cx"> {
</span><del>- switch (set.size()) {
- case 0:
- m_structure = 0;
- break;
-
- case 1:
- m_structure = set[0];
- break;
-
- default:
- m_structure = topValue();
- break;
- }
</del><ins>+ m_set = other.m_set;
+ setClobbered(other.isClobbered());
+ return *this;
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> void clear()
</span><span class="cx"> {
</span><del>- m_structure = 0;
</del><ins>+ m_set.clear();
+ setClobbered(false);
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> void makeTop()
</span><span class="cx"> {
</span><del>- m_structure = topValue();
</del><ins>+ m_set.deleteStructureListIfNecessary();
+ m_set.m_pointer = topValue;
</ins><span class="cx"> }
</span><span class="cx">
</span><del>- static StructureAbstractValue top()
- {
- StructureAbstractValue value;
- value.makeTop();
- return value;
- }
</del><ins>+#if ASSERT_DISABLED
+ void assertIsWatched(Graph&) const { }
+#else
+ void assertIsWatched(Graph&) const;
+#endif
</ins><span class="cx">
</span><del>- void add(Structure* structure)
- {
- ASSERT(!contains(structure) && !isTop());
- if (m_structure)
- makeTop();
- else
- m_structure = structure;
- }
</del><ins>+ void clobber();
+ void observeInvalidationPoint() { setClobbered(false); }
</ins><span class="cx">
</span><del>- bool addAll(const StructureSet& other)
- {
- if (isTop() || !other.size())
- return false;
- if (other.size() > 1) {
- makeTop();
- return true;
- }
- if (!m_structure) {
- m_structure = other[0];
- return true;
- }
- if (m_structure == other[0])
- return false;
- makeTop();
- return true;
- }
</del><ins>+ void observeTransition(Structure* from, Structure* to);
+ void observeTransitions(const TransitionVector&);
</ins><span class="cx">
</span><del>- bool addAll(const StructureAbstractValue& other)
</del><ins>+ static StructureAbstractValue top()
</ins><span class="cx"> {
</span><del>- if (!other.m_structure)
- return false;
- if (isTop())
- return false;
- if (other.isTop()) {
- makeTop();
- return true;
- }
- if (m_structure) {
- if (m_structure == other.m_structure)
- return false;
- makeTop();
- return true;
- }
- m_structure = other.m_structure;
- return true;
</del><ins>+ StructureAbstractValue result;
+ result.m_set.m_pointer = topValue;
+ return result;
</ins><span class="cx"> }
</span><span class="cx">
</span><del>- bool contains(Structure* structure) const
- {
- if (isTop())
- return true;
- if (m_structure == structure)
- return true;
- return false;
- }
</del><ins>+ bool isClear() const { return m_set.isEmpty(); }
+ bool isTop() const { return m_set.m_pointer == topValue; }
+ bool isNeitherClearNorTop() const { return !isClear() && !isTop(); }
</ins><span class="cx">
</span><del>- bool isSubsetOf(const StructureSet& other) const
- {
- if (isTop())
- return false;
- if (!m_structure)
- return true;
- return other.contains(m_structure);
- }
</del><ins>+ // A clobbered abstract value means that the set currently contains the m_set set of
+ // structures plus TOP, except that the "plus TOP" will go away at the next invalidation
+ // point. Note that it's tempting to think of this as "the set of structures in m_set plus
+ // the set of structures transition-reachable from m_set" - but this isn't really correct,
+ // since if we add an unwatchable structure after clobbering, the two definitions are not
+ // equivalent. If we do this, the new unwatchable structure will be added to m_set.
+ // Invalidation points do not try to "clip" the set of transition-reachable structures from
+ // m_set by looking at reachability as this would mean that the new set is TOP. Instead they
+ // literally assume that the set is just m_set rather than m_set plus TOP.
+ bool isClobbered() const { return m_set.getReservedFlag(); }
</ins><span class="cx">
</span><del>- bool doesNotContainAnyOtherThan(Structure* structure) const
- {
- if (isTop())
- return false;
- if (!m_structure)
- return true;
- return m_structure == structure;
- }
</del><ins>+ bool add(Structure* structure);
</ins><span class="cx">
</span><del>- bool isSupersetOf(const StructureSet& other) const
- {
- if (isTop())
- return true;
- if (!other.size())
- return true;
- if (other.size() > 1)
- return false;
- return m_structure == other[0];
- }
</del><ins>+ bool merge(const StructureSet& other);
</ins><span class="cx">
</span><del>- bool isSubsetOf(const StructureAbstractValue& other) const
</del><ins>+ ALWAYS_INLINE bool merge(const StructureAbstractValue& other)
</ins><span class="cx"> {
</span><del>- if (other.isTop())
- return true;
</del><ins>+ if (other.isClear())
+ return false;
+
</ins><span class="cx"> if (isTop())
</span><span class="cx"> return false;
</span><del>- if (m_structure) {
- if (other.m_structure)
- return m_structure == other.m_structure;
- return false;
- }
- return true;
- }
-
- bool isSupersetOf(const StructureAbstractValue& other) const
- {
- return other.isSubsetOf(*this);
- }
-
- void filter(const StructureSet& other)
- {
- if (!m_structure)
- return;
</del><span class="cx">
</span><del>- if (isTop()) {
- switch (other.size()) {
- case 0:
- m_structure = 0;
- return;
-
- case 1:
- m_structure = other[0];
- return;
-
- default:
- return;
- }
</del><ins>+ if (other.isTop()) {
+ makeTop();
+ return true;
</ins><span class="cx"> }
</span><span class="cx">
</span><del>- if (other.contains(m_structure))
- return;
-
- m_structure = 0;
</del><ins>+ return mergeSlow(other);
</ins><span class="cx"> }
</span><span class="cx">
</span><del>- void filter(const StructureAbstractValue& other)
- {
- if (isTop()) {
- m_structure = other.m_structure;
- return;
- }
- if (m_structure == other.m_structure)
- return;
- if (other.isTop())
- return;
- m_structure = 0;
- }
</del><ins>+ void filter(const StructureSet& other);
+ void filter(const StructureAbstractValue& other);
</ins><span class="cx">
</span><del>- void filter(SpeculatedType other)
</del><ins>+ ALWAYS_INLINE void filter(SpeculatedType type)
</ins><span class="cx"> {
</span><del>- if (!(other & SpecCell)) {
</del><ins>+ if (!(type & SpecCell)) {
</ins><span class="cx"> clear();
</span><span class="cx"> return;
</span><span class="cx"> }
</span><del>-
- if (isClearOrTop())
- return;
-
- if (!(speculationFromStructure(m_structure) & other))
- m_structure = 0;
</del><ins>+ if (isNeitherClearNorTop())
+ filterSlow(type);
</ins><span class="cx"> }
</span><span class="cx">
</span><del>- bool isClear() const
</del><ins>+ ALWAYS_INLINE bool operator==(const StructureAbstractValue& other) const
</ins><span class="cx"> {
</span><del>- return !m_structure;
</del><ins>+ if ((m_set.isThin() && other.m_set.isThin()) || isTop() || other.isTop())
+ return m_set.m_pointer == other.m_set.m_pointer;
+
+ return equalsSlow(other);
</ins><span class="cx"> }
</span><span class="cx">
</span><del>- bool isTop() const { return m_structure == topValue(); }
-
- bool isClearOrTop() const { return m_structure <= topValue(); }
- bool isNeitherClearNorTop() const { return !isClearOrTop(); }
-
</del><span class="cx"> size_t size() const
</span><span class="cx"> {
</span><span class="cx"> ASSERT(!isTop());
</span><del>- return !!m_structure;
</del><ins>+ return m_set.size();
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> Structure* at(size_t i) const
</span><span class="cx"> {
</span><span class="cx"> ASSERT(!isTop());
</span><del>- ASSERT(m_structure);
- ASSERT_UNUSED(i, !i);
- return m_structure;
</del><ins>+ return m_set.at(i);
</ins><span class="cx"> }
</span><span class="cx">
</span><del>- Structure* operator[](size_t i) const
- {
- return at(i);
- }
</del><ins>+ Structure* operator[](size_t i) const { return at(i); }
</ins><span class="cx">
</span><del>- Structure* last() const
</del><ins>+ // FIXME: Eliminate all uses of this method. There shouldn't be any
+ // special-casing for the one-structure case.
+ // https://bugs.webkit.org/show_bug.cgi?id=133229
+ Structure* onlyStructure() const
</ins><span class="cx"> {
</span><ins>+ if (isTop() || size() != 1)
+ return nullptr;
</ins><span class="cx"> return at(0);
</span><span class="cx"> }
</span><span class="cx">
</span><del>- SpeculatedType speculationFromStructures() const
- {
- if (isTop())
- return SpecCell;
- if (isClear())
- return SpecNone;
- return speculationFromStructure(m_structure);
- }
</del><ins>+ void dumpInContext(PrintStream&, DumpContext*) const;
+ void dump(PrintStream&) const;
</ins><span class="cx">
</span><del>- bool isValidOffset(PropertyOffset offset)
- {
- if (isTop())
- return false;
- if (isClear())
- return true;
- return m_structure->isValidOffset(offset);
- }
</del><ins>+ // The methods below are all conservative and err on the side of making 'this' appear bigger
+ // than it is. For example, contains() may return true if the set is clobbered or TOP.
+ // isSubsetOf() may return false in case of ambiguities. Therefore you should only perform
+ // optimizations as a consequence of the "this is smaller" return value - so false for
+ // contains(), true for isSubsetOf(), false for isSupersetOf(), and false for overlaps().
+
+ bool contains(Structure* structure) const;
</ins><span class="cx">
</span><del>- bool hasSingleton() const
- {
- return isNeitherClearNorTop();
- }
</del><ins>+ bool isSubsetOf(const StructureSet& other) const;
+ bool isSubsetOf(const StructureAbstractValue& other) const;
</ins><span class="cx">
</span><del>- Structure* singleton() const
</del><ins>+ bool isSupersetOf(const StructureSet& other) const;
+ bool isSupersetOf(const StructureAbstractValue& other) const
</ins><span class="cx"> {
</span><del>- ASSERT(isNeitherClearNorTop());
- return m_structure;
</del><ins>+ return other.isSubsetOf(*this);
</ins><span class="cx"> }
</span><span class="cx">
</span><del>- bool operator==(const StructureAbstractValue& other) const
</del><ins>+ bool overlaps(const StructureSet& other) const;
+ bool overlaps(const StructureAbstractValue& other) const;
+
+private:
+ static const uintptr_t clobberedFlag = StructureSet::reservedFlag;
+ static const uintptr_t topValue = StructureSet::reservedValue;
+ static const unsigned polymorphismLimit = 10;
+ static const unsigned clobberedSupremacyThreshold = 2;
+
+ void filterSlow(SpeculatedType type);
+ bool mergeSlow(const StructureAbstractValue& other);
+
+ bool equalsSlow(const StructureAbstractValue& other) const;
+
+ void makeTopWhenThin()
</ins><span class="cx"> {
</span><del>- return m_structure == other.m_structure;
</del><ins>+ ASSERT(m_set.isThin());
+ m_set.m_pointer = topValue;
</ins><span class="cx"> }
</span><span class="cx">
</span><del>- void dumpInContext(PrintStream& out, DumpContext* context) const
</del><ins>+ bool mergeNotTop(const StructureSet& other);
+
+ void setClobbered(bool clobbered)
</ins><span class="cx"> {
</span><del>- if (isTop()) {
- out.print("TOP");
- return;
- }
-
- out.print("[");
- if (m_structure)
- out.print(inContext(*m_structure, context));
- out.print("]");
</del><ins>+ ASSERT(!isTop() || !clobbered);
+ m_set.setReservedFlag(clobbered);
</ins><span class="cx"> }
</span><del>-
- void dump(PrintStream& out) const
- {
- dumpInContext(out, 0);
- }
-
-private:
- static Structure* topValue() { return reinterpret_cast<Structure*>(1); }
</del><span class="cx">
</span><del>- // NB. This must have a trivial destructor.
