<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN"
"http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head><meta http-equiv="content-type" content="text/html; charset=utf-8" />
<title>[171648] trunk</title>
</head>
<body>
<style type="text/css"><!--
#msg dl.meta { border: 1px #006 solid; background: #369; padding: 6px; color: #fff; }
#msg dl.meta dt { float: left; width: 6em; font-weight: bold; }
#msg dt:after { content:':';}
#msg dl, #msg dt, #msg ul, #msg li, #header, #footer, #logmsg { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; }
#msg dl a { font-weight: bold}
#msg dl a:link { color:#fc3; }
#msg dl a:active { color:#ff0; }
#msg dl a:visited { color:#cc6; }
h3 { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; font-weight: bold; }
#msg pre { overflow: auto; background: #ffc; border: 1px #fa0 solid; padding: 6px; }
#logmsg { background: #ffc; border: 1px #fa0 solid; padding: 1em 1em 0 1em; }
#logmsg p, #logmsg pre, #logmsg blockquote { margin: 0 0 1em 0; }
#logmsg p, #logmsg li, #logmsg dt, #logmsg dd { line-height: 14pt; }
#logmsg h1, #logmsg h2, #logmsg h3, #logmsg h4, #logmsg h5, #logmsg h6 { margin: .5em 0; }
#logmsg h1:first-child, #logmsg h2:first-child, #logmsg h3:first-child, #logmsg h4:first-child, #logmsg h5:first-child, #logmsg h6:first-child { margin-top: 0; }
#logmsg ul, #logmsg ol { padding: 0; list-style-position: inside; margin: 0 0 0 1em; }
#logmsg ul { text-indent: -1em; padding-left: 1em; }#logmsg ol { text-indent: -1.5em; padding-left: 1.5em; }
#logmsg > ul, #logmsg > ol { margin: 0 0 1em 0; }
#logmsg pre { background: #eee; padding: 1em; }
#logmsg blockquote { border: 1px solid #fa0; border-left-width: 10px; padding: 1em 1em 0 1em; background: white;}
#logmsg dl { margin: 0; }
#logmsg dt { font-weight: bold; }
#logmsg dd { margin: 0; padding: 0 0 0.5em 0; }
#logmsg dd:before { content:'\00bb';}
#logmsg table { border-spacing: 0px; border-collapse: collapse; border-top: 4px solid #fa0; border-bottom: 1px solid #fa0; background: #fff; }
#logmsg table th { text-align: left; font-weight: normal; padding: 0.2em 0.5em; border-top: 1px dotted #fa0; }
#logmsg table td { text-align: right; border-top: 1px dotted #fa0; padding: 0.2em 0.5em; }
#logmsg table thead th { text-align: center; border-bottom: 1px solid #fa0; }
#logmsg table th.Corner { text-align: left; }
#logmsg hr { border: none 0; border-top: 2px dashed #fa0; height: 1px; }
#header, #footer { color: #fff; background: #636; border: 1px #300 solid; padding: 6px; }
#patch { width: 100%; }
#patch h4 {font-family: verdana,arial,helvetica,sans-serif;font-size:10pt;padding:8px;background:#369;color:#fff;margin:0;}
#patch .propset h4, #patch .binary h4 {margin:0;}
#patch pre {padding:0;line-height:1.2em;margin:0;}
#patch .diff {width:100%;background:#eee;padding: 0 0 10px 0;overflow:auto;}
#patch .propset .diff, #patch .binary .diff {padding:10px 0;}
#patch span {display:block;padding:0 10px;}
#patch .modfile, #patch .addfile, #patch .delfile, #patch .propset, #patch .binary, #patch .copfile {border:1px solid #ccc;margin:10px 0;}
#patch ins {background:#dfd;text-decoration:none;display:block;padding:0 10px;}
#patch del {background:#fdd;text-decoration:none;display:block;padding:0 10px;}
#patch .lines, .info {color:#888;background:#fff;}
--></style>
<div id="msg">
<dl class="meta">
<dt>Revision</dt> <dd><a href="http://trac.webkit.org/projects/webkit/changeset/171648">171648</a></dd>
<dt>Author</dt> <dd>fpizlo@apple.com</dd>
<dt>Date</dt> <dd>2014-07-26 12:06:44 -0700 (Sat, 26 Jul 2014)</dd>
</dl>
<h3>Log Message</h3>
<pre>Unreviewed, roll out <a href="http://trac.webkit.org/projects/webkit/changeset/171641">r171641</a>-<a href="http://trac.webkit.org/projects/webkit/changeset/171644">r171644</a>. It broke some tests; will investigate and
reland later.
Source/JavaScriptCore:
* CMakeLists.txt:
* JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
* JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
* JavaScriptCore.xcodeproj/project.pbxproj:
* bytecode/BytecodeList.json:
* bytecode/BytecodeUseDef.h:
(JSC::computeUsesForBytecodeOffset):
(JSC::computeDefsForBytecodeOffset):
* bytecode/CodeBlock.cpp:
(JSC::CodeBlock::dumpBytecode):
(JSC::CodeBlock::CodeBlock):
(JSC::CodeBlock::finalizeUnconditionally):
(JSC::CodeBlock::printPutByIdCacheStatus): Deleted.
* bytecode/CodeBlock.h:
* bytecode/GetByIdStatus.cpp:
(JSC::GetByIdStatus::computeForStubInfo):
(JSC::GetByIdStatus::computeFor):
* bytecode/GetByIdStatus.h:
* bytecode/GetByIdVariant.cpp:
(JSC::GetByIdVariant::dumpInContext):
* bytecode/GetByIdVariant.h:
(JSC::GetByIdVariant::structureSet):
* bytecode/Instruction.h:
* bytecode/PutByIdStatus.cpp:
(JSC::PutByIdStatus::appendVariant):
(JSC::PutByIdStatus::computeForStubInfo):
(JSC::PutByIdStatus::computeFor):
* bytecode/PutByIdStatus.h:
* bytecode/PutByIdVariant.cpp:
(JSC::PutByIdVariant::dumpInContext):
(JSC::PutByIdVariant::oldStructureForTransition): Deleted.
(JSC::PutByIdVariant::writesStructures): Deleted.
(JSC::PutByIdVariant::reallocatesStorage): Deleted.
(JSC::PutByIdVariant::attemptToMerge): Deleted.
(JSC::PutByIdVariant::attemptToMergeTransitionWithReplace): Deleted.
* bytecode/PutByIdVariant.h:
(JSC::PutByIdVariant::PutByIdVariant):
(JSC::PutByIdVariant::replace):
(JSC::PutByIdVariant::transition):
(JSC::PutByIdVariant::structure):
(JSC::PutByIdVariant::oldStructure):
(JSC::PutByIdVariant::newStructure):
(JSC::PutByIdVariant::constantChecks):
* bytecode/StructureSet.cpp:
(JSC::StructureSet::filter): Deleted.
(JSC::StructureSet::filterArrayModes): Deleted.
* bytecode/StructureSet.h:
(JSC::StructureSet::onlyStructure):
* bytecode/ToThisStatus.cpp: Removed.
* bytecode/ToThisStatus.h: Removed.
* bytecode/TypeLocation.h: Removed.
* bytecompiler/BytecodeGenerator.cpp:
(JSC::BytecodeGenerator::BytecodeGenerator):
(JSC::BytecodeGenerator::emitMove):
(JSC::BytecodeGenerator::emitPutToScope):
(JSC::BytecodeGenerator::emitPutById):
(JSC::BytecodeGenerator::emitPutByVal):
(JSC::BytecodeGenerator::emitProfileTypesWithHighFidelity): Deleted.
* bytecompiler/BytecodeGenerator.h:
(JSC::BytecodeGenerator::isProfilingTypesWithHighFidelity): Deleted.
* bytecompiler/NodesCodegen.cpp:
(JSC::PostfixNode::emitResolve):
(JSC::PrefixNode::emitResolve):
(JSC::ReadModifyResolveNode::emitBytecode):
(JSC::AssignResolveNode::emitBytecode):
(JSC::ConstDeclNode::emitCodeSingle):
(JSC::ForInNode::emitBytecode):
* debugger/DebuggerActivation.cpp: Added.
(JSC::DebuggerActivation::DebuggerActivation):
(JSC::DebuggerActivation::finishCreation):
(JSC::DebuggerActivation::visitChildren):
(JSC::DebuggerActivation::className):
(JSC::DebuggerActivation::getOwnPropertySlot):
(JSC::DebuggerActivation::put):
(JSC::DebuggerActivation::deleteProperty):
(JSC::DebuggerActivation::getOwnPropertyNames):
(JSC::DebuggerActivation::defineOwnProperty):
* debugger/DebuggerActivation.h: Added.
(JSC::DebuggerActivation::create):
(JSC::DebuggerActivation::createStructure):
* debugger/DebuggerScope.cpp: Removed.
* debugger/DebuggerScope.h: Removed.
* dfg/DFGAbstractInterpreterInlines.h:
(JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
(JSC::DFG::AbstractInterpreter<AbstractStateType>::observeTransition):
(JSC::DFG::AbstractInterpreter<AbstractStateType>::observeTransitions):
* dfg/DFGAbstractValue.cpp:
(JSC::DFG::AbstractValue::changeStructure): Deleted.
(JSC::DFG::AbstractValue::contains): Deleted.
* dfg/DFGAbstractValue.h:
(JSC::DFG::AbstractValue::couldBeType):
(JSC::DFG::AbstractValue::isType):
* dfg/DFGByteCodeParser.cpp:
(JSC::DFG::ByteCodeParser::handlePutById):
(JSC::DFG::ByteCodeParser::parseBlock):
* dfg/DFGClobberize.h:
(JSC::DFG::clobberize):
* dfg/DFGConstantFoldingPhase.cpp:
(JSC::DFG::ConstantFoldingPhase::foldConstants):
(JSC::DFG::ConstantFoldingPhase::emitGetByOffset):
(JSC::DFG::ConstantFoldingPhase::emitPutByOffset):
(JSC::DFG::ConstantFoldingPhase::addBaseCheck): Deleted.
(JSC::DFG::ConstantFoldingPhase::addChecks): Deleted.
* dfg/DFGDoesGC.cpp:
(JSC::DFG::doesGC):
* dfg/DFGFixupPhase.cpp:
(JSC::DFG::FixupPhase::fixupNode):
* dfg/DFGGraph.cpp:
(JSC::DFG::Graph::visitChildren):
(JSC::DFG::Graph::freezeStrong):
* dfg/DFGGraph.h:
* dfg/DFGNode.cpp:
(JSC::DFG::MultiPutByOffsetData::writesStructures):
(JSC::DFG::MultiPutByOffsetData::reallocatesStorage):
* dfg/DFGNode.h:
(JSC::DFG::Node::convertToPutByOffset):
(JSC::DFG::Node::hasTransition):
(JSC::DFG::Node::convertToMultiGetByOffset): Deleted.
(JSC::DFG::Node::convertToMultiPutByOffset): Deleted.
* dfg/DFGNodeType.h:
* dfg/DFGPredictionPropagationPhase.cpp:
(JSC::DFG::PredictionPropagationPhase::propagate):
* dfg/DFGSafeToExecute.h:
(JSC::DFG::safeToExecute):
* dfg/DFGSpeculativeJIT.cpp:
(JSC::DFG::SpeculativeJIT::silentSavePlanForGPR):
* dfg/DFGSpeculativeJIT32_64.cpp:
(JSC::DFG::SpeculativeJIT::fillSpeculateCell):
(JSC::DFG::SpeculativeJIT::compile):
* dfg/DFGSpeculativeJIT64.cpp:
(JSC::DFG::SpeculativeJIT::fillJSValue):
(JSC::DFG::SpeculativeJIT::nonSpeculativeCompareNull):
(JSC::DFG::SpeculativeJIT::emitCall):
(JSC::DFG::SpeculativeJIT::fillSpeculateInt32Internal):
(JSC::DFG::SpeculativeJIT::fillSpeculateInt32Strict):
(JSC::DFG::SpeculativeJIT::fillSpeculateInt52):
(JSC::DFG::SpeculativeJIT::fillSpeculateDouble):
(JSC::DFG::SpeculativeJIT::fillSpeculateCell):
(JSC::DFG::SpeculativeJIT::fillSpeculateBoolean):
(JSC::DFG::SpeculativeJIT::compileLogicalNot):
(JSC::DFG::SpeculativeJIT::emitBranch):
(JSC::DFG::SpeculativeJIT::compile):
* dfg/DFGStructureAbstractValue.cpp:
(JSC::DFG::StructureAbstractValue::observeTransition):
(JSC::DFG::StructureAbstractValue::observeTransitions):
* dfg/DFGStructureAbstractValue.h:
(JSC::DFG::StructureAbstractValue::onlyStructure):
(JSC::DFG::StructureAbstractValue::operator=): Deleted.
(JSC::DFG::StructureAbstractValue::set): Deleted.
* dfg/DFGValidate.cpp:
(JSC::DFG::Validate::validate):
* dfg/DFGWatchableStructureWatchingPhase.cpp:
(JSC::DFG::WatchableStructureWatchingPhase::run):
* ftl/FTLAbbreviations.h:
(JSC::FTL::getLinkage): Deleted.
* ftl/FTLCapabilities.cpp:
(JSC::FTL::canCompile):
* ftl/FTLLowerDFGToLLVM.cpp:
(JSC::FTL::LowerDFGToLLVM::compileNode):
(JSC::FTL::LowerDFGToLLVM::compilePhantomPutStructure):
(JSC::FTL::LowerDFGToLLVM::compileMultiGetByOffset):
(JSC::FTL::LowerDFGToLLVM::compileMultiPutByOffset):
(JSC::FTL::LowerDFGToLLVM::getModuleByPathForSymbol):
* heap/Heap.cpp:
(JSC::Heap::collect):
* inspector/agents/InspectorRuntimeAgent.cpp:
(Inspector::InspectorRuntimeAgent::getRuntimeTypeForVariableInTextRange): Deleted.
* inspector/agents/InspectorRuntimeAgent.h:
* inspector/protocol/Runtime.json:
* jsc.cpp:
(GlobalObject::finishCreation):
(functionDumpTypesForAllVariables): Deleted.
* llint/LLIntData.cpp:
(JSC::LLInt::Data::performAssertions):
* llint/LLIntSlowPaths.cpp:
(JSC::LLInt::LLINT_SLOW_PATH_DECL):
(JSC::LLInt::putToScopeCommon): Deleted.
* llint/LLIntSlowPaths.h:
* llint/LowLevelInterpreter.asm:
* llint/LowLevelInterpreter32_64.asm:
* llint/LowLevelInterpreter64.asm:
* runtime/ArrayBufferNeuteringWatchpoint.cpp:
(JSC::ArrayBufferNeuteringWatchpoint::createStructure):
* runtime/CommonSlowPaths.cpp:
(JSC::SLOW_PATH_DECL):
* runtime/Executable.h:
(JSC::ExecutableBase::createStructure):
(JSC::NativeExecutable::createStructure):
* runtime/HighFidelityLog.cpp: Removed.
* runtime/HighFidelityLog.h: Removed.
* runtime/HighFidelityTypeProfiler.cpp: Removed.
* runtime/HighFidelityTypeProfiler.h: Removed.
* runtime/JSObject.cpp:
(JSC::JSObject::putDirectCustomAccessor):
(JSC::JSObject::putDirectNonIndexAccessor):
(JSC::JSObject::reifyStaticFunctionsForDelete):
* runtime/JSPromiseDeferred.h:
(JSC::JSPromiseDeferred::createStructure):
* runtime/JSPromiseReaction.h:
(JSC::JSPromiseReaction::createStructure):
* runtime/JSPropertyNameIterator.h:
(JSC::JSPropertyNameIterator::createStructure):
* runtime/JSType.h:
* runtime/JSTypeInfo.h:
(JSC::TypeInfo::TypeInfo):
* runtime/MapData.h:
(JSC::MapData::createStructure):
* runtime/Options.h:
* runtime/PropertyMapHashTable.h:
(JSC::PropertyTable::createStructure):
* runtime/RegExp.h:
(JSC::RegExp::createStructure):
* runtime/SparseArrayValueMap.cpp:
(JSC::SparseArrayValueMap::createStructure):
* runtime/Structure.cpp:
(JSC::StructureTransitionTable::contains):
(JSC::StructureTransitionTable::get):
(JSC::StructureTransitionTable::add):
(JSC::Structure::Structure):
(JSC::Structure::materializePropertyMap):
(JSC::Structure::addPropertyTransition):
(JSC::Structure::despecifyFunctionTransition):
(JSC::Structure::toDictionaryTransition):
(JSC::Structure::freezeTransition):
(JSC::Structure::preventExtensionsTransition):
(JSC::Structure::takePropertyTableOrCloneIfPinned):
(JSC::Structure::nonPropertyTransition):
(JSC::Structure::flattenDictionaryStructure):
(JSC::Structure::addPropertyWithoutTransition):
(JSC::Structure::pin):
(JSC::Structure::allocateRareData):
(JSC::Structure::cloneRareDataFrom):
(JSC::Structure::getConcurrently):
(JSC::Structure::putSpecificValue):
(JSC::Structure::getPropertyNamesFromStructure):
(JSC::Structure::visitChildren):
(JSC::Structure::checkConsistency):
(JSC::Structure::toStructureShape): Deleted.
* runtime/Structure.h:
(JSC::Structure::isExtensible):
(JSC::Structure::didTransition):
(JSC::Structure::isDictionary):
(JSC::Structure::isUncacheableDictionary):
(JSC::Structure::hasBeenFlattenedBefore):
(JSC::Structure::propertyAccessesAreCacheable):
(JSC::Structure::previousID):
(JSC::Structure::hasGetterSetterProperties):
(JSC::Structure::hasReadOnlyOrGetterSetterPropertiesExcludingProto):
(JSC::Structure::setHasGetterSetterProperties):
(JSC::Structure::hasCustomGetterSetterProperties):
(JSC::Structure::setHasCustomGetterSetterProperties):
(JSC::Structure::setContainsReadOnlyProperties):
(JSC::Structure::hasNonEnumerableProperties):
(JSC::Structure::disableSpecificFunctionTracking):
(JSC::Structure::objectToStringValue):
(JSC::Structure::setObjectToStringValue):
(JSC::Structure::staticFunctionsReified):
(JSC::Structure::setStaticFunctionsReified):
(JSC::Structure::transitionWatchpointSet):
(JSC::Structure::setPreviousID):
(JSC::Structure::clearPreviousID):
(JSC::Structure::previous):
(JSC::Structure::rareData):
(JSC::Structure::setHasGetterSetterPropertiesWithProtoCheck): Deleted.
(JSC::Structure::setHasCustomGetterSetterPropertiesWithProtoCheck): Deleted.
* runtime/StructureChain.h:
(JSC::StructureChain::createStructure):
* runtime/StructureInlines.h:
(JSC::Structure::setEnumerationCache):
(JSC::Structure::enumerationCache):
(JSC::Structure::checkOffsetConsistency):
* runtime/StructureRareData.cpp:
(JSC::StructureRareData::createStructure):
* runtime/SymbolTable.cpp:
(JSC::SymbolTable::SymbolTable):
(JSC::SymbolTable::cloneCapturedNames):
(JSC::SymbolTable::uniqueIDForVariable): Deleted.
(JSC::SymbolTable::uniqueIDForRegister): Deleted.
(JSC::SymbolTable::globalTypeSetForRegister): Deleted.
(JSC::SymbolTable::globalTypeSetForVariable): Deleted.
* runtime/SymbolTable.h:
(JSC::SymbolTable::createStructure):
(JSC::SymbolTable::add):
(JSC::SymbolTable::set):
* runtime/TypeSet.cpp: Removed.
* runtime/TypeSet.h: Removed.
* runtime/VM.cpp:
(JSC::VM::VM):
(JSC::VM::getTypesForVariableInRange): Deleted.
(JSC::VM::updateHighFidelityTypeProfileState): Deleted.
(JSC::VM::dumpHighFidelityProfilingTypes): Deleted.
* runtime/VM.h:
(JSC::VM::isProfilingTypesWithHighFidelity): Deleted.
(JSC::VM::highFidelityLog): Deleted.
(JSC::VM::highFidelityTypeProfiler): Deleted.
(JSC::VM::nextLocation): Deleted.
(JSC::VM::getNextUniqueVariableID): Deleted.
* runtime/WeakMapData.h:
(JSC::WeakMapData::createStructure):
* tests/stress/fold-multi-get-by-offset-to-get-by-offset-without-folding-the-structure-check.js: Removed.
* tests/stress/fold-multi-put-by-offset-to-put-by-offset-without-folding-the-structure-check.js: Removed.
* tests/stress/prune-multi-put-by-offset-replace-or-transition-variant.js: Removed.
Source/WebCore:
* ForwardingHeaders/debugger/DebuggerActivation.h: Added.
Source/WebKit/mac:
* WebView/WebScriptDebugDelegate.mm:
Source/WTF:
* wtf/text/WTFString.h:
LayoutTests:
* js/regress/fold-get-by-id-to-multi-get-by-offset-expected.txt: Removed.
* js/regress/fold-get-by-id-to-multi-get-by-offset-rare-int-expected.txt: Removed.
* js/regress/fold-get-by-id-to-multi-get-by-offset-rare-int.html: Removed.
* js/regress/fold-get-by-id-to-multi-get-by-offset.html: Removed.
* js/regress/fold-multi-get-by-offset-to-get-by-offset-expected.txt: Removed.
* js/regress/fold-multi-get-by-offset-to-get-by-offset.html: Removed.
* js/regress/fold-multi-get-by-offset-to-poly-get-by-offset-expected.txt: Removed.
* js/regress/fold-multi-get-by-offset-to-poly-get-by-offset.html: Removed.
* js/regress/fold-multi-put-by-offset-to-poly-put-by-offset-expected.txt: Removed.
* js/regress/fold-multi-put-by-offset-to-poly-put-by-offset.html: Removed.
* js/regress/fold-multi-put-by-offset-to-put-by-offset-expected.txt: Removed.
* js/regress/fold-multi-put-by-offset-to-put-by-offset.html: Removed.
* js/regress/fold-multi-put-by-offset-to-replace-or-transition-put-by-offset-expected.txt: Removed.
* js/regress/fold-multi-put-by-offset-to-replace-or-transition-put-by-offset.html: Removed.
* js/regress/fold-put-by-id-to-multi-put-by-offset-expected.txt: Removed.
* js/regress/fold-put-by-id-to-multi-put-by-offset.html: Removed.
* js/regress/fold-put-structure-expected.txt: Removed.
* js/regress/fold-put-structure.html: Removed.
* js/regress/hoist-poly-check-structure-effectful-loop-expected.txt: Removed.
* js/regress/hoist-poly-check-structure-effectful-loop.html: Removed.
* js/regress/hoist-poly-check-structure-expected.txt: Removed.
* js/regress/hoist-poly-check-structure.html: Removed.
* js/regress/put-by-id-replace-and-transition-expected.txt: Removed.
* js/regress/put-by-id-replace-and-transition.html: Removed.
* js/regress/put-by-id-slightly-polymorphic-expected.txt: Removed.
* js/regress/put-by-id-slightly-polymorphic.html: Removed.
* js/regress/script-tests/fold-get-by-id-to-multi-get-by-offset-rare-int.js: Removed.
* js/regress/script-tests/fold-get-by-id-to-multi-get-by-offset.js: Removed.
* js/regress/script-tests/fold-multi-get-by-offset-to-get-by-offset.js: Removed.
* js/regress/script-tests/fold-multi-get-by-offset-to-poly-get-by-offset.js: Removed.
* js/regress/script-tests/fold-multi-put-by-offset-to-poly-put-by-offset.js: Removed.
* js/regress/script-tests/fold-multi-put-by-offset-to-put-by-offset.js: Removed.
* js/regress/script-tests/fold-multi-put-by-offset-to-replace-or-transition-put-by-offset.js: Removed.
* js/regress/script-tests/fold-put-by-id-to-multi-put-by-offset.js: Removed.
* js/regress/script-tests/fold-put-structure.js: Removed.
* js/regress/script-tests/hoist-poly-check-structure-effectful-loop.js: Removed.
* js/regress/script-tests/hoist-poly-check-structure.js: Removed.
* js/regress/script-tests/put-by-id-replace-and-transition.js: Removed.
* js/regress/script-tests/put-by-id-slightly-polymorphic.js: Removed.</pre>
<h3>Modified Paths</h3>
<ul>
<li><a href="#trunkLayoutTestsChangeLog">trunk/LayoutTests/ChangeLog</a></li>
<li><a href="#trunkSourceJavaScriptCoreCMakeListstxt">trunk/Source/JavaScriptCore/CMakeLists.txt</a></li>
<li><a href="#trunkSourceJavaScriptCoreChangeLog">trunk/Source/JavaScriptCore/ChangeLog</a></li>
<li><a href="#trunkSourceJavaScriptCoreJavaScriptCorevcxprojJavaScriptCorevcxproj">trunk/Source/JavaScriptCore/JavaScriptCore.vcxproj/JavaScriptCore.vcxproj</a></li>
<li><a href="#trunkSourceJavaScriptCoreJavaScriptCorevcxprojJavaScriptCorevcxprojfilters">trunk/Source/JavaScriptCore/JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters</a></li>
<li><a href="#trunkSourceJavaScriptCoreJavaScriptCorexcodeprojprojectpbxproj">trunk/Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj</a></li>
<li><a href="#trunkSourceJavaScriptCorebytecodeBytecodeListjson">trunk/Source/JavaScriptCore/bytecode/BytecodeList.json</a></li>
<li><a href="#trunkSourceJavaScriptCorebytecodeBytecodeUseDefh">trunk/Source/JavaScriptCore/bytecode/BytecodeUseDef.h</a></li>
<li><a href="#trunkSourceJavaScriptCorebytecodeCodeBlockcpp">trunk/Source/JavaScriptCore/bytecode/CodeBlock.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCorebytecodeCodeBlockh">trunk/Source/JavaScriptCore/bytecode/CodeBlock.h</a></li>
<li><a href="#trunkSourceJavaScriptCorebytecodeGetByIdStatuscpp">trunk/Source/JavaScriptCore/bytecode/GetByIdStatus.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCorebytecodeGetByIdStatush">trunk/Source/JavaScriptCore/bytecode/GetByIdStatus.h</a></li>
<li><a href="#trunkSourceJavaScriptCorebytecodeGetByIdVariantcpp">trunk/Source/JavaScriptCore/bytecode/GetByIdVariant.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCorebytecodeGetByIdVarianth">trunk/Source/JavaScriptCore/bytecode/GetByIdVariant.h</a></li>
<li><a href="#trunkSourceJavaScriptCorebytecodeInstructionh">trunk/Source/JavaScriptCore/bytecode/Instruction.h</a></li>
<li><a href="#trunkSourceJavaScriptCorebytecodePutByIdStatuscpp">trunk/Source/JavaScriptCore/bytecode/PutByIdStatus.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCorebytecodePutByIdStatush">trunk/Source/JavaScriptCore/bytecode/PutByIdStatus.h</a></li>
<li><a href="#trunkSourceJavaScriptCorebytecodePutByIdVariantcpp">trunk/Source/JavaScriptCore/bytecode/PutByIdVariant.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCorebytecodePutByIdVarianth">trunk/Source/JavaScriptCore/bytecode/PutByIdVariant.h</a></li>
<li><a href="#trunkSourceJavaScriptCorebytecodeStructureSetcpp">trunk/Source/JavaScriptCore/bytecode/StructureSet.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCorebytecodeStructureSeth">trunk/Source/JavaScriptCore/bytecode/StructureSet.h</a></li>
<li><a href="#trunkSourceJavaScriptCorebytecompilerBytecodeGeneratorcpp">trunk/Source/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCorebytecompilerBytecodeGeneratorh">trunk/Source/JavaScriptCore/bytecompiler/BytecodeGenerator.h</a></li>
<li><a href="#trunkSourceJavaScriptCorebytecompilerNodesCodegencpp">trunk/Source/JavaScriptCore/bytecompiler/NodesCodegen.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGAbstractInterpreterInlinesh">trunk/Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGAbstractValuecpp">trunk/Source/JavaScriptCore/dfg/DFGAbstractValue.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGAbstractValueh">trunk/Source/JavaScriptCore/dfg/DFGAbstractValue.h</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGByteCodeParsercpp">trunk/Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGClobberizeh">trunk/Source/JavaScriptCore/dfg/DFGClobberize.h</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGConstantFoldingPhasecpp">trunk/Source/JavaScriptCore/dfg/DFGConstantFoldingPhase.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGDoesGCcpp">trunk/Source/JavaScriptCore/dfg/DFGDoesGC.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGFixupPhasecpp">trunk/Source/JavaScriptCore/dfg/DFGFixupPhase.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGGraphcpp">trunk/Source/JavaScriptCore/dfg/DFGGraph.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGGraphh">trunk/Source/JavaScriptCore/dfg/DFGGraph.h</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGNodecpp">trunk/Source/JavaScriptCore/dfg/DFGNode.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGNodeh">trunk/Source/JavaScriptCore/dfg/DFGNode.h</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGNodeTypeh">trunk/Source/JavaScriptCore/dfg/DFGNodeType.h</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGPredictionPropagationPhasecpp">trunk/Source/JavaScriptCore/dfg/DFGPredictionPropagationPhase.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGSafeToExecuteh">trunk/Source/JavaScriptCore/dfg/DFGSafeToExecute.h</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGSpeculativeJITcpp">trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGSpeculativeJIT32_64cpp">trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGSpeculativeJIT64cpp">trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGStructureAbstractValuecpp">trunk/Source/JavaScriptCore/dfg/DFGStructureAbstractValue.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGStructureAbstractValueh">trunk/Source/JavaScriptCore/dfg/DFGStructureAbstractValue.h</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGValidatecpp">trunk/Source/JavaScriptCore/dfg/DFGValidate.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGWatchableStructureWatchingPhasecpp">trunk/Source/JavaScriptCore/dfg/DFGWatchableStructureWatchingPhase.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreftlFTLAbbreviationsh">trunk/Source/JavaScriptCore/ftl/FTLAbbreviations.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreftlFTLCapabilitiescpp">trunk/Source/JavaScriptCore/ftl/FTLCapabilities.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreftlFTLLowerDFGToLLVMcpp">trunk/Source/JavaScriptCore/ftl/FTLLowerDFGToLLVM.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreheapHeapcpp">trunk/Source/JavaScriptCore/heap/Heap.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreinspectoragentsInspectorRuntimeAgentcpp">trunk/Source/JavaScriptCore/inspector/agents/InspectorRuntimeAgent.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreinspectoragentsInspectorRuntimeAgenth">trunk/Source/JavaScriptCore/inspector/agents/InspectorRuntimeAgent.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreinspectorprotocolRuntimejson">trunk/Source/JavaScriptCore/inspector/protocol/Runtime.json</a></li>
<li><a href="#trunkSourceJavaScriptCorejsccpp">trunk/Source/JavaScriptCore/jsc.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCorellintLLIntDatacpp">trunk/Source/JavaScriptCore/llint/LLIntData.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCorellintLLIntSlowPathscpp">trunk/Source/JavaScriptCore/llint/LLIntSlowPaths.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCorellintLLIntSlowPathsh">trunk/Source/JavaScriptCore/llint/LLIntSlowPaths.h</a></li>
<li><a href="#trunkSourceJavaScriptCorellintLowLevelInterpreterasm">trunk/Source/JavaScriptCore/llint/LowLevelInterpreter.asm</a></li>
<li><a href="#trunkSourceJavaScriptCorellintLowLevelInterpreter32_64asm">trunk/Source/JavaScriptCore/llint/LowLevelInterpreter32_64.asm</a></li>
<li><a href="#trunkSourceJavaScriptCorellintLowLevelInterpreter64asm">trunk/Source/JavaScriptCore/llint/LowLevelInterpreter64.asm</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeArrayBufferNeuteringWatchpointcpp">trunk/Source/JavaScriptCore/runtime/ArrayBufferNeuteringWatchpoint.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeCommonSlowPathscpp">trunk/Source/JavaScriptCore/runtime/CommonSlowPaths.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeExecutableh">trunk/Source/JavaScriptCore/runtime/Executable.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeJSObjectcpp">trunk/Source/JavaScriptCore/runtime/JSObject.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeJSPromiseDeferredh">trunk/Source/JavaScriptCore/runtime/JSPromiseDeferred.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeJSPromiseReactionh">trunk/Source/JavaScriptCore/runtime/JSPromiseReaction.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeJSPropertyNameIteratorh">trunk/Source/JavaScriptCore/runtime/JSPropertyNameIterator.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeJSTypeh">trunk/Source/JavaScriptCore/runtime/JSType.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeJSTypeInfoh">trunk/Source/JavaScriptCore/runtime/JSTypeInfo.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeMapDatah">trunk/Source/JavaScriptCore/runtime/MapData.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeOptionsh">trunk/Source/JavaScriptCore/runtime/Options.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimePropertyMapHashTableh">trunk/Source/JavaScriptCore/runtime/PropertyMapHashTable.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeRegExph">trunk/Source/JavaScriptCore/runtime/RegExp.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeSparseArrayValueMapcpp">trunk/Source/JavaScriptCore/runtime/SparseArrayValueMap.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeStructurecpp">trunk/Source/JavaScriptCore/runtime/Structure.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeStructureh">trunk/Source/JavaScriptCore/runtime/Structure.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeStructureChainh">trunk/Source/JavaScriptCore/runtime/StructureChain.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeStructureInlinesh">trunk/Source/JavaScriptCore/runtime/StructureInlines.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeStructureRareDatacpp">trunk/Source/JavaScriptCore/runtime/StructureRareData.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeSymbolTablecpp">trunk/Source/JavaScriptCore/runtime/SymbolTable.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeSymbolTableh">trunk/Source/JavaScriptCore/runtime/SymbolTable.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeVMcpp">trunk/Source/JavaScriptCore/runtime/VM.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeVMh">trunk/Source/JavaScriptCore/runtime/VM.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeWeakMapDatah">trunk/Source/JavaScriptCore/runtime/WeakMapData.h</a></li>
<li><a href="#trunkSourceWTFChangeLog">trunk/Source/WTF/ChangeLog</a></li>
<li><a href="#trunkSourceWTFwtftextWTFStringh">trunk/Source/WTF/wtf/text/WTFString.h</a></li>
<li><a href="#trunkSourceWebCoreChangeLog">trunk/Source/WebCore/ChangeLog</a></li>
<li><a href="#trunkSourceWebKitmacChangeLog">trunk/Source/WebKit/mac/ChangeLog</a></li>
<li><a href="#trunkSourceWebKitmacWebViewWebScriptDebugDelegatemm">trunk/Source/WebKit/mac/WebView/WebScriptDebugDelegate.mm</a></li>
</ul>
<h3>Added Paths</h3>
<ul>
<li><a href="#trunkSourceJavaScriptCoredebuggerDebuggerActivationcpp">trunk/Source/JavaScriptCore/debugger/DebuggerActivation.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoredebuggerDebuggerActivationh">trunk/Source/JavaScriptCore/debugger/DebuggerActivation.h</a></li>
<li><a href="#trunkSourceWebCoreForwardingHeadersdebuggerDebuggerActivationh">trunk/Source/WebCore/ForwardingHeaders/debugger/DebuggerActivation.h</a></li>
</ul>
<h3>Removed Paths</h3>
<ul>
<li><a href="#trunkLayoutTestsjsregressfoldgetbyidtomultigetbyoffsetexpectedtxt">trunk/LayoutTests/js/regress/fold-get-by-id-to-multi-get-by-offset-expected.txt</a></li>
<li><a href="#trunkLayoutTestsjsregressfoldgetbyidtomultigetbyoffsetrareintexpectedtxt">trunk/LayoutTests/js/regress/fold-get-by-id-to-multi-get-by-offset-rare-int-expected.txt</a></li>
<li><a href="#trunkLayoutTestsjsregressfoldgetbyidtomultigetbyoffsetrareinthtml">trunk/LayoutTests/js/regress/fold-get-by-id-to-multi-get-by-offset-rare-int.html</a></li>
<li><a href="#trunkLayoutTestsjsregressfoldgetbyidtomultigetbyoffsethtml">trunk/LayoutTests/js/regress/fold-get-by-id-to-multi-get-by-offset.html</a></li>
<li><a href="#trunkLayoutTestsjsregressfoldmultigetbyoffsettogetbyoffsetexpectedtxt">trunk/LayoutTests/js/regress/fold-multi-get-by-offset-to-get-by-offset-expected.txt</a></li>
<li><a href="#trunkLayoutTestsjsregressfoldmultigetbyoffsettogetbyoffsethtml">trunk/LayoutTests/js/regress/fold-multi-get-by-offset-to-get-by-offset.html</a></li>
<li><a href="#trunkLayoutTestsjsregressfoldmultigetbyoffsettopolygetbyoffsetexpectedtxt">trunk/LayoutTests/js/regress/fold-multi-get-by-offset-to-poly-get-by-offset-expected.txt</a></li>
<li><a href="#trunkLayoutTestsjsregressfoldmultigetbyoffsettopolygetbyoffsethtml">trunk/LayoutTests/js/regress/fold-multi-get-by-offset-to-poly-get-by-offset.html</a></li>
<li><a href="#trunkLayoutTestsjsregressfoldmultiputbyoffsettopolyputbyoffsetexpectedtxt">trunk/LayoutTests/js/regress/fold-multi-put-by-offset-to-poly-put-by-offset-expected.txt</a></li>
<li><a href="#trunkLayoutTestsjsregressfoldmultiputbyoffsettopolyputbyoffsethtml">trunk/LayoutTests/js/regress/fold-multi-put-by-offset-to-poly-put-by-offset.html</a></li>
<li><a href="#trunkLayoutTestsjsregressfoldmultiputbyoffsettoputbyoffsetexpectedtxt">trunk/LayoutTests/js/regress/fold-multi-put-by-offset-to-put-by-offset-expected.txt</a></li>
<li><a href="#trunkLayoutTestsjsregressfoldmultiputbyoffsettoputbyoffsethtml">trunk/LayoutTests/js/regress/fold-multi-put-by-offset-to-put-by-offset.html</a></li>
<li><a href="#trunkLayoutTestsjsregressfoldmultiputbyoffsettoreplaceortransitionputbyoffsetexpectedtxt">trunk/LayoutTests/js/regress/fold-multi-put-by-offset-to-replace-or-transition-put-by-offset-expected.txt</a></li>
<li><a href="#trunkLayoutTestsjsregressfoldmultiputbyoffsettoreplaceortransitionputbyoffsethtml">trunk/LayoutTests/js/regress/fold-multi-put-by-offset-to-replace-or-transition-put-by-offset.html</a></li>
<li><a href="#trunkLayoutTestsjsregressfoldputbyidtomultiputbyoffsetexpectedtxt">trunk/LayoutTests/js/regress/fold-put-by-id-to-multi-put-by-offset-expected.txt</a></li>
<li><a href="#trunkLayoutTestsjsregressfoldputbyidtomultiputbyoffsethtml">trunk/LayoutTests/js/regress/fold-put-by-id-to-multi-put-by-offset.html</a></li>
<li><a href="#trunkLayoutTestsjsregressfoldputstructureexpectedtxt">trunk/LayoutTests/js/regress/fold-put-structure-expected.txt</a></li>
<li><a href="#trunkLayoutTestsjsregressfoldputstructurehtml">trunk/LayoutTests/js/regress/fold-put-structure.html</a></li>
<li><a href="#trunkLayoutTestsjsregresshoistpolycheckstructureeffectfulloopexpectedtxt">trunk/LayoutTests/js/regress/hoist-poly-check-structure-effectful-loop-expected.txt</a></li>
<li><a href="#trunkLayoutTestsjsregresshoistpolycheckstructureeffectfulloophtml">trunk/LayoutTests/js/regress/hoist-poly-check-structure-effectful-loop.html</a></li>
<li><a href="#trunkLayoutTestsjsregresshoistpolycheckstructureexpectedtxt">trunk/LayoutTests/js/regress/hoist-poly-check-structure-expected.txt</a></li>
<li><a href="#trunkLayoutTestsjsregresshoistpolycheckstructurehtml">trunk/LayoutTests/js/regress/hoist-poly-check-structure.html</a></li>
<li><a href="#trunkLayoutTestsjsregressputbyidreplaceandtransitionexpectedtxt">trunk/LayoutTests/js/regress/put-by-id-replace-and-transition-expected.txt</a></li>
<li><a href="#trunkLayoutTestsjsregressputbyidreplaceandtransitionhtml">trunk/LayoutTests/js/regress/put-by-id-replace-and-transition.html</a></li>
<li><a href="#trunkLayoutTestsjsregressputbyidslightlypolymorphicexpectedtxt">trunk/LayoutTests/js/regress/put-by-id-slightly-polymorphic-expected.txt</a></li>
<li><a href="#trunkLayoutTestsjsregressputbyidslightlypolymorphichtml">trunk/LayoutTests/js/regress/put-by-id-slightly-polymorphic.html</a></li>
<li><a href="#trunkLayoutTestsjsregressscripttestsfoldgetbyidtomultigetbyoffsetrareintjs">trunk/LayoutTests/js/regress/script-tests/fold-get-by-id-to-multi-get-by-offset-rare-int.js</a></li>
<li><a href="#trunkLayoutTestsjsregressscripttestsfoldgetbyidtomultigetbyoffsetjs">trunk/LayoutTests/js/regress/script-tests/fold-get-by-id-to-multi-get-by-offset.js</a></li>
<li><a href="#trunkLayoutTestsjsregressscripttestsfoldmultigetbyoffsettogetbyoffsetjs">trunk/LayoutTests/js/regress/script-tests/fold-multi-get-by-offset-to-get-by-offset.js</a></li>
<li><a href="#trunkLayoutTestsjsregressscripttestsfoldmultigetbyoffsettopolygetbyoffsetjs">trunk/LayoutTests/js/regress/script-tests/fold-multi-get-by-offset-to-poly-get-by-offset.js</a></li>
<li><a href="#trunkLayoutTestsjsregressscripttestsfoldmultiputbyoffsettopolyputbyoffsetjs">trunk/LayoutTests/js/regress/script-tests/fold-multi-put-by-offset-to-poly-put-by-offset.js</a></li>
<li><a href="#trunkLayoutTestsjsregressscripttestsfoldmultiputbyoffsettoputbyoffsetjs">trunk/LayoutTests/js/regress/script-tests/fold-multi-put-by-offset-to-put-by-offset.js</a></li>
<li><a href="#trunkLayoutTestsjsregressscripttestsfoldmultiputbyoffsettoreplaceortransitionputbyoffsetjs">trunk/LayoutTests/js/regress/script-tests/fold-multi-put-by-offset-to-replace-or-transition-put-by-offset.js</a></li>
<li><a href="#trunkLayoutTestsjsregressscripttestsfoldputbyidtomultiputbyoffsetjs">trunk/LayoutTests/js/regress/script-tests/fold-put-by-id-to-multi-put-by-offset.js</a></li>
<li><a href="#trunkLayoutTestsjsregressscripttestsfoldputstructurejs">trunk/LayoutTests/js/regress/script-tests/fold-put-structure.js</a></li>
<li><a href="#trunkLayoutTestsjsregressscripttestshoistpolycheckstructureeffectfulloopjs">trunk/LayoutTests/js/regress/script-tests/hoist-poly-check-structure-effectful-loop.js</a></li>
<li><a href="#trunkLayoutTestsjsregressscripttestshoistpolycheckstructurejs">trunk/LayoutTests/js/regress/script-tests/hoist-poly-check-structure.js</a></li>
<li><a href="#trunkLayoutTestsjsregressscripttestsputbyidreplaceandtransitionjs">trunk/LayoutTests/js/regress/script-tests/put-by-id-replace-and-transition.js</a></li>
<li><a href="#trunkLayoutTestsjsregressscripttestsputbyidslightlypolymorphicjs">trunk/LayoutTests/js/regress/script-tests/put-by-id-slightly-polymorphic.js</a></li>
<li><a href="#trunkSourceJavaScriptCorebytecodeToThisStatuscpp">trunk/Source/JavaScriptCore/bytecode/ToThisStatus.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCorebytecodeToThisStatush">trunk/Source/JavaScriptCore/bytecode/ToThisStatus.h</a></li>
<li><a href="#trunkSourceJavaScriptCorebytecodeTypeLocationh">trunk/Source/JavaScriptCore/bytecode/TypeLocation.h</a></li>
<li><a href="#trunkSourceJavaScriptCoredebuggerDebuggerScopecpp">trunk/Source/JavaScriptCore/debugger/DebuggerScope.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoredebuggerDebuggerScopeh">trunk/Source/JavaScriptCore/debugger/DebuggerScope.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeHighFidelityLogcpp">trunk/Source/JavaScriptCore/runtime/HighFidelityLog.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeHighFidelityLogh">trunk/Source/JavaScriptCore/runtime/HighFidelityLog.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeHighFidelityTypeProfilercpp">trunk/Source/JavaScriptCore/runtime/HighFidelityTypeProfiler.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeHighFidelityTypeProfilerh">trunk/Source/JavaScriptCore/runtime/HighFidelityTypeProfiler.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeTypeSetcpp">trunk/Source/JavaScriptCore/runtime/TypeSet.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeTypeSeth">trunk/Source/JavaScriptCore/runtime/TypeSet.h</a></li>
<li><a href="#trunkSourceJavaScriptCoretestsstressfoldmultigetbyoffsettogetbyoffsetwithoutfoldingthestructurecheckjs">trunk/Source/JavaScriptCore/tests/stress/fold-multi-get-by-offset-to-get-by-offset-without-folding-the-structure-check.js</a></li>
<li><a href="#trunkSourceJavaScriptCoretestsstressfoldmultiputbyoffsettoputbyoffsetwithoutfoldingthestructurecheckjs">trunk/Source/JavaScriptCore/tests/stress/fold-multi-put-by-offset-to-put-by-offset-without-folding-the-structure-check.js</a></li>
<li><a href="#trunkSourceJavaScriptCoretestsstressprunemultiputbyoffsetreplaceortransitionvariantjs">trunk/Source/JavaScriptCore/tests/stress/prune-multi-put-by-offset-replace-or-transition-variant.js</a></li>
</ul>
</div>
<div id="patch">
<h3>Diff</h3>
<a id="trunkLayoutTestsChangeLog"></a>
<div class="modfile"><h4>Modified: trunk/LayoutTests/ChangeLog (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/ChangeLog        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/LayoutTests/ChangeLog        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -1,121 +1,48 @@
</span><del>-2014-07-25 Filip Pizlo <fpizlo@apple.com>
</del><ins>+2014-07-26 Filip Pizlo <fpizlo@apple.com>
</ins><span class="cx">
</span><del>- Merge r170090, r170092, r170129, r170141, r170161, r170215, r170275, r170375, r170376, r170382, r170383, r170399, r170436, r170489, r170490, r170556 from ftlopt.
</del><ins>+ Unreviewed, roll out r171641-r171644. It broke some tests; will investigate and
+ reland later.
</ins><span class="cx">
</span><del>- 2014-07-25 Filip Pizlo <fpizlo@apple.com>
-
- [ftlopt] Fold GetById/PutById to MultiGetByOffset/GetByOffset or MultiPutByOffset/PutByOffset, which implies handling non-singleton sets
- https://bugs.webkit.org/show_bug.cgi?id=134090
-
- Reviewed by Oliver Hunt.
-
- * js/regress/fold-get-by-id-to-multi-get-by-offset-expected.txt: Added.
- * js/regress/fold-get-by-id-to-multi-get-by-offset-rare-int-expected.txt: Added.
- * js/regress/fold-get-by-id-to-multi-get-by-offset-rare-int.html: Added.
- * js/regress/fold-get-by-id-to-multi-get-by-offset.html: Added.
- * js/regress/fold-put-by-id-to-multi-put-by-offset-expected.txt: Added.
- * js/regress/fold-put-by-id-to-multi-put-by-offset.html: Added.
- * js/regress/script-tests/fold-get-by-id-to-multi-get-by-offset-rare-int.js: Added.
- (foo):
- (fu):
- (bar):
- (.bar):
- (Number):
- * js/regress/script-tests/fold-get-by-id-to-multi-get-by-offset.js: Added.
- (foo):
- (fu):
- (bar):
- (.bar):
- (Number):
- * js/regress/script-tests/fold-put-by-id-to-multi-put-by-offset.js: Added.
- (foo):
- (fu):
- (bar):
- (.bar):
-
- 2014-06-19 Filip Pizlo <fpizlo@apple.com>
-
- [ftlopt] LICM should be able to hoist CheckStructure even if the loop clobbers structures so long as the structures being checked are watchable
- https://bugs.webkit.org/show_bug.cgi?id=134056
-
- Unreviewed, just landing the test cases for this attempted optimization. The test cases
- will still be valid once we find a smart way of doing this optimization.
-
- * js/regress/hoist-poly-check-structure-effectful-loop-expected.txt: Added.
- * js/regress/hoist-poly-check-structure-effectful-loop.html: Added.
- * js/regress/hoist-poly-check-structure-expected.txt: Added.
- * js/regress/hoist-poly-check-structure.html: Added.
- * js/regress/script-tests/hoist-poly-check-structure-effectful-loop.js: Added.
- (foo):
- (test):
- * js/regress/script-tests/hoist-poly-check-structure.js: Added.
- (foo):
- (test):
-
- 2014-06-18 Filip Pizlo <fpizlo@apple.com>
-
- DFG AI and constant folder should be able to precisely prune MultiGetByOffset/MultiPutByOffset even if the base structure abstract value is not a singleton
- https://bugs.webkit.org/show_bug.cgi?id=133918
-
- Reviewed by Mark Hahnenberg.
-
- * js/regress/fold-multi-get-by-offset-to-get-by-offset-expected.txt: Added.
- * js/regress/fold-multi-get-by-offset-to-get-by-offset.html: Added.
- * js/regress/fold-multi-get-by-offset-to-poly-get-by-offset-expected.txt: Added.
- * js/regress/fold-multi-get-by-offset-to-poly-get-by-offset.html: Added.
- * js/regress/fold-multi-put-by-offset-to-poly-put-by-offset-expected.txt: Added.
- * js/regress/fold-multi-put-by-offset-to-poly-put-by-offset.html: Added.
- * js/regress/fold-multi-put-by-offset-to-put-by-offset-expected.txt: Added.
- * js/regress/fold-multi-put-by-offset-to-put-by-offset.html: Added.
- * js/regress/fold-multi-put-by-offset-to-replace-or-transition-put-by-offset-expected.txt: Added.
- * js/regress/fold-multi-put-by-offset-to-replace-or-transition-put-by-offset.html: Added.
- * js/regress/fold-put-structure-expected.txt: Added.
- * js/regress/fold-put-structure.html: Added.
- * js/regress/script-tests/fold-multi-get-by-offset-to-get-by-offset.js: Added.
- (foo):
- (fu):
- (bar):
- (.bar):
- * js/regress/script-tests/fold-multi-get-by-offset-to-poly-get-by-offset.js: Added.
- (foo):
- (fu):
- (bar):
- (.bar):
- * js/regress/script-tests/fold-multi-put-by-offset-to-poly-put-by-offset.js: Added.
- (foo):
- (fu):
- (bar):
- (.bar):
- * js/regress/script-tests/fold-multi-put-by-offset-to-put-by-offset.js: Added.
- (foo):
- (fu):
- (bar):
- (.bar):
- * js/regress/script-tests/fold-multi-put-by-offset-to-replace-or-transition-put-by-offset.js: Added.
- (foo):
- (fu):
- (bar):
- (.bar):
- * js/regress/script-tests/fold-put-structure.js: Added.
- (foo):
- (fu):
- (bar):
- (.bar):
-
- 2014-06-17 Filip Pizlo <fpizlo@apple.com>
-
- [ftlopt] DFG put_by_id should inline accesses with a slightly polymorphic base
- https://bugs.webkit.org/show_bug.cgi?id=133964
-
- Reviewed by Mark Hahnenberg.
-
- * js/regress/put-by-id-replace-and-transition-expected.txt: Added.
- * js/regress/put-by-id-replace-and-transition.html: Added.
- * js/regress/put-by-id-slightly-polymorphic-expected.txt: Added.
- * js/regress/put-by-id-slightly-polymorphic.html: Added.
- * js/regress/script-tests/put-by-id-replace-and-transition.js: Added.
- * js/regress/script-tests/put-by-id-slightly-polymorphic.js: Added.
-
</del><ins>+ * js/regress/fold-get-by-id-to-multi-get-by-offset-expected.txt: Removed.
+ * js/regress/fold-get-by-id-to-multi-get-by-offset-rare-int-expected.txt: Removed.
+ * js/regress/fold-get-by-id-to-multi-get-by-offset-rare-int.html: Removed.
+ * js/regress/fold-get-by-id-to-multi-get-by-offset.html: Removed.
+ * js/regress/fold-multi-get-by-offset-to-get-by-offset-expected.txt: Removed.
+ * js/regress/fold-multi-get-by-offset-to-get-by-offset.html: Removed.
+ * js/regress/fold-multi-get-by-offset-to-poly-get-by-offset-expected.txt: Removed.
+ * js/regress/fold-multi-get-by-offset-to-poly-get-by-offset.html: Removed.
+ * js/regress/fold-multi-put-by-offset-to-poly-put-by-offset-expected.txt: Removed.
+ * js/regress/fold-multi-put-by-offset-to-poly-put-by-offset.html: Removed.
+ * js/regress/fold-multi-put-by-offset-to-put-by-offset-expected.txt: Removed.
+ * js/regress/fold-multi-put-by-offset-to-put-by-offset.html: Removed.
+ * js/regress/fold-multi-put-by-offset-to-replace-or-transition-put-by-offset-expected.txt: Removed.
+ * js/regress/fold-multi-put-by-offset-to-replace-or-transition-put-by-offset.html: Removed.
+ * js/regress/fold-put-by-id-to-multi-put-by-offset-expected.txt: Removed.
+ * js/regress/fold-put-by-id-to-multi-put-by-offset.html: Removed.
+ * js/regress/fold-put-structure-expected.txt: Removed.
+ * js/regress/fold-put-structure.html: Removed.
+ * js/regress/hoist-poly-check-structure-effectful-loop-expected.txt: Removed.
+ * js/regress/hoist-poly-check-structure-effectful-loop.html: Removed.
+ * js/regress/hoist-poly-check-structure-expected.txt: Removed.
+ * js/regress/hoist-poly-check-structure.html: Removed.
+ * js/regress/put-by-id-replace-and-transition-expected.txt: Removed.
+ * js/regress/put-by-id-replace-and-transition.html: Removed.
+ * js/regress/put-by-id-slightly-polymorphic-expected.txt: Removed.
+ * js/regress/put-by-id-slightly-polymorphic.html: Removed.
+ * js/regress/script-tests/fold-get-by-id-to-multi-get-by-offset-rare-int.js: Removed.
+ * js/regress/script-tests/fold-get-by-id-to-multi-get-by-offset.js: Removed.
+ * js/regress/script-tests/fold-multi-get-by-offset-to-get-by-offset.js: Removed.
+ * js/regress/script-tests/fold-multi-get-by-offset-to-poly-get-by-offset.js: Removed.
+ * js/regress/script-tests/fold-multi-put-by-offset-to-poly-put-by-offset.js: Removed.
+ * js/regress/script-tests/fold-multi-put-by-offset-to-put-by-offset.js: Removed.
+ * js/regress/script-tests/fold-multi-put-by-offset-to-replace-or-transition-put-by-offset.js: Removed.
+ * js/regress/script-tests/fold-put-by-id-to-multi-put-by-offset.js: Removed.
+ * js/regress/script-tests/fold-put-structure.js: Removed.
+ * js/regress/script-tests/hoist-poly-check-structure-effectful-loop.js: Removed.
+ * js/regress/script-tests/hoist-poly-check-structure.js: Removed.
