<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN"
"http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head><meta http-equiv="content-type" content="text/html; charset=utf-8" />
<title>[171660] trunk</title>
</head>
<body>
<style type="text/css"><!--
#msg dl.meta { border: 1px #006 solid; background: #369; padding: 6px; color: #fff; }
#msg dl.meta dt { float: left; width: 6em; font-weight: bold; }
#msg dt:after { content:':';}
#msg dl, #msg dt, #msg ul, #msg li, #header, #footer, #logmsg { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; }
#msg dl a { font-weight: bold}
#msg dl a:link { color:#fc3; }
#msg dl a:active { color:#ff0; }
#msg dl a:visited { color:#cc6; }
h3 { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; font-weight: bold; }
#msg pre { overflow: auto; background: #ffc; border: 1px #fa0 solid; padding: 6px; }
#logmsg { background: #ffc; border: 1px #fa0 solid; padding: 1em 1em 0 1em; }
#logmsg p, #logmsg pre, #logmsg blockquote { margin: 0 0 1em 0; }
#logmsg p, #logmsg li, #logmsg dt, #logmsg dd { line-height: 14pt; }
#logmsg h1, #logmsg h2, #logmsg h3, #logmsg h4, #logmsg h5, #logmsg h6 { margin: .5em 0; }
#logmsg h1:first-child, #logmsg h2:first-child, #logmsg h3:first-child, #logmsg h4:first-child, #logmsg h5:first-child, #logmsg h6:first-child { margin-top: 0; }
#logmsg ul, #logmsg ol { padding: 0; list-style-position: inside; margin: 0 0 0 1em; }
#logmsg ul { text-indent: -1em; padding-left: 1em; }#logmsg ol { text-indent: -1.5em; padding-left: 1.5em; }
#logmsg > ul, #logmsg > ol { margin: 0 0 1em 0; }
#logmsg pre { background: #eee; padding: 1em; }
#logmsg blockquote { border: 1px solid #fa0; border-left-width: 10px; padding: 1em 1em 0 1em; background: white;}
#logmsg dl { margin: 0; }
#logmsg dt { font-weight: bold; }
#logmsg dd { margin: 0; padding: 0 0 0.5em 0; }
#logmsg dd:before { content:'\00bb';}
#logmsg table { border-spacing: 0px; border-collapse: collapse; border-top: 4px solid #fa0; border-bottom: 1px solid #fa0; background: #fff; }
#logmsg table th { text-align: left; font-weight: normal; padding: 0.2em 0.5em; border-top: 1px dotted #fa0; }
#logmsg table td { text-align: right; border-top: 1px dotted #fa0; padding: 0.2em 0.5em; }
#logmsg table thead th { text-align: center; border-bottom: 1px solid #fa0; }
#logmsg table th.Corner { text-align: left; }
#logmsg hr { border: none 0; border-top: 2px dashed #fa0; height: 1px; }
#header, #footer { color: #fff; background: #636; border: 1px #300 solid; padding: 6px; }
#patch { width: 100%; }
#patch h4 {font-family: verdana,arial,helvetica,sans-serif;font-size:10pt;padding:8px;background:#369;color:#fff;margin:0;}
#patch .propset h4, #patch .binary h4 {margin:0;}
#patch pre {padding:0;line-height:1.2em;margin:0;}
#patch .diff {width:100%;background:#eee;padding: 0 0 10px 0;overflow:auto;}
#patch .propset .diff, #patch .binary .diff {padding:10px 0;}
#patch span {display:block;padding:0 10px;}
#patch .modfile, #patch .addfile, #patch .delfile, #patch .propset, #patch .binary, #patch .copfile {border:1px solid #ccc;margin:10px 0;}
#patch ins {background:#dfd;text-decoration:none;display:block;padding:0 10px;}
#patch del {background:#fdd;text-decoration:none;display:block;padding:0 10px;}
#patch .lines, .info {color:#888;background:#fff;}
--></style>
<div id="msg">
<dl class="meta">
<dt>Revision</dt> <dd><a href="http://trac.webkit.org/projects/webkit/changeset/171660">171660</a></dd>
<dt>Author</dt> <dd>fpizlo@apple.com</dd>
<dt>Date</dt> <dd>2014-07-27 16:14:40 -0700 (Sun, 27 Jul 2014)</dd>
</dl>
<h3>Log Message</h3>
<pre>Merge <a href="http://trac.webkit.org/projects/webkit/changeset/170090">r170090</a>, <a href="http://trac.webkit.org/projects/webkit/changeset/170092">r170092</a>, <a href="http://trac.webkit.org/projects/webkit/changeset/170129">r170129</a>, <a href="http://trac.webkit.org/projects/webkit/changeset/170141">r170141</a>, <a href="http://trac.webkit.org/projects/webkit/changeset/170161">r170161</a>, <a href="http://trac.webkit.org/projects/webkit/changeset/170215">r170215</a>, <a href="http://trac.webkit.org/projects/webkit/changeset/170275">r170275</a>, <a href="http://trac.webkit.org/projects/webkit/changeset/170375">r170375</a>, <a href="http://trac.webkit.org/projects/webkit/changeset/170376">r170376</a>, <a href="http://trac.webkit.org/projects/webkit/changeset/170382">r170382</a>, <a href="http://trac.webkit.org/projects/webkit/changeset/170383">r170383</a>, <a href="http://trac.webkit.org/projects/webkit/changeset/170399">r170399</a>, <a href="http://trac.webkit.org/projects/webkit/changeset/170436">r170436</a>, <a href="http://trac.webkit.org/projects/webkit/changeset/170489">r170489</a>, <a href="http://trac.webkit.org/projects/webkit/changeset/170490">r170490</a>, <a href="http://trac.webkit.org/projects/webkit/changeset/170556">r170556</a> from ftlopt.