-
- // This can only remember one structure at a time.
- Structure* m_structure;
</del><ins>+ StructureSet m_set;
</ins><span class="cx"> };
</span><span class="cx">
</span><span class="cx"> } } // namespace JSC::DFG
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGStructureClobberStateh"></a>
<div class="addfile"><h4>Added: trunk/Source/JavaScriptCore/dfg/DFGStructureClobberState.h (0 => 171380)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGStructureClobberState.h (rev 0)
+++ trunk/Source/JavaScriptCore/dfg/DFGStructureClobberState.h 2014-07-23 01:19:50 UTC (rev 171380)
</span><span class="lines">@@ -0,0 +1,72 @@
</span><ins>+/*
+ * Copyright (C) 2014 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ * notice, this list of conditions and the following disclaimer in the
+ * documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef DFGStructureClobberState_h
+#define DFGStructureClobberState_h
+
+#if ENABLE(DFG_JIT)
+
+#include <wtf/PrintStream.h>
+
+namespace JSC { namespace DFG {
+
+enum StructureClobberState {
+ StructuresAreWatched, // Constants with watchable structures must have those structures.
+ StructuresAreClobbered // Constants with watchable structures could have any structure.
+};
+
+inline StructureClobberState merge(StructureClobberState a, StructureClobberState b)
+{
+ switch (a) {
+ case StructuresAreWatched:
+ return b;
+ case StructuresAreClobbered:
+ return StructuresAreClobbered;
+ }
+ RELEASE_ASSERT_NOT_REACHED();
+}
+
+} } // namespace JSC::DFG
+
+namespace WTF {
+
+inline void printInternal(PrintStream& out, JSC::DFG::StructureClobberState state)
+{
+ switch (state) {
+ case JSC::DFG::StructuresAreWatched:
+ out.print("StructuresAreWatched");
+ return;
+ case JSC::DFG::StructuresAreClobbered:
+ out.print("StructuresAreClobbered");
+ return;
+ }
+ RELEASE_ASSERT_NOT_REACHED();
+}
+
+} // namespace WTF
+
+#endif // ENABLE(DFG_JIT)
+
+#endif // DFGStructureClobberState_h
</ins></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGTransitioncpp"></a>
<div class="addfile"><h4>Added: trunk/Source/JavaScriptCore/dfg/DFGTransition.cpp (0 => 171380)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGTransition.cpp (rev 0)
+++ trunk/Source/JavaScriptCore/dfg/DFGTransition.cpp 2014-07-23 01:19:50 UTC (rev 171380)
</span><span class="lines">@@ -0,0 +1,48 @@
</span><ins>+/*
+ * Copyright (C) 2014 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ * notice, this list of conditions and the following disclaimer in the
+ * documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "DFGTransition.h"
+
+#if ENABLE(DFG_JIT)
+
+#include "JSCInlines.h"
+
+namespace JSC { namespace DFG {
+
+void Transition::dumpInContext(PrintStream& out, DumpContext* context) const
+{
+ out.print(pointerDumpInContext(previous, context), " -> ", pointerDumpInContext(next, context));
+}
+
+void Transition::dump(PrintStream& out) const
+{
+ dumpInContext(out, 0);
+}
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
+
</ins></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGTransitionh"></a>
<div class="addfile"><h4>Added: trunk/Source/JavaScriptCore/dfg/DFGTransition.h (0 => 171380)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGTransition.h (rev 0)
+++ trunk/Source/JavaScriptCore/dfg/DFGTransition.h 2014-07-23 01:19:50 UTC (rev 171380)
</span><span class="lines">@@ -0,0 +1,68 @@
</span><ins>+/*
+ * Copyright (C) 2014 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ * notice, this list of conditions and the following disclaimer in the
+ * documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef DFGTransition_h
+#define DFGTransition_h
+
+#if ENABLE(DFG_JIT)
+
+#include <wtf/PrintStream.h>
+#include <wtf/Vector.h>
+
+namespace JSC {
+
+class Structure;
+struct DumpContext;
+
+namespace DFG {
+
+struct Transition {
+ Structure* previous;
+ Structure* next;
+
+ Transition()
+ : previous(nullptr)
+ , next(nullptr)
+ {
+ }
+
+ Transition(Structure* previous, Structure* next)
+ : previous(previous)
+ , next(next)
+ {
+ }
+
+ void dumpInContext(PrintStream&, DumpContext*) const;
+ void dump(PrintStream&) const;
+};
+
+typedef Vector<Transition, 3> TransitionVector;
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
+
+#endif // DFGTransition_h
+
</ins></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGTypeCheckHoistingPhasecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGTypeCheckHoistingPhase.cpp (171379 => 171380)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGTypeCheckHoistingPhase.cpp 2014-07-23 01:12:32 UTC (rev 171379)
+++ trunk/Source/JavaScriptCore/dfg/DFGTypeCheckHoistingPhase.cpp 2014-07-23 01:19:50 UTC (rev 171380)
</span><span class="lines">@@ -215,8 +215,7 @@
</span><span class="cx"> for (unsigned indexInBlock = 0; indexInBlock < block->size(); ++indexInBlock) {
</span><span class="cx"> Node* node = block->at(indexInBlock);
</span><span class="cx"> switch (node->op()) {
</span><del>- case CheckStructure:
- case StructureTransitionWatchpoint: {
</del><ins>+ case CheckStructure: {
</ins><span class="cx"> Node* child = node->child1().node();
</span><span class="cx"> if (child->op() != GetLocal)
</span><span class="cx"> break;
</span><span class="lines">@@ -285,13 +284,6 @@
</span><span class="cx"> noticeStructureCheck(variable, subNode->structureSet());
</span><span class="cx"> break;
</span><span class="cx"> }
</span><del>- case StructureTransitionWatchpoint: {
- if (subNode->child1() != source)
- break;
-
- noticeStructureCheck(variable, subNode->structure());
- break;
- }
</del><span class="cx"> default:
</span><span class="cx"> break;
</span><span class="cx"> }
</span><span class="lines">@@ -331,7 +323,6 @@
</span><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> case CheckStructure:
</span><del>- case StructureTransitionWatchpoint:
</del><span class="cx"> case GetByOffset:
</span><span class="cx"> case PutByOffset:
</span><span class="cx"> case PutStructure:
</span><span class="lines">@@ -386,13 +377,6 @@
</span><span class="cx"> noticeStructureCheckAccountingForArrayMode(variable, subNode->structureSet());
</span><span class="cx"> break;
</span><span class="cx"> }
</span><del>- case StructureTransitionWatchpoint: {
- if (subNode->child1() != source)
- break;
-
- noticeStructureCheckAccountingForArrayMode(variable, subNode->structure());
- break;
- }
</del><span class="cx"> case CheckArray: {
</span><span class="cx"> if (subNode->child1() != source)
</span><span class="cx"> break;
</span><span class="lines">@@ -503,7 +487,7 @@
</span><span class="cx"> noticeStructureCheck(variable, 0);
</span><span class="cx"> return;
</span><span class="cx"> }
</span><del>- noticeStructureCheck(variable, set.singletonStructure());
</del><ins>+ noticeStructureCheck(variable, set.onlyStructure());
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> void noticeCheckArray(VariableAccessData* variable, ArrayMode arrayMode)
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGWatchableStructureWatchingPhasecpp"></a>
<div class="addfile"><h4>Added: trunk/Source/JavaScriptCore/dfg/DFGWatchableStructureWatchingPhase.cpp (0 => 171380)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGWatchableStructureWatchingPhase.cpp (rev 0)
+++ trunk/Source/JavaScriptCore/dfg/DFGWatchableStructureWatchingPhase.cpp 2014-07-23 01:19:50 UTC (rev 171380)
</span><span class="lines">@@ -0,0 +1,179 @@
</span><ins>+/*
+ * Copyright (C) 2014 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ * notice, this list of conditions and the following disclaimer in the
+ * documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "DFGWatchableStructureWatchingPhase.h"
+
+#if ENABLE(DFG_JIT)
+
+#include "DFGBasicBlockInlines.h"
+#include "DFGGraph.h"
+#include "DFGPhase.h"
+#include "JSCInlines.h"
+
+namespace JSC { namespace DFG {
+
+class WatchableStructureWatchingPhase : public Phase {
+public:
+ WatchableStructureWatchingPhase(Graph& graph)
+ : Phase(graph, "watchable structure watching")
+ {
+ }
+
+ bool run()
+ {
+ // These are pretty dumb, but needed to placate subsequent assertions. We con't actually
+ // have to watch these because there is no way to transition away from it, but they are
+ // watchable and so we will assert if they aren't watched.
+ tryWatch(m_graph.m_vm.stringStructure.get());
+ tryWatch(m_graph.m_vm.getterSetterStructure.get());
+
+ for (BlockIndex blockIndex = m_graph.numBlocks(); blockIndex--;) {
+ BasicBlock* block = m_graph.block(blockIndex);
+ if (!block)
+ continue;
+
+ for (unsigned nodeIndex = 0; nodeIndex < block->size(); ++nodeIndex) {
+ Node* node = block->at(nodeIndex);
+
+ switch (node->op()) {
+ case JSConstant:
+ case WeakJSConstant:
+ tryWatch(m_graph.valueOfJSConstant(node));
+ break;
+
+ case CheckFunction:
+ tryWatch(node->function());
+ break;
+
+ case CheckExecutable:
+ tryWatch(node->executable());
+ break;
+
+ case CheckStructure:
+ tryWatch(node->structureSet());
+ break;
+
+ case NewObject:
+ case ArrayifyToStructure:
+ case NewStringObject:
+ tryWatch(node->structure());
+ break;
+
+ case PutStructure:
+ case PhantomPutStructure:
+ case AllocatePropertyStorage:
+ case ReallocatePropertyStorage:
+ RELEASE_ASSERT(node->transition()->previous->transitionWatchpointSetHasBeenInvalidated());
+ tryWatch(node->transition()->next);
+ break;
+
+ case MultiGetByOffset:
+ for (unsigned i = node->multiGetByOffsetData().variants.size(); i--;) {
+ GetByIdVariant& variant = node->multiGetByOffsetData().variants[i];
+ tryWatch(variant.specificValue());
+ tryWatch(variant.structureSet());
+ // Don't need to watch anything in the structure chain because that would
+ // have been decomposed into CheckStructure's. Don't need to watch the
+ // callLinkStatus because we wouldn't use MultiGetByOffset if any of the
+ // variants did that.