+ * js/regress/script-tests/put-by-id-replace-and-transition.js: Removed.
+ * js/regress/script-tests/put-by-id-slightly-polymorphic.js: Removed.
+
</ins><span class="cx"> 2014-07-25 Zalan Bujtas <zalan@apple.com>
</span><span class="cx">
</span><span class="cx"> Subpixel rendering: Rounded rect gets non-renderable at certain subpixel size.
</span></span></pre></div>
<a id="trunkLayoutTestsjsregressfoldgetbyidtomultigetbyoffsetexpectedtxt"></a>
<div class="delfile"><h4>Deleted: trunk/LayoutTests/js/regress/fold-get-by-id-to-multi-get-by-offset-expected.txt (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/regress/fold-get-by-id-to-multi-get-by-offset-expected.txt        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/LayoutTests/js/regress/fold-get-by-id-to-multi-get-by-offset-expected.txt        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -1,10 +0,0 @@
</span><del>-JSRegress/fold-get-by-id-to-multi-get-by-offset
-
-On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
-
-
-PASS no exception thrown
-PASS successfullyParsed is true
-
-TEST COMPLETE
-
</del></span></pre></div>
<a id="trunkLayoutTestsjsregressfoldgetbyidtomultigetbyoffsetrareintexpectedtxt"></a>
<div class="delfile"><h4>Deleted: trunk/LayoutTests/js/regress/fold-get-by-id-to-multi-get-by-offset-rare-int-expected.txt (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/regress/fold-get-by-id-to-multi-get-by-offset-rare-int-expected.txt        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/LayoutTests/js/regress/fold-get-by-id-to-multi-get-by-offset-rare-int-expected.txt        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -1,10 +0,0 @@
</span><del>-JSRegress/fold-get-by-id-to-multi-get-by-offset-rare-int
-
-On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
-
-
-PASS no exception thrown
-PASS successfullyParsed is true
-
-TEST COMPLETE
-
</del></span></pre></div>
<a id="trunkLayoutTestsjsregressfoldgetbyidtomultigetbyoffsetrareinthtml"></a>
<div class="delfile"><h4>Deleted: trunk/LayoutTests/js/regress/fold-get-by-id-to-multi-get-by-offset-rare-int.html (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/regress/fold-get-by-id-to-multi-get-by-offset-rare-int.html        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/LayoutTests/js/regress/fold-get-by-id-to-multi-get-by-offset-rare-int.html        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -1,12 +0,0 @@
</span><del>-<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
-<html>
-<head>
-<script src="../../resources/js-test-pre.js"></script>
-</head>
-<body>
-<script src="../../resources/regress-pre.js"></script>
-<script src="script-tests/fold-get-by-id-to-multi-get-by-offset-rare-int.js"></script>
-<script src="../../resources/regress-post.js"></script>
-<script src="../../resources/js-test-post.js"></script>
-</body>
-</html>
</del></span></pre></div>
<a id="trunkLayoutTestsjsregressfoldgetbyidtomultigetbyoffsethtml"></a>
<div class="delfile"><h4>Deleted: trunk/LayoutTests/js/regress/fold-get-by-id-to-multi-get-by-offset.html (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/regress/fold-get-by-id-to-multi-get-by-offset.html        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/LayoutTests/js/regress/fold-get-by-id-to-multi-get-by-offset.html        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -1,12 +0,0 @@
</span><del>-<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
-<html>
-<head>
-<script src="../../resources/js-test-pre.js"></script>
-</head>
-<body>
-<script src="../../resources/regress-pre.js"></script>
-<script src="script-tests/fold-get-by-id-to-multi-get-by-offset.js"></script>
-<script src="../../resources/regress-post.js"></script>
-<script src="../../resources/js-test-post.js"></script>
-</body>
-</html>
</del></span></pre></div>
<a id="trunkLayoutTestsjsregressfoldmultigetbyoffsettogetbyoffsetexpectedtxt"></a>
<div class="delfile"><h4>Deleted: trunk/LayoutTests/js/regress/fold-multi-get-by-offset-to-get-by-offset-expected.txt (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/regress/fold-multi-get-by-offset-to-get-by-offset-expected.txt        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/LayoutTests/js/regress/fold-multi-get-by-offset-to-get-by-offset-expected.txt        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -1,10 +0,0 @@
</span><del>-JSRegress/fold-multi-get-by-offset-to-get-by-offset
-
-On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
-
-
-PASS no exception thrown
-PASS successfullyParsed is true
-
-TEST COMPLETE
-
</del></span></pre></div>
<a id="trunkLayoutTestsjsregressfoldmultigetbyoffsettogetbyoffsethtml"></a>
<div class="delfile"><h4>Deleted: trunk/LayoutTests/js/regress/fold-multi-get-by-offset-to-get-by-offset.html (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/regress/fold-multi-get-by-offset-to-get-by-offset.html        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/LayoutTests/js/regress/fold-multi-get-by-offset-to-get-by-offset.html        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -1,12 +0,0 @@
</span><del>-<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
-<html>
-<head>
-<script src="../../resources/js-test-pre.js"></script>
-</head>
-<body>
-<script src="../../resources/regress-pre.js"></script>
-<script src="script-tests/fold-multi-get-by-offset-to-get-by-offset.js"></script>
-<script src="../../resources/regress-post.js"></script>
-<script src="../../resources/js-test-post.js"></script>
-</body>
-</html>
</del></span></pre></div>
<a id="trunkLayoutTestsjsregressfoldmultigetbyoffsettopolygetbyoffsetexpectedtxt"></a>
<div class="delfile"><h4>Deleted: trunk/LayoutTests/js/regress/fold-multi-get-by-offset-to-poly-get-by-offset-expected.txt (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/regress/fold-multi-get-by-offset-to-poly-get-by-offset-expected.txt        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/LayoutTests/js/regress/fold-multi-get-by-offset-to-poly-get-by-offset-expected.txt        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -1,10 +0,0 @@
</span><del>-JSRegress/fold-multi-get-by-offset-to-poly-get-by-offset
-
-On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
-
-
-PASS no exception thrown
-PASS successfullyParsed is true
-
-TEST COMPLETE
-
</del></span></pre></div>
<a id="trunkLayoutTestsjsregressfoldmultigetbyoffsettopolygetbyoffsethtml"></a>
<div class="delfile"><h4>Deleted: trunk/LayoutTests/js/regress/fold-multi-get-by-offset-to-poly-get-by-offset.html (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/regress/fold-multi-get-by-offset-to-poly-get-by-offset.html        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/LayoutTests/js/regress/fold-multi-get-by-offset-to-poly-get-by-offset.html        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -1,12 +0,0 @@
</span><del>-<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
-<html>
-<head>
-<script src="../../resources/js-test-pre.js"></script>
-</head>
-<body>
-<script src="../../resources/regress-pre.js"></script>
-<script src="script-tests/fold-multi-get-by-offset-to-poly-get-by-offset.js"></script>
-<script src="../../resources/regress-post.js"></script>
-<script src="../../resources/js-test-post.js"></script>
-</body>
-</html>
</del></span></pre></div>
<a id="trunkLayoutTestsjsregressfoldmultiputbyoffsettopolyputbyoffsetexpectedtxt"></a>
<div class="delfile"><h4>Deleted: trunk/LayoutTests/js/regress/fold-multi-put-by-offset-to-poly-put-by-offset-expected.txt (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/regress/fold-multi-put-by-offset-to-poly-put-by-offset-expected.txt        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/LayoutTests/js/regress/fold-multi-put-by-offset-to-poly-put-by-offset-expected.txt        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -1,10 +0,0 @@
</span><del>-JSRegress/fold-multi-put-by-offset-to-poly-put-by-offset
-
-On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
-
-
-PASS no exception thrown
-PASS successfullyParsed is true
-
-TEST COMPLETE
-
</del></span></pre></div>
<a id="trunkLayoutTestsjsregressfoldmultiputbyoffsettopolyputbyoffsethtml"></a>
<div class="delfile"><h4>Deleted: trunk/LayoutTests/js/regress/fold-multi-put-by-offset-to-poly-put-by-offset.html (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/regress/fold-multi-put-by-offset-to-poly-put-by-offset.html        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/LayoutTests/js/regress/fold-multi-put-by-offset-to-poly-put-by-offset.html        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -1,12 +0,0 @@
</span><del>-<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
-<html>
-<head>
-<script src="../../resources/js-test-pre.js"></script>
-</head>
-<body>
-<script src="../../resources/regress-pre.js"></script>
-<script src="script-tests/fold-multi-put-by-offset-to-poly-put-by-offset.js"></script>
-<script src="../../resources/regress-post.js"></script>
-<script src="../../resources/js-test-post.js"></script>
-</body>
-</html>
</del></span></pre></div>
<a id="trunkLayoutTestsjsregressfoldmultiputbyoffsettoputbyoffsetexpectedtxt"></a>
<div class="delfile"><h4>Deleted: trunk/LayoutTests/js/regress/fold-multi-put-by-offset-to-put-by-offset-expected.txt (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/regress/fold-multi-put-by-offset-to-put-by-offset-expected.txt        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/LayoutTests/js/regress/fold-multi-put-by-offset-to-put-by-offset-expected.txt        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -1,10 +0,0 @@
</span><del>-JSRegress/fold-multi-put-by-offset-to-put-by-offset
-
-On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
-
-
-PASS no exception thrown
-PASS successfullyParsed is true
-
-TEST COMPLETE
-
</del></span></pre></div>
<a id="trunkLayoutTestsjsregressfoldmultiputbyoffsettoputbyoffsethtml"></a>
<div class="delfile"><h4>Deleted: trunk/LayoutTests/js/regress/fold-multi-put-by-offset-to-put-by-offset.html (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/regress/fold-multi-put-by-offset-to-put-by-offset.html        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/LayoutTests/js/regress/fold-multi-put-by-offset-to-put-by-offset.html        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -1,12 +0,0 @@
</span><del>-<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
-<html>
-<head>
-<script src="../../resources/js-test-pre.js"></script>
-</head>
-<body>
-<script src="../../resources/regress-pre.js"></script>
-<script src="script-tests/fold-multi-put-by-offset-to-put-by-offset.js"></script>
-<script src="../../resources/regress-post.js"></script>
-<script src="../../resources/js-test-post.js"></script>
-</body>
-</html>
</del></span></pre></div>
<a id="trunkLayoutTestsjsregressfoldmultiputbyoffsettoreplaceortransitionputbyoffsetexpectedtxt"></a>
<div class="delfile"><h4>Deleted: trunk/LayoutTests/js/regress/fold-multi-put-by-offset-to-replace-or-transition-put-by-offset-expected.txt (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/regress/fold-multi-put-by-offset-to-replace-or-transition-put-by-offset-expected.txt        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/LayoutTests/js/regress/fold-multi-put-by-offset-to-replace-or-transition-put-by-offset-expected.txt        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -1,10 +0,0 @@
</span><del>-JSRegress/fold-multi-put-by-offset-to-replace-or-transition-put-by-offset
-
-On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
-
-
-PASS no exception thrown
-PASS successfullyParsed is true
-
-TEST COMPLETE
-
</del></span></pre></div>
<a id="trunkLayoutTestsjsregressfoldmultiputbyoffsettoreplaceortransitionputbyoffsethtml"></a>
<div class="delfile"><h4>Deleted: trunk/LayoutTests/js/regress/fold-multi-put-by-offset-to-replace-or-transition-put-by-offset.html (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/regress/fold-multi-put-by-offset-to-replace-or-transition-put-by-offset.html        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/LayoutTests/js/regress/fold-multi-put-by-offset-to-replace-or-transition-put-by-offset.html        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -1,12 +0,0 @@
</span><del>-<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
-<html>
-<head>
-<script src="../../resources/js-test-pre.js"></script>
-</head>
-<body>
-<script src="../../resources/regress-pre.js"></script>
-<script src="script-tests/fold-multi-put-by-offset-to-replace-or-transition-put-by-offset.js"></script>
-<script src="../../resources/regress-post.js"></script>
-<script src="../../resources/js-test-post.js"></script>
-</body>
-</html>
</del></span></pre></div>
<a id="trunkLayoutTestsjsregressfoldputbyidtomultiputbyoffsetexpectedtxt"></a>
<div class="delfile"><h4>Deleted: trunk/LayoutTests/js/regress/fold-put-by-id-to-multi-put-by-offset-expected.txt (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/regress/fold-put-by-id-to-multi-put-by-offset-expected.txt        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/LayoutTests/js/regress/fold-put-by-id-to-multi-put-by-offset-expected.txt        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -1,10 +0,0 @@
</span><del>-JSRegress/fold-put-by-id-to-multi-put-by-offset
-
-On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
-
-
-PASS no exception thrown
-PASS successfullyParsed is true
-
-TEST COMPLETE
-
</del></span></pre></div>
<a id="trunkLayoutTestsjsregressfoldputbyidtomultiputbyoffsethtml"></a>
<div class="delfile"><h4>Deleted: trunk/LayoutTests/js/regress/fold-put-by-id-to-multi-put-by-offset.html (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/regress/fold-put-by-id-to-multi-put-by-offset.html        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/LayoutTests/js/regress/fold-put-by-id-to-multi-put-by-offset.html        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -1,12 +0,0 @@
</span><del>-<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
-<html>
-<head>
-<script src="../../resources/js-test-pre.js"></script>
-</head>
-<body>
-<script src="../../resources/regress-pre.js"></script>
-<script src="script-tests/fold-put-by-id-to-multi-put-by-offset.js"></script>
-<script src="../../resources/regress-post.js"></script>
-<script src="../../resources/js-test-post.js"></script>
-</body>
-</html>
</del></span></pre></div>
<a id="trunkLayoutTestsjsregressfoldputstructureexpectedtxt"></a>
<div class="delfile"><h4>Deleted: trunk/LayoutTests/js/regress/fold-put-structure-expected.txt (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/regress/fold-put-structure-expected.txt        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/LayoutTests/js/regress/fold-put-structure-expected.txt        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -1,10 +0,0 @@
</span><del>-JSRegress/fold-put-structure
-
-On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
-
-
-PASS no exception thrown
-PASS successfullyParsed is true
-
-TEST COMPLETE
-
</del></span></pre></div>
<a id="trunkLayoutTestsjsregressfoldputstructurehtml"></a>
<div class="delfile"><h4>Deleted: trunk/LayoutTests/js/regress/fold-put-structure.html (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/regress/fold-put-structure.html        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/LayoutTests/js/regress/fold-put-structure.html        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -1,12 +0,0 @@
</span><del>-<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
-<html>
-<head>
-<script src="../../resources/js-test-pre.js"></script>
-</head>
-<body>
-<script src="../../resources/regress-pre.js"></script>
-<script src="script-tests/fold-put-structure.js"></script>
-<script src="../../resources/regress-post.js"></script>
-<script src="../../resources/js-test-post.js"></script>
-</body>
-</html>
</del></span></pre></div>
<a id="trunkLayoutTestsjsregresshoistpolycheckstructureeffectfulloopexpectedtxt"></a>
<div class="delfile"><h4>Deleted: trunk/LayoutTests/js/regress/hoist-poly-check-structure-effectful-loop-expected.txt (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/regress/hoist-poly-check-structure-effectful-loop-expected.txt        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/LayoutTests/js/regress/hoist-poly-check-structure-effectful-loop-expected.txt        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -1,10 +0,0 @@
</span><del>-JSRegress/hoist-poly-check-structure-effectful-loop
-
-On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
-
-
-PASS no exception thrown
-PASS successfullyParsed is true
-
-TEST COMPLETE
-
</del></span></pre></div>
<a id="trunkLayoutTestsjsregresshoistpolycheckstructureeffectfulloophtml"></a>
<div class="delfile"><h4>Deleted: trunk/LayoutTests/js/regress/hoist-poly-check-structure-effectful-loop.html (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/regress/hoist-poly-check-structure-effectful-loop.html        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/LayoutTests/js/regress/hoist-poly-check-structure-effectful-loop.html        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -1,12 +0,0 @@
</span><del>-<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
-<html>
-<head>
-<script src="../../resources/js-test-pre.js"></script>
-</head>
-<body>
-<script src="../../resources/regress-pre.js"></script>
-<script src="script-tests/hoist-poly-check-structure-effectful-loop.js"></script>
-<script src="../../resources/regress-post.js"></script>
-<script src="../../resources/js-test-post.js"></script>
-</body>
-</html>
</del></span></pre></div>
<a id="trunkLayoutTestsjsregresshoistpolycheckstructureexpectedtxt"></a>
<div class="delfile"><h4>Deleted: trunk/LayoutTests/js/regress/hoist-poly-check-structure-expected.txt (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/regress/hoist-poly-check-structure-expected.txt        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/LayoutTests/js/regress/hoist-poly-check-structure-expected.txt        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -1,10 +0,0 @@
</span><del>-JSRegress/hoist-poly-check-structure
-
-On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
-
-
-PASS no exception thrown
-PASS successfullyParsed is true
-
-TEST COMPLETE
-
</del></span></pre></div>
<a id="trunkLayoutTestsjsregresshoistpolycheckstructurehtml"></a>
<div class="delfile"><h4>Deleted: trunk/LayoutTests/js/regress/hoist-poly-check-structure.html (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/regress/hoist-poly-check-structure.html        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/LayoutTests/js/regress/hoist-poly-check-structure.html        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -1,12 +0,0 @@
</span><del>-<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
-<html>
-<head>
-<script src="../../resources/js-test-pre.js"></script>
-</head>
-<body>
-<script src="../../resources/regress-pre.js"></script>
-<script src="script-tests/hoist-poly-check-structure.js"></script>
-<script src="../../resources/regress-post.js"></script>
-<script src="../../resources/js-test-post.js"></script>
-</body>
-</html>
</del></span></pre></div>
<a id="trunkLayoutTestsjsregressputbyidreplaceandtransitionexpectedtxt"></a>
<div class="delfile"><h4>Deleted: trunk/LayoutTests/js/regress/put-by-id-replace-and-transition-expected.txt (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/regress/put-by-id-replace-and-transition-expected.txt        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/LayoutTests/js/regress/put-by-id-replace-and-transition-expected.txt        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -1,10 +0,0 @@
</span><del>-JSRegress/put-by-id-replace-and-transition
-
-On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
-
-
-PASS no exception thrown
-PASS successfullyParsed is true
-
-TEST COMPLETE
-
</del></span></pre></div>
<a id="trunkLayoutTestsjsregressputbyidreplaceandtransitionhtml"></a>
<div class="delfile"><h4>Deleted: trunk/LayoutTests/js/regress/put-by-id-replace-and-transition.html (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/regress/put-by-id-replace-and-transition.html        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/LayoutTests/js/regress/put-by-id-replace-and-transition.html        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -1,12 +0,0 @@
</span><del>-<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
-<html>
-<head>
-<script src="../../resources/js-test-pre.js"></script>
-</head>
-<body>
-<script src="../../resources/regress-pre.js"></script>
-<script src="script-tests/put-by-id-replace-and-transition.js"></script>
-<script src="../../resources/regress-post.js"></script>
-<script src="../../resources/js-test-post.js"></script>
-</body>
-</html>
</del></span></pre></div>
<a id="trunkLayoutTestsjsregressputbyidslightlypolymorphicexpectedtxt"></a>
<div class="delfile"><h4>Deleted: trunk/LayoutTests/js/regress/put-by-id-slightly-polymorphic-expected.txt (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/regress/put-by-id-slightly-polymorphic-expected.txt        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/LayoutTests/js/regress/put-by-id-slightly-polymorphic-expected.txt        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -1,10 +0,0 @@
</span><del>-JSRegress/put-by-id-slightly-polymorphic
-
-On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
-
-
-PASS no exception thrown
-PASS successfullyParsed is true
-
-TEST COMPLETE
-
</del></span></pre></div>
<a id="trunkLayoutTestsjsregressputbyidslightlypolymorphichtml"></a>
<div class="delfile"><h4>Deleted: trunk/LayoutTests/js/regress/put-by-id-slightly-polymorphic.html (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/regress/put-by-id-slightly-polymorphic.html        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/LayoutTests/js/regress/put-by-id-slightly-polymorphic.html        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -1,12 +0,0 @@
</span><del>-<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
-<html>
-<head>
-<script src="../../resources/js-test-pre.js"></script>
-</head>
-<body>
-<script src="../../resources/regress-pre.js"></script>
-<script src="script-tests/put-by-id-slightly-polymorphic.js"></script>
-<script src="../../resources/regress-post.js"></script>
-<script src="../../resources/js-test-post.js"></script>
-</body>
-</html>
</del></span></pre></div>
<a id="trunkLayoutTestsjsregressscripttestsfoldgetbyidtomultigetbyoffsetrareintjs"></a>
<div class="delfile"><h4>Deleted: trunk/LayoutTests/js/regress/script-tests/fold-get-by-id-to-multi-get-by-offset-rare-int.js (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/regress/script-tests/fold-get-by-id-to-multi-get-by-offset-rare-int.js        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/LayoutTests/js/regress/script-tests/fold-get-by-id-to-multi-get-by-offset-rare-int.js        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -1,47 +0,0 @@
</span><del>-function foo(o) {
- return o.f;
-}
-
-function fu(o) {
- return o.e;
-}
-
-function bar(f, o) {
- return f(o);
-}
-
-for (var i = 0; i < 1000; ++i) {
- var o = {f:1};
- o["i" + i] = 42;
- foo(o);
- fu({f:1, e:2});
- fu({e:1, f:2});
-}
-
-for (var i = 0; i < 100; ++i) {
- bar(foo, {f:1});
- bar(function() { }, null);
- bar(function() { return 42 }, null);
-}
-
-Number.prototype.f = 100;
-
-(function(f, o, p) {
- var result = 0;
- var n = 1000000;
- for (var i = 0; i < n + 1; ++i) {
- result += fu(o);
- var q;
- if (i == n)
- q = 42;
- else
- q = o;
- result += bar(f, q);
- var tmp = o;
- o = p;
- p = tmp;
- }
- if (result != (o.f + o.e + p.f + p.e) * n / 2 + 100 + p.e)
- throw "Error: bad result: " + result;
-})(foo, {f:42, e:43}, {e:44, f:45});
-
</del></span></pre></div>
<a id="trunkLayoutTestsjsregressscripttestsfoldgetbyidtomultigetbyoffsetjs"></a>
<div class="delfile"><h4>Deleted: trunk/LayoutTests/js/regress/script-tests/fold-get-by-id-to-multi-get-by-offset.js (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/regress/script-tests/fold-get-by-id-to-multi-get-by-offset.js        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/LayoutTests/js/regress/script-tests/fold-get-by-id-to-multi-get-by-offset.js        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -1,42 +0,0 @@
</span><del>-function foo(o) {
- return o.f;
-}
-
-function fu(o) {
- return o.e;
-}
-
-function bar(f, o) {
- return f(o);
-}
-
-for (var i = 0; i < 1000; ++i) {
- var o = {f:1};
- o["i" + i] = 42;
- foo(o);
- fu({f:1, e:2});
- fu({e:1, f:2});
-}
-
-for (var i = 0; i < 100; ++i) {
- bar(foo, {f:1});
- bar(function() { }, null);
- bar(function() { return 42 }, null);
-}
-
-Number.prototype.f = 100;
-
-(function(f, o, p) {
- var result = 0;
- var n = 1000000;
- for (var i = 0; i < n; ++i) {
- result += fu(o);
- result += bar(f, o);
- var tmp = o;
- o = p;
- p = tmp;
- }
- if (result != (o.f + o.e + p.f + p.e) * n / 2)
- throw "Error: bad result: " + result;
-})(foo, {f:42, e:43}, {e:44, f:45});
-
</del></span></pre></div>
<a id="trunkLayoutTestsjsregressscripttestsfoldmultigetbyoffsettogetbyoffsetjs"></a>
<div class="delfile"><h4>Deleted: trunk/LayoutTests/js/regress/script-tests/fold-multi-get-by-offset-to-get-by-offset.js (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/regress/script-tests/fold-multi-get-by-offset-to-get-by-offset.js        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/LayoutTests/js/regress/script-tests/fold-multi-get-by-offset-to-get-by-offset.js        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -1,43 +0,0 @@
</span><del>-function foo(o) {
- return o.f;
-}
-
-function fu(o) {
- return o.e;
-}
-
-function bar(f, o) {
- return f(o);
-}
-
-for (var i = 0; i < 100; ++i) {
- foo({f:1, e:2});
- foo({e:1, f:2});
- foo({d:1, e:2, f:3});
- fu({f:1, e:2});
- fu({e:1, f:2});
- fu({d:1, e:2, f:3});
-}
-
-for (var i = 0; i < 100; ++i) {
- bar(foo, {f:1});
- bar(function() { }, null);
- bar(function() { return 42 }, null);
-}
-
-(function(f, o) {
- var result = 0;
- var n = 1000000;
- for (var i = 0; i < n; ++i) {
- var p;
- if (i == n - 1) // Defeat LICM.
- p = {f: 42, e: 42};
- else
- p = o;
- result += fu(p);
- result += bar(f, p);
- }
- if (result != (n - 1) * (o.f + o.e) + 42 * 2)
- throw "Error: bad result: " + result;
-})(foo, {f:42, e:2});
-
</del></span></pre></div>
<a id="trunkLayoutTestsjsregressscripttestsfoldmultigetbyoffsettopolygetbyoffsetjs"></a>
<div class="delfile"><h4>Deleted: trunk/LayoutTests/js/regress/script-tests/fold-multi-get-by-offset-to-poly-get-by-offset.js (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/regress/script-tests/fold-multi-get-by-offset-to-poly-get-by-offset.js        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/LayoutTests/js/regress/script-tests/fold-multi-get-by-offset-to-poly-get-by-offset.js        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -1,41 +0,0 @@
</span><del>-function foo(o) {
- return o.f;
-}
-
-function fu(o) {
- return o.e;
-}
-
-function bar(f, o) {
- return f(o);
-}
-
-for (var i = 0; i < 100; ++i) {
- foo({f:1, e:2});
- foo({e:1, f:2});
- foo({d:1, e:2, f:3});
- fu({f:1, e:2});
- fu({e:1, f:2});
- fu({d:1, e:2, f:3});
-}
-
-for (var i = 0; i < 100; ++i) {
- bar(foo, {f:1});
- bar(function() { }, null);
- bar(function() { return 42 }, null);
-}
-
-(function(f, o, p) {
- var result = 0;
- var n = 1000000;
- for (var i = 0; i < n; ++i) {
- result += fu(o);
- result += bar(f, o);
- var tmp = o;
- o = p;
- p = tmp;
- }
- if (result != n * o.f + n * o.e)
- throw "Error: bad result: " + result;
-})(foo, {f:42, e:23}, {f:42, e:23, g:100});
-
</del></span></pre></div>
<a id="trunkLayoutTestsjsregressscripttestsfoldmultiputbyoffsettopolyputbyoffsetjs"></a>
<div class="delfile"><h4>Deleted: trunk/LayoutTests/js/regress/script-tests/fold-multi-put-by-offset-to-poly-put-by-offset.js (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/regress/script-tests/fold-multi-put-by-offset-to-poly-put-by-offset.js        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/LayoutTests/js/regress/script-tests/fold-multi-put-by-offset-to-poly-put-by-offset.js        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -1,47 +0,0 @@
</span><del>-function foo(o) {
- o.f = 1;
-}
-
-function fu(o) {
- o.e = 2;
-}
-
-function bar(f, o) {
- f(o);
-}
-
-for (var i = 0; i < 100; ++i) {
- foo({f:1, e:2});
- foo({e:1, f:2});
- foo({d:1, e:2, f:3});
- fu({f:1, e:2});
- fu({e:1, f:2});
- fu({d:1, e:2, f:3});
-}
-
-for (var i = 0; i < 100; ++i) {
- bar(foo, {f:1});
- bar(function() { }, null);
- bar(function() { return 42 }, null);
-}
-
-(function(f, o, p) {
- var result = 0;
- var n = 1000000;
- for (var i = 0; i < n; ++i) {
- fu(o);
- bar(f, o);
- var tmp = o;
- o = p;
- p = tmp;
- }
- if (o.e != 2)
- throw "Error: bad value in o.e: " + o.e;
- if (o.f != 1)
- throw "Error: bad value in o.f: " + o.f;
- if (p.e != 2)
- throw "Error: bad value in p.e: " + p.e;
- if (p.f != 1)
- throw "Error: bad value in p.f: " + p.f;
-})(foo, {f:42, e:23}, {f:42, e:23, g:100});
-
</del></span></pre></div>
<a id="trunkLayoutTestsjsregressscripttestsfoldmultiputbyoffsettoputbyoffsetjs"></a>
<div class="delfile"><h4>Deleted: trunk/LayoutTests/js/regress/script-tests/fold-multi-put-by-offset-to-put-by-offset.js (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/regress/script-tests/fold-multi-put-by-offset-to-put-by-offset.js        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/LayoutTests/js/regress/script-tests/fold-multi-put-by-offset-to-put-by-offset.js        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -1,40 +0,0 @@
</span><del>-function foo(o) {
- o.f = 1;
-}
-
-function fu(o) {
- o.e = 2;
-}
-
-function bar(f, o) {
- f(o);
-}
-
-for (var i = 0; i < 100; ++i) {
- foo({f:1, e:2});
- foo({e:1, f:2});
- foo({d:1, e:2, f:3});
- fu({f:1, e:2});
- fu({e:1, f:2});
- fu({d:1, e:2, f:3});
-}
-
-for (var i = 0; i < 100; ++i) {
- bar(foo, {f:1});
- bar(function() { }, null);
- bar(function() { return 42 }, null);
-}
-
-(function(f, o) {
- var result = 0;
- var n = 1000000;
- for (var i = 0; i < n; ++i) {
- fu(o);
- bar(f, o);
- }
- if (o.e != 2)
- throw "Error: bad value in o.e: " + o.e;
- if (o.f != 1)
- throw "Error: bad value in o.f: " + o.f;
-})(foo, {f:42, e:23});
-
</del></span></pre></div>
<a id="trunkLayoutTestsjsregressscripttestsfoldmultiputbyoffsettoreplaceortransitionputbyoffsetjs"></a>
<div class="delfile"><h4>Deleted: trunk/LayoutTests/js/regress/script-tests/fold-multi-put-by-offset-to-replace-or-transition-put-by-offset.js (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/regress/script-tests/fold-multi-put-by-offset-to-replace-or-transition-put-by-offset.js        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/LayoutTests/js/regress/script-tests/fold-multi-put-by-offset-to-replace-or-transition-put-by-offset.js        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -1,50 +0,0 @@
</span><del>-function foo(o) {
- o.f = 1;
-}
-
-function fu(o) {
- o.e = 2;
-}
-
-function bar(f, o) {
- f(o);
-}
-
-for (var i = 0; i < 100; ++i) {
- foo({f:1, e:2});
- foo({e:1, f:2});
- foo({d:1, e:2, f:3});
- fu({f:1, e:2});
- fu({e:1, f:2});
- fu({d:1, e:2, f:3});
-}
-
-for (var i = 0; i < 100; ++i) {
- bar(foo, {f:1});
- bar(function() { }, null);
- bar(function() { return 42 }, null);
-}
-
-(function(f, o) {
- var result = 0;
- var n = 1000000;
- var p;
- for (var i = 0; i < n; ++i) {
- var q;
- if (i & 1)
- q = o;
- else
- p = q = {e:61};
- fu(q);
- bar(f, q);
- }
- if (o.e != 2)
- throw "Error: bad value in o.e: " + o.e;
- if (o.f != 1)
- throw "Error: bad value in o.f: " + o.f;
- if (p.e != 2)
- throw "Error: bad value in p.e: " + p.e;
- if (p.f != 1)
- throw "Error: bad value in p.f: " + p.f;
-})(foo, {e:23, f:42});
-
</del></span></pre></div>
<a id="trunkLayoutTestsjsregressscripttestsfoldputbyidtomultiputbyoffsetjs"></a>
<div class="delfile"><h4>Deleted: trunk/LayoutTests/js/regress/script-tests/fold-put-by-id-to-multi-put-by-offset.js (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/regress/script-tests/fold-put-by-id-to-multi-put-by-offset.js        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/LayoutTests/js/regress/script-tests/fold-put-by-id-to-multi-put-by-offset.js        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -1,46 +0,0 @@
</span><del>-function foo(o) {
- o.f = 1;
-}
-
-function fu(o) {
- o.e = 2;
-}
-
-function bar(f, o) {
- f(o);
-}
-
-for (var i = 0; i < 1000; ++i) {
- var o = {};
- o["i" + i] = 42;
- foo(o);
- fu({f:1, e:2});
- fu({e:1, f:2, g:3});
-}
-
-for (var i = 0; i < 100; ++i) {
- bar(foo, {f:1});
- bar(function() { }, null);
- bar(function() { return 42 }, null);
-}
-
-(function(f, o, p) {
- var result = 0;
- var n = 1000000;
- for (var i = 0; i < n; ++i) {
- fu(o);
- bar(f, o);
- var tmp = o;
- o = p;
- p = tmp;
- }
- if (o.e != 2)
- throw "Error: bad value in o.e: " + o.e;
- if (o.f != 1)
- throw "Error: bad value in o.f: " + o.f;
- if (p.e != 2)
- throw "Error: bad value in p.e: " + p.e;
- if (p.f != 1)
- throw "Error: bad value in p.f: " + p.f;
-})(foo, {f:42, e:23}, {e:23, f:42, g:100});
-
</del></span></pre></div>
<a id="trunkLayoutTestsjsregressscripttestsfoldputstructurejs"></a>
<div class="delfile"><h4>Deleted: trunk/LayoutTests/js/regress/script-tests/fold-put-structure.js (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/regress/script-tests/fold-put-structure.js        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/LayoutTests/js/regress/script-tests/fold-put-structure.js        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -1,39 +0,0 @@
</span><del>-function foo(o) {
- o.f = 1;
-}
-
-function fu(o) {
- o.e = 2;
-}
-
-function bar(f, o) {
- f(o);
-}
-
-for (var i = 0; i < 100; ++i) {
- foo({e:2});
- foo({e:1, f:2});
- fu({f:1, e:2});
- fu({e:1, f:2});
- fu({d:1, e:2, f:3});
-}
-
-for (var i = 0; i < 100; ++i) {
- bar(foo, {e:1});
- bar(function() { }, null);
- bar(function() { return 42 }, null);
-}
-
-(function(f, o) {
- var result = 0;
- var n = 1000000;
- for (var i = 0; i < n; ++i) {
- fu(o);
- bar(f, o);
- }
- if (o.e != 2)
- throw "Error: bad value in o.e: " + o.e;
- if (o.f != 1)
- throw "Error: bad value in o.f: " + o.f;
-})(foo, {e:42, f:23});
-
</del></span></pre></div>
<a id="trunkLayoutTestsjsregressscripttestshoistpolycheckstructureeffectfulloopjs"></a>
<div class="delfile"><h4>Deleted: trunk/LayoutTests/js/regress/script-tests/hoist-poly-check-structure-effectful-loop.js (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/regress/script-tests/hoist-poly-check-structure-effectful-loop.js        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/LayoutTests/js/regress/script-tests/hoist-poly-check-structure-effectful-loop.js        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -1,27 +0,0 @@
</span><del>-function foo(o, p) {
- var result = 0;
- for (var i = 0; i < 100; ++i) {
- result += o.f;
- p.g = 42;
- }
- return result;
-}
-
-noInline(foo);
-
-function test(o) {
- if (foo(o, {}) != 100)
- throw new Error("Error: bad result: " + result);
-}
-
-for (var i = 0; i < 100; ++i) {
- test({f:1, g:2});
- test({f:1, h:2});
- test({f:1, i:2});
- test({f:1, j:2});
- test({f:1, k:2});
- test({f:1, l:2});
-}
-
-for (var i = 0; i < 10000; ++i)
- test({f:1, g:2});
</del></span></pre></div>
<a id="trunkLayoutTestsjsregressscripttestshoistpolycheckstructurejs"></a>
<div class="delfile"><h4>Deleted: trunk/LayoutTests/js/regress/script-tests/hoist-poly-check-structure.js (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/regress/script-tests/hoist-poly-check-structure.js        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/LayoutTests/js/regress/script-tests/hoist-poly-check-structure.js        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -1,25 +0,0 @@
</span><del>-function foo(o) {
- var result = 0;
- for (var i = 0; i < 100; ++i)
- result += o.f;
- return result;
-}
-
-noInline(foo);
-
-function test(o) {
- if (foo(o) != 100)
- throw new Error("Error: bad result: " + result);
-}
-
-for (var i = 0; i < 100; ++i) {
- test({f:1});
- test({f:1, g:2});
- test({f:1, g:2, h:3});
- test({f:1, g:2, h:3, i:4});
- test({f:1, g:2, h:3, i:4, j:5});
- test({f:1, g:2, h:3, i:4, j:5, k:6});
-}
-
-for (var i = 0; i < 10000; ++i)
- test({f:1});
</del></span></pre></div>
<a id="trunkLayoutTestsjsregressscripttestsputbyidreplaceandtransitionjs"></a>
<div class="delfile"><h4>Deleted: trunk/LayoutTests/js/regress/script-tests/put-by-id-replace-and-transition.js (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/regress/script-tests/put-by-id-replace-and-transition.js        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/LayoutTests/js/regress/script-tests/put-by-id-replace-and-transition.js        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -1,13 +0,0 @@
</span><del>-(function() {
- var o;
- var n = 1000000;
- for (var i = 0; i < n; ++i) {
- if (i & 1)
- o = {f: 1};
- else
- o = {f: 1, g: 2};
- o.g = i;
- }
- if (o.g != n - 1)
- throw "Error: bad value of o.g: " + o.g;
-})();
</del></span></pre></div>
<a id="trunkLayoutTestsjsregressscripttestsputbyidslightlypolymorphicjs"></a>
<div class="delfile"><h4>Deleted: trunk/LayoutTests/js/regress/script-tests/put-by-id-slightly-polymorphic.js (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/regress/script-tests/put-by-id-slightly-polymorphic.js        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/LayoutTests/js/regress/script-tests/put-by-id-slightly-polymorphic.js        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -1,15 +0,0 @@
</span><del>-(function() {
- var o = {f: 1, g: 2};
- var p = {f: 1};
- var n = 1000000;
- for (var i = 0; i < n; ++i) {
- o.f = i;
- var tmp = o;
- o = p;
- p = tmp;
- }
- if (o.f != n - 2)
- throw "Error: bad value of o.f: " + o.f;
- if (p.f != n - 1)
- throw "Error: vad value of p.f: " + p.f;
-})();
</del></span></pre></div>
<a id="trunkSourceJavaScriptCoreCMakeListstxt"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/CMakeLists.txt (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/CMakeLists.txt        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/Source/JavaScriptCore/CMakeLists.txt        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -94,7 +94,6 @@
</span><span class="cx"> bytecode/StructureSet.cpp
</span><span class="cx"> bytecode/StructureStubClearingWatchpoint.cpp
</span><span class="cx"> bytecode/StructureStubInfo.cpp
</span><del>- bytecode/ToThisStatus.cpp
</del><span class="cx"> bytecode/UnlinkedCodeBlock.cpp
</span><span class="cx"> bytecode/UnlinkedInstructionStream.cpp
</span><span class="cx"> bytecode/ValueRecovery.cpp
</span><span class="lines">@@ -104,8 +103,8 @@
</span><span class="cx"> bytecompiler/NodesCodegen.cpp
</span><span class="cx">
</span><span class="cx"> debugger/Debugger.cpp
</span><ins>+ debugger/DebuggerActivation.cpp
</ins><span class="cx"> debugger/DebuggerCallFrame.cpp
</span><del>- debugger/DebuggerScope.cpp
</del><span class="cx">
</span><span class="cx"> dfg/DFGAbstractHeap.cpp
</span><span class="cx"> dfg/DFGAbstractValue.cpp
</span><span class="lines">@@ -396,8 +395,6 @@
</span><span class="cx"> runtime/FunctionExecutableDump.cpp
</span><span class="cx"> runtime/FunctionPrototype.cpp
</span><span class="cx"> runtime/GetterSetter.cpp
</span><del>- runtime/HighFidelityLog.cpp
- runtime/HighFidelityTypeProfiler.cpp
</del><span class="cx"> runtime/Identifier.cpp
</span><span class="cx"> runtime/IndexingType.cpp
</span><span class="cx"> runtime/InitializeThreading.cpp
</span><span class="lines">@@ -503,7 +500,6 @@
</span><span class="cx"> runtime/StructureRareData.cpp
</span><span class="cx"> runtime/SymbolTable.cpp
</span><span class="cx"> runtime/TestRunnerUtils.cpp
</span><del>- runtime/TypeSet.cpp
</del><span class="cx"> runtime/TypedArrayController.cpp
</span><span class="cx"> runtime/TypedArrayType.cpp
</span><span class="cx"> runtime/VM.cpp
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreChangeLog"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/ChangeLog (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/ChangeLog        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/Source/JavaScriptCore/ChangeLog        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -1,3 +1,311 @@
</span><ins>+2014-07-26 Filip Pizlo <fpizlo@apple.com>
+
+ Unreviewed, roll out r171641-r171644. It broke some tests; will investigate and
+ reland later.
+
+ * CMakeLists.txt:
+ * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+ * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
+ * JavaScriptCore.xcodeproj/project.pbxproj:
+ * bytecode/BytecodeList.json:
+ * bytecode/BytecodeUseDef.h:
+ (JSC::computeUsesForBytecodeOffset):
+ (JSC::computeDefsForBytecodeOffset):
+ * bytecode/CodeBlock.cpp:
+ (JSC::CodeBlock::dumpBytecode):
+ (JSC::CodeBlock::CodeBlock):
+ (JSC::CodeBlock::finalizeUnconditionally):
+ (JSC::CodeBlock::printPutByIdCacheStatus): Deleted.
+ * bytecode/CodeBlock.h:
+ * bytecode/GetByIdStatus.cpp:
+ (JSC::GetByIdStatus::computeForStubInfo):
+ (JSC::GetByIdStatus::computeFor):
+ * bytecode/GetByIdStatus.h:
+ * bytecode/GetByIdVariant.cpp:
+ (JSC::GetByIdVariant::dumpInContext):
+ * bytecode/GetByIdVariant.h:
+ (JSC::GetByIdVariant::structureSet):
+ * bytecode/Instruction.h:
+ * bytecode/PutByIdStatus.cpp:
+ (JSC::PutByIdStatus::appendVariant):
+ (JSC::PutByIdStatus::computeForStubInfo):
+ (JSC::PutByIdStatus::computeFor):
+ * bytecode/PutByIdStatus.h:
+ * bytecode/PutByIdVariant.cpp:
+ (JSC::PutByIdVariant::dumpInContext):
+ (JSC::PutByIdVariant::oldStructureForTransition): Deleted.
+ (JSC::PutByIdVariant::writesStructures): Deleted.
+ (JSC::PutByIdVariant::reallocatesStorage): Deleted.
+ (JSC::PutByIdVariant::attemptToMerge): Deleted.
+ (JSC::PutByIdVariant::attemptToMergeTransitionWithReplace): Deleted.
+ * bytecode/PutByIdVariant.h:
+ (JSC::PutByIdVariant::PutByIdVariant):
+ (JSC::PutByIdVariant::replace):
+ (JSC::PutByIdVariant::transition):
+ (JSC::PutByIdVariant::structure):
+ (JSC::PutByIdVariant::oldStructure):
+ (JSC::PutByIdVariant::newStructure):
+ (JSC::PutByIdVariant::constantChecks):
+ * bytecode/StructureSet.cpp:
+ (JSC::StructureSet::filter): Deleted.
+ (JSC::StructureSet::filterArrayModes): Deleted.
+ * bytecode/StructureSet.h:
+ (JSC::StructureSet::onlyStructure):
+ * bytecode/ToThisStatus.cpp: Removed.
+ * bytecode/ToThisStatus.h: Removed.
+ * bytecode/TypeLocation.h: Removed.
+ * bytecompiler/BytecodeGenerator.cpp:
+ (JSC::BytecodeGenerator::BytecodeGenerator):
+ (JSC::BytecodeGenerator::emitMove):
+ (JSC::BytecodeGenerator::emitPutToScope):
+ (JSC::BytecodeGenerator::emitPutById):
+ (JSC::BytecodeGenerator::emitPutByVal):
+ (JSC::BytecodeGenerator::emitProfileTypesWithHighFidelity): Deleted.
+ * bytecompiler/BytecodeGenerator.h:
+ (JSC::BytecodeGenerator::isProfilingTypesWithHighFidelity): Deleted.
+ * bytecompiler/NodesCodegen.cpp:
+ (JSC::PostfixNode::emitResolve):
+ (JSC::PrefixNode::emitResolve):
+ (JSC::ReadModifyResolveNode::emitBytecode):
+ (JSC::AssignResolveNode::emitBytecode):
+ (JSC::ConstDeclNode::emitCodeSingle):
+ (JSC::ForInNode::emitBytecode):
+ * debugger/DebuggerActivation.cpp: Added.
+ (JSC::DebuggerActivation::DebuggerActivation):
+ (JSC::DebuggerActivation::finishCreation):
+ (JSC::DebuggerActivation::visitChildren):
+ (JSC::DebuggerActivation::className):
+ (JSC::DebuggerActivation::getOwnPropertySlot):
+ (JSC::DebuggerActivation::put):
+ (JSC::DebuggerActivation::deleteProperty):
+ (JSC::DebuggerActivation::getOwnPropertyNames):
+ (JSC::DebuggerActivation::defineOwnProperty):
+ * debugger/DebuggerActivation.h: Added.
+ (JSC::DebuggerActivation::create):
+ (JSC::DebuggerActivation::createStructure):
+ * debugger/DebuggerScope.cpp: Removed.
+ * debugger/DebuggerScope.h: Removed.
+ * dfg/DFGAbstractInterpreterInlines.h:
+ (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+ (JSC::DFG::AbstractInterpreter<AbstractStateType>::observeTransition):
+ (JSC::DFG::AbstractInterpreter<AbstractStateType>::observeTransitions):
+ * dfg/DFGAbstractValue.cpp:
+ (JSC::DFG::AbstractValue::changeStructure): Deleted.
+ (JSC::DFG::AbstractValue::contains): Deleted.
+ * dfg/DFGAbstractValue.h:
+ (JSC::DFG::AbstractValue::couldBeType):
+ (JSC::DFG::AbstractValue::isType):
+ * dfg/DFGByteCodeParser.cpp:
+ (JSC::DFG::ByteCodeParser::handlePutById):
+ (JSC::DFG::ByteCodeParser::parseBlock):
+ * dfg/DFGClobberize.h:
+ (JSC::DFG::clobberize):
+ * dfg/DFGConstantFoldingPhase.cpp:
+ (JSC::DFG::ConstantFoldingPhase::foldConstants):
+ (JSC::DFG::ConstantFoldingPhase::emitGetByOffset):
+ (JSC::DFG::ConstantFoldingPhase::emitPutByOffset):
+ (JSC::DFG::ConstantFoldingPhase::addBaseCheck): Deleted.
+ (JSC::DFG::ConstantFoldingPhase::addChecks): Deleted.
+ * dfg/DFGDoesGC.cpp:
+ (JSC::DFG::doesGC):
+ * dfg/DFGFixupPhase.cpp:
+ (JSC::DFG::FixupPhase::fixupNode):
+ * dfg/DFGGraph.cpp:
+ (JSC::DFG::Graph::visitChildren):
+ (JSC::DFG::Graph::freezeStrong):
+ * dfg/DFGGraph.h:
+ * dfg/DFGNode.cpp:
+ (JSC::DFG::MultiPutByOffsetData::writesStructures):
+ (JSC::DFG::MultiPutByOffsetData::reallocatesStorage):
+ * dfg/DFGNode.h:
+ (JSC::DFG::Node::convertToPutByOffset):
+ (JSC::DFG::Node::hasTransition):
+ (JSC::DFG::Node::convertToMultiGetByOffset): Deleted.
+ (JSC::DFG::Node::convertToMultiPutByOffset): Deleted.
+ * dfg/DFGNodeType.h:
+ * dfg/DFGPredictionPropagationPhase.cpp:
+ (JSC::DFG::PredictionPropagationPhase::propagate):
+ * dfg/DFGSafeToExecute.h:
+ (JSC::DFG::safeToExecute):
+ * dfg/DFGSpeculativeJIT.cpp:
+ (JSC::DFG::SpeculativeJIT::silentSavePlanForGPR):
+ * dfg/DFGSpeculativeJIT32_64.cpp:
+ (JSC::DFG::SpeculativeJIT::fillSpeculateCell):
+ (JSC::DFG::SpeculativeJIT::compile):
+ * dfg/DFGSpeculativeJIT64.cpp:
+ (JSC::DFG::SpeculativeJIT::fillJSValue):
+ (JSC::DFG::SpeculativeJIT::nonSpeculativeCompareNull):
+ (JSC::DFG::SpeculativeJIT::emitCall):
+ (JSC::DFG::SpeculativeJIT::fillSpeculateInt32Internal):
+ (JSC::DFG::SpeculativeJIT::fillSpeculateInt32Strict):
+ (JSC::DFG::SpeculativeJIT::fillSpeculateInt52):
+ (JSC::DFG::SpeculativeJIT::fillSpeculateDouble):
+ (JSC::DFG::SpeculativeJIT::fillSpeculateCell):
+ (JSC::DFG::SpeculativeJIT::fillSpeculateBoolean):
+ (JSC::DFG::SpeculativeJIT::compileLogicalNot):
+ (JSC::DFG::SpeculativeJIT::emitBranch):
+ (JSC::DFG::SpeculativeJIT::compile):
+ * dfg/DFGStructureAbstractValue.cpp:
+ (JSC::DFG::StructureAbstractValue::observeTransition):
+ (JSC::DFG::StructureAbstractValue::observeTransitions):
+ * dfg/DFGStructureAbstractValue.h:
+ (JSC::DFG::StructureAbstractValue::onlyStructure):
+ (JSC::DFG::StructureAbstractValue::operator=): Deleted.
+ (JSC::DFG::StructureAbstractValue::set): Deleted.
+ * dfg/DFGValidate.cpp:
+ (JSC::DFG::Validate::validate):
+ * dfg/DFGWatchableStructureWatchingPhase.cpp:
+ (JSC::DFG::WatchableStructureWatchingPhase::run):
+ * ftl/FTLAbbreviations.h:
+ (JSC::FTL::getLinkage): Deleted.
+ * ftl/FTLCapabilities.cpp:
+ (JSC::FTL::canCompile):
+ * ftl/FTLLowerDFGToLLVM.cpp:
+ (JSC::FTL::LowerDFGToLLVM::compileNode):
+ (JSC::FTL::LowerDFGToLLVM::compilePhantomPutStructure):
+ (JSC::FTL::LowerDFGToLLVM::compileMultiGetByOffset):
+ (JSC::FTL::LowerDFGToLLVM::compileMultiPutByOffset):
+ (JSC::FTL::LowerDFGToLLVM::getModuleByPathForSymbol):
+ * heap/Heap.cpp:
+ (JSC::Heap::collect):
+ * inspector/agents/InspectorRuntimeAgent.cpp:
+ (Inspector::InspectorRuntimeAgent::getRuntimeTypeForVariableInTextRange): Deleted.
+ * inspector/agents/InspectorRuntimeAgent.h:
+ * inspector/protocol/Runtime.json:
+ * jsc.cpp:
+ (GlobalObject::finishCreation):
+ (functionDumpTypesForAllVariables): Deleted.
+ * llint/LLIntData.cpp:
+ (JSC::LLInt::Data::performAssertions):
+ * llint/LLIntSlowPaths.cpp:
+ (JSC::LLInt::LLINT_SLOW_PATH_DECL):
+ (JSC::LLInt::putToScopeCommon): Deleted.
+ * llint/LLIntSlowPaths.h:
+ * llint/LowLevelInterpreter.asm:
+ * llint/LowLevelInterpreter32_64.asm:
+ * llint/LowLevelInterpreter64.asm:
+ * runtime/ArrayBufferNeuteringWatchpoint.cpp:
+ (JSC::ArrayBufferNeuteringWatchpoint::createStructure):
+ * runtime/CommonSlowPaths.cpp:
+ (JSC::SLOW_PATH_DECL):
+ * runtime/Executable.h:
+ (JSC::ExecutableBase::createStructure):
+ (JSC::NativeExecutable::createStructure):
+ * runtime/HighFidelityLog.cpp: Removed.
+ * runtime/HighFidelityLog.h: Removed.
+ * runtime/HighFidelityTypeProfiler.cpp: Removed.
+ * runtime/HighFidelityTypeProfiler.h: Removed.
+ * runtime/JSObject.cpp:
+ (JSC::JSObject::putDirectCustomAccessor):
+ (JSC::JSObject::putDirectNonIndexAccessor):
+ (JSC::JSObject::reifyStaticFunctionsForDelete):
+ * runtime/JSPromiseDeferred.h:
+ (JSC::JSPromiseDeferred::createStructure):
+ * runtime/JSPromiseReaction.h:
+ (JSC::JSPromiseReaction::createStructure):
+ * runtime/JSPropertyNameIterator.h:
+ (JSC::JSPropertyNameIterator::createStructure):
+ * runtime/JSType.h:
+ * runtime/JSTypeInfo.h:
+ (JSC::TypeInfo::TypeInfo):
+ * runtime/MapData.h:
+ (JSC::MapData::createStructure):
+ * runtime/Options.h:
+ * runtime/PropertyMapHashTable.h:
+ (JSC::PropertyTable::createStructure):
+ * runtime/RegExp.h:
+ (JSC::RegExp::createStructure):
+ * runtime/SparseArrayValueMap.cpp:
+ (JSC::SparseArrayValueMap::createStructure):
+ * runtime/Structure.cpp:
+ (JSC::StructureTransitionTable::contains):
+ (JSC::StructureTransitionTable::get):
+ (JSC::StructureTransitionTable::add):
+ (JSC::Structure::Structure):
+ (JSC::Structure::materializePropertyMap):
+ (JSC::Structure::addPropertyTransition):
+ (JSC::Structure::despecifyFunctionTransition):
+ (JSC::Structure::toDictionaryTransition):
+ (JSC::Structure::freezeTransition):
+ (JSC::Structure::preventExtensionsTransition):
+ (JSC::Structure::takePropertyTableOrCloneIfPinned):
+ (JSC::Structure::nonPropertyTransition):
+ (JSC::Structure::flattenDictionaryStructure):
+ (JSC::Structure::addPropertyWithoutTransition):
+ (JSC::Structure::pin):
+ (JSC::Structure::allocateRareData):
+ (JSC::Structure::cloneRareDataFrom):
+ (JSC::Structure::getConcurrently):
+ (JSC::Structure::putSpecificValue):
+ (JSC::Structure::getPropertyNamesFromStructure):
+ (JSC::Structure::visitChildren):
+ (JSC::Structure::checkConsistency):
+ (JSC::Structure::toStructureShape): Deleted.
+ * runtime/Structure.h:
+ (JSC::Structure::isExtensible):
+ (JSC::Structure::didTransition):
+ (JSC::Structure::isDictionary):
+ (JSC::Structure::isUncacheableDictionary):
+ (JSC::Structure::hasBeenFlattenedBefore):
+ (JSC::Structure::propertyAccessesAreCacheable):
+ (JSC::Structure::previousID):
+ (JSC::Structure::hasGetterSetterProperties):
+ (JSC::Structure::hasReadOnlyOrGetterSetterPropertiesExcludingProto):
+ (JSC::Structure::setHasGetterSetterProperties):
+ (JSC::Structure::hasCustomGetterSetterProperties):
+ (JSC::Structure::setHasCustomGetterSetterProperties):
+ (JSC::Structure::setContainsReadOnlyProperties):
+ (JSC::Structure::hasNonEnumerableProperties):
+ (JSC::Structure::disableSpecificFunctionTracking):
+ (JSC::Structure::objectToStringValue):
+ (JSC::Structure::setObjectToStringValue):
+ (JSC::Structure::staticFunctionsReified):
+ (JSC::Structure::setStaticFunctionsReified):
+ (JSC::Structure::transitionWatchpointSet):
+ (JSC::Structure::setPreviousID):
+ (JSC::Structure::clearPreviousID):
+ (JSC::Structure::previous):
+ (JSC::Structure::rareData):
+ (JSC::Structure::setHasGetterSetterPropertiesWithProtoCheck): Deleted.
