<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN"
"http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head><meta http-equiv="content-type" content="text/html; charset=utf-8" />
<title>[171648] trunk</title>
</head>
<body>

<style type="text/css"><!--
#msg dl.meta { border: 1px #006 solid; background: #369; padding: 6px; color: #fff; }
#msg dl.meta dt { float: left; width: 6em; font-weight: bold; }
#msg dt:after { content:':';}
#msg dl, #msg dt, #msg ul, #msg li, #header, #footer, #logmsg { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt;  }
#msg dl a { font-weight: bold}
#msg dl a:link    { color:#fc3; }
#msg dl a:active  { color:#ff0; }
#msg dl a:visited { color:#cc6; }
h3 { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; font-weight: bold; }
#msg pre { overflow: auto; background: #ffc; border: 1px #fa0 solid; padding: 6px; }
#logmsg { background: #ffc; border: 1px #fa0 solid; padding: 1em 1em 0 1em; }
#logmsg p, #logmsg pre, #logmsg blockquote { margin: 0 0 1em 0; }
#logmsg p, #logmsg li, #logmsg dt, #logmsg dd { line-height: 14pt; }
#logmsg h1, #logmsg h2, #logmsg h3, #logmsg h4, #logmsg h5, #logmsg h6 { margin: .5em 0; }
#logmsg h1:first-child, #logmsg h2:first-child, #logmsg h3:first-child, #logmsg h4:first-child, #logmsg h5:first-child, #logmsg h6:first-child { margin-top: 0; }
#logmsg ul, #logmsg ol { padding: 0; list-style-position: inside; margin: 0 0 0 1em; }
#logmsg ul { text-indent: -1em; padding-left: 1em; }#logmsg ol { text-indent: -1.5em; padding-left: 1.5em; }
#logmsg > ul, #logmsg > ol { margin: 0 0 1em 0; }
#logmsg pre { background: #eee; padding: 1em; }
#logmsg blockquote { border: 1px solid #fa0; border-left-width: 10px; padding: 1em 1em 0 1em; background: white;}
#logmsg dl { margin: 0; }
#logmsg dt { font-weight: bold; }
#logmsg dd { margin: 0; padding: 0 0 0.5em 0; }
#logmsg dd:before { content:'\00bb';}
#logmsg table { border-spacing: 0px; border-collapse: collapse; border-top: 4px solid #fa0; border-bottom: 1px solid #fa0; background: #fff; }
#logmsg table th { text-align: left; font-weight: normal; padding: 0.2em 0.5em; border-top: 1px dotted #fa0; }
#logmsg table td { text-align: right; border-top: 1px dotted #fa0; padding: 0.2em 0.5em; }
#logmsg table thead th { text-align: center; border-bottom: 1px solid #fa0; }
#logmsg table th.Corner { text-align: left; }
#logmsg hr { border: none 0; border-top: 2px dashed #fa0; height: 1px; }
#header, #footer { color: #fff; background: #636; border: 1px #300 solid; padding: 6px; }
#patch { width: 100%; }
#patch h4 {font-family: verdana,arial,helvetica,sans-serif;font-size:10pt;padding:8px;background:#369;color:#fff;margin:0;}
#patch .propset h4, #patch .binary h4 {margin:0;}
#patch pre {padding:0;line-height:1.2em;margin:0;}
#patch .diff {width:100%;background:#eee;padding: 0 0 10px 0;overflow:auto;}
#patch .propset .diff, #patch .binary .diff  {padding:10px 0;}
#patch span {display:block;padding:0 10px;}
#patch .modfile, #patch .addfile, #patch .delfile, #patch .propset, #patch .binary, #patch .copfile {border:1px solid #ccc;margin:10px 0;}
#patch ins {background:#dfd;text-decoration:none;display:block;padding:0 10px;}
#patch del {background:#fdd;text-decoration:none;display:block;padding:0 10px;}
#patch .lines, .info {color:#888;background:#fff;}
--></style>
<div id="msg">
<dl class="meta">
<dt>Revision</dt> <dd><a href="http://trac.webkit.org/projects/webkit/changeset/171648">171648</a></dd>
<dt>Author</dt> <dd>fpizlo@apple.com</dd>
<dt>Date</dt> <dd>2014-07-26 12:06:44 -0700 (Sat, 26 Jul 2014)</dd>
</dl>

<h3>Log Message</h3>
<pre>Unreviewed, roll out <a href="http://trac.webkit.org/projects/webkit/changeset/171641">r171641</a>-<a href="http://trac.webkit.org/projects/webkit/changeset/171644">r171644</a>. It broke some tests; will investigate and
reland later.


Source/JavaScriptCore: 
* CMakeLists.txt:
* JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
* JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
* JavaScriptCore.xcodeproj/project.pbxproj:
* bytecode/BytecodeList.json:
* bytecode/BytecodeUseDef.h:
(JSC::computeUsesForBytecodeOffset):
(JSC::computeDefsForBytecodeOffset):
* bytecode/CodeBlock.cpp:
(JSC::CodeBlock::dumpBytecode):
(JSC::CodeBlock::CodeBlock):
(JSC::CodeBlock::finalizeUnconditionally):
(JSC::CodeBlock::printPutByIdCacheStatus): Deleted.
* bytecode/CodeBlock.h:
* bytecode/GetByIdStatus.cpp:
(JSC::GetByIdStatus::computeForStubInfo):
(JSC::GetByIdStatus::computeFor):
* bytecode/GetByIdStatus.h:
* bytecode/GetByIdVariant.cpp:
(JSC::GetByIdVariant::dumpInContext):
* bytecode/GetByIdVariant.h:
(JSC::GetByIdVariant::structureSet):
* bytecode/Instruction.h:
* bytecode/PutByIdStatus.cpp:
(JSC::PutByIdStatus::appendVariant):
(JSC::PutByIdStatus::computeForStubInfo):
(JSC::PutByIdStatus::computeFor):
* bytecode/PutByIdStatus.h:
* bytecode/PutByIdVariant.cpp:
(JSC::PutByIdVariant::dumpInContext):
(JSC::PutByIdVariant::oldStructureForTransition): Deleted.
(JSC::PutByIdVariant::writesStructures): Deleted.
(JSC::PutByIdVariant::reallocatesStorage): Deleted.
(JSC::PutByIdVariant::attemptToMerge): Deleted.
(JSC::PutByIdVariant::attemptToMergeTransitionWithReplace): Deleted.
* bytecode/PutByIdVariant.h:
(JSC::PutByIdVariant::PutByIdVariant):
(JSC::PutByIdVariant::replace):
(JSC::PutByIdVariant::transition):
(JSC::PutByIdVariant::structure):
(JSC::PutByIdVariant::oldStructure):
(JSC::PutByIdVariant::newStructure):
(JSC::PutByIdVariant::constantChecks):
* bytecode/StructureSet.cpp:
(JSC::StructureSet::filter): Deleted.
(JSC::StructureSet::filterArrayModes): Deleted.
* bytecode/StructureSet.h:
(JSC::StructureSet::onlyStructure):
* bytecode/ToThisStatus.cpp: Removed.
* bytecode/ToThisStatus.h: Removed.
* bytecode/TypeLocation.h: Removed.
* bytecompiler/BytecodeGenerator.cpp:
(JSC::BytecodeGenerator::BytecodeGenerator):
(JSC::BytecodeGenerator::emitMove):
(JSC::BytecodeGenerator::emitPutToScope):
(JSC::BytecodeGenerator::emitPutById):
(JSC::BytecodeGenerator::emitPutByVal):
(JSC::BytecodeGenerator::emitProfileTypesWithHighFidelity): Deleted.
* bytecompiler/BytecodeGenerator.h:
(JSC::BytecodeGenerator::isProfilingTypesWithHighFidelity): Deleted.
* bytecompiler/NodesCodegen.cpp:
(JSC::PostfixNode::emitResolve):
(JSC::PrefixNode::emitResolve):
(JSC::ReadModifyResolveNode::emitBytecode):
(JSC::AssignResolveNode::emitBytecode):
(JSC::ConstDeclNode::emitCodeSingle):
(JSC::ForInNode::emitBytecode):
* debugger/DebuggerActivation.cpp: Added.
(JSC::DebuggerActivation::DebuggerActivation):
(JSC::DebuggerActivation::finishCreation):
(JSC::DebuggerActivation::visitChildren):
(JSC::DebuggerActivation::className):
(JSC::DebuggerActivation::getOwnPropertySlot):
(JSC::DebuggerActivation::put):
(JSC::DebuggerActivation::deleteProperty):
(JSC::DebuggerActivation::getOwnPropertyNames):
(JSC::DebuggerActivation::defineOwnProperty):
* debugger/DebuggerActivation.h: Added.
(JSC::DebuggerActivation::create):
(JSC::DebuggerActivation::createStructure):
* debugger/DebuggerScope.cpp: Removed.
* debugger/DebuggerScope.h: Removed.
* dfg/DFGAbstractInterpreterInlines.h:
(JSC::DFG::AbstractInterpreter&lt;AbstractStateType&gt;::executeEffects):
(JSC::DFG::AbstractInterpreter&lt;AbstractStateType&gt;::observeTransition):
(JSC::DFG::AbstractInterpreter&lt;AbstractStateType&gt;::observeTransitions):
* dfg/DFGAbstractValue.cpp:
(JSC::DFG::AbstractValue::changeStructure): Deleted.
(JSC::DFG::AbstractValue::contains): Deleted.
* dfg/DFGAbstractValue.h:
(JSC::DFG::AbstractValue::couldBeType):
(JSC::DFG::AbstractValue::isType):
* dfg/DFGByteCodeParser.cpp:
(JSC::DFG::ByteCodeParser::handlePutById):
(JSC::DFG::ByteCodeParser::parseBlock):
* dfg/DFGClobberize.h:
(JSC::DFG::clobberize):
* dfg/DFGConstantFoldingPhase.cpp:
(JSC::DFG::ConstantFoldingPhase::foldConstants):
(JSC::DFG::ConstantFoldingPhase::emitGetByOffset):
(JSC::DFG::ConstantFoldingPhase::emitPutByOffset):
(JSC::DFG::ConstantFoldingPhase::addBaseCheck): Deleted.
(JSC::DFG::ConstantFoldingPhase::addChecks): Deleted.
* dfg/DFGDoesGC.cpp:
(JSC::DFG::doesGC):
* dfg/DFGFixupPhase.cpp:
(JSC::DFG::FixupPhase::fixupNode):
* dfg/DFGGraph.cpp:
(JSC::DFG::Graph::visitChildren):
(JSC::DFG::Graph::freezeStrong):
* dfg/DFGGraph.h:
* dfg/DFGNode.cpp:
(JSC::DFG::MultiPutByOffsetData::writesStructures):
(JSC::DFG::MultiPutByOffsetData::reallocatesStorage):
* dfg/DFGNode.h:
(JSC::DFG::Node::convertToPutByOffset):
(JSC::DFG::Node::hasTransition):
(JSC::DFG::Node::convertToMultiGetByOffset): Deleted.
(JSC::DFG::Node::convertToMultiPutByOffset): Deleted.
* dfg/DFGNodeType.h:
* dfg/DFGPredictionPropagationPhase.cpp:
(JSC::DFG::PredictionPropagationPhase::propagate):
* dfg/DFGSafeToExecute.h:
(JSC::DFG::safeToExecute):
* dfg/DFGSpeculativeJIT.cpp:
(JSC::DFG::SpeculativeJIT::silentSavePlanForGPR):
* dfg/DFGSpeculativeJIT32_64.cpp:
(JSC::DFG::SpeculativeJIT::fillSpeculateCell):
(JSC::DFG::SpeculativeJIT::compile):
* dfg/DFGSpeculativeJIT64.cpp:
(JSC::DFG::SpeculativeJIT::fillJSValue):
(JSC::DFG::SpeculativeJIT::nonSpeculativeCompareNull):
(JSC::DFG::SpeculativeJIT::emitCall):
(JSC::DFG::SpeculativeJIT::fillSpeculateInt32Internal):
(JSC::DFG::SpeculativeJIT::fillSpeculateInt32Strict):
(JSC::DFG::SpeculativeJIT::fillSpeculateInt52):
(JSC::DFG::SpeculativeJIT::fillSpeculateDouble):
(JSC::DFG::SpeculativeJIT::fillSpeculateCell):
(JSC::DFG::SpeculativeJIT::fillSpeculateBoolean):
(JSC::DFG::SpeculativeJIT::compileLogicalNot):
(JSC::DFG::SpeculativeJIT::emitBranch):
(JSC::DFG::SpeculativeJIT::compile):
* dfg/DFGStructureAbstractValue.cpp:
(JSC::DFG::StructureAbstractValue::observeTransition):
(JSC::DFG::StructureAbstractValue::observeTransitions):
* dfg/DFGStructureAbstractValue.h:
(JSC::DFG::StructureAbstractValue::onlyStructure):
(JSC::DFG::StructureAbstractValue::operator=): Deleted.
(JSC::DFG::StructureAbstractValue::set): Deleted.
* dfg/DFGValidate.cpp:
(JSC::DFG::Validate::validate):
* dfg/DFGWatchableStructureWatchingPhase.cpp:
(JSC::DFG::WatchableStructureWatchingPhase::run):
* ftl/FTLAbbreviations.h:
(JSC::FTL::getLinkage): Deleted.
* ftl/FTLCapabilities.cpp:
(JSC::FTL::canCompile):
* ftl/FTLLowerDFGToLLVM.cpp:
(JSC::FTL::LowerDFGToLLVM::compileNode):
(JSC::FTL::LowerDFGToLLVM::compilePhantomPutStructure):
(JSC::FTL::LowerDFGToLLVM::compileMultiGetByOffset):
(JSC::FTL::LowerDFGToLLVM::compileMultiPutByOffset):
(JSC::FTL::LowerDFGToLLVM::getModuleByPathForSymbol):
* heap/Heap.cpp:
(JSC::Heap::collect):
* inspector/agents/InspectorRuntimeAgent.cpp:
(Inspector::InspectorRuntimeAgent::getRuntimeTypeForVariableInTextRange): Deleted.
* inspector/agents/InspectorRuntimeAgent.h:
* inspector/protocol/Runtime.json:
* jsc.cpp:
(GlobalObject::finishCreation):
(functionDumpTypesForAllVariables): Deleted.
* llint/LLIntData.cpp:
(JSC::LLInt::Data::performAssertions):
* llint/LLIntSlowPaths.cpp:
(JSC::LLInt::LLINT_SLOW_PATH_DECL):
(JSC::LLInt::putToScopeCommon): Deleted.
* llint/LLIntSlowPaths.h:
* llint/LowLevelInterpreter.asm:
* llint/LowLevelInterpreter32_64.asm:
* llint/LowLevelInterpreter64.asm:
* runtime/ArrayBufferNeuteringWatchpoint.cpp:
(JSC::ArrayBufferNeuteringWatchpoint::createStructure):
* runtime/CommonSlowPaths.cpp:
(JSC::SLOW_PATH_DECL):
* runtime/Executable.h:
(JSC::ExecutableBase::createStructure):
(JSC::NativeExecutable::createStructure):
* runtime/HighFidelityLog.cpp: Removed.
* runtime/HighFidelityLog.h: Removed.
* runtime/HighFidelityTypeProfiler.cpp: Removed.
* runtime/HighFidelityTypeProfiler.h: Removed.
* runtime/JSObject.cpp:
(JSC::JSObject::putDirectCustomAccessor):
(JSC::JSObject::putDirectNonIndexAccessor):
(JSC::JSObject::reifyStaticFunctionsForDelete):
* runtime/JSPromiseDeferred.h:
(JSC::JSPromiseDeferred::createStructure):
* runtime/JSPromiseReaction.h:
(JSC::JSPromiseReaction::createStructure):
* runtime/JSPropertyNameIterator.h:
(JSC::JSPropertyNameIterator::createStructure):
* runtime/JSType.h:
* runtime/JSTypeInfo.h:
(JSC::TypeInfo::TypeInfo):
* runtime/MapData.h:
(JSC::MapData::createStructure):
* runtime/Options.h:
* runtime/PropertyMapHashTable.h:
(JSC::PropertyTable::createStructure):
* runtime/RegExp.h:
(JSC::RegExp::createStructure):
* runtime/SparseArrayValueMap.cpp:
(JSC::SparseArrayValueMap::createStructure):
* runtime/Structure.cpp:
(JSC::StructureTransitionTable::contains):
(JSC::StructureTransitionTable::get):
(JSC::StructureTransitionTable::add):
(JSC::Structure::Structure):
(JSC::Structure::materializePropertyMap):
(JSC::Structure::addPropertyTransition):
(JSC::Structure::despecifyFunctionTransition):
(JSC::Structure::toDictionaryTransition):
(JSC::Structure::freezeTransition):
(JSC::Structure::preventExtensionsTransition):
(JSC::Structure::takePropertyTableOrCloneIfPinned):
(JSC::Structure::nonPropertyTransition):
(JSC::Structure::flattenDictionaryStructure):
(JSC::Structure::addPropertyWithoutTransition):
(JSC::Structure::pin):
(JSC::Structure::allocateRareData):
(JSC::Structure::cloneRareDataFrom):
(JSC::Structure::getConcurrently):
(JSC::Structure::putSpecificValue):
(JSC::Structure::getPropertyNamesFromStructure):
(JSC::Structure::visitChildren):
(JSC::Structure::checkConsistency):
(JSC::Structure::toStructureShape): Deleted.
* runtime/Structure.h:
(JSC::Structure::isExtensible):
(JSC::Structure::didTransition):
(JSC::Structure::isDictionary):
(JSC::Structure::isUncacheableDictionary):
(JSC::Structure::hasBeenFlattenedBefore):
(JSC::Structure::propertyAccessesAreCacheable):
(JSC::Structure::previousID):
(JSC::Structure::hasGetterSetterProperties):
(JSC::Structure::hasReadOnlyOrGetterSetterPropertiesExcludingProto):
(JSC::Structure::setHasGetterSetterProperties):
(JSC::Structure::hasCustomGetterSetterProperties):
(JSC::Structure::setHasCustomGetterSetterProperties):
(JSC::Structure::setContainsReadOnlyProperties):
(JSC::Structure::hasNonEnumerableProperties):
(JSC::Structure::disableSpecificFunctionTracking):
(JSC::Structure::objectToStringValue):
(JSC::Structure::setObjectToStringValue):
(JSC::Structure::staticFunctionsReified):
(JSC::Structure::setStaticFunctionsReified):
(JSC::Structure::transitionWatchpointSet):
(JSC::Structure::setPreviousID):
(JSC::Structure::clearPreviousID):
(JSC::Structure::previous):
(JSC::Structure::rareData):
(JSC::Structure::setHasGetterSetterPropertiesWithProtoCheck): Deleted.
(JSC::Structure::setHasCustomGetterSetterPropertiesWithProtoCheck): Deleted.
* runtime/StructureChain.h:
(JSC::StructureChain::createStructure):
* runtime/StructureInlines.h:
(JSC::Structure::setEnumerationCache):
(JSC::Structure::enumerationCache):
(JSC::Structure::checkOffsetConsistency):
* runtime/StructureRareData.cpp:
(JSC::StructureRareData::createStructure):
* runtime/SymbolTable.cpp:
(JSC::SymbolTable::SymbolTable):
(JSC::SymbolTable::cloneCapturedNames):
(JSC::SymbolTable::uniqueIDForVariable): Deleted.
(JSC::SymbolTable::uniqueIDForRegister): Deleted.
(JSC::SymbolTable::globalTypeSetForRegister): Deleted.
(JSC::SymbolTable::globalTypeSetForVariable): Deleted.
* runtime/SymbolTable.h:
(JSC::SymbolTable::createStructure):
(JSC::SymbolTable::add):
(JSC::SymbolTable::set):
* runtime/TypeSet.cpp: Removed.
* runtime/TypeSet.h: Removed.
* runtime/VM.cpp:
(JSC::VM::VM):
(JSC::VM::getTypesForVariableInRange): Deleted.
(JSC::VM::updateHighFidelityTypeProfileState): Deleted.
(JSC::VM::dumpHighFidelityProfilingTypes): Deleted.
* runtime/VM.h:
(JSC::VM::isProfilingTypesWithHighFidelity): Deleted.
(JSC::VM::highFidelityLog): Deleted.
(JSC::VM::highFidelityTypeProfiler): Deleted.
(JSC::VM::nextLocation): Deleted.
(JSC::VM::getNextUniqueVariableID): Deleted.
* runtime/WeakMapData.h:
(JSC::WeakMapData::createStructure):
* tests/stress/fold-multi-get-by-offset-to-get-by-offset-without-folding-the-structure-check.js: Removed.
* tests/stress/fold-multi-put-by-offset-to-put-by-offset-without-folding-the-structure-check.js: Removed.
* tests/stress/prune-multi-put-by-offset-replace-or-transition-variant.js: Removed.

Source/WebCore: 
* ForwardingHeaders/debugger/DebuggerActivation.h: Added.

Source/WebKit/mac: 
* WebView/WebScriptDebugDelegate.mm:

Source/WTF: 
* wtf/text/WTFString.h:

LayoutTests: 
* js/regress/fold-get-by-id-to-multi-get-by-offset-expected.txt: Removed.
* js/regress/fold-get-by-id-to-multi-get-by-offset-rare-int-expected.txt: Removed.
* js/regress/fold-get-by-id-to-multi-get-by-offset-rare-int.html: Removed.
* js/regress/fold-get-by-id-to-multi-get-by-offset.html: Removed.
* js/regress/fold-multi-get-by-offset-to-get-by-offset-expected.txt: Removed.
* js/regress/fold-multi-get-by-offset-to-get-by-offset.html: Removed.
* js/regress/fold-multi-get-by-offset-to-poly-get-by-offset-expected.txt: Removed.
* js/regress/fold-multi-get-by-offset-to-poly-get-by-offset.html: Removed.
* js/regress/fold-multi-put-by-offset-to-poly-put-by-offset-expected.txt: Removed.
* js/regress/fold-multi-put-by-offset-to-poly-put-by-offset.html: Removed.
* js/regress/fold-multi-put-by-offset-to-put-by-offset-expected.txt: Removed.
* js/regress/fold-multi-put-by-offset-to-put-by-offset.html: Removed.
* js/regress/fold-multi-put-by-offset-to-replace-or-transition-put-by-offset-expected.txt: Removed.
* js/regress/fold-multi-put-by-offset-to-replace-or-transition-put-by-offset.html: Removed.
* js/regress/fold-put-by-id-to-multi-put-by-offset-expected.txt: Removed.
* js/regress/fold-put-by-id-to-multi-put-by-offset.html: Removed.
* js/regress/fold-put-structure-expected.txt: Removed.
* js/regress/fold-put-structure.html: Removed.
* js/regress/hoist-poly-check-structure-effectful-loop-expected.txt: Removed.
* js/regress/hoist-poly-check-structure-effectful-loop.html: Removed.
* js/regress/hoist-poly-check-structure-expected.txt: Removed.
* js/regress/hoist-poly-check-structure.html: Removed.
* js/regress/put-by-id-replace-and-transition-expected.txt: Removed.
* js/regress/put-by-id-replace-and-transition.html: Removed.
* js/regress/put-by-id-slightly-polymorphic-expected.txt: Removed.
* js/regress/put-by-id-slightly-polymorphic.html: Removed.
* js/regress/script-tests/fold-get-by-id-to-multi-get-by-offset-rare-int.js: Removed.
* js/regress/script-tests/fold-get-by-id-to-multi-get-by-offset.js: Removed.
* js/regress/script-tests/fold-multi-get-by-offset-to-get-by-offset.js: Removed.
* js/regress/script-tests/fold-multi-get-by-offset-to-poly-get-by-offset.js: Removed.
* js/regress/script-tests/fold-multi-put-by-offset-to-poly-put-by-offset.js: Removed.
* js/regress/script-tests/fold-multi-put-by-offset-to-put-by-offset.js: Removed.
* js/regress/script-tests/fold-multi-put-by-offset-to-replace-or-transition-put-by-offset.js: Removed.
* js/regress/script-tests/fold-put-by-id-to-multi-put-by-offset.js: Removed.
* js/regress/script-tests/fold-put-structure.js: Removed.
* js/regress/script-tests/hoist-poly-check-structure-effectful-loop.js: Removed.
* js/regress/script-tests/hoist-poly-check-structure.js: Removed.
* js/regress/script-tests/put-by-id-replace-and-transition.js: Removed.
* js/regress/script-tests/put-by-id-slightly-polymorphic.js: Removed.</pre>

<h3>Modified Paths</h3>
<ul>
<li><a href="#trunkLayoutTestsChangeLog">trunk/LayoutTests/ChangeLog</a></li>
<li><a href="#trunkSourceJavaScriptCoreCMakeListstxt">trunk/Source/JavaScriptCore/CMakeLists.txt</a></li>
<li><a href="#trunkSourceJavaScriptCoreChangeLog">trunk/Source/JavaScriptCore/ChangeLog</a></li>
<li><a href="#trunkSourceJavaScriptCoreJavaScriptCorevcxprojJavaScriptCorevcxproj">trunk/Source/JavaScriptCore/JavaScriptCore.vcxproj/JavaScriptCore.vcxproj</a></li>
<li><a href="#trunkSourceJavaScriptCoreJavaScriptCorevcxprojJavaScriptCorevcxprojfilters">trunk/Source/JavaScriptCore/JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters</a></li>
<li><a href="#trunkSourceJavaScriptCoreJavaScriptCorexcodeprojprojectpbxproj">trunk/Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj</a></li>
<li><a href="#trunkSourceJavaScriptCorebytecodeBytecodeListjson">trunk/Source/JavaScriptCore/bytecode/BytecodeList.json</a></li>
<li><a href="#trunkSourceJavaScriptCorebytecodeBytecodeUseDefh">trunk/Source/JavaScriptCore/bytecode/BytecodeUseDef.h</a></li>
<li><a href="#trunkSourceJavaScriptCorebytecodeCodeBlockcpp">trunk/Source/JavaScriptCore/bytecode/CodeBlock.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCorebytecodeCodeBlockh">trunk/Source/JavaScriptCore/bytecode/CodeBlock.h</a></li>
<li><a href="#trunkSourceJavaScriptCorebytecodeGetByIdStatuscpp">trunk/Source/JavaScriptCore/bytecode/GetByIdStatus.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCorebytecodeGetByIdStatush">trunk/Source/JavaScriptCore/bytecode/GetByIdStatus.h</a></li>
<li><a href="#trunkSourceJavaScriptCorebytecodeGetByIdVariantcpp">trunk/Source/JavaScriptCore/bytecode/GetByIdVariant.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCorebytecodeGetByIdVarianth">trunk/Source/JavaScriptCore/bytecode/GetByIdVariant.h</a></li>
<li><a href="#trunkSourceJavaScriptCorebytecodeInstructionh">trunk/Source/JavaScriptCore/bytecode/Instruction.h</a></li>
<li><a href="#trunkSourceJavaScriptCorebytecodePutByIdStatuscpp">trunk/Source/JavaScriptCore/bytecode/PutByIdStatus.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCorebytecodePutByIdStatush">trunk/Source/JavaScriptCore/bytecode/PutByIdStatus.h</a></li>
<li><a href="#trunkSourceJavaScriptCorebytecodePutByIdVariantcpp">trunk/Source/JavaScriptCore/bytecode/PutByIdVariant.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCorebytecodePutByIdVarianth">trunk/Source/JavaScriptCore/bytecode/PutByIdVariant.h</a></li>
<li><a href="#trunkSourceJavaScriptCorebytecodeStructureSetcpp">trunk/Source/JavaScriptCore/bytecode/StructureSet.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCorebytecodeStructureSeth">trunk/Source/JavaScriptCore/bytecode/StructureSet.h</a></li>
<li><a href="#trunkSourceJavaScriptCorebytecompilerBytecodeGeneratorcpp">trunk/Source/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCorebytecompilerBytecodeGeneratorh">trunk/Source/JavaScriptCore/bytecompiler/BytecodeGenerator.h</a></li>
<li><a href="#trunkSourceJavaScriptCorebytecompilerNodesCodegencpp">trunk/Source/JavaScriptCore/bytecompiler/NodesCodegen.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGAbstractInterpreterInlinesh">trunk/Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGAbstractValuecpp">trunk/Source/JavaScriptCore/dfg/DFGAbstractValue.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGAbstractValueh">trunk/Source/JavaScriptCore/dfg/DFGAbstractValue.h</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGByteCodeParsercpp">trunk/Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGClobberizeh">trunk/Source/JavaScriptCore/dfg/DFGClobberize.h</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGConstantFoldingPhasecpp">trunk/Source/JavaScriptCore/dfg/DFGConstantFoldingPhase.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGDoesGCcpp">trunk/Source/JavaScriptCore/dfg/DFGDoesGC.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGFixupPhasecpp">trunk/Source/JavaScriptCore/dfg/DFGFixupPhase.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGGraphcpp">trunk/Source/JavaScriptCore/dfg/DFGGraph.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGGraphh">trunk/Source/JavaScriptCore/dfg/DFGGraph.h</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGNodecpp">trunk/Source/JavaScriptCore/dfg/DFGNode.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGNodeh">trunk/Source/JavaScriptCore/dfg/DFGNode.h</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGNodeTypeh">trunk/Source/JavaScriptCore/dfg/DFGNodeType.h</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGPredictionPropagationPhasecpp">trunk/Source/JavaScriptCore/dfg/DFGPredictionPropagationPhase.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGSafeToExecuteh">trunk/Source/JavaScriptCore/dfg/DFGSafeToExecute.h</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGSpeculativeJITcpp">trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGSpeculativeJIT32_64cpp">trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGSpeculativeJIT64cpp">trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGStructureAbstractValuecpp">trunk/Source/JavaScriptCore/dfg/DFGStructureAbstractValue.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGStructureAbstractValueh">trunk/Source/JavaScriptCore/dfg/DFGStructureAbstractValue.h</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGValidatecpp">trunk/Source/JavaScriptCore/dfg/DFGValidate.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGWatchableStructureWatchingPhasecpp">trunk/Source/JavaScriptCore/dfg/DFGWatchableStructureWatchingPhase.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreftlFTLAbbreviationsh">trunk/Source/JavaScriptCore/ftl/FTLAbbreviations.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreftlFTLCapabilitiescpp">trunk/Source/JavaScriptCore/ftl/FTLCapabilities.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreftlFTLLowerDFGToLLVMcpp">trunk/Source/JavaScriptCore/ftl/FTLLowerDFGToLLVM.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreheapHeapcpp">trunk/Source/JavaScriptCore/heap/Heap.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreinspectoragentsInspectorRuntimeAgentcpp">trunk/Source/JavaScriptCore/inspector/agents/InspectorRuntimeAgent.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreinspectoragentsInspectorRuntimeAgenth">trunk/Source/JavaScriptCore/inspector/agents/InspectorRuntimeAgent.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreinspectorprotocolRuntimejson">trunk/Source/JavaScriptCore/inspector/protocol/Runtime.json</a></li>
<li><a href="#trunkSourceJavaScriptCorejsccpp">trunk/Source/JavaScriptCore/jsc.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCorellintLLIntDatacpp">trunk/Source/JavaScriptCore/llint/LLIntData.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCorellintLLIntSlowPathscpp">trunk/Source/JavaScriptCore/llint/LLIntSlowPaths.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCorellintLLIntSlowPathsh">trunk/Source/JavaScriptCore/llint/LLIntSlowPaths.h</a></li>
<li><a href="#trunkSourceJavaScriptCorellintLowLevelInterpreterasm">trunk/Source/JavaScriptCore/llint/LowLevelInterpreter.asm</a></li>
<li><a href="#trunkSourceJavaScriptCorellintLowLevelInterpreter32_64asm">trunk/Source/JavaScriptCore/llint/LowLevelInterpreter32_64.asm</a></li>
<li><a href="#trunkSourceJavaScriptCorellintLowLevelInterpreter64asm">trunk/Source/JavaScriptCore/llint/LowLevelInterpreter64.asm</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeArrayBufferNeuteringWatchpointcpp">trunk/Source/JavaScriptCore/runtime/ArrayBufferNeuteringWatchpoint.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeCommonSlowPathscpp">trunk/Source/JavaScriptCore/runtime/CommonSlowPaths.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeExecutableh">trunk/Source/JavaScriptCore/runtime/Executable.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeJSObjectcpp">trunk/Source/JavaScriptCore/runtime/JSObject.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeJSPromiseDeferredh">trunk/Source/JavaScriptCore/runtime/JSPromiseDeferred.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeJSPromiseReactionh">trunk/Source/JavaScriptCore/runtime/JSPromiseReaction.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeJSPropertyNameIteratorh">trunk/Source/JavaScriptCore/runtime/JSPropertyNameIterator.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeJSTypeh">trunk/Source/JavaScriptCore/runtime/JSType.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeJSTypeInfoh">trunk/Source/JavaScriptCore/runtime/JSTypeInfo.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeMapDatah">trunk/Source/JavaScriptCore/runtime/MapData.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeOptionsh">trunk/Source/JavaScriptCore/runtime/Options.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimePropertyMapHashTableh">trunk/Source/JavaScriptCore/runtime/PropertyMapHashTable.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeRegExph">trunk/Source/JavaScriptCore/runtime/RegExp.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeSparseArrayValueMapcpp">trunk/Source/JavaScriptCore/runtime/SparseArrayValueMap.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeStructurecpp">trunk/Source/JavaScriptCore/runtime/Structure.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeStructureh">trunk/Source/JavaScriptCore/runtime/Structure.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeStructureChainh">trunk/Source/JavaScriptCore/runtime/StructureChain.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeStructureInlinesh">trunk/Source/JavaScriptCore/runtime/StructureInlines.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeStructureRareDatacpp">trunk/Source/JavaScriptCore/runtime/StructureRareData.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeSymbolTablecpp">trunk/Source/JavaScriptCore/runtime/SymbolTable.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeSymbolTableh">trunk/Source/JavaScriptCore/runtime/SymbolTable.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeVMcpp">trunk/Source/JavaScriptCore/runtime/VM.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeVMh">trunk/Source/JavaScriptCore/runtime/VM.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeWeakMapDatah">trunk/Source/JavaScriptCore/runtime/WeakMapData.h</a></li>
<li><a href="#trunkSourceWTFChangeLog">trunk/Source/WTF/ChangeLog</a></li>
<li><a href="#trunkSourceWTFwtftextWTFStringh">trunk/Source/WTF/wtf/text/WTFString.h</a></li>
<li><a href="#trunkSourceWebCoreChangeLog">trunk/Source/WebCore/ChangeLog</a></li>
<li><a href="#trunkSourceWebKitmacChangeLog">trunk/Source/WebKit/mac/ChangeLog</a></li>
<li><a href="#trunkSourceWebKitmacWebViewWebScriptDebugDelegatemm">trunk/Source/WebKit/mac/WebView/WebScriptDebugDelegate.mm</a></li>
</ul>

<h3>Added Paths</h3>
<ul>
<li><a href="#trunkSourceJavaScriptCoredebuggerDebuggerActivationcpp">trunk/Source/JavaScriptCore/debugger/DebuggerActivation.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoredebuggerDebuggerActivationh">trunk/Source/JavaScriptCore/debugger/DebuggerActivation.h</a></li>
<li><a href="#trunkSourceWebCoreForwardingHeadersdebuggerDebuggerActivationh">trunk/Source/WebCore/ForwardingHeaders/debugger/DebuggerActivation.h</a></li>
</ul>

<h3>Removed Paths</h3>
<ul>
<li><a href="#trunkLayoutTestsjsregressfoldgetbyidtomultigetbyoffsetexpectedtxt">trunk/LayoutTests/js/regress/fold-get-by-id-to-multi-get-by-offset-expected.txt</a></li>
<li><a href="#trunkLayoutTestsjsregressfoldgetbyidtomultigetbyoffsetrareintexpectedtxt">trunk/LayoutTests/js/regress/fold-get-by-id-to-multi-get-by-offset-rare-int-expected.txt</a></li>
<li><a href="#trunkLayoutTestsjsregressfoldgetbyidtomultigetbyoffsetrareinthtml">trunk/LayoutTests/js/regress/fold-get-by-id-to-multi-get-by-offset-rare-int.html</a></li>
<li><a href="#trunkLayoutTestsjsregressfoldgetbyidtomultigetbyoffsethtml">trunk/LayoutTests/js/regress/fold-get-by-id-to-multi-get-by-offset.html</a></li>
<li><a href="#trunkLayoutTestsjsregressfoldmultigetbyoffsettogetbyoffsetexpectedtxt">trunk/LayoutTests/js/regress/fold-multi-get-by-offset-to-get-by-offset-expected.txt</a></li>
<li><a href="#trunkLayoutTestsjsregressfoldmultigetbyoffsettogetbyoffsethtml">trunk/LayoutTests/js/regress/fold-multi-get-by-offset-to-get-by-offset.html</a></li>
<li><a href="#trunkLayoutTestsjsregressfoldmultigetbyoffsettopolygetbyoffsetexpectedtxt">trunk/LayoutTests/js/regress/fold-multi-get-by-offset-to-poly-get-by-offset-expected.txt</a></li>
<li><a href="#trunkLayoutTestsjsregressfoldmultigetbyoffsettopolygetbyoffsethtml">trunk/LayoutTests/js/regress/fold-multi-get-by-offset-to-poly-get-by-offset.html</a></li>
<li><a href="#trunkLayoutTestsjsregressfoldmultiputbyoffsettopolyputbyoffsetexpectedtxt">trunk/LayoutTests/js/regress/fold-multi-put-by-offset-to-poly-put-by-offset-expected.txt</a></li>
<li><a href="#trunkLayoutTestsjsregressfoldmultiputbyoffsettopolyputbyoffsethtml">trunk/LayoutTests/js/regress/fold-multi-put-by-offset-to-poly-put-by-offset.html</a></li>
<li><a href="#trunkLayoutTestsjsregressfoldmultiputbyoffsettoputbyoffsetexpectedtxt">trunk/LayoutTests/js/regress/fold-multi-put-by-offset-to-put-by-offset-expected.txt</a></li>
<li><a href="#trunkLayoutTestsjsregressfoldmultiputbyoffsettoputbyoffsethtml">trunk/LayoutTests/js/regress/fold-multi-put-by-offset-to-put-by-offset.html</a></li>
<li><a href="#trunkLayoutTestsjsregressfoldmultiputbyoffsettoreplaceortransitionputbyoffsetexpectedtxt">trunk/LayoutTests/js/regress/fold-multi-put-by-offset-to-replace-or-transition-put-by-offset-expected.txt</a></li>
<li><a href="#trunkLayoutTestsjsregressfoldmultiputbyoffsettoreplaceortransitionputbyoffsethtml">trunk/LayoutTests/js/regress/fold-multi-put-by-offset-to-replace-or-transition-put-by-offset.html</a></li>
<li><a href="#trunkLayoutTestsjsregressfoldputbyidtomultiputbyoffsetexpectedtxt">trunk/LayoutTests/js/regress/fold-put-by-id-to-multi-put-by-offset-expected.txt</a></li>
<li><a href="#trunkLayoutTestsjsregressfoldputbyidtomultiputbyoffsethtml">trunk/LayoutTests/js/regress/fold-put-by-id-to-multi-put-by-offset.html</a></li>
<li><a href="#trunkLayoutTestsjsregressfoldputstructureexpectedtxt">trunk/LayoutTests/js/regress/fold-put-structure-expected.txt</a></li>
<li><a href="#trunkLayoutTestsjsregressfoldputstructurehtml">trunk/LayoutTests/js/regress/fold-put-structure.html</a></li>
<li><a href="#trunkLayoutTestsjsregresshoistpolycheckstructureeffectfulloopexpectedtxt">trunk/LayoutTests/js/regress/hoist-poly-check-structure-effectful-loop-expected.txt</a></li>
<li><a href="#trunkLayoutTestsjsregresshoistpolycheckstructureeffectfulloophtml">trunk/LayoutTests/js/regress/hoist-poly-check-structure-effectful-loop.html</a></li>
<li><a href="#trunkLayoutTestsjsregresshoistpolycheckstructureexpectedtxt">trunk/LayoutTests/js/regress/hoist-poly-check-structure-expected.txt</a></li>
<li><a href="#trunkLayoutTestsjsregresshoistpolycheckstructurehtml">trunk/LayoutTests/js/regress/hoist-poly-check-structure.html</a></li>
<li><a href="#trunkLayoutTestsjsregressputbyidreplaceandtransitionexpectedtxt">trunk/LayoutTests/js/regress/put-by-id-replace-and-transition-expected.txt</a></li>
<li><a href="#trunkLayoutTestsjsregressputbyidreplaceandtransitionhtml">trunk/LayoutTests/js/regress/put-by-id-replace-and-transition.html</a></li>
<li><a href="#trunkLayoutTestsjsregressputbyidslightlypolymorphicexpectedtxt">trunk/LayoutTests/js/regress/put-by-id-slightly-polymorphic-expected.txt</a></li>
<li><a href="#trunkLayoutTestsjsregressputbyidslightlypolymorphichtml">trunk/LayoutTests/js/regress/put-by-id-slightly-polymorphic.html</a></li>
<li><a href="#trunkLayoutTestsjsregressscripttestsfoldgetbyidtomultigetbyoffsetrareintjs">trunk/LayoutTests/js/regress/script-tests/fold-get-by-id-to-multi-get-by-offset-rare-int.js</a></li>
<li><a href="#trunkLayoutTestsjsregressscripttestsfoldgetbyidtomultigetbyoffsetjs">trunk/LayoutTests/js/regress/script-tests/fold-get-by-id-to-multi-get-by-offset.js</a></li>
<li><a href="#trunkLayoutTestsjsregressscripttestsfoldmultigetbyoffsettogetbyoffsetjs">trunk/LayoutTests/js/regress/script-tests/fold-multi-get-by-offset-to-get-by-offset.js</a></li>
<li><a href="#trunkLayoutTestsjsregressscripttestsfoldmultigetbyoffsettopolygetbyoffsetjs">trunk/LayoutTests/js/regress/script-tests/fold-multi-get-by-offset-to-poly-get-by-offset.js</a></li>
<li><a href="#trunkLayoutTestsjsregressscripttestsfoldmultiputbyoffsettopolyputbyoffsetjs">trunk/LayoutTests/js/regress/script-tests/fold-multi-put-by-offset-to-poly-put-by-offset.js</a></li>
<li><a href="#trunkLayoutTestsjsregressscripttestsfoldmultiputbyoffsettoputbyoffsetjs">trunk/LayoutTests/js/regress/script-tests/fold-multi-put-by-offset-to-put-by-offset.js</a></li>
<li><a href="#trunkLayoutTestsjsregressscripttestsfoldmultiputbyoffsettoreplaceortransitionputbyoffsetjs">trunk/LayoutTests/js/regress/script-tests/fold-multi-put-by-offset-to-replace-or-transition-put-by-offset.js</a></li>
<li><a href="#trunkLayoutTestsjsregressscripttestsfoldputbyidtomultiputbyoffsetjs">trunk/LayoutTests/js/regress/script-tests/fold-put-by-id-to-multi-put-by-offset.js</a></li>
<li><a href="#trunkLayoutTestsjsregressscripttestsfoldputstructurejs">trunk/LayoutTests/js/regress/script-tests/fold-put-structure.js</a></li>
<li><a href="#trunkLayoutTestsjsregressscripttestshoistpolycheckstructureeffectfulloopjs">trunk/LayoutTests/js/regress/script-tests/hoist-poly-check-structure-effectful-loop.js</a></li>
<li><a href="#trunkLayoutTestsjsregressscripttestshoistpolycheckstructurejs">trunk/LayoutTests/js/regress/script-tests/hoist-poly-check-structure.js</a></li>
<li><a href="#trunkLayoutTestsjsregressscripttestsputbyidreplaceandtransitionjs">trunk/LayoutTests/js/regress/script-tests/put-by-id-replace-and-transition.js</a></li>
<li><a href="#trunkLayoutTestsjsregressscripttestsputbyidslightlypolymorphicjs">trunk/LayoutTests/js/regress/script-tests/put-by-id-slightly-polymorphic.js</a></li>
<li><a href="#trunkSourceJavaScriptCorebytecodeToThisStatuscpp">trunk/Source/JavaScriptCore/bytecode/ToThisStatus.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCorebytecodeToThisStatush">trunk/Source/JavaScriptCore/bytecode/ToThisStatus.h</a></li>
<li><a href="#trunkSourceJavaScriptCorebytecodeTypeLocationh">trunk/Source/JavaScriptCore/bytecode/TypeLocation.h</a></li>
<li><a href="#trunkSourceJavaScriptCoredebuggerDebuggerScopecpp">trunk/Source/JavaScriptCore/debugger/DebuggerScope.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoredebuggerDebuggerScopeh">trunk/Source/JavaScriptCore/debugger/DebuggerScope.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeHighFidelityLogcpp">trunk/Source/JavaScriptCore/runtime/HighFidelityLog.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeHighFidelityLogh">trunk/Source/JavaScriptCore/runtime/HighFidelityLog.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeHighFidelityTypeProfilercpp">trunk/Source/JavaScriptCore/runtime/HighFidelityTypeProfiler.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeHighFidelityTypeProfilerh">trunk/Source/JavaScriptCore/runtime/HighFidelityTypeProfiler.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeTypeSetcpp">trunk/Source/JavaScriptCore/runtime/TypeSet.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeTypeSeth">trunk/Source/JavaScriptCore/runtime/TypeSet.h</a></li>
<li><a href="#trunkSourceJavaScriptCoretestsstressfoldmultigetbyoffsettogetbyoffsetwithoutfoldingthestructurecheckjs">trunk/Source/JavaScriptCore/tests/stress/fold-multi-get-by-offset-to-get-by-offset-without-folding-the-structure-check.js</a></li>
<li><a href="#trunkSourceJavaScriptCoretestsstressfoldmultiputbyoffsettoputbyoffsetwithoutfoldingthestructurecheckjs">trunk/Source/JavaScriptCore/tests/stress/fold-multi-put-by-offset-to-put-by-offset-without-folding-the-structure-check.js</a></li>
<li><a href="#trunkSourceJavaScriptCoretestsstressprunemultiputbyoffsetreplaceortransitionvariantjs">trunk/Source/JavaScriptCore/tests/stress/prune-multi-put-by-offset-replace-or-transition-variant.js</a></li>
</ul>