+ ASSERT(!variant.callLinkStatus());
+ }
+ break;
+
+ case MultiPutByOffset:
+ for (unsigned i = node->multiPutByOffsetData().variants.size(); i--;) {
+ PutByIdVariant& variant = node->multiPutByOffsetData().variants[i];
+ tryWatch(variant.oldStructure());
+ if (variant.kind() == PutByIdVariant::Transition)
+ tryWatch(variant.newStructure());
+ }
+ break;
+
+ case NewArray:
+ case NewArrayBuffer:
+ tryWatch(m_graph.globalObjectFor(node->origin.semantic)->arrayStructureForIndexingTypeDuringAllocation(node->indexingType()));
+ break;
+
+ case NewTypedArray:
+ tryWatch(m_graph.globalObjectFor(node->origin.semantic)->typedArrayStructure(node->typedArrayType()));
+ break;
+
+ case ToString:
+ tryWatch(m_graph.globalObjectFor(node->origin.semantic)->stringObjectStructure());
+ break;
+
+ case CreateActivation:
+ tryWatch(m_graph.globalObjectFor(node->origin.semantic)->activationStructure());
+ break;
+
+ case NewRegexp:
+ tryWatch(m_graph.globalObjectFor(node->origin.semantic)->regExpStructure());
+ break;
+
+ default:
+ break;
+ }
+ }
+ }
+
+ return true;
+ }
+
+private:
+ void tryWatch(JSValue value)
+ {
+ if (value.isCell())
+ tryWatch(value.asCell());
+ }
+
+ void tryWatch(JSCell* cell)
+ {
+ if (cell)
+ tryWatch(cell->structure());
+ }
+
+ void tryWatch(const StructureSet& set)
+ {
+ for (unsigned i = set.size(); i--;)
+ tryWatch(set[i]);
+ }
+
+ void tryWatch(Structure* structure)
+ {
+ m_graph.watchpoints().consider(structure);
+ }
+};
+
+bool performWatchableStructureWatching(Graph& graph)
+{
+ SamplingRegion samplingRegion("DFG Watchable Structure Watching");
+ return runPhase<WatchableStructureWatchingPhase>(graph);
+}
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
+
</ins></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGWatchableStructureWatchingPhaseh"></a>
<div class="addfile"><h4>Added: trunk/Source/JavaScriptCore/dfg/DFGWatchableStructureWatchingPhase.h (0 => 171380)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGWatchableStructureWatchingPhase.h (rev 0)
+++ trunk/Source/JavaScriptCore/dfg/DFGWatchableStructureWatchingPhase.h 2014-07-23 01:19:50 UTC (rev 171380)
</span><span class="lines">@@ -0,0 +1,53 @@
</span><ins>+/*
+ * Copyright (C) 2014 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ * notice, this list of conditions and the following disclaimer in the
+ * documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef DFGWatchableStructureWatchingPhase_h
+#define DFGWatchableStructureWatchingPhase_h
+
+#if ENABLE(DFG_JIT)
+
+namespace JSC { namespace DFG {
+
+class Graph;
+
+// Set watchpoints on any structures that we know of that are currently watchable. It's
+// somewhat counterintuitive, but this ends up being the cleanest and most effective way
+// of reducing structure checks on terminal structures:
+//
+// - We used to only set watchpoints on watchable structures if we knew that this would
+// remove a structure check. Experiments show that switching from that, to blindly
+// setting watchpoints on all watchable structures, was not a regression.
+//
+// - It makes abstract interpretation a whole lot easier. We just assume that watchable
+// structures are unclobberable without having to do any other logic.
+
+bool performWatchableStructureWatching(Graph&);
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
+
+#endif // DFGWatchableStructureWatchingPhase_h
+
</ins></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGWatchpointCollectionPhasecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGWatchpointCollectionPhase.cpp (171379 => 171380)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGWatchpointCollectionPhase.cpp 2014-07-23 01:12:32 UTC (rev 171379)
+++ trunk/Source/JavaScriptCore/dfg/DFGWatchpointCollectionPhase.cpp 2014-07-23 01:19:50 UTC (rev 171380)
</span><span class="lines">@@ -64,8 +64,6 @@
</span><span class="cx"> private:
</span><span class="cx"> void handle()
</span><span class="cx"> {
</span><del>- DFG_NODE_DO_TO_CHILDREN(m_graph, m_node, handleEdge);
-
</del><span class="cx"> switch (m_node->op()) {
</span><span class="cx"> case CompareEqConstant:
</span><span class="cx"> case IsUndefined:
</span><span class="lines">@@ -119,13 +117,6 @@
</span><span class="cx"> addLazily(jsCast<JSFunction*>(m_node->function())->allocationProfileWatchpointSet());
</span><span class="cx"> break;
</span><span class="cx">
</span><del>- case StructureTransitionWatchpoint:
- m_graph.watchpoints().addLazily(
- m_node->origin.semantic,
- m_node->child1()->op() == WeakJSConstant ? BadWeakConstantCacheWatchpoint : BadCacheWatchpoint,
- m_node->structure()->transitionWatchpointSet());
- break;
-
</del><span class="cx"> case VariableWatchpoint:
</span><span class="cx"> addLazily(m_node->variableWatchpointSet());
</span><span class="cx"> break;
</span><span class="lines">@@ -147,26 +138,6 @@
</span><span class="cx"> }
</span><span class="cx"> }
</span><span class="cx">
</span><del>- void handleEdge(Node*, Edge edge)
- {
- switch (edge.useKind()) {
- case StringObjectUse:
- case StringOrStringObjectUse: {
- Structure* stringObjectStructure = globalObject()->stringObjectStructure();
- Structure* stringPrototypeStructure = stringObjectStructure->storedPrototype().asCell()->structure();
- ASSERT(m_graph.watchpoints().isValidOrMixed(stringPrototypeStructure->transitionWatchpointSet()));
-
- m_graph.watchpoints().addLazily(
- m_node->origin.semantic, NotStringObject,
- stringPrototypeStructure->transitionWatchpointSet());
- break;
- }
-
- default:
- break;
- }
- }
-
</del><span class="cx"> void handleMasqueradesAsUndefined()
</span><span class="cx"> {
</span><span class="cx"> if (m_graph.masqueradesAsUndefinedWatchpointIsStillValid(m_node->origin.semantic))
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreftlFTLCapabilitiescpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/ftl/FTLCapabilities.cpp (171379 => 171380)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/ftl/FTLCapabilities.cpp 2014-07-23 01:12:32 UTC (rev 171379)
+++ trunk/Source/JavaScriptCore/ftl/FTLCapabilities.cpp 2014-07-23 01:19:50 UTC (rev 171380)
</span><span class="lines">@@ -63,7 +63,6 @@
</span><span class="cx"> case BitLShift:
</span><span class="cx"> case BitURShift:
</span><span class="cx"> case CheckStructure:
</span><del>- case StructureTransitionWatchpoint:
</del><span class="cx"> case ArrayifyToStructure:
</span><span class="cx"> case PutStructure:
</span><span class="cx"> case PhantomPutStructure:
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreftlFTLIntrinsicRepositoryh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/ftl/FTLIntrinsicRepository.h (171379 => 171380)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/ftl/FTLIntrinsicRepository.h 2014-07-23 01:12:32 UTC (rev 171379)
+++ trunk/Source/JavaScriptCore/ftl/FTLIntrinsicRepository.h 2014-07-23 01:19:50 UTC (rev 171380)
</span><span class="lines">@@ -91,6 +91,8 @@
</span><span class="cx"> macro(V_JITOperation_EC, functionType(voidType, intPtr, intPtr)) \
</span><span class="cx"> macro(V_JITOperation_ECb, functionType(voidType, intPtr, intPtr)) \
</span><span class="cx"> macro(V_JITOperation_EVwsJ, functionType(voidType, intPtr, intPtr, int64)) \
</span><ins>+ macro(V_JITOperation_J, functionType(voidType, int64)) \
+ macro(V_JITOperation_Z, functionType(voidType, int32)) \
</ins><span class="cx"> macro(Z_JITOperation_D, functionType(int32, doubleType))
</span><span class="cx">
</span><span class="cx"> class IntrinsicRepository : public CommonValues {
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreftlFTLLowerDFGToLLVMcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/ftl/FTLLowerDFGToLLVM.cpp (171379 => 171380)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/ftl/FTLLowerDFGToLLVM.cpp 2014-07-23 01:12:32 UTC (rev 171379)
+++ trunk/Source/JavaScriptCore/ftl/FTLLowerDFGToLLVM.cpp 2014-07-23 01:19:50 UTC (rev 171380)
</span><span class="lines">@@ -52,6 +52,24 @@
</span><span class="cx">
</span><span class="cx"> static std::atomic<int> compileCounter;
</span><span class="cx">
</span><ins>+#if ASSERT_DISABLED
+NO_RETURN_DUE_TO_CRASH static void ftlUnreachable()
+{
+ CRASH();
+}
+#else
+NO_RETURN_DUE_TO_CRASH static void ftlUnreachable(
+ CodeBlock* codeBlock, BlockIndex blockIndex, unsigned nodeIndex)
+{
+
+ dataLog("Crashing in thought-to-be-unreachable FTL-generated code for ", pointerDump(codeBlock), " at basic block #", blockIndex);
+ if (nodeIndex != UINT_MAX)
+ dataLog(", node @", nodeIndex);
+ dataLog(".\n");
+ CRASH();
+}
+#endif
+
</ins><span class="cx"> // Using this instead of typeCheck() helps to reduce the load on LLVM, by creating
</span><span class="cx"> // significantly less dead code.
</span><span class="cx"> #define FTL_TYPE_CHECK(lowValue, highValue, typesPassedThrough, failCondition) do { \
</span><span class="lines">@@ -201,7 +219,7 @@
</span><span class="cx"> type = m_out.int64;
</span><span class="cx"> break;
</span><span class="cx"> default:
</span><del>- RELEASE_ASSERT_NOT_REACHED();
</del><ins>+ DFG_CRASH(m_graph, node, "Bad Phi node result type");
</ins><span class="cx"> break;
</span><span class="cx"> }
</span><span class="cx"> m_phis.add(node, buildAlloca(m_out.m_builder, type));
</span><span class="lines">@@ -236,10 +254,12 @@
</span><span class="cx"> m_out.appendTo(lowBlock, m_nextLowBlock);
</span><span class="cx">
</span><span class="cx"> if (Options::ftlCrashes())
</span><del>- m_out.crashNonTerminal();
</del><ins>+ m_out.trap();
</ins><span class="cx">
</span><span class="cx"> if (!m_highBlock->cfaHasVisited) {
</span><del>- m_out.crash();
</del><ins>+ if (verboseCompilationEnabled())
+ dataLog("Bailing because CFA didn't reach.\n");
+ crash(m_highBlock->index, UINT_MAX);
</ins><span class="cx"> return;
</span><span class="cx"> }
</span><span class="cx">
</span><span class="lines">@@ -257,7 +277,26 @@
</span><span class="cx"> bool compileNode(unsigned nodeIndex)
</span><span class="cx"> {
</span><span class="cx"> if (!m_state.isValid()) {
</span><del>- m_out.unreachable();
</del><ins>+ if (verboseCompilationEnabled())
+ dataLog("Bailing.\n");
+ crash(m_highBlock->index, m_node->index());
+
+ // Invalidate dominated blocks. Under normal circumstances we would expect
+ // them to be invalidated already. But you can have the CFA become more
+ // precise over time because the structures of objects change on the main
+ // thread. Failing to do this would result in weird crashes due to a value
+ // being used but not defined. Race conditions FTW!