+ (JSC::Structure::setHasCustomGetterSetterPropertiesWithProtoCheck): Deleted.
+ * runtime/StructureChain.h:
+ (JSC::StructureChain::createStructure):
+ * runtime/StructureInlines.h:
+ (JSC::Structure::setEnumerationCache):
+ (JSC::Structure::enumerationCache):
+ (JSC::Structure::checkOffsetConsistency):
+ * runtime/StructureRareData.cpp:
+ (JSC::StructureRareData::createStructure):
+ * runtime/SymbolTable.cpp:
+ (JSC::SymbolTable::SymbolTable):
+ (JSC::SymbolTable::cloneCapturedNames):
+ (JSC::SymbolTable::uniqueIDForVariable): Deleted.
+ (JSC::SymbolTable::uniqueIDForRegister): Deleted.
+ (JSC::SymbolTable::globalTypeSetForRegister): Deleted.
+ (JSC::SymbolTable::globalTypeSetForVariable): Deleted.
+ * runtime/SymbolTable.h:
+ (JSC::SymbolTable::createStructure):
+ (JSC::SymbolTable::add):
+ (JSC::SymbolTable::set):
+ * runtime/TypeSet.cpp: Removed.
+ * runtime/TypeSet.h: Removed.
+ * runtime/VM.cpp:
+ (JSC::VM::VM):
+ (JSC::VM::getTypesForVariableInRange): Deleted.
+ (JSC::VM::updateHighFidelityTypeProfileState): Deleted.
+ (JSC::VM::dumpHighFidelityProfilingTypes): Deleted.
+ * runtime/VM.h:
+ (JSC::VM::isProfilingTypesWithHighFidelity): Deleted.
+ (JSC::VM::highFidelityLog): Deleted.
+ (JSC::VM::highFidelityTypeProfiler): Deleted.
+ (JSC::VM::nextLocation): Deleted.
+ (JSC::VM::getNextUniqueVariableID): Deleted.
+ * runtime/WeakMapData.h:
+ (JSC::WeakMapData::createStructure):
+ * tests/stress/fold-multi-get-by-offset-to-get-by-offset-without-folding-the-structure-check.js: Removed.
+ * tests/stress/fold-multi-put-by-offset-to-put-by-offset-without-folding-the-structure-check.js: Removed.
+ * tests/stress/prune-multi-put-by-offset-replace-or-transition-variant.js: Removed.
+
</ins><span class="cx"> 2014-07-25 Filip Pizlo <fpizlo@apple.com>
</span><span class="cx">
</span><span class="cx"> Attempt to fix non-Xcode platforms.
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreJavaScriptCorevcxprojJavaScriptCorevcxproj"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/JavaScriptCore.vcxproj/JavaScriptCore.vcxproj (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/JavaScriptCore.vcxproj/JavaScriptCore.vcxproj        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/Source/JavaScriptCore/JavaScriptCore.vcxproj/JavaScriptCore.vcxproj        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -347,7 +347,6 @@
</span><span class="cx"> <ClCompile Include="..\bytecode\StructureSet.cpp" />
</span><span class="cx"> <ClCompile Include="..\bytecode\StructureStubClearingWatchpoint.cpp" />
</span><span class="cx"> <ClCompile Include="..\bytecode\StructureStubInfo.cpp" />
</span><del>- <ClCompile Include="..\bytecode\ToThisStatus.cpp" />
</del><span class="cx"> <ClCompile Include="..\bytecode\UnlinkedCodeBlock.cpp" />
</span><span class="cx"> <ClCompile Include="..\bytecode\UnlinkedInstructionStream.cpp" />
</span><span class="cx"> <ClCompile Include="..\bytecode\ValueRecovery.cpp" />
</span><span class="lines">@@ -355,8 +354,8 @@
</span><span class="cx"> <ClCompile Include="..\bytecompiler\BytecodeGenerator.cpp" />
</span><span class="cx"> <ClCompile Include="..\bytecompiler\NodesCodegen.cpp" />
</span><span class="cx"> <ClCompile Include="..\debugger\Debugger.cpp" />
</span><ins>+ <ClCompile Include="..\debugger\DebuggerActivation.cpp" />
</ins><span class="cx"> <ClCompile Include="..\debugger\DebuggerCallFrame.cpp" />
</span><del>- <ClCompile Include="..\debugger\DebuggerScope.cpp" />
</del><span class="cx"> <ClCompile Include="..\dfg\DFGAbstractHeap.cpp" />
</span><span class="cx"> <ClCompile Include="..\dfg\DFGAbstractValue.cpp" />
</span><span class="cx"> <ClCompile Include="..\dfg\DFGArgumentsSimplificationPhase.cpp" />
</span><span class="lines">@@ -683,8 +682,6 @@
</span><span class="cx"> <ClCompile Include="..\runtime\FunctionExecutableDump.cpp" />
</span><span class="cx"> <ClCompile Include="..\runtime\FunctionPrototype.cpp" />
</span><span class="cx"> <ClCompile Include="..\runtime\GetterSetter.cpp" />
</span><del>- <ClCompile Include="..\runtime\HighFidelityLog.cpp" />
- <ClCompile Include="..\runtime\HighFidelityTypeProfiler.cpp" />
</del><span class="cx"> <ClCompile Include="..\runtime\Identifier.cpp" />
</span><span class="cx"> <ClCompile Include="..\runtime\IndexingType.cpp" />
</span><span class="cx"> <ClCompile Include="..\runtime\InitializeThreading.cpp" />
</span><span class="lines">@@ -792,7 +789,6 @@
</span><span class="cx"> <ClCompile Include="..\runtime\TestRunnerUtils.cpp" />
</span><span class="cx"> <ClCompile Include="..\runtime\TypedArrayController.cpp" />
</span><span class="cx"> <ClCompile Include="..\runtime\TypedArrayType.cpp" />
</span><del>- <ClCompile Include="..\runtime\TypeSet.cpp" />
</del><span class="cx"> <ClCompile Include="..\runtime\VM.cpp" />
</span><span class="cx"> <ClCompile Include="..\runtime\VMEntryScope.cpp" />
</span><span class="cx"> <ClCompile Include="..\runtime\Watchdog.cpp" />
</span><span class="lines">@@ -941,8 +937,6 @@
</span><span class="cx"> <ClInclude Include="..\bytecode\StructureSet.h" />
</span><span class="cx"> <ClInclude Include="..\bytecode\StructureStubClearingWatchpoint.h" />
</span><span class="cx"> <ClInclude Include="..\bytecode\StructureStubInfo.h" />
</span><del>- <ClInclude Include="..\bytecode\ToThisStatus.h" />
- <ClInclude Include="..\bytecode\TypeLocation.h" />
</del><span class="cx"> <ClInclude Include="..\bytecode\UnlinkedCodeBlock.h" />
</span><span class="cx"> <ClInclude Include="..\bytecode\UnlinkedInstructionStream.h" />
</span><span class="cx"> <ClInclude Include="..\bytecode\ValueProfile.h" />
</span><span class="lines">@@ -957,9 +951,9 @@
</span><span class="cx"> <ClInclude Include="..\config.h" />
</span><span class="cx"> <ClInclude Include="..\debugger\Breakpoint.h" />
</span><span class="cx"> <ClInclude Include="..\debugger\Debugger.h" />
</span><ins>+ <ClInclude Include="..\debugger\DebuggerActivation.h" />
</ins><span class="cx"> <ClInclude Include="..\debugger\DebuggerCallFrame.h" />
</span><span class="cx"> <ClInclude Include="..\debugger\DebuggerPrimitives.h" />
</span><del>- <ClInclude Include="..\debugger\DebuggerScope.h" />
</del><span class="cx"> <ClInclude Include="..\dfg\DFGAbstractHeap.h" />
</span><span class="cx"> <ClInclude Include="..\dfg\DFGAbstractInterpreter.h" />
</span><span class="cx"> <ClInclude Include="..\dfg\DFGAbstractInterpreterInlines.h" />
</span><span class="lines">@@ -1411,8 +1405,6 @@
</span><span class="cx"> <ClInclude Include="..\runtime\GenericTypedArrayView.h" />
</span><span class="cx"> <ClInclude Include="..\runtime\GenericTypedArrayViewInlines.h" />
</span><span class="cx"> <ClInclude Include="..\runtime\GetterSetter.h" />
</span><del>- <ClInclude Include="..\runtime\HighFidelityLog.h" />
- <ClInclude Include="..\runtime\HighFidelityTypeProfiler.h" />
</del><span class="cx"> <ClInclude Include="..\runtime\Identifier.h" />
</span><span class="cx"> <ClInclude Include="..\runtime\IndexingHeader.h" />
</span><span class="cx"> <ClInclude Include="..\runtime\IndexingHeaderInlines.h" />
</span><span class="lines">@@ -1569,7 +1561,6 @@
</span><span class="cx"> <ClInclude Include="..\runtime\TypedArrayController.h" />
</span><span class="cx"> <ClInclude Include="..\runtime\TypedArrayInlines.h" />
</span><span class="cx"> <ClInclude Include="..\runtime\TypedArrayType.h" />
</span><del>- <ClInclude Include="..\runtime\TypeSet.h" />
</del><span class="cx"> <ClInclude Include="..\runtime\TypedArrays.h" />
</span><span class="cx"> <ClInclude Include="..\runtime\Uint16Array.h" />
</span><span class="cx"> <ClInclude Include="..\runtime\Uint16WithFraction.h" />
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreJavaScriptCorevcxprojJavaScriptCorevcxprojfilters"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/Source/JavaScriptCore/JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -213,10 +213,10 @@
</span><span class="cx"> <ClCompile Include="..\debugger\Debugger.cpp">
</span><span class="cx"> <Filter>debugger</Filter>
</span><span class="cx"> </ClCompile>
</span><del>- <ClCompile Include="..\debugger\DebuggerCallFrame.cpp">
</del><ins>+ <ClCompile Include="..\debugger\DebuggerActivation.cpp">
</ins><span class="cx"> <Filter>debugger</Filter>
</span><span class="cx"> </ClCompile>
</span><del>- <ClCompile Include="..\debugger\DebuggerScope.cpp">
</del><ins>+ <ClCompile Include="..\debugger\DebuggerCallFrame.cpp">
</ins><span class="cx"> <Filter>debugger</Filter>
</span><span class="cx"> </ClCompile>
</span><span class="cx"> <ClCompile Include="..\disassembler\Disassembler.cpp">
</span><span class="lines">@@ -1883,15 +1883,15 @@
</span><span class="cx"> <ClInclude Include="..\debugger\Debugger.h">
</span><span class="cx"> <Filter>debugger</Filter>
</span><span class="cx"> </ClInclude>
</span><ins>+ <ClInclude Include="..\debugger\DebuggerActivation.h">
+ <Filter>debugger</Filter>
+ </ClInclude>
</ins><span class="cx"> <ClInclude Include="..\debugger\DebuggerCallFrame.h">
</span><span class="cx"> <Filter>debugger</Filter>
</span><span class="cx"> </ClInclude>
</span><span class="cx"> <ClInclude Include="..\debugger\DebuggerPrimitives.h">
</span><span class="cx"> <Filter>debugger</Filter>
</span><span class="cx"> </ClInclude>
</span><del>- <ClInclude Include="..\debugger\DebuggerScope.h">
- <Filter>debugger</Filter>
- </ClInclude>
</del><span class="cx"> <ClInclude Include="..\dfg\DFGDriver.h">
</span><span class="cx"> <Filter>dfg</Filter>
</span><span class="cx"> </ClInclude>
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreJavaScriptCorexcodeprojprojectpbxproj"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -223,17 +223,6 @@
</span><span class="cx">                 0F2BDC4D1522818600CD8910 /* DFGMinifiedNode.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F2BDC4C1522818300CD8910 /* DFGMinifiedNode.cpp */; };
</span><span class="cx">                 0F2BDC4F15228BF300CD8910 /* DFGValueSource.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F2BDC4E15228BE700CD8910 /* DFGValueSource.cpp */; };
</span><span class="cx">                 0F2BDC5115228FFD00CD8910 /* DFGVariableEvent.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F2BDC5015228FFA00CD8910 /* DFGVariableEvent.cpp */; };
</span><del>-                0F2D4DDD19832D34007D4B19 /* DebuggerScope.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F2D4DDB19832D34007D4B19 /* DebuggerScope.cpp */; };
-                0F2D4DDE19832D34007D4B19 /* DebuggerScope.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F2D4DDC19832D34007D4B19 /* DebuggerScope.h */; settings = {ATTRIBUTES = (Private, ); }; };
-                0F2D4DE819832DAC007D4B19 /* ToThisStatus.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F2D4DE519832DAC007D4B19 /* ToThisStatus.cpp */; };
-                0F2D4DE919832DAC007D4B19 /* ToThisStatus.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F2D4DE619832DAC007D4B19 /* ToThisStatus.h */; settings = {ATTRIBUTES = (Private, ); }; };
-                0F2D4DEA19832DAC007D4B19 /* TypeLocation.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F2D4DE719832DAC007D4B19 /* TypeLocation.h */; settings = {ATTRIBUTES = (Private, ); }; };
-                0F2D4DEB19832DC4007D4B19 /* HighFidelityLog.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F2D4DDF19832D91007D4B19 /* HighFidelityLog.cpp */; };
-                0F2D4DEC19832DC4007D4B19 /* HighFidelityLog.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F2D4DE019832D91007D4B19 /* HighFidelityLog.h */; settings = {ATTRIBUTES = (Private, ); }; };
-                0F2D4DED19832DC4007D4B19 /* HighFidelityTypeProfiler.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F2D4DE119832D91007D4B19 /* HighFidelityTypeProfiler.cpp */; };
-                0F2D4DEE19832DC4007D4B19 /* HighFidelityTypeProfiler.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F2D4DE219832D91007D4B19 /* HighFidelityTypeProfiler.h */; settings = {ATTRIBUTES = (Private, ); }; };
-                0F2D4DEF19832DD3007D4B19 /* TypeSet.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F2D4DE319832D91007D4B19 /* TypeSet.cpp */; };
-                0F2D4DF019832DD6007D4B19 /* TypeSet.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F2D4DE419832D91007D4B19 /* TypeSet.h */; settings = {ATTRIBUTES = (Private, ); }; };
</del><span class="cx">                 0F2E892C16D028AD009E4FD2 /* UnusedPointer.h in Headers */ = {isa = PBXBuildFile; fileRef = 65987F2F16828A7E003C2F8D /* UnusedPointer.h */; settings = {ATTRIBUTES = (Private, ); }; };
</span><span class="cx">                 0F2E892D16D02BAF009E4FD2 /* DFGMinifiedID.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FB4B51016B3A964003F696B /* DFGMinifiedID.h */; settings = {ATTRIBUTES = (Private, ); }; };
</span><span class="cx">                 0F2FC77216E12F710038D976 /* DFGDCEPhase.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F2FC77016E12F6F0038D976 /* DFGDCEPhase.cpp */; };
</span><span class="lines">@@ -1972,6 +1961,8 @@
</span><span class="cx">                 BC18C52E0E16FCE100B34460 /* Lexer.lut.h in Headers */ = {isa = PBXBuildFile; fileRef = BC18C52D0E16FCE100B34460 /* Lexer.lut.h */; };
</span><span class="cx">                 BC257DE80E1F51C50016B6C9 /* Arguments.h in Headers */ = {isa = PBXBuildFile; fileRef = BC257DE60E1F51C50016B6C9 /* Arguments.h */; };
</span><span class="cx">                 BC3046070E1F497F003232CF /* Error.h in Headers */ = {isa = PBXBuildFile; fileRef = BC3046060E1F497F003232CF /* Error.h */; settings = {ATTRIBUTES = (Private, ); }; };
</span><ins>+                BC3135640F302FA3003DFD3A /* DebuggerActivation.h in Headers */ = {isa = PBXBuildFile; fileRef = BC3135620F302FA3003DFD3A /* DebuggerActivation.h */; settings = {ATTRIBUTES = (Private, ); }; };
+                BC3135650F302FA3003DFD3A /* DebuggerActivation.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BC3135630F302FA3003DFD3A /* DebuggerActivation.cpp */; };
</ins><span class="cx">                 BC6AAAE50E1F426500AD87D8 /* ClassInfo.h in Headers */ = {isa = PBXBuildFile; fileRef = BC6AAAE40E1F426500AD87D8 /* ClassInfo.h */; settings = {ATTRIBUTES = (Private, ); }; };
</span><span class="cx">                 BC756FC90E2031B200DE7D12 /* JSGlobalObjectFunctions.h in Headers */ = {isa = PBXBuildFile; fileRef = BC756FC70E2031B200DE7D12 /* JSGlobalObjectFunctions.h */; };
</span><span class="cx">                 BC87CDB910712AD4000614CF /* JSONObject.lut.h in Headers */ = {isa = PBXBuildFile; fileRef = BC87CDB810712ACA000614CF /* JSONObject.lut.h */; };
</span><span class="lines">@@ -2407,17 +2398,6 @@
</span><span class="cx">                 0F2BDC4C1522818300CD8910 /* DFGMinifiedNode.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGMinifiedNode.cpp; path = dfg/DFGMinifiedNode.cpp; sourceTree = "<group>"; };
</span><span class="cx">                 0F2BDC4E15228BE700CD8910 /* DFGValueSource.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGValueSource.cpp; path = dfg/DFGValueSource.cpp; sourceTree = "<group>"; };
</span><span class="cx">                 0F2BDC5015228FFA00CD8910 /* DFGVariableEvent.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGVariableEvent.cpp; path = dfg/DFGVariableEvent.cpp; sourceTree = "<group>"; };
</span><del>-                0F2D4DDB19832D34007D4B19 /* DebuggerScope.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = DebuggerScope.cpp; sourceTree = "<group>"; };
-                0F2D4DDC19832D34007D4B19 /* DebuggerScope.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DebuggerScope.h; sourceTree = "<group>"; };
-                0F2D4DDF19832D91007D4B19 /* HighFidelityLog.cpp */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.cpp.cpp; path = HighFidelityLog.cpp; sourceTree = "<group>"; };
-                0F2D4DE019832D91007D4B19 /* HighFidelityLog.h */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.c.h; path = HighFidelityLog.h; sourceTree = "<group>"; };
-                0F2D4DE119832D91007D4B19 /* HighFidelityTypeProfiler.cpp */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.cpp.cpp; path = HighFidelityTypeProfiler.cpp; sourceTree = "<group>"; };
-                0F2D4DE219832D91007D4B19 /* HighFidelityTypeProfiler.h */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.c.h; path = HighFidelityTypeProfiler.h; sourceTree = "<group>"; };
-                0F2D4DE319832D91007D4B19 /* TypeSet.cpp */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.cpp.cpp; path = TypeSet.cpp; sourceTree = "<group>"; };
-                0F2D4DE419832D91007D4B19 /* TypeSet.h */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.c.h; path = TypeSet.h; sourceTree = "<group>"; };
-                0F2D4DE519832DAC007D4B19 /* ToThisStatus.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ToThisStatus.cpp; sourceTree = "<group>"; };
-                0F2D4DE619832DAC007D4B19 /* ToThisStatus.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ToThisStatus.h; sourceTree = "<group>"; };
-                0F2D4DE719832DAC007D4B19 /* TypeLocation.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = TypeLocation.h; sourceTree = "<group>"; };
</del><span class="cx">                 0F2FC77016E12F6F0038D976 /* DFGDCEPhase.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGDCEPhase.cpp; path = dfg/DFGDCEPhase.cpp; sourceTree = "<group>"; };
</span><span class="cx">                 0F2FC77116E12F6F0038D976 /* DFGDCEPhase.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGDCEPhase.h; path = dfg/DFGDCEPhase.h; sourceTree = "<group>"; };
</span><span class="cx">                 0F2FCCF218A60070001A27F8 /* DFGGraphSafepoint.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGGraphSafepoint.cpp; path = dfg/DFGGraphSafepoint.cpp; sourceTree = "<group>"; };
</span><span class="lines">@@ -3603,6 +3583,8 @@
</span><span class="cx">                 BC2680C90E16D4E900A06E92 /* ObjectPrototype.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ObjectPrototype.h; sourceTree = "<group>"; };
</span><span class="cx">                 BC2680E60E16D52300A06E92 /* NumberConstructor.lut.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = NumberConstructor.lut.h; sourceTree = "<group>"; };
</span><span class="cx">                 BC3046060E1F497F003232CF /* Error.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = Error.h; sourceTree = "<group>"; };
</span><ins>+                BC3135620F302FA3003DFD3A /* DebuggerActivation.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DebuggerActivation.h; sourceTree = "<group>"; };
+                BC3135630F302FA3003DFD3A /* DebuggerActivation.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = DebuggerActivation.cpp; sourceTree = "<group>"; };
</ins><span class="cx">                 BC337BDE0E1AF0B80076918A /* GetterSetter.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = GetterSetter.h; sourceTree = "<group>"; };
</span><span class="cx">                 BC337BEA0E1B00CB0076918A /* Error.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = Error.cpp; sourceTree = "<group>"; };
</span><span class="cx">                 BC6AAAE40E1F426500AD87D8 /* ClassInfo.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ClassInfo.h; sourceTree = "<group>"; };
</span><span class="lines">@@ -4444,11 +4426,11 @@
</span><span class="cx">                                 FEA0861E182B7A0400F6D851 /* Breakpoint.h */,
</span><span class="cx">                                 F692A8580255597D01FF60F7 /* Debugger.cpp */,
</span><span class="cx">                                 F692A8590255597D01FF60F7 /* Debugger.h */,
</span><ins>+                                BC3135630F302FA3003DFD3A /* DebuggerActivation.cpp */,
+                                BC3135620F302FA3003DFD3A /* DebuggerActivation.h */,
</ins><span class="cx">                                 149559ED0DDCDDF700648087 /* DebuggerCallFrame.cpp */,
</span><span class="cx">                                 1480DB9B0DDC227F003CFDF2 /* DebuggerCallFrame.h */,
</span><span class="cx">                                 FEA0861F182B7A0400F6D851 /* DebuggerPrimitives.h */,
</span><del>-                                0F2D4DDB19832D34007D4B19 /* DebuggerScope.cpp */,
-                                0F2D4DDC19832D34007D4B19 /* DebuggerScope.h */,
</del><span class="cx">                         );
</span><span class="cx">                         path = debugger;
</span><span class="cx">                         sourceTree = "<group>";
</span><span class="lines">@@ -4577,6 +4559,8 @@
</span><span class="cx">                 7EF6E0BB0EB7A1EC0079AFAF /* runtime */ = {
</span><span class="cx">                         isa = PBXGroup;
</span><span class="cx">                         children = (
</span><ins>+                                9E72940A190F0514001A91B5 /* BundlePath.h */,
+                                9E729409190F0306001A91B5 /* BundlePath.mm */,
</ins><span class="cx">                                 BCF605110E203EF800B9A64D /* ArgList.cpp */,
</span><span class="cx">                                 BCF605120E203EF800B9A64D /* ArgList.h */,
</span><span class="cx">                                 BC257DE50E1F51C50016B6C9 /* Arguments.cpp */,
</span><span class="lines">@@ -4610,8 +4594,6 @@
</span><span class="cx">                                 704FD35305697E6D003DBED9 /* BooleanObject.h */,
</span><span class="cx">                                 BC7952340E15EB5600A898AB /* BooleanPrototype.cpp */,
</span><span class="cx">                                 BC7952350E15EB5600A898AB /* BooleanPrototype.h */,
</span><del>-                                9E72940A190F0514001A91B5 /* BundlePath.h */,
-                                9E729409190F0306001A91B5 /* BundlePath.mm */,
</del><span class="cx">                                 0FB7F38B15ED8E3800F167B2 /* Butterfly.h */,
</span><span class="cx">                                 0FB7F38C15ED8E3800F167B2 /* ButterflyInlines.h */,
</span><span class="cx">                                 BCA62DFE0E2826230004F30D /* CallData.cpp */,
</span><span class="lines">@@ -4683,10 +4665,6 @@
</span><span class="cx">                                 0F2B66B317B6B5AB00A7AE3F /* GenericTypedArrayViewInlines.h */,
</span><span class="cx">                                 BC02E9B80E184545000F9297 /* GetterSetter.cpp */,
</span><span class="cx">                                 BC337BDE0E1AF0B80076918A /* GetterSetter.h */,
</span><del>-                                0F2D4DDF19832D91007D4B19 /* HighFidelityLog.cpp */,
-                                0F2D4DE019832D91007D4B19 /* HighFidelityLog.h */,
-                                0F2D4DE119832D91007D4B19 /* HighFidelityTypeProfiler.cpp */,
-                                0F2D4DE219832D91007D4B19 /* HighFidelityTypeProfiler.h */,
</del><span class="cx">                                 933A349D038AE80F008635CE /* Identifier.cpp */,
</span><span class="cx">                                 933A349A038AE7C6008635CE /* Identifier.h */,
</span><span class="cx">                                 8606DDE918DA44AB00A383D0 /* IdentifierInlines.h */,
</span><span class="lines">@@ -4696,9 +4674,9 @@
</span><span class="cx">                                 0FB7F38F15ED8E3800F167B2 /* IndexingType.h */,
</span><span class="cx">                                 E178636C0D9BEEC300D74E75 /* InitializeThreading.cpp */,
</span><span class="cx">                                 E178633F0D9BEC0000D74E75 /* InitializeThreading.h */,
</span><ins>+                                A7A8AF2B17ADB5F3005AB174 /* Int8Array.h */,
</ins><span class="cx">                                 A7A8AF2C17ADB5F3005AB174 /* Int16Array.h */,
</span><span class="cx">                                 A7A8AF2D17ADB5F3005AB174 /* Int32Array.h */,
</span><del>-                                A7A8AF2B17ADB5F3005AB174 /* Int8Array.h */,
</del><span class="cx">                                 A78853F717972629001440E4 /* IntendedStructureChain.cpp */,
</span><span class="cx">                                 A78853F817972629001440E4 /* IntendedStructureChain.h */,
</span><span class="cx">                                 BC9BB95B0E19680600DF8855 /* InternalFunction.cpp */,
</span><span class="lines">@@ -4757,9 +4735,9 @@
</span><span class="cx">                                 A59455911824744700CC3843 /* JSGlobalObjectDebuggable.h */,
</span><span class="cx">                                 BC756FC60E2031B200DE7D12 /* JSGlobalObjectFunctions.cpp */,
</span><span class="cx">                                 BC756FC70E2031B200DE7D12 /* JSGlobalObjectFunctions.h */,
</span><ins>+                                0F2B66C917B6B5AB00A7AE3F /* JSInt8Array.h */,
</ins><span class="cx">                                 0F2B66CA17B6B5AB00A7AE3F /* JSInt16Array.h */,
</span><span class="cx">                                 0F2B66CB17B6B5AB00A7AE3F /* JSInt32Array.h */,
</span><del>-                                0F2B66C917B6B5AB00A7AE3F /* JSInt8Array.h */,
</del><span class="cx">                                 65EA4C99092AF9E20093D800 /* JSLock.cpp */,
</span><span class="cx">                                 65EA4C9A092AF9E20093D800 /* JSLock.h */,
</span><span class="cx">                                 A700873F17CBE8EB00C3E643 /* JSMap.cpp */,
</span><span class="lines">@@ -4813,10 +4791,10 @@
</span><span class="cx">                                 0F2B66D017B6B5AB00A7AE3F /* JSTypedArrays.cpp */,
</span><span class="cx">                                 0F2B66D117B6B5AB00A7AE3F /* JSTypedArrays.h */,
</span><span class="cx">                                 6507D2970E871E4A00D7D896 /* JSTypeInfo.h */,
</span><del>-                                0F2B66D417B6B5AB00A7AE3F /* JSUint16Array.h */,
-                                0F2B66D517B6B5AB00A7AE3F /* JSUint32Array.h */,
</del><span class="cx">                                 0F2B66D217B6B5AB00A7AE3F /* JSUint8Array.h */,
</span><span class="cx">                                 0F2B66D317B6B5AB00A7AE3F /* JSUint8ClampedArray.h */,
</span><ins>+                                0F2B66D417B6B5AB00A7AE3F /* JSUint16Array.h */,
+                                0F2B66D517B6B5AB00A7AE3F /* JSUint32Array.h */,
</ins><span class="cx">                                 BC22A39A0E16E14800AF21C8 /* JSVariableObject.cpp */,
</span><span class="cx">                                 14F252560D08DD8D004ECFFF /* JSVariableObject.h */,
</span><span class="cx">                                 A7CA3AE117DA41AE006538AF /* JSWeakMap.cpp */,
</span><span class="lines">@@ -4958,13 +4936,11 @@
</span><span class="cx">                                 0F2B66DB17B6B5AB00A7AE3F /* TypedArrays.h */,
</span><span class="cx">                                 0F2B66DC17B6B5AB00A7AE3F /* TypedArrayType.cpp */,
</span><span class="cx">                                 0F2B66DD17B6B5AB00A7AE3F /* TypedArrayType.h */,
</span><del>-                                0F2D4DE319832D91007D4B19 /* TypeSet.cpp */,
-                                0F2D4DE419832D91007D4B19 /* TypeSet.h */,
</del><ins>+                                A7A8AF3017ADB5F3005AB174 /* Uint8Array.h */,
+                                A7A8AF3117ADB5F3005AB174 /* Uint8ClampedArray.h */,
</ins><span class="cx">                                 A7A8AF3217ADB5F3005AB174 /* Uint16Array.h */,
</span><span class="cx">                                 866739D113BFDE710023D87C /* Uint16WithFraction.h */,
</span><span class="cx">                                 A7A8AF3317ADB5F3005AB174 /* Uint32Array.h */,
</span><del>-                                A7A8AF3017ADB5F3005AB174 /* Uint8Array.h */,
-                                A7A8AF3117ADB5F3005AB174 /* Uint8ClampedArray.h */,
</del><span class="cx">                                 E18E3A570DF9278C00D90B34 /* VM.cpp */,
</span><span class="cx">                                 E18E3A560DF9278C00D90B34 /* VM.h */,
</span><span class="cx">                                 FE5932A5183C5A2600A1ECCC /* VMEntryScope.cpp */,
</span><span class="lines">@@ -5467,9 +5443,6 @@
</span><span class="cx">                                 0F766D3715AE4A1A008F363E /* StructureStubClearingWatchpoint.h */,
</span><span class="cx">                                 BCCF0D0B0EF0B8A500413C8F /* StructureStubInfo.cpp */,
</span><span class="cx">                                 BCCF0D070EF0AAB900413C8F /* StructureStubInfo.h */,
</span><del>-                                0F2D4DE519832DAC007D4B19 /* ToThisStatus.cpp */,
-                                0F2D4DE619832DAC007D4B19 /* ToThisStatus.h */,
-                                0F2D4DE719832DAC007D4B19 /* TypeLocation.h */,
</del><span class="cx">                                 A79E781E15EECBA80047C855 /* UnlinkedCodeBlock.cpp */,
</span><span class="cx">                                 A79E781F15EECBA80047C855 /* UnlinkedCodeBlock.h */,
</span><span class="cx">                                 B59F89381891ADB500D5CCDC /* UnlinkedInstructionStream.cpp */,
</span><span class="lines">@@ -6046,6 +6019,7 @@
</span><span class="cx">                                 BCD2034C0E17135E002C7E82 /* DatePrototype.h in Headers */,
</span><span class="cx">                                 BCD203E80E1718F4002C7E82 /* DatePrototype.lut.h in Headers */,
</span><span class="cx">                                 BC18C3FA0E16F5CD00B34460 /* Debugger.h in Headers */,
</span><ins>+                                BC3135640F302FA3003DFD3A /* DebuggerActivation.h in Headers */,
</ins><span class="cx">                                 BC18C3FB0E16F5CD00B34460 /* DebuggerCallFrame.h in Headers */,
</span><span class="cx">                                 FEA08621182B7A0400F6D851 /* DebuggerPrimitives.h in Headers */,
</span><span class="cx">                                 0F136D4D174AD69E0075B354 /* DeferGC.h in Headers */,
</span><span class="lines">@@ -6286,7 +6260,6 @@
</span><span class="cx">                                 C283190016FE4B7D00157BFD /* HandleBlock.h in Headers */,
</span><span class="cx">                                 C283190216FE533E00157BFD /* HandleBlockInlines.h in Headers */,
</span><span class="cx">                                 0F0B83A914BCF56200885B4F /* HandlerInfo.h in Headers */,
</span><del>-                                0F2D4DEC19832DC4007D4B19 /* HighFidelityLog.h in Headers */,
</del><span class="cx">                                 142E3136134FF0A600AFADB5 /* HandleSet.h in Headers */,
</span><span class="cx">                                 142E3138134FF0A600AFADB5 /* HandleStack.h in Headers */,
</span><span class="cx">                                 1478297B1379E8A800A7C2A3 /* HandleTypes.h in Headers */,
</span><span class="lines">@@ -6327,7 +6300,6 @@
</span><span class="cx">                                 A53243981856A489002ED692 /* InspectorJS.json in Headers */,
</span><span class="cx">                                 A532438818568335002ED692 /* InspectorJSBackendDispatchers.h in Headers */,
</span><span class="cx">                                 A532438A18568335002ED692 /* InspectorJSFrontendDispatchers.h in Headers */,
</span><del>-                                0F2D4DEE19832DC4007D4B19 /* HighFidelityTypeProfiler.h in Headers */,
</del><span class="cx">                                 8606DDEA18DA44AB00A383D0 /* IdentifierInlines.h in Headers */,
</span><span class="cx">                                 A532438C18568335002ED692 /* InspectorJSTypeBuilders.h in Headers */,
</span><span class="cx">                                 A50E4B6218809DD50068A46D /* InspectorRuntimeAgent.h in Headers */,
</span><span class="lines">@@ -6378,7 +6350,6 @@
</span><span class="cx">                                 0F2B66EA17B6B5AB00A7AE3F /* JSArrayBufferViewInlines.h in Headers */,
</span><span class="cx">                                 A7BDAECB17F4EA1400F6140C /* JSArrayIterator.h in Headers */,
</span><span class="cx">                                 BC18C4180E16F5CD00B34460 /* JSBase.h in Headers */,
</span><del>-                                0F2D4DE919832DAC007D4B19 /* ToThisStatus.h in Headers */,
</del><span class="cx">                                 140D17D70E8AD4A9000CD17D /* JSBasePrivate.h in Headers */,
</span><span class="cx">                                 86FA9E92142BBB2E001773B7 /* JSBoundFunction.h in Headers */,
</span><span class="cx">                                 BC18C4190E16F5CD00B34460 /* JSCallbackConstructor.h in Headers */,
</span><span class="lines">@@ -6474,7 +6445,6 @@
</span><span class="cx">                                 6507D29E0E871E5E00D7D896 /* JSTypeInfo.h in Headers */,
</span><span class="cx">                                 0F2B670217B6B5AB00A7AE3F /* JSUint16Array.h in Headers */,
</span><span class="cx">                                 0F2B670317B6B5AB00A7AE3F /* JSUint32Array.h in Headers */,
</span><del>-                                0F2D4DF019832DD6007D4B19 /* TypeSet.h in Headers */,
</del><span class="cx">                                 0F2B670017B6B5AB00A7AE3F /* JSUint8Array.h in Headers */,
</span><span class="cx">                                 0F2B670117B6B5AB00A7AE3F /* JSUint8ClampedArray.h in Headers */,
</span><span class="cx">                                 86E3C612167BABD7006D760A /* JSValue.h in Headers */,
</span><span class="lines">@@ -6574,7 +6544,6 @@
</span><span class="cx">                                 969A079B0ED1D3AE00F1F681 /* Opcode.h in Headers */,
</span><span class="cx">                                 0F2BDC2C151FDE9100CD8910 /* Operands.h in Headers */,
</span><span class="cx">                                 A70447EA17A0BD4600F5898E /* OperandsInlines.h in Headers */,
</span><del>-                                0F2D4DDE19832D34007D4B19 /* DebuggerScope.h in Headers */,
</del><span class="cx">                                 BC18C4480E16F5CD00B34460 /* Operations.h in Headers */,
</span><span class="cx">                                 0FE228ED1436AB2700196C48 /* Options.h in Headers */,
</span><span class="cx">                                 BC18C44B0E16F5CD00B34460 /* Parser.h in Headers */,
</span><span class="lines">@@ -6639,7 +6608,6 @@
</span><span class="cx">                                 0F50AF3C193E8B3900674EE8 /* DFGStructureClobberState.h in Headers */,
</span><span class="cx">                                 A57D23EE1891B5540031C7FA /* RegularExpression.h in Headers */,
</span><span class="cx">                                 0FB7F39D15ED8E4600F167B2 /* Reject.h in Headers */,
</span><del>-                                0F2D4DEA19832DAC007D4B19 /* TypeLocation.h in Headers */,
</del><span class="cx">                                 A5BA15E8182340B300A82E69 /* RemoteInspector.h in Headers */,
</span><span class="cx">                                 A5BA15EA182340B400A82E69 /* RemoteInspectorConstants.h in Headers */,
</span><span class="cx">                                 A5BA15F0182345AF00A82E69 /* RemoteInspectorDebuggable.h in Headers */,
</span><span class="lines">@@ -7654,6 +7622,7 @@
</span><span class="cx">                                 147F39C5107EC37600427A48 /* DateInstance.cpp in Sources */,
</span><span class="cx">                                 147F39C6107EC37600427A48 /* DatePrototype.cpp in Sources */,
</span><span class="cx">                                 14280823107EC02C0013E7B2 /* Debugger.cpp in Sources */,
</span><ins>+                                BC3135650F302FA3003DFD3A /* DebuggerActivation.cpp in Sources */,
</ins><span class="cx">                                 149559EE0DDCDDF700648087 /* DebuggerCallFrame.cpp in Sources */,
</span><span class="cx">                                 2A7A58EF1808A4C40020BDF7 /* DeferGC.cpp in Sources */,
</span><span class="cx">                                 0FC712DE17CD8779008CC93C /* DeferredCompilationCallback.cpp in Sources */,
</span><span class="lines">@@ -7661,9 +7630,7 @@
</span><span class="cx">                                 0F55C19417276E4600CEABFD /* DFGAbstractValue.cpp in Sources */,
</span><span class="cx">                                 0F16015D156198C900C2587C /* DFGArgumentsSimplificationPhase.cpp in Sources */,
</span><span class="cx">                                 0F485321187750560083B687 /* DFGArithMode.cpp in Sources */,
</span><del>-                                0F2D4DDD19832D34007D4B19 /* DebuggerScope.cpp in Sources */,
</del><span class="cx">                                 0F63948415E48118006A597C /* DFGArrayMode.cpp in Sources */,
</span><del>-                                0F2D4DED19832DC4007D4B19 /* HighFidelityTypeProfiler.cpp in Sources */,
</del><span class="cx">                                 A7D9A29417A0BC7400EE2618 /* DFGAtTailAbstractState.cpp in Sources */,
</span><span class="cx">                                 0F666EC61835672B00D017F1 /* DFGAvailability.cpp in Sources */,
</span><span class="cx">                                 0F714CA416EA92F000F3EBEB /* DFGBackwardsPropagationPhase.cpp in Sources */,
</span><span class="lines">@@ -7783,7 +7750,6 @@
</span><span class="cx">                                 A7B48F490EE8936F00DCBDB6 /* ExecutableAllocator.cpp in Sources */,
</span><span class="cx">                                 86DB64640F95C6FC00D7D921 /* ExecutableAllocatorFixedVMPool.cpp in Sources */,
</span><span class="cx">                                 0F56A1D515001CF4002992B1 /* ExecutionCounter.cpp in Sources */,
</span><del>-                                0F2D4DEB19832DC4007D4B19 /* HighFidelityLog.cpp in Sources */,
</del><span class="cx">                                 0F0332C018ADFAE1005F979A /* ExitingJITType.cpp in Sources */,
</span><span class="cx">                                 0FB105851675480F00F8AB6E /* ExitKind.cpp in Sources */,
</span><span class="cx">                                 0FEA0A1C1708B00700BB722C /* FTLAbstractHeap.cpp in Sources */,
</span><span class="lines">@@ -7911,7 +7877,6 @@
</span><span class="cx">                                 A72028B61797601E0098028C /* JSCTestRunnerUtils.cpp in Sources */,
</span><span class="cx">                                 0F2B66EB17B6B5AB00A7AE3F /* JSDataView.cpp in Sources */,
</span><span class="cx">                                 0F2B66ED17B6B5AB00A7AE3F /* JSDataViewPrototype.cpp in Sources */,
</span><del>-                                0F2D4DE819832DAC007D4B19 /* ToThisStatus.cpp in Sources */,
</del><span class="cx">                                 978801401471AD920041B016 /* JSDateMath.cpp in Sources */,
</span><span class="cx">                                 140566D6107EC271005DBC8D /* JSFunction.cpp in Sources */,
</span><span class="cx">                                 147F39D2107EC37600427A48 /* JSGlobalObject.cpp in Sources */,
</span><span class="lines">@@ -8101,7 +8066,6 @@
</span><span class="cx">                                 14469DEB107EC7E700650446 /* StringConstructor.cpp in Sources */,
</span><span class="cx">                                 14469DEC107EC7E700650446 /* StringObject.cpp in Sources */,
</span><span class="cx">                                 14469DED107EC7E700650446 /* StringPrototype.cpp in Sources */,
</span><del>-                                0F2D4DEF19832DD3007D4B19 /* TypeSet.cpp in Sources */,
</del><span class="cx">                                 9335F24D12E6765B002B5553 /* StringRecursionChecker.cpp in Sources */,
</span><span class="cx">                                 BCDE3B430E6C832D001453A7 /* Structure.cpp in Sources */,
</span><span class="cx">                                 7E4EE70F0EBB7A5B005934AA /* StructureChain.cpp in Sources */,
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorebytecodeBytecodeListjson"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/bytecode/BytecodeList.json (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/bytecode/BytecodeList.json        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/Source/JavaScriptCore/bytecode/BytecodeList.json        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -10,7 +10,7 @@
</span><span class="cx"> { "name" : "op_create_arguments", "length" : 2 },
</span><span class="cx"> { "name" : "op_create_this", "length" : 4 },
</span><span class="cx"> { "name" : "op_get_callee", "length" : 3 },
</span><del>- { "name" : "op_to_this", "length" : 4 },
</del><ins>+ { "name" : "op_to_this", "length" : 3 },
</ins><span class="cx"> { "name" : "op_new_object", "length" : 4 },
</span><span class="cx"> { "name" : "op_new_array", "length" : 5 },
</span><span class="cx"> { "name" : "op_new_array_with_size", "length" : 4 },
</span><span class="lines">@@ -113,7 +113,6 @@
</span><span class="cx"> { "name" : "op_resolve_scope", "length" : 6 },
</span><span class="cx"> { "name" : "op_get_from_scope", "length" : 8 },
</span><span class="cx"> { "name" : "op_put_to_scope", "length" : 7 },
</span><del>- { "name" : "op_put_to_scope_with_profile", "length" : 8 },
</del><span class="cx"> { "name" : "op_push_with_scope", "length" : 2 },
</span><span class="cx"> { "name" : "op_pop_scope", "length" : 1 },
</span><span class="cx"> { "name" : "op_push_name_scope", "length" : 4 },
</span><span class="lines">@@ -123,8 +122,7 @@
</span><span class="cx"> { "name" : "op_debug", "length" : 3 },
</span><span class="cx"> { "name" : "op_profile_will_call", "length" : 2 },
</span><span class="cx"> { "name" : "op_profile_did_call", "length" : 2 },
</span><del>- { "name" : "op_end", "length" : 2 },
- { "name" : "op_profile_types_with_high_fidelity", "length" : 4 }
</del><ins>+ { "name" : "op_end", "length" : 2 }
</ins><span class="cx"> ]
</span><span class="cx"> },
</span><span class="cx"> {
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorebytecodeBytecodeUseDefh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/bytecode/BytecodeUseDef.h (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/bytecode/BytecodeUseDef.h        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/Source/JavaScriptCore/bytecode/BytecodeUseDef.h        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -65,7 +65,6 @@
</span><span class="cx"> case op_tear_off_activation:
</span><span class="cx"> case op_profile_will_call:
</span><span class="cx"> case op_profile_did_call:
</span><del>- case op_profile_types_with_high_fidelity:
</del><span class="cx"> case op_throw:
</span><span class="cx"> case op_push_with_scope:
</span><span class="cx"> case op_end:
</span><span class="lines">@@ -106,7 +105,6 @@
</span><span class="cx"> case op_put_by_id_transition_normal_out_of_line:
</span><span class="cx"> case op_put_by_id_out_of_line:
</span><span class="cx"> case op_put_by_id:
</span><del>- case op_put_to_scope_with_profile:
</del><span class="cx"> case op_put_to_scope: {
</span><span class="cx"> functor(codeBlock, instruction, opcodeID, instruction[1].u.operand);
</span><span class="cx"> functor(codeBlock, instruction, opcodeID, instruction[3].u.operand);
</span><span class="lines">@@ -251,7 +249,6 @@
</span><span class="cx"> case op_push_name_scope:
</span><span class="cx"> case op_push_with_scope:
</span><span class="cx"> case op_put_to_scope:
</span><del>- case op_put_to_scope_with_profile:
</del><span class="cx"> case op_pop_scope:
</span><span class="cx"> case op_end:
</span><span class="cx"> case op_profile_will_call:
</span><span class="lines">@@ -290,7 +287,6 @@
</span><span class="cx"> case op_put_by_val_direct:
</span><span class="cx"> case op_put_by_index:
</span><span class="cx"> case op_tear_off_arguments:
</span><del>- case op_profile_types_with_high_fidelity:
</del><span class="cx"> case op_touch_entry:
</span><span class="cx"> #define LLINT_HELPER_OPCODES(opcode, length) case opcode:
</span><span class="cx"> FOR_EACH_LLINT_OPCODE_EXTENSION(LLINT_HELPER_OPCODES);
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorebytecodeCodeBlockcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/bytecode/CodeBlock.cpp (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/bytecode/CodeBlock.cpp        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/Source/JavaScriptCore/bytecode/CodeBlock.cpp        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -39,7 +39,6 @@
</span><span class="cx"> #include "DFGJITCode.h"
</span><span class="cx"> #include "DFGWorklist.h"
</span><span class="cx"> #include "Debugger.h"
</span><del>-#include "HighFidelityTypeProfiler.h"
</del><span class="cx"> #include "Interpreter.h"
</span><span class="cx"> #include "JIT.h"
</span><span class="cx"> #include "JITStubs.h"
</span><span class="lines">@@ -48,7 +47,6 @@
</span><span class="cx"> #include "JSFunction.h"
</span><span class="cx"> #include "JSNameScope.h"
</span><span class="cx"> #include "LLIntEntrypoint.h"
</span><del>-#include "TypeLocation.h"
</del><span class="cx"> #include "LowLevelInterpreter.h"
</span><span class="cx"> #include "JSCInlines.h"
</span><span class="cx"> #include "PolymorphicGetByIdList.h"
</span><span class="lines">@@ -297,6 +295,7 @@
</span><span class="cx"> out.printf(" (offset = %d)", offset);
</span><span class="cx"> }
</span><span class="cx">
</span><ins>+#if ENABLE(JIT) // unused when not ENABLE(JIT), leading to silly warnings
</ins><span class="cx"> static void dumpChain(PrintStream& out, ExecState* exec, StructureChain* chain, const Identifier& ident)
</span><span class="cx"> {
</span><span class="cx"> out.printf("chain = %p: [", chain);
</span><span class="lines">@@ -312,6 +311,7 @@
</span><span class="cx"> }
</span><span class="cx"> out.printf("]");
</span><span class="cx"> }
</span><ins>+#endif
</ins><span class="cx">
</span><span class="cx"> void CodeBlock::printGetByIdCacheStatus(PrintStream& out, ExecState* exec, int location, const StubInfoMap& map)
</span><span class="cx"> {
</span><span class="lines">@@ -398,118 +398,6 @@
</span><span class="cx"> #endif
</span><span class="cx"> }
</span><span class="cx">
</span><del>-void CodeBlock::printPutByIdCacheStatus(PrintStream& out, ExecState* exec, int location, const StubInfoMap& map)
-{
- Instruction* instruction = instructions().begin() + location;
-
- const Identifier& ident = identifier(instruction[2].u.operand);
-
- UNUSED_PARAM(ident); // tell the compiler to shut up in certain platform configurations.
-
- if (Structure* structure = instruction[4].u.structure.get()) {
- switch (exec->interpreter()->getOpcodeID(instruction[0].u.opcode)) {
- case op_put_by_id:
- case op_put_by_id_out_of_line:
- out.print(" llint(");
- dumpStructure(out, "struct", exec, structure, ident);
- out.print(")");
- break;
-
- case op_put_by_id_transition_direct:
- case op_put_by_id_transition_normal:
- case op_put_by_id_transition_direct_out_of_line:
- case op_put_by_id_transition_normal_out_of_line:
- out.print(" llint(");
- dumpStructure(out, "prev", exec, structure, ident);
- out.print(", ");
- dumpStructure(out, "next", exec, instruction[6].u.structure.get(), ident);
- if (StructureChain* chain = instruction[7].u.structureChain.get()) {
- out.print(", ");
- dumpChain(out, exec, chain, ident);
- }
- out.print(")");
- break;
-
- default:
- out.print(" llint(unknown)");
- break;
- }
- }
-
-#if ENABLE(JIT)
- if (StructureStubInfo* stubPtr = map.get(CodeOrigin(location))) {
- StructureStubInfo& stubInfo = *stubPtr;
- if (stubInfo.resetByGC)
- out.print(" (Reset By GC)");
-
- if (stubInfo.seen) {
- out.printf(" jit(");
-
- switch (stubInfo.accessType) {
- case access_put_by_id_replace:
- out.print("replace, ");
- dumpStructure(out, "struct", exec, stubInfo.u.putByIdReplace.baseObjectStructure.get(), ident);
- break;
- case access_put_by_id_transition_normal:
- case access_put_by_id_transition_direct:
- out.print("transition, ");
- dumpStructure(out, "prev", exec, stubInfo.u.putByIdTransition.previousStructure.get(), ident);
- out.print(", ");
- dumpStructure(out, "next", exec, stubInfo.u.putByIdTransition.structure.get(), ident);
- if (StructureChain* chain = stubInfo.u.putByIdTransition.chain.get()) {
- out.print(", ");
- dumpChain(out, exec, chain, ident);
- }
- break;
- case access_put_by_id_list: {
- out.printf("list = [");
- PolymorphicPutByIdList* list = stubInfo.u.putByIdList.list;
- CommaPrinter comma;
- for (unsigned i = 0; i < list->size(); ++i) {
- out.print(comma, "(");
- const PutByIdAccess& access = list->at(i);
-
- if (access.isReplace()) {
- out.print("replace, ");
- dumpStructure(out, "struct", exec, access.oldStructure(), ident);
- } else if (access.isSetter()) {
- out.print("setter, ");
- dumpStructure(out, "struct", exec, access.oldStructure(), ident);
- } else if (access.isCustom()) {
- out.print("custom, ");
- dumpStructure(out, "struct", exec, access.oldStructure(), ident);
- } else if (access.isTransition()) {
- out.print("transition, ");
- dumpStructure(out, "prev", exec, access.oldStructure(), ident);
- out.print(", ");
- dumpStructure(out, "next", exec, access.newStructure(), ident);
- if (access.chain()) {
- out.print(", ");
- dumpChain(out, exec, access.chain(), ident);
- }
- } else
- out.print("unknown");
-
- out.print(")");
- }
- out.print("]");
- break;
- }
- case access_unset:
- out.printf("unset");
- break;
- default:
- RELEASE_ASSERT_NOT_REACHED();
- break;
- }
- out.printf(")");
- }
- }
-#else
- UNUSED_PARAM(map);
-#endif
-}
-
</del><span class="cx"> void CodeBlock::printCallOp(PrintStream& out, ExecState* exec, int location, const Instruction*& it, const char* op, CacheDumpMode cacheDumpMode, bool& hasPrintedProfiling, const CallLinkInfoMap& map)
</span><span class="cx"> {
</span><span class="cx"> int dst = (++it)->u.operand;
</span><span class="lines">@@ -772,7 +660,6 @@
</span><span class="cx"> Structure* structure = (++it)->u.structure.get();
</span><span class="cx"> if (structure)
</span><span class="cx"> out.print(" cache(struct = ", RawPointer(structure), ")");
</span><del>- out.print(" ", (++it)->u.toThisStatus);
</del><span class="cx"> break;
</span><span class="cx"> }
</span><span class="cx"> case op_new_object: {
</span><span class="lines">@@ -835,14 +722,6 @@
</span><span class="cx"> ++it;
</span><span class="cx"> break;
</span><span class="cx"> }
</span><del>- case op_profile_types_with_high_fidelity: {
- int r0 = (++it)->u.operand;
- ++it;
- ++it;
- printLocationAndOp(out, exec, location, it, "op_profile_types_with_high_fidelity");
- out.printf("%s", registerName(r0).data());
- break;
- }
</del><span class="cx"> case op_not: {
</span><span class="cx"> printUnaryOp(out, exec, location, it, "not");
</span><span class="cx"> break;
</span><span class="lines">@@ -1041,32 +920,26 @@
</span><span class="cx"> }
</span><span class="cx"> case op_put_by_id: {
</span><span class="cx"> printPutByIdOp(out, exec, location, it, "put_by_id");
</span><del>- printPutByIdCacheStatus(out, exec, location, stubInfos);
</del><span class="cx"> break;
</span><span class="cx"> }
</span><span class="cx"> case op_put_by_id_out_of_line: {
</span><span class="cx"> printPutByIdOp(out, exec, location, it, "put_by_id_out_of_line");
</span><del>- printPutByIdCacheStatus(out, exec, location, stubInfos);
</del><span class="cx"> break;
</span><span class="cx"> }
</span><span class="cx"> case op_put_by_id_transition_direct: {
</span><span class="cx"> printPutByIdOp(out, exec, location, it, "put_by_id_transition_direct");
</span><del>- printPutByIdCacheStatus(out, exec, location, stubInfos);
</del><span class="cx"> break;
</span><span class="cx"> }
</span><span class="cx"> case op_put_by_id_transition_direct_out_of_line: {
</span><span class="cx"> printPutByIdOp(out, exec, location, it, "put_by_id_transition_direct_out_of_line");
</span><del>- printPutByIdCacheStatus(out, exec, location, stubInfos);
</del><span class="cx"> break;
</span><span class="cx"> }
</span><span class="cx"> case op_put_by_id_transition_normal: {
</span><span class="cx"> printPutByIdOp(out, exec, location, it, "put_by_id_transition_normal");
</span><del>- printPutByIdCacheStatus(out, exec, location, stubInfos);
</del><span class="cx"> break;
</span><span class="cx"> }
</span><span class="cx"> case op_put_by_id_transition_normal_out_of_line: {
</span><span class="cx"> printPutByIdOp(out, exec, location, it, "put_by_id_transition_normal_out_of_line");
</span><del>- printPutByIdCacheStatus(out, exec, location, stubInfos);
</del><span class="cx"> break;
</span><span class="cx"> }
</span><span class="cx"> case op_put_getter_setter: {
</span><span class="lines">@@ -1469,7 +1342,6 @@
</span><span class="cx"> operand);
</span><span class="cx"> break;
</span><span class="cx"> }
</span><del>- case op_put_to_scope_with_profile:
</del><span class="cx"> case op_put_to_scope: {
</span><span class="cx"> int r0 = (++it)->u.operand;
</span><span class="cx"> int id0 = (++it)->u.operand;
</span><span class="lines">@@ -1478,8 +1350,6 @@
</span><span class="cx"> ++it; // Structure
</span><span class="cx"> int operand = (++it)->u.operand; // Operand
</span><span class="cx"> printLocationAndOp(out, exec, location, it, "put_to_scope");
</span><del>- if (opcode == op_put_to_scope_with_profile)
- ++it;
</del><span class="cx"> out.printf("%s, %s, %s, %u<%s|%s>, <structure>, %d",
</span><span class="cx"> registerName(r0).data(), idName(id0, identifier(id0)).data(), registerName(r1).data(),
</span><span class="cx"> modeAndType.operand(), resolveModeName(modeAndType.mode()), resolveTypeName(modeAndType.type()),
</span><span class="lines">@@ -1877,7 +1747,6 @@
</span><span class="cx"> break;
</span><span class="cx"> }
</span><span class="cx">
</span><del>- case op_put_to_scope_with_profile:
</del><span class="cx"> case op_put_to_scope: {
</span><span class="cx"> // put_to_scope scope, id, value, ResolveModeAndType, Structure, Operand
</span><span class="cx"> const Identifier& ident = identifier(pc[2].u.operand);
</span><span class="lines">@@ -1893,68 +1762,9 @@
</span><span class="cx"> } else if (op.structure)
</span><span class="cx"> instructions[i + 5].u.structure.set(*vm(), ownerExecutable, op.structure);
</span><span class="cx"> instructions[i + 6].u.pointer = reinterpret_cast<void*>(op.operand);
</span><del>-
- if (pc[0].u.opcode == op_put_to_scope_with_profile) {
- // The format of this instruction is: put_to_scope_with_profile scope, id, value, ResolveModeAndType, Structure, Operand, TypeLocation*
- TypeLocation* location = vm()->nextLocation();
- size_t instructionOffset = i + opLength - 1;
- int divot, startOffset, endOffset;
- unsigned line = 0, column = 0;
- expressionRangeForBytecodeOffset(instructionOffset, divot, startOffset, endOffset, line, column);
-
- location->m_line = line;
- location->m_column = column;
- location->m_sourceID = m_ownerExecutable->sourceID();
-
- // FIXME: handle other values for op.type here, and also consider what to do when we can't statically determine the globalID
- SymbolTable* symbolTable = 0;
- if (op.type == ClosureVar)
- symbolTable = op.activation->symbolTable();
- else if (op.type == GlobalVar)
- symbolTable = m_globalObject.get()->symbolTable();
-
- if (symbolTable) {
- ConcurrentJITLocker locker(symbolTable->m_lock);
- location->m_globalVariableID = symbolTable->uniqueIDForVariable(locker, ident.impl(), *vm());
- location->m_globalTypeSet =symbolTable->globalTypeSetForVariable(locker, ident.impl(), *vm());
- } else
- location->m_globalVariableID = HighFidelityNoGlobalIDExists;
-
- vm()->highFidelityTypeProfiler()->insertNewLocation(location);
- instructions[i + 7].u.location = location;
- }
</del><span class="cx"> break;
</span><span class="cx"> }
</span><del>-
- case op_profile_types_with_high_fidelity: {
-
- VirtualRegister virtualRegister(pc[1].u.operand);
- SymbolTable* symbolTable = m_symbolTable.get();
- TypeLocation* location = vm()->nextLocation();
- size_t instructionOffset = i + opLength - 1;
- int divot, startOffset, endOffset;
- unsigned line = 0, column = 0;
- expressionRangeForBytecodeOffset(instructionOffset, divot, startOffset, endOffset, line, column);
-
- int hasGlobalIDFlag = pc[3].u.operand;
- if (hasGlobalIDFlag) {
- ConcurrentJITLocker locker(symbolTable->m_lock);
- location->m_globalVariableID = symbolTable->uniqueIDForRegister(locker, virtualRegister.offset(), *vm());
- location->m_globalTypeSet = symbolTable->globalTypeSetForRegister(locker, virtualRegister.offset(), *vm());
- } else
- location->m_globalVariableID = HighFidelityNoGlobalIDExists;
</del><span class="cx">
</span><del>-
- location->m_line = line;
- location->m_column = column;
- location->m_sourceID = m_ownerExecutable->sourceID();
-
- vm()->highFidelityTypeProfiler()->insertNewLocation(location);
- instructions[i + 2].u.location = location;
- break;
- }
-
-
</del><span class="cx"> case op_captured_mov:
</span><span class="cx"> case op_new_captured_func: {
</span><span class="cx"> if (pc[3].u.index == UINT_MAX) {
</span><span class="lines">@@ -2375,8 +2185,6 @@
</span><span class="cx"> if (Options::verboseOSR())
</span><span class="cx"> dataLogF("Clearing LLInt to_this with structure %p.\n", curInstruction[2].u.structure.get());
</span><span class="cx"> curInstruction[2].u.structure.clear();
</span><del>- curInstruction[3].u.toThisStatus = merge(
- curInstruction[3].u.toThisStatus, ToThisClearedByGC);
</del><span class="cx"> break;
</span><span class="cx"> case op_get_callee:
</span><span class="cx"> if (!curInstruction[2].u.jsCell || Heap::isMarked(curInstruction[2].u.jsCell.get()))
</span><span class="lines">@@ -2395,7 +2203,6 @@
</span><span class="cx"> break;
</span><span class="cx"> }
</span><span class="cx"> case op_get_from_scope:
</span><del>- case op_put_to_scope_with_profile:
</del><span class="cx"> case op_put_to_scope: {
</span><span class="cx"> ResolveModeAndType modeAndType =
</span><span class="cx"> ResolveModeAndType(curInstruction[4].u.operand);
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorebytecodeCodeBlockh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/bytecode/CodeBlock.h (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/bytecode/CodeBlock.h        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/Source/JavaScriptCore/bytecode/CodeBlock.h        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -941,7 +941,6 @@
</span><span class="cx">
</span><span class="cx"> bool isKnownToBeLiveDuringGC(); // Will only return valid results when called during GC. Assumes that you've already established that the owner executable is live.