</div>
<div id="patch">
<h3>Diff</h3>
<a id="trunkLayoutTestsChangeLog"></a>
<div class="modfile"><h4>Modified: trunk/LayoutTests/ChangeLog (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/ChangeLog        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/LayoutTests/ChangeLog        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -1,121 +1,48 @@
</span><del>-2014-07-25  Filip Pizlo  &lt;fpizlo@apple.com&gt;
</del><ins>+2014-07-26  Filip Pizlo  &lt;fpizlo@apple.com&gt;
</ins><span class="cx"> 
</span><del>-        Merge r170090, r170092, r170129, r170141, r170161, r170215, r170275, r170375, r170376, r170382, r170383, r170399, r170436, r170489, r170490, r170556 from ftlopt.
</del><ins>+        Unreviewed, roll out r171641-r171644. It broke some tests; will investigate and
+        reland later.
</ins><span class="cx"> 
</span><del>-    2014-07-25  Filip Pizlo  &lt;fpizlo@apple.com&gt;
-    
-            [ftlopt] Fold GetById/PutById to MultiGetByOffset/GetByOffset or MultiPutByOffset/PutByOffset, which implies handling non-singleton sets
-            https://bugs.webkit.org/show_bug.cgi?id=134090
-    
-            Reviewed by Oliver Hunt.
-    
-            * js/regress/fold-get-by-id-to-multi-get-by-offset-expected.txt: Added.
-            * js/regress/fold-get-by-id-to-multi-get-by-offset-rare-int-expected.txt: Added.
-            * js/regress/fold-get-by-id-to-multi-get-by-offset-rare-int.html: Added.
-            * js/regress/fold-get-by-id-to-multi-get-by-offset.html: Added.
-            * js/regress/fold-put-by-id-to-multi-put-by-offset-expected.txt: Added.
-            * js/regress/fold-put-by-id-to-multi-put-by-offset.html: Added.
-            * js/regress/script-tests/fold-get-by-id-to-multi-get-by-offset-rare-int.js: Added.
-            (foo):
-            (fu):
-            (bar):
-            (.bar):
-            (Number):
-            * js/regress/script-tests/fold-get-by-id-to-multi-get-by-offset.js: Added.
-            (foo):
-            (fu):
-            (bar):
-            (.bar):
-            (Number):
-            * js/regress/script-tests/fold-put-by-id-to-multi-put-by-offset.js: Added.
-            (foo):
-            (fu):
-            (bar):
-            (.bar):
-    
-    2014-06-19  Filip Pizlo  &lt;fpizlo@apple.com&gt;
-    
-            [ftlopt] LICM should be able to hoist CheckStructure even if the loop clobbers structures so long as the structures being checked are watchable
-            https://bugs.webkit.org/show_bug.cgi?id=134056
-    
-            Unreviewed, just landing the test cases for this attempted optimization. The test cases
-            will still be valid once we find a smart way of doing this optimization.
-    
-            * js/regress/hoist-poly-check-structure-effectful-loop-expected.txt: Added.
-            * js/regress/hoist-poly-check-structure-effectful-loop.html: Added.
-            * js/regress/hoist-poly-check-structure-expected.txt: Added.
-            * js/regress/hoist-poly-check-structure.html: Added.
-            * js/regress/script-tests/hoist-poly-check-structure-effectful-loop.js: Added.
-            (foo):
-            (test):
-            * js/regress/script-tests/hoist-poly-check-structure.js: Added.
-            (foo):
-            (test):
-    
-    2014-06-18  Filip Pizlo  &lt;fpizlo@apple.com&gt;
-    
-            DFG AI and constant folder should be able to precisely prune MultiGetByOffset/MultiPutByOffset even if the base structure abstract value is not a singleton
-            https://bugs.webkit.org/show_bug.cgi?id=133918
-    
-            Reviewed by Mark Hahnenberg.
-    
-            * js/regress/fold-multi-get-by-offset-to-get-by-offset-expected.txt: Added.
-            * js/regress/fold-multi-get-by-offset-to-get-by-offset.html: Added.
-            * js/regress/fold-multi-get-by-offset-to-poly-get-by-offset-expected.txt: Added.
-            * js/regress/fold-multi-get-by-offset-to-poly-get-by-offset.html: Added.
-            * js/regress/fold-multi-put-by-offset-to-poly-put-by-offset-expected.txt: Added.
-            * js/regress/fold-multi-put-by-offset-to-poly-put-by-offset.html: Added.
-            * js/regress/fold-multi-put-by-offset-to-put-by-offset-expected.txt: Added.
-            * js/regress/fold-multi-put-by-offset-to-put-by-offset.html: Added.
-            * js/regress/fold-multi-put-by-offset-to-replace-or-transition-put-by-offset-expected.txt: Added.
-            * js/regress/fold-multi-put-by-offset-to-replace-or-transition-put-by-offset.html: Added.
-            * js/regress/fold-put-structure-expected.txt: Added.
-            * js/regress/fold-put-structure.html: Added.
-            * js/regress/script-tests/fold-multi-get-by-offset-to-get-by-offset.js: Added.
-            (foo):
-            (fu):
-            (bar):
-            (.bar):
-            * js/regress/script-tests/fold-multi-get-by-offset-to-poly-get-by-offset.js: Added.
-            (foo):
-            (fu):
-            (bar):
-            (.bar):
-            * js/regress/script-tests/fold-multi-put-by-offset-to-poly-put-by-offset.js: Added.
-            (foo):
-            (fu):
-            (bar):
-            (.bar):
-            * js/regress/script-tests/fold-multi-put-by-offset-to-put-by-offset.js: Added.
-            (foo):
-            (fu):
-            (bar):
-            (.bar):
-            * js/regress/script-tests/fold-multi-put-by-offset-to-replace-or-transition-put-by-offset.js: Added.
-            (foo):
-            (fu):
-            (bar):
-            (.bar):
-            * js/regress/script-tests/fold-put-structure.js: Added.
-            (foo):
-            (fu):
-            (bar):
-            (.bar):
-    
-    2014-06-17  Filip Pizlo  &lt;fpizlo@apple.com&gt;
-    
-            [ftlopt] DFG put_by_id should inline accesses with a slightly polymorphic base
-            https://bugs.webkit.org/show_bug.cgi?id=133964
-    
-            Reviewed by Mark Hahnenberg.
-    
-            * js/regress/put-by-id-replace-and-transition-expected.txt: Added.
-            * js/regress/put-by-id-replace-and-transition.html: Added.
-            * js/regress/put-by-id-slightly-polymorphic-expected.txt: Added.
-            * js/regress/put-by-id-slightly-polymorphic.html: Added.
-            * js/regress/script-tests/put-by-id-replace-and-transition.js: Added.
-            * js/regress/script-tests/put-by-id-slightly-polymorphic.js: Added.
-    
</del><ins>+        * js/regress/fold-get-by-id-to-multi-get-by-offset-expected.txt: Removed.
+        * js/regress/fold-get-by-id-to-multi-get-by-offset-rare-int-expected.txt: Removed.
+        * js/regress/fold-get-by-id-to-multi-get-by-offset-rare-int.html: Removed.
+        * js/regress/fold-get-by-id-to-multi-get-by-offset.html: Removed.
+        * js/regress/fold-multi-get-by-offset-to-get-by-offset-expected.txt: Removed.
+        * js/regress/fold-multi-get-by-offset-to-get-by-offset.html: Removed.
+        * js/regress/fold-multi-get-by-offset-to-poly-get-by-offset-expected.txt: Removed.
+        * js/regress/fold-multi-get-by-offset-to-poly-get-by-offset.html: Removed.
+        * js/regress/fold-multi-put-by-offset-to-poly-put-by-offset-expected.txt: Removed.
+        * js/regress/fold-multi-put-by-offset-to-poly-put-by-offset.html: Removed.
+        * js/regress/fold-multi-put-by-offset-to-put-by-offset-expected.txt: Removed.
+        * js/regress/fold-multi-put-by-offset-to-put-by-offset.html: Removed.
+        * js/regress/fold-multi-put-by-offset-to-replace-or-transition-put-by-offset-expected.txt: Removed.
+        * js/regress/fold-multi-put-by-offset-to-replace-or-transition-put-by-offset.html: Removed.
+        * js/regress/fold-put-by-id-to-multi-put-by-offset-expected.txt: Removed.
+        * js/regress/fold-put-by-id-to-multi-put-by-offset.html: Removed.
+        * js/regress/fold-put-structure-expected.txt: Removed.
+        * js/regress/fold-put-structure.html: Removed.
+        * js/regress/hoist-poly-check-structure-effectful-loop-expected.txt: Removed.
+        * js/regress/hoist-poly-check-structure-effectful-loop.html: Removed.
+        * js/regress/hoist-poly-check-structure-expected.txt: Removed.
+        * js/regress/hoist-poly-check-structure.html: Removed.
+        * js/regress/put-by-id-replace-and-transition-expected.txt: Removed.
+        * js/regress/put-by-id-replace-and-transition.html: Removed.
+        * js/regress/put-by-id-slightly-polymorphic-expected.txt: Removed.
+        * js/regress/put-by-id-slightly-polymorphic.html: Removed.
+        * js/regress/script-tests/fold-get-by-id-to-multi-get-by-offset-rare-int.js: Removed.
+        * js/regress/script-tests/fold-get-by-id-to-multi-get-by-offset.js: Removed.
+        * js/regress/script-tests/fold-multi-get-by-offset-to-get-by-offset.js: Removed.
+        * js/regress/script-tests/fold-multi-get-by-offset-to-poly-get-by-offset.js: Removed.
+        * js/regress/script-tests/fold-multi-put-by-offset-to-poly-put-by-offset.js: Removed.
+        * js/regress/script-tests/fold-multi-put-by-offset-to-put-by-offset.js: Removed.
+        * js/regress/script-tests/fold-multi-put-by-offset-to-replace-or-transition-put-by-offset.js: Removed.
+        * js/regress/script-tests/fold-put-by-id-to-multi-put-by-offset.js: Removed.
+        * js/regress/script-tests/fold-put-structure.js: Removed.
+        * js/regress/script-tests/hoist-poly-check-structure-effectful-loop.js: Removed.
+        * js/regress/script-tests/hoist-poly-check-structure.js: Removed.
+        * js/regress/script-tests/put-by-id-replace-and-transition.js: Removed.
+        * js/regress/script-tests/put-by-id-slightly-polymorphic.js: Removed.
+
</ins><span class="cx"> 2014-07-25  Zalan Bujtas  &lt;zalan@apple.com&gt;
</span><span class="cx"> 
</span><span class="cx">         Subpixel rendering: Rounded rect gets non-renderable at certain subpixel size.
</span></span></pre></div>
<a id="trunkLayoutTestsjsregressfoldgetbyidtomultigetbyoffsetexpectedtxt"></a>
<div class="delfile"><h4>Deleted: trunk/LayoutTests/js/regress/fold-get-by-id-to-multi-get-by-offset-expected.txt (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/regress/fold-get-by-id-to-multi-get-by-offset-expected.txt        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/LayoutTests/js/regress/fold-get-by-id-to-multi-get-by-offset-expected.txt        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -1,10 +0,0 @@
</span><del>-JSRegress/fold-get-by-id-to-multi-get-by-offset
-
-On success, you will see a series of &quot;PASS&quot; messages, followed by &quot;TEST COMPLETE&quot;.
-
-
-PASS no exception thrown
-PASS successfullyParsed is true
-
-TEST COMPLETE
-
</del></span></pre></div>
<a id="trunkLayoutTestsjsregressfoldgetbyidtomultigetbyoffsetrareintexpectedtxt"></a>
<div class="delfile"><h4>Deleted: trunk/LayoutTests/js/regress/fold-get-by-id-to-multi-get-by-offset-rare-int-expected.txt (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/regress/fold-get-by-id-to-multi-get-by-offset-rare-int-expected.txt        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/LayoutTests/js/regress/fold-get-by-id-to-multi-get-by-offset-rare-int-expected.txt        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -1,10 +0,0 @@
</span><del>-JSRegress/fold-get-by-id-to-multi-get-by-offset-rare-int
-
-On success, you will see a series of &quot;PASS&quot; messages, followed by &quot;TEST COMPLETE&quot;.
-
-
-PASS no exception thrown
-PASS successfullyParsed is true
-
-TEST COMPLETE
-
</del></span></pre></div>
<a id="trunkLayoutTestsjsregressfoldgetbyidtomultigetbyoffsetrareinthtml"></a>
<div class="delfile"><h4>Deleted: trunk/LayoutTests/js/regress/fold-get-by-id-to-multi-get-by-offset-rare-int.html (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/regress/fold-get-by-id-to-multi-get-by-offset-rare-int.html        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/LayoutTests/js/regress/fold-get-by-id-to-multi-get-by-offset-rare-int.html        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -1,12 +0,0 @@
</span><del>-&lt;!DOCTYPE HTML PUBLIC &quot;-//IETF//DTD HTML//EN&quot;&gt;
-&lt;html&gt;
-&lt;head&gt;
-&lt;script src=&quot;../../resources/js-test-pre.js&quot;&gt;&lt;/script&gt;
-&lt;/head&gt;
-&lt;body&gt;
-&lt;script src=&quot;../../resources/regress-pre.js&quot;&gt;&lt;/script&gt;
-&lt;script src=&quot;script-tests/fold-get-by-id-to-multi-get-by-offset-rare-int.js&quot;&gt;&lt;/script&gt;
-&lt;script src=&quot;../../resources/regress-post.js&quot;&gt;&lt;/script&gt;
-&lt;script src=&quot;../../resources/js-test-post.js&quot;&gt;&lt;/script&gt;
-&lt;/body&gt;
-&lt;/html&gt;
</del></span></pre></div>
<a id="trunkLayoutTestsjsregressfoldgetbyidtomultigetbyoffsethtml"></a>
<div class="delfile"><h4>Deleted: trunk/LayoutTests/js/regress/fold-get-by-id-to-multi-get-by-offset.html (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/regress/fold-get-by-id-to-multi-get-by-offset.html        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/LayoutTests/js/regress/fold-get-by-id-to-multi-get-by-offset.html        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -1,12 +0,0 @@
</span><del>-&lt;!DOCTYPE HTML PUBLIC &quot;-//IETF//DTD HTML//EN&quot;&gt;
-&lt;html&gt;
-&lt;head&gt;
-&lt;script src=&quot;../../resources/js-test-pre.js&quot;&gt;&lt;/script&gt;
-&lt;/head&gt;
-&lt;body&gt;
-&lt;script src=&quot;../../resources/regress-pre.js&quot;&gt;&lt;/script&gt;
-&lt;script src=&quot;script-tests/fold-get-by-id-to-multi-get-by-offset.js&quot;&gt;&lt;/script&gt;
-&lt;script src=&quot;../../resources/regress-post.js&quot;&gt;&lt;/script&gt;
-&lt;script src=&quot;../../resources/js-test-post.js&quot;&gt;&lt;/script&gt;
-&lt;/body&gt;
-&lt;/html&gt;
</del></span></pre></div>
<a id="trunkLayoutTestsjsregressfoldmultigetbyoffsettogetbyoffsetexpectedtxt"></a>
<div class="delfile"><h4>Deleted: trunk/LayoutTests/js/regress/fold-multi-get-by-offset-to-get-by-offset-expected.txt (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/regress/fold-multi-get-by-offset-to-get-by-offset-expected.txt        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/LayoutTests/js/regress/fold-multi-get-by-offset-to-get-by-offset-expected.txt        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -1,10 +0,0 @@
</span><del>-JSRegress/fold-multi-get-by-offset-to-get-by-offset
-
-On success, you will see a series of &quot;PASS&quot; messages, followed by &quot;TEST COMPLETE&quot;.
-
-
-PASS no exception thrown
-PASS successfullyParsed is true
-
-TEST COMPLETE
-
</del></span></pre></div>
<a id="trunkLayoutTestsjsregressfoldmultigetbyoffsettogetbyoffsethtml"></a>
<div class="delfile"><h4>Deleted: trunk/LayoutTests/js/regress/fold-multi-get-by-offset-to-get-by-offset.html (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/regress/fold-multi-get-by-offset-to-get-by-offset.html        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/LayoutTests/js/regress/fold-multi-get-by-offset-to-get-by-offset.html        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -1,12 +0,0 @@
</span><del>-&lt;!DOCTYPE HTML PUBLIC &quot;-//IETF//DTD HTML//EN&quot;&gt;
-&lt;html&gt;
-&lt;head&gt;
-&lt;script src=&quot;../../resources/js-test-pre.js&quot;&gt;&lt;/script&gt;
-&lt;/head&gt;
-&lt;body&gt;
-&lt;script src=&quot;../../resources/regress-pre.js&quot;&gt;&lt;/script&gt;
-&lt;script src=&quot;script-tests/fold-multi-get-by-offset-to-get-by-offset.js&quot;&gt;&lt;/script&gt;
-&lt;script src=&quot;../../resources/regress-post.js&quot;&gt;&lt;/script&gt;
-&lt;script src=&quot;../../resources/js-test-post.js&quot;&gt;&lt;/script&gt;
-&lt;/body&gt;
-&lt;/html&gt;
</del></span></pre></div>
<a id="trunkLayoutTestsjsregressfoldmultigetbyoffsettopolygetbyoffsetexpectedtxt"></a>
<div class="delfile"><h4>Deleted: trunk/LayoutTests/js/regress/fold-multi-get-by-offset-to-poly-get-by-offset-expected.txt (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/regress/fold-multi-get-by-offset-to-poly-get-by-offset-expected.txt        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/LayoutTests/js/regress/fold-multi-get-by-offset-to-poly-get-by-offset-expected.txt        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -1,10 +0,0 @@
</span><del>-JSRegress/fold-multi-get-by-offset-to-poly-get-by-offset
-
-On success, you will see a series of &quot;PASS&quot; messages, followed by &quot;TEST COMPLETE&quot;.
-
-
-PASS no exception thrown
-PASS successfullyParsed is true
-
-TEST COMPLETE
-
</del></span></pre></div>
<a id="trunkLayoutTestsjsregressfoldmultigetbyoffsettopolygetbyoffsethtml"></a>
<div class="delfile"><h4>Deleted: trunk/LayoutTests/js/regress/fold-multi-get-by-offset-to-poly-get-by-offset.html (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/regress/fold-multi-get-by-offset-to-poly-get-by-offset.html        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/LayoutTests/js/regress/fold-multi-get-by-offset-to-poly-get-by-offset.html        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -1,12 +0,0 @@
</span><del>-&lt;!DOCTYPE HTML PUBLIC &quot;-//IETF//DTD HTML//EN&quot;&gt;
-&lt;html&gt;
-&lt;head&gt;
-&lt;script src=&quot;../../resources/js-test-pre.js&quot;&gt;&lt;/script&gt;
-&lt;/head&gt;
-&lt;body&gt;
-&lt;script src=&quot;../../resources/regress-pre.js&quot;&gt;&lt;/script&gt;
-&lt;script src=&quot;script-tests/fold-multi-get-by-offset-to-poly-get-by-offset.js&quot;&gt;&lt;/script&gt;
-&lt;script src=&quot;../../resources/regress-post.js&quot;&gt;&lt;/script&gt;
-&lt;script src=&quot;../../resources/js-test-post.js&quot;&gt;&lt;/script&gt;
-&lt;/body&gt;
-&lt;/html&gt;
</del></span></pre></div>
<a id="trunkLayoutTestsjsregressfoldmultiputbyoffsettopolyputbyoffsetexpectedtxt"></a>
<div class="delfile"><h4>Deleted: trunk/LayoutTests/js/regress/fold-multi-put-by-offset-to-poly-put-by-offset-expected.txt (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/regress/fold-multi-put-by-offset-to-poly-put-by-offset-expected.txt        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/LayoutTests/js/regress/fold-multi-put-by-offset-to-poly-put-by-offset-expected.txt        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -1,10 +0,0 @@
</span><del>-JSRegress/fold-multi-put-by-offset-to-poly-put-by-offset
-
-On success, you will see a series of &quot;PASS&quot; messages, followed by &quot;TEST COMPLETE&quot;.
-
-
-PASS no exception thrown
-PASS successfullyParsed is true
-
-TEST COMPLETE
-
</del></span></pre></div>
<a id="trunkLayoutTestsjsregressfoldmultiputbyoffsettopolyputbyoffsethtml"></a>
<div class="delfile"><h4>Deleted: trunk/LayoutTests/js/regress/fold-multi-put-by-offset-to-poly-put-by-offset.html (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/regress/fold-multi-put-by-offset-to-poly-put-by-offset.html        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/LayoutTests/js/regress/fold-multi-put-by-offset-to-poly-put-by-offset.html        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -1,12 +0,0 @@
</span><del>-&lt;!DOCTYPE HTML PUBLIC &quot;-//IETF//DTD HTML//EN&quot;&gt;
-&lt;html&gt;
-&lt;head&gt;
-&lt;script src=&quot;../../resources/js-test-pre.js&quot;&gt;&lt;/script&gt;
-&lt;/head&gt;
-&lt;body&gt;
-&lt;script src=&quot;../../resources/regress-pre.js&quot;&gt;&lt;/script&gt;
-&lt;script src=&quot;script-tests/fold-multi-put-by-offset-to-poly-put-by-offset.js&quot;&gt;&lt;/script&gt;
-&lt;script src=&quot;../../resources/regress-post.js&quot;&gt;&lt;/script&gt;
-&lt;script src=&quot;../../resources/js-test-post.js&quot;&gt;&lt;/script&gt;
-&lt;/body&gt;
-&lt;/html&gt;
</del></span></pre></div>
<a id="trunkLayoutTestsjsregressfoldmultiputbyoffsettoputbyoffsetexpectedtxt"></a>
<div class="delfile"><h4>Deleted: trunk/LayoutTests/js/regress/fold-multi-put-by-offset-to-put-by-offset-expected.txt (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/regress/fold-multi-put-by-offset-to-put-by-offset-expected.txt        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/LayoutTests/js/regress/fold-multi-put-by-offset-to-put-by-offset-expected.txt        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -1,10 +0,0 @@
</span><del>-JSRegress/fold-multi-put-by-offset-to-put-by-offset
-
-On success, you will see a series of &quot;PASS&quot; messages, followed by &quot;TEST COMPLETE&quot;.
-
-
-PASS no exception thrown
-PASS successfullyParsed is true
-
-TEST COMPLETE
-
</del></span></pre></div>
<a id="trunkLayoutTestsjsregressfoldmultiputbyoffsettoputbyoffsethtml"></a>
<div class="delfile"><h4>Deleted: trunk/LayoutTests/js/regress/fold-multi-put-by-offset-to-put-by-offset.html (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/regress/fold-multi-put-by-offset-to-put-by-offset.html        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/LayoutTests/js/regress/fold-multi-put-by-offset-to-put-by-offset.html        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -1,12 +0,0 @@
</span><del>-&lt;!DOCTYPE HTML PUBLIC &quot;-//IETF//DTD HTML//EN&quot;&gt;
-&lt;html&gt;
-&lt;head&gt;
-&lt;script src=&quot;../../resources/js-test-pre.js&quot;&gt;&lt;/script&gt;
-&lt;/head&gt;
-&lt;body&gt;
-&lt;script src=&quot;../../resources/regress-pre.js&quot;&gt;&lt;/script&gt;
-&lt;script src=&quot;script-tests/fold-multi-put-by-offset-to-put-by-offset.js&quot;&gt;&lt;/script&gt;
-&lt;script src=&quot;../../resources/regress-post.js&quot;&gt;&lt;/script&gt;
-&lt;script src=&quot;../../resources/js-test-post.js&quot;&gt;&lt;/script&gt;
-&lt;/body&gt;
-&lt;/html&gt;
</del></span></pre></div>
<a id="trunkLayoutTestsjsregressfoldmultiputbyoffsettoreplaceortransitionputbyoffsetexpectedtxt"></a>
<div class="delfile"><h4>Deleted: trunk/LayoutTests/js/regress/fold-multi-put-by-offset-to-replace-or-transition-put-by-offset-expected.txt (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/regress/fold-multi-put-by-offset-to-replace-or-transition-put-by-offset-expected.txt        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/LayoutTests/js/regress/fold-multi-put-by-offset-to-replace-or-transition-put-by-offset-expected.txt        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -1,10 +0,0 @@
</span><del>-JSRegress/fold-multi-put-by-offset-to-replace-or-transition-put-by-offset
-
-On success, you will see a series of &quot;PASS&quot; messages, followed by &quot;TEST COMPLETE&quot;.
-
-
-PASS no exception thrown
-PASS successfullyParsed is true
-
-TEST COMPLETE
-
</del></span></pre></div>
<a id="trunkLayoutTestsjsregressfoldmultiputbyoffsettoreplaceortransitionputbyoffsethtml"></a>
<div class="delfile"><h4>Deleted: trunk/LayoutTests/js/regress/fold-multi-put-by-offset-to-replace-or-transition-put-by-offset.html (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/regress/fold-multi-put-by-offset-to-replace-or-transition-put-by-offset.html        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/LayoutTests/js/regress/fold-multi-put-by-offset-to-replace-or-transition-put-by-offset.html        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -1,12 +0,0 @@
</span><del>-&lt;!DOCTYPE HTML PUBLIC &quot;-//IETF//DTD HTML//EN&quot;&gt;
-&lt;html&gt;
-&lt;head&gt;
-&lt;script src=&quot;../../resources/js-test-pre.js&quot;&gt;&lt;/script&gt;
-&lt;/head&gt;
-&lt;body&gt;
-&lt;script src=&quot;../../resources/regress-pre.js&quot;&gt;&lt;/script&gt;
-&lt;script src=&quot;script-tests/fold-multi-put-by-offset-to-replace-or-transition-put-by-offset.js&quot;&gt;&lt;/script&gt;
-&lt;script src=&quot;../../resources/regress-post.js&quot;&gt;&lt;/script&gt;
-&lt;script src=&quot;../../resources/js-test-post.js&quot;&gt;&lt;/script&gt;
-&lt;/body&gt;
-&lt;/html&gt;
</del></span></pre></div>
<a id="trunkLayoutTestsjsregressfoldputbyidtomultiputbyoffsetexpectedtxt"></a>
<div class="delfile"><h4>Deleted: trunk/LayoutTests/js/regress/fold-put-by-id-to-multi-put-by-offset-expected.txt (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/regress/fold-put-by-id-to-multi-put-by-offset-expected.txt        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/LayoutTests/js/regress/fold-put-by-id-to-multi-put-by-offset-expected.txt        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -1,10 +0,0 @@
</span><del>-JSRegress/fold-put-by-id-to-multi-put-by-offset
-
-On success, you will see a series of &quot;PASS&quot; messages, followed by &quot;TEST COMPLETE&quot;.
-
-
-PASS no exception thrown
-PASS successfullyParsed is true
-
-TEST COMPLETE
-
</del></span></pre></div>
<a id="trunkLayoutTestsjsregressfoldputbyidtomultiputbyoffsethtml"></a>
<div class="delfile"><h4>Deleted: trunk/LayoutTests/js/regress/fold-put-by-id-to-multi-put-by-offset.html (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/regress/fold-put-by-id-to-multi-put-by-offset.html        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/LayoutTests/js/regress/fold-put-by-id-to-multi-put-by-offset.html        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -1,12 +0,0 @@
</span><del>-&lt;!DOCTYPE HTML PUBLIC &quot;-//IETF//DTD HTML//EN&quot;&gt;
-&lt;html&gt;
-&lt;head&gt;
-&lt;script src=&quot;../../resources/js-test-pre.js&quot;&gt;&lt;/script&gt;
-&lt;/head&gt;
-&lt;body&gt;
-&lt;script src=&quot;../../resources/regress-pre.js&quot;&gt;&lt;/script&gt;
-&lt;script src=&quot;script-tests/fold-put-by-id-to-multi-put-by-offset.js&quot;&gt;&lt;/script&gt;
-&lt;script src=&quot;../../resources/regress-post.js&quot;&gt;&lt;/script&gt;
-&lt;script src=&quot;../../resources/js-test-post.js&quot;&gt;&lt;/script&gt;
-&lt;/body&gt;
-&lt;/html&gt;
</del></span></pre></div>
<a id="trunkLayoutTestsjsregressfoldputstructureexpectedtxt"></a>
<div class="delfile"><h4>Deleted: trunk/LayoutTests/js/regress/fold-put-structure-expected.txt (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/regress/fold-put-structure-expected.txt        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/LayoutTests/js/regress/fold-put-structure-expected.txt        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -1,10 +0,0 @@
</span><del>-JSRegress/fold-put-structure
-
-On success, you will see a series of &quot;PASS&quot; messages, followed by &quot;TEST COMPLETE&quot;.
-
-
-PASS no exception thrown
-PASS successfullyParsed is true
-
-TEST COMPLETE
-
</del></span></pre></div>
<a id="trunkLayoutTestsjsregressfoldputstructurehtml"></a>
<div class="delfile"><h4>Deleted: trunk/LayoutTests/js/regress/fold-put-structure.html (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/regress/fold-put-structure.html        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/LayoutTests/js/regress/fold-put-structure.html        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -1,12 +0,0 @@
</span><del>-&lt;!DOCTYPE HTML PUBLIC &quot;-//IETF//DTD HTML//EN&quot;&gt;
-&lt;html&gt;
-&lt;head&gt;
-&lt;script src=&quot;../../resources/js-test-pre.js&quot;&gt;&lt;/script&gt;
-&lt;/head&gt;
-&lt;body&gt;
-&lt;script src=&quot;../../resources/regress-pre.js&quot;&gt;&lt;/script&gt;
-&lt;script src=&quot;script-tests/fold-put-structure.js&quot;&gt;&lt;/script&gt;
-&lt;script src=&quot;../../resources/regress-post.js&quot;&gt;&lt;/script&gt;
-&lt;script src=&quot;../../resources/js-test-post.js&quot;&gt;&lt;/script&gt;
-&lt;/body&gt;
-&lt;/html&gt;
</del></span></pre></div>
<a id="trunkLayoutTestsjsregresshoistpolycheckstructureeffectfulloopexpectedtxt"></a>
<div class="delfile"><h4>Deleted: trunk/LayoutTests/js/regress/hoist-poly-check-structure-effectful-loop-expected.txt (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/regress/hoist-poly-check-structure-effectful-loop-expected.txt        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/LayoutTests/js/regress/hoist-poly-check-structure-effectful-loop-expected.txt        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -1,10 +0,0 @@
</span><del>-JSRegress/hoist-poly-check-structure-effectful-loop
-
-On success, you will see a series of &quot;PASS&quot; messages, followed by &quot;TEST COMPLETE&quot;.
-
-
-PASS no exception thrown
-PASS successfullyParsed is true
-
-TEST COMPLETE
-
</del></span></pre></div>
<a id="trunkLayoutTestsjsregresshoistpolycheckstructureeffectfulloophtml"></a>
<div class="delfile"><h4>Deleted: trunk/LayoutTests/js/regress/hoist-poly-check-structure-effectful-loop.html (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/regress/hoist-poly-check-structure-effectful-loop.html        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/LayoutTests/js/regress/hoist-poly-check-structure-effectful-loop.html        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -1,12 +0,0 @@
</span><del>-&lt;!DOCTYPE HTML PUBLIC &quot;-//IETF//DTD HTML//EN&quot;&gt;
-&lt;html&gt;
-&lt;head&gt;
-&lt;script src=&quot;../../resources/js-test-pre.js&quot;&gt;&lt;/script&gt;
-&lt;/head&gt;
-&lt;body&gt;
-&lt;script src=&quot;../../resources/regress-pre.js&quot;&gt;&lt;/script&gt;
-&lt;script src=&quot;script-tests/hoist-poly-check-structure-effectful-loop.js&quot;&gt;&lt;/script&gt;
-&lt;script src=&quot;../../resources/regress-post.js&quot;&gt;&lt;/script&gt;
-&lt;script src=&quot;../../resources/js-test-post.js&quot;&gt;&lt;/script&gt;
-&lt;/body&gt;
-&lt;/html&gt;
</del></span></pre></div>
<a id="trunkLayoutTestsjsregresshoistpolycheckstructureexpectedtxt"></a>
<div class="delfile"><h4>Deleted: trunk/LayoutTests/js/regress/hoist-poly-check-structure-expected.txt (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/regress/hoist-poly-check-structure-expected.txt        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/LayoutTests/js/regress/hoist-poly-check-structure-expected.txt        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -1,10 +0,0 @@
</span><del>-JSRegress/hoist-poly-check-structure
-
-On success, you will see a series of &quot;PASS&quot; messages, followed by &quot;TEST COMPLETE&quot;.
-
-
-PASS no exception thrown
-PASS successfullyParsed is true
-
-TEST COMPLETE
-
</del></span></pre></div>
<a id="trunkLayoutTestsjsregresshoistpolycheckstructurehtml"></a>
<div class="delfile"><h4>Deleted: trunk/LayoutTests/js/regress/hoist-poly-check-structure.html (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/regress/hoist-poly-check-structure.html        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/LayoutTests/js/regress/hoist-poly-check-structure.html        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -1,12 +0,0 @@
</span><del>-&lt;!DOCTYPE HTML PUBLIC &quot;-//IETF//DTD HTML//EN&quot;&gt;
-&lt;html&gt;
-&lt;head&gt;
-&lt;script src=&quot;../../resources/js-test-pre.js&quot;&gt;&lt;/script&gt;
-&lt;/head&gt;
-&lt;body&gt;
-&lt;script src=&quot;../../resources/regress-pre.js&quot;&gt;&lt;/script&gt;
-&lt;script src=&quot;script-tests/hoist-poly-check-structure.js&quot;&gt;&lt;/script&gt;
-&lt;script src=&quot;../../resources/regress-post.js&quot;&gt;&lt;/script&gt;
-&lt;script src=&quot;../../resources/js-test-post.js&quot;&gt;&lt;/script&gt;
-&lt;/body&gt;
-&lt;/html&gt;
</del></span></pre></div>
<a id="trunkLayoutTestsjsregressputbyidreplaceandtransitionexpectedtxt"></a>
<div class="delfile"><h4>Deleted: trunk/LayoutTests/js/regress/put-by-id-replace-and-transition-expected.txt (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/regress/put-by-id-replace-and-transition-expected.txt        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/LayoutTests/js/regress/put-by-id-replace-and-transition-expected.txt        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -1,10 +0,0 @@
</span><del>-JSRegress/put-by-id-replace-and-transition
-
-On success, you will see a series of &quot;PASS&quot; messages, followed by &quot;TEST COMPLETE&quot;.
-
-
-PASS no exception thrown
-PASS successfullyParsed is true
-
-TEST COMPLETE
-
</del></span></pre></div>
<a id="trunkLayoutTestsjsregressputbyidreplaceandtransitionhtml"></a>
<div class="delfile"><h4>Deleted: trunk/LayoutTests/js/regress/put-by-id-replace-and-transition.html (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/regress/put-by-id-replace-and-transition.html        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/LayoutTests/js/regress/put-by-id-replace-and-transition.html        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -1,12 +0,0 @@
</span><del>-&lt;!DOCTYPE HTML PUBLIC &quot;-//IETF//DTD HTML//EN&quot;&gt;
-&lt;html&gt;
-&lt;head&gt;
-&lt;script src=&quot;../../resources/js-test-pre.js&quot;&gt;&lt;/script&gt;
-&lt;/head&gt;
-&lt;body&gt;
-&lt;script src=&quot;../../resources/regress-pre.js&quot;&gt;&lt;/script&gt;
-&lt;script src=&quot;script-tests/put-by-id-replace-and-transition.js&quot;&gt;&lt;/script&gt;
-&lt;script src=&quot;../../resources/regress-post.js&quot;&gt;&lt;/script&gt;
-&lt;script src=&quot;../../resources/js-test-post.js&quot;&gt;&lt;/script&gt;
-&lt;/body&gt;
-&lt;/html&gt;
</del></span></pre></div>
<a id="trunkLayoutTestsjsregressputbyidslightlypolymorphicexpectedtxt"></a>
<div class="delfile"><h4>Deleted: trunk/LayoutTests/js/regress/put-by-id-slightly-polymorphic-expected.txt (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/regress/put-by-id-slightly-polymorphic-expected.txt        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/LayoutTests/js/regress/put-by-id-slightly-polymorphic-expected.txt        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -1,10 +0,0 @@
</span><del>-JSRegress/put-by-id-slightly-polymorphic
-
-On success, you will see a series of &quot;PASS&quot; messages, followed by &quot;TEST COMPLETE&quot;.
-
-
-PASS no exception thrown
-PASS successfullyParsed is true
-
-TEST COMPLETE
-
</del></span></pre></div>
<a id="trunkLayoutTestsjsregressputbyidslightlypolymorphichtml"></a>
<div class="delfile"><h4>Deleted: trunk/LayoutTests/js/regress/put-by-id-slightly-polymorphic.html (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/regress/put-by-id-slightly-polymorphic.html        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/LayoutTests/js/regress/put-by-id-slightly-polymorphic.html        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -1,12 +0,0 @@
</span><del>-&lt;!DOCTYPE HTML PUBLIC &quot;-//IETF//DTD HTML//EN&quot;&gt;
-&lt;html&gt;
-&lt;head&gt;
-&lt;script src=&quot;../../resources/js-test-pre.js&quot;&gt;&lt;/script&gt;
-&lt;/head&gt;
-&lt;body&gt;
-&lt;script src=&quot;../../resources/regress-pre.js&quot;&gt;&lt;/script&gt;
-&lt;script src=&quot;script-tests/put-by-id-slightly-polymorphic.js&quot;&gt;&lt;/script&gt;
-&lt;script src=&quot;../../resources/regress-post.js&quot;&gt;&lt;/script&gt;
-&lt;script src=&quot;../../resources/js-test-post.js&quot;&gt;&lt;/script&gt;
-&lt;/body&gt;
-&lt;/html&gt;
</del></span></pre></div>
<a id="trunkLayoutTestsjsregressscripttestsfoldgetbyidtomultigetbyoffsetrareintjs"></a>
<div class="delfile"><h4>Deleted: trunk/LayoutTests/js/regress/script-tests/fold-get-by-id-to-multi-get-by-offset-rare-int.js (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/regress/script-tests/fold-get-by-id-to-multi-get-by-offset-rare-int.js        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/LayoutTests/js/regress/script-tests/fold-get-by-id-to-multi-get-by-offset-rare-int.js        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -1,47 +0,0 @@
</span><del>-function foo(o) {
-    return o.f;
-}
-
-function fu(o) {
-    return o.e;
-}
-
-function bar(f, o) {
-    return f(o);
-}
-
-for (var i = 0; i &lt; 1000; ++i) {
-    var o = {f:1};
-    o[&quot;i&quot; + i] = 42;
-    foo(o);
-    fu({f:1, e:2});
-    fu({e:1, f:2});
-}
-    
-for (var i = 0; i &lt; 100; ++i) {
-    bar(foo, {f:1});
-    bar(function() { }, null);
-    bar(function() { return 42 }, null);
-}
-
-Number.prototype.f = 100;
-    
-(function(f, o, p) {
-    var result = 0;
-    var n = 1000000;
-    for (var i = 0; i &lt; n + 1; ++i) {
-        result += fu(o);
-        var q;
-        if (i == n)
-            q = 42;
-        else
-            q = o;
-        result += bar(f, q);
-        var tmp = o;
-        o = p;
-        p = tmp;
-    }
-    if (result != (o.f + o.e + p.f + p.e) * n / 2 + 100 + p.e)
-        throw &quot;Error: bad result: &quot; + result;
-})(foo, {f:42, e:43}, {e:44, f:45});
-
</del></span></pre></div>
<a id="trunkLayoutTestsjsregressscripttestsfoldgetbyidtomultigetbyoffsetjs"></a>
<div class="delfile"><h4>Deleted: trunk/LayoutTests/js/regress/script-tests/fold-get-by-id-to-multi-get-by-offset.js (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/regress/script-tests/fold-get-by-id-to-multi-get-by-offset.js        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/LayoutTests/js/regress/script-tests/fold-get-by-id-to-multi-get-by-offset.js        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -1,42 +0,0 @@
</span><del>-function foo(o) {
-    return o.f;
-}
-
-function fu(o) {
-    return o.e;
-}
-
-function bar(f, o) {
-    return f(o);
-}
-
-for (var i = 0; i &lt; 1000; ++i) {
-    var o = {f:1};
-    o[&quot;i&quot; + i] = 42;
-    foo(o);
-    fu({f:1, e:2});
-    fu({e:1, f:2});
-}
-    
-for (var i = 0; i &lt; 100; ++i) {
-    bar(foo, {f:1});
-    bar(function() { }, null);
-    bar(function() { return 42 }, null);
-}
-
-Number.prototype.f = 100;
-    
-(function(f, o, p) {
-    var result = 0;
-    var n = 1000000;
-    for (var i = 0; i &lt; n; ++i) {
-        result += fu(o);
-        result += bar(f, o);
-        var tmp = o;
-        o = p;
-        p = tmp;
-    }
-    if (result != (o.f + o.e + p.f + p.e) * n / 2)
-        throw &quot;Error: bad result: &quot; + result;
-})(foo, {f:42, e:43}, {e:44, f:45});
-
</del></span></pre></div>
<a id="trunkLayoutTestsjsregressscripttestsfoldmultigetbyoffsettogetbyoffsetjs"></a>
<div class="delfile"><h4>Deleted: trunk/LayoutTests/js/regress/script-tests/fold-multi-get-by-offset-to-get-by-offset.js (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/regress/script-tests/fold-multi-get-by-offset-to-get-by-offset.js        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/LayoutTests/js/regress/script-tests/fold-multi-get-by-offset-to-get-by-offset.js        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -1,43 +0,0 @@
</span><del>-function foo(o) {
-    return o.f;
-}
-
-function fu(o) {
-    return o.e;
-}
-
-function bar(f, o) {
-    return f(o);
-}
-
-for (var i = 0; i &lt; 100; ++i) {
-    foo({f:1, e:2});
-    foo({e:1, f:2});
-    foo({d:1, e:2, f:3});
-    fu({f:1, e:2});
-    fu({e:1, f:2});
-    fu({d:1, e:2, f:3});
-}
-    
-for (var i = 0; i &lt; 100; ++i) {
-    bar(foo, {f:1});
-    bar(function() { }, null);
-    bar(function() { return 42 }, null);
-}
-    
-(function(f, o) {
-    var result = 0;
-    var n = 1000000;
-    for (var i = 0; i &lt; n; ++i) {
-        var p;
-        if (i == n - 1) // Defeat LICM.
-            p = {f: 42, e: 42};
-        else
-            p = o;
-        result += fu(p);
-        result += bar(f, p);
-    }
-    if (result != (n - 1) * (o.f + o.e) + 42 * 2)
-        throw &quot;Error: bad result: &quot; + result;
-})(foo, {f:42, e:2});
-
</del></span></pre></div>
<a id="trunkLayoutTestsjsregressscripttestsfoldmultigetbyoffsettopolygetbyoffsetjs"></a>
<div class="delfile"><h4>Deleted: trunk/LayoutTests/js/regress/script-tests/fold-multi-get-by-offset-to-poly-get-by-offset.js (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/regress/script-tests/fold-multi-get-by-offset-to-poly-get-by-offset.js        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/LayoutTests/js/regress/script-tests/fold-multi-get-by-offset-to-poly-get-by-offset.js        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -1,41 +0,0 @@
</span><del>-function foo(o) {
-    return o.f;
-}
-
-function fu(o) {
-    return o.e;
-}
-
-function bar(f, o) {
-    return f(o);
-}
-
-for (var i = 0; i &lt; 100; ++i) {
-    foo({f:1, e:2});
-    foo({e:1, f:2});
-    foo({d:1, e:2, f:3});
-    fu({f:1, e:2});
-    fu({e:1, f:2});
-    fu({d:1, e:2, f:3});
-}
-    
-for (var i = 0; i &lt; 100; ++i) {
-    bar(foo, {f:1});
-    bar(function() { }, null);
-    bar(function() { return 42 }, null);
-}
-    
-(function(f, o, p) {
-    var result = 0;
-    var n = 1000000;
-    for (var i = 0; i &lt; n; ++i) {
-        result += fu(o);
-        result += bar(f, o);
-        var tmp = o;
-        o = p;
-        p = tmp;
-    }
-    if (result != n * o.f + n * o.e)
-        throw &quot;Error: bad result: &quot; + result;
-})(foo, {f:42, e:23}, {f:42, e:23, g:100});
-
</del></span></pre></div>
<a id="trunkLayoutTestsjsregressscripttestsfoldmultiputbyoffsettopolyputbyoffsetjs"></a>
<div class="delfile"><h4>Deleted: trunk/LayoutTests/js/regress/script-tests/fold-multi-put-by-offset-to-poly-put-by-offset.js (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/regress/script-tests/fold-multi-put-by-offset-to-poly-put-by-offset.js        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/LayoutTests/js/regress/script-tests/fold-multi-put-by-offset-to-poly-put-by-offset.js        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -1,47 +0,0 @@
</span><del>-function foo(o) {
-    o.f = 1;
-}
-
-function fu(o) {
-    o.e = 2;
-}
-
-function bar(f, o) {
-    f(o);
-}
-
-for (var i = 0; i &lt; 100; ++i) {
-    foo({f:1, e:2});
-    foo({e:1, f:2});
-    foo({d:1, e:2, f:3});
-    fu({f:1, e:2});
-    fu({e:1, f:2});
-    fu({d:1, e:2, f:3});
-}
-    
-for (var i = 0; i &lt; 100; ++i) {
-    bar(foo, {f:1});
-    bar(function() { }, null);
-    bar(function() { return 42 }, null);
-}
-    
-(function(f, o, p) {
-    var result = 0;
-    var n = 1000000;
-    for (var i = 0; i &lt; n; ++i) {
-        fu(o);
-        bar(f, o);
-        var tmp = o;
-        o = p;
-        p = tmp;
-    }
-    if (o.e != 2)
-        throw &quot;Error: bad value in o.e: &quot; + o.e;
-    if (o.f != 1)
-        throw &quot;Error: bad value in o.f: &quot; + o.f;
-    if (p.e != 2)
-        throw &quot;Error: bad value in p.e: &quot; + p.e;
-    if (p.f != 1)
-        throw &quot;Error: bad value in p.f: &quot; + p.f;
-})(foo, {f:42, e:23}, {f:42, e:23, g:100});
-
</del></span></pre></div>
<a id="trunkLayoutTestsjsregressscripttestsfoldmultiputbyoffsettoputbyoffsetjs"></a>
<div class="delfile"><h4>Deleted: trunk/LayoutTests/js/regress/script-tests/fold-multi-put-by-offset-to-put-by-offset.js (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/regress/script-tests/fold-multi-put-by-offset-to-put-by-offset.js        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/LayoutTests/js/regress/script-tests/fold-multi-put-by-offset-to-put-by-offset.js        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -1,40 +0,0 @@
</span><del>-function foo(o) {
-    o.f = 1;
-}
-
-function fu(o) {
-    o.e = 2;
-}
-
-function bar(f, o) {
-    f(o);
-}
-
-for (var i = 0; i &lt; 100; ++i) {
-    foo({f:1, e:2});
-    foo({e:1, f:2});
-    foo({d:1, e:2, f:3});
-    fu({f:1, e:2});
-    fu({e:1, f:2});
-    fu({d:1, e:2, f:3});
-}
-    
-for (var i = 0; i &lt; 100; ++i) {
-    bar(foo, {f:1});
-    bar(function() { }, null);
-    bar(function() { return 42 }, null);
-}
-    
-(function(f, o) {
-    var result = 0;
-    var n = 1000000;
-    for (var i = 0; i &lt; n; ++i) {
-        fu(o);
-        bar(f, o);
-    }
-    if (o.e != 2)
-        throw &quot;Error: bad value in o.e: &quot; + o.e;
-    if (o.f != 1)
-        throw &quot;Error: bad value in o.f: &quot; + o.f;
-})(foo, {f:42, e:23});
-
</del></span></pre></div>
<a id="trunkLayoutTestsjsregressscripttestsfoldmultiputbyoffsettoreplaceortransitionputbyoffsetjs"></a>
<div class="delfile"><h4>Deleted: trunk/LayoutTests/js/regress/script-tests/fold-multi-put-by-offset-to-replace-or-transition-put-by-offset.js (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/regress/script-tests/fold-multi-put-by-offset-to-replace-or-transition-put-by-offset.js        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/LayoutTests/js/regress/script-tests/fold-multi-put-by-offset-to-replace-or-transition-put-by-offset.js        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -1,50 +0,0 @@
</span><del>-function foo(o) {
-    o.f = 1;
-}
-
-function fu(o) {
-    o.e = 2;
-}
-
-function bar(f, o) {
-    f(o);
-}
-
-for (var i = 0; i &lt; 100; ++i) {
-    foo({f:1, e:2});
-    foo({e:1, f:2});
-    foo({d:1, e:2, f:3});
-    fu({f:1, e:2});
-    fu({e:1, f:2});
-    fu({d:1, e:2, f:3});
-}
-    
-for (var i = 0; i &lt; 100; ++i) {
-    bar(foo, {f:1});
-    bar(function() { }, null);
-    bar(function() { return 42 }, null);
-}
-    
-(function(f, o) {
-    var result = 0;
-    var n = 1000000;
-    var p;
-    for (var i = 0; i &lt; n; ++i) {
-        var q;
-        if (i &amp; 1)
-            q = o;
-        else
-            p = q = {e:61};
-        fu(q);
-        bar(f, q);
-    }
-    if (o.e != 2)
-        throw &quot;Error: bad value in o.e: &quot; + o.e;
-    if (o.f != 1)
-        throw &quot;Error: bad value in o.f: &quot; + o.f;
-    if (p.e != 2)
-        throw &quot;Error: bad value in p.e: &quot; + p.e;
-    if (p.f != 1)
-        throw &quot;Error: bad value in p.f: &quot; + p.f;
-})(foo, {e:23, f:42});
-
</del></span></pre></div>
<a id="trunkLayoutTestsjsregressscripttestsfoldputbyidtomultiputbyoffsetjs"></a>
<div class="delfile"><h4>Deleted: trunk/LayoutTests/js/regress/script-tests/fold-put-by-id-to-multi-put-by-offset.js (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/regress/script-tests/fold-put-by-id-to-multi-put-by-offset.js        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/LayoutTests/js/regress/script-tests/fold-put-by-id-to-multi-put-by-offset.js        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -1,46 +0,0 @@
</span><del>-function foo(o) {
-    o.f = 1;
-}
-
-function fu(o) {
-    o.e = 2;
-}
-
-function bar(f, o) {
-    f(o);
-}
-
-for (var i = 0; i &lt; 1000; ++i) {
-    var o = {};
-    o[&quot;i&quot; + i] = 42;
-    foo(o);
-    fu({f:1, e:2});
-    fu({e:1, f:2, g:3});
-}
-    
-for (var i = 0; i &lt; 100; ++i) {
-    bar(foo, {f:1});
-    bar(function() { }, null);
-    bar(function() { return 42 }, null);
-}
-    
-(function(f, o, p) {
-    var result = 0;
-    var n = 1000000;
-    for (var i = 0; i &lt; n; ++i) {
-        fu(o);
-        bar(f, o);
-        var tmp = o;
-        o = p;
-        p = tmp;
-    }
-    if (o.e != 2)
-        throw &quot;Error: bad value in o.e: &quot; + o.e;
-    if (o.f != 1)
-        throw &quot;Error: bad value in o.f: &quot; + o.f;
-    if (p.e != 2)
-        throw &quot;Error: bad value in p.e: &quot; + p.e;
-    if (p.f != 1)
-        throw &quot;Error: bad value in p.f: &quot; + p.f;
-})(foo, {f:42, e:23}, {e:23, f:42, g:100});
-
</del></span></pre></div>
<a id="trunkLayoutTestsjsregressscripttestsfoldputstructurejs"></a>
<div class="delfile"><h4>Deleted: trunk/LayoutTests/js/regress/script-tests/fold-put-structure.js (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/regress/script-tests/fold-put-structure.js        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/LayoutTests/js/regress/script-tests/fold-put-structure.js        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -1,39 +0,0 @@
</span><del>-function foo(o) {
-    o.f = 1;
-}
-
-function fu(o) {
-    o.e = 2;
-}
-
-function bar(f, o) {
-    f(o);
-}
-
-for (var i = 0; i &lt; 100; ++i) {
-    foo({e:2});
-    foo({e:1, f:2});
-    fu({f:1, e:2});
-    fu({e:1, f:2});
-    fu({d:1, e:2, f:3});
-}
-    
-for (var i = 0; i &lt; 100; ++i) {
-    bar(foo, {e:1});
-    bar(function() { }, null);
-    bar(function() { return 42 }, null);
-}
-    
-(function(f, o) {
-    var result = 0;
-    var n = 1000000;
-    for (var i = 0; i &lt; n; ++i) {
-        fu(o);
-        bar(f, o);
-    }
-    if (o.e != 2)
-        throw &quot;Error: bad value in o.e: &quot; + o.e;
-    if (o.f != 1)
-        throw &quot;Error: bad value in o.f: &quot; + o.f;
-})(foo, {e:42, f:23});
-
</del></span></pre></div>
<a id="trunkLayoutTestsjsregressscripttestshoistpolycheckstructureeffectfulloopjs"></a>
<div class="delfile"><h4>Deleted: trunk/LayoutTests/js/regress/script-tests/hoist-poly-check-structure-effectful-loop.js (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/regress/script-tests/hoist-poly-check-structure-effectful-loop.js        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/LayoutTests/js/regress/script-tests/hoist-poly-check-structure-effectful-loop.js        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -1,27 +0,0 @@
</span><del>-function foo(o, p) {
-    var result = 0;
-    for (var i = 0; i &lt; 100; ++i) {
-        result += o.f;
-        p.g = 42;
-    }
-    return result;
-}
-
-noInline(foo);
-
-function test(o) {
-    if (foo(o, {}) != 100)
-        throw new Error(&quot;Error: bad result: &quot; + result);
-}
-
-for (var i = 0; i &lt; 100; ++i) {
-    test({f:1, g:2});
-    test({f:1, h:2});
-    test({f:1, i:2});
-    test({f:1, j:2});
-    test({f:1, k:2});
-    test({f:1, l:2});
-}
-
-for (var i = 0; i &lt; 10000; ++i)
-    test({f:1, g:2});
</del></span></pre></div>
<a id="trunkLayoutTestsjsregressscripttestshoistpolycheckstructurejs"></a>
<div class="delfile"><h4>Deleted: trunk/LayoutTests/js/regress/script-tests/hoist-poly-check-structure.js (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/regress/script-tests/hoist-poly-check-structure.js        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/LayoutTests/js/regress/script-tests/hoist-poly-check-structure.js        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -1,25 +0,0 @@
</span><del>-function foo(o) {
-    var result = 0;
-    for (var i = 0; i &lt; 100; ++i)
-        result += o.f;
-    return result;
-}
-
-noInline(foo);
-
-function test(o) {
-    if (foo(o) != 100)
-        throw new Error(&quot;Error: bad result: &quot; + result);
-}
-
-for (var i = 0; i &lt; 100; ++i) {
-    test({f:1});
-    test({f:1, g:2});
-    test({f:1, g:2, h:3});
-    test({f:1, g:2, h:3, i:4});
-    test({f:1, g:2, h:3, i:4, j:5});
-    test({f:1, g:2, h:3, i:4, j:5, k:6});
-}
-
-for (var i = 0; i &lt; 10000; ++i)
-    test({f:1});
</del></span></pre></div>
<a id="trunkLayoutTestsjsregressscripttestsputbyidreplaceandtransitionjs"></a>
<div class="delfile"><h4>Deleted: trunk/LayoutTests/js/regress/script-tests/put-by-id-replace-and-transition.js (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/regress/script-tests/put-by-id-replace-and-transition.js        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/LayoutTests/js/regress/script-tests/put-by-id-replace-and-transition.js        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -1,13 +0,0 @@
</span><del>-(function() {
-    var o;
-    var n = 1000000;
-    for (var i = 0; i &lt; n; ++i) {
-        if (i &amp; 1)
-            o = {f: 1};
-        else
-            o = {f: 1, g: 2};
-        o.g = i;
-    }
-    if (o.g != n - 1)
-        throw &quot;Error: bad value of o.g: &quot; + o.g;
-})();
</del></span></pre></div>
<a id="trunkLayoutTestsjsregressscripttestsputbyidslightlypolymorphicjs"></a>
<div class="delfile"><h4>Deleted: trunk/LayoutTests/js/regress/script-tests/put-by-id-slightly-polymorphic.js (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/regress/script-tests/put-by-id-slightly-polymorphic.js        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/LayoutTests/js/regress/script-tests/put-by-id-slightly-polymorphic.js        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -1,15 +0,0 @@
</span><del>-(function() {
-    var o = {f: 1, g: 2};
-    var p = {f: 1};
-    var n = 1000000;
-    for (var i = 0; i &lt; n; ++i) {
-        o.f = i;
-        var tmp = o;
-        o = p;
-        p = tmp;
-    }
-    if (o.f != n - 2)
-        throw &quot;Error: bad value of o.f: &quot; + o.f;
-    if (p.f != n - 1)
-        throw &quot;Error: vad value of p.f: &quot; + p.f;
-})();
</del></span></pre></div>
<a id="trunkSourceJavaScriptCoreCMakeListstxt"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/CMakeLists.txt (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/CMakeLists.txt        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/Source/JavaScriptCore/CMakeLists.txt        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -94,7 +94,6 @@
</span><span class="cx">     bytecode/StructureSet.cpp
</span><span class="cx">     bytecode/StructureStubClearingWatchpoint.cpp
</span><span class="cx">     bytecode/StructureStubInfo.cpp
</span><del>-    bytecode/ToThisStatus.cpp
</del><span class="cx">     bytecode/UnlinkedCodeBlock.cpp
</span><span class="cx">     bytecode/UnlinkedInstructionStream.cpp
</span><span class="cx">     bytecode/ValueRecovery.cpp
</span><span class="lines">@@ -104,8 +103,8 @@
</span><span class="cx">     bytecompiler/NodesCodegen.cpp
</span><span class="cx"> 
</span><span class="cx">     debugger/Debugger.cpp
</span><ins>+    debugger/DebuggerActivation.cpp
</ins><span class="cx">     debugger/DebuggerCallFrame.cpp
</span><del>-    debugger/DebuggerScope.cpp
</del><span class="cx"> 
</span><span class="cx">     dfg/DFGAbstractHeap.cpp
</span><span class="cx">     dfg/DFGAbstractValue.cpp
</span><span class="lines">@@ -396,8 +395,6 @@
</span><span class="cx">     runtime/FunctionExecutableDump.cpp
</span><span class="cx">     runtime/FunctionPrototype.cpp
</span><span class="cx">     runtime/GetterSetter.cpp
</span><del>-    runtime/HighFidelityLog.cpp
-    runtime/HighFidelityTypeProfiler.cpp
</del><span class="cx">     runtime/Identifier.cpp
</span><span class="cx">     runtime/IndexingType.cpp
</span><span class="cx">     runtime/InitializeThreading.cpp
</span><span class="lines">@@ -503,7 +500,6 @@
</span><span class="cx">     runtime/StructureRareData.cpp
</span><span class="cx">     runtime/SymbolTable.cpp
</span><span class="cx">     runtime/TestRunnerUtils.cpp
</span><del>-    runtime/TypeSet.cpp
</del><span class="cx">     runtime/TypedArrayController.cpp
</span><span class="cx">     runtime/TypedArrayType.cpp
</span><span class="cx">     runtime/VM.cpp
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreChangeLog"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/ChangeLog (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/ChangeLog        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/Source/JavaScriptCore/ChangeLog        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -1,3 +1,311 @@
</span><ins>+2014-07-26  Filip Pizlo  &lt;fpizlo@apple.com&gt;
+
+        Unreviewed, roll out r171641-r171644. It broke some tests; will investigate and
+        reland later.
+
+        * CMakeLists.txt:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * bytecode/BytecodeList.json:
+        * bytecode/BytecodeUseDef.h:
+        (JSC::computeUsesForBytecodeOffset):
+        (JSC::computeDefsForBytecodeOffset):
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dumpBytecode):
+        (JSC::CodeBlock::CodeBlock):
+        (JSC::CodeBlock::finalizeUnconditionally):
+        (JSC::CodeBlock::printPutByIdCacheStatus): Deleted.
+        * bytecode/CodeBlock.h:
+        * bytecode/GetByIdStatus.cpp:
+        (JSC::GetByIdStatus::computeForStubInfo):
+        (JSC::GetByIdStatus::computeFor):
+        * bytecode/GetByIdStatus.h:
+        * bytecode/GetByIdVariant.cpp:
+        (JSC::GetByIdVariant::dumpInContext):
+        * bytecode/GetByIdVariant.h:
+        (JSC::GetByIdVariant::structureSet):
+        * bytecode/Instruction.h:
+        * bytecode/PutByIdStatus.cpp:
+        (JSC::PutByIdStatus::appendVariant):
+        (JSC::PutByIdStatus::computeForStubInfo):
+        (JSC::PutByIdStatus::computeFor):
+        * bytecode/PutByIdStatus.h:
+        * bytecode/PutByIdVariant.cpp:
+        (JSC::PutByIdVariant::dumpInContext):
+        (JSC::PutByIdVariant::oldStructureForTransition): Deleted.
+        (JSC::PutByIdVariant::writesStructures): Deleted.
+        (JSC::PutByIdVariant::reallocatesStorage): Deleted.
+        (JSC::PutByIdVariant::attemptToMerge): Deleted.
+        (JSC::PutByIdVariant::attemptToMergeTransitionWithReplace): Deleted.
+        * bytecode/PutByIdVariant.h:
+        (JSC::PutByIdVariant::PutByIdVariant):
+        (JSC::PutByIdVariant::replace):
+        (JSC::PutByIdVariant::transition):
+        (JSC::PutByIdVariant::structure):
+        (JSC::PutByIdVariant::oldStructure):
+        (JSC::PutByIdVariant::newStructure):
+        (JSC::PutByIdVariant::constantChecks):
+        * bytecode/StructureSet.cpp:
+        (JSC::StructureSet::filter): Deleted.
+        (JSC::StructureSet::filterArrayModes): Deleted.
+        * bytecode/StructureSet.h:
+        (JSC::StructureSet::onlyStructure):
+        * bytecode/ToThisStatus.cpp: Removed.
+        * bytecode/ToThisStatus.h: Removed.
+        * bytecode/TypeLocation.h: Removed.
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::BytecodeGenerator):
+        (JSC::BytecodeGenerator::emitMove):
+        (JSC::BytecodeGenerator::emitPutToScope):
+        (JSC::BytecodeGenerator::emitPutById):
+        (JSC::BytecodeGenerator::emitPutByVal):
+        (JSC::BytecodeGenerator::emitProfileTypesWithHighFidelity): Deleted.
+        * bytecompiler/BytecodeGenerator.h:
+        (JSC::BytecodeGenerator::isProfilingTypesWithHighFidelity): Deleted.
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::PostfixNode::emitResolve):
+        (JSC::PrefixNode::emitResolve):
+        (JSC::ReadModifyResolveNode::emitBytecode):
+        (JSC::AssignResolveNode::emitBytecode):
+        (JSC::ConstDeclNode::emitCodeSingle):
+        (JSC::ForInNode::emitBytecode):
+        * debugger/DebuggerActivation.cpp: Added.
+        (JSC::DebuggerActivation::DebuggerActivation):
+        (JSC::DebuggerActivation::finishCreation):
+        (JSC::DebuggerActivation::visitChildren):
+        (JSC::DebuggerActivation::className):
+        (JSC::DebuggerActivation::getOwnPropertySlot):
+        (JSC::DebuggerActivation::put):
+        (JSC::DebuggerActivation::deleteProperty):
+        (JSC::DebuggerActivation::getOwnPropertyNames):
+        (JSC::DebuggerActivation::defineOwnProperty):
+        * debugger/DebuggerActivation.h: Added.
+        (JSC::DebuggerActivation::create):
+        (JSC::DebuggerActivation::createStructure):
+        * debugger/DebuggerScope.cpp: Removed.
+        * debugger/DebuggerScope.h: Removed.
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::AbstractInterpreter&lt;AbstractStateType&gt;::executeEffects):
+        (JSC::DFG::AbstractInterpreter&lt;AbstractStateType&gt;::observeTransition):
+        (JSC::DFG::AbstractInterpreter&lt;AbstractStateType&gt;::observeTransitions):
+        * dfg/DFGAbstractValue.cpp:
+        (JSC::DFG::AbstractValue::changeStructure): Deleted.
+        (JSC::DFG::AbstractValue::contains): Deleted.
+        * dfg/DFGAbstractValue.h:
+        (JSC::DFG::AbstractValue::couldBeType):
+        (JSC::DFG::AbstractValue::isType):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::handlePutById):
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * dfg/DFGClobberize.h:
+        (JSC::DFG::clobberize):
+        * dfg/DFGConstantFoldingPhase.cpp:
+        (JSC::DFG::ConstantFoldingPhase::foldConstants):
+        (JSC::DFG::ConstantFoldingPhase::emitGetByOffset):
+        (JSC::DFG::ConstantFoldingPhase::emitPutByOffset):
+        (JSC::DFG::ConstantFoldingPhase::addBaseCheck): Deleted.
+        (JSC::DFG::ConstantFoldingPhase::addChecks): Deleted.
+        * dfg/DFGDoesGC.cpp:
+        (JSC::DFG::doesGC):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        * dfg/DFGGraph.cpp:
+        (JSC::DFG::Graph::visitChildren):
+        (JSC::DFG::Graph::freezeStrong):
+        * dfg/DFGGraph.h:
+        * dfg/DFGNode.cpp:
+        (JSC::DFG::MultiPutByOffsetData::writesStructures):
+        (JSC::DFG::MultiPutByOffsetData::reallocatesStorage):
+        * dfg/DFGNode.h:
+        (JSC::DFG::Node::convertToPutByOffset):
+        (JSC::DFG::Node::hasTransition):
+        (JSC::DFG::Node::convertToMultiGetByOffset): Deleted.
+        (JSC::DFG::Node::convertToMultiPutByOffset): Deleted.
+        * dfg/DFGNodeType.h:
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        (JSC::DFG::PredictionPropagationPhase::propagate):
+        * dfg/DFGSafeToExecute.h:
+        (JSC::DFG::safeToExecute):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::silentSavePlanForGPR):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::fillSpeculateCell):
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::fillJSValue):
+        (JSC::DFG::SpeculativeJIT::nonSpeculativeCompareNull):
+        (JSC::DFG::SpeculativeJIT::emitCall):
+        (JSC::DFG::SpeculativeJIT::fillSpeculateInt32Internal):
+        (JSC::DFG::SpeculativeJIT::fillSpeculateInt32Strict):
+        (JSC::DFG::SpeculativeJIT::fillSpeculateInt52):
+        (JSC::DFG::SpeculativeJIT::fillSpeculateDouble):
+        (JSC::DFG::SpeculativeJIT::fillSpeculateCell):
+        (JSC::DFG::SpeculativeJIT::fillSpeculateBoolean):
+        (JSC::DFG::SpeculativeJIT::compileLogicalNot):
+        (JSC::DFG::SpeculativeJIT::emitBranch):
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGStructureAbstractValue.cpp:
+        (JSC::DFG::StructureAbstractValue::observeTransition):
+        (JSC::DFG::StructureAbstractValue::observeTransitions):
+        * dfg/DFGStructureAbstractValue.h:
+        (JSC::DFG::StructureAbstractValue::onlyStructure):
+        (JSC::DFG::StructureAbstractValue::operator=): Deleted.
+        (JSC::DFG::StructureAbstractValue::set): Deleted.
+        * dfg/DFGValidate.cpp:
+        (JSC::DFG::Validate::validate):
+        * dfg/DFGWatchableStructureWatchingPhase.cpp:
+        (JSC::DFG::WatchableStructureWatchingPhase::run):
+        * ftl/FTLAbbreviations.h:
+        (JSC::FTL::getLinkage): Deleted.
+        * ftl/FTLCapabilities.cpp:
+        (JSC::FTL::canCompile):
+        * ftl/FTLLowerDFGToLLVM.cpp:
+        (JSC::FTL::LowerDFGToLLVM::compileNode):
+        (JSC::FTL::LowerDFGToLLVM::compilePhantomPutStructure):
+        (JSC::FTL::LowerDFGToLLVM::compileMultiGetByOffset):
+        (JSC::FTL::LowerDFGToLLVM::compileMultiPutByOffset):
+        (JSC::FTL::LowerDFGToLLVM::getModuleByPathForSymbol):
+        * heap/Heap.cpp:
+        (JSC::Heap::collect):
+        * inspector/agents/InspectorRuntimeAgent.cpp:
+        (Inspector::InspectorRuntimeAgent::getRuntimeTypeForVariableInTextRange): Deleted.
+        * inspector/agents/InspectorRuntimeAgent.h:
+        * inspector/protocol/Runtime.json:
+        * jsc.cpp:
+        (GlobalObject::finishCreation):
+        (functionDumpTypesForAllVariables): Deleted.
+        * llint/LLIntData.cpp:
+        (JSC::LLInt::Data::performAssertions):
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
+        (JSC::LLInt::putToScopeCommon): Deleted.
+        * llint/LLIntSlowPaths.h:
+        * llint/LowLevelInterpreter.asm:
+        * llint/LowLevelInterpreter32_64.asm:
+        * llint/LowLevelInterpreter64.asm:
+        * runtime/ArrayBufferNeuteringWatchpoint.cpp:
+        (JSC::ArrayBufferNeuteringWatchpoint::createStructure):
+        * runtime/CommonSlowPaths.cpp:
+        (JSC::SLOW_PATH_DECL):
+        * runtime/Executable.h:
+        (JSC::ExecutableBase::createStructure):
+        (JSC::NativeExecutable::createStructure):
+        * runtime/HighFidelityLog.cpp: Removed.
+        * runtime/HighFidelityLog.h: Removed.
+        * runtime/HighFidelityTypeProfiler.cpp: Removed.
+        * runtime/HighFidelityTypeProfiler.h: Removed.
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::putDirectCustomAccessor):
+        (JSC::JSObject::putDirectNonIndexAccessor):
+        (JSC::JSObject::reifyStaticFunctionsForDelete):
+        * runtime/JSPromiseDeferred.h:
+        (JSC::JSPromiseDeferred::createStructure):
+        * runtime/JSPromiseReaction.h:
+        (JSC::JSPromiseReaction::createStructure):
+        * runtime/JSPropertyNameIterator.h:
+        (JSC::JSPropertyNameIterator::createStructure):
+        * runtime/JSType.h:
+        * runtime/JSTypeInfo.h:
+        (JSC::TypeInfo::TypeInfo):
+        * runtime/MapData.h:
+        (JSC::MapData::createStructure):
+        * runtime/Options.h:
+        * runtime/PropertyMapHashTable.h:
+        (JSC::PropertyTable::createStructure):
+        * runtime/RegExp.h:
+        (JSC::RegExp::createStructure):
+        * runtime/SparseArrayValueMap.cpp:
+        (JSC::SparseArrayValueMap::createStructure):
+        * runtime/Structure.cpp:
+        (JSC::StructureTransitionTable::contains):
+        (JSC::StructureTransitionTable::get):
+        (JSC::StructureTransitionTable::add):
+        (JSC::Structure::Structure):
+        (JSC::Structure::materializePropertyMap):
+        (JSC::Structure::addPropertyTransition):
+        (JSC::Structure::despecifyFunctionTransition):
+        (JSC::Structure::toDictionaryTransition):
+        (JSC::Structure::freezeTransition):
+        (JSC::Structure::preventExtensionsTransition):
+        (JSC::Structure::takePropertyTableOrCloneIfPinned):
+        (JSC::Structure::nonPropertyTransition):
+        (JSC::Structure::flattenDictionaryStructure):
+        (JSC::Structure::addPropertyWithoutTransition):
+        (JSC::Structure::pin):
+        (JSC::Structure::allocateRareData):
+        (JSC::Structure::cloneRareDataFrom):
+        (JSC::Structure::getConcurrently):
+        (JSC::Structure::putSpecificValue):
+        (JSC::Structure::getPropertyNamesFromStructure):
+        (JSC::Structure::visitChildren):
+        (JSC::Structure::checkConsistency):
+        (JSC::Structure::toStructureShape): Deleted.
+        * runtime/Structure.h:
+        (JSC::Structure::isExtensible):
+        (JSC::Structure::didTransition):
+        (JSC::Structure::isDictionary):
+        (JSC::Structure::isUncacheableDictionary):
+        (JSC::Structure::hasBeenFlattenedBefore):
+        (JSC::Structure::propertyAccessesAreCacheable):
+        (JSC::Structure::previousID):
+        (JSC::Structure::hasGetterSetterProperties):
+        (JSC::Structure::hasReadOnlyOrGetterSetterPropertiesExcludingProto):
+        (JSC::Structure::setHasGetterSetterProperties):
+        (JSC::Structure::hasCustomGetterSetterProperties):
+        (JSC::Structure::setHasCustomGetterSetterProperties):
+        (JSC::Structure::setContainsReadOnlyProperties):
+        (JSC::Structure::hasNonEnumerableProperties):
+        (JSC::Structure::disableSpecificFunctionTracking):
+        (JSC::Structure::objectToStringValue):
+        (JSC::Structure::setObjectToStringValue):
+        (JSC::Structure::staticFunctionsReified):
+        (JSC::Structure::setStaticFunctionsReified):
+        (JSC::Structure::transitionWatchpointSet):
+        (JSC::Structure::setPreviousID):
+        (JSC::Structure::clearPreviousID):
+        (JSC::Structure::previous):
+        (JSC::Structure::rareData):
+        (JSC::Structure::setHasGetterSetterPropertiesWithProtoCheck): Deleted.
+        (JSC::Structure::setHasCustomGetterSetterPropertiesWithProtoCheck): Deleted.
+        * runtime/StructureChain.h:
+        (JSC::StructureChain::createStructure):
+        * runtime/StructureInlines.h:
+        (JSC::Structure::setEnumerationCache):
+        (JSC::Structure::enumerationCache):
+        (JSC::Structure::checkOffsetConsistency):
+        * runtime/StructureRareData.cpp:
+        (JSC::StructureRareData::createStructure):
+        * runtime/SymbolTable.cpp:
+        (JSC::SymbolTable::SymbolTable):
+        (JSC::SymbolTable::cloneCapturedNames):
+        (JSC::SymbolTable::uniqueIDForVariable): Deleted.
+        (JSC::SymbolTable::uniqueIDForRegister): Deleted.
+        (JSC::SymbolTable::globalTypeSetForRegister): Deleted.
+        (JSC::SymbolTable::globalTypeSetForVariable): Deleted.
+        * runtime/SymbolTable.h:
+        (JSC::SymbolTable::createStructure):
+        (JSC::SymbolTable::add):
+        (JSC::SymbolTable::set):
+        * runtime/TypeSet.cpp: Removed.
+        * runtime/TypeSet.h: Removed.
+        * runtime/VM.cpp:
+        (JSC::VM::VM):
+        (JSC::VM::getTypesForVariableInRange): Deleted.
+        (JSC::VM::updateHighFidelityTypeProfileState): Deleted.
+        (JSC::VM::dumpHighFidelityProfilingTypes): Deleted.
+        * runtime/VM.h:
+        (JSC::VM::isProfilingTypesWithHighFidelity): Deleted.
+        (JSC::VM::highFidelityLog): Deleted.
+        (JSC::VM::highFidelityTypeProfiler): Deleted.
+        (JSC::VM::nextLocation): Deleted.
+        (JSC::VM::getNextUniqueVariableID): Deleted.
+        * runtime/WeakMapData.h:
+        (JSC::WeakMapData::createStructure):
+        * tests/stress/fold-multi-get-by-offset-to-get-by-offset-without-folding-the-structure-check.js: Removed.
+        * tests/stress/fold-multi-put-by-offset-to-put-by-offset-without-folding-the-structure-check.js: Removed.
+        * tests/stress/prune-multi-put-by-offset-replace-or-transition-variant.js: Removed.
+
</ins><span class="cx"> 2014-07-25  Filip Pizlo  &lt;fpizlo@apple.com&gt;
</span><span class="cx"> 
</span><span class="cx">         Attempt to fix non-Xcode platforms.
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreJavaScriptCorevcxprojJavaScriptCorevcxproj"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/JavaScriptCore.vcxproj/JavaScriptCore.vcxproj (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/JavaScriptCore.vcxproj/JavaScriptCore.vcxproj        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/Source/JavaScriptCore/JavaScriptCore.vcxproj/JavaScriptCore.vcxproj        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -347,7 +347,6 @@
</span><span class="cx">     &lt;ClCompile Include=&quot;..\bytecode\StructureSet.cpp&quot; /&gt;
</span><span class="cx">     &lt;ClCompile Include=&quot;..\bytecode\StructureStubClearingWatchpoint.cpp&quot; /&gt;
</span><span class="cx">     &lt;ClCompile Include=&quot;..\bytecode\StructureStubInfo.cpp&quot; /&gt;
</span><del>-    &lt;ClCompile Include=&quot;..\bytecode\ToThisStatus.cpp&quot; /&gt;
</del><span class="cx">     &lt;ClCompile Include=&quot;..\bytecode\UnlinkedCodeBlock.cpp&quot; /&gt;
</span><span class="cx">     &lt;ClCompile Include=&quot;..\bytecode\UnlinkedInstructionStream.cpp&quot; /&gt;
</span><span class="cx">     &lt;ClCompile Include=&quot;..\bytecode\ValueRecovery.cpp&quot; /&gt;
</span><span class="lines">@@ -355,8 +354,8 @@
</span><span class="cx">     &lt;ClCompile Include=&quot;..\bytecompiler\BytecodeGenerator.cpp&quot; /&gt;
</span><span class="cx">     &lt;ClCompile Include=&quot;..\bytecompiler\NodesCodegen.cpp&quot; /&gt;
</span><span class="cx">     &lt;ClCompile Include=&quot;..\debugger\Debugger.cpp&quot; /&gt;
</span><ins>+    &lt;ClCompile Include=&quot;..\debugger\DebuggerActivation.cpp&quot; /&gt;
</ins><span class="cx">     &lt;ClCompile Include=&quot;..\debugger\DebuggerCallFrame.cpp&quot; /&gt;
</span><del>-    &lt;ClCompile Include=&quot;..\debugger\DebuggerScope.cpp&quot; /&gt;
</del><span class="cx">     &lt;ClCompile Include=&quot;..\dfg\DFGAbstractHeap.cpp&quot; /&gt;
</span><span class="cx">     &lt;ClCompile Include=&quot;..\dfg\DFGAbstractValue.cpp&quot; /&gt;
</span><span class="cx">     &lt;ClCompile Include=&quot;..\dfg\DFGArgumentsSimplificationPhase.cpp&quot; /&gt;
</span><span class="lines">@@ -683,8 +682,6 @@
</span><span class="cx">     &lt;ClCompile Include=&quot;..\runtime\FunctionExecutableDump.cpp&quot; /&gt;
</span><span class="cx">     &lt;ClCompile Include=&quot;..\runtime\FunctionPrototype.cpp&quot; /&gt;
</span><span class="cx">     &lt;ClCompile Include=&quot;..\runtime\GetterSetter.cpp&quot; /&gt;
</span><del>-    &lt;ClCompile Include=&quot;..\runtime\HighFidelityLog.cpp&quot; /&gt;
-    &lt;ClCompile Include=&quot;..\runtime\HighFidelityTypeProfiler.cpp&quot; /&gt;
</del><span class="cx">     &lt;ClCompile Include=&quot;..\runtime\Identifier.cpp&quot; /&gt;
</span><span class="cx">     &lt;ClCompile Include=&quot;..\runtime\IndexingType.cpp&quot; /&gt;
</span><span class="cx">     &lt;ClCompile Include=&quot;..\runtime\InitializeThreading.cpp&quot; /&gt;
</span><span class="lines">@@ -792,7 +789,6 @@
</span><span class="cx">     &lt;ClCompile Include=&quot;..\runtime\TestRunnerUtils.cpp&quot; /&gt;
</span><span class="cx">     &lt;ClCompile Include=&quot;..\runtime\TypedArrayController.cpp&quot; /&gt;
</span><span class="cx">     &lt;ClCompile Include=&quot;..\runtime\TypedArrayType.cpp&quot; /&gt;
</span><del>-    &lt;ClCompile Include=&quot;..\runtime\TypeSet.cpp&quot; /&gt;
</del><span class="cx">     &lt;ClCompile Include=&quot;..\runtime\VM.cpp&quot; /&gt;
</span><span class="cx">     &lt;ClCompile Include=&quot;..\runtime\VMEntryScope.cpp&quot; /&gt;
</span><span class="cx">     &lt;ClCompile Include=&quot;..\runtime\Watchdog.cpp&quot; /&gt;
</span><span class="lines">@@ -941,8 +937,6 @@
</span><span class="cx">     &lt;ClInclude Include=&quot;..\bytecode\StructureSet.h&quot; /&gt;
</span><span class="cx">     &lt;ClInclude Include=&quot;..\bytecode\StructureStubClearingWatchpoint.h&quot; /&gt;
</span><span class="cx">     &lt;ClInclude Include=&quot;..\bytecode\StructureStubInfo.h&quot; /&gt;
</span><del>-    &lt;ClInclude Include=&quot;..\bytecode\ToThisStatus.h&quot; /&gt;
-    &lt;ClInclude Include=&quot;..\bytecode\TypeLocation.h&quot; /&gt;
</del><span class="cx">     &lt;ClInclude Include=&quot;..\bytecode\UnlinkedCodeBlock.h&quot; /&gt;
</span><span class="cx">     &lt;ClInclude Include=&quot;..\bytecode\UnlinkedInstructionStream.h&quot; /&gt;
</span><span class="cx">     &lt;ClInclude Include=&quot;..\bytecode\ValueProfile.h&quot; /&gt;
</span><span class="lines">@@ -957,9 +951,9 @@
</span><span class="cx">     &lt;ClInclude Include=&quot;..\config.h&quot; /&gt;
</span><span class="cx">     &lt;ClInclude Include=&quot;..\debugger\Breakpoint.h&quot; /&gt;
</span><span class="cx">     &lt;ClInclude Include=&quot;..\debugger\Debugger.h&quot; /&gt;
</span><ins>+    &lt;ClInclude Include=&quot;..\debugger\DebuggerActivation.h&quot; /&gt;
</ins><span class="cx">     &lt;ClInclude Include=&quot;..\debugger\DebuggerCallFrame.h&quot; /&gt;
</span><span class="cx">     &lt;ClInclude Include=&quot;..\debugger\DebuggerPrimitives.h&quot; /&gt;
</span><del>-    &lt;ClInclude Include=&quot;..\debugger\DebuggerScope.h&quot; /&gt;
</del><span class="cx">     &lt;ClInclude Include=&quot;..\dfg\DFGAbstractHeap.h&quot; /&gt;
</span><span class="cx">     &lt;ClInclude Include=&quot;..\dfg\DFGAbstractInterpreter.h&quot; /&gt;
</span><span class="cx">     &lt;ClInclude Include=&quot;..\dfg\DFGAbstractInterpreterInlines.h&quot; /&gt;
</span><span class="lines">@@ -1411,8 +1405,6 @@
</span><span class="cx">     &lt;ClInclude Include=&quot;..\runtime\GenericTypedArrayView.h&quot; /&gt;
</span><span class="cx">     &lt;ClInclude Include=&quot;..\runtime\GenericTypedArrayViewInlines.h&quot; /&gt;
</span><span class="cx">     &lt;ClInclude Include=&quot;..\runtime\GetterSetter.h&quot; /&gt;
</span><del>-    &lt;ClInclude Include=&quot;..\runtime\HighFidelityLog.h&quot; /&gt;
-    &lt;ClInclude Include=&quot;..\runtime\HighFidelityTypeProfiler.h&quot; /&gt;
</del><span class="cx">     &lt;ClInclude Include=&quot;..\runtime\Identifier.h&quot; /&gt;
</span><span class="cx">     &lt;ClInclude Include=&quot;..\runtime\IndexingHeader.h&quot; /&gt;
</span><span class="cx">     &lt;ClInclude Include=&quot;..\runtime\IndexingHeaderInlines.h&quot; /&gt;
</span><span class="lines">@@ -1569,7 +1561,6 @@
</span><span class="cx">     &lt;ClInclude Include=&quot;..\runtime\TypedArrayController.h&quot; /&gt;
</span><span class="cx">     &lt;ClInclude Include=&quot;..\runtime\TypedArrayInlines.h&quot; /&gt;
</span><span class="cx">     &lt;ClInclude Include=&quot;..\runtime\TypedArrayType.h&quot; /&gt;
</span><del>-    &lt;ClInclude Include=&quot;..\runtime\TypeSet.h&quot; /&gt;
</del><span class="cx">     &lt;ClInclude Include=&quot;..\runtime\TypedArrays.h&quot; /&gt;
</span><span class="cx">     &lt;ClInclude Include=&quot;..\runtime\Uint16Array.h&quot; /&gt;
</span><span class="cx">     &lt;ClInclude Include=&quot;..\runtime\Uint16WithFraction.h&quot; /&gt;
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreJavaScriptCorevcxprojJavaScriptCorevcxprojfilters"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/Source/JavaScriptCore/JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -213,10 +213,10 @@
</span><span class="cx">     &lt;ClCompile Include=&quot;..\debugger\Debugger.cpp&quot;&gt;
</span><span class="cx">       &lt;Filter&gt;debugger&lt;/Filter&gt;
</span><span class="cx">     &lt;/ClCompile&gt;
</span><del>-    &lt;ClCompile Include=&quot;..\debugger\DebuggerCallFrame.cpp&quot;&gt;
</del><ins>+    &lt;ClCompile Include=&quot;..\debugger\DebuggerActivation.cpp&quot;&gt;
</ins><span class="cx">       &lt;Filter&gt;debugger&lt;/Filter&gt;
</span><span class="cx">     &lt;/ClCompile&gt;
</span><del>-    &lt;ClCompile Include=&quot;..\debugger\DebuggerScope.cpp&quot;&gt;
</del><ins>+    &lt;ClCompile Include=&quot;..\debugger\DebuggerCallFrame.cpp&quot;&gt;
</ins><span class="cx">       &lt;Filter&gt;debugger&lt;/Filter&gt;
</span><span class="cx">     &lt;/ClCompile&gt;
</span><span class="cx">     &lt;ClCompile Include=&quot;..\disassembler\Disassembler.cpp&quot;&gt;
</span><span class="lines">@@ -1883,15 +1883,15 @@
</span><span class="cx">     &lt;ClInclude Include=&quot;..\debugger\Debugger.h&quot;&gt;
</span><span class="cx">       &lt;Filter&gt;debugger&lt;/Filter&gt;
</span><span class="cx">     &lt;/ClInclude&gt;
</span><ins>+    &lt;ClInclude Include=&quot;..\debugger\DebuggerActivation.h&quot;&gt;
+      &lt;Filter&gt;debugger&lt;/Filter&gt;
+    &lt;/ClInclude&gt;
</ins><span class="cx">     &lt;ClInclude Include=&quot;..\debugger\DebuggerCallFrame.h&quot;&gt;
</span><span class="cx">       &lt;Filter&gt;debugger&lt;/Filter&gt;
</span><span class="cx">     &lt;/ClInclude&gt;
</span><span class="cx">     &lt;ClInclude Include=&quot;..\debugger\DebuggerPrimitives.h&quot;&gt;
</span><span class="cx">       &lt;Filter&gt;debugger&lt;/Filter&gt;
</span><span class="cx">     &lt;/ClInclude&gt;
</span><del>-    &lt;ClInclude Include=&quot;..\debugger\DebuggerScope.h&quot;&gt;
-      &lt;Filter&gt;debugger&lt;/Filter&gt;
-    &lt;/ClInclude&gt;
</del><span class="cx">     &lt;ClInclude Include=&quot;..\dfg\DFGDriver.h&quot;&gt;
</span><span class="cx">       &lt;Filter&gt;dfg&lt;/Filter&gt;
</span><span class="cx">     &lt;/ClInclude&gt;
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreJavaScriptCorexcodeprojprojectpbxproj"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -223,17 +223,6 @@
</span><span class="cx">                 0F2BDC4D1522818600CD8910 /* DFGMinifiedNode.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F2BDC4C1522818300CD8910 /* DFGMinifiedNode.cpp */; };
</span><span class="cx">                 0F2BDC4F15228BF300CD8910 /* DFGValueSource.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F2BDC4E15228BE700CD8910 /* DFGValueSource.cpp */; };
</span><span class="cx">                 0F2BDC5115228FFD00CD8910 /* DFGVariableEvent.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F2BDC5015228FFA00CD8910 /* DFGVariableEvent.cpp */; };
</span><del>-                0F2D4DDD19832D34007D4B19 /* DebuggerScope.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F2D4DDB19832D34007D4B19 /* DebuggerScope.cpp */; };
-                0F2D4DDE19832D34007D4B19 /* DebuggerScope.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F2D4DDC19832D34007D4B19 /* DebuggerScope.h */; settings = {ATTRIBUTES = (Private, ); }; };
-                0F2D4DE819832DAC007D4B19 /* ToThisStatus.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F2D4DE519832DAC007D4B19 /* ToThisStatus.cpp */; };
-                0F2D4DE919832DAC007D4B19 /* ToThisStatus.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F2D4DE619832DAC007D4B19 /* ToThisStatus.h */; settings = {ATTRIBUTES = (Private, ); }; };
-                0F2D4DEA19832DAC007D4B19 /* TypeLocation.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F2D4DE719832DAC007D4B19 /* TypeLocation.h */; settings = {ATTRIBUTES = (Private, ); }; };
-                0F2D4DEB19832DC4007D4B19 /* HighFidelityLog.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F2D4DDF19832D91007D4B19 /* HighFidelityLog.cpp */; };
-                0F2D4DEC19832DC4007D4B19 /* HighFidelityLog.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F2D4DE019832D91007D4B19 /* HighFidelityLog.h */; settings = {ATTRIBUTES = (Private, ); }; };
-                0F2D4DED19832DC4007D4B19 /* HighFidelityTypeProfiler.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F2D4DE119832D91007D4B19 /* HighFidelityTypeProfiler.cpp */; };
-                0F2D4DEE19832DC4007D4B19 /* HighFidelityTypeProfiler.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F2D4DE219832D91007D4B19 /* HighFidelityTypeProfiler.h */; settings = {ATTRIBUTES = (Private, ); }; };
-                0F2D4DEF19832DD3007D4B19 /* TypeSet.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F2D4DE319832D91007D4B19 /* TypeSet.cpp */; };
-                0F2D4DF019832DD6007D4B19 /* TypeSet.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F2D4DE419832D91007D4B19 /* TypeSet.h */; settings = {ATTRIBUTES = (Private, ); }; };
</del><span class="cx">                 0F2E892C16D028AD009E4FD2 /* UnusedPointer.h in Headers */ = {isa = PBXBuildFile; fileRef = 65987F2F16828A7E003C2F8D /* UnusedPointer.h */; settings = {ATTRIBUTES = (Private, ); }; };
</span><span class="cx">                 0F2E892D16D02BAF009E4FD2 /* DFGMinifiedID.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FB4B51016B3A964003F696B /* DFGMinifiedID.h */; settings = {ATTRIBUTES = (Private, ); }; };
</span><span class="cx">                 0F2FC77216E12F710038D976 /* DFGDCEPhase.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F2FC77016E12F6F0038D976 /* DFGDCEPhase.cpp */; };
</span><span class="lines">@@ -1972,6 +1961,8 @@
</span><span class="cx">                 BC18C52E0E16FCE100B34460 /* Lexer.lut.h in Headers */ = {isa = PBXBuildFile; fileRef = BC18C52D0E16FCE100B34460 /* Lexer.lut.h */; };
</span><span class="cx">                 BC257DE80E1F51C50016B6C9 /* Arguments.h in Headers */ = {isa = PBXBuildFile; fileRef = BC257DE60E1F51C50016B6C9 /* Arguments.h */; };
</span><span class="cx">                 BC3046070E1F497F003232CF /* Error.h in Headers */ = {isa = PBXBuildFile; fileRef = BC3046060E1F497F003232CF /* Error.h */; settings = {ATTRIBUTES = (Private, ); }; };
</span><ins>+                BC3135640F302FA3003DFD3A /* DebuggerActivation.h in Headers */ = {isa = PBXBuildFile; fileRef = BC3135620F302FA3003DFD3A /* DebuggerActivation.h */; settings = {ATTRIBUTES = (Private, ); }; };
+                BC3135650F302FA3003DFD3A /* DebuggerActivation.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BC3135630F302FA3003DFD3A /* DebuggerActivation.cpp */; };
</ins><span class="cx">                 BC6AAAE50E1F426500AD87D8 /* ClassInfo.h in Headers */ = {isa = PBXBuildFile; fileRef = BC6AAAE40E1F426500AD87D8 /* ClassInfo.h */; settings = {ATTRIBUTES = (Private, ); }; };
</span><span class="cx">                 BC756FC90E2031B200DE7D12 /* JSGlobalObjectFunctions.h in Headers */ = {isa = PBXBuildFile; fileRef = BC756FC70E2031B200DE7D12 /* JSGlobalObjectFunctions.h */; };
</span><span class="cx">                 BC87CDB910712AD4000614CF /* JSONObject.lut.h in Headers */ = {isa = PBXBuildFile; fileRef = BC87CDB810712ACA000614CF /* JSONObject.lut.h */; };
</span><span class="lines">@@ -2407,17 +2398,6 @@
</span><span class="cx">                 0F2BDC4C1522818300CD8910 /* DFGMinifiedNode.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGMinifiedNode.cpp; path = dfg/DFGMinifiedNode.cpp; sourceTree = &quot;&lt;group&gt;&quot;; };
</span><span class="cx">                 0F2BDC4E15228BE700CD8910 /* DFGValueSource.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGValueSource.cpp; path = dfg/DFGValueSource.cpp; sourceTree = &quot;&lt;group&gt;&quot;; };
</span><span class="cx">                 0F2BDC5015228FFA00CD8910 /* DFGVariableEvent.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGVariableEvent.cpp; path = dfg/DFGVariableEvent.cpp; sourceTree = &quot;&lt;group&gt;&quot;; };
</span><del>-                0F2D4DDB19832D34007D4B19 /* DebuggerScope.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = DebuggerScope.cpp; sourceTree = &quot;&lt;group&gt;&quot;; };
-                0F2D4DDC19832D34007D4B19 /* DebuggerScope.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DebuggerScope.h; sourceTree = &quot;&lt;group&gt;&quot;; };
-                0F2D4DDF19832D91007D4B19 /* HighFidelityLog.cpp */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.cpp.cpp; path = HighFidelityLog.cpp; sourceTree = &quot;&lt;group&gt;&quot;; };
-                0F2D4DE019832D91007D4B19 /* HighFidelityLog.h */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.c.h; path = HighFidelityLog.h; sourceTree = &quot;&lt;group&gt;&quot;; };
-                0F2D4DE119832D91007D4B19 /* HighFidelityTypeProfiler.cpp */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.cpp.cpp; path = HighFidelityTypeProfiler.cpp; sourceTree = &quot;&lt;group&gt;&quot;; };
-                0F2D4DE219832D91007D4B19 /* HighFidelityTypeProfiler.h */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.c.h; path = HighFidelityTypeProfiler.h; sourceTree = &quot;&lt;group&gt;&quot;; };
-                0F2D4DE319832D91007D4B19 /* TypeSet.cpp */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.cpp.cpp; path = TypeSet.cpp; sourceTree = &quot;&lt;group&gt;&quot;; };
-                0F2D4DE419832D91007D4B19 /* TypeSet.h */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.c.h; path = TypeSet.h; sourceTree = &quot;&lt;group&gt;&quot;; };
-                0F2D4DE519832DAC007D4B19 /* ToThisStatus.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ToThisStatus.cpp; sourceTree = &quot;&lt;group&gt;&quot;; };
-                0F2D4DE619832DAC007D4B19 /* ToThisStatus.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ToThisStatus.h; sourceTree = &quot;&lt;group&gt;&quot;; };
-                0F2D4DE719832DAC007D4B19 /* TypeLocation.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = TypeLocation.h; sourceTree = &quot;&lt;group&gt;&quot;; };
</del><span class="cx">                 0F2FC77016E12F6F0038D976 /* DFGDCEPhase.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGDCEPhase.cpp; path = dfg/DFGDCEPhase.cpp; sourceTree = &quot;&lt;group&gt;&quot;; };
</span><span class="cx">                 0F2FC77116E12F6F0038D976 /* DFGDCEPhase.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGDCEPhase.h; path = dfg/DFGDCEPhase.h; sourceTree = &quot;&lt;group&gt;&quot;; };
</span><span class="cx">                 0F2FCCF218A60070001A27F8 /* DFGGraphSafepoint.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGGraphSafepoint.cpp; path = dfg/DFGGraphSafepoint.cpp; sourceTree = &quot;&lt;group&gt;&quot;; };
</span><span class="lines">@@ -3603,6 +3583,8 @@
</span><span class="cx">                 BC2680C90E16D4E900A06E92 /* ObjectPrototype.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ObjectPrototype.h; sourceTree = &quot;&lt;group&gt;&quot;; };
</span><span class="cx">                 BC2680E60E16D52300A06E92 /* NumberConstructor.lut.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = NumberConstructor.lut.h; sourceTree = &quot;&lt;group&gt;&quot;; };
</span><span class="cx">                 BC3046060E1F497F003232CF /* Error.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = Error.h; sourceTree = &quot;&lt;group&gt;&quot;; };
</span><ins>+                BC3135620F302FA3003DFD3A /* DebuggerActivation.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DebuggerActivation.h; sourceTree = &quot;&lt;group&gt;&quot;; };
+                BC3135630F302FA3003DFD3A /* DebuggerActivation.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = DebuggerActivation.cpp; sourceTree = &quot;&lt;group&gt;&quot;; };
</ins><span class="cx">                 BC337BDE0E1AF0B80076918A /* GetterSetter.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = GetterSetter.h; sourceTree = &quot;&lt;group&gt;&quot;; };
</span><span class="cx">                 BC337BEA0E1B00CB0076918A /* Error.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = Error.cpp; sourceTree = &quot;&lt;group&gt;&quot;; };
</span><span class="cx">                 BC6AAAE40E1F426500AD87D8 /* ClassInfo.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ClassInfo.h; sourceTree = &quot;&lt;group&gt;&quot;; };
</span><span class="lines">@@ -4444,11 +4426,11 @@
</span><span class="cx">                                 FEA0861E182B7A0400F6D851 /* Breakpoint.h */,
</span><span class="cx">                                 F692A8580255597D01FF60F7 /* Debugger.cpp */,