+ for (BlockIndex blockIndex = m_graph.numBlocks(); blockIndex--;) {
+ BasicBlock* target = m_graph.block(blockIndex);
+ if (!target)
+ continue;
+ if (m_graph.m_dominators.dominates(m_highBlock, target)) {
+ if (verboseCompilationEnabled())
+ dataLog("Block ", *target, " will bail also.\n");
+ target->cfaHasVisited = false;
+ }
+ }
+
</ins><span class="cx"> return false;
</span><span class="cx"> }
</span><span class="cx">
</span><span class="lines">@@ -401,9 +440,6 @@
</span><span class="cx"> case CheckStructure:
</span><span class="cx"> compileCheckStructure();
</span><span class="cx"> break;
</span><del>- case StructureTransitionWatchpoint:
- compileStructureTransitionWatchpoint();
- break;
</del><span class="cx"> case CheckFunction:
</span><span class="cx"> compileCheckFunction();
</span><span class="cx"> break;
</span><span class="lines">@@ -638,12 +674,7 @@
</span><span class="cx"> case AllocationProfileWatchpoint:
</span><span class="cx"> break;
</span><span class="cx"> default:
</span><del>- dataLog("Unrecognized node in FTL backend:\n");
- m_graph.dump(WTF::dataFile(), " ", m_node);
- dataLog("\n");
- dataLog("Full graph dump:\n");
- m_graph.dump();
- RELEASE_ASSERT_NOT_REACHED();
</del><ins>+ DFG_CRASH(m_graph, m_node, "Unrecognized node in FTL backend");
</ins><span class="cx"> break;
</span><span class="cx"> }
</span><span class="cx">
</span><span class="lines">@@ -677,7 +708,7 @@
</span><span class="cx"> m_out.set(lowJSValue(m_node->child1()), destination);
</span><span class="cx"> break;
</span><span class="cx"> default:
</span><del>- RELEASE_ASSERT_NOT_REACHED();
</del><ins>+ DFG_CRASH(m_graph, m_node, "Bad use kind");
</ins><span class="cx"> break;
</span><span class="cx"> }
</span><span class="cx"> }
</span><span class="lines">@@ -703,7 +734,7 @@
</span><span class="cx"> setJSValue(m_out.get(source));
</span><span class="cx"> break;
</span><span class="cx"> default:
</span><del>- RELEASE_ASSERT_NOT_REACHED();
</del><ins>+ DFG_CRASH(m_graph, m_node, "Bad use kind");
</ins><span class="cx"> break;
</span><span class="cx"> }
</span><span class="cx"> }
</span><span class="lines">@@ -746,7 +777,7 @@
</span><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> default:
</span><del>- RELEASE_ASSERT_NOT_REACHED();
</del><ins>+ DFG_CRASH(m_graph, m_node, "Bad use kind");
</ins><span class="cx"> }
</span><span class="cx"> }
</span><span class="cx">
</span><span class="lines">@@ -771,7 +802,7 @@
</span><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> default:
</span><del>- RELEASE_ASSERT_NOT_REACHED();
</del><ins>+ DFG_CRASH(m_graph, m_node, "Bad use kind");
</ins><span class="cx"> }
</span><span class="cx"> }
</span><span class="cx">
</span><span class="lines">@@ -834,7 +865,7 @@
</span><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> default:
</span><del>- RELEASE_ASSERT_NOT_REACHED();
</del><ins>+ DFG_CRASH(m_graph, m_node, "Bad use kind");
</ins><span class="cx"> break;
</span><span class="cx"> }
</span><span class="cx"> }
</span><span class="lines">@@ -876,7 +907,7 @@
</span><span class="cx"> {
</span><span class="cx"> VariableAccessData* variable = m_node->variableAccessData();
</span><span class="cx"> VirtualRegister operand = variable->machineLocal();
</span><del>- RELEASE_ASSERT(operand.isArgument());
</del><ins>+ DFG_ASSERT(m_graph, m_node, operand.isArgument());
</ins><span class="cx">
</span><span class="cx"> LValue jsValue = m_out.load64(addressFor(operand));
</span><span class="cx">
</span><span class="lines">@@ -897,7 +928,7 @@
</span><span class="cx"> setJSValue(jsValue);
</span><span class="cx"> break;
</span><span class="cx"> default:
</span><del>- RELEASE_ASSERT_NOT_REACHED();
</del><ins>+ DFG_CRASH(m_graph, m_node, "Bad use kind");
</ins><span class="cx"> break;
</span><span class="cx"> }
</span><span class="cx"> }
</span><span class="lines">@@ -916,7 +947,7 @@
</span><span class="cx"> VariableAccessData* variable = m_node->variableAccessData();
</span><span class="cx"> AbstractValue& value = m_state.variables().operand(variable->local());
</span><span class="cx">
</span><del>- RELEASE_ASSERT(variable->isCaptured());
</del><ins>+ DFG_ASSERT(m_graph, m_node, variable->isCaptured());
</ins><span class="cx">
</span><span class="cx"> if (isInt32Speculation(value.m_type))
</span><span class="cx"> setInt32(m_out.load32(payloadFor(variable->machineLocal())));
</span><span class="lines">@@ -968,7 +999,7 @@
</span><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> default:
</span><del>- RELEASE_ASSERT_NOT_REACHED();
</del><ins>+ DFG_CRASH(m_graph, m_node, "Bad flush format");
</ins><span class="cx"> break;
</span><span class="cx"> }
</span><span class="cx">
</span><span class="lines">@@ -1144,7 +1175,7 @@
</span><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> default:
</span><del>- RELEASE_ASSERT_NOT_REACHED();
</del><ins>+ DFG_CRASH(m_graph, m_node, "Bad use kind");
</ins><span class="cx"> break;
</span><span class="cx"> }
</span><span class="cx"> }
</span><span class="lines">@@ -1218,7 +1249,7 @@
</span><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> default:
</span><del>- RELEASE_ASSERT_NOT_REACHED();
</del><ins>+ DFG_CRASH(m_graph, m_node, "Bad use kind");
</ins><span class="cx"> break;
</span><span class="cx"> }
</span><span class="cx"> }
</span><span class="lines">@@ -1321,7 +1352,7 @@
</span><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> default:
</span><del>- RELEASE_ASSERT_NOT_REACHED();
</del><ins>+ DFG_CRASH(m_graph, m_node, "Bad use kind");
</ins><span class="cx"> break;
</span><span class="cx"> }
</span><span class="cx"> }
</span><span class="lines">@@ -1419,7 +1450,7 @@
</span><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> default:
</span><del>- RELEASE_ASSERT_NOT_REACHED();
</del><ins>+ DFG_CRASH(m_graph, m_node, "Bad use kind");
</ins><span class="cx"> break;
</span><span class="cx"> }
</span><span class="cx"> }
</span><span class="lines">@@ -1470,7 +1501,7 @@
</span><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> default:
</span><del>- RELEASE_ASSERT_NOT_REACHED();
</del><ins>+ DFG_CRASH(m_graph, m_node, "Bad use kind");
</ins><span class="cx"> break;
</span><span class="cx"> }
</span><span class="cx"> }
</span><span class="lines">@@ -1496,7 +1527,7 @@
</span><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> default:
</span><del>- RELEASE_ASSERT_NOT_REACHED();
</del><ins>+ DFG_CRASH(m_graph, m_node, "Bad use kind");
</ins><span class="cx"> break;
</span><span class="cx"> }
</span><span class="cx"> }
</span><span class="lines">@@ -1563,7 +1594,7 @@
</span><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> default:
</span><del>- RELEASE_ASSERT_NOT_REACHED();
</del><ins>+ DFG_CRASH(m_graph, m_node, "Bad use kind");
</ins><span class="cx"> break;
</span><span class="cx"> }
</span><span class="cx"> }
</span><span class="lines">@@ -1655,12 +1686,6 @@
</span><span class="cx"> m_out.appendTo(continuation, lastNext);
</span><span class="cx"> }
</span><span class="cx">
</span><del>- void compileStructureTransitionWatchpoint()
- {
- addWeakReference(m_node->structure());
- speculateCell(m_node->child1());
- }
-
</del><span class="cx"> void compileCheckFunction()
</span><span class="cx"> {
</span><span class="cx"> LValue cell = lowCell(m_node->child1());
</span><span class="lines">@@ -1729,7 +1754,7 @@
</span><span class="cx"> vmCall(m_out.operation(operationEnsureArrayStorage), m_callFrame, cell);
</span><span class="cx"> break;
</span><span class="cx"> default:
</span><del>- RELEASE_ASSERT_NOT_REACHED();
</del><ins>+ DFG_CRASH(m_graph, m_node, "Bad array type");
</ins><span class="cx"> break;
</span><span class="cx"> }
</span><span class="cx">
</span><span class="lines">@@ -1746,8 +1771,8 @@
</span><span class="cx"> {
</span><span class="cx"> m_ftlState.jitCode->common.notifyCompilingStructureTransition(m_graph.m_plan, codeBlock(), m_node);
</span><span class="cx">
</span><del>- Structure* oldStructure = m_node->structureTransitionData().previousStructure;
- Structure* newStructure = m_node->structureTransitionData().newStructure;
</del><ins>+ Structure* oldStructure = m_node->transition()->previous;
+ Structure* newStructure = m_node->transition()->next;
</ins><span class="cx"> ASSERT_UNUSED(oldStructure, oldStructure->indexingType() == newStructure->indexingType());
</span><span class="cx"> ASSERT(oldStructure->typeInfo().inlineTypeFlags() == newStructure->typeInfo().inlineTypeFlags());
</span><span class="cx"> ASSERT(oldStructure->typeInfo().type() == newStructure->typeInfo().type());
</span><span class="lines">@@ -1803,7 +1828,7 @@
</span><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> default:
</span><del>- RELEASE_ASSERT_NOT_REACHED();
</del><ins>+ DFG_CRASH(m_graph, m_node, "Bad use kind");
</ins><span class="cx"> return;
</span><span class="cx"> }
</span><span class="cx"> }
</span><span class="lines">@@ -1929,7 +1954,7 @@
</span><span class="cx"> {
</span><span class="cx"> checkArgumentsNotCreated();
</span><span class="cx">
</span><del>- RELEASE_ASSERT(!m_node->origin.semantic.inlineCallFrame);
</del><ins>+ DFG_ASSERT(m_graph, m_node, !m_node->origin.semantic.inlineCallFrame);
</ins><span class="cx"> setInt32(m_out.add(m_out.load32NonNegative(payloadFor(JSStack::ArgumentCount)), m_out.constInt32(-1)));
</span><span class="cx"> }
</span><span class="cx">
</span><span class="lines">@@ -1955,7 +1980,7 @@
</span><span class="cx"> // FIXME: FTL should support activations.