</span><span class="cx">
</span><del>-
</del><span class="cx"> protected:
</span><span class="cx"> virtual void visitWeakReferences(SlotVisitor&) override;
</span><span class="cx"> virtual void finalizeUnconditionally() override;
</span><span class="lines">@@ -988,7 +987,6 @@
</span><span class="cx"> enum CacheDumpMode { DumpCaches, DontDumpCaches };
</span><span class="cx"> void printCallOp(PrintStream&, ExecState*, int location, const Instruction*&, const char* op, CacheDumpMode, bool& hasPrintedProfiling, const CallLinkInfoMap&);
</span><span class="cx"> void printPutByIdOp(PrintStream&, ExecState*, int location, const Instruction*&, const char* op);
</span><del>- void printPutByIdCacheStatus(PrintStream&, ExecState*, int location, const StubInfoMap&);
</del><span class="cx"> void printLocationAndOp(PrintStream&, ExecState*, int location, const Instruction*&, const char* op);
</span><span class="cx"> void printLocationOpAndRegisterOperand(PrintStream&, ExecState*, int location, const Instruction*& it, const char* op, int operand);
</span><span class="cx">
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorebytecodeGetByIdStatuscpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/bytecode/GetByIdStatus.cpp (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/bytecode/GetByIdStatus.cpp        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/Source/JavaScriptCore/bytecode/GetByIdStatus.cpp        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -166,8 +166,7 @@
</span><span class="cx">
</span><span class="cx"> variant.m_structureSet.add(structure);
</span><span class="cx"> variant.m_specificValue = JSValue(specificValue);
</span><del>- bool didAppend = result.appendVariant(variant);
- ASSERT_UNUSED(didAppend, didAppend);
</del><ins>+ result.appendVariant(variant);
</ins><span class="cx"> return result;
</span><span class="cx"> }
</span><span class="cx">
</span><span class="lines">@@ -311,43 +310,34 @@
</span><span class="cx"> return computeFor(profiledBlock, baselineMap, codeOrigin.bytecodeIndex, uid);
</span><span class="cx"> }
</span><span class="cx">
</span><del>-GetByIdStatus GetByIdStatus::computeFor(VM& vm, const StructureSet& set, StringImpl* uid)
</del><ins>+GetByIdStatus GetByIdStatus::computeFor(VM& vm, Structure* structure, StringImpl* uid)
</ins><span class="cx"> {
</span><span class="cx"> // For now we only handle the super simple self access case. We could handle the
</span><span class="cx"> // prototype case in the future.
</span><span class="cx">
</span><del>- if (set.isEmpty())
- return GetByIdStatus();
</del><ins>+ if (!structure)
+ return GetByIdStatus(TakesSlowPath);
</ins><span class="cx">
</span><span class="cx"> if (toUInt32FromStringImpl(uid) != PropertyName::NotAnIndex)
</span><span class="cx"> return GetByIdStatus(TakesSlowPath);
</span><span class="cx">
</span><del>- GetByIdStatus result;
- result.m_state = Simple;
- result.m_wasSeenInJIT = false;
- for (unsigned i = 0; i < set.size(); ++i) {
- Structure* structure = set[i];
- if (structure->typeInfo().overridesGetOwnPropertySlot() && structure->typeInfo().type() != GlobalObjectType)
- return GetByIdStatus(TakesSlowPath);
-
- if (!structure->propertyAccessesAreCacheable())
- return GetByIdStatus(TakesSlowPath);
-
- unsigned attributes;
- JSCell* specificValue;
- PropertyOffset offset = structure->getConcurrently(vm, uid, attributes, specificValue);
- if (!isValidOffset(offset))
- return GetByIdStatus(TakesSlowPath); // It's probably a prototype lookup. Give up on life for now, even though we could totally be way smarter about it.
- if (attributes & Accessor)
- return GetByIdStatus(MakesCalls); // We could be smarter here, like strenght-reducing this to a Call.
- if (structure->isDictionary())
- specificValue = 0;
-
- if (!result.appendVariant(GetByIdVariant(structure, offset, specificValue)))
- return GetByIdStatus(TakesSlowPath);
- }
</del><ins>+ if (structure->typeInfo().overridesGetOwnPropertySlot() && structure->typeInfo().type() != GlobalObjectType)
+ return GetByIdStatus(TakesSlowPath);
</ins><span class="cx">
</span><del>- return result;
</del><ins>+ if (!structure->propertyAccessesAreCacheable())
+ return GetByIdStatus(TakesSlowPath);
+
+ unsigned attributes;
+ JSCell* specificValue;
+ PropertyOffset offset = structure->getConcurrently(vm, uid, attributes, specificValue);
+ if (!isValidOffset(offset))
+ return GetByIdStatus(TakesSlowPath); // It's probably a prototype lookup. Give up on life for now, even though we could totally be way smarter about it.
+ if (attributes & Accessor)
+ return GetByIdStatus(MakesCalls);
+ if (structure->isDictionary())
+ specificValue = 0;
+ return GetByIdStatus(
+ Simple, false, GetByIdVariant(StructureSet(structure), offset, specificValue));
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> bool GetByIdStatus::makesCalls() const
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorebytecodeGetByIdStatush"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/bytecode/GetByIdStatus.h (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/bytecode/GetByIdStatus.h        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/Source/JavaScriptCore/bytecode/GetByIdStatus.h        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -68,7 +68,7 @@
</span><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> static GetByIdStatus computeFor(CodeBlock*, StubInfoMap&, unsigned bytecodeIndex, StringImpl* uid);
</span><del>- static GetByIdStatus computeFor(VM&, const StructureSet&, StringImpl* uid);
</del><ins>+ static GetByIdStatus computeFor(VM&, Structure*, StringImpl* uid);
</ins><span class="cx">
</span><span class="cx"> static GetByIdStatus computeFor(CodeBlock* baselineBlock, CodeBlock* dfgBlock, StubInfoMap& baselineMap, StubInfoMap& dfgMap, CodeOrigin, StringImpl* uid);
</span><span class="cx">
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorebytecodeGetByIdVariantcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/bytecode/GetByIdVariant.cpp (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/bytecode/GetByIdVariant.cpp        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/Source/JavaScriptCore/bytecode/GetByIdVariant.cpp        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -108,14 +108,12 @@
</span><span class="cx">
</span><span class="cx"> out.print(
</span><span class="cx"> "<", inContext(structureSet(), context), ", ",
</span><del>- "[", listDumpInContext(m_constantChecks, context), "]");
- if (m_alternateBase)
- out.print(", alternateBase = ", inContext(JSValue(m_alternateBase), context));
- if (specificValue())
- out.print(", specificValue = ", inContext(specificValue(), context));
- out.print(", offset = ", offset());
</del><ins>+ "[", listDumpInContext(m_constantChecks, context), "], ",
+ "alternateBase = ", inContext(JSValue(m_alternateBase), context), ", ",
+ "specificValue = ", inContext(specificValue(), context), ", ",
+ "offset = ", offset());
</ins><span class="cx"> if (m_callLinkStatus)
</span><del>- out.print(", call = ", *m_callLinkStatus);
</del><ins>+ out.print("call = ", *m_callLinkStatus);
</ins><span class="cx"> out.print(">");
</span><span class="cx"> }
</span><span class="cx">
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorebytecodeGetByIdVarianth"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/bytecode/GetByIdVariant.h (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/bytecode/GetByIdVariant.h        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/Source/JavaScriptCore/bytecode/GetByIdVariant.h        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -55,7 +55,6 @@
</span><span class="cx"> bool isSet() const { return !!m_structureSet.size(); }
</span><span class="cx"> bool operator!() const { return !isSet(); }
</span><span class="cx"> const StructureSet& structureSet() const { return m_structureSet; }
</span><del>- StructureSet& structureSet() { return m_structureSet; }
</del><span class="cx"> const ConstantStructureCheckVector& constantChecks() const { return m_constantChecks; }
</span><span class="cx"> JSObject* alternateBase() const { return m_alternateBase; }
</span><span class="cx"> JSValue specificValue() const { return m_specificValue; }
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorebytecodeInstructionh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/bytecode/Instruction.h (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/bytecode/Instruction.h        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/Source/JavaScriptCore/bytecode/Instruction.h        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -1,5 +1,5 @@
</span><span class="cx"> /*
</span><del>- * Copyright (C) 2008, 2012, 2013, 2014 Apple Inc. All rights reserved.
</del><ins>+ * Copyright (C) 2008, 2012, 2013 Apple Inc. All rights reserved.
</ins><span class="cx"> *
</span><span class="cx"> * Redistribution and use in source and binary forms, with or without
</span><span class="cx"> * modification, are permitted provided that the following conditions
</span><span class="lines">@@ -31,12 +31,10 @@
</span><span class="cx">
</span><span class="cx"> #include "MacroAssembler.h"
</span><span class="cx"> #include "Opcode.h"
</span><del>-#include "TypeLocation.h"
</del><span class="cx"> #include "PropertySlot.h"
</span><span class="cx"> #include "SpecialPointer.h"
</span><span class="cx"> #include "Structure.h"
</span><span class="cx"> #include "StructureChain.h"
</span><del>-#include "ToThisStatus.h"
</del><span class="cx"> #include "VirtualRegister.h"
</span><span class="cx"> #include <wtf/VectorTraits.h>
</span><span class="cx">
</span><span class="lines">@@ -120,8 +118,6 @@
</span><span class="cx"> WriteBarrierBase<JSActivation> activation;
</span><span class="cx"> void* pointer;
</span><span class="cx"> bool* predicatePointer;
</span><del>- ToThisStatus toThisStatus;
- TypeLocation* location;
</del><span class="cx"> } u;
</span><span class="cx">
</span><span class="cx"> private:
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorebytecodePutByIdStatuscpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/bytecode/PutByIdStatus.cpp (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/bytecode/PutByIdStatus.cpp        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/Source/JavaScriptCore/bytecode/PutByIdStatus.cpp        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -40,11 +40,7 @@
</span><span class="cx"> bool PutByIdStatus::appendVariant(const PutByIdVariant& variant)
</span><span class="cx"> {
</span><span class="cx"> for (unsigned i = 0; i < m_variants.size(); ++i) {
</span><del>- if (m_variants[i].attemptToMerge(variant))
- return true;
- }
- for (unsigned i = 0; i < m_variants.size(); ++i) {
- if (m_variants[i].oldStructure().overlaps(variant.oldStructure()))
</del><ins>+ if (m_variants[i].oldStructure() == variant.oldStructure())
</ins><span class="cx"> return false;
</span><span class="cx"> }
</span><span class="cx"> m_variants.append(variant);
</span><span class="lines">@@ -194,15 +190,11 @@
</span><span class="cx"> access.newStructure()->getConcurrently(*profiledBlock->vm(), uid);
</span><span class="cx"> if (!isValidOffset(offset))
</span><span class="cx"> return PutByIdStatus(TakesSlowPath);
</span><del>- RefPtr<IntendedStructureChain> chain;
- if (access.chain()) {
- chain = adoptRef(new IntendedStructureChain(
- profiledBlock, access.oldStructure(), access.chain()));
- if (!chain->isStillValid())
- continue;
- }
</del><span class="cx"> bool ok = result.appendVariant(PutByIdVariant::transition(
</span><del>- access.oldStructure(), access.newStructure(), chain.get(), offset));
</del><ins>+ access.oldStructure(), access.newStructure(),
+ access.chain() ? adoptRef(new IntendedStructureChain(
+ profiledBlock, access.oldStructure(), access.chain())) : 0,
+ offset));
</ins><span class="cx"> if (!ok)
</span><span class="cx"> return PutByIdStatus(TakesSlowPath);
</span><span class="cx"> break;
</span><span class="lines">@@ -255,101 +247,88 @@
</span><span class="cx"> return computeFor(baselineBlock, baselineMap, codeOrigin.bytecodeIndex, uid);
</span><span class="cx"> }
</span><span class="cx">
</span><del>-PutByIdStatus PutByIdStatus::computeFor(VM& vm, JSGlobalObject* globalObject, const StructureSet& set, StringImpl* uid, bool isDirect)
</del><ins>+PutByIdStatus PutByIdStatus::computeFor(VM& vm, JSGlobalObject* globalObject, Structure* structure, StringImpl* uid, bool isDirect)
</ins><span class="cx"> {
</span><span class="cx"> if (toUInt32FromStringImpl(uid) != PropertyName::NotAnIndex)
</span><span class="cx"> return PutByIdStatus(TakesSlowPath);
</span><span class="cx">
</span><del>- if (set.isEmpty())
- return PutByIdStatus();
</del><ins>+ if (!structure)
+ return PutByIdStatus(TakesSlowPath);
</ins><span class="cx">
</span><del>- PutByIdStatus result;
- result.m_state = Simple;
- for (unsigned i = 0; i < set.size(); ++i) {
- Structure* structure = set[i];
-
- if (structure->typeInfo().overridesGetOwnPropertySlot() && structure->typeInfo().type() != GlobalObjectType)
- return PutByIdStatus(TakesSlowPath);
</del><ins>+ if (structure->typeInfo().overridesGetOwnPropertySlot() && structure->typeInfo().type() != GlobalObjectType)
+ return PutByIdStatus(TakesSlowPath);
</ins><span class="cx">
</span><del>- if (!structure->propertyAccessesAreCacheable())
- return PutByIdStatus(TakesSlowPath);
</del><ins>+ if (!structure->propertyAccessesAreCacheable())
+ return PutByIdStatus(TakesSlowPath);
</ins><span class="cx">
</span><del>- unsigned attributes;
- JSCell* specificValue;
- PropertyOffset offset = structure->getConcurrently(vm, uid, attributes, specificValue);
- if (isValidOffset(offset)) {
- if (attributes & CustomAccessor)
- return PutByIdStatus(MakesCalls);
</del><ins>+ unsigned attributes;
+ JSCell* specificValue;
+ PropertyOffset offset = structure->getConcurrently(vm, uid, attributes, specificValue);
+ if (isValidOffset(offset)) {
+ if (attributes & CustomAccessor)
+ return PutByIdStatus(MakesCalls);
</ins><span class="cx">
</span><del>- if (attributes & (Accessor | ReadOnly))
- return PutByIdStatus(TakesSlowPath);
- if (specificValue) {
- // We need the PutById slow path to verify that we're storing the right value into
- // the specialized slot.
- return PutByIdStatus(TakesSlowPath);
- }
- if (!result.appendVariant(PutByIdVariant::replace(structure, offset)))
- return PutByIdStatus(TakesSlowPath);
- continue;
</del><ins>+ if (attributes & (Accessor | ReadOnly))
+ return PutByIdStatus(TakesSlowPath);
+ if (specificValue) {
+ // We need the PutById slow path to verify that we're storing the right value into
+ // the specialized slot.
+ return PutByIdStatus(TakesSlowPath);
</ins><span class="cx"> }
</span><ins>+ return PutByIdVariant::replace(structure, offset);
+ }
</ins><span class="cx">
</span><del>- // Our hypothesis is that we're doing a transition. Before we prove that this is really
- // true, we want to do some sanity checks.
</del><ins>+ // Our hypothesis is that we're doing a transition. Before we prove that this is really
+ // true, we want to do some sanity checks.
</ins><span class="cx">
</span><del>- // Don't cache put transitions on dictionaries.
- if (structure->isDictionary())
- return PutByIdStatus(TakesSlowPath);
</del><ins>+ // Don't cache put transitions on dictionaries.
+ if (structure->isDictionary())
+ return PutByIdStatus(TakesSlowPath);
</ins><span class="cx">
</span><del>- // If the structure corresponds to something that isn't an object, then give up, since
- // we don't want to be adding properties to strings.
- if (structure->typeInfo().type() == StringType)
- return PutByIdStatus(TakesSlowPath);
</del><ins>+ // If the structure corresponds to something that isn't an object, then give up, since
+ // we don't want to be adding properties to strings.
+ if (structure->typeInfo().type() == StringType)
+ return PutByIdStatus(TakesSlowPath);
</ins><span class="cx">
</span><del>- RefPtr<IntendedStructureChain> chain;
- if (!isDirect) {
- chain = adoptRef(new IntendedStructureChain(globalObject, structure));
</del><ins>+ RefPtr<IntendedStructureChain> chain;
+ if (!isDirect) {
+ chain = adoptRef(new IntendedStructureChain(globalObject, structure));
</ins><span class="cx">
</span><del>- // If the prototype chain has setters or read-only properties, then give up.
- if (chain->mayInterceptStoreTo(vm, uid))
- return PutByIdStatus(TakesSlowPath);
</del><ins>+ // If the prototype chain has setters or read-only properties, then give up.
+ if (chain->mayInterceptStoreTo(vm, uid))
+ return PutByIdStatus(TakesSlowPath);
</ins><span class="cx">
</span><del>- // If the prototype chain hasn't been normalized (i.e. there are proxies or dictionaries)
- // then give up. The dictionary case would only happen if this structure has not been
- // used in an optimized put_by_id transition. And really the only reason why we would
- // bail here is that I don't really feel like having the optimizing JIT go and flatten
- // dictionaries if we have evidence to suggest that those objects were never used as
- // prototypes in a cacheable prototype access - i.e. there's a good chance that some of
- // the other checks below will fail.
- if (structure->isProxy() || !chain->isNormalized())
- return PutByIdStatus(TakesSlowPath);
- }
-
- // We only optimize if there is already a structure that the transition is cached to.
- // Among other things, this allows us to guard against a transition with a specific
- // value.
- //
- // - If we're storing a value that could be specific: this would only be a problem if
- // the existing transition did have a specific value already, since if it didn't,
- // then we would behave "as if" we were not storing a specific value. If it did
- // have a specific value, then we'll know - the fact that we pass 0 for
- // specificValue will tell us.
- //
- // - If we're not storing a value that could be specific: again, this would only be a
- // problem if the existing transition did have a specific value, which we check for
- // by passing 0 for the specificValue.
- Structure* transition = Structure::addPropertyTransitionToExistingStructureConcurrently(structure, uid, 0, 0, offset);
- if (!transition)
- return PutByIdStatus(TakesSlowPath); // This occurs in bizarre cases only. See above.
- ASSERT(!transition->transitionDidInvolveSpecificValue());
- ASSERT(isValidOffset(offset));
-
- bool didAppend = result.appendVariant(
- PutByIdVariant::transition(structure, transition, chain.release(), offset));
- if (!didAppend)
</del><ins>+ // If the prototype chain hasn't been normalized (i.e. there are proxies or dictionaries)
+ // then give up. The dictionary case would only happen if this structure has not been
+ // used in an optimized put_by_id transition. And really the only reason why we would
+ // bail here is that I don't really feel like having the optimizing JIT go and flatten
+ // dictionaries if we have evidence to suggest that those objects were never used as
+ // prototypes in a cacheable prototype access - i.e. there's a good chance that some of
+ // the other checks below will fail.
+ if (structure->isProxy() || !chain->isNormalized())
</ins><span class="cx"> return PutByIdStatus(TakesSlowPath);
</span><span class="cx"> }
</span><span class="cx">
</span><del>- return result;
</del><ins>+ // We only optimize if there is already a structure that the transition is cached to.
+ // Among other things, this allows us to guard against a transition with a specific
+ // value.
+ //
+ // - If we're storing a value that could be specific: this would only be a problem if
+ // the existing transition did have a specific value already, since if it didn't,
+ // then we would behave "as if" we were not storing a specific value. If it did
+ // have a specific value, then we'll know - the fact that we pass 0 for
+ // specificValue will tell us.
+ //
+ // - If we're not storing a value that could be specific: again, this would only be a
+ // problem if the existing transition did have a specific value, which we check for
+ // by passing 0 for the specificValue.
+ Structure* transition = Structure::addPropertyTransitionToExistingStructureConcurrently(structure, uid, 0, 0, offset);
+ if (!transition)
+ return PutByIdStatus(TakesSlowPath); // This occurs in bizarre cases only. See above.
+ ASSERT(!transition->transitionDidInvolveSpecificValue());
+ ASSERT(isValidOffset(offset));
+
+ return PutByIdVariant::transition(structure, transition, chain.release(), offset);
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> void PutByIdStatus::dump(PrintStream& out) const
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorebytecodePutByIdStatush"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/bytecode/PutByIdStatus.h (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/bytecode/PutByIdStatus.h        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/Source/JavaScriptCore/bytecode/PutByIdStatus.h        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -70,7 +70,7 @@
</span><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> static PutByIdStatus computeFor(CodeBlock*, StubInfoMap&, unsigned bytecodeIndex, StringImpl* uid);
</span><del>- static PutByIdStatus computeFor(VM&, JSGlobalObject*, const StructureSet&, StringImpl* uid, bool isDirect);
</del><ins>+ static PutByIdStatus computeFor(VM&, JSGlobalObject*, Structure*, StringImpl* uid, bool isDirect);
</ins><span class="cx">
</span><span class="cx"> static PutByIdStatus computeFor(CodeBlock* baselineBlock, CodeBlock* dfgBlock, StubInfoMap& baselineMap, StubInfoMap& dfgMap, CodeOrigin, StringImpl* uid);
</span><span class="cx">
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorebytecodePutByIdVariantcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/bytecode/PutByIdVariant.cpp (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/bytecode/PutByIdVariant.cpp        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/Source/JavaScriptCore/bytecode/PutByIdVariant.cpp        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -30,99 +30,6 @@
</span><span class="cx">
</span><span class="cx"> namespace JSC {
</span><span class="cx">
</span><del>-Structure* PutByIdVariant::oldStructureForTransition() const
-{
- ASSERT(kind() == Transition);
- ASSERT(m_oldStructure.size() <= 2);
- for (unsigned i = m_oldStructure.size(); i--;) {
- Structure* structure = m_oldStructure[i];
- if (structure != m_newStructure)
- return structure;
- }
- RELEASE_ASSERT_NOT_REACHED();
-}
-
-bool PutByIdVariant::writesStructures() const
-{
- return kind() == Transition;
-}
-
-bool PutByIdVariant::reallocatesStorage() const
-{
- if (kind() != Transition)
- return false;
-
- if (oldStructureForTransition()->outOfLineCapacity() == newStructure()->outOfLineCapacity())
- return false;
-
- return true;
-}
-
-bool PutByIdVariant::attemptToMerge(const PutByIdVariant& other)
-{
- if (m_offset != other.m_offset)
- return false;
-
- switch (m_kind) {
- case Replace:
- switch (other.m_kind) {
- case Replace: {
- ASSERT(m_constantChecks.isEmpty());
- ASSERT(other.m_constantChecks.isEmpty());
-
- m_oldStructure.merge(other.m_oldStructure);
- return true;
- }
-
- case Transition: {
- PutByIdVariant newVariant = other;
- if (newVariant.attemptToMergeTransitionWithReplace(*this)) {
- *this = newVariant;
- return true;
- }
- return false;
- }
-
- default:
- return false;
- }
-
- case Transition:
- switch (other.m_kind) {
- case Replace:
- return attemptToMergeTransitionWithReplace(other);
-
- default:
- return false;
- }
-
- default:
- return false;
- }
-}
-
-bool PutByIdVariant::attemptToMergeTransitionWithReplace(const PutByIdVariant& replace)
-{
- ASSERT(m_kind == Transition);
- ASSERT(replace.m_kind == Replace);
- ASSERT(m_offset == replace.m_offset);
- ASSERT(!replace.writesStructures());
- ASSERT(!replace.reallocatesStorage());
-
- // This sort of merging only works when we have one path along which we add a new field which
- // transitions to structure S while the other path was already on structure S. This doesn't
- // work if we need to reallocate anything or if the replace path is polymorphic.
-
- if (reallocatesStorage())
- return false;
-
- if (replace.m_oldStructure.onlyStructure() != m_newStructure)
- return false;
-
- m_oldStructure.merge(m_newStructure);
- return true;
-}
-
</del><span class="cx"> void PutByIdVariant::dump(PrintStream& out) const
</span><span class="cx"> {
</span><span class="cx"> dumpInContext(out, 0);
</span><span class="lines">@@ -137,12 +44,12 @@
</span><span class="cx">
</span><span class="cx"> case Replace:
</span><span class="cx"> out.print(
</span><del>- "<Replace: ", inContext(structure(), context), ", ", offset(), ">");
</del><ins>+ "<Replace: ", pointerDumpInContext(structure(), context), ", ", offset(), ">");
</ins><span class="cx"> return;
</span><span class="cx">
</span><span class="cx"> case Transition:
</span><span class="cx"> out.print(
</span><del>- "<Transition: ", inContext(oldStructure(), context), " -> ",
</del><ins>+ "<Transition: ", pointerDumpInContext(oldStructure(), context), " -> ",
</ins><span class="cx"> pointerDumpInContext(newStructure(), context), ", [",
</span><span class="cx"> listDumpInContext(constantChecks(), context), "], ", offset(), ">");
</span><span class="cx"> return;
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorebytecodePutByIdVarianth"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/bytecode/PutByIdVariant.h (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/bytecode/PutByIdVariant.h        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/Source/JavaScriptCore/bytecode/PutByIdVariant.h        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -28,7 +28,6 @@
</span><span class="cx">
</span><span class="cx"> #include "IntendedStructureChain.h"
</span><span class="cx"> #include "PropertyOffset.h"
</span><del>-#include "StructureSet.h"
</del><span class="cx">
</span><span class="cx"> namespace JSC {
</span><span class="cx">
</span><span class="lines">@@ -42,12 +41,13 @@
</span><span class="cx">
</span><span class="cx"> PutByIdVariant()
</span><span class="cx"> : m_kind(NotSet)
</span><del>- , m_newStructure(nullptr)
</del><ins>+ , m_oldStructure(0)
+ , m_newStructure(0)
</ins><span class="cx"> , m_offset(invalidOffset)
</span><span class="cx"> {
</span><span class="cx"> }
</span><span class="cx">
</span><del>- static PutByIdVariant replace(const StructureSet& structure, PropertyOffset offset)
</del><ins>+ static PutByIdVariant replace(Structure* structure, PropertyOffset offset)
</ins><span class="cx"> {
</span><span class="cx"> PutByIdVariant result;
</span><span class="cx"> result.m_kind = Replace;
</span><span class="lines">@@ -57,7 +57,7 @@
</span><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> static PutByIdVariant transition(
</span><del>- const StructureSet& oldStructure, Structure* newStructure,
</del><ins>+ Structure* oldStructure, Structure* newStructure,
</ins><span class="cx"> PassRefPtr<IntendedStructureChain> structureChain, PropertyOffset offset)
</span><span class="cx"> {
</span><span class="cx"> PutByIdVariant result;
</span><span class="lines">@@ -75,37 +75,27 @@
</span><span class="cx"> bool isSet() const { return kind() != NotSet; }
</span><span class="cx"> bool operator!() const { return !isSet(); }
</span><span class="cx">
</span><del>- const StructureSet& structure() const
</del><ins>+ Structure* structure() const
</ins><span class="cx"> {
</span><span class="cx"> ASSERT(kind() == Replace);
</span><span class="cx"> return m_oldStructure;
</span><span class="cx"> }
</span><span class="cx">
</span><del>- const StructureSet& oldStructure() const
</del><ins>+ Structure* oldStructure() const
</ins><span class="cx"> {
</span><span class="cx"> ASSERT(kind() == Transition || kind() == Replace);
</span><span class="cx"> return m_oldStructure;
</span><span class="cx"> }
</span><span class="cx">
</span><del>- StructureSet& oldStructure()
- {
- ASSERT(kind() == Transition || kind() == Replace);
- return m_oldStructure;
- }
-
- Structure* oldStructureForTransition() const;
-
</del><span class="cx"> Structure* newStructure() const
</span><span class="cx"> {
</span><span class="cx"> ASSERT(kind() == Transition);
</span><span class="cx"> return m_newStructure;
</span><span class="cx"> }
</span><del>-
- bool writesStructures() const;
- bool reallocatesStorage() const;
</del><span class="cx">
</span><span class="cx"> const ConstantStructureCheckVector& constantChecks() const
</span><span class="cx"> {
</span><ins>+ ASSERT(kind() == Transition);
</ins><span class="cx"> return m_constantChecks;
</span><span class="cx"> }
</span><span class="cx">
</span><span class="lines">@@ -115,16 +105,12 @@
</span><span class="cx"> return m_offset;
</span><span class="cx"> }
</span><span class="cx">
</span><del>- bool attemptToMerge(const PutByIdVariant& other);
-
</del><span class="cx"> void dump(PrintStream&) const;
</span><span class="cx"> void dumpInContext(PrintStream&, DumpContext*) const;
</span><span class="cx">
</span><span class="cx"> private:
</span><del>- bool attemptToMergeTransitionWithReplace(const PutByIdVariant& replace);
-
</del><span class="cx"> Kind m_kind;
</span><del>- StructureSet m_oldStructure;
</del><ins>+ Structure* m_oldStructure;
</ins><span class="cx"> Structure* m_newStructure;
</span><span class="cx"> ConstantStructureCheckVector m_constantChecks;
</span><span class="cx"> PropertyOffset m_offset;
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorebytecodeStructureSetcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/bytecode/StructureSet.cpp (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/bytecode/StructureSet.cpp        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/Source/JavaScriptCore/bytecode/StructureSet.cpp        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -26,7 +26,6 @@
</span><span class="cx"> #include "config.h"
</span><span class="cx"> #include "StructureSet.h"
</span><span class="cx">
</span><del>-#include "DFGAbstractValue.h"
</del><span class="cx"> #include <wtf/CommaPrinter.h>
</span><span class="cx">
</span><span class="cx"> namespace JSC {
</span><span class="lines">@@ -161,84 +160,6 @@
</span><span class="cx"> clear();
</span><span class="cx"> }
</span><span class="cx">
</span><del>-#if ENABLE(DFG_JIT)
-
-namespace {
-
-class StructureAbstractValueContains {
-public:
- StructureAbstractValueContains(const DFG::StructureAbstractValue& value)
- : m_value(value)
- {
- }
-
- bool operator()(Structure* structure)
- {
- return m_value.contains(structure);
- }
-private:
- const DFG::StructureAbstractValue& m_value;
-};
-
-class SpeculatedTypeContains {
-public:
- SpeculatedTypeContains(SpeculatedType type)
- : m_type(type)
- {
- }
-
- bool operator()(Structure* structure)
- {
- return m_type & speculationFromStructure(structure);
- }
-private:
- SpeculatedType m_type;
-};
-
-class ArrayModesContains {
-public:
- ArrayModesContains(ArrayModes arrayModes)
- : m_arrayModes(arrayModes)
- {
- }
-
- bool operator()(Structure* structure)
- {
- return m_arrayModes & arrayModeFromStructure(structure);
- }
-private:
- ArrayModes m_arrayModes;
-};
-
-} // anonymous namespace
-
-void StructureSet::filter(const DFG::StructureAbstractValue& other)
-{
- StructureAbstractValueContains functor(other);
- genericFilter(functor);
-}
-
-void StructureSet::filter(SpeculatedType type)
-{
- SpeculatedTypeContains functor(type);
- genericFilter(functor);
-}
-
-void StructureSet::filterArrayModes(ArrayModes arrayModes)
-{
- ArrayModesContains functor(arrayModes);
- genericFilter(functor);
-}
-
-void StructureSet::filter(const DFG::AbstractValue& other)
-{
- filter(other.m_structure);
- filter(other.m_type);
- filterArrayModes(other.m_arrayModes);
-}
-
-#endif // ENABLE(DFG_JIT)
-
</del><span class="cx"> bool StructureSet::isSubsetOf(const StructureSet& other) const
</span><span class="cx"> {
</span><span class="cx"> if (isThin()) {
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorebytecodeStructureSeth"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/bytecode/StructureSet.h (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/bytecode/StructureSet.h        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/Source/JavaScriptCore/bytecode/StructureSet.h        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -35,7 +35,6 @@
</span><span class="cx">
</span><span class="cx"> namespace DFG {
</span><span class="cx"> class StructureAbstractValue;
</span><del>-struct AbstractValue;
</del><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> class StructureSet {
</span><span class="lines">@@ -73,12 +72,12 @@
</span><span class="cx">
</span><span class="cx"> Structure* onlyStructure() const
</span><span class="cx"> {
</span><del>- if (isThin())
</del><ins>+ if (isThin()) {
+ ASSERT(singleStructure());
</ins><span class="cx"> return singleStructure();
</span><del>- OutOfLineList* list = structureList();
- if (list->m_length != 1)
- return nullptr;
- return list->list()[0];
</del><ins>+ }
+ ASSERT(structureList()->m_length == 1);
+ return structureList()->list()[0];
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> bool isEmpty() const
</span><span class="lines">@@ -97,13 +96,6 @@
</span><span class="cx"> void filter(const StructureSet&);
</span><span class="cx"> void exclude(const StructureSet&);
</span><span class="cx">
</span><del>-#if ENABLE(DFG_JIT)
- void filter(const DFG::StructureAbstractValue&);
- void filter(SpeculatedType);
- void filterArrayModes(ArrayModes);
- void filter(const DFG::AbstractValue&);
-#endif // ENABLE(DFG_JIT)
-
</del><span class="cx"> template<typename Functor>
</span><span class="cx"> void genericFilter(Functor& functor)
</span><span class="cx"> {
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorebytecodeToThisStatuscpp"></a>
<div class="delfile"><h4>Deleted: trunk/Source/JavaScriptCore/bytecode/ToThisStatus.cpp (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/bytecode/ToThisStatus.cpp        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/Source/JavaScriptCore/bytecode/ToThisStatus.cpp        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -1,72 +0,0 @@
</span><del>-/*
- * Copyright (C) 2014 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- * notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- * notice, this list of conditions and the following disclaimer in the
- * documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include "config.h"
-#include "ToThisStatus.h"
-
-namespace JSC {
-
-ToThisStatus merge(ToThisStatus a, ToThisStatus b)
-{
- switch (a) {
- case ToThisOK:
- return b;
- case ToThisConflicted:
- return ToThisConflicted;
- case ToThisClearedByGC:
- if (b == ToThisConflicted)
- return ToThisConflicted;
- return ToThisClearedByGC;
- }
-
- RELEASE_ASSERT_NOT_REACHED();
- return ToThisConflicted;
-}
-
-} // namespace JSC
-
-namespace WTF {
-
-using namespace JSC;
-
-void printInternal(PrintStream& out, ToThisStatus status)
-{
- switch (status) {
- case ToThisOK:
- out.print("OK");
- return;
- case ToThisConflicted:
- out.print("Conflicted");
- return;
- case ToThisClearedByGC:
- out.print("ClearedByGC");
- return;
- }
-
- RELEASE_ASSERT_NOT_REACHED();
-}
-
-} // namespace WTF
-
</del></span></pre></div>
<a id="trunkSourceJavaScriptCorebytecodeToThisStatush"></a>
<div class="delfile"><h4>Deleted: trunk/Source/JavaScriptCore/bytecode/ToThisStatus.h (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/bytecode/ToThisStatus.h        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/Source/JavaScriptCore/bytecode/ToThisStatus.h        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -1,50 +0,0 @@
</span><del>-/*
- * Copyright (C) 2014 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- * notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- * notice, this list of conditions and the following disclaimer in the
- * documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#ifndef ToThisStatus_h
-#define ToThisStatus_h
-
-#include <wtf/PrintStream.h>
-
-namespace JSC {
-
-enum ToThisStatus {
- ToThisOK,
- ToThisConflicted,
- ToThisClearedByGC
-};
-
-ToThisStatus merge(ToThisStatus, ToThisStatus);
-
-} // namespace JSC
-
-namespace WTF {
-
-void printInternal(PrintStream&, JSC::ToThisStatus);
-
-} // namespace WTF
-
-#endif // ToThisStatus_h
-
</del></span></pre></div>
<a id="trunkSourceJavaScriptCorebytecodeTypeLocationh"></a>
<div class="delfile"><h4>Deleted: trunk/Source/JavaScriptCore/bytecode/TypeLocation.h (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/bytecode/TypeLocation.h        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/Source/JavaScriptCore/bytecode/TypeLocation.h        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -1,57 +0,0 @@
</span><del>-/*
- * Copyright (C) 2014 Apple Inc. All Rights Reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- * notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- * notice, this list of conditions and the following disclaimer in the
- * documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#ifndef TypeLocation_h
-#define TypeLocation_h
-
-#include "TypeSet.h"
-
-namespace JSC {
-
-enum HighFidelityGlobalIDFlags {
- HighFidelityNeedsUniqueIDGeneration = -1,
- HighFidelityNoGlobalIDExists = -2
-};
-
-class TypeLocation {
-
-public:
- TypeLocation()
- : m_instructionTypeSet(TypeSet::create())
- , m_globalTypeSet(nullptr)
- {
- }
-
- int64_t m_globalVariableID;
- intptr_t m_sourceID;
- unsigned m_line;
- unsigned m_column;
- RefPtr<TypeSet> m_instructionTypeSet;
- RefPtr<TypeSet> m_globalTypeSet;
-};
-
-} //namespace JSC
-
-#endif //TypeLocation_h
</del></span></pre></div>
<a id="trunkSourceJavaScriptCorebytecompilerBytecodeGeneratorcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/Source/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -410,7 +410,6 @@
</span><span class="cx"> emitOpcode(op_to_this);
</span><span class="cx"> instructions().append(kill(&m_thisRegister));
</span><span class="cx"> instructions().append(0);
</span><del>- instructions().append(0);
</del><span class="cx"> }
</span><span class="cx"> }
</span><span class="cx">
</span><span class="lines">@@ -1003,10 +1002,6 @@
</span><span class="cx"> instructions().append(src->index());
</span><span class="cx"> if (captureMode == IsCaptured)
</span><span class="cx"> instructions().append(watchableVariable(dst->index()));
</span><del>-
- if (!dst->isTemporary() && isProfilingTypesWithHighFidelity())
- emitProfileTypesWithHighFidelity(dst, true);
-
</del><span class="cx"> return dst;
</span><span class="cx"> }
</span><span class="cx">
</span><span class="lines">@@ -1116,18 +1111,6 @@
</span><span class="cx"> return dst;
</span><span class="cx"> }
</span><span class="cx">
</span><del>-void BytecodeGenerator::emitProfileTypesWithHighFidelity(RegisterID* registerToProfile, bool hasGlobalID)
-{
- emitOpcode(op_profile_types_with_high_fidelity);
- instructions().append(registerToProfile->index());
- instructions().append(0); // placeholder for TypeLocation
- // This is a flag indicating whether we should track this value to its globalID or not.
- if (hasGlobalID)
- instructions().append(1);
- else
- instructions().append(0);
-}
-
</del><span class="cx"> RegisterID* BytecodeGenerator::emitLoad(RegisterID* dst, bool b)
</span><span class="cx"> {
</span><span class="cx"> return emitLoad(dst, jsBoolean(b));
</span><span class="lines">@@ -1272,18 +1255,13 @@
</span><span class="cx"> m_codeBlock->addPropertyAccessInstruction(instructions().size());
</span><span class="cx">
</span><span class="cx"> // put_to_scope scope, id, value, ResolveModeAndType, Structure, Operand
</span><del>- if (isProfilingTypesWithHighFidelity())
- emitOpcode(op_put_to_scope_with_profile);
- else
- emitOpcode(op_put_to_scope);
</del><ins>+ emitOpcode(op_put_to_scope);
</ins><span class="cx"> instructions().append(scope->index());
</span><span class="cx"> instructions().append(addConstant(identifier));
</span><span class="cx"> instructions().append(value->index());
</span><span class="cx"> instructions().append(ResolveModeAndType(resolveMode, resolveType()).operand());
</span><span class="cx"> instructions().append(0);
</span><span class="cx"> instructions().append(0);
</span><del>- if (isProfilingTypesWithHighFidelity())
- instructions().append(0);
</del><span class="cx"> return value;
</span><span class="cx"> }
</span><span class="cx">
</span><span class="lines">@@ -1350,10 +1328,6 @@
</span><span class="cx"> instructions().append(0);
</span><span class="cx"> instructions().append(0);
</span><span class="cx"> instructions().append(0);
</span><del>-
- if (isProfilingTypesWithHighFidelity())
- emitProfileTypesWithHighFidelity(value, false);
-
</del><span class="cx"> return value;
</span><span class="cx"> }
</span><span class="cx">
</span><span class="lines">@@ -1450,10 +1424,6 @@
</span><span class="cx"> instructions().append(property->index());
</span><span class="cx"> instructions().append(value->index());
</span><span class="cx"> instructions().append(arrayProfile);
</span><del>-
- if (isProfilingTypesWithHighFidelity())
- emitProfileTypesWithHighFidelity(value, false);
-
</del><span class="cx"> return value;
</span><span class="cx"> }
</span><span class="cx">
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorebytecompilerBytecodeGeneratorh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/bytecompiler/BytecodeGenerator.h (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/bytecompiler/BytecodeGenerator.h        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/Source/JavaScriptCore/bytecompiler/BytecodeGenerator.h        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -332,8 +332,6 @@
</span><span class="cx"> return emitNode(n);
</span><span class="cx"> }
</span><span class="cx">
</span><del>- void emitProfileTypesWithHighFidelity(RegisterID* dst, bool);
-
</del><span class="cx"> RegisterID* emitLoad(RegisterID* dst, bool);
</span><span class="cx"> RegisterID* emitLoad(RegisterID* dst, double);
</span><span class="cx"> RegisterID* emitLoad(RegisterID* dst, const Identifier&);
</span><span class="lines">@@ -679,8 +677,6 @@
</span><span class="cx">
</span><span class="cx"> VM* m_vm;
</span><span class="cx">
</span><del>- bool isProfilingTypesWithHighFidelity() { return vm()->isProfilingTypesWithHighFidelity(); }
-
</del><span class="cx"> OpcodeID m_lastOpcodeID;
</span><span class="cx"> #ifndef NDEBUG
</span><span class="cx"> size_t m_lastOpcodePosition;
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorebytecompilerNodesCodegencpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/bytecompiler/NodesCodegen.cpp (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/bytecompiler/NodesCodegen.cpp        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/Source/JavaScriptCore/bytecompiler/NodesCodegen.cpp        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -740,15 +740,13 @@
</span><span class="cx"> if (local.isReadOnly()) {
</span><span class="cx"> generator.emitReadOnlyExceptionIfNeeded();
</span><span class="cx"> localReg = generator.emitMove(generator.tempDestination(dst), localReg);
</span><del>- } else if (local.isCaptured() || generator.isProfilingTypesWithHighFidelity()) {
</del><ins>+ } else if (local.isCaptured()) {
</ins><span class="cx"> RefPtr<RegisterID> tempDst = generator.finalDestination(dst);
</span><span class="cx"> ASSERT(dst != localReg);
</span><span class="cx"> RefPtr<RegisterID> tempDstSrc = generator.newTemporary();
</span><span class="cx"> generator.emitToNumber(tempDst.get(), localReg);
</span><span class="cx"> generator.emitMove(tempDstSrc.get(), localReg);
</span><span class="cx"> emitIncOrDec(generator, tempDstSrc.get(), m_operator);
</span><del>- if (generator.isProfilingTypesWithHighFidelity())
- generator.emitExpressionInfo(divot(), divotStart(), divotEnd());
</del><span class="cx"> generator.emitMove(localReg, tempDstSrc.get());
</span><span class="cx"> return tempDst.get();
</span><span class="cx"> }
</span><span class="lines">@@ -917,12 +915,10 @@
</span><span class="cx"> if (local.isReadOnly()) {
</span><span class="cx"> generator.emitReadOnlyExceptionIfNeeded();
</span><span class="cx"> localReg = generator.emitMove(generator.tempDestination(dst), localReg);
</span><del>- } else if (local.isCaptured() || generator.isProfilingTypesWithHighFidelity()) {
</del><ins>+ } else if (local.isCaptured()) {
</ins><span class="cx"> RefPtr<RegisterID> tempDst = generator.tempDestination(dst);
</span><span class="cx"> generator.emitMove(tempDst.get(), localReg);
</span><span class="cx"> emitIncOrDec(generator, tempDst.get(), m_operator);
</span><del>- if (generator.isProfilingTypesWithHighFidelity())
- generator.emitExpressionInfo(divot(), divotStart(), divotEnd());
</del><span class="cx"> generator.emitMove(localReg, tempDst.get());
</span><span class="cx"> return generator.moveToDestinationIfNeeded(dst, tempDst.get());
</span><span class="cx"> }
</span><span class="lines">@@ -1411,7 +1407,6 @@
</span><span class="cx">
</span><span class="cx"> RegisterID* ReadModifyResolveNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
</span><span class="cx"> {
</span><del>- JSTextPosition newDivot = divotStart() + m_ident.length();
</del><span class="cx"> if (Local local = generator.local(m_ident)) {
</span><span class="cx"> if (local.isReadOnly()) {
</span><span class="cx"> generator.emitReadOnlyExceptionIfNeeded();
</span><span class="lines">@@ -1419,13 +1414,10 @@
</span><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> if (local.isCaptured()
</span><del>- || generator.isProfilingTypesWithHighFidelity()
</del><span class="cx"> || generator.leftHandSideNeedsCopy(m_rightHasAssignments, m_right->isPure(generator))) {
</span><span class="cx"> RefPtr<RegisterID> result = generator.newTemporary();
</span><span class="cx"> generator.emitMove(result.get(), local.get());
</span><span class="cx"> emitReadModifyAssignment(generator, result.get(), result.get(), m_right, m_operator, OperandTypes(ResultType::unknownType(), m_right->resultDescriptor()));
</span><del>- if (generator.isProfilingTypesWithHighFidelity())
- generator.emitExpressionInfo(newDivot, divotStart(), newDivot);
</del><span class="cx"> generator.emitMove(local.get(), result.get());
</span><span class="cx"> return generator.moveToDestinationIfNeeded(dst, result.get());
</span><span class="cx"> }
</span><span class="lines">@@ -1434,6 +1426,7 @@
</span><span class="cx"> return generator.moveToDestinationIfNeeded(dst, result);
</span><span class="cx"> }
</span><span class="cx">
</span><ins>+ JSTextPosition newDivot = divotStart() + m_ident.length();
</ins><span class="cx"> generator.emitExpressionInfo(newDivot, divotStart(), newDivot);
</span><span class="cx"> RefPtr<RegisterID> scope = generator.emitResolveScope(generator.newTemporary(), m_ident);
</span><span class="cx"> RefPtr<RegisterID> value = generator.emitGetFromScope(generator.newTemporary(), scope.get(), m_ident, ThrowIfNotFound);
</span><span class="lines">@@ -1450,11 +1443,9 @@
</span><span class="cx"> generator.emitReadOnlyExceptionIfNeeded();
</span><span class="cx"> return generator.emitNode(dst, m_right);
</span><span class="cx"> }
</span><del>- if (local.isCaptured() || generator.isProfilingTypesWithHighFidelity()) {
</del><ins>+ if (local.isCaptured()) {
</ins><span class="cx"> RefPtr<RegisterID> tempDst = generator.tempDestination(dst);
</span><span class="cx"> generator.emitNode(tempDst.get(), m_right);
</span><del>- if (generator.isProfilingTypesWithHighFidelity())
- generator.emitExpressionInfo(divot(), divotStart(), divotEnd());
</del><span class="cx"> generator.emitMove(local.get(), tempDst.get());
</span><span class="cx"> return generator.moveToDestinationIfNeeded(dst, tempDst.get());
</span><span class="cx"> }
</span><span class="lines">@@ -1557,8 +1548,7 @@
</span><span class="cx"> if (!m_init)
</span><span class="cx"> return local.get();
</span><span class="cx">
</span><del>- // FIXME: Maybe call emitExpressionInfo here.
- if (local.isCaptured() || generator.isProfilingTypesWithHighFidelity()) {
</del><ins>+ if (local.isCaptured()) {
</ins><span class="cx"> RefPtr<RegisterID> tempDst = generator.newTemporary();
</span><span class="cx"> generator.emitNode(tempDst.get(), m_init);
</span><span class="cx"> return generator.emitMove(local.get(), tempDst.get());
</span><span class="lines">@@ -1881,8 +1871,7 @@
</span><span class="cx"> Identifier ident = simpleBinding->boundProperty();
</span><span class="cx"> Local local = generator.local(ident);
</span><span class="cx"> propertyName = local.get();
</span><del>- // FIXME: Should I emit expression info here?