</span><span class="cx">                                 F692A8590255597D01FF60F7 /* Debugger.h */,
</span><ins>+                                BC3135630F302FA3003DFD3A /* DebuggerActivation.cpp */,
+                                BC3135620F302FA3003DFD3A /* DebuggerActivation.h */,
</ins><span class="cx">                                 149559ED0DDCDDF700648087 /* DebuggerCallFrame.cpp */,
</span><span class="cx">                                 1480DB9B0DDC227F003CFDF2 /* DebuggerCallFrame.h */,
</span><span class="cx">                                 FEA0861F182B7A0400F6D851 /* DebuggerPrimitives.h */,
</span><del>-                                0F2D4DDB19832D34007D4B19 /* DebuggerScope.cpp */,
-                                0F2D4DDC19832D34007D4B19 /* DebuggerScope.h */,
</del><span class="cx">                         );
</span><span class="cx">                         path = debugger;
</span><span class="cx">                         sourceTree = &quot;&lt;group&gt;&quot;;
</span><span class="lines">@@ -4577,6 +4559,8 @@
</span><span class="cx">                 7EF6E0BB0EB7A1EC0079AFAF /* runtime */ = {
</span><span class="cx">                         isa = PBXGroup;
</span><span class="cx">                         children = (
</span><ins>+                                9E72940A190F0514001A91B5 /* BundlePath.h */,
+                                9E729409190F0306001A91B5 /* BundlePath.mm */,
</ins><span class="cx">                                 BCF605110E203EF800B9A64D /* ArgList.cpp */,
</span><span class="cx">                                 BCF605120E203EF800B9A64D /* ArgList.h */,
</span><span class="cx">                                 BC257DE50E1F51C50016B6C9 /* Arguments.cpp */,
</span><span class="lines">@@ -4610,8 +4594,6 @@
</span><span class="cx">                                 704FD35305697E6D003DBED9 /* BooleanObject.h */,
</span><span class="cx">                                 BC7952340E15EB5600A898AB /* BooleanPrototype.cpp */,
</span><span class="cx">                                 BC7952350E15EB5600A898AB /* BooleanPrototype.h */,
</span><del>-                                9E72940A190F0514001A91B5 /* BundlePath.h */,
-                                9E729409190F0306001A91B5 /* BundlePath.mm */,
</del><span class="cx">                                 0FB7F38B15ED8E3800F167B2 /* Butterfly.h */,
</span><span class="cx">                                 0FB7F38C15ED8E3800F167B2 /* ButterflyInlines.h */,
</span><span class="cx">                                 BCA62DFE0E2826230004F30D /* CallData.cpp */,
</span><span class="lines">@@ -4683,10 +4665,6 @@
</span><span class="cx">                                 0F2B66B317B6B5AB00A7AE3F /* GenericTypedArrayViewInlines.h */,
</span><span class="cx">                                 BC02E9B80E184545000F9297 /* GetterSetter.cpp */,
</span><span class="cx">                                 BC337BDE0E1AF0B80076918A /* GetterSetter.h */,
</span><del>-                                0F2D4DDF19832D91007D4B19 /* HighFidelityLog.cpp */,
-                                0F2D4DE019832D91007D4B19 /* HighFidelityLog.h */,
-                                0F2D4DE119832D91007D4B19 /* HighFidelityTypeProfiler.cpp */,
-                                0F2D4DE219832D91007D4B19 /* HighFidelityTypeProfiler.h */,
</del><span class="cx">                                 933A349D038AE80F008635CE /* Identifier.cpp */,
</span><span class="cx">                                 933A349A038AE7C6008635CE /* Identifier.h */,
</span><span class="cx">                                 8606DDE918DA44AB00A383D0 /* IdentifierInlines.h */,
</span><span class="lines">@@ -4696,9 +4674,9 @@
</span><span class="cx">                                 0FB7F38F15ED8E3800F167B2 /* IndexingType.h */,
</span><span class="cx">                                 E178636C0D9BEEC300D74E75 /* InitializeThreading.cpp */,
</span><span class="cx">                                 E178633F0D9BEC0000D74E75 /* InitializeThreading.h */,
</span><ins>+                                A7A8AF2B17ADB5F3005AB174 /* Int8Array.h */,
</ins><span class="cx">                                 A7A8AF2C17ADB5F3005AB174 /* Int16Array.h */,
</span><span class="cx">                                 A7A8AF2D17ADB5F3005AB174 /* Int32Array.h */,
</span><del>-                                A7A8AF2B17ADB5F3005AB174 /* Int8Array.h */,
</del><span class="cx">                                 A78853F717972629001440E4 /* IntendedStructureChain.cpp */,
</span><span class="cx">                                 A78853F817972629001440E4 /* IntendedStructureChain.h */,
</span><span class="cx">                                 BC9BB95B0E19680600DF8855 /* InternalFunction.cpp */,
</span><span class="lines">@@ -4757,9 +4735,9 @@
</span><span class="cx">                                 A59455911824744700CC3843 /* JSGlobalObjectDebuggable.h */,
</span><span class="cx">                                 BC756FC60E2031B200DE7D12 /* JSGlobalObjectFunctions.cpp */,
</span><span class="cx">                                 BC756FC70E2031B200DE7D12 /* JSGlobalObjectFunctions.h */,
</span><ins>+                                0F2B66C917B6B5AB00A7AE3F /* JSInt8Array.h */,
</ins><span class="cx">                                 0F2B66CA17B6B5AB00A7AE3F /* JSInt16Array.h */,
</span><span class="cx">                                 0F2B66CB17B6B5AB00A7AE3F /* JSInt32Array.h */,
</span><del>-                                0F2B66C917B6B5AB00A7AE3F /* JSInt8Array.h */,
</del><span class="cx">                                 65EA4C99092AF9E20093D800 /* JSLock.cpp */,
</span><span class="cx">                                 65EA4C9A092AF9E20093D800 /* JSLock.h */,
</span><span class="cx">                                 A700873F17CBE8EB00C3E643 /* JSMap.cpp */,
</span><span class="lines">@@ -4813,10 +4791,10 @@
</span><span class="cx">                                 0F2B66D017B6B5AB00A7AE3F /* JSTypedArrays.cpp */,
</span><span class="cx">                                 0F2B66D117B6B5AB00A7AE3F /* JSTypedArrays.h */,
</span><span class="cx">                                 6507D2970E871E4A00D7D896 /* JSTypeInfo.h */,
</span><del>-                                0F2B66D417B6B5AB00A7AE3F /* JSUint16Array.h */,
-                                0F2B66D517B6B5AB00A7AE3F /* JSUint32Array.h */,
</del><span class="cx">                                 0F2B66D217B6B5AB00A7AE3F /* JSUint8Array.h */,
</span><span class="cx">                                 0F2B66D317B6B5AB00A7AE3F /* JSUint8ClampedArray.h */,
</span><ins>+                                0F2B66D417B6B5AB00A7AE3F /* JSUint16Array.h */,
+                                0F2B66D517B6B5AB00A7AE3F /* JSUint32Array.h */,
</ins><span class="cx">                                 BC22A39A0E16E14800AF21C8 /* JSVariableObject.cpp */,
</span><span class="cx">                                 14F252560D08DD8D004ECFFF /* JSVariableObject.h */,
</span><span class="cx">                                 A7CA3AE117DA41AE006538AF /* JSWeakMap.cpp */,
</span><span class="lines">@@ -4958,13 +4936,11 @@
</span><span class="cx">                                 0F2B66DB17B6B5AB00A7AE3F /* TypedArrays.h */,
</span><span class="cx">                                 0F2B66DC17B6B5AB00A7AE3F /* TypedArrayType.cpp */,
</span><span class="cx">                                 0F2B66DD17B6B5AB00A7AE3F /* TypedArrayType.h */,
</span><del>-                                0F2D4DE319832D91007D4B19 /* TypeSet.cpp */,
-                                0F2D4DE419832D91007D4B19 /* TypeSet.h */,
</del><ins>+                                A7A8AF3017ADB5F3005AB174 /* Uint8Array.h */,
+                                A7A8AF3117ADB5F3005AB174 /* Uint8ClampedArray.h */,
</ins><span class="cx">                                 A7A8AF3217ADB5F3005AB174 /* Uint16Array.h */,
</span><span class="cx">                                 866739D113BFDE710023D87C /* Uint16WithFraction.h */,
</span><span class="cx">                                 A7A8AF3317ADB5F3005AB174 /* Uint32Array.h */,
</span><del>-                                A7A8AF3017ADB5F3005AB174 /* Uint8Array.h */,
-                                A7A8AF3117ADB5F3005AB174 /* Uint8ClampedArray.h */,
</del><span class="cx">                                 E18E3A570DF9278C00D90B34 /* VM.cpp */,
</span><span class="cx">                                 E18E3A560DF9278C00D90B34 /* VM.h */,
</span><span class="cx">                                 FE5932A5183C5A2600A1ECCC /* VMEntryScope.cpp */,
</span><span class="lines">@@ -5467,9 +5443,6 @@
</span><span class="cx">                                 0F766D3715AE4A1A008F363E /* StructureStubClearingWatchpoint.h */,
</span><span class="cx">                                 BCCF0D0B0EF0B8A500413C8F /* StructureStubInfo.cpp */,
</span><span class="cx">                                 BCCF0D070EF0AAB900413C8F /* StructureStubInfo.h */,
</span><del>-                                0F2D4DE519832DAC007D4B19 /* ToThisStatus.cpp */,
-                                0F2D4DE619832DAC007D4B19 /* ToThisStatus.h */,
-                                0F2D4DE719832DAC007D4B19 /* TypeLocation.h */,
</del><span class="cx">                                 A79E781E15EECBA80047C855 /* UnlinkedCodeBlock.cpp */,
</span><span class="cx">                                 A79E781F15EECBA80047C855 /* UnlinkedCodeBlock.h */,
</span><span class="cx">                                 B59F89381891ADB500D5CCDC /* UnlinkedInstructionStream.cpp */,
</span><span class="lines">@@ -6046,6 +6019,7 @@
</span><span class="cx">                                 BCD2034C0E17135E002C7E82 /* DatePrototype.h in Headers */,
</span><span class="cx">                                 BCD203E80E1718F4002C7E82 /* DatePrototype.lut.h in Headers */,
</span><span class="cx">                                 BC18C3FA0E16F5CD00B34460 /* Debugger.h in Headers */,
</span><ins>+                                BC3135640F302FA3003DFD3A /* DebuggerActivation.h in Headers */,
</ins><span class="cx">                                 BC18C3FB0E16F5CD00B34460 /* DebuggerCallFrame.h in Headers */,
</span><span class="cx">                                 FEA08621182B7A0400F6D851 /* DebuggerPrimitives.h in Headers */,
</span><span class="cx">                                 0F136D4D174AD69E0075B354 /* DeferGC.h in Headers */,
</span><span class="lines">@@ -6286,7 +6260,6 @@
</span><span class="cx">                                 C283190016FE4B7D00157BFD /* HandleBlock.h in Headers */,
</span><span class="cx">                                 C283190216FE533E00157BFD /* HandleBlockInlines.h in Headers */,
</span><span class="cx">                                 0F0B83A914BCF56200885B4F /* HandlerInfo.h in Headers */,
</span><del>-                                0F2D4DEC19832DC4007D4B19 /* HighFidelityLog.h in Headers */,
</del><span class="cx">                                 142E3136134FF0A600AFADB5 /* HandleSet.h in Headers */,
</span><span class="cx">                                 142E3138134FF0A600AFADB5 /* HandleStack.h in Headers */,
</span><span class="cx">                                 1478297B1379E8A800A7C2A3 /* HandleTypes.h in Headers */,
</span><span class="lines">@@ -6327,7 +6300,6 @@
</span><span class="cx">                                 A53243981856A489002ED692 /* InspectorJS.json in Headers */,
</span><span class="cx">                                 A532438818568335002ED692 /* InspectorJSBackendDispatchers.h in Headers */,
</span><span class="cx">                                 A532438A18568335002ED692 /* InspectorJSFrontendDispatchers.h in Headers */,
</span><del>-                                0F2D4DEE19832DC4007D4B19 /* HighFidelityTypeProfiler.h in Headers */,
</del><span class="cx">                                 8606DDEA18DA44AB00A383D0 /* IdentifierInlines.h in Headers */,
</span><span class="cx">                                 A532438C18568335002ED692 /* InspectorJSTypeBuilders.h in Headers */,
</span><span class="cx">                                 A50E4B6218809DD50068A46D /* InspectorRuntimeAgent.h in Headers */,
</span><span class="lines">@@ -6378,7 +6350,6 @@
</span><span class="cx">                                 0F2B66EA17B6B5AB00A7AE3F /* JSArrayBufferViewInlines.h in Headers */,
</span><span class="cx">                                 A7BDAECB17F4EA1400F6140C /* JSArrayIterator.h in Headers */,
</span><span class="cx">                                 BC18C4180E16F5CD00B34460 /* JSBase.h in Headers */,
</span><del>-                                0F2D4DE919832DAC007D4B19 /* ToThisStatus.h in Headers */,
</del><span class="cx">                                 140D17D70E8AD4A9000CD17D /* JSBasePrivate.h in Headers */,
</span><span class="cx">                                 86FA9E92142BBB2E001773B7 /* JSBoundFunction.h in Headers */,
</span><span class="cx">                                 BC18C4190E16F5CD00B34460 /* JSCallbackConstructor.h in Headers */,
</span><span class="lines">@@ -6474,7 +6445,6 @@
</span><span class="cx">                                 6507D29E0E871E5E00D7D896 /* JSTypeInfo.h in Headers */,
</span><span class="cx">                                 0F2B670217B6B5AB00A7AE3F /* JSUint16Array.h in Headers */,
</span><span class="cx">                                 0F2B670317B6B5AB00A7AE3F /* JSUint32Array.h in Headers */,
</span><del>-                                0F2D4DF019832DD6007D4B19 /* TypeSet.h in Headers */,
</del><span class="cx">                                 0F2B670017B6B5AB00A7AE3F /* JSUint8Array.h in Headers */,
</span><span class="cx">                                 0F2B670117B6B5AB00A7AE3F /* JSUint8ClampedArray.h in Headers */,
</span><span class="cx">                                 86E3C612167BABD7006D760A /* JSValue.h in Headers */,
</span><span class="lines">@@ -6574,7 +6544,6 @@
</span><span class="cx">                                 969A079B0ED1D3AE00F1F681 /* Opcode.h in Headers */,
</span><span class="cx">                                 0F2BDC2C151FDE9100CD8910 /* Operands.h in Headers */,
</span><span class="cx">                                 A70447EA17A0BD4600F5898E /* OperandsInlines.h in Headers */,
</span><del>-                                0F2D4DDE19832D34007D4B19 /* DebuggerScope.h in Headers */,
</del><span class="cx">                                 BC18C4480E16F5CD00B34460 /* Operations.h in Headers */,
</span><span class="cx">                                 0FE228ED1436AB2700196C48 /* Options.h in Headers */,
</span><span class="cx">                                 BC18C44B0E16F5CD00B34460 /* Parser.h in Headers */,
</span><span class="lines">@@ -6639,7 +6608,6 @@
</span><span class="cx">                                 0F50AF3C193E8B3900674EE8 /* DFGStructureClobberState.h in Headers */,
</span><span class="cx">                                 A57D23EE1891B5540031C7FA /* RegularExpression.h in Headers */,
</span><span class="cx">                                 0FB7F39D15ED8E4600F167B2 /* Reject.h in Headers */,
</span><del>-                                0F2D4DEA19832DAC007D4B19 /* TypeLocation.h in Headers */,
</del><span class="cx">                                 A5BA15E8182340B300A82E69 /* RemoteInspector.h in Headers */,
</span><span class="cx">                                 A5BA15EA182340B400A82E69 /* RemoteInspectorConstants.h in Headers */,
</span><span class="cx">                                 A5BA15F0182345AF00A82E69 /* RemoteInspectorDebuggable.h in Headers */,
</span><span class="lines">@@ -7654,6 +7622,7 @@
</span><span class="cx">                                 147F39C5107EC37600427A48 /* DateInstance.cpp in Sources */,
</span><span class="cx">                                 147F39C6107EC37600427A48 /* DatePrototype.cpp in Sources */,
</span><span class="cx">                                 14280823107EC02C0013E7B2 /* Debugger.cpp in Sources */,
</span><ins>+                                BC3135650F302FA3003DFD3A /* DebuggerActivation.cpp in Sources */,
</ins><span class="cx">                                 149559EE0DDCDDF700648087 /* DebuggerCallFrame.cpp in Sources */,
</span><span class="cx">                                 2A7A58EF1808A4C40020BDF7 /* DeferGC.cpp in Sources */,
</span><span class="cx">                                 0FC712DE17CD8779008CC93C /* DeferredCompilationCallback.cpp in Sources */,
</span><span class="lines">@@ -7661,9 +7630,7 @@
</span><span class="cx">                                 0F55C19417276E4600CEABFD /* DFGAbstractValue.cpp in Sources */,
</span><span class="cx">                                 0F16015D156198C900C2587C /* DFGArgumentsSimplificationPhase.cpp in Sources */,
</span><span class="cx">                                 0F485321187750560083B687 /* DFGArithMode.cpp in Sources */,
</span><del>-                                0F2D4DDD19832D34007D4B19 /* DebuggerScope.cpp in Sources */,
</del><span class="cx">                                 0F63948415E48118006A597C /* DFGArrayMode.cpp in Sources */,
</span><del>-                                0F2D4DED19832DC4007D4B19 /* HighFidelityTypeProfiler.cpp in Sources */,
</del><span class="cx">                                 A7D9A29417A0BC7400EE2618 /* DFGAtTailAbstractState.cpp in Sources */,
</span><span class="cx">                                 0F666EC61835672B00D017F1 /* DFGAvailability.cpp in Sources */,
</span><span class="cx">                                 0F714CA416EA92F000F3EBEB /* DFGBackwardsPropagationPhase.cpp in Sources */,
</span><span class="lines">@@ -7783,7 +7750,6 @@
</span><span class="cx">                                 A7B48F490EE8936F00DCBDB6 /* ExecutableAllocator.cpp in Sources */,
</span><span class="cx">                                 86DB64640F95C6FC00D7D921 /* ExecutableAllocatorFixedVMPool.cpp in Sources */,
</span><span class="cx">                                 0F56A1D515001CF4002992B1 /* ExecutionCounter.cpp in Sources */,
</span><del>-                                0F2D4DEB19832DC4007D4B19 /* HighFidelityLog.cpp in Sources */,
</del><span class="cx">                                 0F0332C018ADFAE1005F979A /* ExitingJITType.cpp in Sources */,
</span><span class="cx">                                 0FB105851675480F00F8AB6E /* ExitKind.cpp in Sources */,
</span><span class="cx">                                 0FEA0A1C1708B00700BB722C /* FTLAbstractHeap.cpp in Sources */,
</span><span class="lines">@@ -7911,7 +7877,6 @@
</span><span class="cx">                                 A72028B61797601E0098028C /* JSCTestRunnerUtils.cpp in Sources */,
</span><span class="cx">                                 0F2B66EB17B6B5AB00A7AE3F /* JSDataView.cpp in Sources */,
</span><span class="cx">                                 0F2B66ED17B6B5AB00A7AE3F /* JSDataViewPrototype.cpp in Sources */,
</span><del>-                                0F2D4DE819832DAC007D4B19 /* ToThisStatus.cpp in Sources */,
</del><span class="cx">                                 978801401471AD920041B016 /* JSDateMath.cpp in Sources */,
</span><span class="cx">                                 140566D6107EC271005DBC8D /* JSFunction.cpp in Sources */,
</span><span class="cx">                                 147F39D2107EC37600427A48 /* JSGlobalObject.cpp in Sources */,
</span><span class="lines">@@ -8101,7 +8066,6 @@
</span><span class="cx">                                 14469DEB107EC7E700650446 /* StringConstructor.cpp in Sources */,
</span><span class="cx">                                 14469DEC107EC7E700650446 /* StringObject.cpp in Sources */,
</span><span class="cx">                                 14469DED107EC7E700650446 /* StringPrototype.cpp in Sources */,
</span><del>-                                0F2D4DEF19832DD3007D4B19 /* TypeSet.cpp in Sources */,
</del><span class="cx">                                 9335F24D12E6765B002B5553 /* StringRecursionChecker.cpp in Sources */,
</span><span class="cx">                                 BCDE3B430E6C832D001453A7 /* Structure.cpp in Sources */,
</span><span class="cx">                                 7E4EE70F0EBB7A5B005934AA /* StructureChain.cpp in Sources */,
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorebytecodeBytecodeListjson"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/bytecode/BytecodeList.json (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/bytecode/BytecodeList.json        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/Source/JavaScriptCore/bytecode/BytecodeList.json        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -10,7 +10,7 @@
</span><span class="cx">             { &quot;name&quot; : &quot;op_create_arguments&quot;, &quot;length&quot; : 2 },
</span><span class="cx">             { &quot;name&quot; : &quot;op_create_this&quot;, &quot;length&quot; : 4 },
</span><span class="cx">             { &quot;name&quot; : &quot;op_get_callee&quot;, &quot;length&quot; : 3 },
</span><del>-            { &quot;name&quot; : &quot;op_to_this&quot;, &quot;length&quot; : 4 },
</del><ins>+            { &quot;name&quot; : &quot;op_to_this&quot;, &quot;length&quot; : 3 },
</ins><span class="cx">             { &quot;name&quot; : &quot;op_new_object&quot;, &quot;length&quot; : 4 },
</span><span class="cx">             { &quot;name&quot; : &quot;op_new_array&quot;, &quot;length&quot; : 5 },
</span><span class="cx">             { &quot;name&quot; : &quot;op_new_array_with_size&quot;, &quot;length&quot; : 4 },
</span><span class="lines">@@ -113,7 +113,6 @@
</span><span class="cx">             { &quot;name&quot; : &quot;op_resolve_scope&quot;, &quot;length&quot; : 6 },
</span><span class="cx">             { &quot;name&quot; : &quot;op_get_from_scope&quot;, &quot;length&quot; : 8 },
</span><span class="cx">             { &quot;name&quot; : &quot;op_put_to_scope&quot;, &quot;length&quot; : 7 },
</span><del>-            { &quot;name&quot; : &quot;op_put_to_scope_with_profile&quot;, &quot;length&quot; : 8 },
</del><span class="cx">             { &quot;name&quot; : &quot;op_push_with_scope&quot;, &quot;length&quot; : 2 },
</span><span class="cx">             { &quot;name&quot; : &quot;op_pop_scope&quot;, &quot;length&quot; : 1 },
</span><span class="cx">             { &quot;name&quot; : &quot;op_push_name_scope&quot;, &quot;length&quot; : 4 },
</span><span class="lines">@@ -123,8 +122,7 @@
</span><span class="cx">             { &quot;name&quot; : &quot;op_debug&quot;, &quot;length&quot; : 3 },
</span><span class="cx">             { &quot;name&quot; : &quot;op_profile_will_call&quot;, &quot;length&quot; : 2 },
</span><span class="cx">             { &quot;name&quot; : &quot;op_profile_did_call&quot;, &quot;length&quot; : 2 },
</span><del>-            { &quot;name&quot; : &quot;op_end&quot;, &quot;length&quot; : 2 },
-            { &quot;name&quot; : &quot;op_profile_types_with_high_fidelity&quot;, &quot;length&quot; : 4 }
</del><ins>+            { &quot;name&quot; : &quot;op_end&quot;, &quot;length&quot; : 2 }
</ins><span class="cx">         ]
</span><span class="cx">     },
</span><span class="cx">     {
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorebytecodeBytecodeUseDefh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/bytecode/BytecodeUseDef.h (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/bytecode/BytecodeUseDef.h        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/Source/JavaScriptCore/bytecode/BytecodeUseDef.h        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -65,7 +65,6 @@
</span><span class="cx">     case op_tear_off_activation:
</span><span class="cx">     case op_profile_will_call:
</span><span class="cx">     case op_profile_did_call:
</span><del>-    case op_profile_types_with_high_fidelity:
</del><span class="cx">     case op_throw:
</span><span class="cx">     case op_push_with_scope:
</span><span class="cx">     case op_end:
</span><span class="lines">@@ -106,7 +105,6 @@
</span><span class="cx">     case op_put_by_id_transition_normal_out_of_line:
</span><span class="cx">     case op_put_by_id_out_of_line:
</span><span class="cx">     case op_put_by_id:
</span><del>-    case op_put_to_scope_with_profile:
</del><span class="cx">     case op_put_to_scope: {
</span><span class="cx">         functor(codeBlock, instruction, opcodeID, instruction[1].u.operand);
</span><span class="cx">         functor(codeBlock, instruction, opcodeID, instruction[3].u.operand);
</span><span class="lines">@@ -251,7 +249,6 @@
</span><span class="cx">     case op_push_name_scope:
</span><span class="cx">     case op_push_with_scope:
</span><span class="cx">     case op_put_to_scope:
</span><del>-    case op_put_to_scope_with_profile:
</del><span class="cx">     case op_pop_scope:
</span><span class="cx">     case op_end:
</span><span class="cx">     case op_profile_will_call:
</span><span class="lines">@@ -290,7 +287,6 @@
</span><span class="cx">     case op_put_by_val_direct:
</span><span class="cx">     case op_put_by_index:
</span><span class="cx">     case op_tear_off_arguments:
</span><del>-    case op_profile_types_with_high_fidelity:
</del><span class="cx">     case op_touch_entry:
</span><span class="cx"> #define LLINT_HELPER_OPCODES(opcode, length) case opcode:
</span><span class="cx">         FOR_EACH_LLINT_OPCODE_EXTENSION(LLINT_HELPER_OPCODES);
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorebytecodeCodeBlockcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/bytecode/CodeBlock.cpp (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/bytecode/CodeBlock.cpp        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/Source/JavaScriptCore/bytecode/CodeBlock.cpp        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -39,7 +39,6 @@
</span><span class="cx"> #include &quot;DFGJITCode.h&quot;
</span><span class="cx"> #include &quot;DFGWorklist.h&quot;
</span><span class="cx"> #include &quot;Debugger.h&quot;
</span><del>-#include &quot;HighFidelityTypeProfiler.h&quot;
</del><span class="cx"> #include &quot;Interpreter.h&quot;
</span><span class="cx"> #include &quot;JIT.h&quot;
</span><span class="cx"> #include &quot;JITStubs.h&quot;
</span><span class="lines">@@ -48,7 +47,6 @@
</span><span class="cx"> #include &quot;JSFunction.h&quot;
</span><span class="cx"> #include &quot;JSNameScope.h&quot;
</span><span class="cx"> #include &quot;LLIntEntrypoint.h&quot;
</span><del>-#include &quot;TypeLocation.h&quot;
</del><span class="cx"> #include &quot;LowLevelInterpreter.h&quot;
</span><span class="cx"> #include &quot;JSCInlines.h&quot;
</span><span class="cx"> #include &quot;PolymorphicGetByIdList.h&quot;
</span><span class="lines">@@ -297,6 +295,7 @@
</span><span class="cx">         out.printf(&quot; (offset = %d)&quot;, offset);
</span><span class="cx"> }
</span><span class="cx"> 
</span><ins>+#if ENABLE(JIT) // unused when not ENABLE(JIT), leading to silly warnings
</ins><span class="cx"> static void dumpChain(PrintStream&amp; out, ExecState* exec, StructureChain* chain, const Identifier&amp; ident)
</span><span class="cx"> {
</span><span class="cx">     out.printf(&quot;chain = %p: [&quot;, chain);
</span><span class="lines">@@ -312,6 +311,7 @@
</span><span class="cx">     }
</span><span class="cx">     out.printf(&quot;]&quot;);
</span><span class="cx"> }
</span><ins>+#endif
</ins><span class="cx"> 
</span><span class="cx"> void CodeBlock::printGetByIdCacheStatus(PrintStream&amp; out, ExecState* exec, int location, const StubInfoMap&amp; map)
</span><span class="cx"> {
</span><span class="lines">@@ -398,118 +398,6 @@
</span><span class="cx"> #endif
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-void CodeBlock::printPutByIdCacheStatus(PrintStream&amp; out, ExecState* exec, int location, const StubInfoMap&amp; map)
-{
-    Instruction* instruction = instructions().begin() + location;
-
-    const Identifier&amp; ident = identifier(instruction[2].u.operand);
-    
-    UNUSED_PARAM(ident); // tell the compiler to shut up in certain platform configurations.
-    
-    if (Structure* structure = instruction[4].u.structure.get()) {
-        switch (exec-&gt;interpreter()-&gt;getOpcodeID(instruction[0].u.opcode)) {
-        case op_put_by_id:
-        case op_put_by_id_out_of_line:
-            out.print(&quot; llint(&quot;);
-            dumpStructure(out, &quot;struct&quot;, exec, structure, ident);
-            out.print(&quot;)&quot;);
-            break;
-            
-        case op_put_by_id_transition_direct:
-        case op_put_by_id_transition_normal:
-        case op_put_by_id_transition_direct_out_of_line:
-        case op_put_by_id_transition_normal_out_of_line:
-            out.print(&quot; llint(&quot;);
-            dumpStructure(out, &quot;prev&quot;, exec, structure, ident);
-            out.print(&quot;, &quot;);
-            dumpStructure(out, &quot;next&quot;, exec, instruction[6].u.structure.get(), ident);
-            if (StructureChain* chain = instruction[7].u.structureChain.get()) {
-                out.print(&quot;, &quot;);
-                dumpChain(out, exec, chain, ident);
-            }
-            out.print(&quot;)&quot;);
-            break;
-            
-        default:
-            out.print(&quot; llint(unknown)&quot;);
-            break;
-        }
-    }
-
-#if ENABLE(JIT)
-    if (StructureStubInfo* stubPtr = map.get(CodeOrigin(location))) {
-        StructureStubInfo&amp; stubInfo = *stubPtr;
-        if (stubInfo.resetByGC)
-            out.print(&quot; (Reset By GC)&quot;);
-        
-        if (stubInfo.seen) {
-            out.printf(&quot; jit(&quot;);
-            
-            switch (stubInfo.accessType) {
-            case access_put_by_id_replace:
-                out.print(&quot;replace, &quot;);
-                dumpStructure(out, &quot;struct&quot;, exec, stubInfo.u.putByIdReplace.baseObjectStructure.get(), ident);
-                break;
-            case access_put_by_id_transition_normal:
-            case access_put_by_id_transition_direct:
-                out.print(&quot;transition, &quot;);
-                dumpStructure(out, &quot;prev&quot;, exec, stubInfo.u.putByIdTransition.previousStructure.get(), ident);
-                out.print(&quot;, &quot;);
-                dumpStructure(out, &quot;next&quot;, exec, stubInfo.u.putByIdTransition.structure.get(), ident);
-                if (StructureChain* chain = stubInfo.u.putByIdTransition.chain.get()) {
-                    out.print(&quot;, &quot;);
-                    dumpChain(out, exec, chain, ident);
-                }
-                break;
-            case access_put_by_id_list: {
-                out.printf(&quot;list = [&quot;);
-                PolymorphicPutByIdList* list = stubInfo.u.putByIdList.list;
-                CommaPrinter comma;
-                for (unsigned i = 0; i &lt; list-&gt;size(); ++i) {
-                    out.print(comma, &quot;(&quot;);
-                    const PutByIdAccess&amp; access = list-&gt;at(i);
-                    
-                    if (access.isReplace()) {
-                        out.print(&quot;replace, &quot;);
-                        dumpStructure(out, &quot;struct&quot;, exec, access.oldStructure(), ident);
-                    } else if (access.isSetter()) {
-                        out.print(&quot;setter, &quot;);
-                        dumpStructure(out, &quot;struct&quot;, exec, access.oldStructure(), ident);
-                    } else if (access.isCustom()) {
-                        out.print(&quot;custom, &quot;);
-                        dumpStructure(out, &quot;struct&quot;, exec, access.oldStructure(), ident);
-                    } else if (access.isTransition()) {
-                        out.print(&quot;transition, &quot;);
-                        dumpStructure(out, &quot;prev&quot;, exec, access.oldStructure(), ident);
-                        out.print(&quot;, &quot;);
-                        dumpStructure(out, &quot;next&quot;, exec, access.newStructure(), ident);
-                        if (access.chain()) {
-                            out.print(&quot;, &quot;);
-                            dumpChain(out, exec, access.chain(), ident);
-                        }
-                    } else
-                        out.print(&quot;unknown&quot;);
-                    
-                    out.print(&quot;)&quot;);
-                }
-                out.print(&quot;]&quot;);
-                break;
-            }
-            case access_unset:
-                out.printf(&quot;unset&quot;);
-                break;
-            default:
-                RELEASE_ASSERT_NOT_REACHED();
-                break;
-            }
-            out.printf(&quot;)&quot;);
-        }
-    }
-#else
-    UNUSED_PARAM(map);
-#endif
-}
-
</del><span class="cx"> void CodeBlock::printCallOp(PrintStream&amp; out, ExecState* exec, int location, const Instruction*&amp; it, const char* op, CacheDumpMode cacheDumpMode, bool&amp; hasPrintedProfiling, const CallLinkInfoMap&amp; map)
</span><span class="cx"> {
</span><span class="cx">     int dst = (++it)-&gt;u.operand;
</span><span class="lines">@@ -772,7 +660,6 @@
</span><span class="cx">             Structure* structure = (++it)-&gt;u.structure.get();
</span><span class="cx">             if (structure)
</span><span class="cx">                 out.print(&quot; cache(struct = &quot;, RawPointer(structure), &quot;)&quot;);
</span><del>-            out.print(&quot; &quot;, (++it)-&gt;u.toThisStatus);
</del><span class="cx">             break;
</span><span class="cx">         }
</span><span class="cx">         case op_new_object: {
</span><span class="lines">@@ -835,14 +722,6 @@
</span><span class="cx">             ++it;
</span><span class="cx">             break;
</span><span class="cx">         }
</span><del>-        case op_profile_types_with_high_fidelity: {
-            int r0 = (++it)-&gt;u.operand;
-            ++it;
-            ++it;
-            printLocationAndOp(out, exec, location, it, &quot;op_profile_types_with_high_fidelity&quot;);
-            out.printf(&quot;%s&quot;, registerName(r0).data());
-            break;
-        }
</del><span class="cx">         case op_not: {
</span><span class="cx">             printUnaryOp(out, exec, location, it, &quot;not&quot;);
</span><span class="cx">             break;
</span><span class="lines">@@ -1041,32 +920,26 @@
</span><span class="cx">         }
</span><span class="cx">         case op_put_by_id: {
</span><span class="cx">             printPutByIdOp(out, exec, location, it, &quot;put_by_id&quot;);
</span><del>-            printPutByIdCacheStatus(out, exec, location, stubInfos);
</del><span class="cx">             break;
</span><span class="cx">         }
</span><span class="cx">         case op_put_by_id_out_of_line: {
</span><span class="cx">             printPutByIdOp(out, exec, location, it, &quot;put_by_id_out_of_line&quot;);
</span><del>-            printPutByIdCacheStatus(out, exec, location, stubInfos);
</del><span class="cx">             break;
</span><span class="cx">         }
</span><span class="cx">         case op_put_by_id_transition_direct: {
</span><span class="cx">             printPutByIdOp(out, exec, location, it, &quot;put_by_id_transition_direct&quot;);
</span><del>-            printPutByIdCacheStatus(out, exec, location, stubInfos);
</del><span class="cx">             break;
</span><span class="cx">         }
</span><span class="cx">         case op_put_by_id_transition_direct_out_of_line: {
</span><span class="cx">             printPutByIdOp(out, exec, location, it, &quot;put_by_id_transition_direct_out_of_line&quot;);
</span><del>-            printPutByIdCacheStatus(out, exec, location, stubInfos);
</del><span class="cx">             break;
</span><span class="cx">         }
</span><span class="cx">         case op_put_by_id_transition_normal: {
</span><span class="cx">             printPutByIdOp(out, exec, location, it, &quot;put_by_id_transition_normal&quot;);
</span><del>-            printPutByIdCacheStatus(out, exec, location, stubInfos);
</del><span class="cx">             break;
</span><span class="cx">         }
</span><span class="cx">         case op_put_by_id_transition_normal_out_of_line: {
</span><span class="cx">             printPutByIdOp(out, exec, location, it, &quot;put_by_id_transition_normal_out_of_line&quot;);
</span><del>-            printPutByIdCacheStatus(out, exec, location, stubInfos);
</del><span class="cx">             break;
</span><span class="cx">         }
</span><span class="cx">         case op_put_getter_setter: {
</span><span class="lines">@@ -1469,7 +1342,6 @@
</span><span class="cx">                 operand);
</span><span class="cx">             break;
</span><span class="cx">         }
</span><del>-        case op_put_to_scope_with_profile:
</del><span class="cx">         case op_put_to_scope: {
</span><span class="cx">             int r0 = (++it)-&gt;u.operand;
</span><span class="cx">             int id0 = (++it)-&gt;u.operand;
</span><span class="lines">@@ -1478,8 +1350,6 @@
</span><span class="cx">             ++it; // Structure
</span><span class="cx">             int operand = (++it)-&gt;u.operand; // Operand
</span><span class="cx">             printLocationAndOp(out, exec, location, it, &quot;put_to_scope&quot;);
</span><del>-            if (opcode == op_put_to_scope_with_profile)
-                ++it;
</del><span class="cx">             out.printf(&quot;%s, %s, %s, %u&lt;%s|%s&gt;, &lt;structure&gt;, %d&quot;,
</span><span class="cx">                 registerName(r0).data(), idName(id0, identifier(id0)).data(), registerName(r1).data(),
</span><span class="cx">                 modeAndType.operand(), resolveModeName(modeAndType.mode()), resolveTypeName(modeAndType.type()),
</span><span class="lines">@@ -1877,7 +1747,6 @@
</span><span class="cx">             break;
</span><span class="cx">         }
</span><span class="cx"> 
</span><del>-        case op_put_to_scope_with_profile:
</del><span class="cx">         case op_put_to_scope: {
</span><span class="cx">             // put_to_scope scope, id, value, ResolveModeAndType, Structure, Operand
</span><span class="cx">             const Identifier&amp; ident = identifier(pc[2].u.operand);
</span><span class="lines">@@ -1893,68 +1762,9 @@
</span><span class="cx">             } else if (op.structure)
</span><span class="cx">                 instructions[i + 5].u.structure.set(*vm(), ownerExecutable, op.structure);
</span><span class="cx">             instructions[i + 6].u.pointer = reinterpret_cast&lt;void*&gt;(op.operand);
</span><del>-
-            if (pc[0].u.opcode == op_put_to_scope_with_profile) {
-                // The format of this instruction is: put_to_scope_with_profile scope, id, value, ResolveModeAndType, Structure, Operand, TypeLocation*
-                TypeLocation* location = vm()-&gt;nextLocation();
-                size_t instructionOffset = i + opLength - 1;
-                int divot, startOffset, endOffset; 
-                unsigned line = 0, column = 0;
-                expressionRangeForBytecodeOffset(instructionOffset, divot, startOffset, endOffset, line, column);
-
-                location-&gt;m_line = line;
-                location-&gt;m_column = column;
-                location-&gt;m_sourceID = m_ownerExecutable-&gt;sourceID();
-
-                // FIXME: handle other values for op.type here, and also consider what to do when we can't statically determine the globalID
-                SymbolTable* symbolTable = 0;
-                if (op.type == ClosureVar) 
-                    symbolTable = op.activation-&gt;symbolTable();
-                else if (op.type == GlobalVar)
-                    symbolTable = m_globalObject.get()-&gt;symbolTable();
-                
-                if (symbolTable) {
-                    ConcurrentJITLocker locker(symbolTable-&gt;m_lock);
-                    location-&gt;m_globalVariableID = symbolTable-&gt;uniqueIDForVariable(locker, ident.impl(), *vm());
-                    location-&gt;m_globalTypeSet =symbolTable-&gt;globalTypeSetForVariable(locker, ident.impl(), *vm());
-                } else
-                    location-&gt;m_globalVariableID = HighFidelityNoGlobalIDExists;
-
-                vm()-&gt;highFidelityTypeProfiler()-&gt;insertNewLocation(location);
-                instructions[i + 7].u.location = location;
-            }
</del><span class="cx">             break;
</span><span class="cx">         }
</span><del>-
-        case op_profile_types_with_high_fidelity: {
-
-            VirtualRegister virtualRegister(pc[1].u.operand);
-            SymbolTable* symbolTable = m_symbolTable.get();
-            TypeLocation* location = vm()-&gt;nextLocation();
-            size_t instructionOffset = i + opLength - 1;
-            int divot, startOffset, endOffset; 
-            unsigned line = 0, column = 0;
-            expressionRangeForBytecodeOffset(instructionOffset, divot, startOffset, endOffset, line, column);
-
-            int hasGlobalIDFlag = pc[3].u.operand;
-            if (hasGlobalIDFlag) {
-                ConcurrentJITLocker locker(symbolTable-&gt;m_lock);
-                location-&gt;m_globalVariableID = symbolTable-&gt;uniqueIDForRegister(locker, virtualRegister.offset(), *vm());
-                location-&gt;m_globalTypeSet = symbolTable-&gt;globalTypeSetForRegister(locker, virtualRegister.offset(), *vm());
-            } else
-                location-&gt;m_globalVariableID = HighFidelityNoGlobalIDExists;
</del><span class="cx">             
</span><del>-
-            location-&gt;m_line = line;
-            location-&gt;m_column = column;
-            location-&gt;m_sourceID = m_ownerExecutable-&gt;sourceID();
-
-            vm()-&gt;highFidelityTypeProfiler()-&gt;insertNewLocation(location);
-            instructions[i + 2].u.location = location;
-            break;
-        }
-
-
</del><span class="cx">         case op_captured_mov:
</span><span class="cx">         case op_new_captured_func: {
</span><span class="cx">             if (pc[3].u.index == UINT_MAX) {
</span><span class="lines">@@ -2375,8 +2185,6 @@
</span><span class="cx">                 if (Options::verboseOSR())
</span><span class="cx">                     dataLogF(&quot;Clearing LLInt to_this with structure %p.\n&quot;, curInstruction[2].u.structure.get());
</span><span class="cx">                 curInstruction[2].u.structure.clear();
</span><del>-                curInstruction[3].u.toThisStatus = merge(
-                    curInstruction[3].u.toThisStatus, ToThisClearedByGC);
</del><span class="cx">                 break;
</span><span class="cx">             case op_get_callee:
</span><span class="cx">                 if (!curInstruction[2].u.jsCell || Heap::isMarked(curInstruction[2].u.jsCell.get()))
</span><span class="lines">@@ -2395,7 +2203,6 @@
</span><span class="cx">                 break;
</span><span class="cx">             }
</span><span class="cx">             case op_get_from_scope:
</span><del>-            case op_put_to_scope_with_profile:
</del><span class="cx">             case op_put_to_scope: {
</span><span class="cx">                 ResolveModeAndType modeAndType =
</span><span class="cx">                     ResolveModeAndType(curInstruction[4].u.operand);
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorebytecodeCodeBlockh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/bytecode/CodeBlock.h (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/bytecode/CodeBlock.h        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/Source/JavaScriptCore/bytecode/CodeBlock.h        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -941,7 +941,6 @@
</span><span class="cx"> 
</span><span class="cx">     bool isKnownToBeLiveDuringGC(); // Will only return valid results when called during GC. Assumes that you've already established that the owner executable is live.
</span><span class="cx"> 
</span><del>-
</del><span class="cx"> protected:
</span><span class="cx">     virtual void visitWeakReferences(SlotVisitor&amp;) override;
</span><span class="cx">     virtual void finalizeUnconditionally() override;
</span><span class="lines">@@ -988,7 +987,6 @@
</span><span class="cx">     enum CacheDumpMode { DumpCaches, DontDumpCaches };
</span><span class="cx">     void printCallOp(PrintStream&amp;, ExecState*, int location, const Instruction*&amp;, const char* op, CacheDumpMode, bool&amp; hasPrintedProfiling, const CallLinkInfoMap&amp;);
</span><span class="cx">     void printPutByIdOp(PrintStream&amp;, ExecState*, int location, const Instruction*&amp;, const char* op);
</span><del>-    void printPutByIdCacheStatus(PrintStream&amp;, ExecState*, int location, const StubInfoMap&amp;);
</del><span class="cx">     void printLocationAndOp(PrintStream&amp;, ExecState*, int location, const Instruction*&amp;, const char* op);
</span><span class="cx">     void printLocationOpAndRegisterOperand(PrintStream&amp;, ExecState*, int location, const Instruction*&amp; it, const char* op, int operand);
</span><span class="cx"> 
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorebytecodeGetByIdStatuscpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/bytecode/GetByIdStatus.cpp (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/bytecode/GetByIdStatus.cpp        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/Source/JavaScriptCore/bytecode/GetByIdStatus.cpp        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -166,8 +166,7 @@
</span><span class="cx">         
</span><span class="cx">         variant.m_structureSet.add(structure);
</span><span class="cx">         variant.m_specificValue = JSValue(specificValue);
</span><del>-        bool didAppend = result.appendVariant(variant);
-        ASSERT_UNUSED(didAppend, didAppend);
</del><ins>+        result.appendVariant(variant);
</ins><span class="cx">         return result;
</span><span class="cx">     }
</span><span class="cx">         
</span><span class="lines">@@ -311,43 +310,34 @@
</span><span class="cx">     return computeFor(profiledBlock, baselineMap, codeOrigin.bytecodeIndex, uid);
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-GetByIdStatus GetByIdStatus::computeFor(VM&amp; vm, const StructureSet&amp; set, StringImpl* uid)
</del><ins>+GetByIdStatus GetByIdStatus::computeFor(VM&amp; vm, Structure* structure, StringImpl* uid)
</ins><span class="cx"> {
</span><span class="cx">     // For now we only handle the super simple self access case. We could handle the
</span><span class="cx">     // prototype case in the future.
</span><span class="cx">     
</span><del>-    if (set.isEmpty())
-        return GetByIdStatus();
</del><ins>+    if (!structure)
+        return GetByIdStatus(TakesSlowPath);
</ins><span class="cx"> 
</span><span class="cx">     if (toUInt32FromStringImpl(uid) != PropertyName::NotAnIndex)
</span><span class="cx">         return GetByIdStatus(TakesSlowPath);
</span><span class="cx">     
</span><del>-    GetByIdStatus result;
-    result.m_state = Simple;
-    result.m_wasSeenInJIT = false;
-    for (unsigned i = 0; i &lt; set.size(); ++i) {
-        Structure* structure = set[i];
-        if (structure-&gt;typeInfo().overridesGetOwnPropertySlot() &amp;&amp; structure-&gt;typeInfo().type() != GlobalObjectType)
-            return GetByIdStatus(TakesSlowPath);
-        
-        if (!structure-&gt;propertyAccessesAreCacheable())
-            return GetByIdStatus(TakesSlowPath);
-        
-        unsigned attributes;
-        JSCell* specificValue;
-        PropertyOffset offset = structure-&gt;getConcurrently(vm, uid, attributes, specificValue);
-        if (!isValidOffset(offset))
-            return GetByIdStatus(TakesSlowPath); // It's probably a prototype lookup. Give up on life for now, even though we could totally be way smarter about it.
-        if (attributes &amp; Accessor)
-            return GetByIdStatus(MakesCalls); // We could be smarter here, like strenght-reducing this to a Call.
-        if (structure-&gt;isDictionary())
-            specificValue = 0;
-        
-        if (!result.appendVariant(GetByIdVariant(structure, offset, specificValue)))
-            return GetByIdStatus(TakesSlowPath);
-    }
</del><ins>+    if (structure-&gt;typeInfo().overridesGetOwnPropertySlot() &amp;&amp; structure-&gt;typeInfo().type() != GlobalObjectType)
+        return GetByIdStatus(TakesSlowPath);
</ins><span class="cx">     
</span><del>-    return result;
</del><ins>+    if (!structure-&gt;propertyAccessesAreCacheable())
+        return GetByIdStatus(TakesSlowPath);
+
+    unsigned attributes;
+    JSCell* specificValue;
+    PropertyOffset offset = structure-&gt;getConcurrently(vm, uid, attributes, specificValue);
+    if (!isValidOffset(offset))
+        return GetByIdStatus(TakesSlowPath); // It's probably a prototype lookup. Give up on life for now, even though we could totally be way smarter about it.
+    if (attributes &amp; Accessor)
+        return GetByIdStatus(MakesCalls);
+    if (structure-&gt;isDictionary())
+        specificValue = 0;
+    return GetByIdStatus(
+        Simple, false, GetByIdVariant(StructureSet(structure), offset, specificValue));
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> bool GetByIdStatus::makesCalls() const
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorebytecodeGetByIdStatush"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/bytecode/GetByIdStatus.h (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/bytecode/GetByIdStatus.h        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/Source/JavaScriptCore/bytecode/GetByIdStatus.h        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -68,7 +68,7 @@
</span><span class="cx">     }
</span><span class="cx">     
</span><span class="cx">     static GetByIdStatus computeFor(CodeBlock*, StubInfoMap&amp;, unsigned bytecodeIndex, StringImpl* uid);
</span><del>-    static GetByIdStatus computeFor(VM&amp;, const StructureSet&amp;, StringImpl* uid);
</del><ins>+    static GetByIdStatus computeFor(VM&amp;, Structure*, StringImpl* uid);
</ins><span class="cx">     
</span><span class="cx">     static GetByIdStatus computeFor(CodeBlock* baselineBlock, CodeBlock* dfgBlock, StubInfoMap&amp; baselineMap, StubInfoMap&amp; dfgMap, CodeOrigin, StringImpl* uid);
</span><span class="cx">     
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorebytecodeGetByIdVariantcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/bytecode/GetByIdVariant.cpp (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/bytecode/GetByIdVariant.cpp        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/Source/JavaScriptCore/bytecode/GetByIdVariant.cpp        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -108,14 +108,12 @@
</span><span class="cx">     
</span><span class="cx">     out.print(
</span><span class="cx">         &quot;&lt;&quot;, inContext(structureSet(), context), &quot;, &quot;,
</span><del>-        &quot;[&quot;, listDumpInContext(m_constantChecks, context), &quot;]&quot;);
-    if (m_alternateBase)
-        out.print(&quot;, alternateBase = &quot;, inContext(JSValue(m_alternateBase), context));
-    if (specificValue())
-        out.print(&quot;, specificValue = &quot;, inContext(specificValue(), context));
-    out.print(&quot;, offset = &quot;, offset());
</del><ins>+        &quot;[&quot;, listDumpInContext(m_constantChecks, context), &quot;], &quot;,
+        &quot;alternateBase = &quot;, inContext(JSValue(m_alternateBase), context), &quot;, &quot;,
+        &quot;specificValue = &quot;, inContext(specificValue(), context), &quot;, &quot;,
+        &quot;offset = &quot;, offset());
</ins><span class="cx">     if (m_callLinkStatus)
</span><del>-        out.print(&quot;, call = &quot;, *m_callLinkStatus);
</del><ins>+        out.print(&quot;call = &quot;, *m_callLinkStatus);
</ins><span class="cx">     out.print(&quot;&gt;&quot;);
</span><span class="cx"> }
</span><span class="cx"> 
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorebytecodeGetByIdVarianth"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/bytecode/GetByIdVariant.h (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/bytecode/GetByIdVariant.h        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/Source/JavaScriptCore/bytecode/GetByIdVariant.h        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -55,7 +55,6 @@
</span><span class="cx">     bool isSet() const { return !!m_structureSet.size(); }
</span><span class="cx">     bool operator!() const { return !isSet(); }
</span><span class="cx">     const StructureSet&amp; structureSet() const { return m_structureSet; }
</span><del>-    StructureSet&amp; structureSet() { return m_structureSet; }
</del><span class="cx">     const ConstantStructureCheckVector&amp; constantChecks() const { return m_constantChecks; }
</span><span class="cx">     JSObject* alternateBase() const { return m_alternateBase; }
</span><span class="cx">     JSValue specificValue() const { return m_specificValue; }
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorebytecodeInstructionh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/bytecode/Instruction.h (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/bytecode/Instruction.h        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/Source/JavaScriptCore/bytecode/Instruction.h        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -1,5 +1,5 @@
</span><span class="cx"> /*
</span><del>- * Copyright (C) 2008, 2012, 2013, 2014 Apple Inc. All rights reserved.
</del><ins>+ * Copyright (C) 2008, 2012, 2013 Apple Inc. All rights reserved.
</ins><span class="cx">  *
</span><span class="cx">  * Redistribution and use in source and binary forms, with or without
</span><span class="cx">  * modification, are permitted provided that the following conditions
</span><span class="lines">@@ -31,12 +31,10 @@
</span><span class="cx"> 
</span><span class="cx"> #include &quot;MacroAssembler.h&quot;
</span><span class="cx"> #include &quot;Opcode.h&quot;
</span><del>-#include &quot;TypeLocation.h&quot;
</del><span class="cx"> #include &quot;PropertySlot.h&quot;
</span><span class="cx"> #include &quot;SpecialPointer.h&quot;
</span><span class="cx"> #include &quot;Structure.h&quot;
</span><span class="cx"> #include &quot;StructureChain.h&quot;
</span><del>-#include &quot;ToThisStatus.h&quot;
</del><span class="cx"> #include &quot;VirtualRegister.h&quot;
</span><span class="cx"> #include &lt;wtf/VectorTraits.h&gt;
</span><span class="cx"> 
</span><span class="lines">@@ -120,8 +118,6 @@
</span><span class="cx">         WriteBarrierBase&lt;JSActivation&gt; activation;
</span><span class="cx">         void* pointer;
</span><span class="cx">         bool* predicatePointer;
</span><del>-        ToThisStatus toThisStatus;
-        TypeLocation* location;
</del><span class="cx">     } u;
</span><span class="cx">         
</span><span class="cx"> private:
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorebytecodePutByIdStatuscpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/bytecode/PutByIdStatus.cpp (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/bytecode/PutByIdStatus.cpp        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/Source/JavaScriptCore/bytecode/PutByIdStatus.cpp        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -40,11 +40,7 @@
</span><span class="cx"> bool PutByIdStatus::appendVariant(const PutByIdVariant&amp; variant)
</span><span class="cx"> {
</span><span class="cx">     for (unsigned i = 0; i &lt; m_variants.size(); ++i) {
</span><del>-        if (m_variants[i].attemptToMerge(variant))
-            return true;
-    }
-    for (unsigned i = 0; i &lt; m_variants.size(); ++i) {
-        if (m_variants[i].oldStructure().overlaps(variant.oldStructure()))
</del><ins>+        if (m_variants[i].oldStructure() == variant.oldStructure())
</ins><span class="cx">             return false;
</span><span class="cx">     }
</span><span class="cx">     m_variants.append(variant);
</span><span class="lines">@@ -194,15 +190,11 @@
</span><span class="cx">                     access.newStructure()-&gt;getConcurrently(*profiledBlock-&gt;vm(), uid);
</span><span class="cx">                 if (!isValidOffset(offset))
</span><span class="cx">                     return PutByIdStatus(TakesSlowPath);
</span><del>-                RefPtr&lt;IntendedStructureChain&gt; chain;
-                if (access.chain()) {
-                    chain = adoptRef(new IntendedStructureChain(
-                        profiledBlock, access.oldStructure(), access.chain()));
-                    if (!chain-&gt;isStillValid())
-                        continue;
-                }
</del><span class="cx">                 bool ok = result.appendVariant(PutByIdVariant::transition(
</span><del>-                    access.oldStructure(), access.newStructure(), chain.get(), offset));
</del><ins>+                    access.oldStructure(), access.newStructure(),
+                    access.chain() ? adoptRef(new IntendedStructureChain(
+                        profiledBlock, access.oldStructure(), access.chain())) : 0,
+                    offset));
</ins><span class="cx">                 if (!ok)
</span><span class="cx">                     return PutByIdStatus(TakesSlowPath);
</span><span class="cx">                 break;
</span><span class="lines">@@ -255,101 +247,88 @@
</span><span class="cx">     return computeFor(baselineBlock, baselineMap, codeOrigin.bytecodeIndex, uid);
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-PutByIdStatus PutByIdStatus::computeFor(VM&amp; vm, JSGlobalObject* globalObject, const StructureSet&amp; set, StringImpl* uid, bool isDirect)
</del><ins>+PutByIdStatus PutByIdStatus::computeFor(VM&amp; vm, JSGlobalObject* globalObject, Structure* structure, StringImpl* uid, bool isDirect)
</ins><span class="cx"> {
</span><span class="cx">     if (toUInt32FromStringImpl(uid) != PropertyName::NotAnIndex)
</span><span class="cx">         return PutByIdStatus(TakesSlowPath);
</span><span class="cx"> 
</span><del>-    if (set.isEmpty())
-        return PutByIdStatus();
</del><ins>+    if (!structure)
+        return PutByIdStatus(TakesSlowPath);
</ins><span class="cx">     
</span><del>-    PutByIdStatus result;
-    result.m_state = Simple;
-    for (unsigned i = 0; i &lt; set.size(); ++i) {
-        Structure* structure = set[i];
-        
-        if (structure-&gt;typeInfo().overridesGetOwnPropertySlot() &amp;&amp; structure-&gt;typeInfo().type() != GlobalObjectType)
-            return PutByIdStatus(TakesSlowPath);
</del><ins>+    if (structure-&gt;typeInfo().overridesGetOwnPropertySlot() &amp;&amp; structure-&gt;typeInfo().type() != GlobalObjectType)
+        return PutByIdStatus(TakesSlowPath);
</ins><span class="cx"> 
</span><del>-        if (!structure-&gt;propertyAccessesAreCacheable())
-            return PutByIdStatus(TakesSlowPath);
</del><ins>+    if (!structure-&gt;propertyAccessesAreCacheable())
+        return PutByIdStatus(TakesSlowPath);
</ins><span class="cx">     
</span><del>-        unsigned attributes;
-        JSCell* specificValue;
-        PropertyOffset offset = structure-&gt;getConcurrently(vm, uid, attributes, specificValue);
-        if (isValidOffset(offset)) {
-            if (attributes &amp; CustomAccessor)
-                return PutByIdStatus(MakesCalls);
</del><ins>+    unsigned attributes;
+    JSCell* specificValue;
+    PropertyOffset offset = structure-&gt;getConcurrently(vm, uid, attributes, specificValue);
+    if (isValidOffset(offset)) {
+        if (attributes &amp; CustomAccessor)
+            return PutByIdStatus(MakesCalls);
</ins><span class="cx"> 
</span><del>-            if (attributes &amp; (Accessor | ReadOnly))
-                return PutByIdStatus(TakesSlowPath);
-            if (specificValue) {
-                // We need the PutById slow path to verify that we're storing the right value into
-                // the specialized slot.
-                return PutByIdStatus(TakesSlowPath);
-            }
-            if (!result.appendVariant(PutByIdVariant::replace(structure, offset)))
-                return PutByIdStatus(TakesSlowPath);
-            continue;
</del><ins>+        if (attributes &amp; (Accessor | ReadOnly))
+            return PutByIdStatus(TakesSlowPath);
+        if (specificValue) {
+            // We need the PutById slow path to verify that we're storing the right value into
+            // the specialized slot.
+            return PutByIdStatus(TakesSlowPath);
</ins><span class="cx">         }
</span><ins>+        return PutByIdVariant::replace(structure, offset);
+    }
</ins><span class="cx">     
</span><del>-        // Our hypothesis is that we're doing a transition. Before we prove that this is really
-        // true, we want to do some sanity checks.
</del><ins>+    // Our hypothesis is that we're doing a transition. Before we prove that this is really
+    // true, we want to do some sanity checks.
</ins><span class="cx">     
</span><del>-        // Don't cache put transitions on dictionaries.
-        if (structure-&gt;isDictionary())
-            return PutByIdStatus(TakesSlowPath);
</del><ins>+    // Don't cache put transitions on dictionaries.
+    if (structure-&gt;isDictionary())
+        return PutByIdStatus(TakesSlowPath);
</ins><span class="cx"> 
</span><del>-        // If the structure corresponds to something that isn't an object, then give up, since
-        // we don't want to be adding properties to strings.
-        if (structure-&gt;typeInfo().type() == StringType)
-            return PutByIdStatus(TakesSlowPath);
</del><ins>+    // If the structure corresponds to something that isn't an object, then give up, since
+    // we don't want to be adding properties to strings.
+    if (structure-&gt;typeInfo().type() == StringType)
+        return PutByIdStatus(TakesSlowPath);
</ins><span class="cx">     
</span><del>-        RefPtr&lt;IntendedStructureChain&gt; chain;
-        if (!isDirect) {
-            chain = adoptRef(new IntendedStructureChain(globalObject, structure));
</del><ins>+    RefPtr&lt;IntendedStructureChain&gt; chain;
+    if (!isDirect) {
+        chain = adoptRef(new IntendedStructureChain(globalObject, structure));
</ins><span class="cx">         
</span><del>-            // If the prototype chain has setters or read-only properties, then give up.
-            if (chain-&gt;mayInterceptStoreTo(vm, uid))
-                return PutByIdStatus(TakesSlowPath);
</del><ins>+        // If the prototype chain has setters or read-only properties, then give up.
+        if (chain-&gt;mayInterceptStoreTo(vm, uid))
+            return PutByIdStatus(TakesSlowPath);
</ins><span class="cx">         
</span><del>-            // If the prototype chain hasn't been normalized (i.e. there are proxies or dictionaries)
-            // then give up. The dictionary case would only happen if this structure has not been
-            // used in an optimized put_by_id transition. And really the only reason why we would
-            // bail here is that I don't really feel like having the optimizing JIT go and flatten
-            // dictionaries if we have evidence to suggest that those objects were never used as
-            // prototypes in a cacheable prototype access - i.e. there's a good chance that some of
-            // the other checks below will fail.
-            if (structure-&gt;isProxy() || !chain-&gt;isNormalized())
-                return PutByIdStatus(TakesSlowPath);
-        }
-    
-        // We only optimize if there is already a structure that the transition is cached to.
-        // Among other things, this allows us to guard against a transition with a specific
-        // value.
-        //
-        // - If we're storing a value that could be specific: this would only be a problem if
-        //   the existing transition did have a specific value already, since if it didn't,
-        //   then we would behave &quot;as if&quot; we were not storing a specific value. If it did
-        //   have a specific value, then we'll know - the fact that we pass 0 for
-        //   specificValue will tell us.
-        //
-        // - If we're not storing a value that could be specific: again, this would only be a
-        //   problem if the existing transition did have a specific value, which we check for
-        //   by passing 0 for the specificValue.
-        Structure* transition = Structure::addPropertyTransitionToExistingStructureConcurrently(structure, uid, 0, 0, offset);
-        if (!transition)
-            return PutByIdStatus(TakesSlowPath); // This occurs in bizarre cases only. See above.
-        ASSERT(!transition-&gt;transitionDidInvolveSpecificValue());
-        ASSERT(isValidOffset(offset));
-    
-        bool didAppend = result.appendVariant(
-            PutByIdVariant::transition(structure, transition, chain.release(), offset));
-        if (!didAppend)
</del><ins>+        // If the prototype chain hasn't been normalized (i.e. there are proxies or dictionaries)
+        // then give up. The dictionary case would only happen if this structure has not been
+        // used in an optimized put_by_id transition. And really the only reason why we would
+        // bail here is that I don't really feel like having the optimizing JIT go and flatten
+        // dictionaries if we have evidence to suggest that those objects were never used as
+        // prototypes in a cacheable prototype access - i.e. there's a good chance that some of
+        // the other checks below will fail.
+        if (structure-&gt;isProxy() || !chain-&gt;isNormalized())
</ins><span class="cx">             return PutByIdStatus(TakesSlowPath);
</span><span class="cx">     }
</span><span class="cx">     
</span><del>-    return result;
</del><ins>+    // We only optimize if there is already a structure that the transition is cached to.
+    // Among other things, this allows us to guard against a transition with a specific
+    // value.
+    //
+    // - If we're storing a value that could be specific: this would only be a problem if
+    //   the existing transition did have a specific value already, since if it didn't,
+    //   then we would behave &quot;as if&quot; we were not storing a specific value. If it did
+    //   have a specific value, then we'll know - the fact that we pass 0 for
+    //   specificValue will tell us.
+    //
+    // - If we're not storing a value that could be specific: again, this would only be a
+    //   problem if the existing transition did have a specific value, which we check for
+    //   by passing 0 for the specificValue.
+    Structure* transition = Structure::addPropertyTransitionToExistingStructureConcurrently(structure, uid, 0, 0, offset);
+    if (!transition)
+        return PutByIdStatus(TakesSlowPath); // This occurs in bizarre cases only. See above.
+    ASSERT(!transition-&gt;transitionDidInvolveSpecificValue());
+    ASSERT(isValidOffset(offset));
+    
+    return PutByIdVariant::transition(structure, transition, chain.release(), offset);
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> void PutByIdStatus::dump(PrintStream&amp; out) const
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorebytecodePutByIdStatush"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/bytecode/PutByIdStatus.h (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/bytecode/PutByIdStatus.h        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/Source/JavaScriptCore/bytecode/PutByIdStatus.h        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -70,7 +70,7 @@
</span><span class="cx">     }
</span><span class="cx">     
</span><span class="cx">     static PutByIdStatus computeFor(CodeBlock*, StubInfoMap&amp;, unsigned bytecodeIndex, StringImpl* uid);
</span><del>-    static PutByIdStatus computeFor(VM&amp;, JSGlobalObject*, const StructureSet&amp;, StringImpl* uid, bool isDirect);
</del><ins>+    static PutByIdStatus computeFor(VM&amp;, JSGlobalObject*, Structure*, StringImpl* uid, bool isDirect);
</ins><span class="cx">     
</span><span class="cx">     static PutByIdStatus computeFor(CodeBlock* baselineBlock, CodeBlock* dfgBlock, StubInfoMap&amp; baselineMap, StubInfoMap&amp; dfgMap, CodeOrigin, StringImpl* uid);
</span><span class="cx">     
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorebytecodePutByIdVariantcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/bytecode/PutByIdVariant.cpp (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/bytecode/PutByIdVariant.cpp        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/Source/JavaScriptCore/bytecode/PutByIdVariant.cpp        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -30,99 +30,6 @@
</span><span class="cx"> 
</span><span class="cx"> namespace JSC {
</span><span class="cx"> 
</span><del>-Structure* PutByIdVariant::oldStructureForTransition() const
-{
-    ASSERT(kind() == Transition);
-    ASSERT(m_oldStructure.size() &lt;= 2);
-    for (unsigned i = m_oldStructure.size(); i--;) {
-        Structure* structure = m_oldStructure[i];
-        if (structure != m_newStructure)
-            return structure;
-    }
-    RELEASE_ASSERT_NOT_REACHED();
-}
-
-bool PutByIdVariant::writesStructures() const
-{
-    return kind() == Transition;
-}
-
-bool PutByIdVariant::reallocatesStorage() const
-{
-    if (kind() != Transition)
-        return false;
-    
-    if (oldStructureForTransition()-&gt;outOfLineCapacity() == newStructure()-&gt;outOfLineCapacity())
-        return false;
-    
-    return true;
-}
-
-bool PutByIdVariant::attemptToMerge(const PutByIdVariant&amp; other)
-{
-    if (m_offset != other.m_offset)
-        return false;
-    
-    switch (m_kind) {
-    case Replace:
-        switch (other.m_kind) {
-        case Replace: {
-            ASSERT(m_constantChecks.isEmpty());
-            ASSERT(other.m_constantChecks.isEmpty());
-            
-            m_oldStructure.merge(other.m_oldStructure);
-            return true;
-        }
-            
-        case Transition: {
-            PutByIdVariant newVariant = other;
-            if (newVariant.attemptToMergeTransitionWithReplace(*this)) {
-                *this = newVariant;
-                return true;
-            }
-            return false;
-        }
-            
-        default:
-            return false;
-        }
-        
-    case Transition:
-        switch (other.m_kind) {
-        case Replace:
-            return attemptToMergeTransitionWithReplace(other);
-            
-        default:
-            return false;
-        }
-        
-    default:
-        return false;
-    }
-}
-
-bool PutByIdVariant::attemptToMergeTransitionWithReplace(const PutByIdVariant&amp; replace)
-{
-    ASSERT(m_kind == Transition);
-    ASSERT(replace.m_kind == Replace);
-    ASSERT(m_offset == replace.m_offset);
-    ASSERT(!replace.writesStructures());
-    ASSERT(!replace.reallocatesStorage());
-    
-    // This sort of merging only works when we have one path along which we add a new field which
-    // transitions to structure S while the other path was already on structure S. This doesn't
-    // work if we need to reallocate anything or if the replace path is polymorphic.
-    
-    if (reallocatesStorage())
-        return false;
-    
-    if (replace.m_oldStructure.onlyStructure() != m_newStructure)
-        return false;
-    
-    m_oldStructure.merge(m_newStructure);
-    return true;
-}
-
</del><span class="cx"> void PutByIdVariant::dump(PrintStream&amp; out) const
</span><span class="cx"> {
</span><span class="cx">     dumpInContext(out, 0);
</span><span class="lines">@@ -137,12 +44,12 @@
</span><span class="cx">         
</span><span class="cx">     case Replace:
</span><span class="cx">         out.print(
</span><del>-            &quot;&lt;Replace: &quot;, inContext(structure(), context), &quot;, &quot;, offset(), &quot;&gt;&quot;);
</del><ins>+            &quot;&lt;Replace: &quot;, pointerDumpInContext(structure(), context), &quot;, &quot;, offset(), &quot;&gt;&quot;);
</ins><span class="cx">         return;
</span><span class="cx">         
</span><span class="cx">     case Transition:
</span><span class="cx">         out.print(
</span><del>-            &quot;&lt;Transition: &quot;, inContext(oldStructure(), context), &quot; -&gt; &quot;,
</del><ins>+            &quot;&lt;Transition: &quot;, pointerDumpInContext(oldStructure(), context), &quot; -&gt; &quot;,
</ins><span class="cx">             pointerDumpInContext(newStructure(), context), &quot;, [&quot;,
</span><span class="cx">             listDumpInContext(constantChecks(), context), &quot;], &quot;, offset(), &quot;&gt;&quot;);
</span><span class="cx">         return;
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorebytecodePutByIdVarianth"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/bytecode/PutByIdVariant.h (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/bytecode/PutByIdVariant.h        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/Source/JavaScriptCore/bytecode/PutByIdVariant.h        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -28,7 +28,6 @@
</span><span class="cx"> 
</span><span class="cx"> #include &quot;IntendedStructureChain.h&quot;
</span><span class="cx"> #include &quot;PropertyOffset.h&quot;
</span><del>-#include &quot;StructureSet.h&quot;
</del><span class="cx"> 
</span><span class="cx"> namespace JSC {
</span><span class="cx"> 
</span><span class="lines">@@ -42,12 +41,13 @@
</span><span class="cx">     
</span><span class="cx">     PutByIdVariant()
</span><span class="cx">         : m_kind(NotSet)
</span><del>-        , m_newStructure(nullptr)
</del><ins>+        , m_oldStructure(0)
+        , m_newStructure(0)
</ins><span class="cx">         , m_offset(invalidOffset)
</span><span class="cx">     {
</span><span class="cx">     }
</span><span class="cx">     
</span><del>-    static PutByIdVariant replace(const StructureSet&amp; structure, PropertyOffset offset)
</del><ins>+    static PutByIdVariant replace(Structure* structure, PropertyOffset offset)
</ins><span class="cx">     {
</span><span class="cx">         PutByIdVariant result;
</span><span class="cx">         result.m_kind = Replace;
</span><span class="lines">@@ -57,7 +57,7 @@
</span><span class="cx">     }
</span><span class="cx">     
</span><span class="cx">     static PutByIdVariant transition(
</span><del>-        const StructureSet&amp; oldStructure, Structure* newStructure,
</del><ins>+        Structure* oldStructure, Structure* newStructure,
</ins><span class="cx">         PassRefPtr&lt;IntendedStructureChain&gt; structureChain, PropertyOffset offset)
</span><span class="cx">     {
</span><span class="cx">         PutByIdVariant result;
</span><span class="lines">@@ -75,37 +75,27 @@
</span><span class="cx">     bool isSet() const { return kind() != NotSet; }
</span><span class="cx">     bool operator!() const { return !isSet(); }
</span><span class="cx">     
</span><del>-    const StructureSet&amp; structure() const
</del><ins>+    Structure* structure() const
</ins><span class="cx">     {
</span><span class="cx">         ASSERT(kind() == Replace);
</span><span class="cx">         return m_oldStructure;
</span><span class="cx">     }
</span><span class="cx">     
</span><del>-    const StructureSet&amp; oldStructure() const
</del><ins>+    Structure* oldStructure() const
</ins><span class="cx">     {
</span><span class="cx">         ASSERT(kind() == Transition || kind() == Replace);
</span><span class="cx">         return m_oldStructure;
</span><span class="cx">     }
</span><span class="cx">     
</span><del>-    StructureSet&amp; oldStructure()
-    {
-        ASSERT(kind() == Transition || kind() == Replace);
-        return m_oldStructure;
-    }
-    
-    Structure* oldStructureForTransition() const;
-    
</del><span class="cx">     Structure* newStructure() const
</span><span class="cx">     {
</span><span class="cx">         ASSERT(kind() == Transition);
</span><span class="cx">         return m_newStructure;
</span><span class="cx">     }
</span><del>-
-    bool writesStructures() const;
-    bool reallocatesStorage() const;
</del><span class="cx">     
</span><span class="cx">     const ConstantStructureCheckVector&amp; constantChecks() const
</span><span class="cx">     {
</span><ins>+        ASSERT(kind() == Transition);
</ins><span class="cx">         return m_constantChecks;
</span><span class="cx">     }
</span><span class="cx">     
</span><span class="lines">@@ -115,16 +105,12 @@
</span><span class="cx">         return m_offset;
</span><span class="cx">     }
</span><span class="cx">     
</span><del>-    bool attemptToMerge(const PutByIdVariant&amp; other);
-    
</del><span class="cx">     void dump(PrintStream&amp;) const;
</span><span class="cx">     void dumpInContext(PrintStream&amp;, DumpContext*) const;
</span><span class="cx"> 
</span><span class="cx"> private:
</span><del>-    bool attemptToMergeTransitionWithReplace(const PutByIdVariant&amp; replace);
-    
</del><span class="cx">     Kind m_kind;
</span><del>-    StructureSet m_oldStructure;
</del><ins>+    Structure* m_oldStructure;
</ins><span class="cx">     Structure* m_newStructure;
</span><span class="cx">     ConstantStructureCheckVector m_constantChecks;
</span><span class="cx">     PropertyOffset m_offset;
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorebytecodeStructureSetcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/bytecode/StructureSet.cpp (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/bytecode/StructureSet.cpp        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/Source/JavaScriptCore/bytecode/StructureSet.cpp        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -26,7 +26,6 @@
</span><span class="cx"> #include &quot;config.h&quot;
</span><span class="cx"> #include &quot;StructureSet.h&quot;
</span><span class="cx"> 
</span><del>-#include &quot;DFGAbstractValue.h&quot;
</del><span class="cx"> #include &lt;wtf/CommaPrinter.h&gt;
</span><span class="cx"> 
</span><span class="cx"> namespace JSC {
</span><span class="lines">@@ -161,84 +160,6 @@
</span><span class="cx">         clear();
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-#if ENABLE(DFG_JIT)
-
-namespace {
-
-class StructureAbstractValueContains {
-public:
-    StructureAbstractValueContains(const DFG::StructureAbstractValue&amp; value)
-        : m_value(value)
-    {
-    }
-    
-    bool operator()(Structure* structure)
-    {
-        return m_value.contains(structure);
-    }
-private:
-    const DFG::StructureAbstractValue&amp; m_value;
-};
-
-class SpeculatedTypeContains {
-public:
-    SpeculatedTypeContains(SpeculatedType type)
-        : m_type(type)
-    {
-    }
-    
-    bool operator()(Structure* structure)
-    {
-        return m_type &amp; speculationFromStructure(structure);
-    }
-private:
-    SpeculatedType m_type;
-};
-
-class ArrayModesContains {
-public:
-    ArrayModesContains(ArrayModes arrayModes)
-        : m_arrayModes(arrayModes)
-    {
-    }
-    
-    bool operator()(Structure* structure)
-    {
-        return m_arrayModes &amp; arrayModeFromStructure(structure);
-    }
-private:
-    ArrayModes m_arrayModes;
-};
-
-} // anonymous namespace
-
-void StructureSet::filter(const DFG::StructureAbstractValue&amp; other)
-{
-    StructureAbstractValueContains functor(other);
-    genericFilter(functor);
-}
-
-void StructureSet::filter(SpeculatedType type)
-{
-    SpeculatedTypeContains functor(type);
-    genericFilter(functor);
-}
-
-void StructureSet::filterArrayModes(ArrayModes arrayModes)
-{
-    ArrayModesContains functor(arrayModes);
-    genericFilter(functor);
-}
-
-void StructureSet::filter(const DFG::AbstractValue&amp; other)
-{
-    filter(other.m_structure);
-    filter(other.m_type);
-    filterArrayModes(other.m_arrayModes);
-}
-
-#endif // ENABLE(DFG_JIT)
-
</del><span class="cx"> bool StructureSet::isSubsetOf(const StructureSet&amp; other) const
</span><span class="cx"> {
</span><span class="cx">     if (isThin()) {
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorebytecodeStructureSeth"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/bytecode/StructureSet.h (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/bytecode/StructureSet.h        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/Source/JavaScriptCore/bytecode/StructureSet.h        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -35,7 +35,6 @@
</span><span class="cx"> 
</span><span class="cx"> namespace DFG {
</span><span class="cx"> class StructureAbstractValue;
</span><del>-struct AbstractValue;
</del><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> class StructureSet {
</span><span class="lines">@@ -73,12 +72,12 @@
</span><span class="cx">     
</span><span class="cx">     Structure* onlyStructure() const
</span><span class="cx">     {
</span><del>-        if (isThin())
</del><ins>+        if (isThin()) {
+            ASSERT(singleStructure());
</ins><span class="cx">             return singleStructure();
</span><del>-        OutOfLineList* list = structureList();
-        if (list-&gt;m_length != 1)
-            return nullptr;
-        return list-&gt;list()[0];
</del><ins>+        }
+        ASSERT(structureList()-&gt;m_length == 1);
+        return structureList()-&gt;list()[0];
</ins><span class="cx">     }
</span><span class="cx">     
</span><span class="cx">     bool isEmpty() const
</span><span class="lines">@@ -97,13 +96,6 @@
</span><span class="cx">     void filter(const StructureSet&amp;);
</span><span class="cx">     void exclude(const StructureSet&amp;);
</span><span class="cx">     
</span><del>-#if ENABLE(DFG_JIT)
-    void filter(const DFG::StructureAbstractValue&amp;);
-    void filter(SpeculatedType);
-    void filterArrayModes(ArrayModes);
-    void filter(const DFG::AbstractValue&amp;);
-#endif // ENABLE(DFG_JIT)
-    
</del><span class="cx">     template&lt;typename Functor&gt;
</span><span class="cx">     void genericFilter(Functor&amp; functor)
</span><span class="cx">     {
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorebytecodeToThisStatuscpp"></a>
<div class="delfile"><h4>Deleted: trunk/Source/JavaScriptCore/bytecode/ToThisStatus.cpp (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/bytecode/ToThisStatus.cpp        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/Source/JavaScriptCore/bytecode/ToThisStatus.cpp        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -1,72 +0,0 @@
</span><del>-/*
- * Copyright (C) 2014 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-
-#include &quot;config.h&quot;
-#include &quot;ToThisStatus.h&quot;
-
-namespace JSC {
-
-ToThisStatus merge(ToThisStatus a, ToThisStatus b)
-{
-    switch (a) {
-    case ToThisOK:
-        return b;
-    case ToThisConflicted:
-        return ToThisConflicted;
-    case ToThisClearedByGC:
-        if (b == ToThisConflicted)
-            return ToThisConflicted;
-        return ToThisClearedByGC;
-    }
-    
-    RELEASE_ASSERT_NOT_REACHED();
-    return ToThisConflicted;
-}
-
-} // namespace JSC
-
-namespace WTF {
-
-using namespace JSC;
-
-void printInternal(PrintStream&amp; out, ToThisStatus status)
-{
-    switch (status) {
-    case ToThisOK:
-        out.print(&quot;OK&quot;);
-        return;
-    case ToThisConflicted:
-        out.print(&quot;Conflicted&quot;);
-        return;
-    case ToThisClearedByGC:
-        out.print(&quot;ClearedByGC&quot;);
-        return;
-    }
-    
-    RELEASE_ASSERT_NOT_REACHED();
-}
-
-} // namespace WTF
-
</del></span></pre></div>
<a id="trunkSourceJavaScriptCorebytecodeToThisStatush"></a>
<div class="delfile"><h4>Deleted: trunk/Source/JavaScriptCore/bytecode/ToThisStatus.h (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/bytecode/ToThisStatus.h        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/Source/JavaScriptCore/bytecode/ToThisStatus.h        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -1,50 +0,0 @@
</span><del>-/*
- * Copyright (C) 2014 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-
-#ifndef ToThisStatus_h
-#define ToThisStatus_h
-
-#include &lt;wtf/PrintStream.h&gt;
-
-namespace JSC {
-
-enum ToThisStatus {
-    ToThisOK,
-    ToThisConflicted,
-    ToThisClearedByGC
-};
-
-ToThisStatus merge(ToThisStatus, ToThisStatus);
-
-} // namespace JSC
-
-namespace WTF {
-
-void printInternal(PrintStream&amp;, JSC::ToThisStatus);
-
-} // namespace WTF
-
-#endif // ToThisStatus_h
-
</del></span></pre></div>
<a id="trunkSourceJavaScriptCorebytecodeTypeLocationh"></a>
<div class="delfile"><h4>Deleted: trunk/Source/JavaScriptCore/bytecode/TypeLocation.h (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/bytecode/TypeLocation.h        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/Source/JavaScriptCore/bytecode/TypeLocation.h        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -1,57 +0,0 @@
</span><del>-/*
- * Copyright (C) 2014 Apple Inc. All Rights Reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#ifndef TypeLocation_h
-#define TypeLocation_h
-
-#include &quot;TypeSet.h&quot;
-
-namespace JSC {
-
-enum HighFidelityGlobalIDFlags {
-    HighFidelityNeedsUniqueIDGeneration = -1,
-    HighFidelityNoGlobalIDExists = -2
-};
-
-class TypeLocation {
-                       
-public:
-    TypeLocation() 
-        : m_instructionTypeSet(TypeSet::create())
-        , m_globalTypeSet(nullptr)
-    {
-    }
-
-    int64_t m_globalVariableID;
-    intptr_t m_sourceID;
-    unsigned m_line;
-    unsigned m_column;
-    RefPtr&lt;TypeSet&gt; m_instructionTypeSet;
-    RefPtr&lt;TypeSet&gt; m_globalTypeSet;
-};
-
-} //namespace JSC
-
-#endif //TypeLocation_h
</del></span></pre></div>
<a id="trunkSourceJavaScriptCorebytecompilerBytecodeGeneratorcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/Source/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -410,7 +410,6 @@
</span><span class="cx">         emitOpcode(op_to_this);
</span><span class="cx">         instructions().append(kill(&amp;m_thisRegister));
</span><span class="cx">         instructions().append(0);
</span><del>-        instructions().append(0);
</del><span class="cx">     }
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="lines">@@ -1003,10 +1002,6 @@
</span><span class="cx">     instructions().append(src-&gt;index());
</span><span class="cx">     if (captureMode == IsCaptured)
</span><span class="cx">         instructions().append(watchableVariable(dst-&gt;index()));
</span><del>-
-    if (!dst-&gt;isTemporary() &amp;&amp; isProfilingTypesWithHighFidelity())
-        emitProfileTypesWithHighFidelity(dst, true);
-
</del><span class="cx">     return dst;
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="lines">@@ -1116,18 +1111,6 @@
</span><span class="cx">     return dst;
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-void BytecodeGenerator::emitProfileTypesWithHighFidelity(RegisterID* registerToProfile, bool hasGlobalID)
-{
-    emitOpcode(op_profile_types_with_high_fidelity);
-    instructions().append(registerToProfile-&gt;index());
-    instructions().append(0); // placeholder for TypeLocation
-    // This is a flag indicating whether we should track this value to its globalID or not.
-    if (hasGlobalID)
-        instructions().append(1);
-    else
-        instructions().append(0);
-}
-
</del><span class="cx"> RegisterID* BytecodeGenerator::emitLoad(RegisterID* dst, bool b)
</span><span class="cx"> {
</span><span class="cx">     return emitLoad(dst, jsBoolean(b));
</span><span class="lines">@@ -1272,18 +1255,13 @@
</span><span class="cx">     m_codeBlock-&gt;addPropertyAccessInstruction(instructions().size());
</span><span class="cx"> 
</span><span class="cx">     // put_to_scope scope, id, value, ResolveModeAndType, Structure, Operand
</span><del>-    if (isProfilingTypesWithHighFidelity())
-        emitOpcode(op_put_to_scope_with_profile);
-    else
-        emitOpcode(op_put_to_scope);
</del><ins>+    emitOpcode(op_put_to_scope);
</ins><span class="cx">     instructions().append(scope-&gt;index());
</span><span class="cx">     instructions().append(addConstant(identifier));
</span><span class="cx">     instructions().append(value-&gt;index());
</span><span class="cx">     instructions().append(ResolveModeAndType(resolveMode, resolveType()).operand());
</span><span class="cx">     instructions().append(0);
</span><span class="cx">     instructions().append(0);
</span><del>-    if (isProfilingTypesWithHighFidelity())
-        instructions().append(0);
</del><span class="cx">     return value;