</span><span class="cx"> // https://bugs.webkit.org/show_bug.cgi?id=129576
</span><span class="cx">
</span><del>- RELEASE_ASSERT_NOT_REACHED();
</del><ins>+ DFG_CRASH(m_graph, m_node, "Unimplemented");
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> TypedPointer base;
</span><span class="lines">@@ -1992,7 +2017,7 @@
</span><span class="cx"> return;
</span><span class="cx"> }
</span><span class="cx">
</span><del>- RELEASE_ASSERT_NOT_REACHED();
</del><ins>+ DFG_CRASH(m_graph, m_node, "Bad array type");
</ins><span class="cx"> return;
</span><span class="cx"> }
</span><span class="cx"> }
</span><span class="lines">@@ -2142,7 +2167,7 @@
</span><span class="cx"> result = m_out.load32(pointer);
</span><span class="cx"> break;
</span><span class="cx"> default:
</span><del>- RELEASE_ASSERT_NOT_REACHED();
</del><ins>+ DFG_CRASH(m_graph, m_node, "Bad element size");
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> if (elementSize(type) < 4) {
</span><span class="lines">@@ -2186,14 +2211,14 @@
</span><span class="cx"> result = m_out.loadDouble(pointer);
</span><span class="cx"> break;
</span><span class="cx"> default:
</span><del>- RELEASE_ASSERT_NOT_REACHED();
</del><ins>+ DFG_CRASH(m_graph, m_node, "Bad typed array type");
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> setDouble(result);
</span><span class="cx"> return;
</span><span class="cx"> }
</span><span class="cx">
</span><del>- RELEASE_ASSERT_NOT_REACHED();
</del><ins>+ DFG_CRASH(m_graph, m_node, "Bad array type");
</ins><span class="cx"> return;
</span><span class="cx"> } }
</span><span class="cx"> }
</span><span class="lines">@@ -2299,7 +2324,7 @@
</span><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> default:
</span><del>- RELEASE_ASSERT_NOT_REACHED();
</del><ins>+ DFG_CRASH(m_graph, m_node, "Bad array type");
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> m_out.jump(continuation);
</span><span class="lines">@@ -2392,7 +2417,7 @@
</span><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> default:
</span><del>- RELEASE_ASSERT_NOT_REACHED();
</del><ins>+ DFG_CRASH(m_graph, m_node, "Bad use kind");
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> switch (elementSize(type)) {
</span><span class="lines">@@ -2409,7 +2434,7 @@
</span><span class="cx"> refType = m_out.ref32;
</span><span class="cx"> break;
</span><span class="cx"> default:
</span><del>- RELEASE_ASSERT_NOT_REACHED();
</del><ins>+ DFG_CRASH(m_graph, m_node, "Bad element size");
</ins><span class="cx"> }
</span><span class="cx"> } else /* !isInt(type) */ {
</span><span class="cx"> LValue value = lowDouble(child3);
</span><span class="lines">@@ -2423,7 +2448,7 @@
</span><span class="cx"> refType = m_out.refDouble;
</span><span class="cx"> break;
</span><span class="cx"> default:
</span><del>- RELEASE_ASSERT_NOT_REACHED();
</del><ins>+ DFG_CRASH(m_graph, m_node, "Bad typed array type");
</ins><span class="cx"> }
</span><span class="cx"> }
</span><span class="cx">
</span><span class="lines">@@ -2447,7 +2472,7 @@
</span><span class="cx"> return;
</span><span class="cx"> }
</span><span class="cx">
</span><del>- RELEASE_ASSERT_NOT_REACHED();
</del><ins>+ DFG_CRASH(m_graph, m_node, "Bad array type");
</ins><span class="cx"> break;
</span><span class="cx"> }
</span><span class="cx"> }
</span><span class="lines">@@ -2519,7 +2544,7 @@
</span><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> default:
</span><del>- RELEASE_ASSERT_NOT_REACHED();
</del><ins>+ DFG_CRASH(m_graph, m_node, "Bad array type");
</ins><span class="cx"> return;
</span><span class="cx"> }
</span><span class="cx"> }
</span><span class="lines">@@ -2577,7 +2602,7 @@
</span><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> default:
</span><del>- RELEASE_ASSERT_NOT_REACHED();
</del><ins>+ DFG_CRASH(m_graph, m_node, "Bad array type");
</ins><span class="cx"> return;
</span><span class="cx"> }
</span><span class="cx"> }
</span><span class="lines">@@ -2622,7 +2647,7 @@
</span><span class="cx"> Structure* structure = globalObject->arrayStructureForIndexingTypeDuringAllocation(
</span><span class="cx"> m_node->indexingType());
</span><span class="cx">
</span><del>- RELEASE_ASSERT(structure->indexingType() == m_node->indexingType());
</del><ins>+ DFG_ASSERT(m_graph, m_node, structure->indexingType() == m_node->indexingType());
</ins><span class="cx">
</span><span class="cx"> if (!globalObject->isHavingABadTime() && !hasAnyArrayStorage(m_node->indexingType())) {
</span><span class="cx"> unsigned numElements = m_node->numChildren();
</span><span class="lines">@@ -2635,7 +2660,7 @@
</span><span class="cx"> switch (m_node->indexingType()) {
</span><span class="cx"> case ALL_BLANK_INDEXING_TYPES:
</span><span class="cx"> case ALL_UNDECIDED_INDEXING_TYPES:
</span><del>- CRASH();
</del><ins>+ DFG_CRASH(m_graph, m_node, "Bad indexing type");
</ins><span class="cx"> break;
</span><span class="cx">
</span><span class="cx"> case ALL_DOUBLE_INDEXING_TYPES:
</span><span class="lines">@@ -2653,7 +2678,8 @@
</span><span class="cx"> break;
</span><span class="cx">
</span><span class="cx"> default:
</span><del>- CRASH();
</del><ins>+ DFG_CRASH(m_graph, m_node, "Corrupt indexing type");
+ break;
</ins><span class="cx"> }
</span><span class="cx"> }
</span><span class="cx">
</span><span class="lines">@@ -2699,7 +2725,7 @@
</span><span class="cx"> Structure* structure = globalObject->arrayStructureForIndexingTypeDuringAllocation(
</span><span class="cx"> m_node->indexingType());
</span><span class="cx">
</span><del>- RELEASE_ASSERT(structure->indexingType() == m_node->indexingType());
</del><ins>+ DFG_ASSERT(m_graph, m_node, structure->indexingType() == m_node->indexingType());
</ins><span class="cx">
</span><span class="cx"> if (!globalObject->isHavingABadTime() && !hasAnyArrayStorage(m_node->indexingType())) {
</span><span class="cx"> unsigned numElements = m_node->numConstants();
</span><span class="lines">@@ -2837,21 +2863,19 @@
</span><span class="cx">
</span><span class="cx"> void compileAllocatePropertyStorage()
</span><span class="cx"> {
</span><del>- StructureTransitionData& data = m_node->structureTransitionData();
</del><span class="cx"> LValue object = lowCell(m_node->child1());
</span><del>-
- setStorage(allocatePropertyStorage(object, data.previousStructure));
</del><ins>+ setStorage(allocatePropertyStorage(object, m_node->transition()->previous));
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> void compileReallocatePropertyStorage()
</span><span class="cx"> {
</span><del>- StructureTransitionData& data = m_node->structureTransitionData();
</del><ins>+ Transition* transition = m_node->transition();
</ins><span class="cx"> LValue object = lowCell(m_node->child1());
</span><span class="cx"> LValue oldStorage = lowStorage(m_node->child2());
</span><span class="cx">
</span><span class="cx"> setStorage(
</span><span class="cx"> reallocatePropertyStorage(
</span><del>- object, oldStorage, data.previousStructure, data.newStructure));
</del><ins>+ object, oldStorage, transition->previous, transition->next));
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> void compileToString()
</span><span class="lines">@@ -2936,7 +2960,7 @@
</span><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> default:
</span><del>- RELEASE_ASSERT_NOT_REACHED();
</del><ins>+ DFG_CRASH(m_graph, m_node, "Bad use kind");
</ins><span class="cx"> break;
</span><span class="cx"> }
</span><span class="cx"> }
</span><span class="lines">@@ -3028,7 +3052,7 @@
</span><span class="cx"> m_out.operation(operationMakeRope3), m_callFrame, kids[0], kids[1], kids[2]));
</span><span class="cx"> break;
</span><span class="cx"> default:
</span><del>- RELEASE_ASSERT_NOT_REACHED();
</del><ins>+ DFG_CRASH(m_graph, m_node, "Bad number of children");
</ins><span class="cx"> break;
</span><span class="cx"> }
</span><span class="cx"> m_out.jump(continuation);
</span><span class="lines">@@ -3253,7 +3277,7 @@
</span><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> m_out.appendTo(exit, continuation);
</span><del>- terminate(BadCache);
</del><ins>+ speculate(BadCache, noValue(), nullptr, m_out.booleanTrue);
</ins><span class="cx"> m_out.unreachable();
</span><span class="cx">
</span><span class="cx"> m_out.appendTo(continuation, lastNext);
</span><span class="lines">@@ -3325,7 +3349,7 @@
</span><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> m_out.appendTo(exit, continuation);
</span><del>- terminate(BadCache);
</del><ins>+ speculate(BadCache, noValue(), nullptr, m_out.booleanTrue);
</ins><span class="cx"> m_out.unreachable();
</span><span class="cx">
</span><span class="cx"> m_out.appendTo(continuation, lastNext);
</span><span class="lines">@@ -3444,7 +3468,7 @@
</span><span class="cx"> return;
</span><span class="cx"> }
</span><span class="cx">
</span><del>- RELEASE_ASSERT_NOT_REACHED();
</del><ins>+ DFG_CRASH(m_graph, m_node, "Bad use kinds");
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> void compileCompareEqConstant()
</span><span class="lines">@@ -3537,7 +3561,7 @@
</span><span class="cx"> return;
</span><span class="cx"> }
</span><span class="cx">
</span><del>- RELEASE_ASSERT_NOT_REACHED();
</del><ins>+ DFG_CRASH(m_graph, m_node, "Bad use kinds");
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> void compileCompareStrictEqConstant()
</span><span class="lines">@@ -3673,7 +3697,7 @@
</span><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> default:
</span><del>- RELEASE_ASSERT_NOT_REACHED();
</del><ins>+ DFG_CRASH(m_graph, m_node, "Bad use kind");
</ins><span class="cx"> break;
</span><span class="cx"> }
</span><span class="cx">
</span><span class="lines">@@ -3719,7 +3743,7 @@
</span><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> default:
</span><del>- RELEASE_ASSERT_NOT_REACHED();
</del><ins>+ DFG_CRASH(m_graph, m_node, "Bad use kind");
</ins><span class="cx"> break;
</span><span class="cx"> }
</span><span class="cx">
</span><span class="lines">@@ -3772,11 +3796,11 @@
</span><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> case SwitchString:
</span><del>- RELEASE_ASSERT_NOT_REACHED();
</del><ins>+ DFG_CRASH(m_graph, m_node, "Unimplemented");
</ins><span class="cx"> break;
</span><span class="cx"> }
</span><span class="cx">
</span><del>- RELEASE_ASSERT_NOT_REACHED();
</del><ins>+ DFG_CRASH(m_graph, m_node, "Bad switch kind");
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> void compileReturn()
</span><span class="lines">@@ -3958,7 +3982,7 @@
</span><span class="cx"> speculate(m_node->child1());
</span><span class="cx"> #endif
</span><span class="cx"> }
</span><del>-
</del><ins>+
</ins><span class="cx"> LValue didOverflowStack()
</span><span class="cx"> {