- if (!propertyName || local.isCaptured() || generator.isProfilingTypesWithHighFidelity())
</del><ins>+ if (!propertyName || local.isCaptured())
</ins><span class="cx"> goto genericBinding;
</span><span class="cx"> expectedSubscript = generator.emitMove(generator.newTemporary(), propertyName);
</span><span class="cx"> generator.pushOptimisedForIn(expectedSubscript.get(), iter.get(), i.get(), propertyName);
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredebuggerDebuggerActivationcpp"></a>
<div class="addfile"><h4>Added: trunk/Source/JavaScriptCore/debugger/DebuggerActivation.cpp (0 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/debugger/DebuggerActivation.cpp         (rev 0)
+++ trunk/Source/JavaScriptCore/debugger/DebuggerActivation.cpp        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -0,0 +1,98 @@
</span><ins>+/*
+ * Copyright (C) 2008, 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ * notice, this list of conditions and the following disclaimer in the
+ * documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "DebuggerActivation.h"
+
+#include "JSActivation.h"
+#include "JSCInlines.h"
+
+namespace JSC {
+
+STATIC_ASSERT_IS_TRIVIALLY_DESTRUCTIBLE(DebuggerActivation);
+
+const ClassInfo DebuggerActivation::s_info = { "DebuggerActivation", &Base::s_info, 0, 0, CREATE_METHOD_TABLE(DebuggerActivation) };
+
+DebuggerActivation::DebuggerActivation(VM& vm)
+ : JSNonFinalObject(vm, vm.debuggerActivationStructure.get())
+{
+}
+
+void DebuggerActivation::finishCreation(VM& vm, JSObject* activation)
+{
+ Base::finishCreation(vm);
+ ASSERT(activation);
+ ASSERT(activation->isActivationObject());
+ m_activation.set(vm, this, jsCast<JSActivation*>(activation));
+}
+
+void DebuggerActivation::visitChildren(JSCell* cell, SlotVisitor& visitor)
+{
+ DebuggerActivation* thisObject = jsCast<DebuggerActivation*>(cell);
+ ASSERT_GC_OBJECT_INHERITS(thisObject, info());
+ COMPILE_ASSERT(StructureFlags & OverridesVisitChildren, OverridesVisitChildrenWithoutSettingFlag);
+ ASSERT(thisObject->structure()->typeInfo().overridesVisitChildren());
+
+ JSObject::visitChildren(thisObject, visitor);
+ visitor.append(&thisObject->m_activation);
+}
+
+String DebuggerActivation::className(const JSObject* object)
+{
+ const DebuggerActivation* thisObject = jsCast<const DebuggerActivation*>(object);
+ return thisObject->m_activation->methodTable()->className(thisObject->m_activation.get());
+}
+
+bool DebuggerActivation::getOwnPropertySlot(JSObject* object, ExecState* exec, PropertyName propertyName, PropertySlot& slot)
+{
+ DebuggerActivation* thisObject = jsCast<DebuggerActivation*>(object);
+ return thisObject->m_activation->methodTable()->getOwnPropertySlot(thisObject->m_activation.get(), exec, propertyName, slot);
+}
+
+void DebuggerActivation::put(JSCell* cell, ExecState* exec, PropertyName propertyName, JSValue value, PutPropertySlot& slot)
+{
+ DebuggerActivation* thisObject = jsCast<DebuggerActivation*>(cell);
+ thisObject->m_activation->methodTable()->put(thisObject->m_activation.get(), exec, propertyName, value, slot);
+}
+
+bool DebuggerActivation::deleteProperty(JSCell* cell, ExecState* exec, PropertyName propertyName)
+{
+ DebuggerActivation* thisObject = jsCast<DebuggerActivation*>(cell);
+ return thisObject->m_activation->methodTable()->deleteProperty(thisObject->m_activation.get(), exec, propertyName);
+}
+
+void DebuggerActivation::getOwnPropertyNames(JSObject* object, ExecState* exec, PropertyNameArray& propertyNames, EnumerationMode mode)
+{
+ DebuggerActivation* thisObject = jsCast<DebuggerActivation*>(object);
+ thisObject->m_activation->methodTable()->getPropertyNames(thisObject->m_activation.get(), exec, propertyNames, mode);
+}
+
+bool DebuggerActivation::defineOwnProperty(JSObject* object, ExecState* exec, PropertyName propertyName, const PropertyDescriptor& descriptor, bool shouldThrow)
+{
+ DebuggerActivation* thisObject = jsCast<DebuggerActivation*>(object);
+ return thisObject->m_activation->methodTable()->defineOwnProperty(thisObject->m_activation.get(), exec, propertyName, descriptor, shouldThrow);
+}
+
+} // namespace JSC
</ins></span></pre></div>
<a id="trunkSourceJavaScriptCoredebuggerDebuggerActivationh"></a>
<div class="addfile"><h4>Added: trunk/Source/JavaScriptCore/debugger/DebuggerActivation.h (0 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/debugger/DebuggerActivation.h         (rev 0)
+++ trunk/Source/JavaScriptCore/debugger/DebuggerActivation.h        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -0,0 +1,71 @@
</span><ins>+/*
+ * Copyright (C) 2008, 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ * notice, this list of conditions and the following disclaimer in the
+ * documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef DebuggerActivation_h
+#define DebuggerActivation_h
+
+#include "JSObject.h"
+
+namespace JSC {
+
+class DebuggerActivation : public JSNonFinalObject {
+public:
+ typedef JSNonFinalObject Base;
+
+ static DebuggerActivation* create(VM& vm, JSObject* object)
+ {
+ DebuggerActivation* activation = new (NotNull, allocateCell<DebuggerActivation>(vm.heap)) DebuggerActivation(vm);
+ activation->finishCreation(vm, object);
+ return activation;
+ }
+
+ static void visitChildren(JSCell*, SlotVisitor&);
+ static String className(const JSObject*);
+ static bool getOwnPropertySlot(JSObject*, ExecState*, PropertyName, PropertySlot&);
+ static void put(JSCell*, ExecState*, PropertyName, JSValue, PutPropertySlot&);
+ static bool deleteProperty(JSCell*, ExecState*, PropertyName);
+ static void getOwnPropertyNames(JSObject*, ExecState*, PropertyNameArray&, EnumerationMode);
+ static bool defineOwnProperty(JSObject*, ExecState*, PropertyName, const PropertyDescriptor&, bool shouldThrow);
+
+ DECLARE_EXPORT_INFO;
+
+ static Structure* createStructure(VM& vm, JSGlobalObject* globalObject, JSValue prototype)
+ {
+ return Structure::create(vm, globalObject, prototype, TypeInfo(ObjectType, StructureFlags), info());
+ }
+
+protected:
+ static const unsigned StructureFlags = OverridesGetOwnPropertySlot | OverridesVisitChildren | JSObject::StructureFlags;
+
+ JS_EXPORT_PRIVATE void finishCreation(VM&, JSObject* activation);
+
+private:
+ JS_EXPORT_PRIVATE DebuggerActivation(VM&);
+ WriteBarrier<JSActivation> m_activation;
+};
+
+} // namespace JSC
+
+#endif // DebuggerActivation_h
</ins></span></pre></div>
<a id="trunkSourceJavaScriptCoredebuggerDebuggerScopecpp"></a>
<div class="delfile"><h4>Deleted: trunk/Source/JavaScriptCore/debugger/DebuggerScope.cpp (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/debugger/DebuggerScope.cpp        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/Source/JavaScriptCore/debugger/DebuggerScope.cpp        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -1,98 +0,0 @@
</span><del>-/*
- * Copyright (C) 2008-2009, 2014 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- * notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- * notice, this list of conditions and the following disclaimer in the
- * documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include "config.h"
-#include "DebuggerScope.h"
-
-#include "JSActivation.h"
-#include "JSCInlines.h"
-
-namespace JSC {
-
-STATIC_ASSERT_IS_TRIVIALLY_DESTRUCTIBLE(DebuggerScope);
-
-const ClassInfo DebuggerScope::s_info = { "DebuggerScope", &Base::s_info, 0, 0, CREATE_METHOD_TABLE(DebuggerScope) };
-
-DebuggerScope::DebuggerScope(VM& vm)
- : JSNonFinalObject(vm, vm.debuggerScopeStructure.get())
-{
-}
-
-void DebuggerScope::finishCreation(VM& vm, JSObject* activation)
-{
- Base::finishCreation(vm);
- ASSERT(activation);
- ASSERT(activation->isActivationObject());
- m_activation.set(vm, this, jsCast<JSActivation*>(activation));
-}
-
-void DebuggerScope::visitChildren(JSCell* cell, SlotVisitor& visitor)
-{
- DebuggerScope* thisObject = jsCast<DebuggerScope*>(cell);
- ASSERT_GC_OBJECT_INHERITS(thisObject, info());
- COMPILE_ASSERT(StructureFlags & OverridesVisitChildren, OverridesVisitChildrenWithoutSettingFlag);
- ASSERT(thisObject->structure()->typeInfo().overridesVisitChildren());
-
- JSObject::visitChildren(thisObject, visitor);
- visitor.append(&thisObject->m_activation);
-}
-
-String DebuggerScope::className(const JSObject* object)
-{
- const DebuggerScope* thisObject = jsCast<const DebuggerScope*>(object);
- return thisObject->m_activation->methodTable()->className(thisObject->m_activation.get());
-}
-
-bool DebuggerScope::getOwnPropertySlot(JSObject* object, ExecState* exec, PropertyName propertyName, PropertySlot& slot)
-{
- DebuggerScope* thisObject = jsCast<DebuggerScope*>(object);
- return thisObject->m_activation->methodTable()->getOwnPropertySlot(thisObject->m_activation.get(), exec, propertyName, slot);
-}
-
-void DebuggerScope::put(JSCell* cell, ExecState* exec, PropertyName propertyName, JSValue value, PutPropertySlot& slot)
-{
- DebuggerScope* thisObject = jsCast<DebuggerScope*>(cell);
- thisObject->m_activation->methodTable()->put(thisObject->m_activation.get(), exec, propertyName, value, slot);
-}
-
-bool DebuggerScope::deleteProperty(JSCell* cell, ExecState* exec, PropertyName propertyName)
-{
- DebuggerScope* thisObject = jsCast<DebuggerScope*>(cell);
- return thisObject->m_activation->methodTable()->deleteProperty(thisObject->m_activation.get(), exec, propertyName);
-}
-
-void DebuggerScope::getOwnPropertyNames(JSObject* object, ExecState* exec, PropertyNameArray& propertyNames, EnumerationMode mode)
-{
- DebuggerScope* thisObject = jsCast<DebuggerScope*>(object);
- thisObject->m_activation->methodTable()->getPropertyNames(thisObject->m_activation.get(), exec, propertyNames, mode);
-}
-
-bool DebuggerScope::defineOwnProperty(JSObject* object, ExecState* exec, PropertyName propertyName, const PropertyDescriptor& descriptor, bool shouldThrow)
-{
- DebuggerScope* thisObject = jsCast<DebuggerScope*>(object);
- return thisObject->m_activation->methodTable()->defineOwnProperty(thisObject->m_activation.get(), exec, propertyName, descriptor, shouldThrow);
-}
-
-} // namespace JSC
</del></span></pre></div>
<a id="trunkSourceJavaScriptCoredebuggerDebuggerScopeh"></a>
<div class="delfile"><h4>Deleted: trunk/Source/JavaScriptCore/debugger/DebuggerScope.h (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/debugger/DebuggerScope.h        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/Source/JavaScriptCore/debugger/DebuggerScope.h        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -1,71 +0,0 @@
</span><del>-/*
- * Copyright (C) 2008-2009, 2014 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- * notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- * notice, this list of conditions and the following disclaimer in the
- * documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#ifndef DebuggerScope_h
-#define DebuggerScope_h
-
-#include "JSObject.h"
-
-namespace JSC {
-
-class DebuggerScope : public JSNonFinalObject {
-public:
- typedef JSNonFinalObject Base;
-
- static DebuggerScope* create(VM& vm, JSObject* object)
- {
- DebuggerScope* activation = new (NotNull, allocateCell<DebuggerScope>(vm.heap)) DebuggerScope(vm);
- activation->finishCreation(vm, object);
- return activation;
- }
-
- static void visitChildren(JSCell*, SlotVisitor&);
- static String className(const JSObject*);
- static bool getOwnPropertySlot(JSObject*, ExecState*, PropertyName, PropertySlot&);
- static void put(JSCell*, ExecState*, PropertyName, JSValue, PutPropertySlot&);
- static bool deleteProperty(JSCell*, ExecState*, PropertyName);
- static void getOwnPropertyNames(JSObject*, ExecState*, PropertyNameArray&, EnumerationMode);
- static bool defineOwnProperty(JSObject*, ExecState*, PropertyName, const PropertyDescriptor&, bool shouldThrow);
-
- DECLARE_EXPORT_INFO;
-
- static Structure* createStructure(VM& vm, JSGlobalObject* globalObject, JSValue prototype)
- {
- return Structure::create(vm, globalObject, prototype, TypeInfo(ObjectType, StructureFlags), info());
- }
-
-protected:
- static const unsigned StructureFlags = OverridesGetOwnPropertySlot | OverridesVisitChildren | JSObject::StructureFlags;
-
- JS_EXPORT_PRIVATE void finishCreation(VM&, JSObject* activation);
-
-private:
- JS_EXPORT_PRIVATE DebuggerScope(VM&);
- WriteBarrier<JSActivation> m_activation;
-};
-
-} // namespace JSC
-
-#endif // DebuggerScope_h
</del></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGAbstractInterpreterInlinesh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -1388,45 +1388,46 @@
</span><span class="cx"> break;
</span><span class="cx">
</span><span class="cx"> case GetById:
</span><del>- case GetByIdFlush: {
</del><ins>+ case GetByIdFlush:
</ins><span class="cx"> if (!node->prediction()) {
</span><span class="cx"> m_state.setIsValid(false);
</span><span class="cx"> break;
</span><span class="cx"> }
</span><del>-
- AbstractValue& value = forNode(node->child1());
- if (!value.m_structure.isTop() && !value.m_structure.isClobbered()
- && (node->child1().useKind() == CellUse || !(value.m_type & ~SpecCell))) {
- GetByIdStatus status = GetByIdStatus::computeFor(
- m_graph.m_vm, value.m_structure.set(),
- m_graph.identifiers()[node->identifierNumber()]);
- if (status.isSimple()) {
- // Figure out what the result is going to be - is it TOP, a constant, or maybe
- // something more subtle?
- AbstractValue result;
- for (unsigned i = status.numVariants(); i--;) {
- if (!status[i].specificValue()) {
- result.makeHeapTop();
- break;
- }
</del><ins>+ if (isCellSpeculation(node->child1()->prediction())) {
+ // This use of onlyStructure() should be replaced by giving GetByIdStatus the ability
+ // to compute things based on a StructureSet, and then to factor ByteCodeParser's
+ // ability to generate code based on a GetByIdStatus out of ByteCodeParser so that
+ // ConstantFoldingPhase can use it.
+ // https://bugs.webkit.org/show_bug.cgi?id=133229
+ if (Structure* structure = forNode(node->child1()).m_structure.onlyStructure()) {
+ GetByIdStatus status = GetByIdStatus::computeFor(
+ m_graph.m_vm, structure,
+ m_graph.identifiers()[node->identifierNumber()]);
+ if (status.isSimple() && status.numVariants() == 1) {
+ // Assert things that we can't handle and that the computeFor() method
+ // above won't be able to return.
+ ASSERT(status[0].structureSet().size() == 1);
+ ASSERT(status[0].constantChecks().isEmpty());
+ ASSERT(!status[0].alternateBase());
</ins><span class="cx">
</span><del>- AbstractValue thisResult;
- thisResult.set(
- m_graph, *m_graph.freeze(status[i].specificValue()),
- m_state.structureClobberState());
- result.merge(thisResult);
- }
- if (status.numVariants() == 1 || isFTL(m_graph.m_plan.mode))
</del><ins>+ if (status[0].specificValue()) {
+ if (status[0].specificValue().isCell()) {
+ Structure* structure = status[0].specificValue().asCell()->structure();
+ m_graph.watchpoints().consider(structure);
+ }
+ setConstant(node, *m_graph.freeze(status[0].specificValue()));
+ } else
+ forNode(node).makeHeapTop();
+ filter(node->child1(), status[0].structureSet());
+
</ins><span class="cx"> m_state.setFoundConstants(true);
</span><del>- forNode(node) = result;
- break;
</del><ins>+ break;
+ }
</ins><span class="cx"> }
</span><span class="cx"> }
</span><del>-
</del><span class="cx"> clobberWorld(node->origin.semantic, clobberLimit);
</span><span class="cx"> forNode(node).makeHeapTop();
</span><span class="cx"> break;
</span><del>- }
</del><span class="cx">
</span><span class="cx"> case GetArrayLength:
</span><span class="cx"> forNode(node).setType(SpecInt32);
</span><span class="lines">@@ -1461,14 +1462,11 @@
</span><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> case PutStructure:
</span><ins>+ case PhantomPutStructure:
</ins><span class="cx"> if (!forNode(node->child1()).m_structure.isClear()) {
</span><del>- if (forNode(node->child1()).m_structure.onlyStructure() == node->transition()->next)
- m_state.setFoundConstants(true);
- else {
- observeTransition(
- clobberLimit, node->transition()->previous, node->transition()->next);
- forNode(node->child1()).changeStructure(m_graph, node->transition()->next);
- }
</del><ins>+ observeTransition(
+ clobberLimit, node->transition()->previous, node->transition()->next);
+ forNode(node->child1()).set(m_graph, node->transition()->next);
</ins><span class="cx"> }
</span><span class="cx"> break;
</span><span class="cx"> case GetButterfly:
</span><span class="lines">@@ -1597,45 +1595,39 @@
</span><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> case MultiGetByOffset: {
</span><del>- // This code will filter the base value in a manner that is possibly different (either more
- // or less precise) than the way it would be filtered if this was strength-reduced to a
- // CheckStructure. This is fine. It's legal for different passes over the code to prove
- // different things about the code, so long as all of them are sound. That even includes
- // one guy proving that code should never execute (due to a contradiction) and another guy
- // not finding that contradiction. If someone ever proved that there would be a
- // contradiction then there must always be a contradiction even if subsequent passes don't
- // realize it. This is the case here.
-
- // Ordinarily you have to be careful with calling setFoundConstants()
- // because of the effect on compile times, but this node is FTL-only.
- m_state.setFoundConstants(true);
-
- AbstractValue base = forNode(node->child1());
- StructureSet baseSet;
- AbstractValue result;
- for (unsigned i = node->multiGetByOffsetData().variants.size(); i--;) {
- GetByIdVariant& variant = node->multiGetByOffsetData().variants[i];
- StructureSet set = variant.structureSet();
- set.filter(base);
- if (set.isEmpty())
- continue;
- baseSet.merge(set);
- if (!variant.specificValue()) {
- result.makeHeapTop();
- continue;
</del><ins>+ AbstractValue& value = forNode(node->child1());
+ ASSERT(!(value.m_type & ~SpecCell)); // Edge filtering should have already ensured this.
+
+ // This should just filter down the cases in MultiGetByOffset. If that results in all
+ // cases having the same offset then we should strength reduce it to a CheckStructure +
+ // GetByOffset.
+ // https://bugs.webkit.org/show_bug.cgi?id=133229
+ if (Structure* structure = value.m_structure.onlyStructure()) {
+ bool done = false;
+ for (unsigned i = node->multiGetByOffsetData().variants.size(); i--;) {
+ const GetByIdVariant& variant = node->multiGetByOffsetData().variants[i];
+ if (!variant.structureSet().contains(structure))
+ continue;
+
+ if (variant.alternateBase())
+ break;
+
+ filter(value, structure);
+ forNode(node).makeHeapTop();
+ m_state.setFoundConstants(true);
+ done = true;
+ break;
</ins><span class="cx"> }
</span><del>- AbstractValue thisResult;
- thisResult.set(
- m_graph,
- *m_graph.freeze(variant.specificValue()),
- m_state.structureClobberState());
- result.merge(thisResult);
</del><ins>+ if (done)
+ break;
</ins><span class="cx"> }
</span><span class="cx">
</span><del>- if (forNode(node->child1()).changeStructure(m_graph, baseSet) == Contradiction)
- m_state.setIsValid(false);
</del><ins>+ StructureSet set;
+ for (unsigned i = node->multiGetByOffsetData().variants.size(); i--;)
+ set.merge(node->multiGetByOffsetData().variants[i].structureSet());
</ins><span class="cx">
</span><del>- forNode(node) = result;
</del><ins>+ filter(node->child1(), set);
+ forNode(node).makeHeapTop();
</ins><span class="cx"> break;
</span><span class="cx"> }
</span><span class="cx">
</span><span class="lines">@@ -1644,36 +1636,57 @@
</span><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> case MultiPutByOffset: {
</span><ins>+ AbstractValue& value = forNode(node->child1());
+ ASSERT(!(value.m_type & ~SpecCell)); // Edge filtering should have already ensured this.
+
+ // This should just filter down the cases in MultiPutByOffset. If that results in either
+ // one case, or nothing but replace cases and they have the same offset, then we should
+ // just strength reduce it to the appropriate combination of CheckStructure,
+ // [Re]AllocatePropertyStorage, PutStructure, and PutByOffset.
+ // https://bugs.webkit.org/show_bug.cgi?id=133229
+ if (Structure* structure = value.m_structure.onlyStructure()) {
+ bool done = false;
+ for (unsigned i = node->multiPutByOffsetData().variants.size(); i--;) {
+ const PutByIdVariant& variant = node->multiPutByOffsetData().variants[i];
+ if (variant.oldStructure() != structure)
+ continue;
+
+ if (variant.kind() == PutByIdVariant::Replace) {
+ filter(node->child1(), structure);
+ m_state.setFoundConstants(true);
+ done = true;
+ break;
+ }
+
+ ASSERT(variant.kind() == PutByIdVariant::Transition);
+ clobberStructures(clobberLimit);
+ forNode(node->child1()).set(m_graph, variant.newStructure());
+ m_state.setFoundConstants(true);
+ done = true;
+ break;
+ }
+ if (done)
+ break;
+ }
+
+ StructureSet oldSet;
</ins><span class="cx"> StructureSet newSet;
</span><span class="cx"> TransitionVector transitions;
</span><del>-
- // Ordinarily you have to be careful with calling setFoundConstants()
- // because of the effect on compile times, but this node is FTL-only.
- m_state.setFoundConstants(true);
-
- AbstractValue base = forNode(node->child1());
-
</del><span class="cx"> for (unsigned i = node->multiPutByOffsetData().variants.size(); i--;) {
</span><span class="cx"> const PutByIdVariant& variant = node->multiPutByOffsetData().variants[i];
</span><del>- StructureSet thisSet = variant.oldStructure();
- thisSet.filter(base);
- if (thisSet.isEmpty())
- continue;
</del><ins>+ oldSet.add(variant.oldStructure());
</ins><span class="cx"> if (variant.kind() == PutByIdVariant::Transition) {
</span><del>- if (thisSet.onlyStructure() != variant.newStructure()) {
- transitions.append(
- Transition(variant.oldStructureForTransition(), variant.newStructure()));
- } // else this is really a replace.
</del><ins>+ transitions.append(Transition(variant.oldStructure(), variant.newStructure()));
</ins><span class="cx"> newSet.add(variant.newStructure());
</span><span class="cx"> } else {
</span><span class="cx"> ASSERT(variant.kind() == PutByIdVariant::Replace);
</span><del>- newSet.merge(thisSet);
</del><ins>+ newSet.add(variant.oldStructure());
</ins><span class="cx"> }
</span><span class="cx"> }
</span><span class="cx">
</span><ins>+ filter(node->child1(), oldSet);
</ins><span class="cx"> observeTransitions(clobberLimit, transitions);
</span><del>- if (forNode(node->child1()).changeStructure(m_graph, newSet) == Contradiction)
- m_state.setIsValid(false);
</del><ins>+ forNode(node->child1()).set(m_graph, newSet);
</ins><span class="cx"> break;
</span><span class="cx"> }
</span><span class="cx">
</span><span class="lines">@@ -1702,47 +1715,37 @@
</span><span class="cx">
</span><span class="cx"> case PutById:
</span><span class="cx"> case PutByIdFlush:
</span><del>- case PutByIdDirect: {
- AbstractValue& value = forNode(node->child1());
- if (!value.m_structure.isTop() && !value.m_structure.isClobbered()) {
</del><ins>+ case PutByIdDirect:
+ // This use of onlyStructure() should be replaced by giving PutByIdStatus the ability
+ // to compute things based on a StructureSet, and then to factor ByteCodeParser's
+ // ability to generate code based on a PutByIdStatus out of ByteCodeParser so that
+ // ConstantFoldingPhase can use it.
+ // https://bugs.webkit.org/show_bug.cgi?id=133229
+ if (Structure* structure = forNode(node->child1()).m_structure.onlyStructure()) {
</ins><span class="cx"> PutByIdStatus status = PutByIdStatus::computeFor(
</span><span class="cx"> m_graph.m_vm,
</span><span class="cx"> m_graph.globalObjectFor(node->origin.semantic),
</span><del>- value.m_structure.set(),
</del><ins>+ structure,
</ins><span class="cx"> m_graph.identifiers()[node->identifierNumber()],
</span><span class="cx"> node->op() == PutByIdDirect);
</span><del>-
- if (status.isSimple()) {
- StructureSet newSet;
- TransitionVector transitions;
-
- for (unsigned i = status.numVariants(); i--;) {
- const PutByIdVariant& variant = status[i];
- if (variant.kind() == PutByIdVariant::Transition) {
- transitions.append(
- Transition(
- variant.oldStructureForTransition(), variant.newStructure()));
- m_graph.watchpoints().consider(variant.newStructure());
- newSet.add(variant.newStructure());
- } else {
- ASSERT(variant.kind() == PutByIdVariant::Replace);
- newSet.merge(variant.oldStructure());
- }
</del><ins>+ if (status.isSimple() && status.numVariants() == 1) {
+ if (status[0].kind() == PutByIdVariant::Replace) {
+ filter(node->child1(), structure);
+ m_state.setFoundConstants(true);
+ break;
</ins><span class="cx"> }
</span><del>-
- if (status.numVariants() == 1 || isFTL(m_graph.m_plan.mode))
</del><ins>+ if (status[0].kind() == PutByIdVariant::Transition
+ && structure->transitionWatchpointSetHasBeenInvalidated()) {
+ m_graph.watchpoints().consider(status[0].newStructure());
+ clobberStructures(clobberLimit);
+ forNode(node->child1()).set(m_graph, status[0].newStructure());
</ins><span class="cx"> m_state.setFoundConstants(true);
</span><del>-
- observeTransitions(clobberLimit, transitions);
- if (forNode(node->child1()).changeStructure(m_graph, newSet) == Contradiction)
- m_state.setIsValid(false);
- break;
</del><ins>+ break;
+ }
</ins><span class="cx"> }
</span><span class="cx"> }
</span><del>-
</del><span class="cx"> clobberWorld(node->origin.semantic, clobberLimit);
</span><span class="cx"> break;
</span><del>- }
</del><span class="cx">
</span><span class="cx"> case In:
</span><span class="cx"> // FIXME: We can determine when the property definitely exists based on abstract
</span><span class="lines">@@ -1945,8 +1948,7 @@
</span><span class="cx"> {
</span><span class="cx"> AbstractValue::TransitionObserver transitionObserver(from, to);
</span><span class="cx"> forAllValues(clobberLimit, transitionObserver);
</span><del>-
- ASSERT(!from->dfgShouldWatch()); // We don't need to claim to be in a clobbered state because 'from' was never watchable (during the time we were compiling), hence no constants ever introduced into the DFG IR that ever had a watchable structure would ever have the same structure as from.
</del><ins>+ setDidClobber();
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> template<typename AbstractStateType>
</span><span class="lines">@@ -1955,12 +1957,7 @@
</span><span class="cx"> {
</span><span class="cx"> AbstractValue::TransitionsObserver transitionsObserver(vector);
</span><span class="cx"> forAllValues(clobberLimit, transitionsObserver);
</span><del>-
- if (!ASSERT_DISABLED) {
- // We don't need to claim to be in a clobbered state because none of the Transition::previous structures are watchable.
- for (unsigned i = vector.size(); i--;)
- ASSERT(!vector[i].previous->dfgShouldWatch());
- }
</del><ins>+ setDidClobber();
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> template<typename AbstractStateType>
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGAbstractValuecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGAbstractValue.cpp (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGAbstractValue.cpp        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/Source/JavaScriptCore/dfg/DFGAbstractValue.cpp        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -191,17 +191,6 @@
</span><span class="cx"> return normalizeClarity(graph);
</span><span class="cx"> }
</span><span class="cx">
</span><del>-FiltrationResult AbstractValue::changeStructure(Graph& graph, const StructureSet& other)
-{
- m_type &= other.speculationFromStructures();
- m_arrayModes = other.arrayModesFromStructures();
- m_structure = other;
-
- filterValueByType();
-
- return normalizeClarity(graph);
-}
-
</del><span class="cx"> FiltrationResult AbstractValue::filterArrayModes(ArrayModes arrayModes)
</span><span class="cx"> {
</span><span class="cx"> ASSERT(arrayModes);
</span><span class="lines">@@ -252,13 +241,6 @@
</span><span class="cx"> return result;
</span><span class="cx"> }
</span><span class="cx">
</span><del>-bool AbstractValue::contains(Structure* structure) const
-{
- return couldBeType(speculationFromStructure(structure))
- && (m_arrayModes & arrayModeFromStructure(structure))
- && m_structure.contains(structure);
-}
-
</del><span class="cx"> FiltrationResult AbstractValue::filter(const AbstractValue& other)
</span><span class="cx"> {
</span><span class="cx"> m_type &= other.m_type;
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGAbstractValueh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGAbstractValue.h (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGAbstractValue.h        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/Source/JavaScriptCore/dfg/DFGAbstractValue.h        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -267,12 +267,12 @@
</span><span class="cx"> checkConsistency();
</span><span class="cx"> }
</span><span class="cx">
</span><del>- bool couldBeType(SpeculatedType desiredType) const
</del><ins>+ bool couldBeType(SpeculatedType desiredType)
</ins><span class="cx"> {
</span><span class="cx"> return !!(m_type & desiredType);
</span><span class="cx"> }
</span><span class="cx">
</span><del>- bool isType(SpeculatedType desiredType) const
</del><ins>+ bool isType(SpeculatedType desiredType)
</ins><span class="cx"> {
</span><span class="cx"> return !(m_type & ~desiredType);
</span><span class="cx"> }
</span><span class="lines">@@ -283,10 +283,6 @@
</span><span class="cx"> FiltrationResult filterByValue(const FrozenValue& value);
</span><span class="cx"> FiltrationResult filter(const AbstractValue&);
</span><span class="cx">
</span><del>- FiltrationResult changeStructure(Graph&, const StructureSet&);
-
- bool contains(Structure*) const;
-
</del><span class="cx"> bool validate(JSValue value) const
</span><span class="cx"> {
</span><span class="cx"> if (isHeapTop())
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGByteCodeParsercpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -1891,19 +1891,20 @@
</span><span class="cx"> addToGraph(CheckStructure, OpInfo(m_graph.addStructureSet(variant.oldStructure())), base);
</span><span class="cx"> emitChecks(variant.constantChecks());
</span><span class="cx">
</span><del>- ASSERT(variant.oldStructureForTransition()->transitionWatchpointSetHasBeenInvalidated());
</del><ins>+ ASSERT(variant.oldStructure()->transitionWatchpointSetHasBeenInvalidated());
</ins><span class="cx">
</span><span class="cx"> Node* propertyStorage;
</span><span class="cx"> Transition* transition = m_graph.m_transitions.add(
</span><del>- variant.oldStructureForTransition(), variant.newStructure());
</del><ins>+ variant.oldStructure(), variant.newStructure());
</ins><span class="cx">
</span><del>- if (variant.reallocatesStorage()) {
</del><ins>+ if (variant.oldStructure()->outOfLineCapacity()
+ != variant.newStructure()->outOfLineCapacity()) {
</ins><span class="cx">
</span><span class="cx"> // If we're growing the property storage then it must be because we're
</span><span class="cx"> // storing into the out-of-line storage.
</span><span class="cx"> ASSERT(!isInlineOffset(variant.offset()));
</span><span class="cx">
</span><del>- if (!variant.oldStructureForTransition()->outOfLineCapacity()) {
</del><ins>+ if (!variant.oldStructure()->outOfLineCapacity()) {
</ins><span class="cx"> propertyStorage = addToGraph(
</span><span class="cx"> AllocatePropertyStorage, OpInfo(transition), base);
</span><span class="cx"> } else {
</span><span class="lines">@@ -2035,8 +2036,7 @@
</span><span class="cx"> Node* op1 = getThis();
</span><span class="cx"> if (op1->op() != ToThis) {
</span><span class="cx"> Structure* cachedStructure = currentInstruction[2].u.structure.get();
</span><del>- if (currentInstruction[2].u.toThisStatus != ToThisOK
- || !cachedStructure
</del><ins>+ if (!cachedStructure
</ins><span class="cx"> || cachedStructure->classInfo()->methodTable.toThis != JSObject::info()->methodTable.toThis
</span><span class="cx"> || m_inlineStackTop->m_profiledBlock->couldTakeSlowCase(m_currentIndex)
</span><span class="cx"> || m_inlineStackTop->m_exitProfile.hasExitSite(m_currentIndex, BadCache)
</span><span class="lines">@@ -2886,9 +2886,7 @@
</span><span class="cx"> case GlobalPropertyWithVarInjectionChecks: {
</span><span class="cx"> SpeculatedType prediction = getPrediction();
</span><span class="cx"> GetByIdStatus status = GetByIdStatus::computeFor(*m_vm, structure, uid);
</span><del>- if (status.state() != GetByIdStatus::Simple
- || status.numVariants() != 1
- || status[0].structureSet().size() != 1) {
</del><ins>+ if (status.state() != GetByIdStatus::Simple || status.numVariants() != 1) {
</ins><span class="cx"> set(VirtualRegister(dst), addToGraph(GetByIdFlush, OpInfo(identifierNumber), OpInfo(prediction), get(VirtualRegister(scope))));
</span><span class="cx"> break;
</span><span class="cx"> }
</span><span class="lines">@@ -2973,14 +2971,11 @@
</span><span class="cx"> case GlobalProperty:
</span><span class="cx"> case GlobalPropertyWithVarInjectionChecks: {
</span><span class="cx"> PutByIdStatus status = PutByIdStatus::computeFor(*m_vm, globalObject, structure, uid, false);
</span><del>- if (status.numVariants() != 1
- || status[0].kind() != PutByIdVariant::Replace
- || status[0].structure().size() != 1) {
</del><ins>+ if (status.numVariants() != 1 || status[0].kind() != PutByIdVariant::Replace) {
</ins><span class="cx"> addToGraph(PutById, OpInfo(identifierNumber), get(VirtualRegister(scope)), get(VirtualRegister(value)));
</span><span class="cx"> break;
</span><span class="cx"> }
</span><del>- ASSERT(status[0].structure().onlyStructure() == structure);
- Node* base = cellConstantWithStructureCheck(globalObject, structure);
</del><ins>+ Node* base = cellConstantWithStructureCheck(globalObject, status[0].structure());
</ins><span class="cx"> addToGraph(Phantom, get(VirtualRegister(scope)));
</span><span class="cx"> handlePutByOffset(base, identifierNumber, static_cast<PropertyOffset>(operand), get(VirtualRegister(value)));
</span><span class="cx"> // Keep scope alive until after put.
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGClobberizeh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGClobberize.h (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGClobberize.h        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/Source/JavaScriptCore/dfg/DFGClobberize.h        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -440,6 +440,7 @@
</span><span class="cx"> return;
</span><span class="cx">
</span><span class="cx"> case PutStructure:
</span><ins>+ case PhantomPutStructure:
</ins><span class="cx"> write(JSCell_structureID);
</span><span class="cx"> write(JSCell_typeInfoType);
</span><span class="cx"> write(JSCell_typeInfoFlags);
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGConstantFoldingPhasecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGConstantFoldingPhase.cpp (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGConstantFoldingPhase.cpp        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/Source/JavaScriptCore/dfg/DFGConstantFoldingPhase.cpp        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -132,15 +132,6 @@
</span><span class="cx"> break;
</span><span class="cx"> }
</span><span class="cx">
</span><del>- case PutStructure: {
- if (m_state.forNode(node->child1()).m_structure.onlyStructure() != node->transition()->next)
- break;
-
- node->convertToPhantom();
- eliminated = true;
- break;
- }
-
</del><span class="cx"> case CheckFunction: {
</span><span class="cx"> if (m_state.forNode(node->child1()).value() != node->function()->value())
</span><span class="cx"> break;
</span><span class="lines">@@ -163,69 +154,47 @@
</span><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> case MultiGetByOffset: {
</span><del>- Edge baseEdge = node->child1();
- Node* base = baseEdge.node();
</del><ins>+ Edge childEdge = node->child1();
+ Node* child = childEdge.node();
</ins><span class="cx"> MultiGetByOffsetData& data = node->multiGetByOffsetData();
</span><span class="cx">
</span><del>- // First prune the variants, then check if the MultiGetByOffset can be
- // strength-reduced to a GetByOffset.
-
- AbstractValue baseValue = m_state.forNode(base);
-
- m_interpreter.execute(indexInBlock); // Push CFA over this node after we get the state before.
- eliminated = true; // Don't allow the default constant folder to do things to this.
-
- for (unsigned i = 0; i < data.variants.size(); ++i) {
- GetByIdVariant& variant = data.variants[i];
- variant.structureSet().filter(baseValue);
- if (variant.structureSet().isEmpty()) {
- data.variants[i--] = data.variants.last();
- data.variants.removeLast();
- }
- }
-
- if (data.variants.size() != 1)
</del><ins>+ Structure* structure = m_state.forNode(child).m_structure.onlyStructure();
+ if (!structure)
</ins><span class="cx"> break;
</span><span class="cx">
</span><del>- emitGetByOffset(
- indexInBlock, node, baseValue, data.variants[0], data.identifierNumber);
</del><ins>+ for (unsigned i = data.variants.size(); i--;) {
+ const GetByIdVariant& variant = data.variants[i];
+ if (!variant.structureSet().contains(structure))
+ continue;
+
+ if (variant.alternateBase())
+ break;
+
+ emitGetByOffset(indexInBlock, node, structure, variant, data.identifierNumber);
+ eliminated = true;
+ break;
+ }
</ins><span class="cx"> break;
</span><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> case MultiPutByOffset: {
</span><del>- Edge baseEdge = node->child1();
- Node* base = baseEdge.node();
</del><ins>+ Edge childEdge = node->child1();
+ Node* child = childEdge.node();
</ins><span class="cx"> MultiPutByOffsetData& data = node->multiPutByOffsetData();
</span><del>-
- AbstractValue baseValue = m_state.forNode(base);
</del><span class="cx">
</span><del>- m_interpreter.execute(indexInBlock); // Push CFA over this node after we get the state before.
- eliminated = true; // Don't allow the default constant folder to do things to this.
</del><ins>+ Structure* structure = m_state.forNode(child).m_structure.onlyStructure();
+ if (!structure)
+ break;
</ins><span class="cx">
</span><del>-
- for (unsigned i = 0; i < data.variants.size(); ++i) {
- PutByIdVariant& variant = data.variants[i];
- variant.oldStructure().filter(baseValue);
-
- if (variant.oldStructure().isEmpty()) {
- data.variants[i--] = data.variants.last();
- data.variants.removeLast();
</del><ins>+ for (unsigned i = data.variants.size(); i--;) {
+ const PutByIdVariant& variant = data.variants[i];
+ if (variant.oldStructure() != structure)
</ins><span class="cx"> continue;
</span><del>- }
</del><span class="cx">
</span><del>- if (variant.kind() == PutByIdVariant::Transition
- && variant.oldStructure().onlyStructure() == variant.newStructure()) {
- variant = PutByIdVariant::replace(
- variant.oldStructure(),
- variant.offset());
- }
- }
-
- if (data.variants.size() != 1)
</del><ins>+ emitPutByOffset(indexInBlock, node, structure, variant, data.identifierNumber);
+ eliminated = true;
</ins><span class="cx"> break;
</span><del>-
- emitPutByOffset(
- indexInBlock, node, baseValue, data.variants[0], data.identifierNumber);
</del><ins>+ }
</ins><span class="cx"> break;
</span><span class="cx"> }
</span><span class="cx">
</span><span class="lines">@@ -235,47 +204,30 @@
</span><span class="cx"> Node* child = childEdge.node();
</span><span class="cx"> unsigned identifierNumber = node->identifierNumber();
</span><span class="cx">
</span><del>- AbstractValue baseValue = m_state.forNode(child);
-
- m_interpreter.execute(indexInBlock); // Push CFA over this node after we get the state before.
- eliminated = true; // Don't allow the default constant folder to do things to this.
-
- if (baseValue.m_structure.isTop() || baseValue.m_structure.isClobbered()
- || (node->child1().useKind() == UntypedUse || (baseValue.m_type & ~SpecCell)))
</del><ins>+ if (childEdge.useKind() != CellUse)
</ins><span class="cx"> break;
</span><span class="cx">
</span><del>- GetByIdStatus status = GetByIdStatus::computeFor(
- vm(), baseValue.m_structure.set(), m_graph.identifiers()[identifierNumber]);
- if (!status.isSimple())
</del><ins>+ Structure* structure = m_state.forNode(child).m_structure.onlyStructure();
+ if (!structure)
</ins><span class="cx"> break;
</span><ins>+
+ GetByIdStatus status = GetByIdStatus::computeFor(
+ vm(), structure, m_graph.identifiers()[identifierNumber]);
</ins><span class="cx">
</span><del>- for (unsigned i = status.numVariants(); i--;) {
- if (!status[i].constantChecks().isEmpty()
- || status[i].alternateBase()) {
- // FIXME: We could handle prototype cases.
- // https://bugs.webkit.org/show_bug.cgi?id=110386
- break;
- }
- }
-
- if (status.numVariants() == 1) {
- emitGetByOffset(indexInBlock, node, baseValue, status[0], identifierNumber);
</del><ins>+ if (!status.isSimple() || status.numVariants() != 1 ||
+ !status[0].constantChecks().isEmpty() || status[0].alternateBase()) {
+ // FIXME: We could handle prototype cases.
+ // https://bugs.webkit.org/show_bug.cgi?id=110386
</ins><span class="cx"> break;
</span><span class="cx"> }
</span><span class="cx">
</span><del>- if (!isFTL(m_graph.m_plan.mode))
- break;
-
- MultiGetByOffsetData* data = m_graph.m_multiGetByOffsetData.add();
- data->variants = status.variants();
- data->identifierNumber = identifierNumber;
- node->convertToMultiGetByOffset(data);
</del><ins>+ emitGetByOffset(indexInBlock, node, structure, status[0], identifierNumber);
+ eliminated = true;
</ins><span class="cx"> break;
</span><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> case PutById:
</span><del>- case PutByIdDirect:
- case PutByIdFlush: {
</del><ins>+ case PutByIdDirect: {
</ins><span class="cx"> NodeOrigin origin = node->origin;
</span><span class="cx"> Edge childEdge = node->child1();
</span><span class="cx"> Node* child = childEdge.node();
</span><span class="lines">@@ -283,39 +235,24 @@
</span><span class="cx">
</span><span class="cx"> ASSERT(childEdge.useKind() == CellUse);
</span><span class="cx">
</span><del>- AbstractValue baseValue = m_state.forNode(child);
-
- m_interpreter.execute(indexInBlock); // Push CFA over this node after we get the state before.
- eliminated = true; // Don't allow the default constant folder to do things to this.
-
- if (baseValue.m_structure.isTop() || baseValue.m_structure.isClobbered())
</del><ins>+ Structure* structure = m_state.forNode(child).m_structure.onlyStructure();
+ if (!structure)
</ins><span class="cx"> break;
</span><span class="cx">
</span><span class="cx"> PutByIdStatus status = PutByIdStatus::computeFor(
</span><span class="cx"> vm(),
</span><span class="cx"> m_graph.globalObjectFor(origin.semantic),
</span><del>- baseValue.m_structure.set(),
</del><ins>+ structure,
</ins><span class="cx"> m_graph.identifiers()[identifierNumber],
</span><span class="cx"> node->op() == PutByIdDirect);
</span><span class="cx">
</span><span class="cx"> if (!status.isSimple())
</span><span class="cx"> break;
</span><del>-
- for (unsigned i = status.numVariants(); i--;)
- addChecks(origin, indexInBlock, status[i].constantChecks());
-
- if (status.numVariants() == 1) {
- emitPutByOffset(indexInBlock, node, baseValue, status[0], identifierNumber);
</del><ins>+ if (status.numVariants() != 1)
</ins><span class="cx"> break;
</span><del>- }
</del><span class="cx">
</span><del>- if (!isFTL(m_graph.m_plan.mode))
- break;
-
- MultiPutByOffsetData* data = m_graph.m_multiPutByOffsetData.add();
- data->variants = status.variants();
- data->identifierNumber = identifierNumber;
- node->convertToMultiPutByOffset(data);
</del><ins>+ emitPutByOffset(indexInBlock, node, structure, status[0], identifierNumber);
+ eliminated = true;
</ins><span class="cx"> break;
</span><span class="cx"> }
</span><span class="cx">
</span><span class="lines">@@ -406,24 +343,33 @@
</span><span class="cx"> return changed;
</span><span class="cx"> }
</span><span class="cx">
</span><del>- void emitGetByOffset(unsigned indexInBlock, Node* node, const AbstractValue& baseValue, const GetByIdVariant& variant, unsigned identifierNumber)
</del><ins>+ void emitGetByOffset(unsigned indexInBlock, Node* node, Structure* structure, const GetByIdVariant& variant, unsigned identifierNumber)
</ins><span class="cx"> {
</span><span class="cx"> NodeOrigin origin = node->origin;
</span><span class="cx"> Edge childEdge = node->child1();
</span><span class="cx"> Node* child = childEdge.node();
</span><span class="cx">
</span><del>- addBaseCheck(indexInBlock, node, baseValue, variant.structureSet());
</del><ins>+ bool needsCellCheck = m_state.forNode(child).m_type & ~SpecCell;
</ins><span class="cx">
</span><ins>+ ASSERT(!variant.alternateBase());
+ ASSERT_UNUSED(structure, variant.structureSet().contains(structure));
+
+ // Now before we do anything else, push the CFA forward over the GetById
+ // and make sure we signal to the loop that it should continue and not
+ // do any eliminations.
+ m_interpreter.execute(indexInBlock);
+
+ if (needsCellCheck) {
+ m_insertionSet.insertNode(
+ indexInBlock, SpecNone, Phantom, origin, childEdge);
+ }
+
</ins><span class="cx"> if (variant.specificValue()) {
</span><span class="cx"> m_graph.convertToConstant(node, m_graph.freeze(variant.specificValue()));
</span><span class="cx"> return;
</span><span class="cx"> }
</span><span class="cx">
</span><del>- if (variant.alternateBase()) {
- child = m_insertionSet.insertConstant(indexInBlock, origin, variant.alternateBase());
- childEdge = Edge(child, KnownCellUse);
- } else
- childEdge.setUseKind(KnownCellUse);
</del><ins>+ childEdge.setUseKind(KnownCellUse);
</ins><span class="cx">
</span><span class="cx"> Edge propertyStorage;
</span><span class="cx">
</span><span class="lines">@@ -442,29 +388,50 @@
</span><span class="cx"> m_graph.m_storageAccessData.append(storageAccessData);
</span><span class="cx"> }
</span><span class="cx">
</span><del>- void emitPutByOffset(unsigned indexInBlock, Node* node, const AbstractValue& baseValue, const PutByIdVariant& variant, unsigned identifierNumber)
</del><ins>+ void emitPutByOffset(unsigned indexInBlock, Node* node, Structure* structure, const PutByIdVariant& variant, unsigned identifierNumber)
</ins><span class="cx"> {
</span><span class="cx"> NodeOrigin origin = node->origin;
</span><span class="cx"> Edge childEdge = node->child1();
</span><ins>+ Node* child = childEdge.node();
+
+ ASSERT(variant.oldStructure() == structure);
</ins><span class="cx">
</span><del>- addBaseCheck(indexInBlock, node, baseValue, variant.oldStructure());
</del><ins>+ bool needsCellCheck = m_state.forNode(child).m_type & ~SpecCell;
+
+ // Now before we do anything else, push the CFA forward over the PutById
+ // and make sure we signal to the loop that it should continue and not
+ // do any eliminations.
+ m_interpreter.execute(indexInBlock);
</ins><span class="cx">
</span><ins>+ if (needsCellCheck) {
+ m_insertionSet.insertNode(
+ indexInBlock, SpecNone, Phantom, origin, childEdge);
+ }
+
</ins><span class="cx"> childEdge.setUseKind(KnownCellUse);
</span><span class="cx">
</span><span class="cx"> Transition* transition = 0;
</span><span class="cx"> if (variant.kind() == PutByIdVariant::Transition) {
</span><del>- transition = m_graph.m_transitions.add(
- variant.oldStructureForTransition(), variant.newStructure());
</del><ins>+ transition = m_graph.m_transitions.add(structure, variant.newStructure());
+
+ for (unsigned i = 0; i < variant.constantChecks().size(); ++i) {
+ addStructureTransitionCheck(
+ origin, indexInBlock,
+ variant.constantChecks()[i].constant(),
+ variant.constantChecks()[i].structure());
+ }
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> Edge propertyStorage;
</span><span class="cx">
</span><span class="cx"> if (isInlineOffset(variant.offset()))
</span><span class="cx"> propertyStorage = childEdge;
</span><del>- else if (!variant.reallocatesStorage()) {
</del><ins>+ else if (
+ variant.kind() == PutByIdVariant::Replace
+ || structure->outOfLineCapacity() == variant.newStructure()->outOfLineCapacity()) {
</ins><span class="cx"> propertyStorage = Edge(m_insertionSet.insertNode(
</span><span class="cx"> indexInBlock, SpecNone, GetButterfly, origin, childEdge));
</span><del>- } else if (!variant.oldStructureForTransition()->outOfLineCapacity()) {
</del><ins>+ } else if (!structure->outOfLineCapacity()) {
</ins><span class="cx"> ASSERT(variant.newStructure()->outOfLineCapacity());
</span><span class="cx"> ASSERT(!isInlineOffset(variant.offset()));
</span><span class="cx"> Node* allocatePropertyStorage = m_insertionSet.insertNode(
</span><span class="lines">@@ -473,8 +440,8 @@
</span><span class="cx"> m_insertionSet.insertNode(indexInBlock, SpecNone, StoreBarrier, origin, Edge(node->child1().node(), KnownCellUse));
</span><span class="cx"> propertyStorage = Edge(allocatePropertyStorage);
</span><span class="cx"> } else {
</span><del>- ASSERT(variant.oldStructureForTransition()->outOfLineCapacity());
- ASSERT(variant.newStructure()->outOfLineCapacity() > variant.oldStructureForTransition()->outOfLineCapacity());
</del><ins>+ ASSERT(structure->outOfLineCapacity());
+ ASSERT(variant.newStructure()->outOfLineCapacity() > structure->outOfLineCapacity());
</ins><span class="cx"> ASSERT(!isInlineOffset(variant.offset()));
</span><span class="cx">
</span><span class="cx"> Node* reallocatePropertyStorage = m_insertionSet.insertNode(
</span><span class="lines">@@ -502,34 +469,6 @@
</span><span class="cx"> storageAccessData.identifierNumber = identifierNumber;
</span><span class="cx"> m_graph.m_storageAccessData.append(storageAccessData);
</span><span class="cx"> }
</span><del>-
- void addBaseCheck(
- unsigned indexInBlock, Node* node, const AbstractValue& baseValue, const StructureSet& set)
- {
- if (!baseValue.m_structure.isSubsetOf(set)) {
- // Arises when we prune MultiGetByOffset. We could have a
- // MultiGetByOffset with a single variant that checks for structure S,
- // and the input has structures S and T, for example.
- m_insertionSet.insertNode(
- indexInBlock, SpecNone, CheckStructure, node->origin,
- OpInfo(m_graph.addStructureSet(set)), node->child1());
- return;
- }
-
- if (baseValue.m_type & ~SpecCell) {
- m_insertionSet.insertNode(
- indexInBlock, SpecNone, Phantom, node->origin, node->child1());
- }
- }
-
- void addChecks(
- NodeOrigin origin, unsigned indexInBlock, const ConstantStructureCheckVector& checks)
- {
- for (unsigned i = 0; i < checks.size(); ++i) {
- addStructureTransitionCheck(
- origin, indexInBlock, checks[i].constant(), checks[i].structure());
- }
- }
</del><span class="cx">
</span><span class="cx"> void addStructureTransitionCheck(NodeOrigin origin, unsigned indexInBlock, JSCell* cell, Structure* structure)
</span><span class="cx"> {
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGDoesGCcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGDoesGC.cpp (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGDoesGC.cpp        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/Source/JavaScriptCore/dfg/DFGDoesGC.cpp        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -186,6 +186,7 @@
</span><span class="cx"> case PutByVal:
</span><span class="cx"> case PutByValAlias:
</span><span class="cx"> case PutStructure:
</span><ins>+ case PhantomPutStructure:
</ins><span class="cx"> case GetByOffset:
</span><span class="cx"> case GetGetterSetterByOffset:
</span><span class="cx"> case PutByOffset:
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGFixupPhasecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGFixupPhase.cpp (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGFixupPhase.cpp        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/Source/JavaScriptCore/dfg/DFGFixupPhase.cpp        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -980,6 +980,7 @@
</span><span class="cx"> case Phi:
</span><span class="cx"> case Upsilon:
</span><span class="cx"> case GetArgument:
</span><ins>+ case PhantomPutStructure:
</ins><span class="cx"> case GetIndexedPropertyStorage:
</span><span class="cx"> case GetTypedArrayByteOffset:
</span><span class="cx"> case LastNodeType:
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGGraphcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGGraph.cpp (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGGraph.cpp        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/Source/JavaScriptCore/dfg/DFGGraph.cpp        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -889,6 +889,7 @@
</span><span class="cx"> break;
</span><span class="cx">
</span><span class="cx"> case PutStructure:
</span><ins>+ case PhantomPutStructure:
</ins><span class="cx"> case AllocatePropertyStorage:
</span><span class="cx"> case ReallocatePropertyStorage:
</span><span class="cx"> visitor.appendUnbarrieredReadOnlyPointer(
</span><span class="lines">@@ -916,9 +917,7 @@
</span><span class="cx"> case MultiPutByOffset:
</span><span class="cx"> for (unsigned i = node->multiPutByOffsetData().variants.size(); i--;) {
</span><span class="cx"> PutByIdVariant& variant = node->multiPutByOffsetData().variants[i];
</span><del>- const StructureSet& set = variant.oldStructure();
- for (unsigned j = set.size(); j--;)
- visitor.appendUnbarrieredReadOnlyPointer(set[j]);
</del><ins>+ visitor.appendUnbarrieredReadOnlyPointer(variant.oldStructure());
</ins><span class="cx"> if (variant.kind() == PutByIdVariant::Transition)
</span><span class="cx"> visitor.appendUnbarrieredReadOnlyPointer(variant.newStructure());
</span><span class="cx"> }
</span><span class="lines">@@ -952,7 +951,7 @@
</span><span class="cx">
</span><span class="cx"> FrozenValue* Graph::freezeStrong(JSValue value)
</span><span class="cx"> {
</span><del>- FrozenValue* result = freezeFragile(value);
</del><ins>+ FrozenValue* result = freeze(value);
</ins><span class="cx"> result->strengthenTo(StrongValue);
</span><span class="cx"> return result;
</span><span class="cx"> }
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGGraphh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGGraph.h (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGGraph.h        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/Source/JavaScriptCore/dfg/DFGGraph.h        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -147,8 +147,8 @@
</span><span class="cx"> void dethread();
</span><span class="cx">
</span><span class="cx"> FrozenValue* freezeFragile(JSValue value);
</span><del>- FrozenValue* freeze(JSValue value); // We use weak freezing by default. Shorthand for freezeFragile(value)->strengthenTo(WeakValue);
- FrozenValue* freezeStrong(JSValue value); // Shorthand for freezeFragile(value)->strengthenTo(StrongValue).
</del><ins>+ FrozenValue* freeze(JSValue value); // We use weak freezing by default.
+ FrozenValue* freezeStrong(JSValue value); // Shorthand for freeze(value)->markStrongly().