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="lines">@@ -1350,10 +1328,6 @@
</span><span class="cx">     instructions().append(0);
</span><span class="cx">     instructions().append(0);
</span><span class="cx">     instructions().append(0);
</span><del>-
-    if (isProfilingTypesWithHighFidelity())
-        emitProfileTypesWithHighFidelity(value, false);
-
</del><span class="cx">     return value;
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="lines">@@ -1450,10 +1424,6 @@
</span><span class="cx">     instructions().append(property-&gt;index());
</span><span class="cx">     instructions().append(value-&gt;index());
</span><span class="cx">     instructions().append(arrayProfile);
</span><del>-
-    if (isProfilingTypesWithHighFidelity())
-        emitProfileTypesWithHighFidelity(value, false);
-
</del><span class="cx">     return value;
</span><span class="cx"> }
</span><span class="cx"> 
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorebytecompilerBytecodeGeneratorh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/bytecompiler/BytecodeGenerator.h (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/bytecompiler/BytecodeGenerator.h        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/Source/JavaScriptCore/bytecompiler/BytecodeGenerator.h        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -332,8 +332,6 @@
</span><span class="cx">             return emitNode(n);
</span><span class="cx">         }
</span><span class="cx"> 
</span><del>-        void emitProfileTypesWithHighFidelity(RegisterID* dst, bool);
-
</del><span class="cx">         RegisterID* emitLoad(RegisterID* dst, bool);
</span><span class="cx">         RegisterID* emitLoad(RegisterID* dst, double);
</span><span class="cx">         RegisterID* emitLoad(RegisterID* dst, const Identifier&amp;);
</span><span class="lines">@@ -679,8 +677,6 @@
</span><span class="cx"> 
</span><span class="cx">         VM* m_vm;
</span><span class="cx"> 
</span><del>-        bool isProfilingTypesWithHighFidelity() { return vm()-&gt;isProfilingTypesWithHighFidelity(); }
-
</del><span class="cx">         OpcodeID m_lastOpcodeID;
</span><span class="cx"> #ifndef NDEBUG
</span><span class="cx">         size_t m_lastOpcodePosition;
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorebytecompilerNodesCodegencpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/bytecompiler/NodesCodegen.cpp (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/bytecompiler/NodesCodegen.cpp        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/Source/JavaScriptCore/bytecompiler/NodesCodegen.cpp        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -740,15 +740,13 @@
</span><span class="cx">         if (local.isReadOnly()) {
</span><span class="cx">             generator.emitReadOnlyExceptionIfNeeded();
</span><span class="cx">             localReg = generator.emitMove(generator.tempDestination(dst), localReg);
</span><del>-        } else if (local.isCaptured() || generator.isProfilingTypesWithHighFidelity()) {
</del><ins>+        } else if (local.isCaptured()) {
</ins><span class="cx">             RefPtr&lt;RegisterID&gt; tempDst = generator.finalDestination(dst);
</span><span class="cx">             ASSERT(dst != localReg);
</span><span class="cx">             RefPtr&lt;RegisterID&gt; tempDstSrc = generator.newTemporary();
</span><span class="cx">             generator.emitToNumber(tempDst.get(), localReg);
</span><span class="cx">             generator.emitMove(tempDstSrc.get(), localReg);
</span><span class="cx">             emitIncOrDec(generator, tempDstSrc.get(), m_operator);
</span><del>-            if (generator.isProfilingTypesWithHighFidelity())
-                generator.emitExpressionInfo(divot(), divotStart(), divotEnd());
</del><span class="cx">             generator.emitMove(localReg, tempDstSrc.get());
</span><span class="cx">             return tempDst.get();
</span><span class="cx">         }
</span><span class="lines">@@ -917,12 +915,10 @@
</span><span class="cx">         if (local.isReadOnly()) {
</span><span class="cx">             generator.emitReadOnlyExceptionIfNeeded();
</span><span class="cx">             localReg = generator.emitMove(generator.tempDestination(dst), localReg);
</span><del>-        } else if (local.isCaptured() || generator.isProfilingTypesWithHighFidelity()) {
</del><ins>+        } else if (local.isCaptured()) {
</ins><span class="cx">             RefPtr&lt;RegisterID&gt; tempDst = generator.tempDestination(dst);
</span><span class="cx">             generator.emitMove(tempDst.get(), localReg);
</span><span class="cx">             emitIncOrDec(generator, tempDst.get(), m_operator);
</span><del>-            if (generator.isProfilingTypesWithHighFidelity())
-                generator.emitExpressionInfo(divot(), divotStart(), divotEnd());
</del><span class="cx">             generator.emitMove(localReg, tempDst.get());
</span><span class="cx">             return generator.moveToDestinationIfNeeded(dst, tempDst.get());
</span><span class="cx">         }
</span><span class="lines">@@ -1411,7 +1407,6 @@
</span><span class="cx"> 
</span><span class="cx"> RegisterID* ReadModifyResolveNode::emitBytecode(BytecodeGenerator&amp; generator, RegisterID* dst)
</span><span class="cx"> {
</span><del>-    JSTextPosition newDivot = divotStart() + m_ident.length();
</del><span class="cx">     if (Local local = generator.local(m_ident)) {
</span><span class="cx">         if (local.isReadOnly()) {
</span><span class="cx">             generator.emitReadOnlyExceptionIfNeeded();
</span><span class="lines">@@ -1419,13 +1414,10 @@
</span><span class="cx">         }
</span><span class="cx">         
</span><span class="cx">         if (local.isCaptured()
</span><del>-            || generator.isProfilingTypesWithHighFidelity()
</del><span class="cx">             || generator.leftHandSideNeedsCopy(m_rightHasAssignments, m_right-&gt;isPure(generator))) {
</span><span class="cx">             RefPtr&lt;RegisterID&gt; result = generator.newTemporary();
</span><span class="cx">             generator.emitMove(result.get(), local.get());
</span><span class="cx">             emitReadModifyAssignment(generator, result.get(), result.get(), m_right, m_operator, OperandTypes(ResultType::unknownType(), m_right-&gt;resultDescriptor()));
</span><del>-            if (generator.isProfilingTypesWithHighFidelity())
-                generator.emitExpressionInfo(newDivot, divotStart(), newDivot);
</del><span class="cx">             generator.emitMove(local.get(), result.get());
</span><span class="cx">             return generator.moveToDestinationIfNeeded(dst, result.get());
</span><span class="cx">         }
</span><span class="lines">@@ -1434,6 +1426,7 @@
</span><span class="cx">         return generator.moveToDestinationIfNeeded(dst, result);
</span><span class="cx">     }
</span><span class="cx"> 
</span><ins>+    JSTextPosition newDivot = divotStart() + m_ident.length();
</ins><span class="cx">     generator.emitExpressionInfo(newDivot, divotStart(), newDivot);
</span><span class="cx">     RefPtr&lt;RegisterID&gt; scope = generator.emitResolveScope(generator.newTemporary(), m_ident);
</span><span class="cx">     RefPtr&lt;RegisterID&gt; value = generator.emitGetFromScope(generator.newTemporary(), scope.get(), m_ident, ThrowIfNotFound);
</span><span class="lines">@@ -1450,11 +1443,9 @@
</span><span class="cx">             generator.emitReadOnlyExceptionIfNeeded();
</span><span class="cx">             return generator.emitNode(dst, m_right);
</span><span class="cx">         }
</span><del>-        if (local.isCaptured() || generator.isProfilingTypesWithHighFidelity()) {
</del><ins>+        if (local.isCaptured()) {
</ins><span class="cx">             RefPtr&lt;RegisterID&gt; tempDst = generator.tempDestination(dst);
</span><span class="cx">             generator.emitNode(tempDst.get(), m_right);
</span><del>-            if (generator.isProfilingTypesWithHighFidelity())
-                generator.emitExpressionInfo(divot(), divotStart(), divotEnd());
</del><span class="cx">             generator.emitMove(local.get(), tempDst.get());
</span><span class="cx">             return generator.moveToDestinationIfNeeded(dst, tempDst.get());
</span><span class="cx">         }
</span><span class="lines">@@ -1557,8 +1548,7 @@
</span><span class="cx">         if (!m_init)
</span><span class="cx">             return local.get();
</span><span class="cx"> 
</span><del>-        // FIXME: Maybe call emitExpressionInfo here.
-        if (local.isCaptured() || generator.isProfilingTypesWithHighFidelity()) {
</del><ins>+        if (local.isCaptured()) {
</ins><span class="cx">             RefPtr&lt;RegisterID&gt; tempDst = generator.newTemporary();
</span><span class="cx">             generator.emitNode(tempDst.get(), m_init);
</span><span class="cx">             return generator.emitMove(local.get(), tempDst.get());
</span><span class="lines">@@ -1881,8 +1871,7 @@
</span><span class="cx">             Identifier ident = simpleBinding-&gt;boundProperty();
</span><span class="cx">             Local local = generator.local(ident);
</span><span class="cx">             propertyName = local.get();
</span><del>-            // FIXME: Should I emit expression info here?
-            if (!propertyName || local.isCaptured() || generator.isProfilingTypesWithHighFidelity())
</del><ins>+            if (!propertyName || local.isCaptured())
</ins><span class="cx">                 goto genericBinding;
</span><span class="cx">             expectedSubscript = generator.emitMove(generator.newTemporary(), propertyName);
</span><span class="cx">             generator.pushOptimisedForIn(expectedSubscript.get(), iter.get(), i.get(), propertyName);
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredebuggerDebuggerActivationcpp"></a>
<div class="addfile"><h4>Added: trunk/Source/JavaScriptCore/debugger/DebuggerActivation.cpp (0 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/debugger/DebuggerActivation.cpp                                (rev 0)
+++ trunk/Source/JavaScriptCore/debugger/DebuggerActivation.cpp        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -0,0 +1,98 @@
</span><ins>+/*
+ * Copyright (C) 2008, 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include &quot;config.h&quot;
+#include &quot;DebuggerActivation.h&quot;
+
+#include &quot;JSActivation.h&quot;
+#include &quot;JSCInlines.h&quot;
+
+namespace JSC {
+
+STATIC_ASSERT_IS_TRIVIALLY_DESTRUCTIBLE(DebuggerActivation);
+
+const ClassInfo DebuggerActivation::s_info = { &quot;DebuggerActivation&quot;, &amp;Base::s_info, 0, 0, CREATE_METHOD_TABLE(DebuggerActivation) };
+
+DebuggerActivation::DebuggerActivation(VM&amp; vm)
+    : JSNonFinalObject(vm, vm.debuggerActivationStructure.get())
+{
+}
+
+void DebuggerActivation::finishCreation(VM&amp; vm, JSObject* activation)
+{
+    Base::finishCreation(vm);
+    ASSERT(activation);
+    ASSERT(activation-&gt;isActivationObject());
+    m_activation.set(vm, this, jsCast&lt;JSActivation*&gt;(activation));
+}
+
+void DebuggerActivation::visitChildren(JSCell* cell, SlotVisitor&amp; visitor)
+{
+    DebuggerActivation* thisObject = jsCast&lt;DebuggerActivation*&gt;(cell);
+    ASSERT_GC_OBJECT_INHERITS(thisObject, info());
+    COMPILE_ASSERT(StructureFlags &amp; OverridesVisitChildren, OverridesVisitChildrenWithoutSettingFlag);
+    ASSERT(thisObject-&gt;structure()-&gt;typeInfo().overridesVisitChildren());
+
+    JSObject::visitChildren(thisObject, visitor);
+    visitor.append(&amp;thisObject-&gt;m_activation);
+}
+
+String DebuggerActivation::className(const JSObject* object)
+{
+    const DebuggerActivation* thisObject = jsCast&lt;const DebuggerActivation*&gt;(object);
+    return thisObject-&gt;m_activation-&gt;methodTable()-&gt;className(thisObject-&gt;m_activation.get());
+}
+
+bool DebuggerActivation::getOwnPropertySlot(JSObject* object, ExecState* exec, PropertyName propertyName, PropertySlot&amp; slot)
+{
+    DebuggerActivation* thisObject = jsCast&lt;DebuggerActivation*&gt;(object);
+    return thisObject-&gt;m_activation-&gt;methodTable()-&gt;getOwnPropertySlot(thisObject-&gt;m_activation.get(), exec, propertyName, slot);
+}
+
+void DebuggerActivation::put(JSCell* cell, ExecState* exec, PropertyName propertyName, JSValue value, PutPropertySlot&amp; slot)
+{
+    DebuggerActivation* thisObject = jsCast&lt;DebuggerActivation*&gt;(cell);
+    thisObject-&gt;m_activation-&gt;methodTable()-&gt;put(thisObject-&gt;m_activation.get(), exec, propertyName, value, slot);
+}
+
+bool DebuggerActivation::deleteProperty(JSCell* cell, ExecState* exec, PropertyName propertyName)
+{
+    DebuggerActivation* thisObject = jsCast&lt;DebuggerActivation*&gt;(cell);
+    return thisObject-&gt;m_activation-&gt;methodTable()-&gt;deleteProperty(thisObject-&gt;m_activation.get(), exec, propertyName);
+}
+
+void DebuggerActivation::getOwnPropertyNames(JSObject* object, ExecState* exec, PropertyNameArray&amp; propertyNames, EnumerationMode mode)
+{
+    DebuggerActivation* thisObject = jsCast&lt;DebuggerActivation*&gt;(object);
+    thisObject-&gt;m_activation-&gt;methodTable()-&gt;getPropertyNames(thisObject-&gt;m_activation.get(), exec, propertyNames, mode);
+}
+
+bool DebuggerActivation::defineOwnProperty(JSObject* object, ExecState* exec, PropertyName propertyName, const PropertyDescriptor&amp; descriptor, bool shouldThrow)
+{
+    DebuggerActivation* thisObject = jsCast&lt;DebuggerActivation*&gt;(object);
+    return thisObject-&gt;m_activation-&gt;methodTable()-&gt;defineOwnProperty(thisObject-&gt;m_activation.get(), exec, propertyName, descriptor, shouldThrow);
+}
+
+} // namespace JSC
</ins></span></pre></div>
<a id="trunkSourceJavaScriptCoredebuggerDebuggerActivationh"></a>
<div class="addfile"><h4>Added: trunk/Source/JavaScriptCore/debugger/DebuggerActivation.h (0 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/debugger/DebuggerActivation.h                                (rev 0)
+++ trunk/Source/JavaScriptCore/debugger/DebuggerActivation.h        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -0,0 +1,71 @@
</span><ins>+/*
+ * Copyright (C) 2008, 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef DebuggerActivation_h
+#define DebuggerActivation_h
+
+#include &quot;JSObject.h&quot;
+
+namespace JSC {
+
+class DebuggerActivation : public JSNonFinalObject {
+public:
+    typedef JSNonFinalObject Base;
+
+    static DebuggerActivation* create(VM&amp; vm, JSObject* object)
+    {
+        DebuggerActivation* activation = new (NotNull, allocateCell&lt;DebuggerActivation&gt;(vm.heap)) DebuggerActivation(vm);
+        activation-&gt;finishCreation(vm, object);
+        return activation;
+    }
+
+    static void visitChildren(JSCell*, SlotVisitor&amp;);
+    static String className(const JSObject*);
+    static bool getOwnPropertySlot(JSObject*, ExecState*, PropertyName, PropertySlot&amp;);
+    static void put(JSCell*, ExecState*, PropertyName, JSValue, PutPropertySlot&amp;);
+    static bool deleteProperty(JSCell*, ExecState*, PropertyName);
+    static void getOwnPropertyNames(JSObject*, ExecState*, PropertyNameArray&amp;, EnumerationMode);
+    static bool defineOwnProperty(JSObject*, ExecState*, PropertyName, const PropertyDescriptor&amp;, bool shouldThrow);
+
+    DECLARE_EXPORT_INFO;
+
+    static Structure* createStructure(VM&amp; vm, JSGlobalObject* globalObject, JSValue prototype) 
+    {
+        return Structure::create(vm, globalObject, prototype, TypeInfo(ObjectType, StructureFlags), info()); 
+    }
+
+protected:
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | OverridesVisitChildren | JSObject::StructureFlags;
+
+    JS_EXPORT_PRIVATE void finishCreation(VM&amp;, JSObject* activation);
+
+private:
+    JS_EXPORT_PRIVATE DebuggerActivation(VM&amp;);
+    WriteBarrier&lt;JSActivation&gt; m_activation;
+};
+
+} // namespace JSC
+
+#endif // DebuggerActivation_h
</ins></span></pre></div>
<a id="trunkSourceJavaScriptCoredebuggerDebuggerScopecpp"></a>
<div class="delfile"><h4>Deleted: trunk/Source/JavaScriptCore/debugger/DebuggerScope.cpp (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/debugger/DebuggerScope.cpp        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/Source/JavaScriptCore/debugger/DebuggerScope.cpp        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -1,98 +0,0 @@
</span><del>-/*
- * Copyright (C) 2008-2009, 2014 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-
-#include &quot;config.h&quot;
-#include &quot;DebuggerScope.h&quot;
-
-#include &quot;JSActivation.h&quot;
-#include &quot;JSCInlines.h&quot;
-
-namespace JSC {
-
-STATIC_ASSERT_IS_TRIVIALLY_DESTRUCTIBLE(DebuggerScope);
-
-const ClassInfo DebuggerScope::s_info = { &quot;DebuggerScope&quot;, &amp;Base::s_info, 0, 0, CREATE_METHOD_TABLE(DebuggerScope) };
-
-DebuggerScope::DebuggerScope(VM&amp; vm)
-    : JSNonFinalObject(vm, vm.debuggerScopeStructure.get())
-{
-}
-
-void DebuggerScope::finishCreation(VM&amp; vm, JSObject* activation)
-{
-    Base::finishCreation(vm);
-    ASSERT(activation);
-    ASSERT(activation-&gt;isActivationObject());
-    m_activation.set(vm, this, jsCast&lt;JSActivation*&gt;(activation));
-}
-
-void DebuggerScope::visitChildren(JSCell* cell, SlotVisitor&amp; visitor)
-{
-    DebuggerScope* thisObject = jsCast&lt;DebuggerScope*&gt;(cell);
-    ASSERT_GC_OBJECT_INHERITS(thisObject, info());
-    COMPILE_ASSERT(StructureFlags &amp; OverridesVisitChildren, OverridesVisitChildrenWithoutSettingFlag);
-    ASSERT(thisObject-&gt;structure()-&gt;typeInfo().overridesVisitChildren());
-
-    JSObject::visitChildren(thisObject, visitor);
-    visitor.append(&amp;thisObject-&gt;m_activation);
-}
-
-String DebuggerScope::className(const JSObject* object)
-{
-    const DebuggerScope* thisObject = jsCast&lt;const DebuggerScope*&gt;(object);
-    return thisObject-&gt;m_activation-&gt;methodTable()-&gt;className(thisObject-&gt;m_activation.get());
-}
-
-bool DebuggerScope::getOwnPropertySlot(JSObject* object, ExecState* exec, PropertyName propertyName, PropertySlot&amp; slot)
-{
-    DebuggerScope* thisObject = jsCast&lt;DebuggerScope*&gt;(object);
-    return thisObject-&gt;m_activation-&gt;methodTable()-&gt;getOwnPropertySlot(thisObject-&gt;m_activation.get(), exec, propertyName, slot);
-}
-
-void DebuggerScope::put(JSCell* cell, ExecState* exec, PropertyName propertyName, JSValue value, PutPropertySlot&amp; slot)
-{
-    DebuggerScope* thisObject = jsCast&lt;DebuggerScope*&gt;(cell);
-    thisObject-&gt;m_activation-&gt;methodTable()-&gt;put(thisObject-&gt;m_activation.get(), exec, propertyName, value, slot);
-}
-
-bool DebuggerScope::deleteProperty(JSCell* cell, ExecState* exec, PropertyName propertyName)
-{
-    DebuggerScope* thisObject = jsCast&lt;DebuggerScope*&gt;(cell);
-    return thisObject-&gt;m_activation-&gt;methodTable()-&gt;deleteProperty(thisObject-&gt;m_activation.get(), exec, propertyName);
-}
-
-void DebuggerScope::getOwnPropertyNames(JSObject* object, ExecState* exec, PropertyNameArray&amp; propertyNames, EnumerationMode mode)
-{
-    DebuggerScope* thisObject = jsCast&lt;DebuggerScope*&gt;(object);
-    thisObject-&gt;m_activation-&gt;methodTable()-&gt;getPropertyNames(thisObject-&gt;m_activation.get(), exec, propertyNames, mode);
-}
-
-bool DebuggerScope::defineOwnProperty(JSObject* object, ExecState* exec, PropertyName propertyName, const PropertyDescriptor&amp; descriptor, bool shouldThrow)
-{
-    DebuggerScope* thisObject = jsCast&lt;DebuggerScope*&gt;(object);
-    return thisObject-&gt;m_activation-&gt;methodTable()-&gt;defineOwnProperty(thisObject-&gt;m_activation.get(), exec, propertyName, descriptor, shouldThrow);
-}
-
-} // namespace JSC
</del></span></pre></div>
<a id="trunkSourceJavaScriptCoredebuggerDebuggerScopeh"></a>
<div class="delfile"><h4>Deleted: trunk/Source/JavaScriptCore/debugger/DebuggerScope.h (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/debugger/DebuggerScope.h        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/Source/JavaScriptCore/debugger/DebuggerScope.h        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -1,71 +0,0 @@
</span><del>-/*
- * Copyright (C) 2008-2009, 2014 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-
-#ifndef DebuggerScope_h
-#define DebuggerScope_h
-
-#include &quot;JSObject.h&quot;
-
-namespace JSC {
-
-class DebuggerScope : public JSNonFinalObject {
-public:
-    typedef JSNonFinalObject Base;
-
-    static DebuggerScope* create(VM&amp; vm, JSObject* object)
-    {
-        DebuggerScope* activation = new (NotNull, allocateCell&lt;DebuggerScope&gt;(vm.heap)) DebuggerScope(vm);
-        activation-&gt;finishCreation(vm, object);
-        return activation;
-    }
-
-    static void visitChildren(JSCell*, SlotVisitor&amp;);
-    static String className(const JSObject*);
-    static bool getOwnPropertySlot(JSObject*, ExecState*, PropertyName, PropertySlot&amp;);
-    static void put(JSCell*, ExecState*, PropertyName, JSValue, PutPropertySlot&amp;);
-    static bool deleteProperty(JSCell*, ExecState*, PropertyName);
-    static void getOwnPropertyNames(JSObject*, ExecState*, PropertyNameArray&amp;, EnumerationMode);
-    static bool defineOwnProperty(JSObject*, ExecState*, PropertyName, const PropertyDescriptor&amp;, bool shouldThrow);
-
-    DECLARE_EXPORT_INFO;
-
-    static Structure* createStructure(VM&amp; vm, JSGlobalObject* globalObject, JSValue prototype) 
-    {
-        return Structure::create(vm, globalObject, prototype, TypeInfo(ObjectType, StructureFlags), info()); 
-    }
-
-protected:
-    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | OverridesVisitChildren | JSObject::StructureFlags;
-
-    JS_EXPORT_PRIVATE void finishCreation(VM&amp;, JSObject* activation);
-
-private:
-    JS_EXPORT_PRIVATE DebuggerScope(VM&amp;);
-    WriteBarrier&lt;JSActivation&gt; m_activation;
-};
-
-} // namespace JSC
-
-#endif // DebuggerScope_h
</del></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGAbstractInterpreterInlinesh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -1388,45 +1388,46 @@
</span><span class="cx">         break;
</span><span class="cx">             
</span><span class="cx">     case GetById:
</span><del>-    case GetByIdFlush: {
</del><ins>+    case GetByIdFlush:
</ins><span class="cx">         if (!node-&gt;prediction()) {
</span><span class="cx">             m_state.setIsValid(false);
</span><span class="cx">             break;
</span><span class="cx">         }
</span><del>-        
-        AbstractValue&amp; value = forNode(node-&gt;child1());
-        if (!value.m_structure.isTop() &amp;&amp; !value.m_structure.isClobbered()
-            &amp;&amp; (node-&gt;child1().useKind() == CellUse || !(value.m_type &amp; ~SpecCell))) {
-            GetByIdStatus status = GetByIdStatus::computeFor(
-                m_graph.m_vm, value.m_structure.set(),
-                m_graph.identifiers()[node-&gt;identifierNumber()]);
-            if (status.isSimple()) {
-                // Figure out what the result is going to be - is it TOP, a constant, or maybe
-                // something more subtle?
-                AbstractValue result;
-                for (unsigned i = status.numVariants(); i--;) {
-                    if (!status[i].specificValue()) {
-                        result.makeHeapTop();
-                        break;
-                    }
</del><ins>+        if (isCellSpeculation(node-&gt;child1()-&gt;prediction())) {
+            // This use of onlyStructure() should be replaced by giving GetByIdStatus the ability
+            // to compute things based on a StructureSet, and then to factor ByteCodeParser's
+            // ability to generate code based on a GetByIdStatus out of ByteCodeParser so that
+            // ConstantFoldingPhase can use it.
+            // https://bugs.webkit.org/show_bug.cgi?id=133229
+            if (Structure* structure = forNode(node-&gt;child1()).m_structure.onlyStructure()) {
+                GetByIdStatus status = GetByIdStatus::computeFor(
+                    m_graph.m_vm, structure,
+                    m_graph.identifiers()[node-&gt;identifierNumber()]);
+                if (status.isSimple() &amp;&amp; status.numVariants() == 1) {
+                    // Assert things that we can't handle and that the computeFor() method
+                    // above won't be able to return.
+                    ASSERT(status[0].structureSet().size() == 1);
+                    ASSERT(status[0].constantChecks().isEmpty());
+                    ASSERT(!status[0].alternateBase());
</ins><span class="cx">                     
</span><del>-                    AbstractValue thisResult;
-                    thisResult.set(
-                        m_graph, *m_graph.freeze(status[i].specificValue()),
-                        m_state.structureClobberState());
-                    result.merge(thisResult);
-                }
-                if (status.numVariants() == 1 || isFTL(m_graph.m_plan.mode))
</del><ins>+                    if (status[0].specificValue()) {
+                        if (status[0].specificValue().isCell()) {
+                            Structure* structure = status[0].specificValue().asCell()-&gt;structure();
+                            m_graph.watchpoints().consider(structure);
+                        }
+                        setConstant(node, *m_graph.freeze(status[0].specificValue()));
+                    } else
+                        forNode(node).makeHeapTop();
+                    filter(node-&gt;child1(), status[0].structureSet());
+                    
</ins><span class="cx">                     m_state.setFoundConstants(true);
</span><del>-                forNode(node) = result;
-                break;
</del><ins>+                    break;
+                }
</ins><span class="cx">             }
</span><span class="cx">         }
</span><del>-
</del><span class="cx">         clobberWorld(node-&gt;origin.semantic, clobberLimit);
</span><span class="cx">         forNode(node).makeHeapTop();
</span><span class="cx">         break;
</span><del>-    }
</del><span class="cx">             
</span><span class="cx">     case GetArrayLength:
</span><span class="cx">         forNode(node).setType(SpecInt32);
</span><span class="lines">@@ -1461,14 +1462,11 @@
</span><span class="cx">     }
</span><span class="cx">         
</span><span class="cx">     case PutStructure:
</span><ins>+    case PhantomPutStructure:
</ins><span class="cx">         if (!forNode(node-&gt;child1()).m_structure.isClear()) {
</span><del>-            if (forNode(node-&gt;child1()).m_structure.onlyStructure() == node-&gt;transition()-&gt;next)
-                m_state.setFoundConstants(true);
-            else {
-                observeTransition(
-                    clobberLimit, node-&gt;transition()-&gt;previous, node-&gt;transition()-&gt;next);
-                forNode(node-&gt;child1()).changeStructure(m_graph, node-&gt;transition()-&gt;next);
-            }
</del><ins>+            observeTransition(
+                clobberLimit, node-&gt;transition()-&gt;previous, node-&gt;transition()-&gt;next);
+            forNode(node-&gt;child1()).set(m_graph, node-&gt;transition()-&gt;next);
</ins><span class="cx">         }
</span><span class="cx">         break;
</span><span class="cx">     case GetButterfly:
</span><span class="lines">@@ -1597,45 +1595,39 @@
</span><span class="cx">     }
</span><span class="cx">         
</span><span class="cx">     case MultiGetByOffset: {
</span><del>-        // This code will filter the base value in a manner that is possibly different (either more
-        // or less precise) than the way it would be filtered if this was strength-reduced to a
-        // CheckStructure. This is fine. It's legal for different passes over the code to prove
-        // different things about the code, so long as all of them are sound. That even includes
-        // one guy proving that code should never execute (due to a contradiction) and another guy
-        // not finding that contradiction. If someone ever proved that there would be a
-        // contradiction then there must always be a contradiction even if subsequent passes don't
-        // realize it. This is the case here.
-        
-        // Ordinarily you have to be careful with calling setFoundConstants()
-        // because of the effect on compile times, but this node is FTL-only.
-        m_state.setFoundConstants(true);
-        
-        AbstractValue base = forNode(node-&gt;child1());
-        StructureSet baseSet;
-        AbstractValue result;
-        for (unsigned i = node-&gt;multiGetByOffsetData().variants.size(); i--;) {
-            GetByIdVariant&amp; variant = node-&gt;multiGetByOffsetData().variants[i];
-            StructureSet set = variant.structureSet();
-            set.filter(base);
-            if (set.isEmpty())
-                continue;
-            baseSet.merge(set);
-            if (!variant.specificValue()) {
-                result.makeHeapTop();
-                continue;
</del><ins>+        AbstractValue&amp; value = forNode(node-&gt;child1());
+        ASSERT(!(value.m_type &amp; ~SpecCell)); // Edge filtering should have already ensured this.
+
+        // This should just filter down the cases in MultiGetByOffset. If that results in all
+        // cases having the same offset then we should strength reduce it to a CheckStructure +
+        // GetByOffset.
+        // https://bugs.webkit.org/show_bug.cgi?id=133229
+        if (Structure* structure = value.m_structure.onlyStructure()) {
+            bool done = false;
+            for (unsigned i = node-&gt;multiGetByOffsetData().variants.size(); i--;) {
+                const GetByIdVariant&amp; variant = node-&gt;multiGetByOffsetData().variants[i];
+                if (!variant.structureSet().contains(structure))
+                    continue;
+                
+                if (variant.alternateBase())
+                    break;
+                
+                filter(value, structure);
+                forNode(node).makeHeapTop();
+                m_state.setFoundConstants(true);
+                done = true;
+                break;
</ins><span class="cx">             }
</span><del>-            AbstractValue thisResult;
-            thisResult.set(
-                m_graph,
-                *m_graph.freeze(variant.specificValue()),
-                m_state.structureClobberState());
-            result.merge(thisResult);
</del><ins>+            if (done)
+                break;
</ins><span class="cx">         }
</span><span class="cx">         
</span><del>-        if (forNode(node-&gt;child1()).changeStructure(m_graph, baseSet) == Contradiction)
-            m_state.setIsValid(false);
</del><ins>+        StructureSet set;
+        for (unsigned i = node-&gt;multiGetByOffsetData().variants.size(); i--;)
+            set.merge(node-&gt;multiGetByOffsetData().variants[i].structureSet());
</ins><span class="cx">         
</span><del>-        forNode(node) = result;
</del><ins>+        filter(node-&gt;child1(), set);
+        forNode(node).makeHeapTop();
</ins><span class="cx">         break;
</span><span class="cx">     }
</span><span class="cx">             
</span><span class="lines">@@ -1644,36 +1636,57 @@
</span><span class="cx">     }
</span><span class="cx">         
</span><span class="cx">     case MultiPutByOffset: {
</span><ins>+        AbstractValue&amp; value = forNode(node-&gt;child1());
+        ASSERT(!(value.m_type &amp; ~SpecCell)); // Edge filtering should have already ensured this.
+
+        // This should just filter down the cases in MultiPutByOffset. If that results in either
+        // one case, or nothing but replace cases and they have the same offset, then we should
+        // just strength reduce it to the appropriate combination of CheckStructure,
+        // [Re]AllocatePropertyStorage, PutStructure, and PutByOffset.
+        // https://bugs.webkit.org/show_bug.cgi?id=133229
+        if (Structure* structure = value.m_structure.onlyStructure()) {
+            bool done = false;
+            for (unsigned i = node-&gt;multiPutByOffsetData().variants.size(); i--;) {
+                const PutByIdVariant&amp; variant = node-&gt;multiPutByOffsetData().variants[i];
+                if (variant.oldStructure() != structure)
+                    continue;
+                
+                if (variant.kind() == PutByIdVariant::Replace) {
+                    filter(node-&gt;child1(), structure);
+                    m_state.setFoundConstants(true);
+                    done = true;
+                    break;
+                }
+                
+                ASSERT(variant.kind() == PutByIdVariant::Transition);
+                clobberStructures(clobberLimit);
+                forNode(node-&gt;child1()).set(m_graph, variant.newStructure());
+                m_state.setFoundConstants(true);
+                done = true;
+                break;
+            }
+            if (done)
+                break;
+        }
+        
+        StructureSet oldSet;
</ins><span class="cx">         StructureSet newSet;
</span><span class="cx">         TransitionVector transitions;
</span><del>-        
-        // Ordinarily you have to be careful with calling setFoundConstants()
-        // because of the effect on compile times, but this node is FTL-only.
-        m_state.setFoundConstants(true);
-        
-        AbstractValue base = forNode(node-&gt;child1());
-        
</del><span class="cx">         for (unsigned i = node-&gt;multiPutByOffsetData().variants.size(); i--;) {
</span><span class="cx">             const PutByIdVariant&amp; variant = node-&gt;multiPutByOffsetData().variants[i];
</span><del>-            StructureSet thisSet = variant.oldStructure();
-            thisSet.filter(base);
-            if (thisSet.isEmpty())
-                continue;
</del><ins>+            oldSet.add(variant.oldStructure());
</ins><span class="cx">             if (variant.kind() == PutByIdVariant::Transition) {
</span><del>-                if (thisSet.onlyStructure() != variant.newStructure()) {
-                    transitions.append(
-                        Transition(variant.oldStructureForTransition(), variant.newStructure()));
-                } // else this is really a replace.
</del><ins>+                transitions.append(Transition(variant.oldStructure(), variant.newStructure()));
</ins><span class="cx">                 newSet.add(variant.newStructure());
</span><span class="cx">             } else {
</span><span class="cx">                 ASSERT(variant.kind() == PutByIdVariant::Replace);
</span><del>-                newSet.merge(thisSet);
</del><ins>+                newSet.add(variant.oldStructure());
</ins><span class="cx">             }
</span><span class="cx">         }
</span><span class="cx">         
</span><ins>+        filter(node-&gt;child1(), oldSet);
</ins><span class="cx">         observeTransitions(clobberLimit, transitions);
</span><del>-        if (forNode(node-&gt;child1()).changeStructure(m_graph, newSet) == Contradiction)
-            m_state.setIsValid(false);
</del><ins>+        forNode(node-&gt;child1()).set(m_graph, newSet);
</ins><span class="cx">         break;
</span><span class="cx">     }
</span><span class="cx">     
</span><span class="lines">@@ -1702,47 +1715,37 @@
</span><span class="cx">         
</span><span class="cx">     case PutById:
</span><span class="cx">     case PutByIdFlush:
</span><del>-    case PutByIdDirect: {
-        AbstractValue&amp; value = forNode(node-&gt;child1());
-        if (!value.m_structure.isTop() &amp;&amp; !value.m_structure.isClobbered()) {
</del><ins>+    case PutByIdDirect:
+        // This use of onlyStructure() should be replaced by giving PutByIdStatus the ability
+        // to compute things based on a StructureSet, and then to factor ByteCodeParser's
+        // ability to generate code based on a PutByIdStatus out of ByteCodeParser so that
+        // ConstantFoldingPhase can use it.
+        // https://bugs.webkit.org/show_bug.cgi?id=133229
+        if (Structure* structure = forNode(node-&gt;child1()).m_structure.onlyStructure()) {
</ins><span class="cx">             PutByIdStatus status = PutByIdStatus::computeFor(
</span><span class="cx">                 m_graph.m_vm,
</span><span class="cx">                 m_graph.globalObjectFor(node-&gt;origin.semantic),
</span><del>-                value.m_structure.set(),
</del><ins>+                structure,
</ins><span class="cx">                 m_graph.identifiers()[node-&gt;identifierNumber()],
</span><span class="cx">                 node-&gt;op() == PutByIdDirect);
</span><del>-            
-            if (status.isSimple()) {
-                StructureSet newSet;
-                TransitionVector transitions;
-                
-                for (unsigned i = status.numVariants(); i--;) {
-                    const PutByIdVariant&amp; variant = status[i];
-                    if (variant.kind() == PutByIdVariant::Transition) {
-                        transitions.append(
-                            Transition(
-                                variant.oldStructureForTransition(), variant.newStructure()));
-                        m_graph.watchpoints().consider(variant.newStructure());
-                        newSet.add(variant.newStructure());
-                    } else {
-                        ASSERT(variant.kind() == PutByIdVariant::Replace);
-                        newSet.merge(variant.oldStructure());
-                    }
</del><ins>+            if (status.isSimple() &amp;&amp; status.numVariants() == 1) {
+                if (status[0].kind() == PutByIdVariant::Replace) {
+                    filter(node-&gt;child1(), structure);
+                    m_state.setFoundConstants(true);
+                    break;
</ins><span class="cx">                 }
</span><del>-                
-                if (status.numVariants() == 1 || isFTL(m_graph.m_plan.mode))
</del><ins>+                if (status[0].kind() == PutByIdVariant::Transition
+                    &amp;&amp; structure-&gt;transitionWatchpointSetHasBeenInvalidated()) {
+                    m_graph.watchpoints().consider(status[0].newStructure());
+                    clobberStructures(clobberLimit);
+                    forNode(node-&gt;child1()).set(m_graph, status[0].newStructure());
</ins><span class="cx">                     m_state.setFoundConstants(true);
</span><del>-                
-                observeTransitions(clobberLimit, transitions);
-                if (forNode(node-&gt;child1()).changeStructure(m_graph, newSet) == Contradiction)
-                    m_state.setIsValid(false);
-                break;
</del><ins>+                    break;
+                }
</ins><span class="cx">             }
</span><span class="cx">         }
</span><del>-        
</del><span class="cx">         clobberWorld(node-&gt;origin.semantic, clobberLimit);
</span><span class="cx">         break;
</span><del>-    }
</del><span class="cx">         
</span><span class="cx">     case In:
</span><span class="cx">         // FIXME: We can determine when the property definitely exists based on abstract
</span><span class="lines">@@ -1945,8 +1948,7 @@
</span><span class="cx"> {
</span><span class="cx">     AbstractValue::TransitionObserver transitionObserver(from, to);
</span><span class="cx">     forAllValues(clobberLimit, transitionObserver);
</span><del>-    
-    ASSERT(!from-&gt;dfgShouldWatch()); // We don't need to claim to be in a clobbered state because 'from' was never watchable (during the time we were compiling), hence no constants ever introduced into the DFG IR that ever had a watchable structure would ever have the same structure as from.
</del><ins>+    setDidClobber();
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> template&lt;typename AbstractStateType&gt;
</span><span class="lines">@@ -1955,12 +1957,7 @@
</span><span class="cx"> {
</span><span class="cx">     AbstractValue::TransitionsObserver transitionsObserver(vector);
</span><span class="cx">     forAllValues(clobberLimit, transitionsObserver);
</span><del>-    
-    if (!ASSERT_DISABLED) {
-        // We don't need to claim to be in a clobbered state because none of the Transition::previous structures are watchable.
-        for (unsigned i = vector.size(); i--;)
-            ASSERT(!vector[i].previous-&gt;dfgShouldWatch());
-    }
</del><ins>+    setDidClobber();
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> template&lt;typename AbstractStateType&gt;
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGAbstractValuecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGAbstractValue.cpp (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGAbstractValue.cpp        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/Source/JavaScriptCore/dfg/DFGAbstractValue.cpp        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -191,17 +191,6 @@
</span><span class="cx">     return normalizeClarity(graph);
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-FiltrationResult AbstractValue::changeStructure(Graph&amp; graph, const StructureSet&amp; other)
-{
-    m_type &amp;= other.speculationFromStructures();
-    m_arrayModes = other.arrayModesFromStructures();
-    m_structure = other;
-    
-    filterValueByType();
-    
-    return normalizeClarity(graph);
-}
-
</del><span class="cx"> FiltrationResult AbstractValue::filterArrayModes(ArrayModes arrayModes)
</span><span class="cx"> {
</span><span class="cx">     ASSERT(arrayModes);
</span><span class="lines">@@ -252,13 +241,6 @@
</span><span class="cx">     return result;
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-bool AbstractValue::contains(Structure* structure) const
-{
-    return couldBeType(speculationFromStructure(structure))
-        &amp;&amp; (m_arrayModes &amp; arrayModeFromStructure(structure))
-        &amp;&amp; m_structure.contains(structure);
-}
-
</del><span class="cx"> FiltrationResult AbstractValue::filter(const AbstractValue&amp; other)
</span><span class="cx"> {
</span><span class="cx">     m_type &amp;= other.m_type;
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGAbstractValueh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGAbstractValue.h (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGAbstractValue.h        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/Source/JavaScriptCore/dfg/DFGAbstractValue.h        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -267,12 +267,12 @@
</span><span class="cx">         checkConsistency();
</span><span class="cx">     }
</span><span class="cx">     
</span><del>-    bool couldBeType(SpeculatedType desiredType) const
</del><ins>+    bool couldBeType(SpeculatedType desiredType)
</ins><span class="cx">     {
</span><span class="cx">         return !!(m_type &amp; desiredType);
</span><span class="cx">     }
</span><span class="cx">     
</span><del>-    bool isType(SpeculatedType desiredType) const
</del><ins>+    bool isType(SpeculatedType desiredType)
</ins><span class="cx">     {
</span><span class="cx">         return !(m_type &amp; ~desiredType);
</span><span class="cx">     }
</span><span class="lines">@@ -283,10 +283,6 @@
</span><span class="cx">     FiltrationResult filterByValue(const FrozenValue&amp; value);
</span><span class="cx">     FiltrationResult filter(const AbstractValue&amp;);
</span><span class="cx">     
</span><del>-    FiltrationResult changeStructure(Graph&amp;, const StructureSet&amp;);
-    
-    bool contains(Structure*) const;
-    
</del><span class="cx">     bool validate(JSValue value) const
</span><span class="cx">     {
</span><span class="cx">         if (isHeapTop())
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGByteCodeParsercpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -1891,19 +1891,20 @@
</span><span class="cx">     addToGraph(CheckStructure, OpInfo(m_graph.addStructureSet(variant.oldStructure())), base);
</span><span class="cx">     emitChecks(variant.constantChecks());
</span><span class="cx"> 
</span><del>-    ASSERT(variant.oldStructureForTransition()-&gt;transitionWatchpointSetHasBeenInvalidated());
</del><ins>+    ASSERT(variant.oldStructure()-&gt;transitionWatchpointSetHasBeenInvalidated());
</ins><span class="cx">     
</span><span class="cx">     Node* propertyStorage;
</span><span class="cx">     Transition* transition = m_graph.m_transitions.add(
</span><del>-        variant.oldStructureForTransition(), variant.newStructure());
</del><ins>+        variant.oldStructure(), variant.newStructure());
</ins><span class="cx"> 
</span><del>-    if (variant.reallocatesStorage()) {
</del><ins>+    if (variant.oldStructure()-&gt;outOfLineCapacity()
+        != variant.newStructure()-&gt;outOfLineCapacity()) {
</ins><span class="cx"> 
</span><span class="cx">         // If we're growing the property storage then it must be because we're
</span><span class="cx">         // storing into the out-of-line storage.
</span><span class="cx">         ASSERT(!isInlineOffset(variant.offset()));
</span><span class="cx"> 
</span><del>-        if (!variant.oldStructureForTransition()-&gt;outOfLineCapacity()) {
</del><ins>+        if (!variant.oldStructure()-&gt;outOfLineCapacity()) {
</ins><span class="cx">             propertyStorage = addToGraph(
</span><span class="cx">                 AllocatePropertyStorage, OpInfo(transition), base);
</span><span class="cx">         } else {
</span><span class="lines">@@ -2035,8 +2036,7 @@
</span><span class="cx">             Node* op1 = getThis();
</span><span class="cx">             if (op1-&gt;op() != ToThis) {
</span><span class="cx">                 Structure* cachedStructure = currentInstruction[2].u.structure.get();
</span><del>-                if (currentInstruction[2].u.toThisStatus != ToThisOK
-                    || !cachedStructure
</del><ins>+                if (!cachedStructure
</ins><span class="cx">                     || cachedStructure-&gt;classInfo()-&gt;methodTable.toThis != JSObject::info()-&gt;methodTable.toThis
</span><span class="cx">                     || m_inlineStackTop-&gt;m_profiledBlock-&gt;couldTakeSlowCase(m_currentIndex)
</span><span class="cx">                     || m_inlineStackTop-&gt;m_exitProfile.hasExitSite(m_currentIndex, BadCache)
</span><span class="lines">@@ -2886,9 +2886,7 @@
</span><span class="cx">             case GlobalPropertyWithVarInjectionChecks: {
</span><span class="cx">                 SpeculatedType prediction = getPrediction();
</span><span class="cx">                 GetByIdStatus status = GetByIdStatus::computeFor(*m_vm, structure, uid);
</span><del>-                if (status.state() != GetByIdStatus::Simple
-                    || status.numVariants() != 1
-                    || status[0].structureSet().size() != 1) {
</del><ins>+                if (status.state() != GetByIdStatus::Simple || status.numVariants() != 1) {
</ins><span class="cx">                     set(VirtualRegister(dst), addToGraph(GetByIdFlush, OpInfo(identifierNumber), OpInfo(prediction), get(VirtualRegister(scope))));
</span><span class="cx">                     break;
</span><span class="cx">                 }
</span><span class="lines">@@ -2973,14 +2971,11 @@
</span><span class="cx">             case GlobalProperty:
</span><span class="cx">             case GlobalPropertyWithVarInjectionChecks: {
</span><span class="cx">                 PutByIdStatus status = PutByIdStatus::computeFor(*m_vm, globalObject, structure, uid, false);
</span><del>-                if (status.numVariants() != 1
-                    || status[0].kind() != PutByIdVariant::Replace
-                    || status[0].structure().size() != 1) {
</del><ins>+                if (status.numVariants() != 1 || status[0].kind() != PutByIdVariant::Replace) {
</ins><span class="cx">                     addToGraph(PutById, OpInfo(identifierNumber), get(VirtualRegister(scope)), get(VirtualRegister(value)));
</span><span class="cx">                     break;
</span><span class="cx">                 }
</span><del>-                ASSERT(status[0].structure().onlyStructure() == structure);
-                Node* base = cellConstantWithStructureCheck(globalObject, structure);
</del><ins>+                Node* base = cellConstantWithStructureCheck(globalObject, status[0].structure());
</ins><span class="cx">                 addToGraph(Phantom, get(VirtualRegister(scope)));
</span><span class="cx">                 handlePutByOffset(base, identifierNumber, static_cast&lt;PropertyOffset&gt;(operand), get(VirtualRegister(value)));
</span><span class="cx">                 // Keep scope alive until after put.
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGClobberizeh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGClobberize.h (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGClobberize.h        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/Source/JavaScriptCore/dfg/DFGClobberize.h        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -440,6 +440,7 @@
</span><span class="cx">         return;
</span><span class="cx">         
</span><span class="cx">     case PutStructure:
</span><ins>+    case PhantomPutStructure:
</ins><span class="cx">         write(JSCell_structureID);
</span><span class="cx">         write(JSCell_typeInfoType);
</span><span class="cx">         write(JSCell_typeInfoFlags);
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGConstantFoldingPhasecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGConstantFoldingPhase.cpp (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGConstantFoldingPhase.cpp        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/Source/JavaScriptCore/dfg/DFGConstantFoldingPhase.cpp        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -132,15 +132,6 @@
</span><span class="cx">                 break;
</span><span class="cx">             }
</span><span class="cx">                 
</span><del>-            case PutStructure: {
-                if (m_state.forNode(node-&gt;child1()).m_structure.onlyStructure() != node-&gt;transition()-&gt;next)
-                    break;
-                
-                node-&gt;convertToPhantom();
-                eliminated = true;
-                break;
-            }
-                
</del><span class="cx">             case CheckFunction: {
</span><span class="cx">                 if (m_state.forNode(node-&gt;child1()).value() != node-&gt;function()-&gt;value())
</span><span class="cx">                     break;
</span><span class="lines">@@ -163,69 +154,47 @@
</span><span class="cx">             }
</span><span class="cx">                 
</span><span class="cx">             case MultiGetByOffset: {
</span><del>-                Edge baseEdge = node-&gt;child1();
-                Node* base = baseEdge.node();
</del><ins>+                Edge childEdge = node-&gt;child1();
+                Node* child = childEdge.node();
</ins><span class="cx">                 MultiGetByOffsetData&amp; data = node-&gt;multiGetByOffsetData();
</span><span class="cx"> 
</span><del>-                // First prune the variants, then check if the MultiGetByOffset can be
-                // strength-reduced to a GetByOffset.
-                
-                AbstractValue baseValue = m_state.forNode(base);
-                
-                m_interpreter.execute(indexInBlock); // Push CFA over this node after we get the state before.
-                eliminated = true; // Don't allow the default constant folder to do things to this.
-                
-                for (unsigned i = 0; i &lt; data.variants.size(); ++i) {
-                    GetByIdVariant&amp; variant = data.variants[i];
-                    variant.structureSet().filter(baseValue);
-                    if (variant.structureSet().isEmpty()) {
-                        data.variants[i--] = data.variants.last();
-                        data.variants.removeLast();
-                    }
-                }
-                
-                if (data.variants.size() != 1)
</del><ins>+                Structure* structure = m_state.forNode(child).m_structure.onlyStructure();
+                if (!structure)
</ins><span class="cx">                     break;
</span><span class="cx">                 
</span><del>-                emitGetByOffset(
-                    indexInBlock, node, baseValue, data.variants[0], data.identifierNumber);
</del><ins>+                for (unsigned i = data.variants.size(); i--;) {
+                    const GetByIdVariant&amp; variant = data.variants[i];
+                    if (!variant.structureSet().contains(structure))
+                        continue;
+                    
+                    if (variant.alternateBase())
+                        break;
+                    
+                    emitGetByOffset(indexInBlock, node, structure, variant, data.identifierNumber);
+                    eliminated = true;
+                    break;
+                }
</ins><span class="cx">                 break;
</span><span class="cx">             }
</span><span class="cx">                 
</span><span class="cx">             case MultiPutByOffset: {
</span><del>-                Edge baseEdge = node-&gt;child1();
-                Node* base = baseEdge.node();
</del><ins>+                Edge childEdge = node-&gt;child1();
+                Node* child = childEdge.node();
</ins><span class="cx">                 MultiPutByOffsetData&amp; data = node-&gt;multiPutByOffsetData();
</span><del>-                
-                AbstractValue baseValue = m_state.forNode(base);
</del><span class="cx"> 
</span><del>-                m_interpreter.execute(indexInBlock); // Push CFA over this node after we get the state before.
-                eliminated = true; // Don't allow the default constant folder to do things to this.
</del><ins>+                Structure* structure = m_state.forNode(child).m_structure.onlyStructure();
+                if (!structure)
+                    break;
</ins><span class="cx">                 
</span><del>-
-                for (unsigned i = 0; i &lt; data.variants.size(); ++i) {
-                    PutByIdVariant&amp; variant = data.variants[i];
-                    variant.oldStructure().filter(baseValue);
-                    
-                    if (variant.oldStructure().isEmpty()) {
-                        data.variants[i--] = data.variants.last();
-                        data.variants.removeLast();
</del><ins>+                for (unsigned i = data.variants.size(); i--;) {
+                    const PutByIdVariant&amp; variant = data.variants[i];
+                    if (variant.oldStructure() != structure)
</ins><span class="cx">                         continue;
</span><del>-                    }
</del><span class="cx">                     
</span><del>-                    if (variant.kind() == PutByIdVariant::Transition
-                        &amp;&amp; variant.oldStructure().onlyStructure() == variant.newStructure()) {
-                        variant = PutByIdVariant::replace(
-                            variant.oldStructure(),
-                            variant.offset());
-                    }
-                }
-
-                if (data.variants.size() != 1)
</del><ins>+                    emitPutByOffset(indexInBlock, node, structure, variant, data.identifierNumber);
+                    eliminated = true;
</ins><span class="cx">                     break;
</span><del>-                
-                emitPutByOffset(
-                    indexInBlock, node, baseValue, data.variants[0], data.identifierNumber);
</del><ins>+                }
</ins><span class="cx">                 break;
</span><span class="cx">             }
</span><span class="cx">         
</span><span class="lines">@@ -235,47 +204,30 @@
</span><span class="cx">                 Node* child = childEdge.node();
</span><span class="cx">                 unsigned identifierNumber = node-&gt;identifierNumber();
</span><span class="cx">                 
</span><del>-                AbstractValue baseValue = m_state.forNode(child);
-
-                m_interpreter.execute(indexInBlock); // Push CFA over this node after we get the state before.
-                eliminated = true; // Don't allow the default constant folder to do things to this.
-
-                if (baseValue.m_structure.isTop() || baseValue.m_structure.isClobbered()
-                    || (node-&gt;child1().useKind() == UntypedUse || (baseValue.m_type &amp; ~SpecCell)))
</del><ins>+                if (childEdge.useKind() != CellUse)
</ins><span class="cx">                     break;
</span><span class="cx">                 
</span><del>-                GetByIdStatus status = GetByIdStatus::computeFor(
-                    vm(), baseValue.m_structure.set(), m_graph.identifiers()[identifierNumber]);
-                if (!status.isSimple())
</del><ins>+                Structure* structure = m_state.forNode(child).m_structure.onlyStructure();
+                if (!structure)
</ins><span class="cx">                     break;
</span><ins>+
+                GetByIdStatus status = GetByIdStatus::computeFor(
+                    vm(), structure, m_graph.identifiers()[identifierNumber]);
</ins><span class="cx">                 
</span><del>-                for (unsigned i = status.numVariants(); i--;) {
-                    if (!status[i].constantChecks().isEmpty()
-                        || status[i].alternateBase()) {
-                        // FIXME: We could handle prototype cases.
-                        // https://bugs.webkit.org/show_bug.cgi?id=110386
-                        break;
-                    }
-                }
-                
-                if (status.numVariants() == 1) {
-                    emitGetByOffset(indexInBlock, node, baseValue, status[0], identifierNumber);
</del><ins>+                if (!status.isSimple() || status.numVariants() != 1 ||
+                    !status[0].constantChecks().isEmpty() || status[0].alternateBase()) {
+                    // FIXME: We could handle prototype cases.
+                    // https://bugs.webkit.org/show_bug.cgi?id=110386
</ins><span class="cx">                     break;
</span><span class="cx">                 }
</span><span class="cx">                 
</span><del>-                if (!isFTL(m_graph.m_plan.mode))
-                    break;
-                
-                MultiGetByOffsetData* data = m_graph.m_multiGetByOffsetData.add();
-                data-&gt;variants = status.variants();
-                data-&gt;identifierNumber = identifierNumber;
-                node-&gt;convertToMultiGetByOffset(data);
</del><ins>+                emitGetByOffset(indexInBlock, node, structure, status[0], identifierNumber);
+                eliminated = true;
</ins><span class="cx">                 break;
</span><span class="cx">             }
</span><span class="cx">                 
</span><span class="cx">             case PutById:
</span><del>-            case PutByIdDirect:
-            case PutByIdFlush: {
</del><ins>+            case PutByIdDirect: {
</ins><span class="cx">                 NodeOrigin origin = node-&gt;origin;
</span><span class="cx">                 Edge childEdge = node-&gt;child1();
</span><span class="cx">                 Node* child = childEdge.node();
</span><span class="lines">@@ -283,39 +235,24 @@
</span><span class="cx">                 
</span><span class="cx">                 ASSERT(childEdge.useKind() == CellUse);
</span><span class="cx">                 
</span><del>-                AbstractValue baseValue = m_state.forNode(child);
-
-                m_interpreter.execute(indexInBlock); // Push CFA over this node after we get the state before.
-                eliminated = true; // Don't allow the default constant folder to do things to this.
-
-                if (baseValue.m_structure.isTop() || baseValue.m_structure.isClobbered())
</del><ins>+                Structure* structure = m_state.forNode(child).m_structure.onlyStructure();
+                if (!structure)
</ins><span class="cx">                     break;
</span><span class="cx">                 
</span><span class="cx">                 PutByIdStatus status = PutByIdStatus::computeFor(
</span><span class="cx">                     vm(),
</span><span class="cx">                     m_graph.globalObjectFor(origin.semantic),
</span><del>-                    baseValue.m_structure.set(),
</del><ins>+                    structure,
</ins><span class="cx">                     m_graph.identifiers()[identifierNumber],
</span><span class="cx">                     node-&gt;op() == PutByIdDirect);
</span><span class="cx">                 
</span><span class="cx">                 if (!status.isSimple())
</span><span class="cx">                     break;
</span><del>-                
-                for (unsigned i = status.numVariants(); i--;)
-                    addChecks(origin, indexInBlock, status[i].constantChecks());
-                
-                if (status.numVariants() == 1) {
-                    emitPutByOffset(indexInBlock, node, baseValue, status[0], identifierNumber);
</del><ins>+                if (status.numVariants() != 1)
</ins><span class="cx">                     break;
</span><del>-                }
</del><span class="cx">                 
</span><del>-                if (!isFTL(m_graph.m_plan.mode))
-                    break;
-
-                MultiPutByOffsetData* data = m_graph.m_multiPutByOffsetData.add();
-                data-&gt;variants = status.variants();
-                data-&gt;identifierNumber = identifierNumber;
-                node-&gt;convertToMultiPutByOffset(data);
</del><ins>+                emitPutByOffset(indexInBlock, node, structure, status[0], identifierNumber);
+                eliminated = true;
</ins><span class="cx">                 break;
</span><span class="cx">             }
</span><span class="cx"> 
</span><span class="lines">@@ -406,24 +343,33 @@
</span><span class="cx">         return changed;
</span><span class="cx">     }
</span><span class="cx">         
</span><del>-    void emitGetByOffset(unsigned indexInBlock, Node* node, const AbstractValue&amp; baseValue, const GetByIdVariant&amp; variant, unsigned identifierNumber)
</del><ins>+    void emitGetByOffset(unsigned indexInBlock, Node* node, Structure* structure, const GetByIdVariant&amp; variant, unsigned identifierNumber)
</ins><span class="cx">     {
</span><span class="cx">         NodeOrigin origin = node-&gt;origin;
</span><span class="cx">         Edge childEdge = node-&gt;child1();
</span><span class="cx">         Node* child = childEdge.node();
</span><span class="cx"> 
</span><del>-        addBaseCheck(indexInBlock, node, baseValue, variant.structureSet());
</del><ins>+        bool needsCellCheck = m_state.forNode(child).m_type &amp; ~SpecCell;
</ins><span class="cx">         
</span><ins>+        ASSERT(!variant.alternateBase());
+        ASSERT_UNUSED(structure, variant.structureSet().contains(structure));
+        
+        // Now before we do anything else, push the CFA forward over the GetById
+        // and make sure we signal to the loop that it should continue and not
+        // do any eliminations.
+        m_interpreter.execute(indexInBlock);
+        
+        if (needsCellCheck) {
+            m_insertionSet.insertNode(
+                indexInBlock, SpecNone, Phantom, origin, childEdge);
+        }
+        
</ins><span class="cx">         if (variant.specificValue()) {
</span><span class="cx">             m_graph.convertToConstant(node, m_graph.freeze(variant.specificValue()));
</span><span class="cx">             return;
</span><span class="cx">         }
</span><span class="cx">         
</span><del>-        if (variant.alternateBase()) {
-            child = m_insertionSet.insertConstant(indexInBlock, origin, variant.alternateBase());
-            childEdge = Edge(child, KnownCellUse);
-        } else
-            childEdge.setUseKind(KnownCellUse);
</del><ins>+        childEdge.setUseKind(KnownCellUse);
</ins><span class="cx">         
</span><span class="cx">         Edge propertyStorage;
</span><span class="cx">         
</span><span class="lines">@@ -442,29 +388,50 @@
</span><span class="cx">         m_graph.m_storageAccessData.append(storageAccessData);
</span><span class="cx">     }
</span><span class="cx"> 
</span><del>-    void emitPutByOffset(unsigned indexInBlock, Node* node, const AbstractValue&amp; baseValue, const PutByIdVariant&amp; variant, unsigned identifierNumber)
</del><ins>+    void emitPutByOffset(unsigned indexInBlock, Node* node, Structure* structure, const PutByIdVariant&amp; variant, unsigned identifierNumber)
</ins><span class="cx">     {
</span><span class="cx">         NodeOrigin origin = node-&gt;origin;
</span><span class="cx">         Edge childEdge = node-&gt;child1();
</span><ins>+        Node* child = childEdge.node();
+
+        ASSERT(variant.oldStructure() == structure);
</ins><span class="cx">         
</span><del>-        addBaseCheck(indexInBlock, node, baseValue, variant.oldStructure());
</del><ins>+        bool needsCellCheck = m_state.forNode(child).m_type &amp; ~SpecCell;
+        
+        // Now before we do anything else, push the CFA forward over the PutById
+        // and make sure we signal to the loop that it should continue and not
+        // do any eliminations.
+        m_interpreter.execute(indexInBlock);
</ins><span class="cx"> 
</span><ins>+        if (needsCellCheck) {
+            m_insertionSet.insertNode(
+                indexInBlock, SpecNone, Phantom, origin, childEdge);
+        }
+
</ins><span class="cx">         childEdge.setUseKind(KnownCellUse);
</span><span class="cx"> 
</span><span class="cx">         Transition* transition = 0;
</span><span class="cx">         if (variant.kind() == PutByIdVariant::Transition) {
</span><del>-            transition = m_graph.m_transitions.add(
-                variant.oldStructureForTransition(), variant.newStructure());
</del><ins>+            transition = m_graph.m_transitions.add(structure, variant.newStructure());
+
+            for (unsigned i = 0; i &lt; variant.constantChecks().size(); ++i) {
+                addStructureTransitionCheck(
+                    origin, indexInBlock,
+                    variant.constantChecks()[i].constant(),
+                    variant.constantChecks()[i].structure());
+            }
</ins><span class="cx">         }
</span><span class="cx"> 
</span><span class="cx">         Edge propertyStorage;
</span><span class="cx"> 
</span><span class="cx">         if (isInlineOffset(variant.offset()))
</span><span class="cx">             propertyStorage = childEdge;
</span><del>-        else if (!variant.reallocatesStorage()) {
</del><ins>+        else if (
+            variant.kind() == PutByIdVariant::Replace
+            || structure-&gt;outOfLineCapacity() == variant.newStructure()-&gt;outOfLineCapacity()) {
</ins><span class="cx">             propertyStorage = Edge(m_insertionSet.insertNode(
</span><span class="cx">                 indexInBlock, SpecNone, GetButterfly, origin, childEdge));
</span><del>-        } else if (!variant.oldStructureForTransition()-&gt;outOfLineCapacity()) {
</del><ins>+        } else if (!structure-&gt;outOfLineCapacity()) {
</ins><span class="cx">             ASSERT(variant.newStructure()-&gt;outOfLineCapacity());
</span><span class="cx">             ASSERT(!isInlineOffset(variant.offset()));
</span><span class="cx">             Node* allocatePropertyStorage = m_insertionSet.insertNode(
</span><span class="lines">@@ -473,8 +440,8 @@
</span><span class="cx">             m_insertionSet.insertNode(indexInBlock, SpecNone, StoreBarrier, origin, Edge(node-&gt;child1().node(), KnownCellUse));
</span><span class="cx">             propertyStorage = Edge(allocatePropertyStorage);
</span><span class="cx">         } else {
</span><del>-            ASSERT(variant.oldStructureForTransition()-&gt;outOfLineCapacity());
-            ASSERT(variant.newStructure()-&gt;outOfLineCapacity() &gt; variant.oldStructureForTransition()-&gt;outOfLineCapacity());
</del><ins>+            ASSERT(structure-&gt;outOfLineCapacity());
+            ASSERT(variant.newStructure()-&gt;outOfLineCapacity() &gt; structure-&gt;outOfLineCapacity());
</ins><span class="cx">             ASSERT(!isInlineOffset(variant.offset()));
</span><span class="cx"> 
</span><span class="cx">             Node* reallocatePropertyStorage = m_insertionSet.insertNode(
</span><span class="lines">@@ -502,34 +469,6 @@
</span><span class="cx">         storageAccessData.identifierNumber = identifierNumber;
</span><span class="cx">         m_graph.m_storageAccessData.append(storageAccessData);
</span><span class="cx">     }
</span><del>-    
-    void addBaseCheck(
-        unsigned indexInBlock, Node* node, const AbstractValue&amp; baseValue, const StructureSet&amp; set)
-    {
-        if (!baseValue.m_structure.isSubsetOf(set)) {
-            // Arises when we prune MultiGetByOffset. We could have a
-            // MultiGetByOffset with a single variant that checks for structure S,
-            // and the input has structures S and T, for example.
-            m_insertionSet.insertNode(
-                indexInBlock, SpecNone, CheckStructure, node-&gt;origin,
-                OpInfo(m_graph.addStructureSet(set)), node-&gt;child1());
-            return;
-        }
-        
-        if (baseValue.m_type &amp; ~SpecCell) {
-            m_insertionSet.insertNode(
-                indexInBlock, SpecNone, Phantom, node-&gt;origin, node-&gt;child1());
-        }
-    }
-    
-    void addChecks(
-        NodeOrigin origin, unsigned indexInBlock, const ConstantStructureCheckVector&amp; checks)
-    {
-        for (unsigned i = 0; i &lt; checks.size(); ++i) {
-            addStructureTransitionCheck(
-                origin, indexInBlock, checks[i].constant(), checks[i].structure());
-        }
-    }
</del><span class="cx"> 
</span><span class="cx">     void addStructureTransitionCheck(NodeOrigin origin, unsigned indexInBlock, JSCell* cell, Structure* structure)
</span><span class="cx">     {
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGDoesGCcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGDoesGC.cpp (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGDoesGC.cpp        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/Source/JavaScriptCore/dfg/DFGDoesGC.cpp        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -186,6 +186,7 @@
</span><span class="cx">     case PutByVal:
</span><span class="cx">     case PutByValAlias:
</span><span class="cx">     case PutStructure:
</span><ins>+    case PhantomPutStructure:
</ins><span class="cx">     case GetByOffset:
</span><span class="cx">     case GetGetterSetterByOffset:
</span><span class="cx">     case PutByOffset:
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGFixupPhasecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGFixupPhase.cpp (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGFixupPhase.cpp        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/Source/JavaScriptCore/dfg/DFGFixupPhase.cpp        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -980,6 +980,7 @@
</span><span class="cx">         case Phi:
</span><span class="cx">         case Upsilon:
</span><span class="cx">         case GetArgument:
</span><ins>+        case PhantomPutStructure:
</ins><span class="cx">         case GetIndexedPropertyStorage:
</span><span class="cx">         case GetTypedArrayByteOffset:
</span><span class="cx">         case LastNodeType:
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGGraphcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGGraph.cpp (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGGraph.cpp        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/Source/JavaScriptCore/dfg/DFGGraph.cpp        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -889,6 +889,7 @@
</span><span class="cx">                 break;
</span><span class="cx">                 
</span><span class="cx">             case PutStructure:
</span><ins>+            case PhantomPutStructure:
</ins><span class="cx">             case AllocatePropertyStorage:
</span><span class="cx">             case ReallocatePropertyStorage:
</span><span class="cx">                 visitor.appendUnbarrieredReadOnlyPointer(
</span><span class="lines">@@ -916,9 +917,7 @@
</span><span class="cx">             case MultiPutByOffset:
</span><span class="cx">                 for (unsigned i = node-&gt;multiPutByOffsetData().variants.size(); i--;) {
</span><span class="cx">                     PutByIdVariant&amp; variant = node-&gt;multiPutByOffsetData().variants[i];
</span><del>-                    const StructureSet&amp; set = variant.oldStructure();
-                    for (unsigned j = set.size(); j--;)
-                        visitor.appendUnbarrieredReadOnlyPointer(set[j]);
</del><ins>+                    visitor.appendUnbarrieredReadOnlyPointer(variant.oldStructure());
</ins><span class="cx">                     if (variant.kind() == PutByIdVariant::Transition)
</span><span class="cx">                         visitor.appendUnbarrieredReadOnlyPointer(variant.newStructure());
</span><span class="cx">                 }
</span><span class="lines">@@ -952,7 +951,7 @@
</span><span class="cx"> 
</span><span class="cx"> FrozenValue* Graph::freezeStrong(JSValue value)
</span><span class="cx"> {
</span><del>-    FrozenValue* result = freezeFragile(value);
</del><ins>+    FrozenValue* result = freeze(value);
</ins><span class="cx">     result-&gt;strengthenTo(StrongValue);
</span><span class="cx">     return result;
</span><span class="cx"> }
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGGraphh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGGraph.h (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGGraph.h        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/Source/JavaScriptCore/dfg/DFGGraph.h        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -147,8 +147,8 @@
</span><span class="cx">     void dethread();
</span><span class="cx">     
</span><span class="cx">     FrozenValue* freezeFragile(JSValue value);
</span><del>-    FrozenValue* freeze(JSValue value); // We use weak freezing by default. Shorthand for freezeFragile(value)-&gt;strengthenTo(WeakValue);
-    FrozenValue* freezeStrong(JSValue value); // Shorthand for freezeFragile(value)-&gt;strengthenTo(StrongValue).
</del><ins>+    FrozenValue* freeze(JSValue value); // We use weak freezing by default.
+    FrozenValue* freezeStrong(JSValue value); // Shorthand for freeze(value)-&gt;markStrongly().
</ins><span class="cx">     
</span><span class="cx">     void convertToConstant(Node* node, FrozenValue* value);
</span><span class="cx">     void convertToConstant(Node* node, JSValue value);
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGNodecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGNode.cpp (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGNode.cpp        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/Source/JavaScriptCore/dfg/DFGNode.cpp        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -37,7 +37,7 @@
</span><span class="cx"> bool MultiPutByOffsetData::writesStructures() const
</span><span class="cx"> {
</span><span class="cx">     for (unsigned i = variants.size(); i--;) {
</span><del>-        if (variants[i].writesStructures())
</del><ins>+        if (variants[i].kind() == PutByIdVariant::Transition)
</ins><span class="cx">             return true;
</span><span class="cx">     }
</span><span class="cx">     return false;
</span><span class="lines">@@ -46,8 +46,14 @@
</span><span class="cx"> bool MultiPutByOffsetData::reallocatesStorage() const
</span><span class="cx"> {
</span><span class="cx">     for (unsigned i = variants.size(); i--;) {
</span><del>-        if (variants[i].reallocatesStorage())
-            return true;
</del><ins>+        if (variants[i].kind() != PutByIdVariant::Transition)
+            continue;
+        
+        if (variants[i].oldStructure()-&gt;outOfLineCapacity() ==
+            variants[i].newStructure()-&gt;outOfLineCapacity())
+            continue;
+        
+        return true;
</ins><span class="cx">     }
</span><span class="cx">     return false;
</span><span class="cx"> }
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGNodeh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGNode.h (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGNode.h        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/Source/JavaScriptCore/dfg/DFGNode.h        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -458,18 +458,9 @@
</span><span class="cx">         m_flags &amp;= ~NodeClobbersWorld;
</span><span class="cx">     }
</span><span class="cx">     
</span><del>-    void convertToMultiGetByOffset(MultiGetByOffsetData* data)
-    {
-        ASSERT(m_op == GetById || m_op == GetByIdFlush);
-        m_opInfo = bitwise_cast&lt;intptr_t&gt;(data);
-        child1().setUseKind(CellUse);
-        m_op = MultiGetByOffset;
-        m_flags &amp;= ~NodeClobbersWorld;
-    }
-    
</del><span class="cx">     void convertToPutByOffset(unsigned storageAccessDataIndex, Edge storage)
</span><span class="cx">     {
</span><del>-        ASSERT(m_op == PutById || m_op == PutByIdDirect || m_op == PutByIdFlush || m_op == MultiPutByOffset);
</del><ins>+        ASSERT(m_op == PutById || m_op == PutByIdDirect || m_op == MultiPutByOffset);
</ins><span class="cx">         m_opInfo = storageAccessDataIndex;
</span><span class="cx">         children.setChild3(children.child2());
</span><span class="cx">         children.setChild2(children.child1());
</span><span class="lines">@@ -478,14 +469,6 @@
</span><span class="cx">         m_flags &amp;= ~NodeClobbersWorld;
</span><span class="cx">     }
</span><span class="cx">     
</span><del>-    void convertToMultiPutByOffset(MultiPutByOffsetData* data)
-    {
-        ASSERT(m_op == PutById || m_op == PutByIdDirect || m_op == PutByIdFlush);
-        m_opInfo = bitwise_cast&lt;intptr_t&gt;(data);
-        m_op = MultiPutByOffset;
-        m_flags &amp;= ~NodeClobbersWorld;
-    }
-    
</del><span class="cx">     void convertToPhantomLocal()
</span><span class="cx">     {
</span><span class="cx">         ASSERT(m_op == Phantom &amp;&amp; (child1()-&gt;op() == Phi || child1()-&gt;op() == SetLocal || child1()-&gt;op() == SetArgument));
</span><span class="lines">@@ -1124,6 +1107,7 @@
</span><span class="cx">     {
</span><span class="cx">         switch (op()) {
</span><span class="cx">         case PutStructure:
</span><ins>+        case PhantomPutStructure:
</ins><span class="cx">         case AllocatePropertyStorage:
</span><span class="cx">         case ReallocatePropertyStorage:
</span><span class="cx">             return true;
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGNodeTypeh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGNodeType.h (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGNodeType.h        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/Source/JavaScriptCore/dfg/DFGNodeType.h        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -155,6 +155,7 @@
</span><span class="cx">     macro(CheckStructure, NodeMustGenerate) \
</span><span class="cx">     macro(CheckExecutable, NodeMustGenerate) \
</span><span class="cx">     macro(PutStructure, NodeMustGenerate) \
</span><ins>+    macro(PhantomPutStructure, NodeMustGenerate) \
</ins><span class="cx">     macro(AllocatePropertyStorage, NodeMustGenerate | NodeResultStorage) \
</span><span class="cx">     macro(ReallocatePropertyStorage, NodeMustGenerate | NodeResultStorage) \
</span><span class="cx">     macro(GetButterfly, NodeResultStorage) \
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGPredictionPropagationPhasecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGPredictionPropagationPhase.cpp (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGPredictionPropagationPhase.cpp        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/Source/JavaScriptCore/dfg/DFGPredictionPropagationPhase.cpp        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -540,6 +540,7 @@
</span><span class="cx">         case GetLocalUnlinked:
</span><span class="cx">         case GetMyArgumentsLength:
</span><span class="cx">         case GetMyArgumentByVal:
</span><ins>+        case PhantomPutStructure:
</ins><span class="cx">         case PhantomArguments:
</span><span class="cx">         case CheckArray:
</span><span class="cx">         case Arrayify:
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGSafeToExecuteh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGSafeToExecute.h (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGSafeToExecute.h        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/Source/JavaScriptCore/dfg/DFGSafeToExecute.h        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -283,6 +283,7 @@
</span><span class="cx">             graph, node, state.forNode(graph.varArgChild(node, 0)));
</span><span class="cx"> 
</span><span class="cx">     case PutStructure:
</span><ins>+    case PhantomPutStructure:
</ins><span class="cx">     case AllocatePropertyStorage:
</span><span class="cx">     case ReallocatePropertyStorage:
</span><span class="cx">         return state.forNode(node-&gt;child1()).m_structure.isSubsetOf(
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGSpeculativeJITcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -343,6 +343,7 @@
</span><span class="cx">     } else if (registerFormat == DataFormatCell) {
</span><span class="cx">         ASSERT(info.gpr() == source);
</span><span class="cx">         if (node-&gt;hasConstant()) {
</span><ins>+            DFG_ASSERT(m_jit.graph(), m_currentNode, node-&gt;isCellConstant());
</ins><span class="cx">             node-&gt;asCell(); // To get the assertion.
</span><span class="cx">             fillAction = SetCellConstant;
</span><span class="cx">         } else {
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGSpeculativeJIT32_64cpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -867,6 +867,15 @@
</span><span class="cx">     m_interpreter.filter(value, SpecCell);
</span><span class="cx">     VirtualRegister virtualRegister = edge-&gt;virtualRegister();
</span><span class="cx">     GenerationInfo&amp; info = generationInfoFromVirtualRegister(virtualRegister);
</span><ins>+    
+    if (edge-&gt;hasConstant() &amp;&amp; !edge-&gt;isCellConstant()) {
+        // Protect the silent spill/fill logic by failing early. If we &quot;speculate&quot; on
+        // the constant then the silent filler may think that we have a cell and a
+        // constant, so it will try to fill this as an cell constant. Bad things will
+        // happen.
+        terminateSpeculativeExecution(Uncountable, JSValueRegs(), 0);
+        return allocate();
+    }
</ins><span class="cx"> 
</span><span class="cx">     switch (info.registerFormat()) {
</span><span class="cx">     case DataFormatNone: {
</span><span class="lines">@@ -878,13 +887,9 @@
</span><span class="cx">         if (edge-&gt;hasConstant()) {
</span><span class="cx">             JSValue jsValue = edge-&gt;asJSValue();
</span><span class="cx">             GPRReg gpr = allocate();
</span><del>-            if (jsValue.isCell()) {
-                m_gprs.retain(gpr, virtualRegister, SpillOrderConstant);
-                m_jit.move(MacroAssembler::TrustedImmPtr(jsValue.asCell()), gpr);
-                info.fillCell(*m_stream, gpr);
-                return gpr;
-            }
-            terminateSpeculativeExecution(Uncountable, JSValueRegs(), 0);
</del><ins>+            m_gprs.retain(gpr, virtualRegister, SpillOrderConstant);
+            m_jit.move(MacroAssembler::TrustedImmPtr(jsValue.asCell()), gpr);
+            info.fillCell(*m_stream, gpr);
</ins><span class="cx">             return gpr;
</span><span class="cx">         }
</span><span class="cx"> 
</span><span class="lines">@@ -3734,6 +3739,13 @@
</span><span class="cx">         break;
</span><span class="cx">     }
</span><span class="cx">         
</span><ins>+    case PhantomPutStructure: {
+        ASSERT(isKnownCell(node-&gt;child1().node()));
+        m_jit.jitCode()-&gt;common.notifyCompilingStructureTransition(m_jit.graph().m_plan, m_jit.codeBlock(), node);
+        noResult(node);
+        break;
+    }
+
</ins><span class="cx">     case PutStructure: {
</span><span class="cx">         Structure* oldStructure = node-&gt;transition()-&gt;previous;
</span><span class="cx">         Structure* newStructure = node-&gt;transition()-&gt;next;
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGSpeculativeJIT64cpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -97,7 +97,7 @@
</span><span class="cx">                 
</span><span class="cx">             default:
</span><span class="cx">                 m_jit.load64(JITCompiler::addressFor(virtualRegister), gpr);
</span><del>-                DFG_ASSERT(m_jit.graph(), m_currentNode, spillFormat &amp; DataFormatJS);
</del><ins>+                RELEASE_ASSERT(spillFormat &amp; DataFormatJS);
</ins><span class="cx">                 break;
</span><span class="cx">             }
</span><span class="cx">             info.fillJSValue(*m_stream, gpr, spillFormat);
</span><span class="lines">@@ -137,10 +137,10 @@
</span><span class="cx">     case DataFormatDouble:
</span><span class="cx">     case DataFormatInt52:
</span><span class="cx">         // this type currently never occurs
</span><del>-        DFG_CRASH(m_jit.graph(), m_currentNode, &quot;Bad data format&quot;);
</del><ins>+        RELEASE_ASSERT_NOT_REACHED();
</ins><span class="cx">         
</span><span class="cx">     default:
</span><del>-        DFG_CRASH(m_jit.graph(), m_currentNode, &quot;Corrupt data format&quot;);
</del><ins>+        RELEASE_ASSERT_NOT_REACHED();
</ins><span class="cx">         return InvalidGPRReg;
</span><span class="cx">     }
</span><span class="cx"> }
</span><span class="lines">@@ -311,7 +311,7 @@
</span><span class="cx">     if (branchIndexInBlock != UINT_MAX) {
</span><span class="cx">         Node* branchNode = m_block-&gt;at(branchIndexInBlock);
</span><span class="cx"> 
</span><del>-        DFG_ASSERT(m_jit.graph(), node, node-&gt;adjustedRefCount() == 1);
</del><ins>+        RELEASE_ASSERT(node-&gt;adjustedRefCount() == 1);
</ins><span class="cx">         
</span><span class="cx">         nonSpeculativePeepholeBranchNull(operand, branchNode, invert);
</span><span class="cx">     
</span><span class="lines">@@ -628,8 +628,8 @@
</span><span class="cx"> 
</span><span class="cx">     bool isCall = node-&gt;op() == Call;
</span><span class="cx">     if (!isCall)
</span><del>-        DFG_ASSERT(m_jit.graph(), node, node-&gt;op() == Construct);
-    
</del><ins>+        RELEASE_ASSERT(node-&gt;op() == Construct);
+
</ins><span class="cx">     // For constructors, the this argument is not passed but we have to make space
</span><span class="cx">     // for it.
</span><span class="cx">     int dummyThisArgument = isCall ? 0 : 1;
</span><span class="lines">@@ -741,7 +741,7 @@
</span><span class="cx">         
</span><span class="cx">         DataFormat spillFormat = info.spillFormat();
</span><span class="cx">         
</span><del>-        DFG_ASSERT(m_jit.graph(), m_currentNode, (spillFormat &amp; DataFormatJS) || spillFormat == DataFormatInt32);
</del><ins>+        RELEASE_ASSERT((spillFormat &amp; DataFormatJS) || spillFormat == DataFormatInt32);
</ins><span class="cx">         
</span><span class="cx">         m_gprs.retain(gpr, virtualRegister, SpillOrderSpilled);
</span><span class="cx">         
</span><span class="lines">@@ -771,7 +771,7 @@
</span><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     case DataFormatJS: {
</span><del>-        DFG_ASSERT(m_jit.graph(), m_currentNode, !(type &amp; SpecInt52));
</del><ins>+        RELEASE_ASSERT(!(type &amp; SpecInt52));
</ins><span class="cx">         // Check the value is an integer.
</span><span class="cx">         GPRReg gpr = info.gpr();
</span><span class="cx">         m_gprs.lock(gpr);
</span><span class="lines">@@ -834,10 +834,10 @@
</span><span class="cx">     case DataFormatStorage:
</span><span class="cx">     case DataFormatInt52:
</span><span class="cx">     case DataFormatStrictInt52:
</span><del>-        DFG_CRASH(m_jit.graph(), m_currentNode, &quot;Bad data format&quot;);