</span><span class="cx"> // This does a very simple leaf function analysis. The invariant of FTL call
</span><span class="lines">@@ -4233,7 +4257,7 @@
</span><span class="cx"> return;
</span><span class="cx"> }
</span><span class="cx">
</span><del>- RELEASE_ASSERT_NOT_REACHED();
</del><ins>+ DFG_CRASH(m_graph, m_node, "Bad use kinds");
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> void compareEqObjectOrOtherToObject(Edge leftChild, Edge rightChild)
</span><span class="lines">@@ -4512,7 +4536,7 @@
</span><span class="cx"> return m_out.phi(m_out.boolean, fastResult, slowResult);
</span><span class="cx"> }
</span><span class="cx"> default:
</span><del>- RELEASE_ASSERT_NOT_REACHED();
</del><ins>+ DFG_CRASH(m_graph, m_node, "Bad use kind");
</ins><span class="cx"> return 0;
</span><span class="cx"> }
</span><span class="cx"> }
</span><span class="lines">@@ -4759,7 +4783,8 @@
</span><span class="cx">
</span><span class="cx"> void terminate(ExitKind kind)
</span><span class="cx"> {
</span><del>- speculate(kind, noValue(), 0, m_out.booleanTrue);
</del><ins>+ speculate(kind, noValue(), nullptr, m_out.booleanTrue);
+ m_state.setIsValid(false);
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> void typeCheck(
</span><span class="lines">@@ -4815,7 +4840,7 @@
</span><span class="cx"> return result;
</span><span class="cx"> }
</span><span class="cx">
</span><del>- RELEASE_ASSERT(!(m_state.forNode(edge).m_type & SpecInt32));
</del><ins>+ DFG_ASSERT(m_graph, m_node, !(m_state.forNode(edge).m_type & SpecInt32));
</ins><span class="cx"> terminate(Uncountable);
</span><span class="cx"> return m_out.int32Zero;
</span><span class="cx"> }
</span><span class="lines">@@ -4823,7 +4848,7 @@
</span><span class="cx"> enum Int52Kind { StrictInt52, Int52 };
</span><span class="cx"> LValue lowInt52(Edge edge, Int52Kind kind)
</span><span class="cx"> {
</span><del>- RELEASE_ASSERT(edge.useKind() == Int52RepUse);
</del><ins>+ DFG_ASSERT(m_graph, m_node, edge.useKind() == Int52RepUse);
</ins><span class="cx">
</span><span class="cx"> LoweredNodeValue value;
</span><span class="cx">
</span><span class="lines">@@ -4849,7 +4874,7 @@
</span><span class="cx"> break;
</span><span class="cx"> }
</span><span class="cx">
</span><del>- RELEASE_ASSERT(!m_state.forNode(edge).m_type);
</del><ins>+ DFG_ASSERT(m_graph, m_node, !m_state.forNode(edge).m_type);
</ins><span class="cx"> terminate(Uncountable);
</span><span class="cx"> return m_out.int64Zero;
</span><span class="cx"> }
</span><span class="lines">@@ -4885,7 +4910,7 @@
</span><span class="cx"> case StrictInt52:
</span><span class="cx"> return Int52;
</span><span class="cx"> }
</span><del>- RELEASE_ASSERT_NOT_REACHED();
</del><ins>+ DFG_CRASH(m_graph, m_node, "Bad use kind");
</ins><span class="cx"> return Int52;
</span><span class="cx"> }
</span><span class="cx">
</span><span class="lines">@@ -4916,7 +4941,7 @@
</span><span class="cx"> return uncheckedValue;
</span><span class="cx"> }
</span><span class="cx">
</span><del>- RELEASE_ASSERT(!(m_state.forNode(edge).m_type & SpecCell));
</del><ins>+ DFG_ASSERT(m_graph, m_node, !(m_state.forNode(edge).m_type & SpecCell));
</ins><span class="cx"> terminate(Uncountable);
</span><span class="cx"> return m_out.intPtrZero;
</span><span class="cx"> }
</span><span class="lines">@@ -4985,20 +5010,19 @@
</span><span class="cx"> return result;
</span><span class="cx"> }
</span><span class="cx">
</span><del>- RELEASE_ASSERT(!(m_state.forNode(edge).m_type & SpecBoolean));
</del><ins>+ DFG_ASSERT(m_graph, m_node, !(m_state.forNode(edge).m_type & SpecBoolean));
</ins><span class="cx"> terminate(Uncountable);
</span><span class="cx"> return m_out.booleanFalse;
</span><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> LValue lowDouble(Edge edge)
</span><span class="cx"> {
</span><del>- RELEASE_ASSERT(isDouble(edge.useKind()));
</del><ins>+ DFG_ASSERT(m_graph, m_node, isDouble(edge.useKind()));
</ins><span class="cx">
</span><span class="cx"> LoweredNodeValue value = m_doubleValues.get(edge.node());
</span><span class="cx"> if (isValid(value))
</span><span class="cx"> return value.value();
</span><del>-
- RELEASE_ASSERT(!m_state.forNode(edge).m_type);
</del><ins>+ DFG_ASSERT(m_graph, m_node, !m_state.forNode(edge).m_type);
</ins><span class="cx"> terminate(Uncountable);
</span><span class="cx"> return m_out.doubleZero;
</span><span class="cx"> }
</span><span class="lines">@@ -5006,8 +5030,8 @@
</span><span class="cx"> LValue lowJSValue(Edge edge, OperandSpeculationMode mode = AutomaticOperandSpeculation)
</span><span class="cx"> {
</span><span class="cx"> ASSERT_UNUSED(mode, mode == ManualOperandSpeculation || edge.useKind() == UntypedUse);
</span><del>- RELEASE_ASSERT(!isDouble(edge.useKind()));
- RELEASE_ASSERT(edge.useKind() != Int52RepUse);
</del><ins>+ DFG_ASSERT(m_graph, m_node, !isDouble(edge.useKind()));
+ DFG_ASSERT(m_graph, m_node, edge.useKind() != Int52RepUse);
</ins><span class="cx">
</span><span class="cx"> if (edge->hasConstant())
</span><span class="cx"> return m_out.constInt64(JSValue::encode(m_graph.valueOfJSConstant(edge.node())));
</span><span class="lines">@@ -5030,7 +5054,7 @@
</span><span class="cx"> return result;
</span><span class="cx"> }
</span><span class="cx">
</span><del>- RELEASE_ASSERT_NOT_REACHED();
</del><ins>+ DFG_CRASH(m_graph, m_node, "Value not defined");
</ins><span class="cx"> return 0;
</span><span class="cx"> }
</span><span class="cx">
</span><span class="lines">@@ -5342,8 +5366,7 @@
</span><span class="cx"> speculateMisc(edge);
</span><span class="cx"> break;
</span><span class="cx"> default:
</span><del>- dataLog("Unsupported speculation use kind: ", edge.useKind(), "\n");
- RELEASE_ASSERT_NOT_REACHED();
</del><ins>+ DFG_CRASH(m_graph, m_node, "Unsupported speculation use kind");
</ins><span class="cx"> }
</span><span class="cx"> }
</span><span class="cx">
</span><span class="lines">@@ -5404,7 +5427,7 @@
</span><span class="cx">
</span><span class="cx"> switch (arrayMode.arrayClass()) {
</span><span class="cx"> case Array::OriginalArray:
</span><del>- RELEASE_ASSERT_NOT_REACHED();
</del><ins>+ DFG_CRASH(m_graph, m_node, "Unexpected original array");
</ins><span class="cx"> return 0;
</span><span class="cx">
</span><span class="cx"> case Array::Array:
</span><span class="lines">@@ -5424,7 +5447,7 @@
</span><span class="cx"> m_out.constInt8(arrayMode.shapeMask()));
</span><span class="cx"> }
</span><span class="cx">
</span><del>- RELEASE_ASSERT_NOT_REACHED();
</del><ins>+ DFG_CRASH(m_graph, m_node, "Corrupt array class");
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> default:
</span><span class="lines">@@ -5567,7 +5590,7 @@
</span><span class="cx"> Structure* stringObjectStructure =
</span><span class="cx"> m_graph.globalObjectFor(m_node->origin.semantic)->stringObjectStructure();
</span><span class="cx">
</span><del>- if (m_state.forNode(edge).m_currentKnownStructure.isSubsetOf(StructureSet(stringObjectStructure)))
</del><ins>+ if (m_state.forNode(edge).m_structure.isSubsetOf(StructureSet(stringObjectStructure)))
</ins><span class="cx"> return;
</span><span class="cx">
</span><span class="cx"> speculate(
</span><span class="lines">@@ -5782,9 +5805,10 @@
</span><span class="cx">
</span><span class="cx"> LBasicBlock continuation = FTL_NEW_BLOCK(m_out, ("Exception check continuation"));
</span><span class="cx">
</span><ins>+ LValue exception = m_out.load64(m_out.absolute(vm().addressOfException()));
+
</ins><span class="cx"> m_out.branch(
</span><del>- m_out.notZero64(m_out.load64(m_out.absolute(vm().addressOfException()))),
- rarely(m_handleExceptions), usually(continuation));
</del><ins>+ m_out.notZero64(exception), rarely(m_handleExceptions), usually(continuation));
</ins><span class="cx">
</span><span class="cx"> m_out.appendTo(continuation);
</span><span class="cx"> }
</span><span class="lines">@@ -5871,10 +5895,8 @@
</span><span class="cx"> break;
</span><span class="cx"> }
</span><span class="cx">
</span><del>- if (Options::validateFTLOSRExitLiveness()) {
- dataLog("Expected r", operand, " to be available but it wasn't.\n");
- RELEASE_ASSERT_NOT_REACHED();
- }
</del><ins>+ if (Options::validateFTLOSRExitLiveness())
+ DFG_CRASH(m_graph, m_node, toCString("Expected r", operand, " to be available but it wasn't.").data());
</ins><span class="cx">
</span><span class="cx"> // This means that the DFG's DCE proved that the value is dead in bytecode
</span><span class="cx"> // even though the bytecode liveness analysis thinks it's live. This is
</span><span class="lines">@@ -5979,10 +6001,7 @@
</span><span class="cx"> return;
</span><span class="cx"> }
</span><span class="cx">
</span><del>- startCrashing();
- dataLog("Cannot find value for node: ", node, " while compiling exit at ", exit.m_codeOrigin, " in node ", m_node, "\n");
- m_graph.dump();
- RELEASE_ASSERT_NOT_REACHED();
</del><ins>+ DFG_CRASH(m_graph, m_node, toCString("Cannot find value for node: ", node).data());
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> bool tryToSetConstantExitArgument(OSRExit& exit, unsigned index, Node* node)
</span><span class="lines">@@ -6060,7 +6079,7 @@
</span><span class="cx"> return;
</span><span class="cx"> }
</span><span class="cx">
</span><del>- RELEASE_ASSERT_NOT_REACHED();
</del><ins>+ DFG_CRASH(m_graph, m_node, "Corrupt int52 kind");
</ins><span class="cx"> }
</span><span class="cx"> void setJSValue(Node* node, LValue value)
</span><span class="cx"> {
</span><span class="lines">@@ -6187,6 +6206,25 @@
</span><span class="cx"> return addressFor(operand, TagOffset);
</span><span class="cx"> }
</span><span class="cx">
</span><ins>+ void crash(BlockIndex blockIndex, unsigned nodeIndex)
+ {
+#if ASSERT_DISABLED
+ m_out.call(m_out.operation(ftlUnreachable));
+ UNUSED_PARAM(blockIndex);
+ UNUSED_PARAM(nodeIndex);
+#else
+ m_out.call(
+ m_out.intToPtr(
+ m_out.constIntPtr(ftlUnreachable),
+ pointerType(
+ functionType(
+ m_out.voidType, m_out.intPtr, m_out.int32, m_out.int32))),
+ m_out.constIntPtr(codeBlock()), m_out.constInt32(blockIndex),
+ m_out.constInt32(nodeIndex));
+#endif
+ m_out.unreachable();
+ }
+
</ins><span class="cx"> VM& vm() { return m_graph.m_vm; }
</span><span class="cx"> CodeBlock* codeBlock() { return m_graph.m_codeBlock; }
</span><span class="cx">
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreftlFTLOutputcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/ftl/FTLOutput.cpp (171379 => 171380)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/ftl/FTLOutput.cpp 2014-07-23 01:12:32 UTC (rev 171379)
+++ trunk/Source/JavaScriptCore/ftl/FTLOutput.cpp 2014-07-23 01:19:50 UTC (rev 171380)
</span><span class="lines">@@ -1,5 +1,5 @@
</span><span class="cx"> /*
</span><del>- * Copyright (C) 2013 Apple Inc. All rights reserved.