</ins><span class="cx">
</span><span class="cx"> void convertToConstant(Node* node, FrozenValue* value);
</span><span class="cx"> void convertToConstant(Node* node, JSValue value);
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGNodecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGNode.cpp (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGNode.cpp        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/Source/JavaScriptCore/dfg/DFGNode.cpp        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -37,7 +37,7 @@
</span><span class="cx"> bool MultiPutByOffsetData::writesStructures() const
</span><span class="cx"> {
</span><span class="cx"> for (unsigned i = variants.size(); i--;) {
</span><del>- if (variants[i].writesStructures())
</del><ins>+ if (variants[i].kind() == PutByIdVariant::Transition)
</ins><span class="cx"> return true;
</span><span class="cx"> }
</span><span class="cx"> return false;
</span><span class="lines">@@ -46,8 +46,14 @@
</span><span class="cx"> bool MultiPutByOffsetData::reallocatesStorage() const
</span><span class="cx"> {
</span><span class="cx"> for (unsigned i = variants.size(); i--;) {
</span><del>- if (variants[i].reallocatesStorage())
- return true;
</del><ins>+ if (variants[i].kind() != PutByIdVariant::Transition)
+ continue;
+
+ if (variants[i].oldStructure()->outOfLineCapacity() ==
+ variants[i].newStructure()->outOfLineCapacity())
+ continue;
+
+ return true;
</ins><span class="cx"> }
</span><span class="cx"> return false;
</span><span class="cx"> }
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGNodeh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGNode.h (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGNode.h        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/Source/JavaScriptCore/dfg/DFGNode.h        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -458,18 +458,9 @@
</span><span class="cx"> m_flags &= ~NodeClobbersWorld;
</span><span class="cx"> }
</span><span class="cx">
</span><del>- void convertToMultiGetByOffset(MultiGetByOffsetData* data)
- {
- ASSERT(m_op == GetById || m_op == GetByIdFlush);
- m_opInfo = bitwise_cast<intptr_t>(data);
- child1().setUseKind(CellUse);
- m_op = MultiGetByOffset;
- m_flags &= ~NodeClobbersWorld;
- }
-
</del><span class="cx"> void convertToPutByOffset(unsigned storageAccessDataIndex, Edge storage)
</span><span class="cx"> {
</span><del>- ASSERT(m_op == PutById || m_op == PutByIdDirect || m_op == PutByIdFlush || m_op == MultiPutByOffset);
</del><ins>+ ASSERT(m_op == PutById || m_op == PutByIdDirect || m_op == MultiPutByOffset);
</ins><span class="cx"> m_opInfo = storageAccessDataIndex;
</span><span class="cx"> children.setChild3(children.child2());
</span><span class="cx"> children.setChild2(children.child1());
</span><span class="lines">@@ -478,14 +469,6 @@
</span><span class="cx"> m_flags &= ~NodeClobbersWorld;
</span><span class="cx"> }
</span><span class="cx">
</span><del>- void convertToMultiPutByOffset(MultiPutByOffsetData* data)
- {
- ASSERT(m_op == PutById || m_op == PutByIdDirect || m_op == PutByIdFlush);
- m_opInfo = bitwise_cast<intptr_t>(data);
- m_op = MultiPutByOffset;
- m_flags &= ~NodeClobbersWorld;
- }
-
</del><span class="cx"> void convertToPhantomLocal()
</span><span class="cx"> {
</span><span class="cx"> ASSERT(m_op == Phantom && (child1()->op() == Phi || child1()->op() == SetLocal || child1()->op() == SetArgument));
</span><span class="lines">@@ -1124,6 +1107,7 @@
</span><span class="cx"> {
</span><span class="cx"> switch (op()) {
</span><span class="cx"> case PutStructure:
</span><ins>+ case PhantomPutStructure:
</ins><span class="cx"> case AllocatePropertyStorage:
</span><span class="cx"> case ReallocatePropertyStorage:
</span><span class="cx"> return true;
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGNodeTypeh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGNodeType.h (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGNodeType.h        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/Source/JavaScriptCore/dfg/DFGNodeType.h        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -155,6 +155,7 @@
</span><span class="cx"> macro(CheckStructure, NodeMustGenerate) \
</span><span class="cx"> macro(CheckExecutable, NodeMustGenerate) \
</span><span class="cx"> macro(PutStructure, NodeMustGenerate) \
</span><ins>+ macro(PhantomPutStructure, NodeMustGenerate) \
</ins><span class="cx"> macro(AllocatePropertyStorage, NodeMustGenerate | NodeResultStorage) \
</span><span class="cx"> macro(ReallocatePropertyStorage, NodeMustGenerate | NodeResultStorage) \
</span><span class="cx"> macro(GetButterfly, NodeResultStorage) \
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGPredictionPropagationPhasecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGPredictionPropagationPhase.cpp (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGPredictionPropagationPhase.cpp        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/Source/JavaScriptCore/dfg/DFGPredictionPropagationPhase.cpp        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -540,6 +540,7 @@
</span><span class="cx"> case GetLocalUnlinked:
</span><span class="cx"> case GetMyArgumentsLength:
</span><span class="cx"> case GetMyArgumentByVal:
</span><ins>+ case PhantomPutStructure:
</ins><span class="cx"> case PhantomArguments:
</span><span class="cx"> case CheckArray:
</span><span class="cx"> case Arrayify:
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGSafeToExecuteh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGSafeToExecute.h (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGSafeToExecute.h        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/Source/JavaScriptCore/dfg/DFGSafeToExecute.h        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -283,6 +283,7 @@
</span><span class="cx"> graph, node, state.forNode(graph.varArgChild(node, 0)));
</span><span class="cx">
</span><span class="cx"> case PutStructure:
</span><ins>+ case PhantomPutStructure:
</ins><span class="cx"> case AllocatePropertyStorage:
</span><span class="cx"> case ReallocatePropertyStorage:
</span><span class="cx"> return state.forNode(node->child1()).m_structure.isSubsetOf(
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGSpeculativeJITcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -343,6 +343,7 @@
</span><span class="cx"> } else if (registerFormat == DataFormatCell) {
</span><span class="cx"> ASSERT(info.gpr() == source);
</span><span class="cx"> if (node->hasConstant()) {
</span><ins>+ DFG_ASSERT(m_jit.graph(), m_currentNode, node->isCellConstant());
</ins><span class="cx"> node->asCell(); // To get the assertion.
</span><span class="cx"> fillAction = SetCellConstant;
</span><span class="cx"> } else {
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGSpeculativeJIT32_64cpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -867,6 +867,15 @@
</span><span class="cx"> m_interpreter.filter(value, SpecCell);
</span><span class="cx"> VirtualRegister virtualRegister = edge->virtualRegister();
</span><span class="cx"> GenerationInfo& info = generationInfoFromVirtualRegister(virtualRegister);
</span><ins>+
+ if (edge->hasConstant() && !edge->isCellConstant()) {
+ // Protect the silent spill/fill logic by failing early. If we "speculate" on
+ // the constant then the silent filler may think that we have a cell and a
+ // constant, so it will try to fill this as an cell constant. Bad things will
+ // happen.
+ terminateSpeculativeExecution(Uncountable, JSValueRegs(), 0);
+ return allocate();
+ }
</ins><span class="cx">
</span><span class="cx"> switch (info.registerFormat()) {
</span><span class="cx"> case DataFormatNone: {
</span><span class="lines">@@ -878,13 +887,9 @@
</span><span class="cx"> if (edge->hasConstant()) {
</span><span class="cx"> JSValue jsValue = edge->asJSValue();
</span><span class="cx"> GPRReg gpr = allocate();
</span><del>- if (jsValue.isCell()) {
- m_gprs.retain(gpr, virtualRegister, SpillOrderConstant);
- m_jit.move(MacroAssembler::TrustedImmPtr(jsValue.asCell()), gpr);
- info.fillCell(*m_stream, gpr);
- return gpr;
- }
- terminateSpeculativeExecution(Uncountable, JSValueRegs(), 0);
</del><ins>+ m_gprs.retain(gpr, virtualRegister, SpillOrderConstant);
+ m_jit.move(MacroAssembler::TrustedImmPtr(jsValue.asCell()), gpr);
+ info.fillCell(*m_stream, gpr);
</ins><span class="cx"> return gpr;
</span><span class="cx"> }
</span><span class="cx">
</span><span class="lines">@@ -3734,6 +3739,13 @@
</span><span class="cx"> break;
</span><span class="cx"> }
</span><span class="cx">
</span><ins>+ case PhantomPutStructure: {
+ ASSERT(isKnownCell(node->child1().node()));
+ m_jit.jitCode()->common.notifyCompilingStructureTransition(m_jit.graph().m_plan, m_jit.codeBlock(), node);
+ noResult(node);
+ break;
+ }
+
</ins><span class="cx"> case PutStructure: {
</span><span class="cx"> Structure* oldStructure = node->transition()->previous;
</span><span class="cx"> Structure* newStructure = node->transition()->next;
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGSpeculativeJIT64cpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -97,7 +97,7 @@
</span><span class="cx">
</span><span class="cx"> default:
</span><span class="cx"> m_jit.load64(JITCompiler::addressFor(virtualRegister), gpr);
</span><del>- DFG_ASSERT(m_jit.graph(), m_currentNode, spillFormat & DataFormatJS);
</del><ins>+ RELEASE_ASSERT(spillFormat & DataFormatJS);
</ins><span class="cx"> break;
</span><span class="cx"> }
</span><span class="cx"> info.fillJSValue(*m_stream, gpr, spillFormat);
</span><span class="lines">@@ -137,10 +137,10 @@
</span><span class="cx"> case DataFormatDouble:
</span><span class="cx"> case DataFormatInt52:
</span><span class="cx"> // this type currently never occurs
</span><del>- DFG_CRASH(m_jit.graph(), m_currentNode, "Bad data format");
</del><ins>+ RELEASE_ASSERT_NOT_REACHED();
</ins><span class="cx">
</span><span class="cx"> default:
</span><del>- DFG_CRASH(m_jit.graph(), m_currentNode, "Corrupt data format");
</del><ins>+ RELEASE_ASSERT_NOT_REACHED();
</ins><span class="cx"> return InvalidGPRReg;
</span><span class="cx"> }
</span><span class="cx"> }
</span><span class="lines">@@ -311,7 +311,7 @@
</span><span class="cx"> if (branchIndexInBlock != UINT_MAX) {
</span><span class="cx"> Node* branchNode = m_block->at(branchIndexInBlock);
</span><span class="cx">
</span><del>- DFG_ASSERT(m_jit.graph(), node, node->adjustedRefCount() == 1);
</del><ins>+ RELEASE_ASSERT(node->adjustedRefCount() == 1);
</ins><span class="cx">
</span><span class="cx"> nonSpeculativePeepholeBranchNull(operand, branchNode, invert);
</span><span class="cx">
</span><span class="lines">@@ -628,8 +628,8 @@
</span><span class="cx">
</span><span class="cx"> bool isCall = node->op() == Call;
</span><span class="cx"> if (!isCall)
</span><del>- DFG_ASSERT(m_jit.graph(), node, node->op() == Construct);
-
</del><ins>+ RELEASE_ASSERT(node->op() == Construct);
+
</ins><span class="cx"> // For constructors, the this argument is not passed but we have to make space
</span><span class="cx"> // for it.
</span><span class="cx"> int dummyThisArgument = isCall ? 0 : 1;
</span><span class="lines">@@ -741,7 +741,7 @@
</span><span class="cx">
</span><span class="cx"> DataFormat spillFormat = info.spillFormat();
</span><span class="cx">
</span><del>- DFG_ASSERT(m_jit.graph(), m_currentNode, (spillFormat & DataFormatJS) || spillFormat == DataFormatInt32);
</del><ins>+ RELEASE_ASSERT((spillFormat & DataFormatJS) || spillFormat == DataFormatInt32);
</ins><span class="cx">
</span><span class="cx"> m_gprs.retain(gpr, virtualRegister, SpillOrderSpilled);
</span><span class="cx">
</span><span class="lines">@@ -771,7 +771,7 @@
</span><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> case DataFormatJS: {
</span><del>- DFG_ASSERT(m_jit.graph(), m_currentNode, !(type & SpecInt52));
</del><ins>+ RELEASE_ASSERT(!(type & SpecInt52));
</ins><span class="cx"> // Check the value is an integer.
</span><span class="cx"> GPRReg gpr = info.gpr();
</span><span class="cx"> m_gprs.lock(gpr);
</span><span class="lines">@@ -834,10 +834,10 @@
</span><span class="cx"> case DataFormatStorage:
</span><span class="cx"> case DataFormatInt52:
</span><span class="cx"> case DataFormatStrictInt52:
</span><del>- DFG_CRASH(m_jit.graph(), m_currentNode, "Bad data format");
</del><ins>+ RELEASE_ASSERT_NOT_REACHED();
</ins><span class="cx">
</span><span class="cx"> default:
</span><del>- DFG_CRASH(m_jit.graph(), m_currentNode, "Corrupt data format");
</del><ins>+ RELEASE_ASSERT_NOT_REACHED();
</ins><span class="cx"> return InvalidGPRReg;
</span><span class="cx"> }
</span><span class="cx"> }
</span><span class="lines">@@ -854,7 +854,7 @@
</span><span class="cx"> {
</span><span class="cx"> DataFormat mustBeDataFormatInt32;
</span><span class="cx"> GPRReg result = fillSpeculateInt32Internal<true>(edge, mustBeDataFormatInt32);
</span><del>- DFG_ASSERT(m_jit.graph(), m_currentNode, mustBeDataFormatInt32 == DataFormatInt32);
</del><ins>+ RELEASE_ASSERT(mustBeDataFormatInt32 == DataFormatInt32);
</ins><span class="cx"> return result;
</span><span class="cx"> }
</span><span class="cx">
</span><span class="lines">@@ -889,7 +889,7 @@
</span><span class="cx">
</span><span class="cx"> DataFormat spillFormat = info.spillFormat();
</span><span class="cx">
</span><del>- DFG_ASSERT(m_jit.graph(), m_currentNode, spillFormat == DataFormatInt52 || spillFormat == DataFormatStrictInt52);
</del><ins>+ RELEASE_ASSERT(spillFormat == DataFormatInt52 || spillFormat == DataFormatStrictInt52);
</ins><span class="cx">
</span><span class="cx"> m_gprs.retain(gpr, virtualRegister, SpillOrderSpilled);
</span><span class="cx">
</span><span class="lines">@@ -941,7 +941,7 @@
</span><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> default:
</span><del>- DFG_CRASH(m_jit.graph(), m_currentNode, "Bad data format");
</del><ins>+ RELEASE_ASSERT_NOT_REACHED();
</ins><span class="cx"> return InvalidGPRReg;
</span><span class="cx"> }
</span><span class="cx"> }
</span><span class="lines">@@ -972,7 +972,7 @@
</span><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> DataFormat spillFormat = info.spillFormat();
</span><del>- DFG_ASSERT(m_jit.graph(), m_currentNode, spillFormat == DataFormatDouble);
</del><ins>+ RELEASE_ASSERT(spillFormat == DataFormatDouble);
</ins><span class="cx"> FPRReg fpr = fprAllocate();
</span><span class="cx"> m_jit.loadDouble(JITCompiler::addressFor(virtualRegister), fpr);
</span><span class="cx"> m_fprs.retain(fpr, virtualRegister, SpillOrderDouble);
</span><span class="lines">@@ -980,7 +980,7 @@
</span><span class="cx"> return fpr;
</span><span class="cx"> }
</span><span class="cx">
</span><del>- DFG_ASSERT(m_jit.graph(), m_currentNode, info.registerFormat() == DataFormatDouble);
</del><ins>+ RELEASE_ASSERT(info.registerFormat() == DataFormatDouble);
</ins><span class="cx"> FPRReg fpr = info.fpr();
</span><span class="cx"> m_fprs.lock(fpr);
</span><span class="cx"> return fpr;
</span><span class="lines">@@ -995,19 +995,21 @@
</span><span class="cx"> VirtualRegister virtualRegister = edge->virtualRegister();
</span><span class="cx"> GenerationInfo& info = generationInfoFromVirtualRegister(virtualRegister);
</span><span class="cx">
</span><ins>+ if (edge->hasConstant() && !edge->isCellConstant()) {
+ // Better to fail early on constants.
+ terminateSpeculativeExecution(Uncountable, JSValueRegs(), 0);
+ return allocate();
+ }
+
</ins><span class="cx"> switch (info.registerFormat()) {
</span><span class="cx"> case DataFormatNone: {
</span><span class="cx"> GPRReg gpr = allocate();
</span><span class="cx">
</span><span class="cx"> if (edge->hasConstant()) {
</span><span class="cx"> JSValue jsValue = edge->asJSValue();
</span><del>- if (jsValue.isCell()) {
- m_gprs.retain(gpr, virtualRegister, SpillOrderConstant);
- m_jit.move(MacroAssembler::TrustedImm64(JSValue::encode(jsValue)), gpr);
- info.fillJSValue(*m_stream, gpr, DataFormatJSCell);
- return gpr;
- }
- terminateSpeculativeExecution(Uncountable, JSValueRegs(), 0);
</del><ins>+ m_gprs.retain(gpr, virtualRegister, SpillOrderConstant);
+ m_jit.move(MacroAssembler::TrustedImm64(JSValue::encode(jsValue)), gpr);
+ info.fillJSValue(*m_stream, gpr, DataFormatJSCell);
</ins><span class="cx"> return gpr;
</span><span class="cx"> }
</span><span class="cx">
</span><span class="lines">@@ -1060,10 +1062,10 @@
</span><span class="cx"> case DataFormatStorage:
</span><span class="cx"> case DataFormatInt52:
</span><span class="cx"> case DataFormatStrictInt52:
</span><del>- DFG_CRASH(m_jit.graph(), m_currentNode, "Bad data format");
</del><ins>+ RELEASE_ASSERT_NOT_REACHED();
</ins><span class="cx">
</span><span class="cx"> default:
</span><del>- DFG_CRASH(m_jit.graph(), m_currentNode, "Corrupt data format");
</del><ins>+ RELEASE_ASSERT_NOT_REACHED();
</ins><span class="cx"> return InvalidGPRReg;
</span><span class="cx"> }
</span><span class="cx"> }
</span><span class="lines">@@ -1096,7 +1098,7 @@
</span><span class="cx"> terminateSpeculativeExecution(Uncountable, JSValueRegs(), 0);
</span><span class="cx"> return gpr;
</span><span class="cx"> }
</span><del>- DFG_ASSERT(m_jit.graph(), m_currentNode, info.spillFormat() & DataFormatJS);
</del><ins>+ RELEASE_ASSERT(info.spillFormat() & DataFormatJS);
</ins><span class="cx"> m_gprs.retain(gpr, virtualRegister, SpillOrderSpilled);
</span><span class="cx"> m_jit.load64(JITCompiler::addressFor(virtualRegister), gpr);
</span><span class="cx">
</span><span class="lines">@@ -1141,10 +1143,10 @@
</span><span class="cx"> case DataFormatStorage:
</span><span class="cx"> case DataFormatInt52:
</span><span class="cx"> case DataFormatStrictInt52:
</span><del>- DFG_CRASH(m_jit.graph(), m_currentNode, "Bad data format");
</del><ins>+ RELEASE_ASSERT_NOT_REACHED();
</ins><span class="cx">
</span><span class="cx"> default:
</span><del>- DFG_CRASH(m_jit.graph(), m_currentNode, "Corrupt data format");
</del><ins>+ RELEASE_ASSERT_NOT_REACHED();
</ins><span class="cx"> return InvalidGPRReg;
</span><span class="cx"> }
</span><span class="cx"> }
</span><span class="lines">@@ -1608,7 +1610,7 @@
</span><span class="cx"> return compileStringZeroLength(node);
</span><span class="cx">
</span><span class="cx"> default:
</span><del>- DFG_CRASH(m_jit.graph(), node, "Bad use kind");
</del><ins>+ RELEASE_ASSERT_NOT_REACHED();
</ins><span class="cx"> break;
</span><span class="cx"> }
</span><span class="cx"> }
</span><span class="lines">@@ -1763,7 +1765,7 @@
</span><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> default:
</span><del>- DFG_CRASH(m_jit.graph(), m_currentNode, "Bad use kind");
</del><ins>+ RELEASE_ASSERT_NOT_REACHED();
</ins><span class="cx"> }
</span><span class="cx"> }
</span><span class="cx">
</span><span class="lines">@@ -1788,7 +1790,7 @@
</span><span class="cx">
</span><span class="cx"> case Identity: {
</span><span class="cx"> // CSE should always eliminate this.
</span><del>- DFG_CRASH(m_jit.graph(), node, "Unexpected Identity node");
</del><ins>+ RELEASE_ASSERT_NOT_REACHED();
</ins><span class="cx"> break;
</span><span class="cx"> }
</span><span class="cx">
</span><span class="lines">@@ -1869,7 +1871,7 @@
</span><span class="cx"> case MovHint:
</span><span class="cx"> case ZombieHint:
</span><span class="cx"> case Check: {
</span><del>- DFG_CRASH(m_jit.graph(), node, "Unexpected node");
</del><ins>+ RELEASE_ASSERT_NOT_REACHED();
</ins><span class="cx"> break;
</span><span class="cx"> }
</span><span class="cx">
</span><span class="lines">@@ -1929,7 +1931,7 @@
</span><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> default:
</span><del>- DFG_CRASH(m_jit.graph(), node, "Bad flush format");
</del><ins>+ RELEASE_ASSERT_NOT_REACHED();
</ins><span class="cx"> break;
</span><span class="cx"> }
</span><span class="cx">
</span><span class="lines">@@ -2067,7 +2069,7 @@
</span><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> default:
</span><del>- DFG_CRASH(m_jit.graph(), node, "Bad use kind");
</del><ins>+ RELEASE_ASSERT_NOT_REACHED();
</ins><span class="cx"> }
</span><span class="cx"> break;
</span><span class="cx"> }
</span><span class="lines">@@ -2147,7 +2149,7 @@
</span><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> default:
</span><del>- DFG_CRASH(m_jit.graph(), node, "Bad use kind");
</del><ins>+ RELEASE_ASSERT_NOT_REACHED();
</ins><span class="cx"> break;
</span><span class="cx"> }
</span><span class="cx"> break;
</span><span class="lines">@@ -2214,7 +2216,7 @@
</span><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> default:
</span><del>- DFG_CRASH(m_jit.graph(), node, "Bad use kind");
</del><ins>+ RELEASE_ASSERT_NOT_REACHED();
</ins><span class="cx"> break;
</span><span class="cx"> }
</span><span class="cx"> break;
</span><span class="lines">@@ -2336,7 +2338,8 @@
</span><span class="cx"> switch (node->arrayMode().type()) {
</span><span class="cx"> case Array::SelectUsingPredictions:
</span><span class="cx"> case Array::ForceExit:
</span><del>- DFG_CRASH(m_jit.graph(), node, "Bad array mode type");
</del><ins>+ RELEASE_ASSERT_NOT_REACHED();
+ terminateSpeculativeExecution(InadequateCoverage, JSValueRegs(), 0);
</ins><span class="cx"> break;
</span><span class="cx"> case Array::Generic: {
</span><span class="cx"> JSValueOperand base(this, node->child1());
</span><span class="lines">@@ -2537,10 +2540,12 @@
</span><span class="cx"> switch (arrayMode.type()) {
</span><span class="cx"> case Array::SelectUsingPredictions:
</span><span class="cx"> case Array::ForceExit:
</span><del>- DFG_CRASH(m_jit.graph(), node, "Bad array mode type");
</del><ins>+ RELEASE_ASSERT_NOT_REACHED();
+ terminateSpeculativeExecution(InadequateCoverage, JSValueRegs(), 0);
+ alreadyHandled = true;
</ins><span class="cx"> break;
</span><span class="cx"> case Array::Generic: {
</span><del>- DFG_ASSERT(m_jit.graph(), node, node->op() == PutByVal);
</del><ins>+ RELEASE_ASSERT(node->op() == PutByVal);
</ins><span class="cx">
</span><span class="cx"> JSValueOperand arg1(this, child1);
</span><span class="cx"> JSValueOperand arg2(this, child2);
</span><span class="lines">@@ -3113,14 +3118,14 @@
</span><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> default:
</span><del>- DFG_CRASH(m_jit.graph(), node, "Bad use kind");
</del><ins>+ RELEASE_ASSERT_NOT_REACHED();
</ins><span class="cx"> break;
</span><span class="cx"> }
</span><span class="cx"> break;
</span><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> case ToPrimitive: {
</span><del>- DFG_ASSERT(m_jit.graph(), node, node->child1().useKind() == UntypedUse);
</del><ins>+ RELEASE_ASSERT(node->child1().useKind() == UntypedUse);
</ins><span class="cx"> JSValueOperand op1(this, node->child1());
</span><span class="cx"> GPRTemporary result(this, Reuse, op1);
</span><span class="cx">
</span><span class="lines">@@ -3187,7 +3192,7 @@
</span><span class="cx"> JSGlobalObject* globalObject = m_jit.graph().globalObjectFor(node->origin.semantic);
</span><span class="cx"> if (!globalObject->isHavingABadTime() && !hasAnyArrayStorage(node->indexingType())) {
</span><span class="cx"> Structure* structure = globalObject->arrayStructureForIndexingTypeDuringAllocation(node->indexingType());
</span><del>- DFG_ASSERT(m_jit.graph(), node, structure->indexingType() == node->indexingType());
</del><ins>+ RELEASE_ASSERT(structure->indexingType() == node->indexingType());
</ins><span class="cx"> ASSERT(
</span><span class="cx"> hasUndecided(structure->indexingType())
</span><span class="cx"> || hasInt32(structure->indexingType())
</span><span class="lines">@@ -3438,7 +3443,7 @@
</span><span class="cx">
</span><span class="cx"> emitAllocateJSArray(resultGPR, globalObject->arrayStructureForIndexingTypeDuringAllocation(indexingType), storageGPR, numElements);
</span><span class="cx">
</span><del>- DFG_ASSERT(m_jit.graph(), node, indexingType & IsArray);
</del><ins>+ RELEASE_ASSERT(indexingType & IsArray);
</ins><span class="cx"> JSValue* data = m_jit.codeBlock()->constantBuffer(node->startConstant());
</span><span class="cx"> if (indexingType == ArrayWithDouble) {
</span><span class="cx"> for (unsigned index = 0; index < node->numConstants(); ++index) {
</span><span class="lines">@@ -3492,7 +3497,7 @@
</span><span class="cx"> break;
</span><span class="cx"> }
</span><span class="cx"> default:
</span><del>- DFG_CRASH(m_jit.graph(), node, "Bad use kind");
</del><ins>+ RELEASE_ASSERT_NOT_REACHED();
</ins><span class="cx"> break;
</span><span class="cx"> }
</span><span class="cx"> break;
</span><span class="lines">@@ -3722,7 +3727,7 @@
</span><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> default:
</span><del>- DFG_CRASH(m_jit.graph(), node, "Bad use kind");
</del><ins>+ RELEASE_ASSERT_NOT_REACHED();
</ins><span class="cx"> break;
</span><span class="cx"> }
</span><span class="cx"> break;
</span><span class="lines">@@ -3772,7 +3777,7 @@
</span><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> default:
</span><del>- DFG_CRASH(m_jit.graph(), node, "Bad use kind");
</del><ins>+ RELEASE_ASSERT_NOT_REACHED();
</ins><span class="cx"> break;
</span><span class="cx"> }
</span><span class="cx"> break;
</span><span class="lines">@@ -3832,6 +3837,13 @@
</span><span class="cx"> break;
</span><span class="cx"> }
</span><span class="cx">
</span><ins>+ case PhantomPutStructure: {
+ ASSERT(isKnownCell(node->child1().node()));
+ m_jit.jitCode()->common.notifyCompilingStructureTransition(m_jit.graph().m_plan, m_jit.codeBlock(), node);
+ noResult(node);
+ break;
+ }
+
</ins><span class="cx"> case PutStructure: {
</span><span class="cx"> Structure* oldStructure = node->transition()->previous;
</span><span class="cx"> Structure* newStructure = node->transition()->next;
</span><span class="lines">@@ -4236,7 +4248,7 @@
</span><span class="cx"> break;
</span><span class="cx">
</span><span class="cx"> case CreateActivation: {
</span><del>- DFG_ASSERT(m_jit.graph(), node, !node->origin.semantic.inlineCallFrame);
</del><ins>+ RELEASE_ASSERT(!node->origin.semantic.inlineCallFrame);
</ins><span class="cx">
</span><span class="cx"> JSValueOperand value(this, node->child1());
</span><span class="cx"> GPRTemporary result(this, Reuse, value);
</span><span class="lines">@@ -4309,7 +4321,7 @@
</span><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> case TearOffActivation: {
</span><del>- DFG_ASSERT(m_jit.graph(), node, !node->origin.semantic.inlineCallFrame);
</del><ins>+ RELEASE_ASSERT(!node->origin.semantic.inlineCallFrame);
</ins><span class="cx">
</span><span class="cx"> JSValueOperand activationValue(this, node->child1());
</span><span class="cx"> GPRTemporary scratch(this);
</span><span class="lines">@@ -4381,7 +4393,7 @@
</span><span class="cx"> m_jit.graph().machineArgumentsRegisterFor(node->origin.semantic))));
</span><span class="cx"> }
</span><span class="cx">
</span><del>- DFG_ASSERT(m_jit.graph(), node, !node->origin.semantic.inlineCallFrame);
</del><ins>+ RELEASE_ASSERT(!node->origin.semantic.inlineCallFrame);
</ins><span class="cx"> m_jit.load32(JITCompiler::payloadFor(JSStack::ArgumentCount), resultGPR);
</span><span class="cx"> m_jit.sub32(TrustedImm32(1), resultGPR);
</span><span class="cx"> int32Result(resultGPR, node);
</span><span class="lines">@@ -4457,7 +4469,7 @@
</span><span class="cx"> JITCompiler::JumpList slowArgument;
</span><span class="cx"> JITCompiler::JumpList slowArgumentOutOfBounds;
</span><span class="cx"> if (m_jit.symbolTableFor(node->origin.semantic)->slowArguments()) {
</span><del>- DFG_ASSERT(m_jit.graph(), node, !node->origin.semantic.inlineCallFrame);
</del><ins>+ RELEASE_ASSERT(!node->origin.semantic.inlineCallFrame);
</ins><span class="cx"> const SlowArgument* slowArguments = m_jit.graph().m_slowArguments.get();
</span><span class="cx">
</span><span class="cx"> slowArgumentOutOfBounds.append(
</span><span class="lines">@@ -4524,7 +4536,7 @@
</span><span class="cx"> JITCompiler::JumpList slowArgument;
</span><span class="cx"> JITCompiler::JumpList slowArgumentOutOfBounds;
</span><span class="cx"> if (m_jit.symbolTableFor(node->origin.semantic)->slowArguments()) {
</span><del>- DFG_ASSERT(m_jit.graph(), node, !node->origin.semantic.inlineCallFrame);
</del><ins>+ RELEASE_ASSERT(!node->origin.semantic.inlineCallFrame);
</ins><span class="cx"> const SlowArgument* slowArguments = m_jit.graph().m_slowArguments.get();
</span><span class="cx">
</span><span class="cx"> slowArgumentOutOfBounds.append(
</span><span class="lines">@@ -4659,7 +4671,7 @@
</span><span class="cx"> break;
</span><span class="cx">
</span><span class="cx"> case Unreachable:
</span><del>- DFG_CRASH(m_jit.graph(), node, "Unexpected Unreachable node");
</del><ins>+ RELEASE_ASSERT_NOT_REACHED();
</ins><span class="cx"> break;
</span><span class="cx">
</span><span class="cx"> case StoreBarrier:
</span><span class="lines">@@ -4727,7 +4739,7 @@
</span><span class="cx"> case CheckTierUpInLoop:
</span><span class="cx"> case CheckTierUpAtReturn:
</span><span class="cx"> case CheckTierUpAndOSREnter:
</span><del>- DFG_CRASH(m_jit.graph(), node, "Unexpected tier-up node");
</del><ins>+ RELEASE_ASSERT_NOT_REACHED();
</ins><span class="cx"> break;
</span><span class="cx"> #endif // ENABLE(FTL_JIT)
</span><span class="cx">
</span><span class="lines">@@ -4743,7 +4755,7 @@
</span><span class="cx"> case MultiGetByOffset:
</span><span class="cx"> case MultiPutByOffset:
</span><span class="cx"> case FiatInt52:
</span><del>- DFG_CRASH(m_jit.graph(), node, "Unexpected FTL node");
</del><ins>+ RELEASE_ASSERT_NOT_REACHED();
</ins><span class="cx"> break;
</span><span class="cx"> }
</span><span class="cx">
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGStructureAbstractValuecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGStructureAbstractValue.cpp (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGStructureAbstractValue.cpp        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/Source/JavaScriptCore/dfg/DFGStructureAbstractValue.cpp        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -83,8 +83,6 @@
</span><span class="cx"> void StructureAbstractValue::observeTransition(Structure* from, Structure* to)
</span><span class="cx"> {
</span><span class="cx"> SAMPLE("StructureAbstractValue observeTransition");
</span><del>-
- ASSERT(!from->dfgShouldWatch());
</del><span class="cx">
</span><span class="cx"> if (isTop())
</span><span class="cx"> return;
</span><span class="lines">@@ -92,6 +90,11 @@
</span><span class="cx"> if (!m_set.contains(from))
</span><span class="cx"> return;
</span><span class="cx">
</span><ins>+ if (from->dfgShouldWatch()) {
+ setClobbered(true);
+ return;
+ }
+
</ins><span class="cx"> if (!m_set.add(to))
</span><span class="cx"> return;
</span><span class="cx">
</span><span class="lines">@@ -108,12 +111,13 @@
</span><span class="cx">
</span><span class="cx"> StructureSet newStructures;
</span><span class="cx"> for (unsigned i = vector.size(); i--;) {
</span><del>- ASSERT(!vector[i].previous->dfgShouldWatch());
-
</del><span class="cx"> if (!m_set.contains(vector[i].previous))
</span><span class="cx"> continue;
</span><span class="cx">
</span><del>- newStructures.add(vector[i].next);
</del><ins>+ if (vector[i].previous->dfgShouldWatch())
+ setClobbered(true);
+ else
+ newStructures.add(vector[i].next);
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> if (!m_set.merge(newStructures))
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGStructureAbstractValueh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGStructureAbstractValue.h (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGStructureAbstractValue.h        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/Source/JavaScriptCore/dfg/DFGStructureAbstractValue.h        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -55,18 +55,6 @@
</span><span class="cx"> setClobbered(other.isClobbered());
</span><span class="cx"> }
</span><span class="cx">
</span><del>- ALWAYS_INLINE StructureAbstractValue& operator=(Structure* structure)
- {
- m_set = structure;
- setClobbered(false);
- return *this;
- }
- ALWAYS_INLINE StructureAbstractValue& operator=(const StructureSet& other)
- {
- m_set = other;
- setClobbered(false);
- return *this;
- }
</del><span class="cx"> ALWAYS_INLINE StructureAbstractValue& operator=(const StructureAbstractValue& other)
</span><span class="cx"> {
</span><span class="cx"> m_set = other.m_set;
</span><span class="lines">@@ -161,12 +149,6 @@
</span><span class="cx"> return equalsSlow(other);
</span><span class="cx"> }
</span><span class="cx">
</span><del>- const StructureSet& set() const
- {
- ASSERT(!isTop());
- return m_set;
- }
-
</del><span class="cx"> size_t size() const
</span><span class="cx"> {
</span><span class="cx"> ASSERT(!isTop());
</span><span class="lines">@@ -181,14 +163,14 @@
</span><span class="cx">
</span><span class="cx"> Structure* operator[](size_t i) const { return at(i); }
</span><span class="cx">
</span><del>- // In most cases, what you really want to do is verify whether the set is top or clobbered, and
- // if not, enumerate the set of structures. Use this only in cases where the singleton case is
- // meaningfully special, like for transitions.
</del><ins>+ // FIXME: Eliminate all uses of this method. There shouldn't be any
+ // special-casing for the one-structure case.
+ // https://bugs.webkit.org/show_bug.cgi?id=133229
</ins><span class="cx"> Structure* onlyStructure() const
</span><span class="cx"> {
</span><del>- if (isTop() || isClobbered())
</del><ins>+ if (isTop() || size() != 1)
</ins><span class="cx"> return nullptr;
</span><del>- return m_set.onlyStructure();
</del><ins>+ return at(0);
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> void dumpInContext(PrintStream&, DumpContext*) const;
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGValidatecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGValidate.cpp (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGValidate.cpp        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/Source/JavaScriptCore/dfg/DFGValidate.cpp        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -233,17 +233,6 @@
</span><span class="cx"> VALIDATE((node), !!node->child1());
</span><span class="cx"> VALIDATE((node), !!node->child2());
</span><span class="cx"> break;
</span><del>- case PutStructure:
- VALIDATE((node), !node->transition()->previous->dfgShouldWatch());
- break;
- case MultiPutByOffset:
- for (unsigned i = node->multiPutByOffsetData().variants.size(); i--;) {
- const PutByIdVariant& variant = node->multiPutByOffsetData().variants[i];
- if (variant.kind() != PutByIdVariant::Transition)
- continue;
- VALIDATE((node), !variant.oldStructureForTransition()->dfgShouldWatch());
- }
- break;
</del><span class="cx"> default:
</span><span class="cx"> break;
</span><span class="cx"> }
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGWatchableStructureWatchingPhasecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGWatchableStructureWatchingPhase.cpp (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGWatchableStructureWatchingPhase.cpp        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/Source/JavaScriptCore/dfg/DFGWatchableStructureWatchingPhase.cpp        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -77,6 +77,7 @@
</span><span class="cx"> break;
</span><span class="cx">
</span><span class="cx"> case PutStructure:
</span><ins>+ case PhantomPutStructure:
</ins><span class="cx"> case AllocatePropertyStorage:
</span><span class="cx"> case ReallocatePropertyStorage:
</span><span class="cx"> RELEASE_ASSERT(node->transition()->previous->transitionWatchpointSetHasBeenInvalidated());
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreftlFTLAbbreviationsh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/ftl/FTLAbbreviations.h (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/ftl/FTLAbbreviations.h        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/Source/JavaScriptCore/ftl/FTLAbbreviations.h        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -149,7 +149,8 @@
</span><span class="cx"> static inline void addTargetDependentFunctionAttr(LValue function, const char* key, const char* value) { llvm->AddTargetDependentFunctionAttr(function, key, value); }
</span><span class="cx"> static inline void removeFunctionAttr(LValue function, LLVMAttribute pa) { llvm->RemoveFunctionAttr(function, pa); }
</span><span class="cx">
</span><del>-static inline LLVMLinkage getLinkage(LValue global) { return llvm->GetLinkage(global); }
</del><ins>+
+
</ins><span class="cx"> static inline void setLinkage(LValue global, LLVMLinkage linkage) { llvm->SetLinkage(global, linkage); }
</span><span class="cx"> static inline void setVisibility(LValue global, LLVMVisibility viz) { llvm->SetVisibility(global, viz); }
</span><span class="cx"> static inline LLVMBool isDeclaration(LValue global) { return llvm->IsDeclaration(global); }
</span><span class="lines">@@ -162,6 +163,10 @@
</span><span class="cx"> static inline LValue getFirstGlobal(LModule module) { return llvm->GetFirstGlobal(module); }
</span><span class="cx"> static inline LValue getNextGlobal(LValue global) { return llvm->GetNextGlobal(global); }
</span><span class="cx">
</span><ins>+
+
+
+
</ins><span class="cx"> static inline LValue addExternFunction(LModule module, const char* name, LType type)
</span><span class="cx"> {
</span><span class="cx"> LValue result = addFunction(module, name, type);
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreftlFTLCapabilitiescpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/ftl/FTLCapabilities.cpp (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/ftl/FTLCapabilities.cpp        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/Source/JavaScriptCore/ftl/FTLCapabilities.cpp        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -64,6 +64,7 @@
</span><span class="cx"> case CheckStructure:
</span><span class="cx"> case ArrayifyToStructure:
</span><span class="cx"> case PutStructure:
</span><ins>+ case PhantomPutStructure:
</ins><span class="cx"> case GetButterfly:
</span><span class="cx"> case NewObject:
</span><span class="cx"> case NewArray:
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreftlFTLLowerDFGToLLVMcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/ftl/FTLLowerDFGToLLVM.cpp (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/ftl/FTLLowerDFGToLLVM.cpp        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/Source/JavaScriptCore/ftl/FTLLowerDFGToLLVM.cpp        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -476,6 +476,9 @@
</span><span class="cx"> case PutStructure:
</span><span class="cx"> compilePutStructure();
</span><span class="cx"> break;
</span><ins>+ case PhantomPutStructure:
+ compilePhantomPutStructure();
+ break;
</ins><span class="cx"> case GetById:
</span><span class="cx"> compileGetById();
</span><span class="cx"> break;
</span><span class="lines">@@ -1803,6 +1806,11 @@
</span><span class="cx"> cell, m_heaps.JSCell_structureID);
</span><span class="cx"> }
</span><span class="cx">
</span><ins>+ void compilePhantomPutStructure()
+ {
+ m_ftlState.jitCode->common.notifyCompilingStructureTransition(m_graph.m_plan, codeBlock(), m_node);
+ }
+
</ins><span class="cx"> void compileGetById()
</span><span class="cx"> {
</span><span class="cx"> // Pretty much the only reason why we don't also support GetByIdFlush is because:
</span><span class="lines">@@ -3248,12 +3256,6 @@
</span><span class="cx"> LValue base = lowCell(m_node->child1());
</span><span class="cx">
</span><span class="cx"> MultiGetByOffsetData& data = m_node->multiGetByOffsetData();
</span><del>-
- if (data.variants.isEmpty()) {
- // Protect against creating a Phi function with zero inputs. LLVM doesn't like that.
- terminate(BadCache);
- return;
- }
</del><span class="cx">
</span><span class="cx"> Vector<LBasicBlock, 2> blocks(data.variants.size());
</span><span class="cx"> for (unsigned i = data.variants.size(); i--;)
</span><span class="lines">@@ -3331,10 +3333,8 @@
</span><span class="cx"> Vector<SwitchCase, 2> cases;
</span><span class="cx"> for (unsigned i = data.variants.size(); i--;) {
</span><span class="cx"> PutByIdVariant variant = data.variants[i];
</span><del>- for (unsigned j = variant.oldStructure().size(); j--;) {
- cases.append(
- SwitchCase(weakStructure(variant.oldStructure()[j]), blocks[i], Weight(1)));
- }
</del><ins>+ cases.append(
+ SwitchCase(weakStructure(variant.oldStructure()), blocks[i], Weight(1)));
</ins><span class="cx"> }
</span><span class="cx"> m_out.switchInstruction(
</span><span class="cx"> m_out.load32(base, m_heaps.JSCell_structureID), cases, exit, Weight(0));
</span><span class="lines">@@ -3355,15 +3355,14 @@
</span><span class="cx"> } else {
</span><span class="cx"> m_graph.m_plan.transitions.addLazily(
</span><span class="cx"> codeBlock(), m_node->origin.semantic.codeOriginOwner(),
</span><del>- variant.oldStructureForTransition(), variant.newStructure());
</del><ins>+ variant.oldStructure(), variant.newStructure());
</ins><span class="cx">
</span><span class="cx"> storage = storageForTransition(
</span><del>- base, variant.offset(),
- variant.oldStructureForTransition(), variant.newStructure());
</del><ins>+ base, variant.offset(), variant.oldStructure(), variant.newStructure());
</ins><span class="cx">
</span><del>- ASSERT(variant.oldStructureForTransition()->indexingType() == variant.newStructure()->indexingType());
- ASSERT(variant.oldStructureForTransition()->typeInfo().inlineTypeFlags() == variant.newStructure()->typeInfo().inlineTypeFlags());
- ASSERT(variant.oldStructureForTransition()->typeInfo().type() == variant.newStructure()->typeInfo().type());
</del><ins>+ ASSERT(variant.oldStructure()->indexingType() == variant.newStructure()->indexingType());
+ ASSERT(variant.oldStructure()->typeInfo().inlineTypeFlags() == variant.newStructure()->typeInfo().inlineTypeFlags());
+ ASSERT(variant.oldStructure()->typeInfo().type() == variant.newStructure()->typeInfo().type());
</ins><span class="cx"> m_out.store32(
</span><span class="cx"> weakStructure(variant.newStructure()), base, m_heaps.JSCell_structureID);
</span><span class="cx"> }
</span><span class="lines">@@ -4137,9 +4136,7 @@
</span><span class="cx">
</span><span class="cx"> for (CString* symbol = namedFunctions.begin(); symbol != namedFunctions.end(); ++symbol) {
</span><span class="cx"> LValue function = getNamedFunction(m_ftlState.module, symbol->data());
</span><del>- LLVMLinkage linkage = getLinkage(function);
- if (linkage != LLVMInternalLinkage && linkage != LLVMPrivateLinkage)
- setVisibility(function, LLVMHiddenVisibility);
</del><ins>+ setVisibility(function, LLVMHiddenVisibility);
</ins><span class="cx"> if (!isDeclaration(function)) {
</span><span class="cx"> setLinkage(function, LLVMPrivateLinkage);
</span><span class="cx">
</span><span class="lines">@@ -4150,9 +4147,7 @@
</span><span class="cx">
</span><span class="cx"> for (CString* symbol = namedGlobals.begin(); symbol != namedGlobals.end(); ++symbol) {
</span><span class="cx"> LValue global = getNamedGlobal(m_ftlState.module, symbol->data());
</span><del>- LLVMLinkage linkage = getLinkage(global);
- if (linkage != LLVMInternalLinkage && linkage != LLVMPrivateLinkage)
- setVisibility(global, LLVMHiddenVisibility);
</del><ins>+ setVisibility(global, LLVMHiddenVisibility);
</ins><span class="cx"> if (!isDeclaration(global))
</span><span class="cx"> setLinkage(global, LLVMPrivateLinkage);
</span><span class="cx"> }
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreheapHeapcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/heap/Heap.cpp (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/heap/Heap.cpp        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/Source/JavaScriptCore/heap/Heap.cpp        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -35,7 +35,6 @@
</span><span class="cx"> #include "HeapIterationScope.h"
</span><span class="cx"> #include "HeapRootVisitor.h"
</span><span class="cx"> #include "HeapStatistics.h"
</span><del>-#include "HighFidelityLog.h"
</del><span class="cx"> #include "IncrementalSweeper.h"
</span><span class="cx"> #include "Interpreter.h"
</span><span class="cx"> #include "JSGlobalObject.h"
</span><span class="lines">@@ -970,8 +969,6 @@
</span><span class="cx"> #if ENABLE(ALLOCATION_LOGGING)
</span><span class="cx"> dataLogF("JSC GC starting collection.\n");
</span><span class="cx"> #endif
</span><del>- if (vm()->isProfilingTypesWithHighFidelity())
- vm()->highFidelityLog()->processHighFidelityLog(false, "GC");
</del><span class="cx">
</span><span class="cx"> double before = 0;
</span><span class="cx"> if (Options::logGC()) {
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreinspectoragentsInspectorRuntimeAgentcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/inspector/agents/InspectorRuntimeAgent.cpp (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/inspector/agents/InspectorRuntimeAgent.cpp        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/Source/JavaScriptCore/inspector/agents/InspectorRuntimeAgent.cpp        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -191,13 +191,6 @@
</span><span class="cx"> {
</span><span class="cx"> }
</span><span class="cx">
</span><del>-void InspectorRuntimeAgent::getRuntimeTypeForVariableInTextRange(ErrorString*, const String& in_variableName, const String& in_id, int in_startLine, int in_startColumn, int in_endLine, int in_endColumn, String* out_types)
-{
- VM& vm = globalVM();
- String types(vm.getTypesForVariableInRange(in_startLine, in_startColumn, in_endLine, in_endColumn, in_variableName, in_id));
- *out_types = types;
-}
-
</del><span class="cx"> } // namespace Inspector
</span><span class="cx">
</span><span class="cx"> #endif // ENABLE(INSPECTOR)
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreinspectoragentsInspectorRuntimeAgenth"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/inspector/agents/InspectorRuntimeAgent.h (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/inspector/agents/InspectorRuntimeAgent.h        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/Source/JavaScriptCore/inspector/agents/InspectorRuntimeAgent.h        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -66,7 +66,6 @@
</span><span class="cx"> virtual void getProperties(ErrorString*, const String& objectId, const bool* ownProperties, RefPtr<Inspector::TypeBuilder::Array<Inspector::TypeBuilder::Runtime::PropertyDescriptor>>& result, RefPtr<Inspector::TypeBuilder::Array<Inspector::TypeBuilder::Runtime::InternalPropertyDescriptor>>& internalProperties) override final;
</span><span class="cx"> virtual void releaseObjectGroup(ErrorString*, const String& objectGroup) override final;
</span><span class="cx"> virtual void run(ErrorString*) override;
</span><del>- virtual void getRuntimeTypeForVariableInTextRange(ErrorString*, const String& in_variableName, const String& in_id, int in_startLine, int in_startColumn, int in_endLine, int in_endColumn, String* out_types) override;
</del><span class="cx">
</span><span class="cx"> void setScriptDebugServer(ScriptDebugServer* scriptDebugServer) { m_scriptDebugServer = scriptDebugServer; }
</span><span class="cx">
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreinspectorprotocolRuntimejson"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/inspector/protocol/Runtime.json (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/inspector/protocol/Runtime.json        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/Source/JavaScriptCore/inspector/protocol/Runtime.json        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -196,21 +196,6 @@
</span><span class="cx"> {
</span><span class="cx"> "name": "disable",
</span><span class="cx"> "description": "Disables reporting of execution contexts creation."
</span><del>- },
- {
- "name": "getRuntimeTypeForVariableInTextRange",
- "parameters": [
- { "name": "variableName", "type": "string", "description": "Variable we want type infromation for." },
- { "name": "sourceID", "type": "string", "description": "sourceID uniquely identifying a script" },
- { "name": "startLine", "type": "integer", "description": "start line for variable name" },
- { "name": "startColumn", "type": "integer", "description": "start column for variable name" },
- { "name": "endLine", "type": "integer", "description": "end line for variable name" },
- { "name": "endColumn", "type": "integer", "description": "end column for variable name" }
- ],
- "returns": [
- { "name": "types", "type": "string", "description": "Types for requested variable." }
- ],
- "description": "Returns detailed informtation on given function."
</del><span class="cx"> }
</span><span class="cx"> ],
</span><span class="cx"> "events": [
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorejsccpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/jsc.cpp (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/jsc.cpp        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/Source/JavaScriptCore/jsc.cpp        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -25,7 +25,6 @@
</span><span class="cx"> #include "ArrayPrototype.h"
</span><span class="cx"> #include "ButterflyInlines.h"
</span><span class="cx"> #include "BytecodeGenerator.h"
</span><del>-#include "CodeBlock.h"
</del><span class="cx"> #include "Completion.h"
</span><span class="cx"> #include "CopiedSpaceInlines.h"
</span><span class="cx"> #include "ExceptionHelpers.h"
</span><span class="lines">@@ -471,7 +470,6 @@
</span><span class="cx"> static EncodedJSValue JSC_HOST_CALL functionEffectful42(ExecState*);
</span><span class="cx"> static EncodedJSValue JSC_HOST_CALL functionIdentity(ExecState*);
</span><span class="cx"> static EncodedJSValue JSC_HOST_CALL functionMakeMasquerader(ExecState*);
</span><del>-static EncodedJSValue JSC_HOST_CALL functionDumpTypesForAllVariables (ExecState*);
</del><span class="cx">
</span><span class="cx"> #if ENABLE(SAMPLING_FLAGS)
</span><span class="cx"> static EncodedJSValue JSC_HOST_CALL functionSetSamplingFlags(ExecState*);
</span><span class="lines">@@ -621,7 +619,6 @@
</span><span class="cx">
</span><span class="cx"> addFunction(vm, "createImpureGetter", functionCreateImpureGetter, 1);
</span><span class="cx"> addFunction(vm, "setImpureGetterDelegate", functionSetImpureGetterDelegate, 2);
</span><del>- addFunction(vm, "dumpTypesForAllVariables", functionDumpTypesForAllVariables , 4);
</del><span class="cx">
</span><span class="cx"> JSArray* array = constructEmptyArray(globalExec(), 0);
</span><span class="cx"> for (size_t i = 0; i < arguments.size(); ++i)
</span><span class="lines">@@ -1056,12 +1053,6 @@
</span><span class="cx"> return JSValue::encode(Masquerader::create(exec->vm(), exec->lexicalGlobalObject()));
</span><span class="cx"> }
</span><span class="cx">
</span><del>-EncodedJSValue JSC_HOST_CALL functionDumpTypesForAllVariables(ExecState* exec)
-{
- exec->vm().dumpHighFidelityProfilingTypes();
- return JSValue::encode(jsUndefined());
-}
-
</del><span class="cx"> // Use SEH for Release builds only to get rid of the crash report dialog
</span><span class="cx"> // (luckily the same tests fail in Release and Debug builds so far). Need to
</span><span class="cx"> // be in a separate main function because the jscmain function requires object
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorellintLLIntDatacpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/llint/LLIntData.cpp (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/llint/LLIntData.cpp        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/Source/JavaScriptCore/llint/LLIntData.cpp        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -132,9 +132,9 @@
</span><span class="cx"> #elif CPU(X86_64) && OS(WINDOWS)
</span><span class="cx"> ASSERT(maxFrameExtentForSlowPathCall == 64);
</span><span class="cx"> #endif
</span><del>- ASSERT(StringType == 6);
- ASSERT(ObjectType == 17);
- ASSERT(FinalObjectType == 18);
</del><ins>+ ASSERT(StringType == 5);
+ ASSERT(ObjectType == 18);
+ ASSERT(FinalObjectType == 19);
</ins><span class="cx"> ASSERT(MasqueradesAsUndefined == 1);
</span><span class="cx"> ASSERT(ImplementsHasInstance == 2);
</span><span class="cx"> ASSERT(ImplementsDefaultHasInstance == 8);
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorellintLLIntSlowPathscpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/llint/LLIntSlowPaths.cpp (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/llint/LLIntSlowPaths.cpp        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/Source/JavaScriptCore/llint/LLIntSlowPaths.cpp        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -34,7 +34,6 @@
</span><span class="cx"> #include "ExceptionFuzz.h"
</span><span class="cx"> #include "GetterSetter.h"
</span><span class="cx"> #include "HostCallReturnValue.h"
</span><del>-#include "HighFidelityLog.h"
</del><span class="cx"> #include "Interpreter.h"
</span><span class="cx"> #include "JIT.h"
</span><span class="cx"> #include "JITExceptions.h"
</span><span class="lines">@@ -170,6 +169,7 @@
</span><span class="cx"> ExecState* __rcf_exec = (execCallee); \
</span><span class="cx"> LLINT_RETURN_TWO(pc, __rcf_exec); \
</span><span class="cx"> } while (false)
</span><ins>+
</ins><span class="cx">
</span><span class="cx"> extern "C" SlowPathReturnType llint_trace_operand(ExecState* exec, Instruction* pc, int fromWhere, int operand)
</span><span class="cx"> {
</span><span class="lines">@@ -541,15 +541,6 @@
</span><span class="cx"> LLINT_RETURN(RegExpObject::create(vm, exec->lexicalGlobalObject()->regExpStructure(), regExp));
</span><span class="cx"> }
</span><span class="cx">
</span><del>-LLINT_SLOW_PATH_DECL(slow_path_profile_types_with_high_fidelity)
-{
- LLINT_BEGIN();
- TypeLocation* location = pc[2].u.location;
- JSValue val = LLINT_OP_C(1).jsValue();
- vm.highFidelityLog()->recordTypeInformationForLocation(val, location);
- LLINT_END_IMPL();
-}
-
</del><span class="cx"> LLINT_SLOW_PATH_DECL(slow_path_check_has_instance)
</span><span class="cx"> {
</span><span class="cx"> LLINT_BEGIN();
</span><span class="lines">@@ -1444,8 +1435,9 @@
</span><span class="cx"> LLINT_RETURN(slot.getValue(exec, ident));
</span><span class="cx"> }
</span><span class="cx">
</span><del>-static JSObject* putToScopeCommon(ExecState* exec, Instruction* pc, VM& vm)
</del><ins>+LLINT_SLOW_PATH_DECL(slow_path_put_to_scope)
</ins><span class="cx"> {
</span><ins>+ LLINT_BEGIN();
</ins><span class="cx"> CodeBlock* codeBlock = exec->codeBlock();
</span><span class="cx"> const Identifier& ident = codeBlock->identifier(pc[2].u.operand);
</span><span class="cx"> JSObject* scope = jsCast<JSObject*>(LLINT_OP(1).jsValue());
</span><span class="lines">@@ -1453,7 +1445,7 @@
</span><span class="cx"> ResolveModeAndType modeAndType = ResolveModeAndType(pc[4].u.operand);
</span><span class="cx">
</span><span class="cx"> if (modeAndType.mode() == ThrowIfNotFound && !scope->hasProperty(exec, ident))
</span><del>- return createUndefinedVariableError(exec, ident);
</del><ins>+ LLINT_THROW(createUndefinedVariableError(exec, ident));
</ins><span class="cx">
</span><span class="cx"> PutPropertySlot slot(scope, codeBlock->isStrictMode());
</span><span class="cx"> scope->methodTable()->put(scope, exec, ident, value, slot);
</span><span class="lines">@@ -1467,31 +1459,9 @@
</span><span class="cx"> }
</span><span class="cx"> }
</span><span class="cx">
</span><del>- return nullptr;
-}
-
-LLINT_SLOW_PATH_DECL(slow_path_put_to_scope)
-{
- LLINT_BEGIN();
- JSObject* error = putToScopeCommon(exec, pc, vm);
- if (error)
- LLINT_THROW(error);
</del><span class="cx"> LLINT_END();
</span><span class="cx"> }
</span><span class="cx">
</span><del>-LLINT_SLOW_PATH_DECL(slow_path_put_to_scope_with_profile)
-{
- // The format of this instruction is the same as put_to_scope with a TypeLocation appended: put_to_scope_with_profile scope, id, value, ResolveModeAndType, Structure, Operand, TypeLocation*
- LLINT_BEGIN();
- JSObject* error = putToScopeCommon(exec, pc, vm);
- if (error)
- LLINT_THROW(error);
- TypeLocation* location = pc[7].u.location;
- JSValue val = LLINT_OP_C(3).jsValue();
- vm.highFidelityLog()->recordTypeInformationForLocation(val, location);
- LLINT_END();
-}
-
</del><span class="cx"> extern "C" SlowPathReturnType llint_throw_stack_overflow_error(VM* vm, ProtoCallFrame* protoFrame)
</span><span class="cx"> {
</span><span class="cx"> ExecState* exec = vm->topCallFrame;
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorellintLLIntSlowPathsh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/llint/LLIntSlowPaths.h (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/llint/LLIntSlowPaths.h        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/Source/JavaScriptCore/llint/LLIntSlowPaths.h        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -122,8 +122,6 @@
</span><span class="cx"> LLINT_SLOW_PATH_HIDDEN_DECL(slow_path_resolve_scope);
</span><span class="cx"> LLINT_SLOW_PATH_HIDDEN_DECL(slow_path_get_from_scope);
</span><span class="cx"> LLINT_SLOW_PATH_HIDDEN_DECL(slow_path_put_to_scope);
</span><del>-LLINT_SLOW_PATH_HIDDEN_DECL(slow_path_put_to_scope_with_profile);
-LLINT_SLOW_PATH_HIDDEN_DECL(slow_path_profile_types_with_high_fidelity);
</del><span class="cx"> extern "C" SlowPathReturnType llint_throw_stack_overflow_error(VM*, ProtoCallFrame*) WTF_INTERNAL;
</span><span class="cx"> #if !ENABLE(JIT)
</span><span class="cx"> extern "C" SlowPathReturnType llint_stack_check_at_vm_entry(VM*, Register*) WTF_INTERNAL;
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorellintLowLevelInterpreterasm"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/llint/LowLevelInterpreter.asm (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/llint/LowLevelInterpreter.asm        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/Source/JavaScriptCore/llint/LowLevelInterpreter.asm        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -150,9 +150,9 @@
</span><span class="cx"> const SlowPutArrayStorageShape = 30
</span><span class="cx">
</span><span class="cx"> # Type constants.