</del><ins>+        RELEASE_ASSERT_NOT_REACHED();
</ins><span class="cx">         
</span><span class="cx">     default:
</span><del>-        DFG_CRASH(m_jit.graph(), m_currentNode, &quot;Corrupt data format&quot;);
</del><ins>+        RELEASE_ASSERT_NOT_REACHED();
</ins><span class="cx">         return InvalidGPRReg;
</span><span class="cx">     }
</span><span class="cx"> }
</span><span class="lines">@@ -854,7 +854,7 @@
</span><span class="cx"> {
</span><span class="cx">     DataFormat mustBeDataFormatInt32;
</span><span class="cx">     GPRReg result = fillSpeculateInt32Internal&lt;true&gt;(edge, mustBeDataFormatInt32);
</span><del>-    DFG_ASSERT(m_jit.graph(), m_currentNode, mustBeDataFormatInt32 == DataFormatInt32);
</del><ins>+    RELEASE_ASSERT(mustBeDataFormatInt32 == DataFormatInt32);
</ins><span class="cx">     return result;
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="lines">@@ -889,7 +889,7 @@
</span><span class="cx">         
</span><span class="cx">         DataFormat spillFormat = info.spillFormat();
</span><span class="cx">         
</span><del>-        DFG_ASSERT(m_jit.graph(), m_currentNode, spillFormat == DataFormatInt52 || spillFormat == DataFormatStrictInt52);
</del><ins>+        RELEASE_ASSERT(spillFormat == DataFormatInt52 || spillFormat == DataFormatStrictInt52);
</ins><span class="cx">         
</span><span class="cx">         m_gprs.retain(gpr, virtualRegister, SpillOrderSpilled);
</span><span class="cx">         
</span><span class="lines">@@ -941,7 +941,7 @@
</span><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     default:
</span><del>-        DFG_CRASH(m_jit.graph(), m_currentNode, &quot;Bad data format&quot;);
</del><ins>+        RELEASE_ASSERT_NOT_REACHED();
</ins><span class="cx">         return InvalidGPRReg;
</span><span class="cx">     }
</span><span class="cx"> }
</span><span class="lines">@@ -972,7 +972,7 @@
</span><span class="cx">         }
</span><span class="cx">         
</span><span class="cx">         DataFormat spillFormat = info.spillFormat();
</span><del>-        DFG_ASSERT(m_jit.graph(), m_currentNode, spillFormat == DataFormatDouble);
</del><ins>+        RELEASE_ASSERT(spillFormat == DataFormatDouble);
</ins><span class="cx">         FPRReg fpr = fprAllocate();
</span><span class="cx">         m_jit.loadDouble(JITCompiler::addressFor(virtualRegister), fpr);
</span><span class="cx">         m_fprs.retain(fpr, virtualRegister, SpillOrderDouble);
</span><span class="lines">@@ -980,7 +980,7 @@
</span><span class="cx">         return fpr;
</span><span class="cx">     }
</span><span class="cx"> 
</span><del>-    DFG_ASSERT(m_jit.graph(), m_currentNode, info.registerFormat() == DataFormatDouble);
</del><ins>+    RELEASE_ASSERT(info.registerFormat() == DataFormatDouble);
</ins><span class="cx">     FPRReg fpr = info.fpr();
</span><span class="cx">     m_fprs.lock(fpr);
</span><span class="cx">     return fpr;
</span><span class="lines">@@ -995,19 +995,21 @@
</span><span class="cx">     VirtualRegister virtualRegister = edge-&gt;virtualRegister();
</span><span class="cx">     GenerationInfo&amp; info = generationInfoFromVirtualRegister(virtualRegister);
</span><span class="cx"> 
</span><ins>+    if (edge-&gt;hasConstant() &amp;&amp; !edge-&gt;isCellConstant()) {
+        // Better to fail early on constants.
+        terminateSpeculativeExecution(Uncountable, JSValueRegs(), 0);
+        return allocate();
+    }
+
</ins><span class="cx">     switch (info.registerFormat()) {
</span><span class="cx">     case DataFormatNone: {
</span><span class="cx">         GPRReg gpr = allocate();
</span><span class="cx"> 
</span><span class="cx">         if (edge-&gt;hasConstant()) {
</span><span class="cx">             JSValue jsValue = edge-&gt;asJSValue();
</span><del>-            if (jsValue.isCell()) {
-                m_gprs.retain(gpr, virtualRegister, SpillOrderConstant);
-                m_jit.move(MacroAssembler::TrustedImm64(JSValue::encode(jsValue)), gpr);
-                info.fillJSValue(*m_stream, gpr, DataFormatJSCell);
-                return gpr;
-            }
-            terminateSpeculativeExecution(Uncountable, JSValueRegs(), 0);
</del><ins>+            m_gprs.retain(gpr, virtualRegister, SpillOrderConstant);
+            m_jit.move(MacroAssembler::TrustedImm64(JSValue::encode(jsValue)), gpr);
+            info.fillJSValue(*m_stream, gpr, DataFormatJSCell);
</ins><span class="cx">             return gpr;
</span><span class="cx">         }
</span><span class="cx">         
</span><span class="lines">@@ -1060,10 +1062,10 @@
</span><span class="cx">     case DataFormatStorage:
</span><span class="cx">     case DataFormatInt52:
</span><span class="cx">     case DataFormatStrictInt52:
</span><del>-        DFG_CRASH(m_jit.graph(), m_currentNode, &quot;Bad data format&quot;);
</del><ins>+        RELEASE_ASSERT_NOT_REACHED();
</ins><span class="cx">         
</span><span class="cx">     default:
</span><del>-        DFG_CRASH(m_jit.graph(), m_currentNode, &quot;Corrupt data format&quot;);
</del><ins>+        RELEASE_ASSERT_NOT_REACHED();
</ins><span class="cx">         return InvalidGPRReg;
</span><span class="cx">     }
</span><span class="cx"> }
</span><span class="lines">@@ -1096,7 +1098,7 @@
</span><span class="cx">             terminateSpeculativeExecution(Uncountable, JSValueRegs(), 0);
</span><span class="cx">             return gpr;
</span><span class="cx">         }
</span><del>-        DFG_ASSERT(m_jit.graph(), m_currentNode, info.spillFormat() &amp; DataFormatJS);
</del><ins>+        RELEASE_ASSERT(info.spillFormat() &amp; DataFormatJS);
</ins><span class="cx">         m_gprs.retain(gpr, virtualRegister, SpillOrderSpilled);
</span><span class="cx">         m_jit.load64(JITCompiler::addressFor(virtualRegister), gpr);
</span><span class="cx"> 
</span><span class="lines">@@ -1141,10 +1143,10 @@
</span><span class="cx">     case DataFormatStorage:
</span><span class="cx">     case DataFormatInt52:
</span><span class="cx">     case DataFormatStrictInt52:
</span><del>-        DFG_CRASH(m_jit.graph(), m_currentNode, &quot;Bad data format&quot;);
</del><ins>+        RELEASE_ASSERT_NOT_REACHED();
</ins><span class="cx">         
</span><span class="cx">     default:
</span><del>-        DFG_CRASH(m_jit.graph(), m_currentNode, &quot;Corrupt data format&quot;);
</del><ins>+        RELEASE_ASSERT_NOT_REACHED();
</ins><span class="cx">         return InvalidGPRReg;
</span><span class="cx">     }
</span><span class="cx"> }
</span><span class="lines">@@ -1608,7 +1610,7 @@
</span><span class="cx">         return compileStringZeroLength(node);
</span><span class="cx"> 
</span><span class="cx">     default:
</span><del>-        DFG_CRASH(m_jit.graph(), node, &quot;Bad use kind&quot;);
</del><ins>+        RELEASE_ASSERT_NOT_REACHED();
</ins><span class="cx">         break;
</span><span class="cx">     }
</span><span class="cx"> }
</span><span class="lines">@@ -1763,7 +1765,7 @@
</span><span class="cx">     }
</span><span class="cx">         
</span><span class="cx">     default:
</span><del>-        DFG_CRASH(m_jit.graph(), m_currentNode, &quot;Bad use kind&quot;);
</del><ins>+        RELEASE_ASSERT_NOT_REACHED();
</ins><span class="cx">     }
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="lines">@@ -1788,7 +1790,7 @@
</span><span class="cx"> 
</span><span class="cx">     case Identity: {
</span><span class="cx">         // CSE should always eliminate this.
</span><del>-        DFG_CRASH(m_jit.graph(), node, &quot;Unexpected Identity node&quot;);
</del><ins>+        RELEASE_ASSERT_NOT_REACHED();
</ins><span class="cx">         break;
</span><span class="cx">     }
</span><span class="cx"> 
</span><span class="lines">@@ -1869,7 +1871,7 @@
</span><span class="cx">     case MovHint:
</span><span class="cx">     case ZombieHint:
</span><span class="cx">     case Check: {
</span><del>-        DFG_CRASH(m_jit.graph(), node, &quot;Unexpected node&quot;);
</del><ins>+        RELEASE_ASSERT_NOT_REACHED();
</ins><span class="cx">         break;
</span><span class="cx">     }
</span><span class="cx"> 
</span><span class="lines">@@ -1929,7 +1931,7 @@
</span><span class="cx">         }
</span><span class="cx">             
</span><span class="cx">         default:
</span><del>-            DFG_CRASH(m_jit.graph(), node, &quot;Bad flush format&quot;);
</del><ins>+            RELEASE_ASSERT_NOT_REACHED();
</ins><span class="cx">             break;
</span><span class="cx">         }
</span><span class="cx"> 
</span><span class="lines">@@ -2067,7 +2069,7 @@
</span><span class="cx">         }
</span><span class="cx">             
</span><span class="cx">         default:
</span><del>-            DFG_CRASH(m_jit.graph(), node, &quot;Bad use kind&quot;);
</del><ins>+            RELEASE_ASSERT_NOT_REACHED();
</ins><span class="cx">         }
</span><span class="cx">         break;
</span><span class="cx">     }
</span><span class="lines">@@ -2147,7 +2149,7 @@
</span><span class="cx">         }
</span><span class="cx">             
</span><span class="cx">         default:
</span><del>-            DFG_CRASH(m_jit.graph(), node, &quot;Bad use kind&quot;);
</del><ins>+            RELEASE_ASSERT_NOT_REACHED();
</ins><span class="cx">             break;
</span><span class="cx">         }
</span><span class="cx">         break;
</span><span class="lines">@@ -2214,7 +2216,7 @@
</span><span class="cx">         }
</span><span class="cx">             
</span><span class="cx">         default:
</span><del>-            DFG_CRASH(m_jit.graph(), node, &quot;Bad use kind&quot;);
</del><ins>+            RELEASE_ASSERT_NOT_REACHED();
</ins><span class="cx">             break;
</span><span class="cx">         }
</span><span class="cx">         break;
</span><span class="lines">@@ -2336,7 +2338,8 @@
</span><span class="cx">         switch (node-&gt;arrayMode().type()) {
</span><span class="cx">         case Array::SelectUsingPredictions:
</span><span class="cx">         case Array::ForceExit:
</span><del>-            DFG_CRASH(m_jit.graph(), node, &quot;Bad array mode type&quot;);
</del><ins>+            RELEASE_ASSERT_NOT_REACHED();
+            terminateSpeculativeExecution(InadequateCoverage, JSValueRegs(), 0);
</ins><span class="cx">             break;
</span><span class="cx">         case Array::Generic: {
</span><span class="cx">             JSValueOperand base(this, node-&gt;child1());
</span><span class="lines">@@ -2537,10 +2540,12 @@
</span><span class="cx">         switch (arrayMode.type()) {
</span><span class="cx">         case Array::SelectUsingPredictions:
</span><span class="cx">         case Array::ForceExit:
</span><del>-            DFG_CRASH(m_jit.graph(), node, &quot;Bad array mode type&quot;);
</del><ins>+            RELEASE_ASSERT_NOT_REACHED();
+            terminateSpeculativeExecution(InadequateCoverage, JSValueRegs(), 0);
+            alreadyHandled = true;
</ins><span class="cx">             break;
</span><span class="cx">         case Array::Generic: {
</span><del>-            DFG_ASSERT(m_jit.graph(), node, node-&gt;op() == PutByVal);
</del><ins>+            RELEASE_ASSERT(node-&gt;op() == PutByVal);
</ins><span class="cx">             
</span><span class="cx">             JSValueOperand arg1(this, child1);
</span><span class="cx">             JSValueOperand arg2(this, child2);
</span><span class="lines">@@ -3113,14 +3118,14 @@
</span><span class="cx">         }
</span><span class="cx">             
</span><span class="cx">         default:
</span><del>-            DFG_CRASH(m_jit.graph(), node, &quot;Bad use kind&quot;);
</del><ins>+            RELEASE_ASSERT_NOT_REACHED();
</ins><span class="cx">             break;
</span><span class="cx">         }
</span><span class="cx">         break;
</span><span class="cx">     }
</span><span class="cx">         
</span><span class="cx">     case ToPrimitive: {
</span><del>-        DFG_ASSERT(m_jit.graph(), node, node-&gt;child1().useKind() == UntypedUse);
</del><ins>+        RELEASE_ASSERT(node-&gt;child1().useKind() == UntypedUse);
</ins><span class="cx">         JSValueOperand op1(this, node-&gt;child1());
</span><span class="cx">         GPRTemporary result(this, Reuse, op1);
</span><span class="cx">         
</span><span class="lines">@@ -3187,7 +3192,7 @@
</span><span class="cx">         JSGlobalObject* globalObject = m_jit.graph().globalObjectFor(node-&gt;origin.semantic);
</span><span class="cx">         if (!globalObject-&gt;isHavingABadTime() &amp;&amp; !hasAnyArrayStorage(node-&gt;indexingType())) {
</span><span class="cx">             Structure* structure = globalObject-&gt;arrayStructureForIndexingTypeDuringAllocation(node-&gt;indexingType());
</span><del>-            DFG_ASSERT(m_jit.graph(), node, structure-&gt;indexingType() == node-&gt;indexingType());
</del><ins>+            RELEASE_ASSERT(structure-&gt;indexingType() == node-&gt;indexingType());
</ins><span class="cx">             ASSERT(
</span><span class="cx">                 hasUndecided(structure-&gt;indexingType())
</span><span class="cx">                 || hasInt32(structure-&gt;indexingType())
</span><span class="lines">@@ -3438,7 +3443,7 @@
</span><span class="cx"> 
</span><span class="cx">             emitAllocateJSArray(resultGPR, globalObject-&gt;arrayStructureForIndexingTypeDuringAllocation(indexingType), storageGPR, numElements);
</span><span class="cx">             
</span><del>-            DFG_ASSERT(m_jit.graph(), node, indexingType &amp; IsArray);
</del><ins>+            RELEASE_ASSERT(indexingType &amp; IsArray);
</ins><span class="cx">             JSValue* data = m_jit.codeBlock()-&gt;constantBuffer(node-&gt;startConstant());
</span><span class="cx">             if (indexingType == ArrayWithDouble) {
</span><span class="cx">                 for (unsigned index = 0; index &lt; node-&gt;numConstants(); ++index) {
</span><span class="lines">@@ -3492,7 +3497,7 @@
</span><span class="cx">             break;
</span><span class="cx">         }
</span><span class="cx">         default:
</span><del>-            DFG_CRASH(m_jit.graph(), node, &quot;Bad use kind&quot;);
</del><ins>+            RELEASE_ASSERT_NOT_REACHED();
</ins><span class="cx">             break;
</span><span class="cx">         }
</span><span class="cx">         break;
</span><span class="lines">@@ -3722,7 +3727,7 @@
</span><span class="cx">         }
</span><span class="cx">             
</span><span class="cx">         default:
</span><del>-            DFG_CRASH(m_jit.graph(), node, &quot;Bad use kind&quot;);
</del><ins>+            RELEASE_ASSERT_NOT_REACHED();
</ins><span class="cx">             break;
</span><span class="cx">         }
</span><span class="cx">         break;
</span><span class="lines">@@ -3772,7 +3777,7 @@
</span><span class="cx">         }
</span><span class="cx">             
</span><span class="cx">         default:
</span><del>-            DFG_CRASH(m_jit.graph(), node, &quot;Bad use kind&quot;);
</del><ins>+            RELEASE_ASSERT_NOT_REACHED();
</ins><span class="cx">             break;
</span><span class="cx">         }
</span><span class="cx">         break;
</span><span class="lines">@@ -3832,6 +3837,13 @@
</span><span class="cx">         break;
</span><span class="cx">     }
</span><span class="cx">         
</span><ins>+    case PhantomPutStructure: {
+        ASSERT(isKnownCell(node-&gt;child1().node()));
+        m_jit.jitCode()-&gt;common.notifyCompilingStructureTransition(m_jit.graph().m_plan, m_jit.codeBlock(), node);
+        noResult(node);
+        break;
+    }
+        
</ins><span class="cx">     case PutStructure: {
</span><span class="cx">         Structure* oldStructure = node-&gt;transition()-&gt;previous;
</span><span class="cx">         Structure* newStructure = node-&gt;transition()-&gt;next;
</span><span class="lines">@@ -4236,7 +4248,7 @@
</span><span class="cx">         break;
</span><span class="cx"> 
</span><span class="cx">     case CreateActivation: {
</span><del>-        DFG_ASSERT(m_jit.graph(), node, !node-&gt;origin.semantic.inlineCallFrame);
</del><ins>+        RELEASE_ASSERT(!node-&gt;origin.semantic.inlineCallFrame);
</ins><span class="cx">         
</span><span class="cx">         JSValueOperand value(this, node-&gt;child1());
</span><span class="cx">         GPRTemporary result(this, Reuse, value);
</span><span class="lines">@@ -4309,7 +4321,7 @@
</span><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     case TearOffActivation: {
</span><del>-        DFG_ASSERT(m_jit.graph(), node, !node-&gt;origin.semantic.inlineCallFrame);
</del><ins>+        RELEASE_ASSERT(!node-&gt;origin.semantic.inlineCallFrame);
</ins><span class="cx"> 
</span><span class="cx">         JSValueOperand activationValue(this, node-&gt;child1());
</span><span class="cx">         GPRTemporary scratch(this);
</span><span class="lines">@@ -4381,7 +4393,7 @@
</span><span class="cx">                         m_jit.graph().machineArgumentsRegisterFor(node-&gt;origin.semantic))));
</span><span class="cx">         }
</span><span class="cx">         
</span><del>-        DFG_ASSERT(m_jit.graph(), node, !node-&gt;origin.semantic.inlineCallFrame);
</del><ins>+        RELEASE_ASSERT(!node-&gt;origin.semantic.inlineCallFrame);
</ins><span class="cx">         m_jit.load32(JITCompiler::payloadFor(JSStack::ArgumentCount), resultGPR);
</span><span class="cx">         m_jit.sub32(TrustedImm32(1), resultGPR);
</span><span class="cx">         int32Result(resultGPR, node);
</span><span class="lines">@@ -4457,7 +4469,7 @@
</span><span class="cx">         JITCompiler::JumpList slowArgument;
</span><span class="cx">         JITCompiler::JumpList slowArgumentOutOfBounds;
</span><span class="cx">         if (m_jit.symbolTableFor(node-&gt;origin.semantic)-&gt;slowArguments()) {
</span><del>-            DFG_ASSERT(m_jit.graph(), node, !node-&gt;origin.semantic.inlineCallFrame);
</del><ins>+            RELEASE_ASSERT(!node-&gt;origin.semantic.inlineCallFrame);
</ins><span class="cx">             const SlowArgument* slowArguments = m_jit.graph().m_slowArguments.get();
</span><span class="cx">             
</span><span class="cx">             slowArgumentOutOfBounds.append(
</span><span class="lines">@@ -4524,7 +4536,7 @@
</span><span class="cx">         JITCompiler::JumpList slowArgument;
</span><span class="cx">         JITCompiler::JumpList slowArgumentOutOfBounds;
</span><span class="cx">         if (m_jit.symbolTableFor(node-&gt;origin.semantic)-&gt;slowArguments()) {
</span><del>-            DFG_ASSERT(m_jit.graph(), node, !node-&gt;origin.semantic.inlineCallFrame);
</del><ins>+            RELEASE_ASSERT(!node-&gt;origin.semantic.inlineCallFrame);
</ins><span class="cx">             const SlowArgument* slowArguments = m_jit.graph().m_slowArguments.get();
</span><span class="cx"> 
</span><span class="cx">             slowArgumentOutOfBounds.append(
</span><span class="lines">@@ -4659,7 +4671,7 @@
</span><span class="cx">         break;
</span><span class="cx"> 
</span><span class="cx">     case Unreachable:
</span><del>-        DFG_CRASH(m_jit.graph(), node, &quot;Unexpected Unreachable node&quot;);
</del><ins>+        RELEASE_ASSERT_NOT_REACHED();
</ins><span class="cx">         break;
</span><span class="cx"> 
</span><span class="cx">     case StoreBarrier:
</span><span class="lines">@@ -4727,7 +4739,7 @@
</span><span class="cx">     case CheckTierUpInLoop:
</span><span class="cx">     case CheckTierUpAtReturn:
</span><span class="cx">     case CheckTierUpAndOSREnter:
</span><del>-        DFG_CRASH(m_jit.graph(), node, &quot;Unexpected tier-up node&quot;);
</del><ins>+        RELEASE_ASSERT_NOT_REACHED();
</ins><span class="cx">         break;
</span><span class="cx"> #endif // ENABLE(FTL_JIT)
</span><span class="cx"> 
</span><span class="lines">@@ -4743,7 +4755,7 @@
</span><span class="cx">     case MultiGetByOffset:
</span><span class="cx">     case MultiPutByOffset:
</span><span class="cx">     case FiatInt52:
</span><del>-        DFG_CRASH(m_jit.graph(), node, &quot;Unexpected FTL node&quot;);
</del><ins>+        RELEASE_ASSERT_NOT_REACHED();
</ins><span class="cx">         break;
</span><span class="cx">     }
</span><span class="cx"> 
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGStructureAbstractValuecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGStructureAbstractValue.cpp (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGStructureAbstractValue.cpp        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/Source/JavaScriptCore/dfg/DFGStructureAbstractValue.cpp        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -83,8 +83,6 @@
</span><span class="cx"> void StructureAbstractValue::observeTransition(Structure* from, Structure* to)
</span><span class="cx"> {
</span><span class="cx">     SAMPLE(&quot;StructureAbstractValue observeTransition&quot;);
</span><del>-    
-    ASSERT(!from-&gt;dfgShouldWatch());
</del><span class="cx"> 
</span><span class="cx">     if (isTop())
</span><span class="cx">         return;
</span><span class="lines">@@ -92,6 +90,11 @@
</span><span class="cx">     if (!m_set.contains(from))
</span><span class="cx">         return;
</span><span class="cx">     
</span><ins>+    if (from-&gt;dfgShouldWatch()) {
+        setClobbered(true);
+        return;
+    }
+    
</ins><span class="cx">     if (!m_set.add(to))
</span><span class="cx">         return;
</span><span class="cx">     
</span><span class="lines">@@ -108,12 +111,13 @@
</span><span class="cx">     
</span><span class="cx">     StructureSet newStructures;
</span><span class="cx">     for (unsigned i = vector.size(); i--;) {
</span><del>-        ASSERT(!vector[i].previous-&gt;dfgShouldWatch());
-
</del><span class="cx">         if (!m_set.contains(vector[i].previous))
</span><span class="cx">             continue;
</span><span class="cx">         
</span><del>-        newStructures.add(vector[i].next);
</del><ins>+        if (vector[i].previous-&gt;dfgShouldWatch())
+            setClobbered(true);
+        else
+            newStructures.add(vector[i].next);
</ins><span class="cx">     }
</span><span class="cx">     
</span><span class="cx">     if (!m_set.merge(newStructures))
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGStructureAbstractValueh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGStructureAbstractValue.h (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGStructureAbstractValue.h        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/Source/JavaScriptCore/dfg/DFGStructureAbstractValue.h        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -55,18 +55,6 @@
</span><span class="cx">         setClobbered(other.isClobbered());
</span><span class="cx">     }
</span><span class="cx">     
</span><del>-    ALWAYS_INLINE StructureAbstractValue&amp; operator=(Structure* structure)
-    {
-        m_set = structure;
-        setClobbered(false);
-        return *this;
-    }
-    ALWAYS_INLINE StructureAbstractValue&amp; operator=(const StructureSet&amp; other)
-    {
-        m_set = other;
-        setClobbered(false);
-        return *this;
-    }
</del><span class="cx">     ALWAYS_INLINE StructureAbstractValue&amp; operator=(const StructureAbstractValue&amp; other)
</span><span class="cx">     {
</span><span class="cx">         m_set = other.m_set;
</span><span class="lines">@@ -161,12 +149,6 @@
</span><span class="cx">         return equalsSlow(other);
</span><span class="cx">     }
</span><span class="cx">     
</span><del>-    const StructureSet&amp; set() const
-    {
-        ASSERT(!isTop());
-        return m_set;
-    }
-    
</del><span class="cx">     size_t size() const
</span><span class="cx">     {
</span><span class="cx">         ASSERT(!isTop());
</span><span class="lines">@@ -181,14 +163,14 @@
</span><span class="cx">     
</span><span class="cx">     Structure* operator[](size_t i) const { return at(i); }
</span><span class="cx">     
</span><del>-    // In most cases, what you really want to do is verify whether the set is top or clobbered, and
-    // if not, enumerate the set of structures. Use this only in cases where the singleton case is
-    // meaningfully special, like for transitions.
</del><ins>+    // FIXME: Eliminate all uses of this method. There shouldn't be any
+    // special-casing for the one-structure case.
+    // https://bugs.webkit.org/show_bug.cgi?id=133229
</ins><span class="cx">     Structure* onlyStructure() const
</span><span class="cx">     {
</span><del>-        if (isTop() || isClobbered())
</del><ins>+        if (isTop() || size() != 1)
</ins><span class="cx">             return nullptr;
</span><del>-        return m_set.onlyStructure();
</del><ins>+        return at(0);
</ins><span class="cx">     }
</span><span class="cx">     
</span><span class="cx">     void dumpInContext(PrintStream&amp;, DumpContext*) const;
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGValidatecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGValidate.cpp (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGValidate.cpp        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/Source/JavaScriptCore/dfg/DFGValidate.cpp        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -233,17 +233,6 @@
</span><span class="cx">                     VALIDATE((node), !!node-&gt;child1());
</span><span class="cx">                     VALIDATE((node), !!node-&gt;child2());
</span><span class="cx">                     break;
</span><del>-                case PutStructure:
-                    VALIDATE((node), !node-&gt;transition()-&gt;previous-&gt;dfgShouldWatch());
-                    break;
-                case MultiPutByOffset:
-                    for (unsigned i = node-&gt;multiPutByOffsetData().variants.size(); i--;) {
-                        const PutByIdVariant&amp; variant = node-&gt;multiPutByOffsetData().variants[i];
-                        if (variant.kind() != PutByIdVariant::Transition)
-                            continue;
-                        VALIDATE((node), !variant.oldStructureForTransition()-&gt;dfgShouldWatch());
-                    }
-                    break;
</del><span class="cx">                 default:
</span><span class="cx">                     break;
</span><span class="cx">                 }
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGWatchableStructureWatchingPhasecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGWatchableStructureWatchingPhase.cpp (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGWatchableStructureWatchingPhase.cpp        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/Source/JavaScriptCore/dfg/DFGWatchableStructureWatchingPhase.cpp        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -77,6 +77,7 @@
</span><span class="cx">                     break;
</span><span class="cx">                 
</span><span class="cx">                 case PutStructure:
</span><ins>+                case PhantomPutStructure:
</ins><span class="cx">                 case AllocatePropertyStorage:
</span><span class="cx">                 case ReallocatePropertyStorage:
</span><span class="cx">                     RELEASE_ASSERT(node-&gt;transition()-&gt;previous-&gt;transitionWatchpointSetHasBeenInvalidated());
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreftlFTLAbbreviationsh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/ftl/FTLAbbreviations.h (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/ftl/FTLAbbreviations.h        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/Source/JavaScriptCore/ftl/FTLAbbreviations.h        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -149,7 +149,8 @@
</span><span class="cx"> static inline void addTargetDependentFunctionAttr(LValue function, const char* key, const char* value) { llvm-&gt;AddTargetDependentFunctionAttr(function, key, value); }
</span><span class="cx"> static inline void removeFunctionAttr(LValue function, LLVMAttribute pa) { llvm-&gt;RemoveFunctionAttr(function, pa); }
</span><span class="cx"> 
</span><del>-static inline LLVMLinkage getLinkage(LValue global) { return llvm-&gt;GetLinkage(global); }
</del><ins>+
+
</ins><span class="cx"> static inline void setLinkage(LValue global, LLVMLinkage linkage) { llvm-&gt;SetLinkage(global, linkage); }
</span><span class="cx"> static inline void setVisibility(LValue global, LLVMVisibility viz) { llvm-&gt;SetVisibility(global, viz); }
</span><span class="cx"> static inline LLVMBool isDeclaration(LValue global) { return llvm-&gt;IsDeclaration(global); }
</span><span class="lines">@@ -162,6 +163,10 @@
</span><span class="cx"> static inline LValue getFirstGlobal(LModule module) { return llvm-&gt;GetFirstGlobal(module); }
</span><span class="cx"> static inline LValue getNextGlobal(LValue global) { return llvm-&gt;GetNextGlobal(global); }
</span><span class="cx"> 
</span><ins>+
+
+
+
</ins><span class="cx"> static inline LValue addExternFunction(LModule module, const char* name, LType type)
</span><span class="cx"> {
</span><span class="cx">     LValue result = addFunction(module, name, type);
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreftlFTLCapabilitiescpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/ftl/FTLCapabilities.cpp (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/ftl/FTLCapabilities.cpp        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/Source/JavaScriptCore/ftl/FTLCapabilities.cpp        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -64,6 +64,7 @@
</span><span class="cx">     case CheckStructure:
</span><span class="cx">     case ArrayifyToStructure:
</span><span class="cx">     case PutStructure:
</span><ins>+    case PhantomPutStructure:
</ins><span class="cx">     case GetButterfly:
</span><span class="cx">     case NewObject:
</span><span class="cx">     case NewArray:
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreftlFTLLowerDFGToLLVMcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/ftl/FTLLowerDFGToLLVM.cpp (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/ftl/FTLLowerDFGToLLVM.cpp        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/Source/JavaScriptCore/ftl/FTLLowerDFGToLLVM.cpp        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -476,6 +476,9 @@
</span><span class="cx">         case PutStructure:
</span><span class="cx">             compilePutStructure();
</span><span class="cx">             break;
</span><ins>+        case PhantomPutStructure:
+            compilePhantomPutStructure();
+            break;
</ins><span class="cx">         case GetById:
</span><span class="cx">             compileGetById();
</span><span class="cx">             break;
</span><span class="lines">@@ -1803,6 +1806,11 @@
</span><span class="cx">             cell, m_heaps.JSCell_structureID);
</span><span class="cx">     }
</span><span class="cx">     
</span><ins>+    void compilePhantomPutStructure()
+    {
+        m_ftlState.jitCode-&gt;common.notifyCompilingStructureTransition(m_graph.m_plan, codeBlock(), m_node);
+    }
+    
</ins><span class="cx">     void compileGetById()
</span><span class="cx">     {
</span><span class="cx">         // Pretty much the only reason why we don't also support GetByIdFlush is because:
</span><span class="lines">@@ -3248,12 +3256,6 @@
</span><span class="cx">         LValue base = lowCell(m_node-&gt;child1());
</span><span class="cx">         
</span><span class="cx">         MultiGetByOffsetData&amp; data = m_node-&gt;multiGetByOffsetData();
</span><del>-
-        if (data.variants.isEmpty()) {
-            // Protect against creating a Phi function with zero inputs. LLVM doesn't like that.
-            terminate(BadCache);
-            return;
-        }
</del><span class="cx">         
</span><span class="cx">         Vector&lt;LBasicBlock, 2&gt; blocks(data.variants.size());
</span><span class="cx">         for (unsigned i = data.variants.size(); i--;)
</span><span class="lines">@@ -3331,10 +3333,8 @@
</span><span class="cx">         Vector&lt;SwitchCase, 2&gt; cases;
</span><span class="cx">         for (unsigned i = data.variants.size(); i--;) {
</span><span class="cx">             PutByIdVariant variant = data.variants[i];
</span><del>-            for (unsigned j = variant.oldStructure().size(); j--;) {
-                cases.append(
-                    SwitchCase(weakStructure(variant.oldStructure()[j]), blocks[i], Weight(1)));
-            }
</del><ins>+            cases.append(
+                SwitchCase(weakStructure(variant.oldStructure()), blocks[i], Weight(1)));
</ins><span class="cx">         }
</span><span class="cx">         m_out.switchInstruction(
</span><span class="cx">             m_out.load32(base, m_heaps.JSCell_structureID), cases, exit, Weight(0));
</span><span class="lines">@@ -3355,15 +3355,14 @@
</span><span class="cx">             } else {
</span><span class="cx">                 m_graph.m_plan.transitions.addLazily(
</span><span class="cx">                     codeBlock(), m_node-&gt;origin.semantic.codeOriginOwner(),
</span><del>-                    variant.oldStructureForTransition(), variant.newStructure());
</del><ins>+                    variant.oldStructure(), variant.newStructure());
</ins><span class="cx">                 
</span><span class="cx">                 storage = storageForTransition(
</span><del>-                    base, variant.offset(),
-                    variant.oldStructureForTransition(), variant.newStructure());
</del><ins>+                    base, variant.offset(), variant.oldStructure(), variant.newStructure());
</ins><span class="cx"> 
</span><del>-                ASSERT(variant.oldStructureForTransition()-&gt;indexingType() == variant.newStructure()-&gt;indexingType());
-                ASSERT(variant.oldStructureForTransition()-&gt;typeInfo().inlineTypeFlags() == variant.newStructure()-&gt;typeInfo().inlineTypeFlags());
-                ASSERT(variant.oldStructureForTransition()-&gt;typeInfo().type() == variant.newStructure()-&gt;typeInfo().type());
</del><ins>+                ASSERT(variant.oldStructure()-&gt;indexingType() == variant.newStructure()-&gt;indexingType());
+                ASSERT(variant.oldStructure()-&gt;typeInfo().inlineTypeFlags() == variant.newStructure()-&gt;typeInfo().inlineTypeFlags());
+                ASSERT(variant.oldStructure()-&gt;typeInfo().type() == variant.newStructure()-&gt;typeInfo().type());
</ins><span class="cx">                 m_out.store32(
</span><span class="cx">                     weakStructure(variant.newStructure()), base, m_heaps.JSCell_structureID);
</span><span class="cx">             }
</span><span class="lines">@@ -4137,9 +4136,7 @@
</span><span class="cx">         
</span><span class="cx">         for (CString* symbol = namedFunctions.begin(); symbol != namedFunctions.end(); ++symbol) {
</span><span class="cx">             LValue function = getNamedFunction(m_ftlState.module, symbol-&gt;data());
</span><del>-            LLVMLinkage linkage = getLinkage(function);
-            if (linkage != LLVMInternalLinkage &amp;&amp; linkage != LLVMPrivateLinkage)
-                setVisibility(function, LLVMHiddenVisibility);
</del><ins>+            setVisibility(function, LLVMHiddenVisibility);
</ins><span class="cx">             if (!isDeclaration(function)) {
</span><span class="cx">                 setLinkage(function, LLVMPrivateLinkage);
</span><span class="cx"> 
</span><span class="lines">@@ -4150,9 +4147,7 @@
</span><span class="cx"> 
</span><span class="cx">         for (CString* symbol = namedGlobals.begin(); symbol != namedGlobals.end(); ++symbol) {
</span><span class="cx">             LValue global = getNamedGlobal(m_ftlState.module, symbol-&gt;data());
</span><del>-            LLVMLinkage linkage = getLinkage(global);
-            if (linkage != LLVMInternalLinkage &amp;&amp; linkage != LLVMPrivateLinkage)
-                setVisibility(global, LLVMHiddenVisibility);
</del><ins>+            setVisibility(global, LLVMHiddenVisibility);
</ins><span class="cx">             if (!isDeclaration(global))
</span><span class="cx">                 setLinkage(global, LLVMPrivateLinkage);
</span><span class="cx">         }
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreheapHeapcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/heap/Heap.cpp (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/heap/Heap.cpp        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/Source/JavaScriptCore/heap/Heap.cpp        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -35,7 +35,6 @@
</span><span class="cx"> #include &quot;HeapIterationScope.h&quot;
</span><span class="cx"> #include &quot;HeapRootVisitor.h&quot;
</span><span class="cx"> #include &quot;HeapStatistics.h&quot;
</span><del>-#include &quot;HighFidelityLog.h&quot;
</del><span class="cx"> #include &quot;IncrementalSweeper.h&quot;
</span><span class="cx"> #include &quot;Interpreter.h&quot;
</span><span class="cx"> #include &quot;JSGlobalObject.h&quot;
</span><span class="lines">@@ -970,8 +969,6 @@
</span><span class="cx"> #if ENABLE(ALLOCATION_LOGGING)
</span><span class="cx">     dataLogF(&quot;JSC GC starting collection.\n&quot;);
</span><span class="cx"> #endif
</span><del>-    if (vm()-&gt;isProfilingTypesWithHighFidelity())
-        vm()-&gt;highFidelityLog()-&gt;processHighFidelityLog(false, &quot;GC&quot;);
</del><span class="cx">     
</span><span class="cx">     double before = 0;
</span><span class="cx">     if (Options::logGC()) {
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreinspectoragentsInspectorRuntimeAgentcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/inspector/agents/InspectorRuntimeAgent.cpp (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/inspector/agents/InspectorRuntimeAgent.cpp        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/Source/JavaScriptCore/inspector/agents/InspectorRuntimeAgent.cpp        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -191,13 +191,6 @@
</span><span class="cx"> {
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-void InspectorRuntimeAgent::getRuntimeTypeForVariableInTextRange(ErrorString*, const String&amp; in_variableName, const String&amp; in_id, int in_startLine, int in_startColumn, int in_endLine, int in_endColumn, String* out_types) 
-{
-    VM&amp; vm = globalVM();
-    String types(vm.getTypesForVariableInRange(in_startLine, in_startColumn, in_endLine, in_endColumn, in_variableName, in_id));
-    *out_types = types;
-}
-
</del><span class="cx"> } // namespace Inspector
</span><span class="cx"> 
</span><span class="cx"> #endif // ENABLE(INSPECTOR)
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreinspectoragentsInspectorRuntimeAgenth"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/inspector/agents/InspectorRuntimeAgent.h (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/inspector/agents/InspectorRuntimeAgent.h        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/Source/JavaScriptCore/inspector/agents/InspectorRuntimeAgent.h        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -66,7 +66,6 @@
</span><span class="cx">     virtual void getProperties(ErrorString*, const String&amp; objectId, const bool* ownProperties, RefPtr&lt;Inspector::TypeBuilder::Array&lt;Inspector::TypeBuilder::Runtime::PropertyDescriptor&gt;&gt;&amp; result, RefPtr&lt;Inspector::TypeBuilder::Array&lt;Inspector::TypeBuilder::Runtime::InternalPropertyDescriptor&gt;&gt;&amp; internalProperties) override final;
</span><span class="cx">     virtual void releaseObjectGroup(ErrorString*, const String&amp; objectGroup) override final;
</span><span class="cx">     virtual void run(ErrorString*) override;
</span><del>-    virtual void getRuntimeTypeForVariableInTextRange(ErrorString*, const String&amp; in_variableName, const String&amp; in_id, int in_startLine, int in_startColumn, int in_endLine, int in_endColumn, String* out_types) override;
</del><span class="cx"> 
</span><span class="cx">     void setScriptDebugServer(ScriptDebugServer* scriptDebugServer) { m_scriptDebugServer = scriptDebugServer; }
</span><span class="cx"> 
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreinspectorprotocolRuntimejson"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/inspector/protocol/Runtime.json (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/inspector/protocol/Runtime.json        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/Source/JavaScriptCore/inspector/protocol/Runtime.json        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -196,21 +196,6 @@
</span><span class="cx">         {
</span><span class="cx">             &quot;name&quot;: &quot;disable&quot;,
</span><span class="cx">             &quot;description&quot;: &quot;Disables reporting of execution contexts creation.&quot;
</span><del>-        },
-        {
-            &quot;name&quot;: &quot;getRuntimeTypeForVariableInTextRange&quot;,
-            &quot;parameters&quot;: [
-                { &quot;name&quot;: &quot;variableName&quot;, &quot;type&quot;: &quot;string&quot;, &quot;description&quot;: &quot;Variable we want type infromation for.&quot; },
-                { &quot;name&quot;: &quot;sourceID&quot;, &quot;type&quot;: &quot;string&quot;, &quot;description&quot;: &quot;sourceID uniquely identifying a script&quot; },
-                { &quot;name&quot;: &quot;startLine&quot;, &quot;type&quot;: &quot;integer&quot;, &quot;description&quot;: &quot;start line for variable name&quot; },
-                { &quot;name&quot;: &quot;startColumn&quot;, &quot;type&quot;: &quot;integer&quot;, &quot;description&quot;: &quot;start column for variable name&quot; },
-                { &quot;name&quot;: &quot;endLine&quot;, &quot;type&quot;: &quot;integer&quot;, &quot;description&quot;: &quot;end line for variable name&quot; },
-                { &quot;name&quot;: &quot;endColumn&quot;, &quot;type&quot;: &quot;integer&quot;, &quot;description&quot;: &quot;end column for variable name&quot; }
-            ],
-            &quot;returns&quot;: [
-                { &quot;name&quot;: &quot;types&quot;, &quot;type&quot;: &quot;string&quot;, &quot;description&quot;: &quot;Types for requested variable.&quot; }
-            ],
-            &quot;description&quot;: &quot;Returns detailed informtation on given function.&quot;
</del><span class="cx">         }
</span><span class="cx">     ],
</span><span class="cx">     &quot;events&quot;: [
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorejsccpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/jsc.cpp (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/jsc.cpp        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/Source/JavaScriptCore/jsc.cpp        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -25,7 +25,6 @@
</span><span class="cx"> #include &quot;ArrayPrototype.h&quot;
</span><span class="cx"> #include &quot;ButterflyInlines.h&quot;
</span><span class="cx"> #include &quot;BytecodeGenerator.h&quot;
</span><del>-#include &quot;CodeBlock.h&quot;
</del><span class="cx"> #include &quot;Completion.h&quot;
</span><span class="cx"> #include &quot;CopiedSpaceInlines.h&quot;
</span><span class="cx"> #include &quot;ExceptionHelpers.h&quot;
</span><span class="lines">@@ -471,7 +470,6 @@
</span><span class="cx"> static EncodedJSValue JSC_HOST_CALL functionEffectful42(ExecState*);
</span><span class="cx"> static EncodedJSValue JSC_HOST_CALL functionIdentity(ExecState*);
</span><span class="cx"> static EncodedJSValue JSC_HOST_CALL functionMakeMasquerader(ExecState*);
</span><del>-static EncodedJSValue JSC_HOST_CALL functionDumpTypesForAllVariables (ExecState*);
</del><span class="cx"> 
</span><span class="cx"> #if ENABLE(SAMPLING_FLAGS)
</span><span class="cx"> static EncodedJSValue JSC_HOST_CALL functionSetSamplingFlags(ExecState*);
</span><span class="lines">@@ -621,7 +619,6 @@
</span><span class="cx"> 
</span><span class="cx">         addFunction(vm, &quot;createImpureGetter&quot;, functionCreateImpureGetter, 1);
</span><span class="cx">         addFunction(vm, &quot;setImpureGetterDelegate&quot;, functionSetImpureGetterDelegate, 2);
</span><del>-        addFunction(vm, &quot;dumpTypesForAllVariables&quot;, functionDumpTypesForAllVariables , 4);
</del><span class="cx">         
</span><span class="cx">         JSArray* array = constructEmptyArray(globalExec(), 0);
</span><span class="cx">         for (size_t i = 0; i &lt; arguments.size(); ++i)
</span><span class="lines">@@ -1056,12 +1053,6 @@
</span><span class="cx">     return JSValue::encode(Masquerader::create(exec-&gt;vm(), exec-&gt;lexicalGlobalObject()));
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-EncodedJSValue JSC_HOST_CALL functionDumpTypesForAllVariables(ExecState* exec)
-{
-    exec-&gt;vm().dumpHighFidelityProfilingTypes();
-    return JSValue::encode(jsUndefined());
-}
-
</del><span class="cx"> // Use SEH for Release builds only to get rid of the crash report dialog
</span><span class="cx"> // (luckily the same tests fail in Release and Debug builds so far). Need to
</span><span class="cx"> // be in a separate main function because the jscmain function requires object
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorellintLLIntDatacpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/llint/LLIntData.cpp (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/llint/LLIntData.cpp        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/Source/JavaScriptCore/llint/LLIntData.cpp        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -132,9 +132,9 @@
</span><span class="cx"> #elif CPU(X86_64) &amp;&amp; OS(WINDOWS)
</span><span class="cx">     ASSERT(maxFrameExtentForSlowPathCall == 64);
</span><span class="cx"> #endif
</span><del>-    ASSERT(StringType == 6);
-    ASSERT(ObjectType == 17);
-    ASSERT(FinalObjectType == 18);
</del><ins>+    ASSERT(StringType == 5);
+    ASSERT(ObjectType == 18);
+    ASSERT(FinalObjectType == 19);
</ins><span class="cx">     ASSERT(MasqueradesAsUndefined == 1);
</span><span class="cx">     ASSERT(ImplementsHasInstance == 2);
</span><span class="cx">     ASSERT(ImplementsDefaultHasInstance == 8);
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorellintLLIntSlowPathscpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/llint/LLIntSlowPaths.cpp (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/llint/LLIntSlowPaths.cpp        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/Source/JavaScriptCore/llint/LLIntSlowPaths.cpp        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -34,7 +34,6 @@
</span><span class="cx"> #include &quot;ExceptionFuzz.h&quot;
</span><span class="cx"> #include &quot;GetterSetter.h&quot;
</span><span class="cx"> #include &quot;HostCallReturnValue.h&quot;
</span><del>-#include &quot;HighFidelityLog.h&quot;
</del><span class="cx"> #include &quot;Interpreter.h&quot;
</span><span class="cx"> #include &quot;JIT.h&quot;
</span><span class="cx"> #include &quot;JITExceptions.h&quot;
</span><span class="lines">@@ -170,6 +169,7 @@
</span><span class="cx">         ExecState* __rcf_exec = (execCallee);                           \
</span><span class="cx">         LLINT_RETURN_TWO(pc, __rcf_exec);                               \
</span><span class="cx">     } while (false)
</span><ins>+    
</ins><span class="cx"> 
</span><span class="cx"> extern &quot;C&quot; SlowPathReturnType llint_trace_operand(ExecState* exec, Instruction* pc, int fromWhere, int operand)
</span><span class="cx"> {
</span><span class="lines">@@ -541,15 +541,6 @@
</span><span class="cx">     LLINT_RETURN(RegExpObject::create(vm, exec-&gt;lexicalGlobalObject()-&gt;regExpStructure(), regExp));
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-LLINT_SLOW_PATH_DECL(slow_path_profile_types_with_high_fidelity)
-{
-    LLINT_BEGIN();
-    TypeLocation* location = pc[2].u.location;
-    JSValue val = LLINT_OP_C(1).jsValue();
-    vm.highFidelityLog()-&gt;recordTypeInformationForLocation(val, location);
-    LLINT_END_IMPL();
-}
-
</del><span class="cx"> LLINT_SLOW_PATH_DECL(slow_path_check_has_instance)
</span><span class="cx"> {
</span><span class="cx">     LLINT_BEGIN();
</span><span class="lines">@@ -1444,8 +1435,9 @@
</span><span class="cx">     LLINT_RETURN(slot.getValue(exec, ident));
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-static JSObject* putToScopeCommon(ExecState* exec, Instruction* pc, VM&amp; vm)
</del><ins>+LLINT_SLOW_PATH_DECL(slow_path_put_to_scope)
</ins><span class="cx"> {
</span><ins>+    LLINT_BEGIN();
</ins><span class="cx">     CodeBlock* codeBlock = exec-&gt;codeBlock();
</span><span class="cx">     const Identifier&amp; ident = codeBlock-&gt;identifier(pc[2].u.operand);
</span><span class="cx">     JSObject* scope = jsCast&lt;JSObject*&gt;(LLINT_OP(1).jsValue());
</span><span class="lines">@@ -1453,7 +1445,7 @@
</span><span class="cx">     ResolveModeAndType modeAndType = ResolveModeAndType(pc[4].u.operand);
</span><span class="cx"> 
</span><span class="cx">     if (modeAndType.mode() == ThrowIfNotFound &amp;&amp; !scope-&gt;hasProperty(exec, ident))
</span><del>-        return createUndefinedVariableError(exec, ident);
</del><ins>+        LLINT_THROW(createUndefinedVariableError(exec, ident));
</ins><span class="cx"> 
</span><span class="cx">     PutPropertySlot slot(scope, codeBlock-&gt;isStrictMode());
</span><span class="cx">     scope-&gt;methodTable()-&gt;put(scope, exec, ident, value, slot);
</span><span class="lines">@@ -1467,31 +1459,9 @@
</span><span class="cx">         }
</span><span class="cx">     }
</span><span class="cx"> 
</span><del>-    return nullptr;
-}
-
-LLINT_SLOW_PATH_DECL(slow_path_put_to_scope)
-{
-    LLINT_BEGIN();
-    JSObject* error = putToScopeCommon(exec, pc, vm);
-    if (error)
-        LLINT_THROW(error);
</del><span class="cx">     LLINT_END();
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-LLINT_SLOW_PATH_DECL(slow_path_put_to_scope_with_profile)
-{
-    // The format of this instruction is the same as put_to_scope with a TypeLocation appended: put_to_scope_with_profile scope, id, value, ResolveModeAndType, Structure, Operand, TypeLocation*
-    LLINT_BEGIN();
-    JSObject* error = putToScopeCommon(exec, pc, vm);
-    if (error)
-        LLINT_THROW(error);
-    TypeLocation* location = pc[7].u.location;
-    JSValue val = LLINT_OP_C(3).jsValue();
-    vm.highFidelityLog()-&gt;recordTypeInformationForLocation(val, location);
-    LLINT_END();
-}
-
</del><span class="cx"> extern &quot;C&quot; SlowPathReturnType llint_throw_stack_overflow_error(VM* vm, ProtoCallFrame* protoFrame)
</span><span class="cx"> {
</span><span class="cx">     ExecState* exec = vm-&gt;topCallFrame;
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorellintLLIntSlowPathsh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/llint/LLIntSlowPaths.h (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/llint/LLIntSlowPaths.h        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/Source/JavaScriptCore/llint/LLIntSlowPaths.h        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -122,8 +122,6 @@
</span><span class="cx"> LLINT_SLOW_PATH_HIDDEN_DECL(slow_path_resolve_scope);
</span><span class="cx"> LLINT_SLOW_PATH_HIDDEN_DECL(slow_path_get_from_scope);
</span><span class="cx"> LLINT_SLOW_PATH_HIDDEN_DECL(slow_path_put_to_scope);
</span><del>-LLINT_SLOW_PATH_HIDDEN_DECL(slow_path_put_to_scope_with_profile);
-LLINT_SLOW_PATH_HIDDEN_DECL(slow_path_profile_types_with_high_fidelity);
</del><span class="cx"> extern &quot;C&quot; SlowPathReturnType llint_throw_stack_overflow_error(VM*, ProtoCallFrame*) WTF_INTERNAL;
</span><span class="cx"> #if !ENABLE(JIT)
</span><span class="cx"> extern &quot;C&quot; SlowPathReturnType llint_stack_check_at_vm_entry(VM*, Register*) WTF_INTERNAL;
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorellintLowLevelInterpreterasm"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/llint/LowLevelInterpreter.asm (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/llint/LowLevelInterpreter.asm        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/Source/JavaScriptCore/llint/LowLevelInterpreter.asm        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -150,9 +150,9 @@
</span><span class="cx"> const SlowPutArrayStorageShape = 30
</span><span class="cx"> 
</span><span class="cx"> # Type constants.
</span><del>-const StringType = 6
-const ObjectType = 17
-const FinalObjectType = 18
</del><ins>+const StringType = 5
+const ObjectType = 18
+const FinalObjectType = 19
</ins><span class="cx"> 
</span><span class="cx"> # Type flags constants.
</span><span class="cx"> const MasqueradesAsUndefined = 1
</span><span class="lines">@@ -1242,11 +1242,3 @@
</span><span class="cx"> _llint_op_init_global_const_nop:
</span><span class="cx">     dispatch(5)
</span><span class="cx"> 
</span><del>-_llint_op_profile_types_with_high_fidelity:
-    callSlowPath(_llint_slow_path_profile_types_with_high_fidelity)
-    dispatch(4)
-
-_llint_op_put_to_scope_with_profile:
-    traceExecution()
-    callSlowPath(_llint_slow_path_put_to_scope_with_profile)
-    dispatch(8)
</del></span></pre></div>
<a id="trunkSourceJavaScriptCorellintLowLevelInterpreter32_64asm"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/llint/LowLevelInterpreter32_64.asm (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/llint/LowLevelInterpreter32_64.asm        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/Source/JavaScriptCore/llint/LowLevelInterpreter32_64.asm        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -760,11 +760,11 @@
</span><span class="cx">     bbneq JSCell::m_type[t0], FinalObjectType, .opToThisSlow
</span><span class="cx">     loadpFromInstruction(2, t2)
</span><span class="cx">     bpneq JSCell::m_structureID[t0], t2, .opToThisSlow
</span><del>-    dispatch(4)
</del><ins>+    dispatch(3)
</ins><span class="cx"> 
</span><span class="cx"> .opToThisSlow:
</span><span class="cx">     callSlowPath(_slow_path_to_this)
</span><del>-    dispatch(4)
</del><ins>+    dispatch(3)
</ins><span class="cx"> 
</span><span class="cx"> 
</span><span class="cx"> _llint_op_new_object:
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorellintLowLevelInterpreter64asm"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/llint/LowLevelInterpreter64.asm (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/llint/LowLevelInterpreter64.asm        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/Source/JavaScriptCore/llint/LowLevelInterpreter64.asm        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -685,11 +685,11 @@
</span><span class="cx">     loadStructureWithScratch(t0, t1, t2)
</span><span class="cx">     loadpFromInstruction(2, t2)
</span><span class="cx">     bpneq t1, t2, .opToThisSlow
</span><del>-    dispatch(4)
</del><ins>+    dispatch(3)
</ins><span class="cx"> 
</span><span class="cx"> .opToThisSlow:
</span><span class="cx">     callSlowPath(_slow_path_to_this)
</span><del>-    dispatch(4)
</del><ins>+    dispatch(3)
</ins><span class="cx"> 
</span><span class="cx"> 
</span><span class="cx"> _llint_op_new_object:
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeArrayBufferNeuteringWatchpointcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/ArrayBufferNeuteringWatchpoint.cpp (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/ArrayBufferNeuteringWatchpoint.cpp        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/Source/JavaScriptCore/runtime/ArrayBufferNeuteringWatchpoint.cpp        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -57,7 +57,7 @@
</span><span class="cx"> 
</span><span class="cx"> Structure* ArrayBufferNeuteringWatchpoint::createStructure(VM&amp; vm)
</span><span class="cx"> {
</span><del>-    return Structure::create(vm, 0, jsNull(), TypeInfo(CellType, StructureFlags), info());
</del><ins>+    return Structure::create(vm, 0, jsNull(), TypeInfo(CompoundType, StructureFlags), info());
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> } // namespace JSC
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeCommonSlowPathscpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/CommonSlowPaths.cpp (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/CommonSlowPaths.cpp        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/Source/JavaScriptCore/runtime/CommonSlowPaths.cpp        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -246,18 +246,10 @@
</span><span class="cx"> {
</span><span class="cx">     BEGIN();
</span><span class="cx">     JSValue v1 = OP(1).jsValue();
</span><del>-    if (v1.isCell()) {
-        Structure* myStructure = v1.asCell()-&gt;structure(vm);
-        Structure* otherStructure = pc[2].u.structure.get();
-        if (myStructure != otherStructure) {
-            if (otherStructure)
-                pc[3].u.toThisStatus = ToThisConflicted;
-            pc[2].u.structure.set(vm, exec-&gt;codeBlock()-&gt;ownerExecutable(), myStructure);
-        }
-    } else {
-        pc[3].u.toThisStatus = ToThisConflicted;
</del><ins>+    if (v1.isCell())
+        pc[2].u.structure.set(vm, exec-&gt;codeBlock()-&gt;ownerExecutable(), v1.asCell()-&gt;structure(vm));
+    else
</ins><span class="cx">         pc[2].u.structure.clear();
</span><del>-    }
</del><span class="cx">     RETURN(v1.toThis(exec, exec-&gt;codeBlock()-&gt;isStrictMode() ? StrictMode : NotStrictMode));
</span><span class="cx"> }
</span><span class="cx"> 
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeExecutableh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/Executable.h (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/Executable.h        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/Source/JavaScriptCore/runtime/Executable.h        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -113,7 +113,7 @@
</span><span class="cx">         return m_numParametersForCall == NUM_PARAMETERS_IS_HOST;
</span><span class="cx">     }
</span><span class="cx"> 
</span><del>-    static Structure* createStructure(VM&amp; vm, JSGlobalObject* globalObject, JSValue proto) { return Structure::create(vm, globalObject, proto, TypeInfo(CellType, StructureFlags), info()); }
</del><ins>+    static Structure* createStructure(VM&amp; vm, JSGlobalObject* globalObject, JSValue proto) { return Structure::create(vm, globalObject, proto, TypeInfo(CompoundType, StructureFlags), info()); }
</ins><span class="cx">         
</span><span class="cx">     void clearCode();
</span><span class="cx"> 
</span><span class="lines">@@ -323,7 +323,7 @@
</span><span class="cx">         return OBJECT_OFFSETOF(NativeExecutable, m_constructor);
</span><span class="cx">     }
</span><span class="cx"> 
</span><del>-    static Structure* createStructure(VM&amp; vm, JSGlobalObject* globalObject, JSValue proto) { return Structure::create(vm, globalObject, proto, TypeInfo(CellType, StructureFlags), info()); }
</del><ins>+    static Structure* createStructure(VM&amp; vm, JSGlobalObject* globalObject, JSValue proto) { return Structure::create(vm, globalObject, proto, TypeInfo(LeafType, StructureFlags), info()); }
</ins><span class="cx">         
</span><span class="cx">     DECLARE_INFO;
</span><span class="cx"> 
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeHighFidelityLogcpp"></a>
<div class="delfile"><h4>Deleted: trunk/Source/JavaScriptCore/runtime/HighFidelityLog.cpp (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/HighFidelityLog.cpp        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/Source/JavaScriptCore/runtime/HighFidelityLog.cpp        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -1,124 +0,0 @@
</span><del>-/*
- * Copyright (C) 2014 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- *
- * 1.  Redistributions of source code must retain the above copyright
- *     notice, this list of conditions and the following disclaimer.
- * 2.  Redistributions in binary form must reproduce the above copyright
- *     notice, this list of conditions and the following disclaimer in the
- *     documentation and/or other materials provided with the distribution.
- * 3.  Neither the name of Apple Inc. (&quot;Apple&quot;) nor the names of
- *     its contributors may be used to endorse or promote products derived
- *     from this software without specific prior written permission.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS &quot;AS IS&quot; AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
- * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
- * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
- * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
- * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
- * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
- * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include &quot;config.h&quot;
-#include &quot;HighFidelityLog.h&quot;
-
-#include &quot;JSCJSValueInlines.h&quot;
-#include &quot;TypeLocation.h&quot;
-#include &lt;wtf/CurrentTime.h&gt;
-
-
-namespace JSC {
-
-static const bool verbose = false;
-
-void HighFidelityLog::initializeHighFidelityLog()
-{
-    ASSERT(!m_logStartPtr);
-    m_highFidelityLogSize = 50000;
-    m_logStartPtr = new LogEntry[m_highFidelityLogSize];
-    m_nextBuffer = new LogEntry[m_highFidelityLogSize];
-    m_currentOffset = 0;
-}
-
-HighFidelityLog::~HighFidelityLog()
-{
-    delete[] m_logStartPtr;
-    delete[] m_nextBuffer;
-}
-
-void HighFidelityLog::recordTypeInformationForLocation(JSValue v, TypeLocation* location)
-{
-    ASSERT(m_logStartPtr);
-    ASSERT(m_currentOffset &lt; m_highFidelityLogSize);
-
-    LogEntry* entry = m_logStartPtr + m_currentOffset;
-
-    entry-&gt;location = location;
-    entry-&gt;value = v;
-    entry-&gt;structure = (v.isCell() ? v.asCell()-&gt;structure() : nullptr);
-
-    m_currentOffset += 1;
-    if (m_currentOffset == m_highFidelityLogSize)
-        processHighFidelityLog(true, &quot;Log Full&quot;);
-}
-
-void HighFidelityLog::processHighFidelityLog(bool asynchronously, String reason)
-{
-    // This should only be called from the main execution thread.
-    if (!m_currentOffset)
-        return;
-
-    if (verbose)
-        dataLog(&quot;Process caller:'&quot;, reason,&quot;'&quot;);
-
-    ByteSpinLocker* locker = new ByteSpinLocker(m_lock);
-    ThreadData* data = new ThreadData;
-    data-&gt;m_proccessLogToOffset = m_currentOffset;
-    data-&gt;m_processLogPtr = m_logStartPtr;
-    data-&gt;m_locker = locker;
-
-    m_currentOffset = 0;
-    LogEntry* temp = m_logStartPtr;
-    m_logStartPtr = m_nextBuffer;
-    m_nextBuffer = temp;
-    
-    if (asynchronously)
-        createThread(actuallyProcessLogThreadFunction, data, &quot;ProcessHighFidelityLog&quot;);
-    else 
-        actuallyProcessLogThreadFunction(data);
-}
-
-void HighFidelityLog::actuallyProcessLogThreadFunction(void* arg)
-{
-    double before  = currentTimeMS();
-    ThreadData* data = static_cast&lt;ThreadData*&gt;(arg);
-    LogEntry* entry = data-&gt;m_processLogPtr;
-    size_t processLogToOffset = data-&gt;m_proccessLogToOffset; 
-    size_t i = 0;
-    while (i &lt; processLogToOffset) {
-        Structure* structure = entry-&gt;structure ? entry-&gt;structure : nullptr;
-        RefPtr&lt;StructureShape&gt; shape; 
-        if (structure)
-            shape = structure-&gt;toStructureShape();
-        if (entry-&gt;location-&gt;m_globalTypeSet)
-            entry-&gt;location-&gt;m_globalTypeSet-&gt;addTypeForValue(entry-&gt;value, shape);
-        entry-&gt;location-&gt;m_instructionTypeSet-&gt;addTypeForValue(entry-&gt;value, shape);
-        entry++;
-        i++;
-    }
-
-    delete data-&gt;m_locker;
-    delete data;
-    double after = currentTimeMS();
-    if (verbose)
-        dataLogF(&quot;Processing the log took: '%f' ms\n&quot;, after - before);
-}
-
-} //namespace JSC
</del></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeHighFidelityLogh"></a>
<div class="delfile"><h4>Deleted: trunk/Source/JavaScriptCore/runtime/HighFidelityLog.h (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/HighFidelityLog.h        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/Source/JavaScriptCore/runtime/HighFidelityLog.h        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -1,83 +0,0 @@
</span><del>-/*
- * Copyright (C) 2014 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- *
- * 1.  Redistributions of source code must retain the above copyright
- *     notice, this list of conditions and the following disclaimer.
- * 2.  Redistributions in binary form must reproduce the above copyright
- *     notice, this list of conditions and the following disclaimer in the
- *     documentation and/or other materials provided with the distribution.
- * 3.  Neither the name of Apple Inc. (&quot;Apple&quot;) nor the names of
- *     its contributors may be used to endorse or promote products derived
- *     from this software without specific prior written permission.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS &quot;AS IS&quot; AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
- * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
- * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
- * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
- * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
- * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
- * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#ifndef HighFidelityLog_h
-#define HighFidelityLog_h
-
-#include &quot;JSCJSValue.h&quot;
-#include &quot;HighFidelityTypeProfiler.h&quot;
-#include &quot;Structure.h&quot;
-#include &lt;wtf/ByteSpinLock.h&gt;
-
-namespace JSC {
-
-class TypeLocation;
-
-class HighFidelityLog {
-
-public:
-    struct LogEntry {
-        public:
-        JSValue value;
-        TypeLocation* location; 
-        Structure* structure;
-    };
-
-    HighFidelityLog()
-        : m_logStartPtr(0)
-    {
-        initializeHighFidelityLog();
-    }
-
-    ~HighFidelityLog();
-
-    void recordTypeInformationForLocation(JSValue v, TypeLocation*);
-    void processHighFidelityLog(bool asynchronously = false, String = &quot;&quot;);
-
-private:
-    void initializeHighFidelityLog();
-    static void actuallyProcessLogThreadFunction(void*);
-
-    unsigned m_highFidelityLogSize;
-    size_t m_currentOffset;
-    LogEntry* m_logStartPtr;
-    LogEntry* m_nextBuffer;
-
-    ByteSpinLock m_lock;
-
-    struct ThreadData {
-        public:
-        LogEntry* m_processLogPtr;
-        size_t m_proccessLogToOffset;
-        ByteSpinLocker* m_locker;
-    };
-};
-
-} //namespace JSC
-
-#endif //HighFidelityLog_h
</del></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeHighFidelityTypeProfilercpp"></a>
<div class="delfile"><h4>Deleted: trunk/Source/JavaScriptCore/runtime/HighFidelityTypeProfiler.cpp (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/HighFidelityTypeProfiler.cpp        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/Source/JavaScriptCore/runtime/HighFidelityTypeProfiler.cpp        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -1,88 +0,0 @@
</span><del>-/*
- * Copyright (C) 2014 Apple Inc. All Rights Reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include &quot;config.h&quot;
-#include &quot;HighFidelityTypeProfiler.h&quot;
-
-#include &quot;TypeLocation.h&quot;
-
-namespace JSC {
-
-static const bool verbose = false;
-
-String HighFidelityTypeProfiler::getTypesForVariableInRange(unsigned startLine, unsigned startColumn, unsigned endLine , unsigned endColumn, const String&amp; variableName, intptr_t sourceID)
-{
-    String global = getGlobalTypesForVariableInRange(startLine, startColumn, endLine, endColumn, variableName, sourceID);
-    if (!global.isEmpty())
-        return global;
-    
-    return getLocalTypesForVariableInRange(startLine, startColumn, endLine, endColumn, variableName, sourceID);
-}
-
-WTF::String HighFidelityTypeProfiler::getGlobalTypesForVariableInRange(unsigned startLine, unsigned, unsigned, unsigned, const WTF::String&amp;, intptr_t sourceID)
-{
-    auto iterLocationMap = m_globalLocationToGlobalIDMap.find(getLocationBasedHash(sourceID, startLine));
-    if (iterLocationMap == m_globalLocationToGlobalIDMap.end())
-        return &quot;&quot;;
-
-    auto iterIDMap = m_globalIDMap.find(iterLocationMap-&gt;second);
-    if (iterIDMap == m_globalIDMap.end())
-        return &quot;&quot;;
-
-    return iterIDMap-&gt;second-&gt;seenTypes();
-}
-
-WTF::String HighFidelityTypeProfiler::getLocalTypesForVariableInRange(unsigned startLine, unsigned , unsigned , unsigned , const WTF::String&amp; , intptr_t sourceID)
-{
-    auto iter = m_globalLocationMap.find(getLocationBasedHash(sourceID, startLine));
-    auto end = m_globalLocationMap.end();
-    if (iter == end)
-        return  &quot;&quot;;
-
-    return iter-&gt;second-&gt;seenTypes();
-}
-
-void HighFidelityTypeProfiler::insertNewLocation(TypeLocation* location)
-{
-    if (verbose)
-        dataLogF(&quot;Registering location:: line:%u, column:%u\n&quot;, location-&gt;m_line, location-&gt;m_column);
-
-    LocationKey key(getLocationBasedHash(location-&gt;m_sourceID, location-&gt;m_line));
-
-    if (location-&gt;m_globalVariableID != HighFidelityNoGlobalIDExists) { 
-        // Build the mapping relationships Map1:key=&gt;globalId, Map2:globalID=&gt;TypeSet 
-        m_globalLocationToGlobalIDMap[key] = location-&gt;m_globalVariableID;
-        m_globalIDMap[location-&gt;m_globalVariableID] = location-&gt;m_globalTypeSet;
-    }
-
-    m_globalLocationMap[key] = location-&gt;m_instructionTypeSet;
-}
-
-LocationKey HighFidelityTypeProfiler::getLocationBasedHash(intptr_t id, unsigned line)
-{
-    return LocationKey(id, line, 1);
-}
-
-} //namespace JSC
</del></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeHighFidelityTypeProfilerh"></a>
<div class="delfile"><h4>Deleted: trunk/Source/JavaScriptCore/runtime/HighFidelityTypeProfiler.h (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/HighFidelityTypeProfiler.h        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/Source/JavaScriptCore/runtime/HighFidelityTypeProfiler.h        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -1,89 +0,0 @@
</span><del>-/*
- * Copyright (C) 2014 Apple Inc. All Rights Reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#ifndef HighFidelityTypeProfiler_h
-#define HighFidelityTypeProfiler_h
-
-#include &quot;CodeBlock.h&quot;
-#include &lt;unordered_map&gt;
-#include &lt;wtf/HashMap.h&gt;
-#include &lt;wtf/HashMethod.h&gt;
-#include &lt;wtf/text/WTFString.h&gt;
-
-namespace JSC {
-
-class TypeLocation;
-
-struct LocationKey {
-
-public:
-    LocationKey(intptr_t sourceID, unsigned line, unsigned column) 
-        : m_sourceID(sourceID)
-        , m_line(line)
-        , m_column(column)
-
-    {
-    }
-
-    unsigned hash() const
-    {
-        return m_line + m_sourceID;
-    }
-
-    // FIXME: For now, this is a hack. We do the following: Map:&quot;ID:Line&quot; =&gt; TypeSet. Obviously, this assumes all assignments are on discrete lines, which is an incorrect assumption.
-    bool operator==(const LocationKey&amp; other) const
-    {
-        return m_sourceID == other.m_sourceID
-               &amp;&amp; m_line == other.m_line;
-    }
-
-    intptr_t m_sourceID;
-    unsigned m_line;
-    unsigned m_column;
-};
-
-class HighFidelityTypeProfiler {
-
-public:
-    String getTypesForVariableInRange(unsigned startLine, unsigned startColumn, unsigned endLine, unsigned endColumn, const String&amp; variableName, intptr_t sourceID);
-    String getGlobalTypesForVariableInRange(unsigned startLine, unsigned startColumn, unsigned endLine, unsigned endColumn, const String&amp; variableName, intptr_t sourceID);
-    String getLocalTypesForVariableInRange(unsigned startLine, unsigned startColumn, unsigned endLine, unsigned endColumn, const String&amp; variableName, intptr_t sourceID);
-    void insertNewLocation(TypeLocation*);
-    
-private:
-    static LocationKey getLocationBasedHash(intptr_t, unsigned);
-
-    typedef std::unordered_map&lt;LocationKey, RefPtr&lt;TypeSet&gt;, HashMethod&lt;LocationKey&gt;&gt; GlobalLocationMap; 
-    typedef std::unordered_map&lt;int64_t, RefPtr&lt;TypeSet&gt;&gt; GlobalIDMap; 
-    typedef std::unordered_map&lt;LocationKey, int64_t, HashMethod&lt;LocationKey&gt;&gt; GlobalLocationToGlobalIDMap;
-
-    GlobalIDMap m_globalIDMap;
-    GlobalLocationMap m_globalLocationMap;
-    GlobalLocationToGlobalIDMap m_globalLocationToGlobalIDMap;
-};
-
-} //namespace JSC
-
-#endif //HighFidelityTypeProfiler_h
</del></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeJSObjectcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/JSObject.cpp (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/JSObject.cpp        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/Source/JavaScriptCore/runtime/JSObject.cpp        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -1242,7 +1242,7 @@
</span><span class="cx">     Structure* structure = this-&gt;structure(vm);
</span><span class="cx">     if (attributes &amp; ReadOnly)
</span><span class="cx">         structure-&gt;setContainsReadOnlyProperties();
</span><del>-    structure-&gt;setHasCustomGetterSetterPropertiesWithProtoCheck(propertyName == vm.propertyNames-&gt;underscoreProto);
</del><ins>+    structure-&gt;setHasCustomGetterSetterProperties(propertyName == vm.propertyNames-&gt;underscoreProto);
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> void JSObject::putDirectNonIndexAccessor(VM&amp; vm, PropertyName propertyName, JSValue value, unsigned attributes)
</span><span class="lines">@@ -1260,7 +1260,7 @@
</span><span class="cx">     if (attributes &amp; ReadOnly)
</span><span class="cx">         structure-&gt;setContainsReadOnlyProperties();
</span><span class="cx"> 
</span><del>-    structure-&gt;setHasGetterSetterPropertiesWithProtoCheck(propertyName == vm.propertyNames-&gt;underscoreProto);
</del><ins>+    structure-&gt;setHasGetterSetterProperties(propertyName == vm.propertyNames-&gt;underscoreProto);
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> bool JSObject::hasProperty(ExecState* exec, PropertyName propertyName) const
</span><span class="lines">@@ -1638,7 +1638,7 @@
</span><span class="cx">     // If this object's ClassInfo has no static properties, then nothing to reify!
</span><span class="cx">     // We can safely set the flag to avoid the expensive check again in the future.
</span><span class="cx">     if (!classInfo()-&gt;hasStaticProperties()) {
</span><del>-        structure(vm)-&gt;setStaticFunctionsReified(true);
</del><ins>+        structure(vm)-&gt;setStaticFunctionsReified();
</ins><span class="cx">         return;
</span><span class="cx">     }
</span><span class="cx"> 
</span><span class="lines">@@ -1656,7 +1656,7 @@
</span><span class="cx">         }
</span><span class="cx">     }
</span><span class="cx"> 
</span><del>-    structure(vm)-&gt;setStaticFunctionsReified(true);
</del><ins>+    structure(vm)-&gt;setStaticFunctionsReified();
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> bool JSObject::removeDirect(VM&amp; vm, PropertyName propertyName)
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeJSPromiseDeferredh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/JSPromiseDeferred.h (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/JSPromiseDeferred.h        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/Source/JavaScriptCore/runtime/JSPromiseDeferred.h        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -42,7 +42,7 @@
</span><span class="cx"> 
</span><span class="cx">     static Structure* createStructure(VM&amp; vm, JSGlobalObject* globalObject, JSValue prototype)
</span><span class="cx">     {
</span><del>-        return Structure::create(vm, globalObject, prototype, TypeInfo(CellType, StructureFlags), info());
</del><ins>+        return Structure::create(vm, globalObject, prototype, TypeInfo(CompoundType, StructureFlags), info());
</ins><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     static const bool hasImmortalStructure = true;
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeJSPromiseReactionh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/JSPromiseReaction.h (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/JSPromiseReaction.h        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/Source/JavaScriptCore/runtime/JSPromiseReaction.h        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -43,7 +43,7 @@
</span><span class="cx">     static JSPromiseReaction* create(VM&amp;, JSPromiseDeferred*, JSValue);
</span><span class="cx">     static Structure* createStructure(VM&amp; vm, JSGlobalObject* globalObject, JSValue prototype)
</span><span class="cx">     {
</span><del>-        return Structure::create(vm, globalObject, prototype, TypeInfo(CellType, StructureFlags), info());
</del><ins>+        return Structure::create(vm, globalObject, prototype, TypeInfo(CompoundType, StructureFlags), info());
</ins><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     static const bool hasImmortalStructure = true;
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeJSPropertyNameIteratorh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/JSPropertyNameIterator.h (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/JSPropertyNameIterator.h        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/Source/JavaScriptCore/runtime/JSPropertyNameIterator.h        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -54,7 +54,7 @@
</span><span class="cx">        
</span><span class="cx">         static Structure* createStructure(VM&amp; vm, JSGlobalObject* globalObject, JSValue prototype)
</span><span class="cx">         {
</span><del>-            return Structure::create(vm, globalObject, prototype, TypeInfo(CellType, StructureFlags), info());
</del><ins>+            return Structure::create(vm, globalObject, prototype, TypeInfo(CompoundType, StructureFlags), info());
</ins><span class="cx">         }
</span><span class="cx"> 
</span><span class="cx">         static void visitChildren(JSCell*, SlotVisitor&amp;);
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeJSTypeh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/JSType.h (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/JSType.h        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/Source/JavaScriptCore/runtime/JSType.h        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -29,11 +29,11 @@
</span><span class="cx">     BooleanType,
</span><span class="cx">     NumberType,
</span><span class="cx">     NullType,
</span><del>-
-    // The CellType value must come before any JSType that is a JSCell.
-    CellType,
</del><span class="cx">     StringType,
</span><ins>+    LeafType,
</ins><span class="cx"> 
</span><ins>+    // The CompoundType value must come before any JSType that may have children.
+    CompoundType,
</ins><span class="cx">     GetterSetterType,
</span><span class="cx">     CustomGetterSetterType,
</span><span class="cx">     APIValueWrapperType,
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeJSTypeInfoh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/JSTypeInfo.h (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/JSTypeInfo.h        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/Source/JavaScriptCore/runtime/JSTypeInfo.h        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -66,6 +66,7 @@
</span><span class="cx">             , m_flags(inlineTypeFlags)
</span><span class="cx">             , m_flags2(outOfLineTypeFlags)
</span><span class="cx">         {
</span><ins>+            ASSERT(m_type &gt;= CompoundType || !(isSetOnFlags1(OverridesVisitChildren)));
</ins><span class="cx">             // No object that doesn't ImplementsHasInstance should override it!
</span><span class="cx">             ASSERT((m_flags &amp; (ImplementsHasInstance | OverridesHasInstance)) != OverridesHasInstance);
</span><span class="cx">             // ImplementsDefaultHasInstance means (ImplementsHasInstance &amp; !OverridesHasInstance)
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeMapDatah"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/MapData.h (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/MapData.h        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/Source/JavaScriptCore/runtime/MapData.h        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -78,7 +78,7 @@
</span><span class="cx"> 
</span><span class="cx">     static Structure* createStructure(VM&amp; vm, JSGlobalObject* globalObject, JSValue prototype)
</span><span class="cx">     {
</span><del>-        return Structure::create(vm, globalObject, prototype, TypeInfo(CellType, StructureFlags), info());
</del><ins>+        return Structure::create(vm, globalObject, prototype, TypeInfo(CompoundType, StructureFlags), info());
</ins><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     static const bool needsDestruction = true;
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeOptionsh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/Options.h (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/Options.h        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/Source/JavaScriptCore/runtime/Options.h        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -274,7 +274,6 @@
</span><span class="cx">     v(unsigned, gcMaxHeapSize, 0) \
</span><span class="cx">     v(bool, recordGCPauseTimes, false) \
</span><span class="cx">     v(bool, logHeapStatisticsAtExit, false) \
</span><del>-    v(bool, profileTypesWithHighFidelity, false) \
</del><span class="cx">     \
</span><span class="cx">     v(bool, enableExceptionFuzz, false) \
</span><span class="cx">     v(unsigned, fireExceptionFuzzAt, 0)
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimePropertyMapHashTableh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/PropertyMapHashTable.h (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/PropertyMapHashTable.h        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/Source/JavaScriptCore/runtime/PropertyMapHashTable.h        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -144,7 +144,7 @@
</span><span class="cx"> 
</span><span class="cx">     static Structure* createStructure(VM&amp; vm, JSGlobalObject* globalObject, JSValue prototype)
</span><span class="cx">     {
</span><del>-        return Structure::create(vm, globalObject, prototype, TypeInfo(CellType, StructureFlags), info());
</del><ins>+        return Structure::create(vm, globalObject, prototype, TypeInfo(CompoundType, StructureFlags), info());
</ins><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     static void visitChildren(JSCell*, SlotVisitor&amp;);
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeRegExph"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/RegExp.h (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/RegExp.h        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/Source/JavaScriptCore/runtime/RegExp.h        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -77,7 +77,7 @@
</span><span class="cx"> 
</span><span class="cx">         static Structure* createStructure(VM&amp; vm, JSGlobalObject* globalObject, JSValue prototype)
</span><span class="cx">         {
</span><del>-            return Structure::create(vm, globalObject, prototype, TypeInfo(CellType, StructureFlags), info());
</del><ins>+            return Structure::create(vm, globalObject, prototype, TypeInfo(LeafType, StructureFlags), info());
</ins><span class="cx">         }
</span><span class="cx">         
</span><span class="cx">         DECLARE_INFO;
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeSparseArrayValueMapcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/SparseArrayValueMap.cpp (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/SparseArrayValueMap.cpp        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/Source/JavaScriptCore/runtime/SparseArrayValueMap.cpp        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -69,7 +69,7 @@
</span><span class="cx"> 
</span><span class="cx"> Structure* SparseArrayValueMap::createStructure(VM&amp; vm, JSGlobalObject* globalObject, JSValue prototype)
</span><span class="cx"> {
</span><del>-    return Structure::create(vm, globalObject, prototype, TypeInfo(CellType, StructureFlags), info());
</del><ins>+    return Structure::create(vm, globalObject, prototype, TypeInfo(CompoundType, StructureFlags), info());
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> SparseArrayValueMap::AddResult SparseArrayValueMap::add(JSObject* array, unsigned i)
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeStructurecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/Structure.cpp (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/Structure.cpp        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/Source/JavaScriptCore/runtime/Structure.cpp        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -63,7 +63,7 @@
</span><span class="cx"> {
</span><span class="cx">     if (isUsingSingleSlot()) {
</span><span class="cx">         Structure* transition = singleTransition();
</span><del>-        return transition &amp;&amp; transition-&gt;m_nameInPrevious == rep &amp;&amp; transition-&gt;attributesInPrevious() == attributes;
</del><ins>+        return transition &amp;&amp; transition-&gt;m_nameInPrevious == rep &amp;&amp; transition-&gt;m_attributesInPrevious == attributes;
</ins><span class="cx">     }
</span><span class="cx">     return map()-&gt;get(std::make_pair(rep, attributes));
</span><span class="cx"> }
</span><span class="lines">@@ -72,7 +72,7 @@
</span><span class="cx"> {
</span><span class="cx">     if (isUsingSingleSlot()) {
</span><span class="cx">         Structure* transition = singleTransition();
</span><del>-        return (transition &amp;&amp; transition-&gt;m_nameInPrevious == rep &amp;&amp; transition-&gt;attributesInPrevious() == attributes) ? transition : 0;
</del><ins>+        return (transition &amp;&amp; transition-&gt;m_nameInPrevious == rep &amp;&amp; transition-&gt;m_attributesInPrevious == attributes) ? transition : 0;
</ins><span class="cx">     }
</span><span class="cx">     return map()-&gt;get(std::make_pair(rep, attributes));
</span><span class="cx"> }
</span><span class="lines">@@ -99,7 +99,7 @@
</span><span class="cx">     // Newer versions of the STL have an std::make_pair function that takes rvalue references.
</span><span class="cx">     // When either of the parameters are bitfields, the C++ compiler will try to bind them as lvalues, which is invalid. To work around this, use unary &quot;+&quot; to make the parameter an rvalue.
</span><span class="cx">     // See https://bugs.webkit.org/show_bug.cgi?id=59261 for more details
</span><del>-    map()-&gt;set(std::make_pair(structure-&gt;m_nameInPrevious.get(), +structure-&gt;attributesInPrevious()), structure);
</del><ins>+    map()-&gt;set(std::make_pair(structure-&gt;m_nameInPrevious.get(), +structure-&gt;m_attributesInPrevious), structure);
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> void Structure::dumpStatistics()
</span><span class="lines">@@ -157,24 +157,23 @@
</span><span class="cx">     , m_transitionWatchpointSet(IsWatched)
</span><span class="cx">     , m_offset(invalidOffset)
</span><span class="cx">     , m_inlineCapacity(inlineCapacity)
</span><del>-    , m_bitField(0)
</del><ins>+    , m_dictionaryKind(NoneDictionaryKind)
+    , m_hasBeenFlattenedBefore(false)
+    , m_isPinnedPropertyTable(false)
+    , m_hasGetterSetterProperties(classInfo-&gt;hasStaticSetterOrReadonlyProperties(vm))
+    , m_hasCustomGetterSetterProperties(false)
+    , m_hasReadOnlyOrGetterSetterPropertiesExcludingProto(classInfo-&gt;hasStaticSetterOrReadonlyProperties(vm))
+    , m_hasNonEnumerableProperties(false)
+    , m_attributesInPrevious(0)
+    , m_specificFunctionThrashCount(0)
+    , m_preventExtensions(false)
+    , m_didTransition(false)
+    , m_staticFunctionReified(false)
+    , m_hasRareData(false)
</ins><span class="cx"> {
</span><del>-    setDictionaryKind(NoneDictionaryKind);
-    setIsPinnedPropertyTable(false);
-    setHasGetterSetterProperties(classInfo-&gt;hasStaticSetterOrReadonlyProperties(vm));
-    setHasCustomGetterSetterProperties(false);
-    setHasReadOnlyOrGetterSetterPropertiesExcludingProto(classInfo-&gt;hasStaticSetterOrReadonlyProperties(vm));
-    setHasNonEnumerableProperties(false);
-    setAttributesInPrevious(0);
-    setSpecificFunctionThrashCount(0);
-    setPreventExtensions(false);
-    setDidTransition(false);
-    setStaticFunctionsReified(false);
-    setHasRareData(false);