</del><ins>+ * Copyright (C) 2013, 2014 Apple Inc. All rights reserved.
</ins><span class="cx"> *
</span><span class="cx"> * Redistribution and use in source and binary forms, with or without
</span><span class="cx"> * modification, are permitted provided that the following conditions
</span><span class="lines">@@ -138,11 +138,6 @@
</span><span class="cx"> constInt32(notTakenWeight.scaleToTotal(total))));
</span><span class="cx"> }
</span><span class="cx">
</span><del>-void Output::crashNonTerminal()
-{
- call(intToPtr(constIntPtr(abort), pointerType(functionType(voidType))));
-}
-
</del><span class="cx"> } } // namespace JSC::FTL
</span><span class="cx">
</span><span class="cx"> #endif // ENABLE(FTL_JIT)
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreftlFTLOutputh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/ftl/FTLOutput.h (171379 => 171380)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/ftl/FTLOutput.h 2014-07-23 01:12:32 UTC (rev 171379)
+++ trunk/Source/JavaScriptCore/ftl/FTLOutput.h 2014-07-23 01:19:50 UTC (rev 171380)
</span><span class="lines">@@ -401,14 +401,6 @@
</span><span class="cx"> call(trapIntrinsic());
</span><span class="cx"> }
</span><span class="cx">
</span><del>- void crashNonTerminal();
-
- void crash()
- {
- crashNonTerminal();
- unreachable();
- }
-
</del><span class="cx"> ValueFromBlock anchor(LValue value)
</span><span class="cx"> {
</span><span class="cx"> return ValueFromBlock(value, m_block);
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorejitJITOperationsh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/jit/JITOperations.h (171379 => 171380)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/jit/JITOperations.h 2014-07-23 01:12:32 UTC (rev 171379)
+++ trunk/Source/JavaScriptCore/jit/JITOperations.h 2014-07-23 01:19:50 UTC (rev 171380)
</span><span class="lines">@@ -171,6 +171,8 @@
</span><span class="cx"> typedef void JIT_OPERATION (*V_JITOperation_EVwsJ)(ExecState*, VariableWatchpointSet*, EncodedJSValue);
</span><span class="cx"> typedef void JIT_OPERATION (*V_JITOperation_EZ)(ExecState*, int32_t);
</span><span class="cx"> typedef void JIT_OPERATION (*V_JITOperation_EVm)(ExecState*, VM*);
</span><ins>+typedef void JIT_OPERATION (*V_JITOperation_J)(EncodedJSValue);
+typedef void JIT_OPERATION (*V_JITOperation_Z)(int32_t);
</ins><span class="cx"> typedef char* JIT_OPERATION (*P_JITOperation_E)(ExecState*);
</span><span class="cx"> typedef char* JIT_OPERATION (*P_JITOperation_EC)(ExecState*, JSCell*);
</span><span class="cx"> typedef char* JIT_OPERATION (*P_JITOperation_ECli)(ExecState*, CallLinkInfo*);
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorejsccpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/jsc.cpp (171379 => 171380)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/jsc.cpp 2014-07-23 01:12:32 UTC (rev 171379)
+++ trunk/Source/JavaScriptCore/jsc.cpp 2014-07-23 01:19:50 UTC (rev 171380)
</span><span class="lines">@@ -94,6 +94,17 @@
</span><span class="cx">
</span><span class="cx"> namespace {
</span><span class="cx">
</span><ins>+NO_RETURN_WITH_VALUE static void jscExit(int status)
+{
+#if ENABLE(DFG_JIT)
+ if (DFG::isCrashing()) {
+ for (;;)
+ pause();
+ }
+#endif // ENABLE(DFG_JIT)
+ exit(status);
+}
+
</ins><span class="cx"> class Element;
</span><span class="cx"> class ElementHandleOwner;
</span><span class="cx"> class Masuqerader;
</span><span class="lines">@@ -890,7 +901,7 @@
</span><span class="cx">
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL functionQuit(ExecState*)
</span><span class="cx"> {
</span><del>- exit(EXIT_SUCCESS);
</del><ins>+ jscExit(EXIT_SUCCESS);
</ins><span class="cx">
</span><span class="cx"> #if COMPILER(MSVC) && OS(WINCE)
</span><span class="cx"> // Without this, Visual Studio will complain that this method does not return a value.
</span><span class="lines">@@ -1010,7 +1021,7 @@
</span><span class="cx"> ecore_shutdown();
</span><span class="cx"> #endif
</span><span class="cx">
</span><del>- return res;
</del><ins>+ jscExit(res);
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> static bool runWithScripts(GlobalObject* globalObject, const Vector<Script>& scripts, bool dump)
</span><span class="lines">@@ -1154,7 +1165,7 @@
</span><span class="cx"> fprintf(stderr, " --<jsc VM option>=<value> Sets the specified JSC VM option\n");
</span><span class="cx"> fprintf(stderr, "\n");
</span><span class="cx">
</span><del>- exit(help ? EXIT_SUCCESS : EXIT_FAILURE);
</del><ins>+ jscExit(help ? EXIT_SUCCESS : EXIT_FAILURE);
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> void CommandLine::parseArguments(int argc, char** argv)
</span><span class="lines">@@ -1243,7 +1254,7 @@
</span><span class="cx"> if (needToDumpOptions)
</span><span class="cx"> JSC::Options::dumpAllOptions(stderr);
</span><span class="cx"> if (needToExit)
</span><del>- exit(EXIT_SUCCESS);
</del><ins>+ jscExit(EXIT_SUCCESS);
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> int jscmain(int argc, char** argv)
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeStructureh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/Structure.h (171379 => 171380)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/Structure.h 2014-07-23 01:12:32 UTC (rev 171379)
+++ trunk/Source/JavaScriptCore/runtime/Structure.h 2014-07-23 01:19:50 UTC (rev 171380)
</span><span class="lines">@@ -1,5 +1,5 @@
</span><span class="cx"> /*
</span><del>- * Copyright (C) 2008, 2009, 2012, 2013 Apple Inc. All rights reserved.
</del><ins>+ * Copyright (C) 2008, 2009, 2012, 2013, 2014 Apple Inc. All rights reserved.
</ins><span class="cx"> *
</span><span class="cx"> * Redistribution and use in source and binary forms, with or without
</span><span class="cx"> * modification, are permitted provided that the following conditions
</span><span class="lines">@@ -370,6 +370,22 @@
</span><span class="cx"> {
</span><span class="cx"> return m_transitionWatchpointSet.isStillValid();
</span><span class="cx"> }
</span><ins>+
+ bool dfgShouldWatchIfPossible() const
+ {
+ // FIXME: We would like to not watch things that are unprofitable to watch, like
+ // dictionaries. Unfortunately, we can't do such things: a dictionary could get flattened,
+ // in which case it will start to appear watchable and so the DFG will think that it is
+ // watching it. We should come up with a comprehensive story for not watching things that
+ // aren't profitable to watch.
+ // https://bugs.webkit.org/show_bug.cgi?id=133625
+ return true;
+ }
+
+ bool dfgShouldWatch() const
+ {
+ return dfgShouldWatchIfPossible() && transitionWatchpointSetIsStillValid();
+ }
</ins><span class="cx">
</span><span class="cx"> void addTransitionWatchpoint(Watchpoint* watchpoint) const
</span><span class="cx"> {
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoretestsstressarrayifytostructurecontradictionjs"></a>
<div class="addfile"><h4>Added: trunk/Source/JavaScriptCore/tests/stress/arrayify-to-structure-contradiction.js (0 => 171380)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/tests/stress/arrayify-to-structure-contradiction.js (rev 0)
+++ trunk/Source/JavaScriptCore/tests/stress/arrayify-to-structure-contradiction.js 2014-07-23 01:19:50 UTC (rev 171380)
</span><span class="lines">@@ -0,0 +1,16 @@
</span><ins>+function foo(array, v, p) {
+ array[0] = 10;
+ if (p)
+ v = "hello";
+ array[0] = v;
+}
+
+noInline(foo);
+
+for (var i = 0; i < 100000; ++i) {
+ var array = [42];
+ foo(array, 43, false);
+ if (array[0] != 43)
+ throw "Error: bad result: " + array;
+}
+
</ins></span></pre></div>
<a id="trunkSourceJavaScriptCoretestsstressftlgetmyargumentslengthinlinejs"></a>
<div class="addfile"><h4>Added: trunk/Source/JavaScriptCore/tests/stress/ftl-getmyargumentslength-inline.js (0 => 171380)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/tests/stress/ftl-getmyargumentslength-inline.js (rev 0)
+++ trunk/Source/JavaScriptCore/tests/stress/ftl-getmyargumentslength-inline.js 2014-07-23 01:19:50 UTC (rev 171380)
</span><span class="lines">@@ -0,0 +1,9 @@
</span><ins>+function foo(){
+ return arguments.length;
+}
+
+for (var i = 0; i < 100000; ++i) {
+ var r = foo(11, 12, 13, 18, 19, 20);
+ if (r != 6) throw "Error: "+r;
+}
+
</ins></span></pre></div>
<a id="trunkSourceJavaScriptCoretestsstressftllibraryexceptionjs"></a>
<div class="addfile"><h4>Added: trunk/Source/JavaScriptCore/tests/stress/ftl-library-exception.js (0 => 171380)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/tests/stress/ftl-library-exception.js (rev 0)
+++ trunk/Source/JavaScriptCore/tests/stress/ftl-library-exception.js 2014-07-23 01:19:50 UTC (rev 171380)
</span><span class="lines">@@ -0,0 +1,21 @@
</span><ins>+function foo(d){
+ return Date.prototype.getTimezoneOffset.call(d);
+}
+
+noInline(foo);
+
+var x;
+var count = 100000;
+var z = 0;
+for (var i = 0 ; i < count; i++){
+ try {
+ var q = foo(i < count - 10 ? new Date() : "a");
+ x = false;
+ z = q;
+ } catch (e) {
+ x = true;
+ }
+}
+
+if (!x)
+ throw "bad result: "+ x;
</ins></span></pre></div>
<a id="trunkSourceJavaScriptCoretestsstressftllibraryinlinegettimezoneoffsetjs"></a>
<div class="addfile"><h4>Added: trunk/Source/JavaScriptCore/tests/stress/ftl-library-inline-gettimezoneoffset.js (0 => 171380)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/tests/stress/ftl-library-inline-gettimezoneoffset.js (rev 0)