</span><del>-const StringType = 6
-const ObjectType = 17
-const FinalObjectType = 18
</del><ins>+const StringType = 5
+const ObjectType = 18
+const FinalObjectType = 19
</ins><span class="cx">
</span><span class="cx"> # Type flags constants.
</span><span class="cx"> const MasqueradesAsUndefined = 1
</span><span class="lines">@@ -1242,11 +1242,3 @@
</span><span class="cx"> _llint_op_init_global_const_nop:
</span><span class="cx"> dispatch(5)
</span><span class="cx">
</span><del>-_llint_op_profile_types_with_high_fidelity:
- callSlowPath(_llint_slow_path_profile_types_with_high_fidelity)
- dispatch(4)
-
-_llint_op_put_to_scope_with_profile:
- traceExecution()
- callSlowPath(_llint_slow_path_put_to_scope_with_profile)
- dispatch(8)
</del></span></pre></div>
<a id="trunkSourceJavaScriptCorellintLowLevelInterpreter32_64asm"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/llint/LowLevelInterpreter32_64.asm (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/llint/LowLevelInterpreter32_64.asm        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/Source/JavaScriptCore/llint/LowLevelInterpreter32_64.asm        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -760,11 +760,11 @@
</span><span class="cx"> bbneq JSCell::m_type[t0], FinalObjectType, .opToThisSlow
</span><span class="cx"> loadpFromInstruction(2, t2)
</span><span class="cx"> bpneq JSCell::m_structureID[t0], t2, .opToThisSlow
</span><del>- dispatch(4)
</del><ins>+ dispatch(3)
</ins><span class="cx">
</span><span class="cx"> .opToThisSlow:
</span><span class="cx"> callSlowPath(_slow_path_to_this)
</span><del>- dispatch(4)
</del><ins>+ dispatch(3)
</ins><span class="cx">
</span><span class="cx">
</span><span class="cx"> _llint_op_new_object:
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorellintLowLevelInterpreter64asm"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/llint/LowLevelInterpreter64.asm (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/llint/LowLevelInterpreter64.asm        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/Source/JavaScriptCore/llint/LowLevelInterpreter64.asm        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -685,11 +685,11 @@
</span><span class="cx"> loadStructureWithScratch(t0, t1, t2)
</span><span class="cx"> loadpFromInstruction(2, t2)
</span><span class="cx"> bpneq t1, t2, .opToThisSlow
</span><del>- dispatch(4)
</del><ins>+ dispatch(3)
</ins><span class="cx">
</span><span class="cx"> .opToThisSlow:
</span><span class="cx"> callSlowPath(_slow_path_to_this)
</span><del>- dispatch(4)
</del><ins>+ dispatch(3)
</ins><span class="cx">
</span><span class="cx">
</span><span class="cx"> _llint_op_new_object:
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeArrayBufferNeuteringWatchpointcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/ArrayBufferNeuteringWatchpoint.cpp (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/ArrayBufferNeuteringWatchpoint.cpp        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/Source/JavaScriptCore/runtime/ArrayBufferNeuteringWatchpoint.cpp        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -57,7 +57,7 @@
</span><span class="cx">
</span><span class="cx"> Structure* ArrayBufferNeuteringWatchpoint::createStructure(VM& vm)
</span><span class="cx"> {
</span><del>- return Structure::create(vm, 0, jsNull(), TypeInfo(CellType, StructureFlags), info());
</del><ins>+ return Structure::create(vm, 0, jsNull(), TypeInfo(CompoundType, StructureFlags), info());
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> } // namespace JSC
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeCommonSlowPathscpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/CommonSlowPaths.cpp (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/CommonSlowPaths.cpp        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/Source/JavaScriptCore/runtime/CommonSlowPaths.cpp        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -246,18 +246,10 @@
</span><span class="cx"> {
</span><span class="cx"> BEGIN();
</span><span class="cx"> JSValue v1 = OP(1).jsValue();
</span><del>- if (v1.isCell()) {
- Structure* myStructure = v1.asCell()->structure(vm);
- Structure* otherStructure = pc[2].u.structure.get();
- if (myStructure != otherStructure) {
- if (otherStructure)
- pc[3].u.toThisStatus = ToThisConflicted;
- pc[2].u.structure.set(vm, exec->codeBlock()->ownerExecutable(), myStructure);
- }
- } else {
- pc[3].u.toThisStatus = ToThisConflicted;
</del><ins>+ if (v1.isCell())
+ pc[2].u.structure.set(vm, exec->codeBlock()->ownerExecutable(), v1.asCell()->structure(vm));
+ else
</ins><span class="cx"> pc[2].u.structure.clear();
</span><del>- }
</del><span class="cx"> RETURN(v1.toThis(exec, exec->codeBlock()->isStrictMode() ? StrictMode : NotStrictMode));
</span><span class="cx"> }
</span><span class="cx">
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeExecutableh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/Executable.h (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/Executable.h        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/Source/JavaScriptCore/runtime/Executable.h        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -113,7 +113,7 @@
</span><span class="cx"> return m_numParametersForCall == NUM_PARAMETERS_IS_HOST;
</span><span class="cx"> }
</span><span class="cx">
</span><del>- static Structure* createStructure(VM& vm, JSGlobalObject* globalObject, JSValue proto) { return Structure::create(vm, globalObject, proto, TypeInfo(CellType, StructureFlags), info()); }
</del><ins>+ static Structure* createStructure(VM& vm, JSGlobalObject* globalObject, JSValue proto) { return Structure::create(vm, globalObject, proto, TypeInfo(CompoundType, StructureFlags), info()); }
</ins><span class="cx">
</span><span class="cx"> void clearCode();
</span><span class="cx">
</span><span class="lines">@@ -323,7 +323,7 @@
</span><span class="cx"> return OBJECT_OFFSETOF(NativeExecutable, m_constructor);
</span><span class="cx"> }
</span><span class="cx">
</span><del>- static Structure* createStructure(VM& vm, JSGlobalObject* globalObject, JSValue proto) { return Structure::create(vm, globalObject, proto, TypeInfo(CellType, StructureFlags), info()); }
</del><ins>+ static Structure* createStructure(VM& vm, JSGlobalObject* globalObject, JSValue proto) { return Structure::create(vm, globalObject, proto, TypeInfo(LeafType, StructureFlags), info()); }
</ins><span class="cx">
</span><span class="cx"> DECLARE_INFO;
</span><span class="cx">
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeHighFidelityLogcpp"></a>
<div class="delfile"><h4>Deleted: trunk/Source/JavaScriptCore/runtime/HighFidelityLog.cpp (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/HighFidelityLog.cpp        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/Source/JavaScriptCore/runtime/HighFidelityLog.cpp        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -1,124 +0,0 @@
</span><del>-/*
- * Copyright (C) 2014 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- *
- * 1. Redistributions of source code must retain the above copyright
- * notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- * notice, this list of conditions and the following disclaimer in the
- * documentation and/or other materials provided with the distribution.
- * 3. Neither the name of Apple Inc. ("Apple") nor the names of
- * its contributors may be used to endorse or promote products derived
- * from this software without specific prior written permission.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
- * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
- * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
- * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
- * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
- * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
- * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include "config.h"
-#include "HighFidelityLog.h"
-
-#include "JSCJSValueInlines.h"
-#include "TypeLocation.h"
-#include <wtf/CurrentTime.h>
-
-
-namespace JSC {
-
-static const bool verbose = false;
-
-void HighFidelityLog::initializeHighFidelityLog()
-{
- ASSERT(!m_logStartPtr);
- m_highFidelityLogSize = 50000;
- m_logStartPtr = new LogEntry[m_highFidelityLogSize];
- m_nextBuffer = new LogEntry[m_highFidelityLogSize];
- m_currentOffset = 0;
-}
-
-HighFidelityLog::~HighFidelityLog()
-{
- delete[] m_logStartPtr;
- delete[] m_nextBuffer;
-}
-
-void HighFidelityLog::recordTypeInformationForLocation(JSValue v, TypeLocation* location)
-{
- ASSERT(m_logStartPtr);
- ASSERT(m_currentOffset < m_highFidelityLogSize);
-
- LogEntry* entry = m_logStartPtr + m_currentOffset;
-
- entry->location = location;
- entry->value = v;
- entry->structure = (v.isCell() ? v.asCell()->structure() : nullptr);
-
- m_currentOffset += 1;
- if (m_currentOffset == m_highFidelityLogSize)
- processHighFidelityLog(true, "Log Full");
-}
-
-void HighFidelityLog::processHighFidelityLog(bool asynchronously, String reason)
-{
- // This should only be called from the main execution thread.
- if (!m_currentOffset)
- return;
-
- if (verbose)
- dataLog("Process caller:'", reason,"'");
-
- ByteSpinLocker* locker = new ByteSpinLocker(m_lock);
- ThreadData* data = new ThreadData;
- data->m_proccessLogToOffset = m_currentOffset;
- data->m_processLogPtr = m_logStartPtr;
- data->m_locker = locker;
-
- m_currentOffset = 0;
- LogEntry* temp = m_logStartPtr;
- m_logStartPtr = m_nextBuffer;
- m_nextBuffer = temp;
-
- if (asynchronously)
- createThread(actuallyProcessLogThreadFunction, data, "ProcessHighFidelityLog");
- else
- actuallyProcessLogThreadFunction(data);
-}
-
-void HighFidelityLog::actuallyProcessLogThreadFunction(void* arg)
-{
- double before = currentTimeMS();
- ThreadData* data = static_cast<ThreadData*>(arg);
- LogEntry* entry = data->m_processLogPtr;
- size_t processLogToOffset = data->m_proccessLogToOffset;
- size_t i = 0;
- while (i < processLogToOffset) {
- Structure* structure = entry->structure ? entry->structure : nullptr;
- RefPtr<StructureShape> shape;
- if (structure)
- shape = structure->toStructureShape();
- if (entry->location->m_globalTypeSet)
- entry->location->m_globalTypeSet->addTypeForValue(entry->value, shape);
- entry->location->m_instructionTypeSet->addTypeForValue(entry->value, shape);
- entry++;
- i++;
- }
-
- delete data->m_locker;
- delete data;
- double after = currentTimeMS();
- if (verbose)
- dataLogF("Processing the log took: '%f' ms\n", after - before);
-}
-
-} //namespace JSC
</del></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeHighFidelityLogh"></a>
<div class="delfile"><h4>Deleted: trunk/Source/JavaScriptCore/runtime/HighFidelityLog.h (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/HighFidelityLog.h        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/Source/JavaScriptCore/runtime/HighFidelityLog.h        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -1,83 +0,0 @@
</span><del>-/*
- * Copyright (C) 2014 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- *
- * 1. Redistributions of source code must retain the above copyright
- * notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- * notice, this list of conditions and the following disclaimer in the
- * documentation and/or other materials provided with the distribution.
- * 3. Neither the name of Apple Inc. ("Apple") nor the names of
- * its contributors may be used to endorse or promote products derived
- * from this software without specific prior written permission.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
- * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
- * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
- * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
- * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
- * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
- * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#ifndef HighFidelityLog_h
-#define HighFidelityLog_h
-
-#include "JSCJSValue.h"
-#include "HighFidelityTypeProfiler.h"
-#include "Structure.h"
-#include <wtf/ByteSpinLock.h>
-
-namespace JSC {
-
-class TypeLocation;
-
-class HighFidelityLog {
-
-public:
- struct LogEntry {
- public:
- JSValue value;
- TypeLocation* location;
- Structure* structure;
- };
-
- HighFidelityLog()
- : m_logStartPtr(0)
- {
- initializeHighFidelityLog();
- }
-
- ~HighFidelityLog();
-
- void recordTypeInformationForLocation(JSValue v, TypeLocation*);
- void processHighFidelityLog(bool asynchronously = false, String = "");
-
-private:
- void initializeHighFidelityLog();
- static void actuallyProcessLogThreadFunction(void*);
-
- unsigned m_highFidelityLogSize;
- size_t m_currentOffset;
- LogEntry* m_logStartPtr;
- LogEntry* m_nextBuffer;
-
- ByteSpinLock m_lock;
-
- struct ThreadData {
- public:
- LogEntry* m_processLogPtr;
- size_t m_proccessLogToOffset;
- ByteSpinLocker* m_locker;
- };
-};
-
-} //namespace JSC
-
-#endif //HighFidelityLog_h
</del></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeHighFidelityTypeProfilercpp"></a>
<div class="delfile"><h4>Deleted: trunk/Source/JavaScriptCore/runtime/HighFidelityTypeProfiler.cpp (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/HighFidelityTypeProfiler.cpp        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/Source/JavaScriptCore/runtime/HighFidelityTypeProfiler.cpp        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -1,88 +0,0 @@
</span><del>-/*
- * Copyright (C) 2014 Apple Inc. All Rights Reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- * notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- * notice, this list of conditions and the following disclaimer in the
- * documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include "config.h"
-#include "HighFidelityTypeProfiler.h"
-
-#include "TypeLocation.h"
-
-namespace JSC {
-
-static const bool verbose = false;
-
-String HighFidelityTypeProfiler::getTypesForVariableInRange(unsigned startLine, unsigned startColumn, unsigned endLine , unsigned endColumn, const String& variableName, intptr_t sourceID)
-{
- String global = getGlobalTypesForVariableInRange(startLine, startColumn, endLine, endColumn, variableName, sourceID);
- if (!global.isEmpty())
- return global;
-
- return getLocalTypesForVariableInRange(startLine, startColumn, endLine, endColumn, variableName, sourceID);
-}
-
-WTF::String HighFidelityTypeProfiler::getGlobalTypesForVariableInRange(unsigned startLine, unsigned, unsigned, unsigned, const WTF::String&, intptr_t sourceID)
-{
- auto iterLocationMap = m_globalLocationToGlobalIDMap.find(getLocationBasedHash(sourceID, startLine));
- if (iterLocationMap == m_globalLocationToGlobalIDMap.end())
- return "";
-
- auto iterIDMap = m_globalIDMap.find(iterLocationMap->second);
- if (iterIDMap == m_globalIDMap.end())
- return "";
-
- return iterIDMap->second->seenTypes();
-}
-
-WTF::String HighFidelityTypeProfiler::getLocalTypesForVariableInRange(unsigned startLine, unsigned , unsigned , unsigned , const WTF::String& , intptr_t sourceID)
-{
- auto iter = m_globalLocationMap.find(getLocationBasedHash(sourceID, startLine));
- auto end = m_globalLocationMap.end();
- if (iter == end)
- return "";
-
- return iter->second->seenTypes();
-}
-
-void HighFidelityTypeProfiler::insertNewLocation(TypeLocation* location)
-{
- if (verbose)
- dataLogF("Registering location:: line:%u, column:%u\n", location->m_line, location->m_column);
-
- LocationKey key(getLocationBasedHash(location->m_sourceID, location->m_line));
-
- if (location->m_globalVariableID != HighFidelityNoGlobalIDExists) {
- // Build the mapping relationships Map1:key=>globalId, Map2:globalID=>TypeSet
- m_globalLocationToGlobalIDMap[key] = location->m_globalVariableID;
- m_globalIDMap[location->m_globalVariableID] = location->m_globalTypeSet;
- }
-
- m_globalLocationMap[key] = location->m_instructionTypeSet;
-}
-
-LocationKey HighFidelityTypeProfiler::getLocationBasedHash(intptr_t id, unsigned line)
-{
- return LocationKey(id, line, 1);
-}
-
-} //namespace JSC
</del></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeHighFidelityTypeProfilerh"></a>
<div class="delfile"><h4>Deleted: trunk/Source/JavaScriptCore/runtime/HighFidelityTypeProfiler.h (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/HighFidelityTypeProfiler.h        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/Source/JavaScriptCore/runtime/HighFidelityTypeProfiler.h        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -1,89 +0,0 @@
</span><del>-/*
- * Copyright (C) 2014 Apple Inc. All Rights Reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- * notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- * notice, this list of conditions and the following disclaimer in the
- * documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#ifndef HighFidelityTypeProfiler_h
-#define HighFidelityTypeProfiler_h
-
-#include "CodeBlock.h"
-#include <unordered_map>
-#include <wtf/HashMap.h>
-#include <wtf/HashMethod.h>
-#include <wtf/text/WTFString.h>
-
-namespace JSC {
-
-class TypeLocation;
-
-struct LocationKey {
-
-public:
- LocationKey(intptr_t sourceID, unsigned line, unsigned column)
- : m_sourceID(sourceID)
- , m_line(line)
- , m_column(column)
-
- {
- }
-
- unsigned hash() const
- {
- return m_line + m_sourceID;
- }
-
- // FIXME: For now, this is a hack. We do the following: Map:"ID:Line" => TypeSet. Obviously, this assumes all assignments are on discrete lines, which is an incorrect assumption.
- bool operator==(const LocationKey& other) const
- {
- return m_sourceID == other.m_sourceID
- && m_line == other.m_line;
- }
-
- intptr_t m_sourceID;
- unsigned m_line;
- unsigned m_column;
-};
-
-class HighFidelityTypeProfiler {
-
-public:
- String getTypesForVariableInRange(unsigned startLine, unsigned startColumn, unsigned endLine, unsigned endColumn, const String& variableName, intptr_t sourceID);
- String getGlobalTypesForVariableInRange(unsigned startLine, unsigned startColumn, unsigned endLine, unsigned endColumn, const String& variableName, intptr_t sourceID);
- String getLocalTypesForVariableInRange(unsigned startLine, unsigned startColumn, unsigned endLine, unsigned endColumn, const String& variableName, intptr_t sourceID);
- void insertNewLocation(TypeLocation*);
-
-private:
- static LocationKey getLocationBasedHash(intptr_t, unsigned);
-
- typedef std::unordered_map<LocationKey, RefPtr<TypeSet>, HashMethod<LocationKey>> GlobalLocationMap;
- typedef std::unordered_map<int64_t, RefPtr<TypeSet>> GlobalIDMap;
- typedef std::unordered_map<LocationKey, int64_t, HashMethod<LocationKey>> GlobalLocationToGlobalIDMap;
-
- GlobalIDMap m_globalIDMap;
- GlobalLocationMap m_globalLocationMap;
- GlobalLocationToGlobalIDMap m_globalLocationToGlobalIDMap;
-};
-
-} //namespace JSC
-
-#endif //HighFidelityTypeProfiler_h
</del></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeJSObjectcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/JSObject.cpp (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/JSObject.cpp        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/Source/JavaScriptCore/runtime/JSObject.cpp        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -1242,7 +1242,7 @@
</span><span class="cx"> Structure* structure = this->structure(vm);
</span><span class="cx"> if (attributes & ReadOnly)
</span><span class="cx"> structure->setContainsReadOnlyProperties();
</span><del>- structure->setHasCustomGetterSetterPropertiesWithProtoCheck(propertyName == vm.propertyNames->underscoreProto);
</del><ins>+ structure->setHasCustomGetterSetterProperties(propertyName == vm.propertyNames->underscoreProto);
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> void JSObject::putDirectNonIndexAccessor(VM& vm, PropertyName propertyName, JSValue value, unsigned attributes)
</span><span class="lines">@@ -1260,7 +1260,7 @@
</span><span class="cx"> if (attributes & ReadOnly)
</span><span class="cx"> structure->setContainsReadOnlyProperties();
</span><span class="cx">
</span><del>- structure->setHasGetterSetterPropertiesWithProtoCheck(propertyName == vm.propertyNames->underscoreProto);
</del><ins>+ structure->setHasGetterSetterProperties(propertyName == vm.propertyNames->underscoreProto);
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> bool JSObject::hasProperty(ExecState* exec, PropertyName propertyName) const
</span><span class="lines">@@ -1638,7 +1638,7 @@
</span><span class="cx"> // If this object's ClassInfo has no static properties, then nothing to reify!
</span><span class="cx"> // We can safely set the flag to avoid the expensive check again in the future.
</span><span class="cx"> if (!classInfo()->hasStaticProperties()) {
</span><del>- structure(vm)->setStaticFunctionsReified(true);
</del><ins>+ structure(vm)->setStaticFunctionsReified();
</ins><span class="cx"> return;
</span><span class="cx"> }
</span><span class="cx">
</span><span class="lines">@@ -1656,7 +1656,7 @@
</span><span class="cx"> }
</span><span class="cx"> }
</span><span class="cx">
</span><del>- structure(vm)->setStaticFunctionsReified(true);
</del><ins>+ structure(vm)->setStaticFunctionsReified();
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> bool JSObject::removeDirect(VM& vm, PropertyName propertyName)
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeJSPromiseDeferredh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/JSPromiseDeferred.h (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/JSPromiseDeferred.h        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/Source/JavaScriptCore/runtime/JSPromiseDeferred.h        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -42,7 +42,7 @@
</span><span class="cx">
</span><span class="cx"> static Structure* createStructure(VM& vm, JSGlobalObject* globalObject, JSValue prototype)
</span><span class="cx"> {
</span><del>- return Structure::create(vm, globalObject, prototype, TypeInfo(CellType, StructureFlags), info());
</del><ins>+ return Structure::create(vm, globalObject, prototype, TypeInfo(CompoundType, StructureFlags), info());
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> static const bool hasImmortalStructure = true;
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeJSPromiseReactionh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/JSPromiseReaction.h (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/JSPromiseReaction.h        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/Source/JavaScriptCore/runtime/JSPromiseReaction.h        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -43,7 +43,7 @@
</span><span class="cx"> static JSPromiseReaction* create(VM&, JSPromiseDeferred*, JSValue);
</span><span class="cx"> static Structure* createStructure(VM& vm, JSGlobalObject* globalObject, JSValue prototype)
</span><span class="cx"> {
</span><del>- return Structure::create(vm, globalObject, prototype, TypeInfo(CellType, StructureFlags), info());
</del><ins>+ return Structure::create(vm, globalObject, prototype, TypeInfo(CompoundType, StructureFlags), info());
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> static const bool hasImmortalStructure = true;
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeJSPropertyNameIteratorh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/JSPropertyNameIterator.h (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/JSPropertyNameIterator.h        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/Source/JavaScriptCore/runtime/JSPropertyNameIterator.h        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -54,7 +54,7 @@
</span><span class="cx">
</span><span class="cx"> static Structure* createStructure(VM& vm, JSGlobalObject* globalObject, JSValue prototype)
</span><span class="cx"> {
</span><del>- return Structure::create(vm, globalObject, prototype, TypeInfo(CellType, StructureFlags), info());
</del><ins>+ return Structure::create(vm, globalObject, prototype, TypeInfo(CompoundType, StructureFlags), info());
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> static void visitChildren(JSCell*, SlotVisitor&);
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeJSTypeh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/JSType.h (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/JSType.h        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/Source/JavaScriptCore/runtime/JSType.h        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -29,11 +29,11 @@
</span><span class="cx"> BooleanType,
</span><span class="cx"> NumberType,
</span><span class="cx"> NullType,
</span><del>-
- // The CellType value must come before any JSType that is a JSCell.
- CellType,
</del><span class="cx"> StringType,
</span><ins>+ LeafType,
</ins><span class="cx">
</span><ins>+ // The CompoundType value must come before any JSType that may have children.
+ CompoundType,
</ins><span class="cx"> GetterSetterType,
</span><span class="cx"> CustomGetterSetterType,
</span><span class="cx"> APIValueWrapperType,
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeJSTypeInfoh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/JSTypeInfo.h (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/JSTypeInfo.h        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/Source/JavaScriptCore/runtime/JSTypeInfo.h        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -66,6 +66,7 @@
</span><span class="cx"> , m_flags(inlineTypeFlags)
</span><span class="cx"> , m_flags2(outOfLineTypeFlags)
</span><span class="cx"> {
</span><ins>+ ASSERT(m_type >= CompoundType || !(isSetOnFlags1(OverridesVisitChildren)));
</ins><span class="cx"> // No object that doesn't ImplementsHasInstance should override it!
</span><span class="cx"> ASSERT((m_flags & (ImplementsHasInstance | OverridesHasInstance)) != OverridesHasInstance);
</span><span class="cx"> // ImplementsDefaultHasInstance means (ImplementsHasInstance & !OverridesHasInstance)
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeMapDatah"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/MapData.h (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/MapData.h        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/Source/JavaScriptCore/runtime/MapData.h        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -78,7 +78,7 @@
</span><span class="cx">
</span><span class="cx"> static Structure* createStructure(VM& vm, JSGlobalObject* globalObject, JSValue prototype)
</span><span class="cx"> {
</span><del>- return Structure::create(vm, globalObject, prototype, TypeInfo(CellType, StructureFlags), info());
</del><ins>+ return Structure::create(vm, globalObject, prototype, TypeInfo(CompoundType, StructureFlags), info());
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> static const bool needsDestruction = true;
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeOptionsh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/Options.h (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/Options.h        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/Source/JavaScriptCore/runtime/Options.h        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -274,7 +274,6 @@
</span><span class="cx"> v(unsigned, gcMaxHeapSize, 0) \
</span><span class="cx"> v(bool, recordGCPauseTimes, false) \
</span><span class="cx"> v(bool, logHeapStatisticsAtExit, false) \
</span><del>- v(bool, profileTypesWithHighFidelity, false) \
</del><span class="cx"> \
</span><span class="cx"> v(bool, enableExceptionFuzz, false) \
</span><span class="cx"> v(unsigned, fireExceptionFuzzAt, 0)
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimePropertyMapHashTableh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/PropertyMapHashTable.h (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/PropertyMapHashTable.h        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/Source/JavaScriptCore/runtime/PropertyMapHashTable.h        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -144,7 +144,7 @@
</span><span class="cx">
</span><span class="cx"> static Structure* createStructure(VM& vm, JSGlobalObject* globalObject, JSValue prototype)
</span><span class="cx"> {
</span><del>- return Structure::create(vm, globalObject, prototype, TypeInfo(CellType, StructureFlags), info());
</del><ins>+ return Structure::create(vm, globalObject, prototype, TypeInfo(CompoundType, StructureFlags), info());
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> static void visitChildren(JSCell*, SlotVisitor&);
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeRegExph"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/RegExp.h (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/RegExp.h        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/Source/JavaScriptCore/runtime/RegExp.h        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -77,7 +77,7 @@
</span><span class="cx">
</span><span class="cx"> static Structure* createStructure(VM& vm, JSGlobalObject* globalObject, JSValue prototype)
</span><span class="cx"> {
</span><del>- return Structure::create(vm, globalObject, prototype, TypeInfo(CellType, StructureFlags), info());
</del><ins>+ return Structure::create(vm, globalObject, prototype, TypeInfo(LeafType, StructureFlags), info());
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> DECLARE_INFO;
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeSparseArrayValueMapcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/SparseArrayValueMap.cpp (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/SparseArrayValueMap.cpp        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/Source/JavaScriptCore/runtime/SparseArrayValueMap.cpp        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -69,7 +69,7 @@
</span><span class="cx">
</span><span class="cx"> Structure* SparseArrayValueMap::createStructure(VM& vm, JSGlobalObject* globalObject, JSValue prototype)
</span><span class="cx"> {
</span><del>- return Structure::create(vm, globalObject, prototype, TypeInfo(CellType, StructureFlags), info());
</del><ins>+ return Structure::create(vm, globalObject, prototype, TypeInfo(CompoundType, StructureFlags), info());
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> SparseArrayValueMap::AddResult SparseArrayValueMap::add(JSObject* array, unsigned i)
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeStructurecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/Structure.cpp (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/Structure.cpp        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/Source/JavaScriptCore/runtime/Structure.cpp        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -63,7 +63,7 @@
</span><span class="cx"> {
</span><span class="cx"> if (isUsingSingleSlot()) {
</span><span class="cx"> Structure* transition = singleTransition();
</span><del>- return transition && transition->m_nameInPrevious == rep && transition->attributesInPrevious() == attributes;
</del><ins>+ return transition && transition->m_nameInPrevious == rep && transition->m_attributesInPrevious == attributes;
</ins><span class="cx"> }
</span><span class="cx"> return map()->get(std::make_pair(rep, attributes));
</span><span class="cx"> }
</span><span class="lines">@@ -72,7 +72,7 @@
</span><span class="cx"> {
</span><span class="cx"> if (isUsingSingleSlot()) {
</span><span class="cx"> Structure* transition = singleTransition();
</span><del>- return (transition && transition->m_nameInPrevious == rep && transition->attributesInPrevious() == attributes) ? transition : 0;
</del><ins>+ return (transition && transition->m_nameInPrevious == rep && transition->m_attributesInPrevious == attributes) ? transition : 0;
</ins><span class="cx"> }
</span><span class="cx"> return map()->get(std::make_pair(rep, attributes));
</span><span class="cx"> }
</span><span class="lines">@@ -99,7 +99,7 @@
</span><span class="cx"> // Newer versions of the STL have an std::make_pair function that takes rvalue references.
</span><span class="cx"> // When either of the parameters are bitfields, the C++ compiler will try to bind them as lvalues, which is invalid. To work around this, use unary "+" to make the parameter an rvalue.
</span><span class="cx"> // See https://bugs.webkit.org/show_bug.cgi?id=59261 for more details
</span><del>- map()->set(std::make_pair(structure->m_nameInPrevious.get(), +structure->attributesInPrevious()), structure);
</del><ins>+ map()->set(std::make_pair(structure->m_nameInPrevious.get(), +structure->m_attributesInPrevious), structure);
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> void Structure::dumpStatistics()
</span><span class="lines">@@ -157,24 +157,23 @@
</span><span class="cx"> , m_transitionWatchpointSet(IsWatched)
</span><span class="cx"> , m_offset(invalidOffset)
</span><span class="cx"> , m_inlineCapacity(inlineCapacity)
</span><del>- , m_bitField(0)
</del><ins>+ , m_dictionaryKind(NoneDictionaryKind)
+ , m_hasBeenFlattenedBefore(false)
+ , m_isPinnedPropertyTable(false)
+ , m_hasGetterSetterProperties(classInfo->hasStaticSetterOrReadonlyProperties(vm))
+ , m_hasCustomGetterSetterProperties(false)
+ , m_hasReadOnlyOrGetterSetterPropertiesExcludingProto(classInfo->hasStaticSetterOrReadonlyProperties(vm))
+ , m_hasNonEnumerableProperties(false)
+ , m_attributesInPrevious(0)
+ , m_specificFunctionThrashCount(0)
+ , m_preventExtensions(false)
+ , m_didTransition(false)
+ , m_staticFunctionReified(false)
+ , m_hasRareData(false)
</ins><span class="cx"> {
</span><del>- setDictionaryKind(NoneDictionaryKind);
- setIsPinnedPropertyTable(false);
- setHasGetterSetterProperties(classInfo->hasStaticSetterOrReadonlyProperties(vm));
- setHasCustomGetterSetterProperties(false);
- setHasReadOnlyOrGetterSetterPropertiesExcludingProto(classInfo->hasStaticSetterOrReadonlyProperties(vm));
- setHasNonEnumerableProperties(false);
- setAttributesInPrevious(0);
- setSpecificFunctionThrashCount(0);
- setPreventExtensions(false);
- setDidTransition(false);
- setStaticFunctionsReified(false);
- setHasRareData(false);
-
</del><span class="cx"> ASSERT(inlineCapacity <= JSFinalObject::maxInlineCapacity());
</span><span class="cx"> ASSERT(static_cast<PropertyOffset>(inlineCapacity) < firstOutOfLineOffset);
</span><del>- ASSERT(!hasRareData());
</del><ins>+ ASSERT(!m_hasRareData);
</ins><span class="cx"> ASSERT(hasReadOnlyOrGetterSetterPropertiesExcludingProto() || !m_classInfo->hasStaticSetterOrReadonlyProperties(vm));
</span><span class="cx"> ASSERT(hasGetterSetterProperties() || !m_classInfo->hasStaticSetterOrReadonlyProperties(vm));
</span><span class="cx"> }
</span><span class="lines">@@ -188,22 +187,21 @@
</span><span class="cx"> , m_transitionWatchpointSet(IsWatched)
</span><span class="cx"> , m_offset(invalidOffset)
</span><span class="cx"> , m_inlineCapacity(0)
</span><del>- , m_bitField(0)
</del><ins>+ , m_dictionaryKind(NoneDictionaryKind)
+ , m_hasBeenFlattenedBefore(false)
+ , m_isPinnedPropertyTable(false)
+ , m_hasGetterSetterProperties(m_classInfo->hasStaticSetterOrReadonlyProperties(vm))
+ , m_hasCustomGetterSetterProperties(false)
+ , m_hasReadOnlyOrGetterSetterPropertiesExcludingProto(m_classInfo->hasStaticSetterOrReadonlyProperties(vm))
+ , m_hasNonEnumerableProperties(false)
+ , m_attributesInPrevious(0)
+ , m_specificFunctionThrashCount(0)
+ , m_preventExtensions(false)
+ , m_didTransition(false)
+ , m_staticFunctionReified(false)
+ , m_hasRareData(false)
</ins><span class="cx"> {
</span><del>- setDictionaryKind(NoneDictionaryKind);
- setIsPinnedPropertyTable(false);
- setHasGetterSetterProperties(m_classInfo->hasStaticSetterOrReadonlyProperties(vm));
- setHasCustomGetterSetterProperties(false);
- setHasReadOnlyOrGetterSetterPropertiesExcludingProto(m_classInfo->hasStaticSetterOrReadonlyProperties(vm));
- setHasNonEnumerableProperties(false);
- setAttributesInPrevious(0);
- setSpecificFunctionThrashCount(0);
- setPreventExtensions(false);
- setDidTransition(false);
- setStaticFunctionsReified(false);
- setHasRareData(false);
-
- TypeInfo typeInfo = TypeInfo(CellType, OverridesVisitChildren | StructureIsImmortal);
</del><ins>+ TypeInfo typeInfo = TypeInfo(CompoundType, OverridesVisitChildren | StructureIsImmortal);
</ins><span class="cx"> m_blob = StructureIDBlob(vm.heap.structureIDTable().allocateID(this), 0, typeInfo);
</span><span class="cx"> m_outOfLineTypeFlags = typeInfo.outOfLineTypeFlags();
</span><span class="cx">
</span><span class="lines">@@ -218,27 +216,26 @@
</span><span class="cx"> , m_transitionWatchpointSet(IsWatched)
</span><span class="cx"> , m_offset(invalidOffset)
</span><span class="cx"> , m_inlineCapacity(previous->m_inlineCapacity)
</span><del>- , m_bitField(0)
</del><ins>+ , m_dictionaryKind(previous->m_dictionaryKind)
+ , m_hasBeenFlattenedBefore(previous->m_hasBeenFlattenedBefore)
+ , m_isPinnedPropertyTable(false)
+ , m_hasGetterSetterProperties(previous->m_hasGetterSetterProperties)
+ , m_hasCustomGetterSetterProperties(previous->m_hasCustomGetterSetterProperties)
+ , m_hasReadOnlyOrGetterSetterPropertiesExcludingProto(previous->m_hasReadOnlyOrGetterSetterPropertiesExcludingProto)
+ , m_hasNonEnumerableProperties(previous->m_hasNonEnumerableProperties)
+ , m_attributesInPrevious(0)
+ , m_specificFunctionThrashCount(previous->m_specificFunctionThrashCount)
+ , m_preventExtensions(previous->m_preventExtensions)
+ , m_didTransition(true)
+ , m_staticFunctionReified(previous->m_staticFunctionReified)
+ , m_hasRareData(false)
</ins><span class="cx"> {
</span><del>- setDictionaryKind(previous->dictionaryKind());
- setIsPinnedPropertyTable(previous->hasBeenFlattenedBefore());
- setHasGetterSetterProperties(previous->hasGetterSetterProperties());
- setHasCustomGetterSetterProperties(previous->hasCustomGetterSetterProperties());
- setHasReadOnlyOrGetterSetterPropertiesExcludingProto(previous->hasReadOnlyOrGetterSetterPropertiesExcludingProto());
- setHasNonEnumerableProperties(previous->hasNonEnumerableProperties());
- setAttributesInPrevious(0);
- setSpecificFunctionThrashCount(previous->specificFunctionThrashCount());
- setPreventExtensions(previous->preventExtensions());
- setDidTransition(false);
- setStaticFunctionsReified(previous->staticFunctionsReified());
- setHasRareData(false);
-
</del><span class="cx"> TypeInfo typeInfo = previous->typeInfo();
</span><span class="cx"> m_blob = StructureIDBlob(vm.heap.structureIDTable().allocateID(this), previous->indexingTypeIncludingHistory(), typeInfo);
</span><span class="cx"> m_outOfLineTypeFlags = typeInfo.outOfLineTypeFlags();
</span><span class="cx">
</span><span class="cx"> ASSERT(!previous->typeInfo().structureIsImmortal());
</span><del>- if (previous->hasRareData() && previous->rareData()->needsCloning())
</del><ins>+ if (previous->m_hasRareData && previous->rareData()->needsCloning())
</ins><span class="cx"> cloneRareDataFrom(vm, previous);
</span><span class="cx"> setPreviousID(vm, previous);
</span><span class="cx">
</span><span class="lines">@@ -313,7 +310,7 @@
</span><span class="cx"> structure = structures[i];
</span><span class="cx"> if (!structure->m_nameInPrevious)
</span><span class="cx"> continue;
</span><del>- PropertyMapEntry entry(vm, this, structure->m_nameInPrevious.get(), structure->m_offset, structure->attributesInPrevious(), structure->m_specificValueInPrevious.get());
</del><ins>+ PropertyMapEntry entry(vm, this, structure->m_nameInPrevious.get(), structure->m_offset, structure->m_attributesInPrevious, structure->m_specificValueInPrevious.get());
</ins><span class="cx"> propertyTable()->add(entry, m_offset, PropertyTable::PropertyOffsetMustNotChange);
</span><span class="cx"> }
</span><span class="cx">
</span><span class="lines">@@ -432,7 +429,7 @@
</span><span class="cx"> ASSERT(structure->isObject());
</span><span class="cx"> ASSERT(!Structure::addPropertyTransitionToExistingStructure(structure, propertyName, attributes, specificValue, offset));
</span><span class="cx">
</span><del>- if (structure->specificFunctionThrashCount() == maxSpecificFunctionThrashCount)
</del><ins>+ if (structure->m_specificFunctionThrashCount == maxSpecificFunctionThrashCount)
</ins><span class="cx"> specificValue = 0;
</span><span class="cx">
</span><span class="cx"> int maxTransitionLength;
</span><span class="lines">@@ -451,7 +448,7 @@
</span><span class="cx">
</span><span class="cx"> transition->m_cachedPrototypeChain.setMayBeNull(vm, transition, structure->m_cachedPrototypeChain.get());
</span><span class="cx"> transition->m_nameInPrevious = propertyName.uid();
</span><del>- transition->setAttributesInPrevious(attributes);
</del><ins>+ transition->m_attributesInPrevious = attributes;
</ins><span class="cx"> transition->m_specificValueInPrevious.setMayBeNull(vm, transition, specificValue);
</span><span class="cx"> transition->propertyTable().set(vm, transition, structure->takePropertyTableOrCloneIfPinned(vm));
</span><span class="cx"> transition->m_offset = structure->m_offset;
</span><span class="lines">@@ -498,10 +495,10 @@
</span><span class="cx">
</span><span class="cx"> Structure* Structure::despecifyFunctionTransition(VM& vm, Structure* structure, PropertyName replaceFunction)
</span><span class="cx"> {
</span><del>- ASSERT(structure->specificFunctionThrashCount() < maxSpecificFunctionThrashCount);
</del><ins>+ ASSERT(structure->m_specificFunctionThrashCount < maxSpecificFunctionThrashCount);
</ins><span class="cx"> Structure* transition = create(vm, structure);
</span><span class="cx">
</span><del>- transition->setSpecificFunctionThrashCount(transition->specificFunctionThrashCount() + 1);
</del><ins>+ ++transition->m_specificFunctionThrashCount;
</ins><span class="cx">
</span><span class="cx"> DeferGC deferGC(vm.heap);
</span><span class="cx"> structure->materializePropertyMapIfNecessary(vm, deferGC);
</span><span class="lines">@@ -509,7 +506,7 @@
</span><span class="cx"> transition->m_offset = structure->m_offset;
</span><span class="cx"> transition->pin();
</span><span class="cx">
</span><del>- if (transition->specificFunctionThrashCount() == maxSpecificFunctionThrashCount)
</del><ins>+ if (transition->m_specificFunctionThrashCount == maxSpecificFunctionThrashCount)
</ins><span class="cx"> transition->despecifyAllFunctions(vm);
</span><span class="cx"> else {
</span><span class="cx"> bool removed = transition->despecifyFunction(vm, replaceFunction);
</span><span class="lines">@@ -553,7 +550,7 @@
</span><span class="cx"> structure->materializePropertyMapIfNecessary(vm, deferGC);
</span><span class="cx"> transition->propertyTable().set(vm, transition, structure->copyPropertyTableForPinning(vm));
</span><span class="cx"> transition->m_offset = structure->m_offset;
</span><del>- transition->setDictionaryKind(kind);
</del><ins>+ transition->m_dictionaryKind = kind;
</ins><span class="cx"> transition->pin();
</span><span class="cx">
</span><span class="cx"> transition->checkOffsetConsistency();
</span><span class="lines">@@ -594,7 +591,7 @@
</span><span class="cx"> PropertyTable::iterator iter = transition->propertyTable()->begin();
</span><span class="cx"> PropertyTable::iterator end = transition->propertyTable()->end();
</span><span class="cx"> if (iter != end)
</span><del>- transition->setHasReadOnlyOrGetterSetterPropertiesExcludingProto(true);
</del><ins>+ transition->m_hasReadOnlyOrGetterSetterPropertiesExcludingProto = true;
</ins><span class="cx"> for (; iter != end; ++iter)
</span><span class="cx"> iter->attributes |= iter->attributes & Accessor ? DontDelete : (DontDelete | ReadOnly);
</span><span class="cx"> }
</span><span class="lines">@@ -616,7 +613,7 @@
</span><span class="cx"> structure->materializePropertyMapIfNecessary(vm, deferGC);
</span><span class="cx"> transition->propertyTable().set(vm, transition, structure->copyPropertyTableForPinning(vm));
</span><span class="cx"> transition->m_offset = structure->m_offset;
</span><del>- transition->setPreventExtensions(true);
</del><ins>+ transition->m_preventExtensions = true;
</ins><span class="cx"> transition->pin();
</span><span class="cx">
</span><span class="cx"> transition->checkOffsetConsistency();
</span><span class="lines">@@ -628,7 +625,7 @@
</span><span class="cx"> DeferGC deferGC(vm.heap);
</span><span class="cx"> materializePropertyMapIfNecessaryForPinning(vm, deferGC);
</span><span class="cx">
</span><del>- if (isPinnedPropertyTable())
</del><ins>+ if (m_isPinnedPropertyTable)
</ins><span class="cx"> return propertyTable()->copy(vm, propertyTable()->size() + 1);
</span><span class="cx">
</span><span class="cx"> // Hold the lock while stealing the table - so that getConcurrently() on another thread
</span><span class="lines">@@ -657,13 +654,13 @@
</span><span class="cx">
</span><span class="cx"> Structure* existingTransition;
</span><span class="cx"> if (!structure->isDictionary() && (existingTransition = structure->m_transitionTable.get(0, attributes))) {
</span><del>- ASSERT(existingTransition->attributesInPrevious() == attributes);
</del><ins>+ ASSERT(existingTransition->m_attributesInPrevious == attributes);
</ins><span class="cx"> ASSERT(existingTransition->indexingTypeIncludingHistory() == indexingType);
</span><span class="cx"> return existingTransition;
</span><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> Structure* transition = create(vm, structure);
</span><del>- transition->setAttributesInPrevious(attributes);
</del><ins>+ transition->m_attributesInPrevious = attributes;
</ins><span class="cx"> transition->m_blob.setIndexingType(indexingType);
</span><span class="cx"> transition->propertyTable().set(vm, transition, structure->takePropertyTableOrCloneIfPinned(vm));
</span><span class="cx"> transition->m_offset = structure->m_offset;
</span><span class="lines">@@ -750,8 +747,8 @@
</span><span class="cx"> checkOffsetConsistency();
</span><span class="cx"> }
</span><span class="cx">
</span><del>- setDictionaryKind(NoneDictionaryKind);
- setHasBeenFlattenedBefore(true);
</del><ins>+ m_dictionaryKind = NoneDictionaryKind;
+ m_hasBeenFlattenedBefore = true;
</ins><span class="cx">
</span><span class="cx"> size_t afterOutOfLineCapacity = this->outOfLineCapacity();
</span><span class="cx">
</span><span class="lines">@@ -775,7 +772,7 @@
</span><span class="cx"> {
</span><span class="cx"> ASSERT(!enumerationCache());
</span><span class="cx">
</span><del>- if (specificFunctionThrashCount() == maxSpecificFunctionThrashCount)
</del><ins>+ if (m_specificFunctionThrashCount == maxSpecificFunctionThrashCount)
</ins><span class="cx"> specificValue = 0;
</span><span class="cx">
</span><span class="cx"> DeferGC deferGC(vm.heap);
</span><span class="lines">@@ -801,28 +798,28 @@
</span><span class="cx"> void Structure::pin()
</span><span class="cx"> {
</span><span class="cx"> ASSERT(propertyTable());
</span><del>- setIsPinnedPropertyTable(true);
</del><ins>+ m_isPinnedPropertyTable = true;
</ins><span class="cx"> clearPreviousID();
</span><span class="cx"> m_nameInPrevious.clear();
</span><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> void Structure::allocateRareData(VM& vm)
</span><span class="cx"> {
</span><del>- ASSERT(!hasRareData());
</del><ins>+ ASSERT(!m_hasRareData);
</ins><span class="cx"> StructureRareData* rareData = StructureRareData::create(vm, previous());
</span><span class="cx"> m_previousOrRareData.set(vm, this, rareData);
</span><del>- setHasRareData(true);
- ASSERT(hasRareData());
</del><ins>+ m_hasRareData = true;
+ ASSERT(m_hasRareData);
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> void Structure::cloneRareDataFrom(VM& vm, const Structure* other)
</span><span class="cx"> {
</span><del>- ASSERT(!hasRareData());
- ASSERT(other->hasRareData());
</del><ins>+ ASSERT(!m_hasRareData);
+ ASSERT(other->m_hasRareData);
</ins><span class="cx"> StructureRareData* newRareData = StructureRareData::clone(vm, other->rareData());
</span><span class="cx"> m_previousOrRareData.set(vm, this, newRareData);
</span><del>- setHasRareData(true);
- ASSERT(hasRareData());
</del><ins>+ m_hasRareData = true;
+ ASSERT(m_hasRareData);
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> #if DUMP_PROPERTYMAP_STATS
</span><span class="lines">@@ -906,7 +903,7 @@
</span><span class="cx"> if (structure->m_nameInPrevious.get() != uid)
</span><span class="cx"> continue;
</span><span class="cx">
</span><del>- attributes = structure->attributesInPrevious();
</del><ins>+ attributes = structure->m_attributesInPrevious;
</ins><span class="cx"> specificValue = structure->m_specificValueInPrevious.get();
</span><span class="cx"> return structure->m_offset;
</span><span class="cx"> }
</span><span class="lines">@@ -950,7 +947,7 @@
</span><span class="cx">
</span><span class="cx"> checkConsistency();
</span><span class="cx"> if (attributes & DontEnum)
</span><del>- setHasNonEnumerableProperties(true);
</del><ins>+ m_hasNonEnumerableProperties = true;
</ins><span class="cx">
</span><span class="cx"> StringImpl* rep = propertyName.uid();
</span><span class="cx">
</span><span class="lines">@@ -1008,7 +1005,7 @@
</span><span class="cx">
</span><span class="cx"> PropertyTable::iterator end = propertyTable()->end();
</span><span class="cx"> for (PropertyTable::iterator iter = propertyTable()->begin(); iter != end; ++iter) {
</span><del>- ASSERT(hasNonEnumerableProperties() || !(iter->attributes & DontEnum));
</del><ins>+ ASSERT(m_hasNonEnumerableProperties || !(iter->attributes & DontEnum));
</ins><span class="cx"> if (!iter->key->isEmptyUnique() && (!(iter->attributes & DontEnum) || mode == IncludeDontEnumProperties)) {
</span><span class="cx"> if (knownUnique)
</span><span class="cx"> propertyNames.addKnownUnique(iter->key);
</span><span class="lines">@@ -1040,7 +1037,7 @@
</span><span class="cx"> visitor.append(&thisObject->m_previousOrRareData);
</span><span class="cx"> visitor.append(&thisObject->m_specificValueInPrevious);
</span><span class="cx">
</span><del>- if (thisObject->isPinnedPropertyTable()) {
</del><ins>+ if (thisObject->m_isPinnedPropertyTable) {
</ins><span class="cx"> ASSERT(thisObject->m_propertyTableUnsafe);
</span><span class="cx"> visitor.append(&thisObject->m_propertyTableUnsafe);
</span><span class="cx"> } else if (thisObject->m_propertyTableUnsafe)
</span><span class="lines">@@ -1073,39 +1070,6 @@
</span><span class="cx"> }
</span><span class="cx"> }
</span><span class="cx">
</span><del>-
-PassRefPtr<StructureShape> Structure::toStructureShape()
-{
- Vector<Structure*, 8> structures;
- Structure* structure;
- PropertyTable* table;
- RefPtr<StructureShape> shape = StructureShape::create();
-
- findStructuresAndMapForMaterialization(structures, structure, table);
-
- if (table) {
- PropertyTable::iterator iter = table->begin();
- PropertyTable::iterator end = table->end();
-
- for (; iter != end; ++iter)
- shape->addProperty(iter->key);
-
- structure->m_lock.unlock();
- }
-
- for (unsigned i = structures.size(); i--;) {
- Structure* structure = structures[i];
- if (!structure->m_nameInPrevious)
- continue;
-
- shape->addProperty(structure->m_nameInPrevious.get());
- }
-
- shape->markAsFinal();
-
- return shape.release();
-}
-
</del><span class="cx"> void Structure::dump(PrintStream& out) const
</span><span class="cx"> {
</span><span class="cx"> out.print(RawPointer(this), ":[", classInfo()->className, ", {");
</span><span class="lines">@@ -1235,7 +1199,7 @@
</span><span class="cx"> if (!propertyTable())
</span><span class="cx"> return;
</span><span class="cx">
</span><del>- if (!hasNonEnumerableProperties()) {
</del><ins>+ if (!m_hasNonEnumerableProperties) {
</ins><span class="cx"> PropertyTable::iterator end = propertyTable()->end();
</span><span class="cx"> for (PropertyTable::iterator iter = propertyTable()->begin(); iter != end; ++iter) {
</span><span class="cx"> ASSERT(!(iter->attributes & DontEnum));
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeStructureh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/Structure.h (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/Structure.h        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/Source/JavaScriptCore/runtime/Structure.h        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -127,7 +127,8 @@
</span><span class="cx">
</span><span class="cx"> JS_EXPORT_PRIVATE bool isSealed(VM&);
</span><span class="cx"> JS_EXPORT_PRIVATE bool isFrozen(VM&);
</span><del>- bool isExtensible() const { return !preventExtensions(); }
</del><ins>+ bool isExtensible() const { return !m_preventExtensions; }
+ bool didTransition() const { return m_didTransition; }
</ins><span class="cx"> bool putWillGrowOutOfLineStorage();
</span><span class="cx"> size_t suggestedNewOutOfLineStorageCapacity();
</span><span class="cx">
</span><span class="lines">@@ -142,11 +143,13 @@
</span><span class="cx"> PropertyOffset removePropertyWithoutTransition(VM&, PropertyName);
</span><span class="cx"> void setPrototypeWithoutTransition(VM& vm, JSValue prototype) { m_prototype.set(vm, this, prototype); }
</span><span class="cx">
</span><del>- bool isDictionary() const { return dictionaryKind() != NoneDictionaryKind; }
- bool isUncacheableDictionary() const { return dictionaryKind() == UncachedDictionaryKind; }
-
- bool propertyAccessesAreCacheable() { return dictionaryKind() != UncachedDictionaryKind && !typeInfo().prohibitsPropertyCaching(); }
</del><ins>+ bool isDictionary() const { return m_dictionaryKind != NoneDictionaryKind; }
+ bool isUncacheableDictionary() const { return m_dictionaryKind == UncachedDictionaryKind; }
</ins><span class="cx">
</span><ins>+ bool hasBeenFlattenedBefore() const { return m_hasBeenFlattenedBefore; }
+
+ bool propertyAccessesAreCacheable() { return m_dictionaryKind != UncachedDictionaryKind && !typeInfo().prohibitsPropertyCaching(); }
+
</ins><span class="cx"> // We use SlowPath in GetByIdStatus for structures that may get new impure properties later to prevent
</span><span class="cx"> // DFG from inlining property accesses since structures don't transition when a new impure property appears.