</del><span class="cx">     ASSERT(inlineCapacity &lt;= JSFinalObject::maxInlineCapacity());
</span><span class="cx">     ASSERT(static_cast&lt;PropertyOffset&gt;(inlineCapacity) &lt; firstOutOfLineOffset);
</span><del>-    ASSERT(!hasRareData());
</del><ins>+    ASSERT(!m_hasRareData);
</ins><span class="cx">     ASSERT(hasReadOnlyOrGetterSetterPropertiesExcludingProto() || !m_classInfo-&gt;hasStaticSetterOrReadonlyProperties(vm));
</span><span class="cx">     ASSERT(hasGetterSetterProperties() || !m_classInfo-&gt;hasStaticSetterOrReadonlyProperties(vm));
</span><span class="cx"> }
</span><span class="lines">@@ -188,22 +187,21 @@
</span><span class="cx">     , m_transitionWatchpointSet(IsWatched)
</span><span class="cx">     , m_offset(invalidOffset)
</span><span class="cx">     , m_inlineCapacity(0)
</span><del>-    , m_bitField(0)
</del><ins>+    , m_dictionaryKind(NoneDictionaryKind)
+    , m_hasBeenFlattenedBefore(false)
+    , m_isPinnedPropertyTable(false)
+    , m_hasGetterSetterProperties(m_classInfo-&gt;hasStaticSetterOrReadonlyProperties(vm))
+    , m_hasCustomGetterSetterProperties(false)
+    , m_hasReadOnlyOrGetterSetterPropertiesExcludingProto(m_classInfo-&gt;hasStaticSetterOrReadonlyProperties(vm))
+    , m_hasNonEnumerableProperties(false)
+    , m_attributesInPrevious(0)
+    , m_specificFunctionThrashCount(0)
+    , m_preventExtensions(false)
+    , m_didTransition(false)
+    , m_staticFunctionReified(false)
+    , m_hasRareData(false)
</ins><span class="cx"> {
</span><del>-    setDictionaryKind(NoneDictionaryKind);
-    setIsPinnedPropertyTable(false);
-    setHasGetterSetterProperties(m_classInfo-&gt;hasStaticSetterOrReadonlyProperties(vm));
-    setHasCustomGetterSetterProperties(false);
-    setHasReadOnlyOrGetterSetterPropertiesExcludingProto(m_classInfo-&gt;hasStaticSetterOrReadonlyProperties(vm));
-    setHasNonEnumerableProperties(false);
-    setAttributesInPrevious(0);
-    setSpecificFunctionThrashCount(0);
-    setPreventExtensions(false);
-    setDidTransition(false);
-    setStaticFunctionsReified(false);
-    setHasRareData(false);