+++ trunk/Source/JavaScriptCore/tests/stress/ftl-library-inline-gettimezoneoffset.js 2014-07-23 01:19:50 UTC (rev 171380)
</span><span class="lines">@@ -0,0 +1,16 @@
</span><ins>+function foo(x, d){
+ return x + d.getTimezoneOffset();
+}
+
+noInline(foo);
+
+var d = new Date();
+var expected = foo(0, d);
+var count = 1000000;
+var result = 0;
+for (var i = 0 ; i < count; i++){
+ result += foo(0, d);
+}
+
+if (result != count * expected)
+ throw "Error: bad result: " + result;
</ins></span></pre></div>
<a id="trunkSourceJavaScriptCoretestsstressftllibraryinliningexceptionsdataviewjs"></a>
<div class="addfile"><h4>Added: trunk/Source/JavaScriptCore/tests/stress/ftl-library-inlining-exceptions-dataview.js (0 => 171380)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/tests/stress/ftl-library-inlining-exceptions-dataview.js (rev 0)
+++ trunk/Source/JavaScriptCore/tests/stress/ftl-library-inlining-exceptions-dataview.js 2014-07-23 01:19:50 UTC (rev 171380)
</span><span class="lines">@@ -0,0 +1,26 @@
</span><ins>+function foo(d){
+ return d.getInt8(42);
+}
+
+noInline(foo);
+
+var d = new DataView(new ArrayBuffer(43));
+d.setInt8(42, 43);
+for (var i = 0; i < 100000; ++i) {
+ var result = foo(d);
+ if (result != 43)
+ throw "Error: bad result: " + result;
+}
+
+for (var i = 0; i < 10; ++i) {
+ var didThrow = false;
+ try {
+ foo(new DataView(new ArrayBuffer(42)));
+ } catch (e) {
+ didThrow = true;
+ if (e.message.indexOf("Out of bounds") < 0)
+ throw "Error: bad exception: " + e.message;
+ }
+ if (!didThrow)
+ throw "Error: did not throw";
+}
</ins></span></pre></div>
<a id="trunkSourceJavaScriptCoretestsstressftllibraryinliningexceptionsjs"></a>
<div class="addfile"><h4>Added: trunk/Source/JavaScriptCore/tests/stress/ftl-library-inlining-exceptions.js (0 => 171380)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/tests/stress/ftl-library-inlining-exceptions.js (rev 0)
+++ trunk/Source/JavaScriptCore/tests/stress/ftl-library-inlining-exceptions.js 2014-07-23 01:19:50 UTC (rev 171380)
</span><span class="lines">@@ -0,0 +1,19 @@
</span><ins>+function foo(d){
+ return Date.prototype.getTimezoneOffset.call(d);
+}
+
+noInline(foo);
+
+var x;
+var count = 100000;
+for (var i = 0 ; i < count; i++){
+ try {
+ foo(i < count - 1000 ? new Date() : "a");
+ x = false;
+ } catch (e) {
+ x = true;
+ }
+}
+
+if (!x)
+ throw "bad result: "+ x;
</ins><span class="cx">\ No newline at end of file
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoretestsstressftllibraryinliningloopsjs"></a>
<div class="addfile"><h4>Added: trunk/Source/JavaScriptCore/tests/stress/ftl-library-inlining-loops.js (0 => 171380)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/tests/stress/ftl-library-inlining-loops.js (rev 0)
+++ trunk/Source/JavaScriptCore/tests/stress/ftl-library-inlining-loops.js 2014-07-23 01:19:50 UTC (rev 171380)
</span><span class="lines">@@ -0,0 +1,28 @@
</span><ins>+function foo(){
+ var count = 100;
+ var d = new DataView(new ArrayBuffer(count));
+
+ for (var i = 0; i < count / 4; i++){
+ d.setInt32(i, i);
+ }
+
+ for (var i = 0; i < count; i++){
+ d.setInt8(i, i);
+ }
+ var result = 0;
+ for (var i = 0; i < count; i++){
+ result += d.getInt8(i);
+ }
+ return result;
+}
+
+noInline(foo);
+
+var r = 0;
+for (var i = 0 ; i < 50000; i++){
+ r += foo();
+}
+
+if (r != 247500000)
+ throw "Bad result: " + r;
+
</ins></span></pre></div>
<a id="trunkSourceJavaScriptCoretestsstressftllibraryinliningrandomjs"></a>
<div class="addfile"><h4>Added: trunk/Source/JavaScriptCore/tests/stress/ftl-library-inlining-random.js (0 => 171380)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/tests/stress/ftl-library-inlining-random.js (rev 0)
+++ trunk/Source/JavaScriptCore/tests/stress/ftl-library-inlining-random.js 2014-07-23 01:19:50 UTC (rev 171380)
</span><span class="lines">@@ -0,0 +1,11 @@
</span><ins>+function foo(x){
+ return Math.random(x);
+}
+
+noInline(foo);
+
+var x = 0;
+
+for (var i = 0 ; i < 100000; i++){
+ x = foo(i);
+}
</ins></span></pre></div>
<a id="trunkSourceJavaScriptCoretestsstressftllibrarysubstringjs"></a>
<div class="addfile"><h4>Added: trunk/Source/JavaScriptCore/tests/stress/ftl-library-substring.js (0 => 171380)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/tests/stress/ftl-library-substring.js (rev 0)
+++ trunk/Source/JavaScriptCore/tests/stress/ftl-library-substring.js 2014-07-23 01:19:50 UTC (rev 171380)
</span><span class="lines">@@ -0,0 +1,15 @@
</span><ins>+function foo(i, x){
+ return x.substring( 2 , 5);
+}
+
+noInline(foo);
+
+var x = "";
+
+for (var i = 0 ; i < 100000; i++){
+ x = foo(i, "lkajsx");
+}
+
+if (x != "ajs")
+ throw "Error: bad substring: "+ x;
+
</ins></span></pre></div>
<a id="trunkSourceJavaScriptCoretestsstressmultiputbyoffsetmultipletransitionsjs"></a>
<div class="addfile"><h4>Added: trunk/Source/JavaScriptCore/tests/stress/multi-put-by-offset-multiple-transitions.js (0 => 171380)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/tests/stress/multi-put-by-offset-multiple-transitions.js (rev 0)
+++ trunk/Source/JavaScriptCore/tests/stress/multi-put-by-offset-multiple-transitions.js 2014-07-23 01:19:50 UTC (rev 171380)
</span><span class="lines">@@ -0,0 +1,30 @@
</span><ins>+function foo(o) {
+ o.x = 1;
+ o.y = 2;
+ o.a = 3;
+ o.b = 4;
+ o.c = 5;
+ o.d = 6;
+ o.e = 7;
+ o.f = 8;
+ o.g = 9;
+ o.h = 10;
+ o.i = 11;
+}
+
+noInline(foo);
+
+function Foo() {
+ foo(this);
+}
+
+var result = 0;
+
+for (var i = 0; i < 100000; ++i) {
+ foo({f:42});
+ result += (new Foo()).x;
+}
+
+if (result != 100000)
+ throw "Bad result: " + result;
+
</ins></span></pre></div>
<a id="trunkSourceJavaScriptCoretestsstressthrowfromftlinloopjs"></a>
<div class="addfile"><h4>Added: trunk/Source/JavaScriptCore/tests/stress/throw-from-ftl-in-loop.js (0 => 171380)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/tests/stress/throw-from-ftl-in-loop.js (rev 0)
+++ trunk/Source/JavaScriptCore/tests/stress/throw-from-ftl-in-loop.js 2014-07-23 01:19:50 UTC (rev 171380)
</span><span class="lines">@@ -0,0 +1,13 @@
</span><ins>+var didThrow = false;
+try {
+ (function() {
+ for (var i = 0; i < 1000000; ++i) { }
+ throw 42;
+ })();
+} catch (e) {
+ if (e != 42)
+ throw "Error: bad result: " + e;
+ didThrow = true;
+}
+if (!didThrow)
+ throw "Error: should have thrown but didn't.";
</ins></span></pre></div>
<a id="trunkSourceJavaScriptCoretestsstressthrowfromftljs"></a>
<div class="addfile"><h4>Added: trunk/Source/JavaScriptCore/tests/stress/throw-from-ftl.js (0 => 171380)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/tests/stress/throw-from-ftl.js (rev 0)
+++ trunk/Source/JavaScriptCore/tests/stress/throw-from-ftl.js 2014-07-23 01:19:50 UTC (rev 171380)
</span><span class="lines">@@ -0,0 +1,25 @@
</span><ins>+function foo(p) {
+ var o = {f:42};
+ if (p)
+ throw o;
+ return o;
+}
+
+noInline(foo);
+
+for (var i = 0; i < 100000; ++i) {
+ var o = foo(false);
+ if (o.f != 42)
+ throw "Error: bad result: " + o.f;
+}
+
+var didThrow = false;
+try {
+ foo(true);
+} catch (e) {
+ if (e.f != 42)
+ throw "Error: bad result in catch: " + o.f;
+ didThrow = true;
+}
+if (!didThrow)
+ throw "Error: should have thrown but didn't.";
</ins></span></pre></div>
<a id="trunkSourceWTFChangeLog"></a>
<div class="modfile"><h4>Modified: trunk/Source/WTF/ChangeLog (171379 => 171380)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WTF/ChangeLog 2014-07-23 01:12:32 UTC (rev 171379)
+++ trunk/Source/WTF/ChangeLog 2014-07-23 01:19:50 UTC (rev 171380)
</span><span class="lines">@@ -1,5 +1,20 @@
</span><span class="cx"> 2014-07-22 Filip Pizlo <fpizlo@apple.com>
</span><span class="cx">
</span><ins>+ Merge r169148, r169185, r169188, r169578, r169582, r169584, r169588, r169753 from ftlopt.
+
+ 2014-06-04 Filip Pizlo <fpizlo@apple.com>
+
+ [ftlopt] AI should be able track structure sets larger than 1
+ https://bugs.webkit.org/show_bug.cgi?id=128073
+
+ Reviewed by Oliver Hunt.
+
+ * wtf/Bag.h:
+ (WTF::Bag::Node::Node):
+ (WTF::Bag::add):
+
+2014-07-22 Filip Pizlo <fpizlo@apple.com>
+
</ins><span class="cx"> Merge r168635, r168780, r169005, r169014, and r169143 from ftlopt.
</span><span class="cx">
</span><span class="cx"> 2014-05-20 Filip Pizlo <fpizlo@apple.com>
</span></span></pre></div>
<a id="trunkSourceWTFwtfBagh"></a>
<div class="modfile"><h4>Modified: trunk/Source/WTF/wtf/Bag.h (171379 => 171380)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WTF/wtf/Bag.h 2014-07-23 01:12:32 UTC (rev 171379)
+++ trunk/Source/WTF/wtf/Bag.h 2014-07-23 01:19:50 UTC (rev 171380)
</span><span class="lines">@@ -34,6 +34,12 @@
</span><span class="cx"> class Node {
</span><span class="cx"> WTF_MAKE_FAST_ALLOCATED;
</span><span class="cx"> public:
</span><ins>+ template<typename... Args>
+ Node(Args... args)
+ : m_item(args...)
+ {
+ }
+
</ins><span class="cx"> T m_item;
</span><span class="cx"> Node* m_next;
</span><span class="cx"> };
</span><span class="lines">@@ -53,9 +59,10 @@
</span><span class="cx"> }
</span><span class="cx"> }
</span><span class="cx">
</span><del>- T* add()
</del><ins>+ template<typename... Args>
+ T* add(Args... args)
</ins><span class="cx"> {
</span><del>- Node* newNode = new Node;
</del><ins>+ Node* newNode = new Node(args...);
</ins><span class="cx"> newNode->m_next = m_head;
</span><span class="cx"> m_head = newNode;
</span><span class="cx"> return &newNode->m_item;
</span></span></pre>
</div>
</div>
</body>
</html>