</span><span class="cx"> bool takesSlowPathInDFGForImpureProperty()
</span><span class="lines">@@ -193,7 +196,7 @@
</span><span class="cx"> Structure* previousID() const
</span><span class="cx"> {
</span><span class="cx"> ASSERT(structure()->classInfo() == info());
</span><del>- if (hasRareData())
</del><ins>+ if (m_hasRareData)
</ins><span class="cx"> return rareData()->previousID();
</span><span class="cx"> return previous();
</span><span class="cx"> }
</span><span class="lines">@@ -267,23 +270,31 @@
</span><span class="cx">
</span><span class="cx"> PropertyOffset getConcurrently(VM&, StringImpl* uid);
</span><span class="cx"> PropertyOffset getConcurrently(VM&, StringImpl* uid, unsigned& attributes, JSCell*& specificValue);
</span><del>-
- void setHasGetterSetterPropertiesWithProtoCheck(bool is__proto__)
</del><ins>+
+ bool hasGetterSetterProperties() const { return m_hasGetterSetterProperties; }
+ bool hasReadOnlyOrGetterSetterPropertiesExcludingProto() const { return m_hasReadOnlyOrGetterSetterPropertiesExcludingProto; }
+ void setHasGetterSetterProperties(bool is__proto__)
</ins><span class="cx"> {
</span><del>- setHasGetterSetterProperties(true);
</del><ins>+ m_hasGetterSetterProperties = true;
</ins><span class="cx"> if (!is__proto__)
</span><del>- setHasReadOnlyOrGetterSetterPropertiesExcludingProto(true);
</del><ins>+ m_hasReadOnlyOrGetterSetterPropertiesExcludingProto = true;
</ins><span class="cx"> }
</span><del>-
- void setContainsReadOnlyProperties() { setHasReadOnlyOrGetterSetterPropertiesExcludingProto(true); }
-
- void setHasCustomGetterSetterPropertiesWithProtoCheck(bool is__proto__)
</del><ins>+
+ bool hasCustomGetterSetterProperties() const { return m_hasCustomGetterSetterProperties; }
+ void setHasCustomGetterSetterProperties(bool is__proto__)
</ins><span class="cx"> {
</span><del>- setHasCustomGetterSetterProperties(true);
</del><ins>+ m_hasCustomGetterSetterProperties = true;
</ins><span class="cx"> if (!is__proto__)
</span><del>- setHasReadOnlyOrGetterSetterPropertiesExcludingProto(true);
</del><ins>+ m_hasReadOnlyOrGetterSetterPropertiesExcludingProto = true;
</ins><span class="cx"> }
</span><del>-
</del><ins>+
+ void setContainsReadOnlyProperties()
+ {
+ m_hasReadOnlyOrGetterSetterPropertiesExcludingProto = true;
+ }
+
+ bool hasNonEnumerableProperties() const { return m_hasNonEnumerableProperties; }
+
</ins><span class="cx"> bool isEmpty() const
</span><span class="cx"> {
</span><span class="cx"> ASSERT(checkOffsetConsistency());
</span><span class="lines">@@ -291,7 +302,7 @@
</span><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> JS_EXPORT_PRIVATE void despecifyDictionaryFunction(VM&, PropertyName);
</span><del>- void disableSpecificFunctionTracking() { setSpecificFunctionThrashCount(maxSpecificFunctionThrashCount); }
</del><ins>+ void disableSpecificFunctionTracking() { m_specificFunctionThrashCount = maxSpecificFunctionThrashCount; }
</ins><span class="cx">
</span><span class="cx"> void setEnumerationCache(VM&, JSPropertyNameIterator* enumerationCache); // Defined in JSPropertyNameIterator.h.
</span><span class="cx"> JSPropertyNameIterator* enumerationCache(); // Defined in JSPropertyNameIterator.h.
</span><span class="lines">@@ -299,18 +310,28 @@
</span><span class="cx">
</span><span class="cx"> JSString* objectToStringValue()
</span><span class="cx"> {
</span><del>- if (!hasRareData())
</del><ins>+ if (!m_hasRareData)
</ins><span class="cx"> return 0;
</span><span class="cx"> return rareData()->objectToStringValue();
</span><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> void setObjectToStringValue(VM& vm, JSString* value)
</span><span class="cx"> {
</span><del>- if (!hasRareData())
</del><ins>+ if (!m_hasRareData)
</ins><span class="cx"> allocateRareData(vm);
</span><span class="cx"> rareData()->setObjectToStringValue(vm, value);
</span><span class="cx"> }
</span><span class="cx">
</span><ins>+ bool staticFunctionsReified()
+ {
+ return m_staticFunctionReified;
+ }
+
+ void setStaticFunctionsReified()
+ {
+ m_staticFunctionReified = true;
+ }
+
</ins><span class="cx"> const ClassInfo* classInfo() const { return m_classInfo; }
</span><span class="cx">
</span><span class="cx"> static ptrdiff_t structureIDOffset()
</span><span class="lines">@@ -381,8 +402,6 @@
</span><span class="cx"> {
</span><span class="cx"> return m_transitionWatchpointSet;
</span><span class="cx"> }
</span><del>-
- PassRefPtr<StructureShape> toStructureShape();
</del><span class="cx">
</span><span class="cx"> void dump(PrintStream&) const;
</span><span class="cx"> void dumpInContext(PrintStream&, DumpContext*) const;
</span><span class="lines">@@ -393,38 +412,6 @@
</span><span class="cx"> DECLARE_EXPORT_INFO;
</span><span class="cx">
</span><span class="cx"> private:
</span><del>- typedef enum {
- NoneDictionaryKind = 0,
- CachedDictionaryKind = 1,
- UncachedDictionaryKind = 2
- } DictionaryKind;
-
-public:
-#define DEFINE_BITFIELD(type, lowerName, upperName, width, offset) \
- static const uint32_t s_##lowerName##Shift = offset;\
- static const uint32_t s_##lowerName##Mask = ((1 << (width - 1)) | ((1 << (width - 1)) - 1));\
- type lowerName() const { return static_cast<type>((m_bitField >> offset) & s_##lowerName##Mask); }\
- void set##upperName(type newValue) \
- {\
- m_bitField &= ~(s_##lowerName##Mask << offset);\
- m_bitField |= (newValue & s_##lowerName##Mask) << offset;\
- }
-
- DEFINE_BITFIELD(DictionaryKind, dictionaryKind, DictionaryKind, 2, 0);
- DEFINE_BITFIELD(bool, isPinnedPropertyTable, IsPinnedPropertyTable, 1, 2);
- DEFINE_BITFIELD(bool, hasGetterSetterProperties, HasGetterSetterProperties, 1, 3);
- DEFINE_BITFIELD(bool, hasReadOnlyOrGetterSetterPropertiesExcludingProto, HasReadOnlyOrGetterSetterPropertiesExcludingProto, 1, 4);
- DEFINE_BITFIELD(bool, hasNonEnumerableProperties, HasNonEnumerableProperties, 1, 5);
- DEFINE_BITFIELD(unsigned, attributesInPrevious, AttributesInPrevious, 14, 6);
- DEFINE_BITFIELD(unsigned, specificFunctionThrashCount, SpecificFunctionThrashCount, 2, 20);
- DEFINE_BITFIELD(bool, preventExtensions, PreventExtensions, 1, 22);
- DEFINE_BITFIELD(bool, didTransition, DidTransition, 1, 23);
- DEFINE_BITFIELD(bool, staticFunctionsReified, StaticFunctionsReified, 1, 24);
- DEFINE_BITFIELD(bool, hasRareData, HasRareData, 1, 25);
- DEFINE_BITFIELD(bool, hasBeenFlattenedBefore, HasBeenFlattenedBefore, 1, 26);
- DEFINE_BITFIELD(bool, hasCustomGetterSetterProperties, HasCustomGetterSetterProperties, 1, 27);
-
-private:
</del><span class="cx"> friend class LLIntOffsetsExtractor;
</span><span class="cx">
</span><span class="cx"> JS_EXPORT_PRIVATE Structure(VM&, JSGlobalObject*, JSValue prototype, const TypeInfo&, const ClassInfo*, IndexingType, unsigned inlineCapacity);
</span><span class="lines">@@ -441,6 +428,11 @@
</span><span class="cx"> // to unlock it.
</span><span class="cx"> void findStructuresAndMapForMaterialization(Vector<Structure*, 8>& structures, Structure*&, PropertyTable*&);
</span><span class="cx">
</span><ins>+ typedef enum {
+ NoneDictionaryKind = 0,
+ CachedDictionaryKind = 1,
+ UncachedDictionaryKind = 2
+ } DictionaryKind;
</ins><span class="cx"> static Structure* toDictionaryTransition(VM&, Structure*, DictionaryKind);
</span><span class="cx">
</span><span class="cx"> PropertyOffset putSpecificValue(VM&, PropertyName, unsigned attributes, JSCell* specificValue);
</span><span class="lines">@@ -487,7 +479,7 @@
</span><span class="cx">
</span><span class="cx"> void setPreviousID(VM& vm, Structure* structure)
</span><span class="cx"> {
</span><del>- if (hasRareData())
</del><ins>+ if (m_hasRareData)
</ins><span class="cx"> rareData()->setPreviousID(vm, structure);
</span><span class="cx"> else
</span><span class="cx"> m_previousOrRareData.set(vm, this, structure);
</span><span class="lines">@@ -495,7 +487,7 @@
</span><span class="cx">
</span><span class="cx"> void clearPreviousID()
</span><span class="cx"> {
</span><del>- if (hasRareData())
</del><ins>+ if (m_hasRareData)
</ins><span class="cx"> rareData()->clearPreviousID();
</span><span class="cx"> else
</span><span class="cx"> m_previousOrRareData.clear();
</span><span class="lines">@@ -514,13 +506,13 @@
</span><span class="cx">
</span><span class="cx"> Structure* previous() const
</span><span class="cx"> {
</span><del>- ASSERT(!hasRareData());
</del><ins>+ ASSERT(!m_hasRareData);
</ins><span class="cx"> return static_cast<Structure*>(m_previousOrRareData.get());
</span><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> StructureRareData* rareData() const
</span><span class="cx"> {
</span><del>- ASSERT(hasRareData());
</del><ins>+ ASSERT(m_hasRareData);
</ins><span class="cx"> return static_cast<StructureRareData*>(m_previousOrRareData.get());
</span><span class="cx"> }
</span><span class="cx">
</span><span class="lines">@@ -566,7 +558,19 @@
</span><span class="cx">
</span><span class="cx"> ConcurrentJITLock m_lock;
</span><span class="cx">
</span><del>- uint32_t m_bitField;
</del><ins>+ unsigned m_dictionaryKind : 2;
+ bool m_hasBeenFlattenedBefore : 1;
+ bool m_isPinnedPropertyTable : 1;
+ bool m_hasGetterSetterProperties : 1;
+ bool m_hasCustomGetterSetterProperties : 1;
+ bool m_hasReadOnlyOrGetterSetterPropertiesExcludingProto : 1;
+ bool m_hasNonEnumerableProperties : 1;
+ unsigned m_attributesInPrevious : 14;
+ unsigned m_specificFunctionThrashCount : 2;
+ unsigned m_preventExtensions : 1;
+ unsigned m_didTransition : 1;
+ unsigned m_staticFunctionReified : 1;
+ bool m_hasRareData : 1;
</ins><span class="cx"> };
</span><span class="cx">
</span><span class="cx"> } // namespace JSC
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeStructureChainh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/StructureChain.h (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/StructureChain.h        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/Source/JavaScriptCore/runtime/StructureChain.h        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -57,7 +57,7 @@
</span><span class="cx">
</span><span class="cx"> static Structure* createStructure(VM& vm, JSGlobalObject* globalObject, JSValue prototype)
</span><span class="cx"> {
</span><del>- return Structure::create(vm, globalObject, prototype, TypeInfo(CellType, StructureFlags), info());
</del><ins>+ return Structure::create(vm, globalObject, prototype, TypeInfo(CompoundType, StructureFlags), info());
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> DECLARE_INFO;
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeStructureInlinesh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/StructureInlines.h (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/StructureInlines.h        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/Source/JavaScriptCore/runtime/StructureInlines.h        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -154,14 +154,14 @@
</span><span class="cx"> inline void Structure::setEnumerationCache(VM& vm, JSPropertyNameIterator* enumerationCache)
</span><span class="cx"> {
</span><span class="cx"> ASSERT(!isDictionary());
</span><del>- if (!hasRareData())
</del><ins>+ if (!m_hasRareData)
</ins><span class="cx"> allocateRareData(vm);
</span><span class="cx"> rareData()->setEnumerationCache(vm, enumerationCache);
</span><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> inline JSPropertyNameIterator* Structure::enumerationCache()
</span><span class="cx"> {
</span><del>- if (!hasRareData())
</del><ins>+ if (!m_hasRareData)
</ins><span class="cx"> return 0;
</span><span class="cx"> return rareData()->enumerationCache();
</span><span class="cx"> }
</span><span class="lines">@@ -247,7 +247,7 @@
</span><span class="cx"> PropertyTable* propertyTable = m_propertyTableUnsafe.get();
</span><span class="cx">
</span><span class="cx"> if (!propertyTable) {
</span><del>- ASSERT(!isPinnedPropertyTable());
</del><ins>+ ASSERT(!m_isPinnedPropertyTable);
</ins><span class="cx"> return true;
</span><span class="cx"> }
</span><span class="cx">
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeStructureRareDatacpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/StructureRareData.cpp (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/StructureRareData.cpp        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/Source/JavaScriptCore/runtime/StructureRareData.cpp        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -36,7 +36,7 @@
</span><span class="cx">
</span><span class="cx"> Structure* StructureRareData::createStructure(VM& vm, JSGlobalObject* globalObject, JSValue prototype)
</span><span class="cx"> {
</span><del>- return Structure::create(vm, globalObject, prototype, TypeInfo(CellType, StructureFlags), info());
</del><ins>+ return Structure::create(vm, globalObject, prototype, TypeInfo(CompoundType, StructureFlags), info());
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> StructureRareData* StructureRareData::create(VM& vm, Structure* previous)
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeSymbolTablecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/SymbolTable.cpp (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/SymbolTable.cpp        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/Source/JavaScriptCore/runtime/SymbolTable.cpp        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -103,11 +103,6 @@
</span><span class="cx"> , m_captureEnd(0)
</span><span class="cx"> , m_functionEnteredOnce(ClearWatchpoint)
</span><span class="cx"> {
</span><del>- if (vm.isProfilingTypesWithHighFidelity()) {
- m_uniqueIDMap = std::make_unique<UniqueIDMap>();
- m_registerToVariableMap = std::make_unique<RegisterToVariableMap>();
- m_uniqueTypeSetMap = std::make_unique<UniqueTypeSetMap>();
- }
</del><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> SymbolTable::~SymbolTable() { }
</span><span class="lines">@@ -162,72 +157,9 @@
</span><span class="cx"> for (unsigned i = parameterCount(); i--;)
</span><span class="cx"> result->m_slowArguments[i] = m_slowArguments[i];
</span><span class="cx"> }
</span><del>-
- if (m_uniqueIDMap && result->m_uniqueIDMap) {
-
- {
- auto iter = m_uniqueIDMap->begin();
- auto end = m_uniqueIDMap->end();
- for (; iter != end; ++iter)
- result->m_uniqueIDMap->set(iter->key, iter->value);
- }
-
- {
- auto iter = m_registerToVariableMap->begin();
- auto end = m_registerToVariableMap->end();
- for (; iter != end; ++iter)
- result->m_registerToVariableMap->set(iter->key, iter->value);
- }
-
- {
- auto iter = m_uniqueTypeSetMap->begin();
- auto end = m_uniqueTypeSetMap->end();
- for (; iter != end; ++iter)
- result->m_uniqueTypeSetMap->set(iter->key, iter->value);
- }
- }
-
</del><span class="cx">
</span><span class="cx"> return result;
</span><span class="cx"> }
</span><span class="cx">
</span><del>-int64_t SymbolTable::uniqueIDForVariable(const ConcurrentJITLocker&, StringImpl* key, VM& vm)
-{
- auto iter = m_uniqueIDMap->find(key);
- auto end = m_uniqueIDMap->end();
- ASSERT_UNUSED(end, iter != end);
-
- int64_t& id = iter->value;
- if (id == HighFidelityNeedsUniqueIDGeneration) {
- id = vm.getNextUniqueVariableID();
- m_uniqueTypeSetMap->set(key, TypeSet::create()); //make a new global typeset for the ID
- }
-
- return id;
-}
-
-int64_t SymbolTable::uniqueIDForRegister(const ConcurrentJITLocker& locker, int registerIndex, VM& vm)
-{
- auto iter = m_registerToVariableMap->find(registerIndex);
- auto end = m_registerToVariableMap->end();
- ASSERT_UNUSED(end, iter != end);
- return uniqueIDForVariable(locker, iter->value.get(), vm);
-}
-
-RefPtr<TypeSet> SymbolTable::globalTypeSetForRegister(const ConcurrentJITLocker& locker, int registerIndex, VM& vm)
-{
- uniqueIDForRegister(locker, registerIndex, vm); //ensure it's created
- auto iter = m_registerToVariableMap->find(registerIndex);
- auto end = m_registerToVariableMap->end();
- ASSERT_UNUSED(end, iter != end);
- return globalTypeSetForVariable(locker, iter->value.get(), vm);
-}
-
-RefPtr<TypeSet> SymbolTable::globalTypeSetForVariable(const ConcurrentJITLocker& locker, StringImpl* key, VM& vm)
-{
- uniqueIDForVariable(locker, key, vm);
- return m_uniqueTypeSetMap->find(key)->value;
-}
-
</del><span class="cx"> } // namespace JSC
</span><span class="cx">
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeSymbolTableh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/SymbolTable.h (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/SymbolTable.h        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/Source/JavaScriptCore/runtime/SymbolTable.h        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -31,7 +31,6 @@
</span><span class="cx">
</span><span class="cx"> #include "ConcurrentJITLock.h"
</span><span class="cx"> #include "JSObject.h"
</span><del>-#include "TypeSet.h"
</del><span class="cx"> #include "VariableWatchpointSet.h"
</span><span class="cx"> #include <memory>
</span><span class="cx"> #include <wtf/HashTraits.h>
</span><span class="lines">@@ -337,9 +336,6 @@
</span><span class="cx"> typedef JSCell Base;
</span><span class="cx">
</span><span class="cx"> typedef HashMap<RefPtr<StringImpl>, SymbolTableEntry, IdentifierRepHash, HashTraits<RefPtr<StringImpl>>, SymbolTableIndexHashTraits> Map;
</span><del>- typedef HashMap<RefPtr<StringImpl>, int64_t> UniqueIDMap;
- typedef HashMap<RefPtr<StringImpl>, RefPtr<TypeSet>> UniqueTypeSetMap;
- typedef HashMap<int, RefPtr<StringImpl>, WTF::IntHash<int>, WTF::UnsignedWithZeroKeyHashTraits<int>> RegisterToVariableMap;
</del><span class="cx">
</span><span class="cx"> static SymbolTable* create(VM& vm)
</span><span class="cx"> {
</span><span class="lines">@@ -353,7 +349,7 @@
</span><span class="cx">
</span><span class="cx"> static Structure* createStructure(VM& vm, JSGlobalObject* globalObject, JSValue prototype)
</span><span class="cx"> {
</span><del>- return Structure::create(vm, globalObject, prototype, TypeInfo(CellType, StructureFlags), info());
</del><ins>+ return Structure::create(vm, globalObject, prototype, TypeInfo(LeafType, StructureFlags), info());
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> // You must hold the lock until after you're done with the iterator.
</span><span class="lines">@@ -417,12 +413,6 @@
</span><span class="cx">
</span><span class="cx"> Map::AddResult add(const ConcurrentJITLocker&, StringImpl* key, const SymbolTableEntry& entry)
</span><span class="cx"> {
</span><del>- if (m_uniqueIDMap) {
- // Use a flag to indicate that we need to produce a unique ID. Because VM is in charge of creating uniqueIDs,
- // when uniqueID() is called, we check this flag to see if uniqueID creation is necessary.
- m_uniqueIDMap->set(key, HighFidelityNeedsUniqueIDGeneration);
- m_registerToVariableMap->set(entry.getIndex(), key);
- }
</del><span class="cx"> return m_map.add(key, entry);
</span><span class="cx"> }
</span><span class="cx">
</span><span class="lines">@@ -434,10 +424,6 @@
</span><span class="cx">
</span><span class="cx"> Map::AddResult set(const ConcurrentJITLocker&, StringImpl* key, const SymbolTableEntry& entry)
</span><span class="cx"> {
</span><del>- if (m_uniqueIDMap) {
- m_uniqueIDMap->set(key, HighFidelityNeedsUniqueIDGeneration);
- m_registerToVariableMap->set(entry.getIndex(), key);
- }
</del><span class="cx"> return m_map.set(key, entry);
</span><span class="cx"> }
</span><span class="cx">
</span><span class="lines">@@ -458,11 +444,6 @@
</span><span class="cx"> return contains(locker, key);
</span><span class="cx"> }
</span><span class="cx">
</span><del>- int64_t uniqueIDForVariable(const ConcurrentJITLocker&, StringImpl* key, VM& vm);
- int64_t uniqueIDForRegister(const ConcurrentJITLocker& locker, int registerIndex, VM& vm);
- RefPtr<TypeSet> globalTypeSetForRegister(const ConcurrentJITLocker& locker, int registerIndex, VM& vm);
- RefPtr<TypeSet> globalTypeSetForVariable(const ConcurrentJITLocker& locker, StringImpl* key, VM& vm);
-
</del><span class="cx"> bool usesNonStrictEval() { return m_usesNonStrictEval; }
</span><span class="cx"> void setUsesNonStrictEval(bool usesNonStrictEval) { m_usesNonStrictEval = usesNonStrictEval; }
</span><span class="cx">
</span><span class="lines">@@ -513,10 +494,7 @@
</span><span class="cx"> ~SymbolTable();
</span><span class="cx">
</span><span class="cx"> Map m_map;
</span><del>- std::unique_ptr<UniqueIDMap> m_uniqueIDMap;
- std::unique_ptr<RegisterToVariableMap> m_registerToVariableMap;
- std::unique_ptr<UniqueTypeSetMap> m_uniqueTypeSetMap;
-
</del><ins>+
</ins><span class="cx"> int m_parameterCountIncludingThis;
</span><span class="cx"> bool m_usesNonStrictEval;
</span><span class="cx">
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeTypeSetcpp"></a>
<div class="delfile"><h4>Deleted: trunk/Source/JavaScriptCore/runtime/TypeSet.cpp (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/TypeSet.cpp        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/Source/JavaScriptCore/runtime/TypeSet.cpp        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -1,236 +0,0 @@
</span><del>-/*
- * Copyright (C) 2008, 2014 Apple Inc. All Rights Reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- * notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- * notice, this list of conditions and the following disclaimer in the
- * documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include "config.h"
-#include "TypeSet.h"
-
-#include "JSCJSValue.h"
-#include "JSCJSValueInlines.h"
-#include <wtf/text/CString.h>
-#include <wtf/text/WTFString.h>
-#include <wtf/text/StringBuilder.h>
-#include <wtf/Vector.h>
-
-namespace JSC {
-
-TypeSet::TypeSet()
- : m_seenTypes(TypeNothing)
- , m_structureHistory(new Vector<RefPtr<StructureShape>>)
- , m_mightHaveDuplicatesInStructureHistory(false)
-{
-}
-
-RuntimeType TypeSet::getRuntimeTypeForValue(JSValue v)
-{
- RuntimeType ret;
- if (v.isFunction())
- ret = TypeFunction;
- else if (v.isUndefined())
- ret = TypeUndefined;
- else if (v.isNull())
- ret = TypeNull;
- else if (v.isBoolean())
- ret = TypeBoolean;
- else if (v.isMachineInt())
- ret = TypeMachineInt;
- else if (v.isNumber())
- ret = TypeNumber;
- else if (v.isString())
- ret = TypeString;
- else if (v.isPrimitive())
- ret = TypePrimitive;
- else if (v.isObject())
- ret = TypeObject;
- else
- CRASH();
-
- return ret;
-}
-
-void TypeSet::addTypeForValue(JSValue v, PassRefPtr<StructureShape> shape)
-{
- RuntimeType t = getRuntimeTypeForValue(v);
- m_seenTypes = m_seenTypes | t;
-
- if (shape) {
- m_structureHistory->append(shape);
- m_mightHaveDuplicatesInStructureHistory = true;
- }
-}
-
-void TypeSet::removeDuplicatesInStructureHistory()
-{
- Vector<RefPtr<StructureShape>>* newHistory = new Vector<RefPtr<StructureShape>>;
- HashMap<String, bool> container;
- for (size_t i = 0; i < m_structureHistory->size(); i++) {
- RefPtr<StructureShape> a = m_structureHistory->at(i);
- String hash = a->propertyHash();
- auto iter = container.find(hash);
- if (iter == container.end()) {
- container.add(hash, true);
- newHistory->append(a);
- }
- }
-
- delete m_structureHistory;
- m_structureHistory = newHistory;
- m_mightHaveDuplicatesInStructureHistory = false;
-}
-
-String TypeSet::seenTypes()
-{
- if (m_seenTypes == TypeNothing)
- return "(Unreached Statement)";
-
- if (m_mightHaveDuplicatesInStructureHistory)
- removeDuplicatesInStructureHistory();
-
- StringBuilder seen;
-
- if (m_seenTypes & TypeFunction)
- seen.append("Function ");
- if (m_seenTypes & TypeUndefined)
- seen.append("Undefined ");
- if (m_seenTypes & TypeNull)
- seen.append("Null ");
- if (m_seenTypes & TypeBoolean)
- seen.append("Boolean ");
- if (m_seenTypes & TypeMachineInt)
- seen.append("MachineInt ");
- if (m_seenTypes & TypeNumber)
- seen.append("Number ");
- if (m_seenTypes & TypeString)
- seen.append("String ");
- if (m_seenTypes & TypePrimitive)
- seen.append("Primitive ");
- if (m_seenTypes & TypeObject)
- seen.append("Object ");
-
- if (m_structureHistory->size())
- seen.append("\nStructures:[ ");
- for (size_t i = 0; i < m_structureHistory->size(); i++) {
- seen.append(m_structureHistory->at(i)->stringRepresentation());
- seen.append(" ");
- }
- if (m_structureHistory->size())
- seen.append("]");
-
- if (m_structureHistory->size()) {
- seen.append("\nLUB: ");
- seen.append(StructureShape::leastUpperBound(m_structureHistory));
- }
-
- return seen.toString();
-}
-
-void TypeSet::dumpSeenTypes()
-{
- dataLog(seenTypes(), "\n");
-}
-
-StructureShape::StructureShape()
- : m_propertyHash(nullptr)
- , m_final(false)
-{
-}
-
-void StructureShape::markAsFinal()
-{
- ASSERT(!m_final);
- m_final = true;
-}
-
-void StructureShape::addProperty(RefPtr<StringImpl> impl)
-{
- ASSERT(!m_final);
- m_fields.set(impl, true);
-}
-
-String StructureShape::propertyHash()
-{
- ASSERT(m_final);
- if (m_propertyHash)
- return *m_propertyHash;
-
- StringBuilder builder;
- builder.append(":");
- for (auto iter = m_fields.begin(), end = m_fields.end(); iter != end; ++iter) {
- String property = String(iter->key);
- property.replace(":", "\\:"); // Ensure that hash({"foo:", "bar"}) != hash({"foo", ":bar"}) because we're using colons as a separator and colons are legal characters in field names in JS.
- builder.append(property);
- }
-
- m_propertyHash = std::make_unique<String>(builder.toString());
- return *m_propertyHash;
-}
-
-String StructureShape::leastUpperBound(Vector<RefPtr<StructureShape>>* shapes)
-{
- if (!shapes->size())
- return "";
-
- StringBuilder lub;
- RefPtr<StructureShape> origin = shapes->at(0);
- lub.append("{");
- for (auto iter = origin->m_fields.begin(), end = origin->m_fields.end(); iter != end; ++iter) {
- bool shouldAdd = true;
- for (size_t i = 1, size = shapes->size(); i < size; i++) {
- // If all other Shapes have the same field as origin, add it to the least upper bound.
- if (!shapes->at(i)->m_fields.contains(iter->key)) {
- shouldAdd = false;
- break;
- }
- }
- if (shouldAdd)
- lub.append(String(iter->key.get()) + String(", "));
- }
-
- if (lub.length() >= 3)
- lub.resize(lub.length() - 2); // Remove the trailing ', '
-
- lub.append("}");
-
- return lub.toString();
-}
-
-String StructureShape::stringRepresentation()
-{
- StringBuilder representation;
- representation.append("{");
- for (auto iter = m_fields.begin(), end = m_fields.end(); iter != end; ++iter) {
- String prop(iter->key.get());
- representation.append(prop);
- representation.append(", ");
- }
-
- if (representation.length() >= 3)
- representation.resize(representation.length() - 2);
-
- representation.append("}");
-
- return representation.toString();
-}
-
-} //namespace JSC
</del></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeTypeSeth"></a>
<div class="delfile"><h4>Deleted: trunk/Source/JavaScriptCore/runtime/TypeSet.h (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/TypeSet.h        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/Source/JavaScriptCore/runtime/TypeSet.h        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -1,90 +0,0 @@
</span><del>-/*
- * Copyright (C) 2008, 2014 Apple Inc. All Rights Reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- * notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- * notice, this list of conditions and the following disclaimer in the
- * documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#ifndef TypeSet_h
-#define TypeSet_h
-
-#include <wtf/HashMap.h>
-#include <wtf/RefCounted.h>
-#include <wtf/text/WTFString.h>
-#include <wtf/Vector.h>
-
-namespace JSC {
-
-class JSValue;
-
-enum RuntimeType {
- TypeNothing = 0x0,
- TypeFunction = 0x1,
- TypeUndefined = 0x2,
- TypeNull = 0x4,
- TypeBoolean = 0x8,
- TypeMachineInt = 0x10,
- TypeNumber = 0x20,
- TypeString = 0x40,
- TypePrimitive = 0x80,
- TypeObject = 0x100
-};
-
-class StructureShape : public RefCounted<StructureShape> {
- friend class TypeSet;
-
-public:
- StructureShape();
-
- static PassRefPtr<StructureShape> create() { return adoptRef(new StructureShape); }
- String propertyHash();
- void markAsFinal();
- void addProperty(RefPtr<StringImpl>);
- static String leastUpperBound(Vector<RefPtr<StructureShape>>*);
- String stringRepresentation();
-
-private:
- HashMap<RefPtr<StringImpl>, bool> m_fields;
- std::unique_ptr<String> m_propertyHash;
- bool m_final;
-};
-
-class TypeSet : public RefCounted<TypeSet> {
-
-public:
- static PassRefPtr<TypeSet> create() { return adoptRef(new TypeSet); }
- TypeSet();
- void addTypeForValue(JSValue v, PassRefPtr<StructureShape>);
- static RuntimeType getRuntimeTypeForValue(JSValue);
- JS_EXPORT_PRIVATE String seenTypes();
-
-private:
- uint32_t m_seenTypes;
- void dumpSeenTypes();
- Vector<RefPtr<StructureShape>>* m_structureHistory;
- bool m_mightHaveDuplicatesInStructureHistory;
- void removeDuplicatesInStructureHistory();
-
-};
-
-} //namespace JSC
-
-#endif //TypeSet_h
</del></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeVMcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/VM.cpp (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/VM.cpp        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/Source/JavaScriptCore/runtime/VM.cpp        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -40,7 +40,7 @@
</span><span class="cx"> #include "CustomGetterSetter.h"
</span><span class="cx"> #include "DFGLongLivedState.h"
</span><span class="cx"> #include "DFGWorklist.h"
</span><del>-#include "DebuggerScope.h"
</del><ins>+#include "DebuggerActivation.h"
</ins><span class="cx"> #include "ErrorInstance.h"
</span><span class="cx"> #include "FTLThunks.h"
</span><span class="cx"> #include "FunctionConstructor.h"
</span><span class="lines">@@ -48,8 +48,6 @@
</span><span class="cx"> #include "GetterSetter.h"
</span><span class="cx"> #include "Heap.h"
</span><span class="cx"> #include "HeapIterationScope.h"
</span><del>-#include "HighFidelityTypeProfiler.h"
-#include "HighFidelityLog.h"
</del><span class="cx"> #include "HostCallReturnValue.h"
</span><span class="cx"> #include "Identifier.h"
</span><span class="cx"> #include "IncrementalSweeper.h"
</span><span class="lines">@@ -91,7 +89,6 @@
</span><span class="cx"> #include <wtf/Threading.h>
</span><span class="cx"> #include <wtf/WTFThreadData.h>
</span><span class="cx"> #include <wtf/text/AtomicStringTable.h>
</span><del>-#include <wtf/CurrentTime.h>
</del><span class="cx">
</span><span class="cx"> #if ENABLE(DFG_JIT)
</span><span class="cx"> #include "ConservativeRoots.h"
</span><span class="lines">@@ -233,7 +230,6 @@
</span><span class="cx"> , m_codeCache(CodeCache::create())
</span><span class="cx"> , m_enabledProfiler(nullptr)
</span><span class="cx"> , m_builtinExecutables(BuiltinExecutables::create(*this))
</span><del>- , m_nextUniqueVariableID(1)
</del><span class="cx"> {
</span><span class="cx"> interpreter = new Interpreter(*this);
</span><span class="cx"> StackBounds stack = wtfThreadData().stack();
</span><span class="lines">@@ -249,7 +245,7 @@
</span><span class="cx"> propertyNames = new CommonIdentifiers(this);
</span><span class="cx"> structureStructure.set(*this, Structure::createStructure(*this));
</span><span class="cx"> structureRareDataStructure.set(*this, StructureRareData::createStructure(*this, 0, jsNull()));
</span><del>- debuggerScopeStructure.set(*this, DebuggerScope::createStructure(*this, 0, jsNull()));
</del><ins>+ debuggerActivationStructure.set(*this, DebuggerActivation::createStructure(*this, 0, jsNull()));
</ins><span class="cx"> terminatedExecutionErrorStructure.set(*this, TerminatedExecutionError::createStructure(*this, 0, jsNull()));
</span><span class="cx"> stringStructure.set(*this, JSString::createStructure(*this, 0, jsNull()));
</span><span class="cx"> notAnObjectStructure.set(*this, JSNotAnObject::createStructure(*this, 0, jsNull()));
</span><span class="lines">@@ -268,6 +264,7 @@
</span><span class="cx"> structureChainStructure.set(*this, StructureChain::createStructure(*this, 0, jsNull()));
</span><span class="cx"> sparseArrayValueMapStructure.set(*this, SparseArrayValueMap::createStructure(*this, 0, jsNull()));
</span><span class="cx"> arrayBufferNeuteringWatchpointStructure.set(*this, ArrayBufferNeuteringWatchpoint::createStructure(*this));
</span><ins>+ withScopeStructure.set(*this, JSWithScope::createStructure(*this, 0, jsNull()));
</ins><span class="cx"> unlinkedFunctionExecutableStructure.set(*this, UnlinkedFunctionExecutable::createStructure(*this, 0, jsNull()));
</span><span class="cx"> unlinkedProgramCodeBlockStructure.set(*this, UnlinkedProgramCodeBlock::createStructure(*this, 0, jsNull()));
</span><span class="cx"> unlinkedEvalCodeBlockStructure.set(*this, UnlinkedEvalCodeBlock::createStructure(*this, 0, jsNull()));
</span><span class="lines">@@ -325,12 +322,6 @@
</span><span class="cx"> // Initialize this last, as a free way of asserting that VM initialization itself
</span><span class="cx"> // won't use this.
</span><span class="cx"> m_typedArrayController = adoptRef(new SimpleTypedArrayController());
</span><del>-
- // FIXME: conditionally allocate this stuff based on whether or not the inspector is running OR this flag is enabled (not just if the flag is enabled).
- if (Options::profileTypesWithHighFidelity()) {
- m_highFidelityTypeProfiler = std::make_unique<HighFidelityTypeProfiler>();
- m_highFidelityLog = std::make_unique<HighFidelityLog>();
- }
</del><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> VM::~VM()
</span><span class="lines">@@ -923,46 +914,6 @@
</span><span class="cx"> }
</span><span class="cx"> }
</span><span class="cx">
</span><del>-String VM::getTypesForVariableInRange(unsigned startLine, unsigned startColumn, unsigned endLine, unsigned endColumn, const String& variableName, const String& sourceIDAsString)
-{
- if (!isProfilingTypesWithHighFidelity())
- return "(Not Profiling)";
-
- bool okay;
- intptr_t sourceID = sourceIDAsString.toIntPtrStrict(&okay);
- if (!okay)
- CRASH();
-
- updateHighFidelityTypeProfileState();
- return m_highFidelityTypeProfiler->getTypesForVariableInRange(startLine, startColumn, endLine, endColumn, variableName, sourceID);
-}
-
-void VM::updateHighFidelityTypeProfileState()
-{
- if (!isProfilingTypesWithHighFidelity())
- return;
-
- highFidelityLog()->processHighFidelityLog(false, "VM Update");
-}
-
-void VM::dumpHighFidelityProfilingTypes()
-{
- if (!isProfilingTypesWithHighFidelity())
- return;
-
- updateHighFidelityTypeProfileState();
- HighFidelityTypeProfiler* profiler = m_highFidelityTypeProfiler.get();
- for (Bag<TypeLocation>::iterator iter = m_locationInfo.begin(); !!iter; ++iter) {
- TypeLocation* location = *iter;
- dataLogF("[Line, Column]::[%u, %u] ", location->m_line, location->m_column);
- dataLog("\n\t\t#Local#\n\t\t",
- profiler->getLocalTypesForVariableInRange(location->m_line, location->m_column, location->m_line, location->m_column, "", location->m_sourceID).replace("\n", "\n\t\t"),
- "\n\t\t#Global#\n\t\t",
- profiler->getGlobalTypesForVariableInRange(location->m_line, location->m_column, location->m_line, location->m_column, "", location->m_sourceID).replace("\n", "\n\t\t"),
- "\n");
- }
-}
-
</del><span class="cx"> void sanitizeStackForVM(VM* vm)
</span><span class="cx"> {
</span><span class="cx"> logSanitizeStack(vm);
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeVMh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/VM.h (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/VM.h        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/Source/JavaScriptCore/runtime/VM.h        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -46,11 +46,9 @@
</span><span class="cx"> #include "Strong.h"
</span><span class="cx"> #include "ThunkGenerators.h"
</span><span class="cx"> #include "TypedArrayController.h"
</span><del>-#include "TypeLocation.h"
</del><span class="cx"> #include "Watchdog.h"
</span><span class="cx"> #include "Watchpoint.h"
</span><span class="cx"> #include "WeakRandom.h"
</span><del>-#include <wtf/Bag.h>
</del><span class="cx"> #include <wtf/BumpPointerAllocator.h>
</span><span class="cx"> #include <wtf/DateMath.h>
</span><span class="cx"> #include <wtf/Forward.h>
</span><span class="lines">@@ -76,8 +74,6 @@
</span><span class="cx"> class CommonIdentifiers;
</span><span class="cx"> class ExecState;
</span><span class="cx"> class HandleStack;
</span><del>- class HighFidelityTypeProfiler;
- class HighFidelityLog;
</del><span class="cx"> class Identifier;
</span><span class="cx"> class Interpreter;
</span><span class="cx"> class JSGlobalObject;
</span><span class="lines">@@ -88,7 +84,6 @@
</span><span class="cx"> class NativeExecutable;
</span><span class="cx"> class ParserArena;
</span><span class="cx"> class RegExpCache;
</span><del>- class ScriptExecutable;
</del><span class="cx"> class SourceProvider;
</span><span class="cx"> class SourceProviderCache;
</span><span class="cx"> struct StackFrame;
</span><span class="lines">@@ -101,7 +96,6 @@
</span><span class="cx"> class UnlinkedEvalCodeBlock;
</span><span class="cx"> class UnlinkedFunctionExecutable;
</span><span class="cx"> class UnlinkedProgramCodeBlock;
</span><del>- class VirtualRegister;
</del><span class="cx"> class VMEntryScope;
</span><span class="cx"> class Watchpoint;
</span><span class="cx"> class WatchpointSet;
</span><span class="lines">@@ -262,7 +256,7 @@
</span><span class="cx">
</span><span class="cx"> Strong<Structure> structureStructure;
</span><span class="cx"> Strong<Structure> structureRareDataStructure;
</span><del>- Strong<Structure> debuggerScopeStructure;
</del><ins>+ Strong<Structure> debuggerActivationStructure;
</ins><span class="cx"> Strong<Structure> terminatedExecutionErrorStructure;
</span><span class="cx"> Strong<Structure> stringStructure;
</span><span class="cx"> Strong<Structure> notAnObjectStructure;
</span><span class="lines">@@ -281,6 +275,7 @@
</span><span class="cx"> Strong<Structure> structureChainStructure;
</span><span class="cx"> Strong<Structure> sparseArrayValueMapStructure;
</span><span class="cx"> Strong<Structure> arrayBufferNeuteringWatchpointStructure;
</span><ins>+ Strong<Structure> withScopeStructure;
</ins><span class="cx"> Strong<Structure> unlinkedFunctionExecutableStructure;
</span><span class="cx"> Strong<Structure> unlinkedProgramCodeBlockStructure;
</span><span class="cx"> Strong<Structure> unlinkedEvalCodeBlockStructure;
</span><span class="lines">@@ -515,15 +510,6 @@
</span><span class="cx">
</span><span class="cx"> BuiltinExecutables* builtinExecutables() { return m_builtinExecutables.get(); }
</span><span class="cx">
</span><del>- bool isProfilingTypesWithHighFidelity() { return !!m_highFidelityTypeProfiler; }
- String getTypesForVariableInRange(unsigned startLine, unsigned startColumn, unsigned endLine, unsigned endColumn, const String& variableName, const String& sourceID);
- HighFidelityLog* highFidelityLog() { return m_highFidelityLog.get(); }
- HighFidelityTypeProfiler* highFidelityTypeProfiler() { return m_highFidelityTypeProfiler.get(); }
- void updateHighFidelityTypeProfileState();
- TypeLocation* nextLocation() { return m_locationInfo.add(); } //TODO: possible optmization: when codeblocks die, report which locations are no longer being changed so we don't walk over them
- JS_EXPORT_PRIVATE void dumpHighFidelityProfilingTypes();
- int64_t getNextUniqueVariableID() { return m_nextUniqueVariableID++; }
-
</del><span class="cx"> private:
</span><span class="cx"> friend class LLIntOffsetsExtractor;
</span><span class="cx"> friend class ClearExceptionScope;
</span><span class="lines">@@ -572,10 +558,6 @@
</span><span class="cx"> OwnPtr<BuiltinExecutables> m_builtinExecutables;
</span><span class="cx"> RefCountedArray<StackFrame> m_exceptionStack;
</span><span class="cx"> HashMap<String, RefPtr<WatchpointSet>> m_impurePropertyWatchpointSets;
</span><del>- std::unique_ptr<HighFidelityTypeProfiler> m_highFidelityTypeProfiler;
- std::unique_ptr<HighFidelityLog> m_highFidelityLog;
- int64_t m_nextUniqueVariableID;
- Bag<TypeLocation> m_locationInfo;
</del><span class="cx"> };
</span><span class="cx">
</span><span class="cx"> #if ENABLE(GC_VALIDATION)
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeWeakMapDatah"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/WeakMapData.h (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/WeakMapData.h        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/Source/JavaScriptCore/runtime/WeakMapData.h        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -47,7 +47,7 @@
</span><span class="cx">
</span><span class="cx"> static Structure* createStructure(VM& vm, JSGlobalObject* globalObject, JSValue prototype)
</span><span class="cx"> {
</span><del>- return Structure::create(vm, globalObject, prototype, TypeInfo(CellType, StructureFlags), info());
</del><ins>+ return Structure::create(vm, globalObject, prototype, TypeInfo(CompoundType, StructureFlags), info());
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> static const bool needsDestruction = true;
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoretestsstressfoldmultigetbyoffsettogetbyoffsetwithoutfoldingthestructurecheckjs"></a>
<div class="delfile"><h4>Deleted: trunk/Source/JavaScriptCore/tests/stress/fold-multi-get-by-offset-to-get-by-offset-without-folding-the-structure-check.js (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/tests/stress/fold-multi-get-by-offset-to-get-by-offset-without-folding-the-structure-check.js        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/Source/JavaScriptCore/tests/stress/fold-multi-get-by-offset-to-get-by-offset-without-folding-the-structure-check.js        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -1,50 +0,0 @@
</span><del>-function foo(o) {
- return o.f;
-}
-
-function fu(o) {
- return o.e;
-}
-
-function bar(f, o) {
- return f(o);
-}
-
-function baz(f, o) {
- return f(o);
-}
-
-for (var i = 0; i < 100; ++i) {
- foo({f:1, e:2});
- foo({e:1, f:2});
- foo({d:1, e:2, f:3});
- fu({f:1, e:2});
- fu({e:1, f:2, g:3});
- fu({d:1, e:2, f:3, g:4});
-}
-
-for (var i = 0; i < 100; ++i) {
- bar(foo, {f:1});
- bar(function() { }, null);
- bar(function() { return 42; }, null);
- baz(fu, {e:1});
- baz(function() { }, null);
- baz(function() { return 42; }, null);
-}
-
-(function(f, g, o, p) {
- var result = 0;
- var n = 1000000;
- for (var i = 0; i < n; ++i) {
- var q;
- if (i == n - 1)
- q = p;
- else
- q = o;
- result += baz(g, q);
- result += bar(f, q);
- }
- if (result != (n - 1) * (o.f + o.e) + 12 + 13)
- throw "Error: bad result: " + result;
-})(foo, fu, {f:42, e:2}, {e:12, f:13, g:14});
-
</del></span></pre></div>
<a id="trunkSourceJavaScriptCoretestsstressfoldmultiputbyoffsettoputbyoffsetwithoutfoldingthestructurecheckjs"></a>
<div class="delfile"><h4>Deleted: trunk/Source/JavaScriptCore/tests/stress/fold-multi-put-by-offset-to-put-by-offset-without-folding-the-structure-check.js (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/tests/stress/fold-multi-put-by-offset-to-put-by-offset-without-folding-the-structure-check.js        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/Source/JavaScriptCore/tests/stress/fold-multi-put-by-offset-to-put-by-offset-without-folding-the-structure-check.js        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -1,56 +0,0 @@
</span><del>-function foo(o) {
- o.f = 1;
-}
-
-function fu(o) {
- o.e = 2;
-}
-
-function bar(f, o) {
- f(o);
-}
-
-function baz(f, o) {
- f(o);
-}
-
-for (var i = 0; i < 100; ++i) {
- foo({f:1, e:2});
- foo({e:1, f:2});
- foo({d:1, e:2, f:3});
- fu({f:1, e:2});
- fu({e:1, f:2, g:3});
- fu({d:1, e:2, f:3, g:4});
-}
-
-for (var i = 0; i < 100; ++i) {
- bar(foo, {f:1});
- bar(function() { }, null);
- bar(function() { return 42; }, null);
- baz(fu, {e:1});
- baz(function() { }, null);
- baz(function() { return 42; }, null);
-}
-
-(function(f, g, o, p) {
- var result = 0;
- var n = 1000000;
- for (var i = 0; i < n; ++i) {
- var q;
- if (i == n - 1)
- q = p;
- else
- q = o;
- baz(g, q);
- bar(f, q);
- }
- if (o.e != 2)
- throw "Error: bad value in o.e: " + o.e;
- if (o.f != 1)
- throw "Error: bad value in o.f: " + o.f;
- if (p.e != 2)
- throw "Error: bad value in p.e: " + p.e;
- if (p.f != 1)
- throw "Error: bad value in p.f: " + p.f;
-})(foo, fu, {f:42, e:2}, {e:12, f:13, g:14});
-
</del></span></pre></div>
<a id="trunkSourceJavaScriptCoretestsstressprunemultiputbyoffsetreplaceortransitionvariantjs"></a>
<div class="delfile"><h4>Deleted: trunk/Source/JavaScriptCore/tests/stress/prune-multi-put-by-offset-replace-or-transition-variant.js (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/tests/stress/prune-multi-put-by-offset-replace-or-transition-variant.js        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/Source/JavaScriptCore/tests/stress/prune-multi-put-by-offset-replace-or-transition-variant.js        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -1,58 +0,0 @@
</span><del>-function foo(o) {
- o.f = 1;
-}
-
-function fu(o) {
- o.e = 2;
-}
-
-function bar(f, o) {
- f(o);
-}
-
-function baz(f, o) {
- f(o);
-}
-
-for (var i = 0; i < 100; ++i) {
- foo({f:1, e:2});
- foo({e:1, f:2});
- foo({e:1});
- foo({d:1, e:2, f:3});
- fu({f:1, e:2});
- fu({e:1, f:2});
- fu({e:1, f:2, g:3});
- fu({d:1, e:2, f:3, g:4});
-}
-
-for (var i = 0; i < 100; ++i) {
- bar(foo, {f:1});
- bar(function() { }, null);
- bar(function() { return 42; }, null);
- baz(fu, {e:1});
- baz(function() { }, null);
- baz(function() { return 42; }, null);
-}
-
-(function(f, g, o, p) {
- var result = 0;
- var n = 1000000;
- for (var i = 0; i < n; ++i) {
- var q;
- if (i == n - 1)
- q = p;
- else
- q = o;
- baz(g, q);
- bar(f, q);
- }
- if (o.e != 2)
- throw "Error: bad value in o.e: " + o.e;
- if (o.f != 1)
- throw "Error: bad value in o.f: " + o.f;
- if (p.e != 2)
- throw "Error: bad value in p.e: " + p.e;
- if (p.f != 1)
- throw "Error: bad value in p.f: " + p.f;
-})(foo, fu, {e:42, f:2}, {e:12, f:13, g:14});
-
</del></span></pre></div>
<a id="trunkSourceWTFChangeLog"></a>
<div class="modfile"><h4>Modified: trunk/Source/WTF/ChangeLog (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WTF/ChangeLog        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/Source/WTF/ChangeLog        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -1,3 +1,10 @@
</span><ins>+2014-07-26 Filip Pizlo <fpizlo@apple.com>
+
+ Unreviewed, roll out r171641-r171644. It broke some tests; will investigate and
+ reland later.
+
+ * wtf/text/WTFString.h:
+
</ins><span class="cx"> 2014-07-25 Filip Pizlo <fpizlo@apple.com>
</span><span class="cx">
</span><span class="cx"> Attempt to fix Windows.
</span></span></pre></div>
<a id="trunkSourceWTFwtftextWTFStringh"></a>
<div class="modfile"><h4>Modified: trunk/Source/WTF/wtf/text/WTFString.h (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WTF/wtf/text/WTFString.h        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/Source/WTF/wtf/text/WTFString.h        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -355,7 +355,7 @@
</span><span class="cx"> WTF_EXPORT_STRING_API unsigned toUIntStrict(bool* ok = 0, int base = 10) const;
</span><span class="cx"> WTF_EXPORT_STRING_API int64_t toInt64Strict(bool* ok = 0, int base = 10) const;
</span><span class="cx"> WTF_EXPORT_STRING_API uint64_t toUInt64Strict(bool* ok = 0, int base = 10) const;
</span><del>- WTF_EXPORT_STRING_API intptr_t toIntPtrStrict(bool* ok = 0, int base = 10) const;
</del><ins>+ intptr_t toIntPtrStrict(bool* ok = 0, int base = 10) const;
</ins><span class="cx">
</span><span class="cx"> WTF_EXPORT_STRING_API int toInt(bool* ok = 0) const;
</span><span class="cx"> WTF_EXPORT_STRING_API unsigned toUInt(bool* ok = 0) const;
</span></span></pre></div>
<a id="trunkSourceWebCoreChangeLog"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/ChangeLog (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/ChangeLog        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/Source/WebCore/ChangeLog        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -1,3 +1,10 @@
</span><ins>+2014-07-26 Filip Pizlo <fpizlo@apple.com>
+
+ Unreviewed, roll out r171641-r171644. It broke some tests; will investigate and
+ reland later.
+
+ * ForwardingHeaders/debugger/DebuggerActivation.h: Added.
+
</ins><span class="cx"> 2014-07-26 Timothy Horton <timothy_horton@apple.com>
</span><span class="cx">
</span><span class="cx"> Crash in Web Content Process under ~PDFDocument under clearTouchEventListeners at topDocument()
</span></span></pre></div>
<a id="trunkSourceWebCoreForwardingHeadersdebuggerDebuggerActivationh"></a>
<div class="addfile"><h4>Added: trunk/Source/WebCore/ForwardingHeaders/debugger/DebuggerActivation.h (0 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/ForwardingHeaders/debugger/DebuggerActivation.h         (rev 0)
+++ trunk/Source/WebCore/ForwardingHeaders/debugger/DebuggerActivation.h        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -0,0 +1,4 @@
</span><ins>+#ifndef WebCore_FWD_DebuggerActivation_h
+#define WebCore_FWD_DebuggerActivation_h
+#include <JavaScriptCore/DebuggerActivation.h>
+#endif
</ins></span></pre></div>
<a id="trunkSourceWebKitmacChangeLog"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebKit/mac/ChangeLog (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebKit/mac/ChangeLog        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/Source/WebKit/mac/ChangeLog        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -1,3 +1,10 @@
</span><ins>+2014-07-26 Filip Pizlo <fpizlo@apple.com>
+
+ Unreviewed, roll out r171641-r171644. It broke some tests; will investigate and
+ reland later.
+
+ * WebView/WebScriptDebugDelegate.mm:
+
</ins><span class="cx"> 2014-07-25 Filip Pizlo <fpizlo@apple.com>
</span><span class="cx">
</span><span class="cx"> Merge r170090, r170092, r170129, r170141, r170161, r170215, r170275, r170375, r170376, r170382, r170383, r170399, r170436, r170489, r170490, r170556 from ftlopt.
</span></span></pre></div>
<a id="trunkSourceWebKitmacWebViewWebScriptDebugDelegatemm"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebKit/mac/WebView/WebScriptDebugDelegate.mm (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebKit/mac/WebView/WebScriptDebugDelegate.mm        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/Source/WebKit/mac/WebView/WebScriptDebugDelegate.mm        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -37,6 +37,7 @@
</span><span class="cx"> #import <WebCore/WebScriptObjectPrivate.h>
</span><span class="cx"> #import <WebCore/runtime_root.h>
</span><span class="cx"> #import <debugger/Debugger.h>
</span><ins>+#import <debugger/DebuggerActivation.h>
</ins><span class="cx"> #import <interpreter/CallFrame.h>
</span><span class="cx"> #import <runtime/Completion.h>
</span><span class="cx"> #import <runtime/JSFunction.h>
</span></span></pre>
</div>
</div>
</body>
</html>