-    TypeInfo typeInfo = TypeInfo(CellType, OverridesVisitChildren | StructureIsImmortal);
</del><ins>+    TypeInfo typeInfo = TypeInfo(CompoundType, OverridesVisitChildren | StructureIsImmortal);
</ins><span class="cx">     m_blob = StructureIDBlob(vm.heap.structureIDTable().allocateID(this), 0, typeInfo);
</span><span class="cx">     m_outOfLineTypeFlags = typeInfo.outOfLineTypeFlags();
</span><span class="cx"> 
</span><span class="lines">@@ -218,27 +216,26 @@
</span><span class="cx">     , m_transitionWatchpointSet(IsWatched)
</span><span class="cx">     , m_offset(invalidOffset)
</span><span class="cx">     , m_inlineCapacity(previous-&gt;m_inlineCapacity)
</span><del>-    , m_bitField(0)
</del><ins>+    , m_dictionaryKind(previous-&gt;m_dictionaryKind)
+    , m_hasBeenFlattenedBefore(previous-&gt;m_hasBeenFlattenedBefore)
+    , m_isPinnedPropertyTable(false)
+    , m_hasGetterSetterProperties(previous-&gt;m_hasGetterSetterProperties)
+    , m_hasCustomGetterSetterProperties(previous-&gt;m_hasCustomGetterSetterProperties)
+    , m_hasReadOnlyOrGetterSetterPropertiesExcludingProto(previous-&gt;m_hasReadOnlyOrGetterSetterPropertiesExcludingProto)
+    , m_hasNonEnumerableProperties(previous-&gt;m_hasNonEnumerableProperties)
+    , m_attributesInPrevious(0)
+    , m_specificFunctionThrashCount(previous-&gt;m_specificFunctionThrashCount)
+    , m_preventExtensions(previous-&gt;m_preventExtensions)
+    , m_didTransition(true)
+    , m_staticFunctionReified(previous-&gt;m_staticFunctionReified)
+    , m_hasRareData(false)
</ins><span class="cx"> {
</span><del>-    setDictionaryKind(previous-&gt;dictionaryKind());
-    setIsPinnedPropertyTable(previous-&gt;hasBeenFlattenedBefore());
-    setHasGetterSetterProperties(previous-&gt;hasGetterSetterProperties());
-    setHasCustomGetterSetterProperties(previous-&gt;hasCustomGetterSetterProperties());
-    setHasReadOnlyOrGetterSetterPropertiesExcludingProto(previous-&gt;hasReadOnlyOrGetterSetterPropertiesExcludingProto());
-    setHasNonEnumerableProperties(previous-&gt;hasNonEnumerableProperties());
-    setAttributesInPrevious(0);
-    setSpecificFunctionThrashCount(previous-&gt;specificFunctionThrashCount());
-    setPreventExtensions(previous-&gt;preventExtensions());
-    setDidTransition(false);
-    setStaticFunctionsReified(previous-&gt;staticFunctionsReified());
-    setHasRareData(false);

</del><span class="cx">     TypeInfo typeInfo = previous-&gt;typeInfo();
</span><span class="cx">     m_blob = StructureIDBlob(vm.heap.structureIDTable().allocateID(this), previous-&gt;indexingTypeIncludingHistory(), typeInfo);
</span><span class="cx">     m_outOfLineTypeFlags = typeInfo.outOfLineTypeFlags();
</span><span class="cx"> 
</span><span class="cx">     ASSERT(!previous-&gt;typeInfo().structureIsImmortal());
</span><del>-    if (previous-&gt;hasRareData() &amp;&amp; previous-&gt;rareData()-&gt;needsCloning())
</del><ins>+    if (previous-&gt;m_hasRareData &amp;&amp; previous-&gt;rareData()-&gt;needsCloning())
</ins><span class="cx">         cloneRareDataFrom(vm, previous);
</span><span class="cx">     setPreviousID(vm, previous);
</span><span class="cx"> 
</span><span class="lines">@@ -313,7 +310,7 @@
</span><span class="cx">         structure = structures[i];
</span><span class="cx">         if (!structure-&gt;m_nameInPrevious)
</span><span class="cx">             continue;
</span><del>-        PropertyMapEntry entry(vm, this, structure-&gt;m_nameInPrevious.get(), structure-&gt;m_offset, structure-&gt;attributesInPrevious(), structure-&gt;m_specificValueInPrevious.get());
</del><ins>+        PropertyMapEntry entry(vm, this, structure-&gt;m_nameInPrevious.get(), structure-&gt;m_offset, structure-&gt;m_attributesInPrevious, structure-&gt;m_specificValueInPrevious.get());
</ins><span class="cx">         propertyTable()-&gt;add(entry, m_offset, PropertyTable::PropertyOffsetMustNotChange);
</span><span class="cx">     }
</span><span class="cx">     
</span><span class="lines">@@ -432,7 +429,7 @@
</span><span class="cx">     ASSERT(structure-&gt;isObject());
</span><span class="cx">     ASSERT(!Structure::addPropertyTransitionToExistingStructure(structure, propertyName, attributes, specificValue, offset));
</span><span class="cx">     
</span><del>-    if (structure-&gt;specificFunctionThrashCount() == maxSpecificFunctionThrashCount)
</del><ins>+    if (structure-&gt;m_specificFunctionThrashCount == maxSpecificFunctionThrashCount)
</ins><span class="cx">         specificValue = 0;
</span><span class="cx"> 
</span><span class="cx">     int maxTransitionLength;
</span><span class="lines">@@ -451,7 +448,7 @@
</span><span class="cx"> 
</span><span class="cx">     transition-&gt;m_cachedPrototypeChain.setMayBeNull(vm, transition, structure-&gt;m_cachedPrototypeChain.get());
</span><span class="cx">     transition-&gt;m_nameInPrevious = propertyName.uid();
</span><del>-    transition-&gt;setAttributesInPrevious(attributes);
</del><ins>+    transition-&gt;m_attributesInPrevious = attributes;
</ins><span class="cx">     transition-&gt;m_specificValueInPrevious.setMayBeNull(vm, transition, specificValue);
</span><span class="cx">     transition-&gt;propertyTable().set(vm, transition, structure-&gt;takePropertyTableOrCloneIfPinned(vm));
</span><span class="cx">     transition-&gt;m_offset = structure-&gt;m_offset;
</span><span class="lines">@@ -498,10 +495,10 @@
</span><span class="cx"> 
</span><span class="cx"> Structure* Structure::despecifyFunctionTransition(VM&amp; vm, Structure* structure, PropertyName replaceFunction)
</span><span class="cx"> {
</span><del>-    ASSERT(structure-&gt;specificFunctionThrashCount() &lt; maxSpecificFunctionThrashCount);
</del><ins>+    ASSERT(structure-&gt;m_specificFunctionThrashCount &lt; maxSpecificFunctionThrashCount);
</ins><span class="cx">     Structure* transition = create(vm, structure);
</span><span class="cx"> 
</span><del>-    transition-&gt;setSpecificFunctionThrashCount(transition-&gt;specificFunctionThrashCount() + 1);
</del><ins>+    ++transition-&gt;m_specificFunctionThrashCount;
</ins><span class="cx"> 
</span><span class="cx">     DeferGC deferGC(vm.heap);
</span><span class="cx">     structure-&gt;materializePropertyMapIfNecessary(vm, deferGC);
</span><span class="lines">@@ -509,7 +506,7 @@
</span><span class="cx">     transition-&gt;m_offset = structure-&gt;m_offset;
</span><span class="cx">     transition-&gt;pin();
</span><span class="cx"> 
</span><del>-    if (transition-&gt;specificFunctionThrashCount() == maxSpecificFunctionThrashCount)
</del><ins>+    if (transition-&gt;m_specificFunctionThrashCount == maxSpecificFunctionThrashCount)
</ins><span class="cx">         transition-&gt;despecifyAllFunctions(vm);
</span><span class="cx">     else {
</span><span class="cx">         bool removed = transition-&gt;despecifyFunction(vm, replaceFunction);
</span><span class="lines">@@ -553,7 +550,7 @@
</span><span class="cx">     structure-&gt;materializePropertyMapIfNecessary(vm, deferGC);
</span><span class="cx">     transition-&gt;propertyTable().set(vm, transition, structure-&gt;copyPropertyTableForPinning(vm));
</span><span class="cx">     transition-&gt;m_offset = structure-&gt;m_offset;
</span><del>-    transition-&gt;setDictionaryKind(kind);
</del><ins>+    transition-&gt;m_dictionaryKind = kind;
</ins><span class="cx">     transition-&gt;pin();
</span><span class="cx"> 
</span><span class="cx">     transition-&gt;checkOffsetConsistency();
</span><span class="lines">@@ -594,7 +591,7 @@
</span><span class="cx">         PropertyTable::iterator iter = transition-&gt;propertyTable()-&gt;begin();
</span><span class="cx">         PropertyTable::iterator end = transition-&gt;propertyTable()-&gt;end();
</span><span class="cx">         if (iter != end)
</span><del>-            transition-&gt;setHasReadOnlyOrGetterSetterPropertiesExcludingProto(true);
</del><ins>+            transition-&gt;m_hasReadOnlyOrGetterSetterPropertiesExcludingProto = true;
</ins><span class="cx">         for (; iter != end; ++iter)
</span><span class="cx">             iter-&gt;attributes |= iter-&gt;attributes &amp; Accessor ? DontDelete : (DontDelete | ReadOnly);
</span><span class="cx">     }
</span><span class="lines">@@ -616,7 +613,7 @@
</span><span class="cx">     structure-&gt;materializePropertyMapIfNecessary(vm, deferGC);
</span><span class="cx">     transition-&gt;propertyTable().set(vm, transition, structure-&gt;copyPropertyTableForPinning(vm));
</span><span class="cx">     transition-&gt;m_offset = structure-&gt;m_offset;
</span><del>-    transition-&gt;setPreventExtensions(true);
</del><ins>+    transition-&gt;m_preventExtensions = true;
</ins><span class="cx">     transition-&gt;pin();
</span><span class="cx"> 
</span><span class="cx">     transition-&gt;checkOffsetConsistency();
</span><span class="lines">@@ -628,7 +625,7 @@
</span><span class="cx">     DeferGC deferGC(vm.heap);
</span><span class="cx">     materializePropertyMapIfNecessaryForPinning(vm, deferGC);
</span><span class="cx">     
</span><del>-    if (isPinnedPropertyTable())
</del><ins>+    if (m_isPinnedPropertyTable)
</ins><span class="cx">         return propertyTable()-&gt;copy(vm, propertyTable()-&gt;size() + 1);
</span><span class="cx">     
</span><span class="cx">     // Hold the lock while stealing the table - so that getConcurrently() on another thread
</span><span class="lines">@@ -657,13 +654,13 @@
</span><span class="cx">     
</span><span class="cx">     Structure* existingTransition;
</span><span class="cx">     if (!structure-&gt;isDictionary() &amp;&amp; (existingTransition = structure-&gt;m_transitionTable.get(0, attributes))) {
</span><del>-        ASSERT(existingTransition-&gt;attributesInPrevious() == attributes);
</del><ins>+        ASSERT(existingTransition-&gt;m_attributesInPrevious == attributes);
</ins><span class="cx">         ASSERT(existingTransition-&gt;indexingTypeIncludingHistory() == indexingType);
</span><span class="cx">         return existingTransition;
</span><span class="cx">     }
</span><span class="cx">     
</span><span class="cx">     Structure* transition = create(vm, structure);
</span><del>-    transition-&gt;setAttributesInPrevious(attributes);
</del><ins>+    transition-&gt;m_attributesInPrevious = attributes;
</ins><span class="cx">     transition-&gt;m_blob.setIndexingType(indexingType);
</span><span class="cx">     transition-&gt;propertyTable().set(vm, transition, structure-&gt;takePropertyTableOrCloneIfPinned(vm));
</span><span class="cx">     transition-&gt;m_offset = structure-&gt;m_offset;
</span><span class="lines">@@ -750,8 +747,8 @@
</span><span class="cx">         checkOffsetConsistency();
</span><span class="cx">     }
</span><span class="cx"> 
</span><del>-    setDictionaryKind(NoneDictionaryKind);
-    setHasBeenFlattenedBefore(true);
</del><ins>+    m_dictionaryKind = NoneDictionaryKind;
+    m_hasBeenFlattenedBefore = true;
</ins><span class="cx"> 
</span><span class="cx">     size_t afterOutOfLineCapacity = this-&gt;outOfLineCapacity();
</span><span class="cx"> 
</span><span class="lines">@@ -775,7 +772,7 @@
</span><span class="cx"> {
</span><span class="cx">     ASSERT(!enumerationCache());
</span><span class="cx"> 
</span><del>-    if (specificFunctionThrashCount() == maxSpecificFunctionThrashCount)
</del><ins>+    if (m_specificFunctionThrashCount == maxSpecificFunctionThrashCount)
</ins><span class="cx">         specificValue = 0;
</span><span class="cx"> 
</span><span class="cx">     DeferGC deferGC(vm.heap);
</span><span class="lines">@@ -801,28 +798,28 @@
</span><span class="cx"> void Structure::pin()
</span><span class="cx"> {
</span><span class="cx">     ASSERT(propertyTable());
</span><del>-    setIsPinnedPropertyTable(true);
</del><ins>+    m_isPinnedPropertyTable = true;
</ins><span class="cx">     clearPreviousID();
</span><span class="cx">     m_nameInPrevious.clear();
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> void Structure::allocateRareData(VM&amp; vm)
</span><span class="cx"> {
</span><del>-    ASSERT(!hasRareData());
</del><ins>+    ASSERT(!m_hasRareData);
</ins><span class="cx">     StructureRareData* rareData = StructureRareData::create(vm, previous());
</span><span class="cx">     m_previousOrRareData.set(vm, this, rareData);
</span><del>-    setHasRareData(true);
-    ASSERT(hasRareData());
</del><ins>+    m_hasRareData = true;
+    ASSERT(m_hasRareData);
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> void Structure::cloneRareDataFrom(VM&amp; vm, const Structure* other)
</span><span class="cx"> {
</span><del>-    ASSERT(!hasRareData());
-    ASSERT(other-&gt;hasRareData());
</del><ins>+    ASSERT(!m_hasRareData);
+    ASSERT(other-&gt;m_hasRareData);
</ins><span class="cx">     StructureRareData* newRareData = StructureRareData::clone(vm, other-&gt;rareData());
</span><span class="cx">     m_previousOrRareData.set(vm, this, newRareData);
</span><del>-    setHasRareData(true);
-    ASSERT(hasRareData());
</del><ins>+    m_hasRareData = true;
+    ASSERT(m_hasRareData);
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> #if DUMP_PROPERTYMAP_STATS
</span><span class="lines">@@ -906,7 +903,7 @@
</span><span class="cx">         if (structure-&gt;m_nameInPrevious.get() != uid)
</span><span class="cx">             continue;
</span><span class="cx">         
</span><del>-        attributes = structure-&gt;attributesInPrevious();
</del><ins>+        attributes = structure-&gt;m_attributesInPrevious;
</ins><span class="cx">         specificValue = structure-&gt;m_specificValueInPrevious.get();
</span><span class="cx">         return structure-&gt;m_offset;
</span><span class="cx">     }
</span><span class="lines">@@ -950,7 +947,7 @@
</span><span class="cx"> 
</span><span class="cx">     checkConsistency();
</span><span class="cx">     if (attributes &amp; DontEnum)
</span><del>-        setHasNonEnumerableProperties(true);
</del><ins>+        m_hasNonEnumerableProperties = true;
</ins><span class="cx"> 
</span><span class="cx">     StringImpl* rep = propertyName.uid();
</span><span class="cx"> 
</span><span class="lines">@@ -1008,7 +1005,7 @@
</span><span class="cx"> 
</span><span class="cx">     PropertyTable::iterator end = propertyTable()-&gt;end();
</span><span class="cx">     for (PropertyTable::iterator iter = propertyTable()-&gt;begin(); iter != end; ++iter) {
</span><del>-        ASSERT(hasNonEnumerableProperties() || !(iter-&gt;attributes &amp; DontEnum));
</del><ins>+        ASSERT(m_hasNonEnumerableProperties || !(iter-&gt;attributes &amp; DontEnum));
</ins><span class="cx">         if (!iter-&gt;key-&gt;isEmptyUnique() &amp;&amp; (!(iter-&gt;attributes &amp; DontEnum) || mode == IncludeDontEnumProperties)) {
</span><span class="cx">             if (knownUnique)
</span><span class="cx">                 propertyNames.addKnownUnique(iter-&gt;key);
</span><span class="lines">@@ -1040,7 +1037,7 @@
</span><span class="cx">     visitor.append(&amp;thisObject-&gt;m_previousOrRareData);
</span><span class="cx">     visitor.append(&amp;thisObject-&gt;m_specificValueInPrevious);
</span><span class="cx"> 
</span><del>-    if (thisObject-&gt;isPinnedPropertyTable()) {
</del><ins>+    if (thisObject-&gt;m_isPinnedPropertyTable) {
</ins><span class="cx">         ASSERT(thisObject-&gt;m_propertyTableUnsafe);
</span><span class="cx">         visitor.append(&amp;thisObject-&gt;m_propertyTableUnsafe);
</span><span class="cx">     } else if (thisObject-&gt;m_propertyTableUnsafe)
</span><span class="lines">@@ -1073,39 +1070,6 @@
</span><span class="cx">     }
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-
-PassRefPtr&lt;StructureShape&gt; Structure::toStructureShape()
-{
-    Vector&lt;Structure*, 8&gt; structures;
-    Structure* structure;
-    PropertyTable* table;
-    RefPtr&lt;StructureShape&gt; shape = StructureShape::create();
-
-    findStructuresAndMapForMaterialization(structures, structure, table);
-    
-    if (table) {
-        PropertyTable::iterator iter = table-&gt;begin();
-        PropertyTable::iterator end = table-&gt;end();
-
-        for (; iter != end; ++iter)
-            shape-&gt;addProperty(iter-&gt;key);
-        
-        structure-&gt;m_lock.unlock();
-    }
-    
-    for (unsigned i = structures.size(); i--;) {
-        Structure* structure = structures[i];
-        if (!structure-&gt;m_nameInPrevious)
-            continue;
-
-        shape-&gt;addProperty(structure-&gt;m_nameInPrevious.get());
-    }
-
-    shape-&gt;markAsFinal();
-
-    return shape.release();
-}
-
</del><span class="cx"> void Structure::dump(PrintStream&amp; out) const
</span><span class="cx"> {
</span><span class="cx">     out.print(RawPointer(this), &quot;:[&quot;, classInfo()-&gt;className, &quot;, {&quot;);
</span><span class="lines">@@ -1235,7 +1199,7 @@
</span><span class="cx">     if (!propertyTable())
</span><span class="cx">         return;
</span><span class="cx"> 
</span><del>-    if (!hasNonEnumerableProperties()) {
</del><ins>+    if (!m_hasNonEnumerableProperties) {
</ins><span class="cx">         PropertyTable::iterator end = propertyTable()-&gt;end();
</span><span class="cx">         for (PropertyTable::iterator iter = propertyTable()-&gt;begin(); iter != end; ++iter) {
</span><span class="cx">             ASSERT(!(iter-&gt;attributes &amp; DontEnum));
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeStructureh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/Structure.h (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/Structure.h        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/Source/JavaScriptCore/runtime/Structure.h        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -127,7 +127,8 @@
</span><span class="cx"> 
</span><span class="cx">     JS_EXPORT_PRIVATE bool isSealed(VM&amp;);
</span><span class="cx">     JS_EXPORT_PRIVATE bool isFrozen(VM&amp;);
</span><del>-    bool isExtensible() const { return !preventExtensions(); }
</del><ins>+    bool isExtensible() const { return !m_preventExtensions; }
+    bool didTransition() const { return m_didTransition; }
</ins><span class="cx">     bool putWillGrowOutOfLineStorage();
</span><span class="cx">     size_t suggestedNewOutOfLineStorageCapacity(); 
</span><span class="cx"> 
</span><span class="lines">@@ -142,11 +143,13 @@
</span><span class="cx">     PropertyOffset removePropertyWithoutTransition(VM&amp;, PropertyName);
</span><span class="cx">     void setPrototypeWithoutTransition(VM&amp; vm, JSValue prototype) { m_prototype.set(vm, this, prototype); }
</span><span class="cx">         
</span><del>-    bool isDictionary() const { return dictionaryKind() != NoneDictionaryKind; }
-    bool isUncacheableDictionary() const { return dictionaryKind() == UncachedDictionaryKind; }
-  
-    bool propertyAccessesAreCacheable() { return dictionaryKind() != UncachedDictionaryKind &amp;&amp; !typeInfo().prohibitsPropertyCaching(); }
</del><ins>+    bool isDictionary() const { return m_dictionaryKind != NoneDictionaryKind; }
+    bool isUncacheableDictionary() const { return m_dictionaryKind == UncachedDictionaryKind; }
</ins><span class="cx"> 
</span><ins>+    bool hasBeenFlattenedBefore() const { return m_hasBeenFlattenedBefore; }
+
+    bool propertyAccessesAreCacheable() { return m_dictionaryKind != UncachedDictionaryKind &amp;&amp; !typeInfo().prohibitsPropertyCaching(); }
+
</ins><span class="cx">     // We use SlowPath in GetByIdStatus for structures that may get new impure properties later to prevent
</span><span class="cx">     // DFG from inlining property accesses since structures don't transition when a new impure property appears.
</span><span class="cx">     bool takesSlowPathInDFGForImpureProperty()
</span><span class="lines">@@ -193,7 +196,7 @@
</span><span class="cx">     Structure* previousID() const
</span><span class="cx">     {
</span><span class="cx">         ASSERT(structure()-&gt;classInfo() == info());
</span><del>-        if (hasRareData())
</del><ins>+        if (m_hasRareData)
</ins><span class="cx">             return rareData()-&gt;previousID();
</span><span class="cx">         return previous();
</span><span class="cx">     }
</span><span class="lines">@@ -267,23 +270,31 @@
</span><span class="cx"> 
</span><span class="cx">     PropertyOffset getConcurrently(VM&amp;, StringImpl* uid);
</span><span class="cx">     PropertyOffset getConcurrently(VM&amp;, StringImpl* uid, unsigned&amp; attributes, JSCell*&amp; specificValue);
</span><del>-    
-    void setHasGetterSetterPropertiesWithProtoCheck(bool is__proto__)
</del><ins>+
+    bool hasGetterSetterProperties() const { return m_hasGetterSetterProperties; }
+    bool hasReadOnlyOrGetterSetterPropertiesExcludingProto() const { return m_hasReadOnlyOrGetterSetterPropertiesExcludingProto; }
+    void setHasGetterSetterProperties(bool is__proto__)
</ins><span class="cx">     {
</span><del>-        setHasGetterSetterProperties(true);
</del><ins>+        m_hasGetterSetterProperties = true;
</ins><span class="cx">         if (!is__proto__)
</span><del>-            setHasReadOnlyOrGetterSetterPropertiesExcludingProto(true);
</del><ins>+            m_hasReadOnlyOrGetterSetterPropertiesExcludingProto = true;
</ins><span class="cx">     }
</span><del>-    
-    void setContainsReadOnlyProperties() { setHasReadOnlyOrGetterSetterPropertiesExcludingProto(true); }
-    
-    void setHasCustomGetterSetterPropertiesWithProtoCheck(bool is__proto__)
</del><ins>+
+    bool hasCustomGetterSetterProperties() const { return m_hasCustomGetterSetterProperties; }
+    void setHasCustomGetterSetterProperties(bool is__proto__)
</ins><span class="cx">     {
</span><del>-        setHasCustomGetterSetterProperties(true);
</del><ins>+        m_hasCustomGetterSetterProperties = true;
</ins><span class="cx">         if (!is__proto__)
</span><del>-            setHasReadOnlyOrGetterSetterPropertiesExcludingProto(true);
</del><ins>+            m_hasReadOnlyOrGetterSetterPropertiesExcludingProto = true;
</ins><span class="cx">     }
</span><del>-    
</del><ins>+
+    void setContainsReadOnlyProperties()
+    {
+        m_hasReadOnlyOrGetterSetterPropertiesExcludingProto = true;
+    }
+
+    bool hasNonEnumerableProperties() const { return m_hasNonEnumerableProperties; }
+        
</ins><span class="cx">     bool isEmpty() const
</span><span class="cx">     {
</span><span class="cx">         ASSERT(checkOffsetConsistency());
</span><span class="lines">@@ -291,7 +302,7 @@
</span><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     JS_EXPORT_PRIVATE void despecifyDictionaryFunction(VM&amp;, PropertyName);
</span><del>-    void disableSpecificFunctionTracking() { setSpecificFunctionThrashCount(maxSpecificFunctionThrashCount); }
</del><ins>+    void disableSpecificFunctionTracking() { m_specificFunctionThrashCount = maxSpecificFunctionThrashCount; }
</ins><span class="cx"> 
</span><span class="cx">     void setEnumerationCache(VM&amp;, JSPropertyNameIterator* enumerationCache); // Defined in JSPropertyNameIterator.h.
</span><span class="cx">     JSPropertyNameIterator* enumerationCache(); // Defined in JSPropertyNameIterator.h.
</span><span class="lines">@@ -299,18 +310,28 @@
</span><span class="cx"> 
</span><span class="cx">     JSString* objectToStringValue()
</span><span class="cx">     {
</span><del>-        if (!hasRareData())
</del><ins>+        if (!m_hasRareData)
</ins><span class="cx">             return 0;
</span><span class="cx">         return rareData()-&gt;objectToStringValue();
</span><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     void setObjectToStringValue(VM&amp; vm, JSString* value)
</span><span class="cx">     {
</span><del>-        if (!hasRareData())
</del><ins>+        if (!m_hasRareData)
</ins><span class="cx">             allocateRareData(vm);
</span><span class="cx">         rareData()-&gt;setObjectToStringValue(vm, value);
</span><span class="cx">     }
</span><span class="cx"> 
</span><ins>+    bool staticFunctionsReified()
+    {
+        return m_staticFunctionReified;
+    }
+
+    void setStaticFunctionsReified()
+    {
+        m_staticFunctionReified = true;
+    }
+
</ins><span class="cx">     const ClassInfo* classInfo() const { return m_classInfo; }
</span><span class="cx"> 
</span><span class="cx">     static ptrdiff_t structureIDOffset()
</span><span class="lines">@@ -381,8 +402,6 @@
</span><span class="cx">     {
</span><span class="cx">         return m_transitionWatchpointSet;
</span><span class="cx">     }
</span><del>-
-    PassRefPtr&lt;StructureShape&gt; toStructureShape();
</del><span class="cx">     
</span><span class="cx">     void dump(PrintStream&amp;) const;
</span><span class="cx">     void dumpInContext(PrintStream&amp;, DumpContext*) const;
</span><span class="lines">@@ -393,38 +412,6 @@
</span><span class="cx">     DECLARE_EXPORT_INFO;
</span><span class="cx"> 
</span><span class="cx"> private:
</span><del>-    typedef enum { 
-        NoneDictionaryKind = 0,
-        CachedDictionaryKind = 1,
-        UncachedDictionaryKind = 2
-    } DictionaryKind;
-
-public:
-#define DEFINE_BITFIELD(type, lowerName, upperName, width, offset) \
-    static const uint32_t s_##lowerName##Shift = offset;\
-    static const uint32_t s_##lowerName##Mask = ((1 &lt;&lt; (width - 1)) | ((1 &lt;&lt; (width - 1)) - 1));\
-    type lowerName() const { return static_cast&lt;type&gt;((m_bitField &gt;&gt; offset) &amp; s_##lowerName##Mask); }\
-    void set##upperName(type newValue) \
-    {\
-        m_bitField &amp;= ~(s_##lowerName##Mask &lt;&lt; offset);\
-        m_bitField |= (newValue &amp; s_##lowerName##Mask) &lt;&lt; offset;\
-    }
-
-    DEFINE_BITFIELD(DictionaryKind, dictionaryKind, DictionaryKind, 2, 0);
-    DEFINE_BITFIELD(bool, isPinnedPropertyTable, IsPinnedPropertyTable, 1, 2);
-    DEFINE_BITFIELD(bool, hasGetterSetterProperties, HasGetterSetterProperties, 1, 3);
-    DEFINE_BITFIELD(bool, hasReadOnlyOrGetterSetterPropertiesExcludingProto, HasReadOnlyOrGetterSetterPropertiesExcludingProto, 1, 4);
-    DEFINE_BITFIELD(bool, hasNonEnumerableProperties, HasNonEnumerableProperties, 1, 5);
-    DEFINE_BITFIELD(unsigned, attributesInPrevious, AttributesInPrevious, 14, 6);
-    DEFINE_BITFIELD(unsigned, specificFunctionThrashCount, SpecificFunctionThrashCount, 2, 20);
-    DEFINE_BITFIELD(bool, preventExtensions, PreventExtensions, 1, 22);
-    DEFINE_BITFIELD(bool, didTransition, DidTransition, 1, 23);
-    DEFINE_BITFIELD(bool, staticFunctionsReified, StaticFunctionsReified, 1, 24);
-    DEFINE_BITFIELD(bool, hasRareData, HasRareData, 1, 25);
-    DEFINE_BITFIELD(bool, hasBeenFlattenedBefore, HasBeenFlattenedBefore, 1, 26);
-    DEFINE_BITFIELD(bool, hasCustomGetterSetterProperties, HasCustomGetterSetterProperties, 1, 27);
-
-private:
</del><span class="cx">     friend class LLIntOffsetsExtractor;
</span><span class="cx"> 
</span><span class="cx">     JS_EXPORT_PRIVATE Structure(VM&amp;, JSGlobalObject*, JSValue prototype, const TypeInfo&amp;, const ClassInfo*, IndexingType, unsigned inlineCapacity);
</span><span class="lines">@@ -441,6 +428,11 @@
</span><span class="cx">     // to unlock it.
</span><span class="cx">     void findStructuresAndMapForMaterialization(Vector&lt;Structure*, 8&gt;&amp; structures, Structure*&amp;, PropertyTable*&amp;);
</span><span class="cx">     
</span><ins>+    typedef enum { 
+        NoneDictionaryKind = 0,
+        CachedDictionaryKind = 1,
+        UncachedDictionaryKind = 2
+    } DictionaryKind;
</ins><span class="cx">     static Structure* toDictionaryTransition(VM&amp;, Structure*, DictionaryKind);
</span><span class="cx"> 
</span><span class="cx">     PropertyOffset putSpecificValue(VM&amp;, PropertyName, unsigned attributes, JSCell* specificValue);
</span><span class="lines">@@ -487,7 +479,7 @@
</span><span class="cx"> 
</span><span class="cx">     void setPreviousID(VM&amp; vm, Structure* structure)
</span><span class="cx">     {
</span><del>-        if (hasRareData())
</del><ins>+        if (m_hasRareData)
</ins><span class="cx">             rareData()-&gt;setPreviousID(vm, structure);
</span><span class="cx">         else
</span><span class="cx">             m_previousOrRareData.set(vm, this, structure);
</span><span class="lines">@@ -495,7 +487,7 @@
</span><span class="cx"> 
</span><span class="cx">     void clearPreviousID()
</span><span class="cx">     {
</span><del>-        if (hasRareData())
</del><ins>+        if (m_hasRareData)
</ins><span class="cx">             rareData()-&gt;clearPreviousID();
</span><span class="cx">         else
</span><span class="cx">             m_previousOrRareData.clear();
</span><span class="lines">@@ -514,13 +506,13 @@
</span><span class="cx"> 
</span><span class="cx">     Structure* previous() const
</span><span class="cx">     {
</span><del>-        ASSERT(!hasRareData());
</del><ins>+        ASSERT(!m_hasRareData);
</ins><span class="cx">         return static_cast&lt;Structure*&gt;(m_previousOrRareData.get());
</span><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     StructureRareData* rareData() const
</span><span class="cx">     {
</span><del>-        ASSERT(hasRareData());
</del><ins>+        ASSERT(m_hasRareData);
</ins><span class="cx">         return static_cast&lt;StructureRareData*&gt;(m_previousOrRareData.get());
</span><span class="cx">     }
</span><span class="cx">         
</span><span class="lines">@@ -566,7 +558,19 @@
</span><span class="cx">     
</span><span class="cx">     ConcurrentJITLock m_lock;
</span><span class="cx">     
</span><del>-    uint32_t m_bitField;
</del><ins>+    unsigned m_dictionaryKind : 2;
+    bool m_hasBeenFlattenedBefore : 1;
+    bool m_isPinnedPropertyTable : 1;
+    bool m_hasGetterSetterProperties : 1;
+    bool m_hasCustomGetterSetterProperties : 1;
+    bool m_hasReadOnlyOrGetterSetterPropertiesExcludingProto : 1;
+    bool m_hasNonEnumerableProperties : 1;
+    unsigned m_attributesInPrevious : 14;
+    unsigned m_specificFunctionThrashCount : 2;
+    unsigned m_preventExtensions : 1;
+    unsigned m_didTransition : 1;
+    unsigned m_staticFunctionReified : 1;
+    bool m_hasRareData : 1;
</ins><span class="cx"> };
</span><span class="cx"> 
</span><span class="cx"> } // namespace JSC
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeStructureChainh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/StructureChain.h (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/StructureChain.h        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/Source/JavaScriptCore/runtime/StructureChain.h        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -57,7 +57,7 @@
</span><span class="cx"> 
</span><span class="cx">         static Structure* createStructure(VM&amp; vm, JSGlobalObject* globalObject, JSValue prototype)
</span><span class="cx">         {
</span><del>-            return Structure::create(vm, globalObject, prototype, TypeInfo(CellType, StructureFlags), info());
</del><ins>+            return Structure::create(vm, globalObject, prototype, TypeInfo(CompoundType, StructureFlags), info());
</ins><span class="cx">         }
</span><span class="cx">         
</span><span class="cx">         DECLARE_INFO;
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeStructureInlinesh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/StructureInlines.h (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/StructureInlines.h        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/Source/JavaScriptCore/runtime/StructureInlines.h        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -154,14 +154,14 @@
</span><span class="cx"> inline void Structure::setEnumerationCache(VM&amp; vm, JSPropertyNameIterator* enumerationCache)
</span><span class="cx"> {
</span><span class="cx">     ASSERT(!isDictionary());
</span><del>-    if (!hasRareData())
</del><ins>+    if (!m_hasRareData)
</ins><span class="cx">         allocateRareData(vm);
</span><span class="cx">     rareData()-&gt;setEnumerationCache(vm, enumerationCache);
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> inline JSPropertyNameIterator* Structure::enumerationCache()
</span><span class="cx"> {
</span><del>-    if (!hasRareData())
</del><ins>+    if (!m_hasRareData)
</ins><span class="cx">         return 0;
</span><span class="cx">     return rareData()-&gt;enumerationCache();
</span><span class="cx"> }
</span><span class="lines">@@ -247,7 +247,7 @@
</span><span class="cx">     PropertyTable* propertyTable = m_propertyTableUnsafe.get();
</span><span class="cx"> 
</span><span class="cx">     if (!propertyTable) {
</span><del>-        ASSERT(!isPinnedPropertyTable());
</del><ins>+        ASSERT(!m_isPinnedPropertyTable);
</ins><span class="cx">         return true;
</span><span class="cx">     }
</span><span class="cx"> 
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeStructureRareDatacpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/StructureRareData.cpp (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/StructureRareData.cpp        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/Source/JavaScriptCore/runtime/StructureRareData.cpp        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -36,7 +36,7 @@
</span><span class="cx"> 
</span><span class="cx"> Structure* StructureRareData::createStructure(VM&amp; vm, JSGlobalObject* globalObject, JSValue prototype)
</span><span class="cx"> {
</span><del>-    return Structure::create(vm, globalObject, prototype, TypeInfo(CellType, StructureFlags), info());
</del><ins>+    return Structure::create(vm, globalObject, prototype, TypeInfo(CompoundType, StructureFlags), info());
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> StructureRareData* StructureRareData::create(VM&amp; vm, Structure* previous)
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeSymbolTablecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/SymbolTable.cpp (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/SymbolTable.cpp        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/Source/JavaScriptCore/runtime/SymbolTable.cpp        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -103,11 +103,6 @@
</span><span class="cx">     , m_captureEnd(0)
</span><span class="cx">     , m_functionEnteredOnce(ClearWatchpoint)
</span><span class="cx"> {
</span><del>-    if (vm.isProfilingTypesWithHighFidelity()) {
-        m_uniqueIDMap = std::make_unique&lt;UniqueIDMap&gt;();
-        m_registerToVariableMap = std::make_unique&lt;RegisterToVariableMap&gt;();
-        m_uniqueTypeSetMap = std::make_unique&lt;UniqueTypeSetMap&gt;();
-    }
</del><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> SymbolTable::~SymbolTable() { }
</span><span class="lines">@@ -162,72 +157,9 @@
</span><span class="cx">         for (unsigned i = parameterCount(); i--;)
</span><span class="cx">             result-&gt;m_slowArguments[i] = m_slowArguments[i];
</span><span class="cx">     }
</span><del>-
-    if (m_uniqueIDMap &amp;&amp; result-&gt;m_uniqueIDMap) {
-
-        {
-            auto iter = m_uniqueIDMap-&gt;begin();
-            auto end = m_uniqueIDMap-&gt;end();
-            for (; iter != end; ++iter)
-                result-&gt;m_uniqueIDMap-&gt;set(iter-&gt;key, iter-&gt;value);
-        }
-
-        {
-            auto iter = m_registerToVariableMap-&gt;begin();
-            auto end = m_registerToVariableMap-&gt;end();
-            for (; iter != end; ++iter)
-                result-&gt;m_registerToVariableMap-&gt;set(iter-&gt;key, iter-&gt;value);
-        }
-
-        {
-            auto iter = m_uniqueTypeSetMap-&gt;begin();
-            auto end = m_uniqueTypeSetMap-&gt;end();
-            for (; iter != end; ++iter)
-                result-&gt;m_uniqueTypeSetMap-&gt;set(iter-&gt;key, iter-&gt;value);
-        }
-    }
-
</del><span class="cx">     
</span><span class="cx">     return result;
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-int64_t SymbolTable::uniqueIDForVariable(const ConcurrentJITLocker&amp;, StringImpl* key, VM&amp; vm)
-{
-    auto iter = m_uniqueIDMap-&gt;find(key);
-    auto end = m_uniqueIDMap-&gt;end();
-    ASSERT_UNUSED(end, iter != end);
-
-    int64_t&amp; id = iter-&gt;value;
-    if (id == HighFidelityNeedsUniqueIDGeneration) {
-        id = vm.getNextUniqueVariableID();
-        m_uniqueTypeSetMap-&gt;set(key, TypeSet::create()); //make a new global typeset for the ID
-    }
-         
-    return id;
-}
-
-int64_t SymbolTable::uniqueIDForRegister(const ConcurrentJITLocker&amp; locker, int registerIndex, VM&amp; vm)
-{
-    auto iter = m_registerToVariableMap-&gt;find(registerIndex);
-    auto end = m_registerToVariableMap-&gt;end();
-    ASSERT_UNUSED(end, iter != end);
-    return uniqueIDForVariable(locker, iter-&gt;value.get(), vm);
-}
-
-RefPtr&lt;TypeSet&gt; SymbolTable::globalTypeSetForRegister(const ConcurrentJITLocker&amp; locker, int registerIndex, VM&amp; vm)
-{
-    uniqueIDForRegister(locker, registerIndex, vm); //ensure it's created
-    auto iter = m_registerToVariableMap-&gt;find(registerIndex);
-    auto end = m_registerToVariableMap-&gt;end();
-    ASSERT_UNUSED(end, iter != end);
-    return globalTypeSetForVariable(locker, iter-&gt;value.get(), vm);
-}
-
-RefPtr&lt;TypeSet&gt; SymbolTable::globalTypeSetForVariable(const ConcurrentJITLocker&amp; locker, StringImpl* key, VM&amp; vm)
-{
-    uniqueIDForVariable(locker, key, vm);
-    return m_uniqueTypeSetMap-&gt;find(key)-&gt;value;
-}
-
</del><span class="cx"> } // namespace JSC
</span><span class="cx"> 
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeSymbolTableh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/SymbolTable.h (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/SymbolTable.h        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/Source/JavaScriptCore/runtime/SymbolTable.h        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -31,7 +31,6 @@
</span><span class="cx"> 
</span><span class="cx"> #include &quot;ConcurrentJITLock.h&quot;
</span><span class="cx"> #include &quot;JSObject.h&quot;
</span><del>-#include &quot;TypeSet.h&quot;
</del><span class="cx"> #include &quot;VariableWatchpointSet.h&quot;
</span><span class="cx"> #include &lt;memory&gt;
</span><span class="cx"> #include &lt;wtf/HashTraits.h&gt;
</span><span class="lines">@@ -337,9 +336,6 @@
</span><span class="cx">     typedef JSCell Base;
</span><span class="cx"> 
</span><span class="cx">     typedef HashMap&lt;RefPtr&lt;StringImpl&gt;, SymbolTableEntry, IdentifierRepHash, HashTraits&lt;RefPtr&lt;StringImpl&gt;&gt;, SymbolTableIndexHashTraits&gt; Map;
</span><del>-    typedef HashMap&lt;RefPtr&lt;StringImpl&gt;, int64_t&gt; UniqueIDMap;
-    typedef HashMap&lt;RefPtr&lt;StringImpl&gt;, RefPtr&lt;TypeSet&gt;&gt; UniqueTypeSetMap;
-    typedef HashMap&lt;int, RefPtr&lt;StringImpl&gt;, WTF::IntHash&lt;int&gt;, WTF::UnsignedWithZeroKeyHashTraits&lt;int&gt;&gt; RegisterToVariableMap;
</del><span class="cx"> 
</span><span class="cx">     static SymbolTable* create(VM&amp; vm)
</span><span class="cx">     {
</span><span class="lines">@@ -353,7 +349,7 @@
</span><span class="cx"> 
</span><span class="cx">     static Structure* createStructure(VM&amp; vm, JSGlobalObject* globalObject, JSValue prototype)
</span><span class="cx">     {
</span><del>-        return Structure::create(vm, globalObject, prototype, TypeInfo(CellType, StructureFlags), info());
</del><ins>+        return Structure::create(vm, globalObject, prototype, TypeInfo(LeafType, StructureFlags), info());
</ins><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     // You must hold the lock until after you're done with the iterator.
</span><span class="lines">@@ -417,12 +413,6 @@
</span><span class="cx">     
</span><span class="cx">     Map::AddResult add(const ConcurrentJITLocker&amp;, StringImpl* key, const SymbolTableEntry&amp; entry)
</span><span class="cx">     {
</span><del>-        if (m_uniqueIDMap) {
-            // Use a flag to indicate that we need to produce a unique ID. Because VM is in charge of creating uniqueIDs, 
-            // when uniqueID() is called, we check this flag to see if uniqueID creation is necessary.
-            m_uniqueIDMap-&gt;set(key, HighFidelityNeedsUniqueIDGeneration); 
-            m_registerToVariableMap-&gt;set(entry.getIndex(), key);
-        }
</del><span class="cx">         return m_map.add(key, entry);
</span><span class="cx">     }
</span><span class="cx">     
</span><span class="lines">@@ -434,10 +424,6 @@
</span><span class="cx">     
</span><span class="cx">     Map::AddResult set(const ConcurrentJITLocker&amp;, StringImpl* key, const SymbolTableEntry&amp; entry)
</span><span class="cx">     {
</span><del>-        if (m_uniqueIDMap) {
-            m_uniqueIDMap-&gt;set(key, HighFidelityNeedsUniqueIDGeneration); 
-            m_registerToVariableMap-&gt;set(entry.getIndex(), key);
-        }
</del><span class="cx">         return m_map.set(key, entry);
</span><span class="cx">     }
</span><span class="cx">     
</span><span class="lines">@@ -458,11 +444,6 @@
</span><span class="cx">         return contains(locker, key);
</span><span class="cx">     }
</span><span class="cx">     
</span><del>-    int64_t uniqueIDForVariable(const ConcurrentJITLocker&amp;, StringImpl* key, VM&amp; vm);
-    int64_t uniqueIDForRegister(const ConcurrentJITLocker&amp; locker, int registerIndex, VM&amp; vm);
-    RefPtr&lt;TypeSet&gt; globalTypeSetForRegister(const ConcurrentJITLocker&amp; locker, int registerIndex, VM&amp; vm);
-    RefPtr&lt;TypeSet&gt; globalTypeSetForVariable(const ConcurrentJITLocker&amp; locker, StringImpl* key, VM&amp; vm);
-
</del><span class="cx">     bool usesNonStrictEval() { return m_usesNonStrictEval; }
</span><span class="cx">     void setUsesNonStrictEval(bool usesNonStrictEval) { m_usesNonStrictEval = usesNonStrictEval; }
</span><span class="cx"> 
</span><span class="lines">@@ -513,10 +494,7 @@
</span><span class="cx">     ~SymbolTable();
</span><span class="cx"> 
</span><span class="cx">     Map m_map;
</span><del>-    std::unique_ptr&lt;UniqueIDMap&gt; m_uniqueIDMap;
-    std::unique_ptr&lt;RegisterToVariableMap&gt; m_registerToVariableMap;
-    std::unique_ptr&lt;UniqueTypeSetMap&gt; m_uniqueTypeSetMap;
-
</del><ins>+    
</ins><span class="cx">     int m_parameterCountIncludingThis;
</span><span class="cx">     bool m_usesNonStrictEval;
</span><span class="cx"> 
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeTypeSetcpp"></a>
<div class="delfile"><h4>Deleted: trunk/Source/JavaScriptCore/runtime/TypeSet.cpp (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/TypeSet.cpp        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/Source/JavaScriptCore/runtime/TypeSet.cpp        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -1,236 +0,0 @@
</span><del>-/*
- * Copyright (C) 2008, 2014 Apple Inc. All Rights Reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include &quot;config.h&quot;
-#include &quot;TypeSet.h&quot;
-
-#include &quot;JSCJSValue.h&quot;
-#include &quot;JSCJSValueInlines.h&quot;
-#include &lt;wtf/text/CString.h&gt;
-#include &lt;wtf/text/WTFString.h&gt;
-#include &lt;wtf/text/StringBuilder.h&gt;
-#include &lt;wtf/Vector.h&gt;
-
-namespace JSC {
-
-TypeSet::TypeSet()
-    : m_seenTypes(TypeNothing)
-    , m_structureHistory(new Vector&lt;RefPtr&lt;StructureShape&gt;&gt;)
-    , m_mightHaveDuplicatesInStructureHistory(false)
-{
-}
-
-RuntimeType TypeSet::getRuntimeTypeForValue(JSValue v)
-{
-    RuntimeType ret;
-    if (v.isFunction())
-        ret = TypeFunction;
-    else if (v.isUndefined())
-        ret = TypeUndefined;
-    else if (v.isNull())
-        ret = TypeNull;
-    else if (v.isBoolean())
-        ret = TypeBoolean;
-    else if (v.isMachineInt())
-        ret = TypeMachineInt;
-    else if (v.isNumber())
-        ret = TypeNumber;
-    else if (v.isString())
-        ret = TypeString;
-    else if (v.isPrimitive())
-        ret = TypePrimitive;
-    else if (v.isObject())
-        ret = TypeObject;
-    else
-        CRASH();
-
-    return ret;
-}
-
-void TypeSet::addTypeForValue(JSValue v, PassRefPtr&lt;StructureShape&gt; shape) 
-{
-    RuntimeType t = getRuntimeTypeForValue(v);
-    m_seenTypes = m_seenTypes | t;
-
-    if (shape) {
-        m_structureHistory-&gt;append(shape);
-        m_mightHaveDuplicatesInStructureHistory = true;
-    }
-}
-
-void TypeSet::removeDuplicatesInStructureHistory() 
-{
-    Vector&lt;RefPtr&lt;StructureShape&gt;&gt;* newHistory = new Vector&lt;RefPtr&lt;StructureShape&gt;&gt;;
-    HashMap&lt;String, bool&gt; container;
-    for (size_t i = 0; i &lt; m_structureHistory-&gt;size(); i++) {
-        RefPtr&lt;StructureShape&gt; a = m_structureHistory-&gt;at(i);
-        String hash = a-&gt;propertyHash();
-        auto iter = container.find(hash);
-        if (iter == container.end()) {
-            container.add(hash, true);
-            newHistory-&gt;append(a);
-        }
-    }
-
-    delete m_structureHistory;
-    m_structureHistory = newHistory;
-    m_mightHaveDuplicatesInStructureHistory = false;
-}
-
-String TypeSet::seenTypes() 
-{
-    if (m_seenTypes == TypeNothing)
-        return &quot;(Unreached Statement)&quot;;
-
-    if (m_mightHaveDuplicatesInStructureHistory)
-        removeDuplicatesInStructureHistory();
-
-    StringBuilder seen;
-
-    if (m_seenTypes &amp; TypeFunction)
-         seen.append(&quot;Function &quot;);
-    if (m_seenTypes &amp; TypeUndefined)
-         seen.append(&quot;Undefined &quot;);
-    if (m_seenTypes &amp; TypeNull)
-         seen.append(&quot;Null &quot;);
-    if (m_seenTypes &amp; TypeBoolean)
-         seen.append(&quot;Boolean &quot;);
-    if (m_seenTypes &amp; TypeMachineInt)
-         seen.append(&quot;MachineInt &quot;);
-    if (m_seenTypes &amp; TypeNumber)
-         seen.append(&quot;Number &quot;);
-    if (m_seenTypes &amp; TypeString)
-         seen.append(&quot;String &quot;);
-    if (m_seenTypes &amp; TypePrimitive)
-         seen.append(&quot;Primitive &quot;);
-    if (m_seenTypes &amp; TypeObject)
-         seen.append(&quot;Object &quot;);
-
-    if (m_structureHistory-&gt;size()) 
-        seen.append(&quot;\nStructures:[ &quot;);
-    for (size_t i = 0; i &lt; m_structureHistory-&gt;size(); i++) {
-        seen.append(m_structureHistory-&gt;at(i)-&gt;stringRepresentation());
-        seen.append(&quot; &quot;);
-    }
-    if (m_structureHistory-&gt;size())
-        seen.append(&quot;]&quot;);
-
-    if (m_structureHistory-&gt;size()) {
-        seen.append(&quot;\nLUB: &quot;);
-        seen.append(StructureShape::leastUpperBound(m_structureHistory));
-    }
-
-    return seen.toString();
-}
-
-void TypeSet::dumpSeenTypes()
-{
-    dataLog(seenTypes(), &quot;\n&quot;);
-}
-
-StructureShape::StructureShape()
-    : m_propertyHash(nullptr)
-    , m_final(false)
-{
-}
-
-void StructureShape::markAsFinal()
-{
-    ASSERT(!m_final);
-    m_final = true;
-}
-
-void StructureShape::addProperty(RefPtr&lt;StringImpl&gt; impl)
-{
-    ASSERT(!m_final);
-    m_fields.set(impl, true);
-}
-
-String StructureShape::propertyHash() 
-{
-    ASSERT(m_final);
-    if (m_propertyHash)
-        return *m_propertyHash;
-
-    StringBuilder builder;
-    builder.append(&quot;:&quot;);
-    for (auto iter = m_fields.begin(), end = m_fields.end(); iter != end; ++iter) {
-        String property = String(iter-&gt;key);
-        property.replace(&quot;:&quot;, &quot;\\:&quot;); // Ensure that hash({&quot;foo:&quot;, &quot;bar&quot;}) != hash({&quot;foo&quot;, &quot;:bar&quot;}) because we're using colons as a separator and colons are legal characters in field names in JS.
-        builder.append(property);
-    }
-
-    m_propertyHash = std::make_unique&lt;String&gt;(builder.toString());
-    return *m_propertyHash;
-}
-
-String StructureShape::leastUpperBound(Vector&lt;RefPtr&lt;StructureShape&gt;&gt;* shapes)
-{
-    if (!shapes-&gt;size())
-        return &quot;&quot;;
-
-    StringBuilder lub;
-    RefPtr&lt;StructureShape&gt; origin = shapes-&gt;at(0);
-    lub.append(&quot;{&quot;);
-    for (auto iter = origin-&gt;m_fields.begin(), end = origin-&gt;m_fields.end(); iter != end; ++iter) {
-        bool shouldAdd = true;
-        for (size_t i = 1, size = shapes-&gt;size(); i &lt; size; i++) {
-            // If all other Shapes have the same field as origin, add it to the least upper bound.
-            if (!shapes-&gt;at(i)-&gt;m_fields.contains(iter-&gt;key)) {
-                shouldAdd = false;
-                break;
-            }
-        }
-        if (shouldAdd)
-            lub.append(String(iter-&gt;key.get()) + String(&quot;, &quot;));
-    }
-
-    if (lub.length() &gt;= 3)
-        lub.resize(lub.length() - 2); // Remove the trailing ', '
-
-    lub.append(&quot;}&quot;);
-    
-    return lub.toString();
-}
-
-String StructureShape::stringRepresentation()
-{
-    StringBuilder representation;
-    representation.append(&quot;{&quot;);
-    for (auto iter = m_fields.begin(), end = m_fields.end(); iter != end; ++iter) {
-        String prop(iter-&gt;key.get());
-        representation.append(prop);
-        representation.append(&quot;, &quot;);
-    }
-
-    if (representation.length() &gt;= 3)
-        representation.resize(representation.length() - 2);
-
-    representation.append(&quot;}&quot;);
-
-    return representation.toString();
-}
-
-} //namespace JSC
</del></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeTypeSeth"></a>
<div class="delfile"><h4>Deleted: trunk/Source/JavaScriptCore/runtime/TypeSet.h (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/TypeSet.h        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/Source/JavaScriptCore/runtime/TypeSet.h        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -1,90 +0,0 @@
</span><del>-/*
- * Copyright (C) 2008, 2014 Apple Inc. All Rights Reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#ifndef TypeSet_h
-#define TypeSet_h
-
-#include &lt;wtf/HashMap.h&gt;
-#include &lt;wtf/RefCounted.h&gt;
-#include &lt;wtf/text/WTFString.h&gt;
-#include &lt;wtf/Vector.h&gt;
-
-namespace JSC {
-
-class JSValue;
-
-enum RuntimeType {
-    TypeNothing            = 0x0,
-    TypeFunction           = 0x1,
-    TypeUndefined          = 0x2,
-    TypeNull               = 0x4,
-    TypeBoolean            = 0x8,
-    TypeMachineInt         = 0x10,
-    TypeNumber             = 0x20,
-    TypeString             = 0x40,
-    TypePrimitive          = 0x80,
-    TypeObject             = 0x100
-};
-
-class StructureShape : public RefCounted&lt;StructureShape&gt; {
-    friend class TypeSet;
-
-public:
-    StructureShape();
-
-    static PassRefPtr&lt;StructureShape&gt; create() { return adoptRef(new StructureShape); }
-    String propertyHash();
-    void markAsFinal();
-    void addProperty(RefPtr&lt;StringImpl&gt;);
-    static String leastUpperBound(Vector&lt;RefPtr&lt;StructureShape&gt;&gt;*);
-    String stringRepresentation();
-
-private:
-    HashMap&lt;RefPtr&lt;StringImpl&gt;, bool&gt; m_fields;         
-    std::unique_ptr&lt;String&gt; m_propertyHash;
-    bool m_final;
-};
-
-class TypeSet : public RefCounted&lt;TypeSet&gt; {
-
-public:
-    static PassRefPtr&lt;TypeSet&gt; create() { return adoptRef(new TypeSet); }
-    TypeSet();
-    void addTypeForValue(JSValue v, PassRefPtr&lt;StructureShape&gt;);
-    static RuntimeType getRuntimeTypeForValue(JSValue);
-    JS_EXPORT_PRIVATE String seenTypes();
-
-private:
-    uint32_t m_seenTypes;
-    void dumpSeenTypes();
-    Vector&lt;RefPtr&lt;StructureShape&gt;&gt;* m_structureHistory;
-    bool m_mightHaveDuplicatesInStructureHistory;
-    void removeDuplicatesInStructureHistory();
-
-};
-
-} //namespace JSC
-
-#endif //TypeSet_h
</del></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeVMcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/VM.cpp (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/VM.cpp        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/Source/JavaScriptCore/runtime/VM.cpp        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -40,7 +40,7 @@
</span><span class="cx"> #include &quot;CustomGetterSetter.h&quot;
</span><span class="cx"> #include &quot;DFGLongLivedState.h&quot;
</span><span class="cx"> #include &quot;DFGWorklist.h&quot;
</span><del>-#include &quot;DebuggerScope.h&quot;
</del><ins>+#include &quot;DebuggerActivation.h&quot;
</ins><span class="cx"> #include &quot;ErrorInstance.h&quot;
</span><span class="cx"> #include &quot;FTLThunks.h&quot;
</span><span class="cx"> #include &quot;FunctionConstructor.h&quot;
</span><span class="lines">@@ -48,8 +48,6 @@
</span><span class="cx"> #include &quot;GetterSetter.h&quot;
</span><span class="cx"> #include &quot;Heap.h&quot;
</span><span class="cx"> #include &quot;HeapIterationScope.h&quot;
</span><del>-#include &quot;HighFidelityTypeProfiler.h&quot;
-#include &quot;HighFidelityLog.h&quot;
</del><span class="cx"> #include &quot;HostCallReturnValue.h&quot;
</span><span class="cx"> #include &quot;Identifier.h&quot;
</span><span class="cx"> #include &quot;IncrementalSweeper.h&quot;
</span><span class="lines">@@ -91,7 +89,6 @@
</span><span class="cx"> #include &lt;wtf/Threading.h&gt;
</span><span class="cx"> #include &lt;wtf/WTFThreadData.h&gt;
</span><span class="cx"> #include &lt;wtf/text/AtomicStringTable.h&gt;
</span><del>-#include &lt;wtf/CurrentTime.h&gt;
</del><span class="cx"> 
</span><span class="cx"> #if ENABLE(DFG_JIT)
</span><span class="cx"> #include &quot;ConservativeRoots.h&quot;
</span><span class="lines">@@ -233,7 +230,6 @@
</span><span class="cx">     , m_codeCache(CodeCache::create())
</span><span class="cx">     , m_enabledProfiler(nullptr)
</span><span class="cx">     , m_builtinExecutables(BuiltinExecutables::create(*this))
</span><del>-    , m_nextUniqueVariableID(1)
</del><span class="cx"> {
</span><span class="cx">     interpreter = new Interpreter(*this);
</span><span class="cx">     StackBounds stack = wtfThreadData().stack();
</span><span class="lines">@@ -249,7 +245,7 @@
</span><span class="cx">     propertyNames = new CommonIdentifiers(this);
</span><span class="cx">     structureStructure.set(*this, Structure::createStructure(*this));
</span><span class="cx">     structureRareDataStructure.set(*this, StructureRareData::createStructure(*this, 0, jsNull()));
</span><del>-    debuggerScopeStructure.set(*this, DebuggerScope::createStructure(*this, 0, jsNull()));
</del><ins>+    debuggerActivationStructure.set(*this, DebuggerActivation::createStructure(*this, 0, jsNull()));
</ins><span class="cx">     terminatedExecutionErrorStructure.set(*this, TerminatedExecutionError::createStructure(*this, 0, jsNull()));
</span><span class="cx">     stringStructure.set(*this, JSString::createStructure(*this, 0, jsNull()));
</span><span class="cx">     notAnObjectStructure.set(*this, JSNotAnObject::createStructure(*this, 0, jsNull()));
</span><span class="lines">@@ -268,6 +264,7 @@
</span><span class="cx">     structureChainStructure.set(*this, StructureChain::createStructure(*this, 0, jsNull()));
</span><span class="cx">     sparseArrayValueMapStructure.set(*this, SparseArrayValueMap::createStructure(*this, 0, jsNull()));
</span><span class="cx">     arrayBufferNeuteringWatchpointStructure.set(*this, ArrayBufferNeuteringWatchpoint::createStructure(*this));
</span><ins>+    withScopeStructure.set(*this, JSWithScope::createStructure(*this, 0, jsNull()));
</ins><span class="cx">     unlinkedFunctionExecutableStructure.set(*this, UnlinkedFunctionExecutable::createStructure(*this, 0, jsNull()));
</span><span class="cx">     unlinkedProgramCodeBlockStructure.set(*this, UnlinkedProgramCodeBlock::createStructure(*this, 0, jsNull()));
</span><span class="cx">     unlinkedEvalCodeBlockStructure.set(*this, UnlinkedEvalCodeBlock::createStructure(*this, 0, jsNull()));
</span><span class="lines">@@ -325,12 +322,6 @@
</span><span class="cx">     // Initialize this last, as a free way of asserting that VM initialization itself
</span><span class="cx">     // won't use this.
</span><span class="cx">     m_typedArrayController = adoptRef(new SimpleTypedArrayController());
</span><del>-
-    // FIXME: conditionally allocate this stuff based on whether or not the inspector is running OR this flag is enabled (not just if the flag is enabled).
-    if (Options::profileTypesWithHighFidelity()) {
-        m_highFidelityTypeProfiler = std::make_unique&lt;HighFidelityTypeProfiler&gt;();
-        m_highFidelityLog = std::make_unique&lt;HighFidelityLog&gt;();
-    }
</del><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> VM::~VM()
</span><span class="lines">@@ -923,46 +914,6 @@
</span><span class="cx">     }
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-String VM::getTypesForVariableInRange(unsigned startLine, unsigned startColumn, unsigned endLine, unsigned endColumn, const String&amp; variableName, const String&amp; sourceIDAsString)
-{
-    if (!isProfilingTypesWithHighFidelity())
-        return &quot;(Not Profiling)&quot;;
-
-    bool okay;
-    intptr_t sourceID = sourceIDAsString.toIntPtrStrict(&amp;okay);
-    if (!okay)
-        CRASH();
-
-    updateHighFidelityTypeProfileState();
-    return m_highFidelityTypeProfiler-&gt;getTypesForVariableInRange(startLine, startColumn, endLine, endColumn, variableName, sourceID);
-}
-
-void VM::updateHighFidelityTypeProfileState()
-{
-    if (!isProfilingTypesWithHighFidelity())
-        return;
-
-    highFidelityLog()-&gt;processHighFidelityLog(false, &quot;VM Update&quot;);
-}
-
-void VM::dumpHighFidelityProfilingTypes()
-{
-    if (!isProfilingTypesWithHighFidelity())
-        return;
-
-    updateHighFidelityTypeProfileState();
-    HighFidelityTypeProfiler* profiler = m_highFidelityTypeProfiler.get();
-    for (Bag&lt;TypeLocation&gt;::iterator iter = m_locationInfo.begin(); !!iter; ++iter) {
-        TypeLocation* location = *iter;
-        dataLogF(&quot;[Line, Column]::[%u, %u] &quot;, location-&gt;m_line, location-&gt;m_column);
-        dataLog(&quot;\n\t\t#Local#\n\t\t&quot;,
-                profiler-&gt;getLocalTypesForVariableInRange(location-&gt;m_line, location-&gt;m_column, location-&gt;m_line, location-&gt;m_column, &quot;&quot;, location-&gt;m_sourceID).replace(&quot;\n&quot;, &quot;\n\t\t&quot;),
-                &quot;\n\t\t#Global#\n\t\t&quot;,
-                profiler-&gt;getGlobalTypesForVariableInRange(location-&gt;m_line, location-&gt;m_column, location-&gt;m_line, location-&gt;m_column, &quot;&quot;, location-&gt;m_sourceID).replace(&quot;\n&quot;, &quot;\n\t\t&quot;),
-                &quot;\n&quot;);
-    }
-}
-
</del><span class="cx"> void sanitizeStackForVM(VM* vm)
</span><span class="cx"> {
</span><span class="cx">     logSanitizeStack(vm);
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeVMh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/VM.h (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/VM.h        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/Source/JavaScriptCore/runtime/VM.h        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -46,11 +46,9 @@
</span><span class="cx"> #include &quot;Strong.h&quot;
</span><span class="cx"> #include &quot;ThunkGenerators.h&quot;
</span><span class="cx"> #include &quot;TypedArrayController.h&quot;
</span><del>-#include &quot;TypeLocation.h&quot;
</del><span class="cx"> #include &quot;Watchdog.h&quot;
</span><span class="cx"> #include &quot;Watchpoint.h&quot;
</span><span class="cx"> #include &quot;WeakRandom.h&quot;
</span><del>-#include &lt;wtf/Bag.h&gt;
</del><span class="cx"> #include &lt;wtf/BumpPointerAllocator.h&gt;
</span><span class="cx"> #include &lt;wtf/DateMath.h&gt;
</span><span class="cx"> #include &lt;wtf/Forward.h&gt;
</span><span class="lines">@@ -76,8 +74,6 @@
</span><span class="cx">     class CommonIdentifiers;
</span><span class="cx">     class ExecState;
</span><span class="cx">     class HandleStack;
</span><del>-    class HighFidelityTypeProfiler;
-    class HighFidelityLog;
</del><span class="cx">     class Identifier;
</span><span class="cx">     class Interpreter;
</span><span class="cx">     class JSGlobalObject;
</span><span class="lines">@@ -88,7 +84,6 @@
</span><span class="cx">     class NativeExecutable;
</span><span class="cx">     class ParserArena;
</span><span class="cx">     class RegExpCache;
</span><del>-    class ScriptExecutable;
</del><span class="cx">     class SourceProvider;
</span><span class="cx">     class SourceProviderCache;
</span><span class="cx">     struct StackFrame;
</span><span class="lines">@@ -101,7 +96,6 @@
</span><span class="cx">     class UnlinkedEvalCodeBlock;
</span><span class="cx">     class UnlinkedFunctionExecutable;
</span><span class="cx">     class UnlinkedProgramCodeBlock;
</span><del>-    class VirtualRegister;
</del><span class="cx">     class VMEntryScope;
</span><span class="cx">     class Watchpoint;
</span><span class="cx">     class WatchpointSet;
</span><span class="lines">@@ -262,7 +256,7 @@
</span><span class="cx"> 
</span><span class="cx">         Strong&lt;Structure&gt; structureStructure;
</span><span class="cx">         Strong&lt;Structure&gt; structureRareDataStructure;
</span><del>-        Strong&lt;Structure&gt; debuggerScopeStructure;
</del><ins>+        Strong&lt;Structure&gt; debuggerActivationStructure;
</ins><span class="cx">         Strong&lt;Structure&gt; terminatedExecutionErrorStructure;
</span><span class="cx">         Strong&lt;Structure&gt; stringStructure;
</span><span class="cx">         Strong&lt;Structure&gt; notAnObjectStructure;
</span><span class="lines">@@ -281,6 +275,7 @@
</span><span class="cx">         Strong&lt;Structure&gt; structureChainStructure;
</span><span class="cx">         Strong&lt;Structure&gt; sparseArrayValueMapStructure;
</span><span class="cx">         Strong&lt;Structure&gt; arrayBufferNeuteringWatchpointStructure;
</span><ins>+        Strong&lt;Structure&gt; withScopeStructure;
</ins><span class="cx">         Strong&lt;Structure&gt; unlinkedFunctionExecutableStructure;
</span><span class="cx">         Strong&lt;Structure&gt; unlinkedProgramCodeBlockStructure;
</span><span class="cx">         Strong&lt;Structure&gt; unlinkedEvalCodeBlockStructure;
</span><span class="lines">@@ -515,15 +510,6 @@
</span><span class="cx">         
</span><span class="cx">         BuiltinExecutables* builtinExecutables() { return m_builtinExecutables.get(); }
</span><span class="cx"> 
</span><del>-        bool isProfilingTypesWithHighFidelity() { return !!m_highFidelityTypeProfiler; }
-        String getTypesForVariableInRange(unsigned startLine, unsigned startColumn, unsigned endLine, unsigned endColumn, const String&amp; variableName, const String&amp; sourceID);
-        HighFidelityLog* highFidelityLog() { return m_highFidelityLog.get(); }
-        HighFidelityTypeProfiler* highFidelityTypeProfiler() { return m_highFidelityTypeProfiler.get(); }
-        void updateHighFidelityTypeProfileState();
-        TypeLocation* nextLocation() { return m_locationInfo.add(); } //TODO: possible optmization: when codeblocks die, report which locations are no longer being changed so we don't walk over them
-        JS_EXPORT_PRIVATE void dumpHighFidelityProfilingTypes();
-        int64_t getNextUniqueVariableID() { return m_nextUniqueVariableID++; }
-
</del><span class="cx">     private:
</span><span class="cx">         friend class LLIntOffsetsExtractor;
</span><span class="cx">         friend class ClearExceptionScope;
</span><span class="lines">@@ -572,10 +558,6 @@
</span><span class="cx">         OwnPtr&lt;BuiltinExecutables&gt; m_builtinExecutables;
</span><span class="cx">         RefCountedArray&lt;StackFrame&gt; m_exceptionStack;
</span><span class="cx">         HashMap&lt;String, RefPtr&lt;WatchpointSet&gt;&gt; m_impurePropertyWatchpointSets;
</span><del>-        std::unique_ptr&lt;HighFidelityTypeProfiler&gt; m_highFidelityTypeProfiler;
-        std::unique_ptr&lt;HighFidelityLog&gt; m_highFidelityLog;
-        int64_t m_nextUniqueVariableID;
-        Bag&lt;TypeLocation&gt; m_locationInfo;
</del><span class="cx">     };
</span><span class="cx"> 
</span><span class="cx"> #if ENABLE(GC_VALIDATION)
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeWeakMapDatah"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/WeakMapData.h (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/WeakMapData.h        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/Source/JavaScriptCore/runtime/WeakMapData.h        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -47,7 +47,7 @@
</span><span class="cx"> 
</span><span class="cx">     static Structure* createStructure(VM&amp; vm, JSGlobalObject* globalObject, JSValue prototype)
</span><span class="cx">     {
</span><del>-        return Structure::create(vm, globalObject, prototype, TypeInfo(CellType, StructureFlags), info());
</del><ins>+        return Structure::create(vm, globalObject, prototype, TypeInfo(CompoundType, StructureFlags), info());
</ins><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     static const bool needsDestruction = true;
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoretestsstressfoldmultigetbyoffsettogetbyoffsetwithoutfoldingthestructurecheckjs"></a>
<div class="delfile"><h4>Deleted: trunk/Source/JavaScriptCore/tests/stress/fold-multi-get-by-offset-to-get-by-offset-without-folding-the-structure-check.js (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/tests/stress/fold-multi-get-by-offset-to-get-by-offset-without-folding-the-structure-check.js        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/Source/JavaScriptCore/tests/stress/fold-multi-get-by-offset-to-get-by-offset-without-folding-the-structure-check.js        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -1,50 +0,0 @@
</span><del>-function foo(o) {
-    return o.f;
-}
-
-function fu(o) {
-    return o.e;
-}
-
-function bar(f, o) {
-    return f(o);
-}
-
-function baz(f, o) {
-    return f(o);
-}
-
-for (var i = 0; i &lt; 100; ++i) {
-    foo({f:1, e:2});
-    foo({e:1, f:2});
-    foo({d:1, e:2, f:3});
-    fu({f:1, e:2});
-    fu({e:1, f:2, g:3});
-    fu({d:1, e:2, f:3, g:4});
-}
-    
-for (var i = 0; i &lt; 100; ++i) {
-    bar(foo, {f:1});
-    bar(function() { }, null);
-    bar(function() { return 42; }, null);
-    baz(fu, {e:1});
-    baz(function() { }, null);
-    baz(function() { return 42; }, null);
-}
-    
-(function(f, g, o, p) {
-    var result = 0;
-    var n = 1000000;
-    for (var i = 0; i &lt; n; ++i) {
-        var q;
-        if (i == n - 1)
-            q = p;
-        else
-            q = o;
-        result += baz(g, q);
-        result += bar(f, q);
-    }
-    if (result != (n - 1) * (o.f + o.e) + 12 + 13)
-        throw &quot;Error: bad result: &quot; + result;
-})(foo, fu, {f:42, e:2}, {e:12, f:13, g:14});
-
</del></span></pre></div>
<a id="trunkSourceJavaScriptCoretestsstressfoldmultiputbyoffsettoputbyoffsetwithoutfoldingthestructurecheckjs"></a>
<div class="delfile"><h4>Deleted: trunk/Source/JavaScriptCore/tests/stress/fold-multi-put-by-offset-to-put-by-offset-without-folding-the-structure-check.js (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/tests/stress/fold-multi-put-by-offset-to-put-by-offset-without-folding-the-structure-check.js        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/Source/JavaScriptCore/tests/stress/fold-multi-put-by-offset-to-put-by-offset-without-folding-the-structure-check.js        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -1,56 +0,0 @@
</span><del>-function foo(o) {
-    o.f = 1;
-}
-
-function fu(o) {
-    o.e = 2;
-}
-
-function bar(f, o) {
-    f(o);
-}
-
-function baz(f, o) {
-    f(o);
-}
-
-for (var i = 0; i &lt; 100; ++i) {
-    foo({f:1, e:2});
-    foo({e:1, f:2});
-    foo({d:1, e:2, f:3});
-    fu({f:1, e:2});
-    fu({e:1, f:2, g:3});
-    fu({d:1, e:2, f:3, g:4});
-}
-    
-for (var i = 0; i &lt; 100; ++i) {
-    bar(foo, {f:1});
-    bar(function() { }, null);
-    bar(function() { return 42; }, null);
-    baz(fu, {e:1});
-    baz(function() { }, null);
-    baz(function() { return 42; }, null);
-}
-    
-(function(f, g, o, p) {
-    var result = 0;
-    var n = 1000000;
-    for (var i = 0; i &lt; n; ++i) {
-        var q;
-        if (i == n - 1)
-            q = p;
-        else
-            q = o;
-        baz(g, q);
-        bar(f, q);
-    }
-    if (o.e != 2)
-        throw &quot;Error: bad value in o.e: &quot; + o.e;
-    if (o.f != 1)
-        throw &quot;Error: bad value in o.f: &quot; + o.f;
-    if (p.e != 2)
-        throw &quot;Error: bad value in p.e: &quot; + p.e;
-    if (p.f != 1)
-        throw &quot;Error: bad value in p.f: &quot; + p.f;
-})(foo, fu, {f:42, e:2}, {e:12, f:13, g:14});
-
</del></span></pre></div>
<a id="trunkSourceJavaScriptCoretestsstressprunemultiputbyoffsetreplaceortransitionvariantjs"></a>
<div class="delfile"><h4>Deleted: trunk/Source/JavaScriptCore/tests/stress/prune-multi-put-by-offset-replace-or-transition-variant.js (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/tests/stress/prune-multi-put-by-offset-replace-or-transition-variant.js        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/Source/JavaScriptCore/tests/stress/prune-multi-put-by-offset-replace-or-transition-variant.js        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -1,58 +0,0 @@
</span><del>-function foo(o) {
-    o.f = 1;
-}
-
-function fu(o) {
-    o.e = 2;
-}
-
-function bar(f, o) {
-    f(o);
-}
-
-function baz(f, o) {
-    f(o);
-}
-
-for (var i = 0; i &lt; 100; ++i) {
-    foo({f:1, e:2});
-    foo({e:1, f:2});
-    foo({e:1});
-    foo({d:1, e:2, f:3});
-    fu({f:1, e:2});
-    fu({e:1, f:2});
-    fu({e:1, f:2, g:3});
-    fu({d:1, e:2, f:3, g:4});
-}
-    
-for (var i = 0; i &lt; 100; ++i) {
-    bar(foo, {f:1});
-    bar(function() { }, null);
-    bar(function() { return 42; }, null);
-    baz(fu, {e:1});
-    baz(function() { }, null);
-    baz(function() { return 42; }, null);
-}
-    
-(function(f, g, o, p) {
-    var result = 0;
-    var n = 1000000;
-    for (var i = 0; i &lt; n; ++i) {
-        var q;
-        if (i == n - 1)
-            q = p;
-        else
-            q = o;
-        baz(g, q);
-        bar(f, q);
-    }
-    if (o.e != 2)
-        throw &quot;Error: bad value in o.e: &quot; + o.e;
-    if (o.f != 1)
-        throw &quot;Error: bad value in o.f: &quot; + o.f;
-    if (p.e != 2)
-        throw &quot;Error: bad value in p.e: &quot; + p.e;
-    if (p.f != 1)
-        throw &quot;Error: bad value in p.f: &quot; + p.f;
-})(foo, fu, {e:42, f:2}, {e:12, f:13, g:14});
-
</del></span></pre></div>
<a id="trunkSourceWTFChangeLog"></a>
<div class="modfile"><h4>Modified: trunk/Source/WTF/ChangeLog (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WTF/ChangeLog        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/Source/WTF/ChangeLog        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -1,3 +1,10 @@
</span><ins>+2014-07-26  Filip Pizlo  &lt;fpizlo@apple.com&gt;
+
+        Unreviewed, roll out r171641-r171644. It broke some tests; will investigate and
+        reland later.
+
+        * wtf/text/WTFString.h:
+
</ins><span class="cx"> 2014-07-25  Filip Pizlo  &lt;fpizlo@apple.com&gt;
</span><span class="cx"> 
</span><span class="cx">         Attempt to fix Windows.
</span></span></pre></div>
<a id="trunkSourceWTFwtftextWTFStringh"></a>
<div class="modfile"><h4>Modified: trunk/Source/WTF/wtf/text/WTFString.h (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WTF/wtf/text/WTFString.h        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/Source/WTF/wtf/text/WTFString.h        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -355,7 +355,7 @@
</span><span class="cx">     WTF_EXPORT_STRING_API unsigned toUIntStrict(bool* ok = 0, int base = 10) const;
</span><span class="cx">     WTF_EXPORT_STRING_API int64_t toInt64Strict(bool* ok = 0, int base = 10) const;
</span><span class="cx">     WTF_EXPORT_STRING_API uint64_t toUInt64Strict(bool* ok = 0, int base = 10) const;
</span><del>-    WTF_EXPORT_STRING_API intptr_t toIntPtrStrict(bool* ok = 0, int base = 10) const;
</del><ins>+    intptr_t toIntPtrStrict(bool* ok = 0, int base = 10) const;
</ins><span class="cx"> 
</span><span class="cx">     WTF_EXPORT_STRING_API int toInt(bool* ok = 0) const;
</span><span class="cx">     WTF_EXPORT_STRING_API unsigned toUInt(bool* ok = 0) const;
</span></span></pre></div>
<a id="trunkSourceWebCoreChangeLog"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/ChangeLog (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/ChangeLog        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/Source/WebCore/ChangeLog        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -1,3 +1,10 @@
</span><ins>+2014-07-26  Filip Pizlo  &lt;fpizlo@apple.com&gt;
+
+        Unreviewed, roll out r171641-r171644. It broke some tests; will investigate and
+        reland later.
+
+        * ForwardingHeaders/debugger/DebuggerActivation.h: Added.
+
</ins><span class="cx"> 2014-07-26  Timothy Horton  &lt;timothy_horton@apple.com&gt;
</span><span class="cx"> 
</span><span class="cx">         Crash in Web Content Process under ~PDFDocument under clearTouchEventListeners at topDocument()
</span></span></pre></div>
<a id="trunkSourceWebCoreForwardingHeadersdebuggerDebuggerActivationh"></a>
<div class="addfile"><h4>Added: trunk/Source/WebCore/ForwardingHeaders/debugger/DebuggerActivation.h (0 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/ForwardingHeaders/debugger/DebuggerActivation.h                                (rev 0)
+++ trunk/Source/WebCore/ForwardingHeaders/debugger/DebuggerActivation.h        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -0,0 +1,4 @@
</span><ins>+#ifndef WebCore_FWD_DebuggerActivation_h
+#define WebCore_FWD_DebuggerActivation_h
+#include &lt;JavaScriptCore/DebuggerActivation.h&gt;
+#endif
</ins></span></pre></div>
<a id="trunkSourceWebKitmacChangeLog"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebKit/mac/ChangeLog (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebKit/mac/ChangeLog        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/Source/WebKit/mac/ChangeLog        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -1,3 +1,10 @@
</span><ins>+2014-07-26  Filip Pizlo  &lt;fpizlo@apple.com&gt;
+
+        Unreviewed, roll out r171641-r171644. It broke some tests; will investigate and
+        reland later.
+
+        * WebView/WebScriptDebugDelegate.mm:
+
</ins><span class="cx"> 2014-07-25  Filip Pizlo  &lt;fpizlo@apple.com&gt;
</span><span class="cx"> 
</span><span class="cx">         Merge r170090, r170092, r170129, r170141, r170161, r170215, r170275, r170375, r170376, r170382, r170383, r170399, r170436, r170489, r170490, r170556 from ftlopt.
</span></span></pre></div>
<a id="trunkSourceWebKitmacWebViewWebScriptDebugDelegatemm"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebKit/mac/WebView/WebScriptDebugDelegate.mm (171647 => 171648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebKit/mac/WebView/WebScriptDebugDelegate.mm        2014-07-26 18:45:04 UTC (rev 171647)
+++ trunk/Source/WebKit/mac/WebView/WebScriptDebugDelegate.mm        2014-07-26 19:06:44 UTC (rev 171648)
</span><span class="lines">@@ -37,6 +37,7 @@
</span><span class="cx"> #import &lt;WebCore/WebScriptObjectPrivate.h&gt;
</span><span class="cx"> #import &lt;WebCore/runtime_root.h&gt;
</span><span class="cx"> #import &lt;debugger/Debugger.h&gt;
</span><ins>+#import &lt;debugger/DebuggerActivation.h&gt;
</ins><span class="cx"> #import &lt;interpreter/CallFrame.h&gt;
</span><span class="cx"> #import &lt;runtime/Completion.h&gt;
</span><span class="cx"> #import &lt;runtime/JSFunction.h&gt;
</span></span></pre>
</div>
</div>

</body>
</html>