Source/JavaScriptCore:
This fixes the previous mismerge and adds test coverage for the thing that went wrong.
Additional changes listed here:
* jsc.cpp:
(functionHasCustomProperties): Expose a way of checking hasCustomProperties(), which the DOM relies on. The regression I previously introduced was because this didn't work right. Now we can test it!
* runtime/Structure.cpp:
(JSC::Structure::Structure): This was supposed to be setDidTransition(true); the last merge had it set to false.
* tests/stress/has-custom-properties.js: Added. This test failed with the mismerge.
2014-06-27 Michael Saboff <msaboff@apple.com>
Unreviewed build fix after <a href="http://trac.webkit.org/projects/webkit/changeset/169795">r169795</a>.
Fixed ASSERT for 32 bit build.
* dfg/DFGSpeculativeJIT.cpp:
(JSC::DFG::SpeculativeJIT::silentSavePlanForGPR):
2014-06-24 Saam Barati <sbarati@apple.com>
Web Inspector: debugger should be able to show variable types
https://bugs.webkit.org/show_bug.cgi?id=133395
Reviewed by Filip Pizlo.
Increase the amount of type information the VM gathers when directed
to do so. This initial commit is working towards the goal of
capturing, and then showing (via the Web Inspector) type information for all
assignment and load operations. This patch doesn't have the feature fully
implemented, but it ensures the VM has no performance regressions
unless the feature is specifically turned on.
* JavaScriptCore.xcodeproj/project.pbxproj:
* bytecode/BytecodeList.json:
* bytecode/BytecodeUseDef.h:
(JSC::computeUsesForBytecodeOffset):
(JSC::computeDefsForBytecodeOffset):
* bytecode/CodeBlock.cpp:
(JSC::CodeBlock::dumpBytecode):
(JSC::CodeBlock::CodeBlock):
(JSC::CodeBlock::finalizeUnconditionally):
* bytecode/CodeBlock.h:
* bytecode/Instruction.h:
* bytecode/TypeLocation.h: Added.
(JSC::TypeLocation::TypeLocation):
* bytecompiler/BytecodeGenerator.cpp:
(JSC::BytecodeGenerator::emitMove):
(JSC::BytecodeGenerator::emitProfileTypesWithHighFidelity):
(JSC::BytecodeGenerator::emitPutToScope):
(JSC::BytecodeGenerator::emitPutById):
(JSC::BytecodeGenerator::emitPutByVal):
* bytecompiler/BytecodeGenerator.h:
(JSC::BytecodeGenerator::isProfilingTypesWithHighFidelity):
* bytecompiler/NodesCodegen.cpp:
(JSC::PostfixNode::emitResolve):
(JSC::PrefixNode::emitResolve):
(JSC::ReadModifyResolveNode::emitBytecode):
(JSC::AssignResolveNode::emitBytecode):
(JSC::ConstDeclNode::emitCodeSingle):
(JSC::ForInNode::emitBytecode):
* heap/Heap.cpp:
(JSC::Heap::collect):
* inspector/agents/InspectorRuntimeAgent.cpp:
(Inspector::InspectorRuntimeAgent::getRuntimeTypeForVariableInTextRange):
* inspector/agents/InspectorRuntimeAgent.h:
* inspector/protocol/Runtime.json:
* jsc.cpp:
(GlobalObject::finishCreation):
(functionDumpTypesForAllVariables):
* llint/LLIntSlowPaths.cpp:
(JSC::LLInt::LLINT_SLOW_PATH_DECL):
(JSC::LLInt::putToScopeCommon):
* llint/LLIntSlowPaths.h:
* llint/LowLevelInterpreter.asm:
* runtime/HighFidelityLog.cpp: Added.
(JSC::HighFidelityLog::initializeHighFidelityLog):
(JSC::HighFidelityLog::~HighFidelityLog):
(JSC::HighFidelityLog::recordTypeInformationForLocation):
(JSC::HighFidelityLog::processHighFidelityLog):
(JSC::HighFidelityLog::actuallyProcessLogThreadFunction):
* runtime/HighFidelityLog.h: Added.
(JSC::HighFidelityLog::HighFidelityLog):
* runtime/HighFidelityTypeProfiler.cpp: Added.
(JSC::HighFidelityTypeProfiler::getTypesForVariableInRange):
(JSC::HighFidelityTypeProfiler::getGlobalTypesForVariableInRange):
(JSC::HighFidelityTypeProfiler::getLocalTypesForVariableInRange):
(JSC::HighFidelityTypeProfiler::insertNewLocation):
(JSC::HighFidelityTypeProfiler::getLocationBasedHash):
* runtime/HighFidelityTypeProfiler.h: Added.
* runtime/Options.h:
* runtime/Structure.cpp:
(JSC::Structure::toStructureShape):
* runtime/Structure.h:
* runtime/SymbolTable.cpp:
(JSC::SymbolTable::SymbolTable):
(JSC::SymbolTable::cloneCapturedNames):
(JSC::SymbolTable::uniqueIDForVariable):
(JSC::SymbolTable::uniqueIDForRegister):
(JSC::SymbolTable::globalTypeSetForRegister):
(JSC::SymbolTable::globalTypeSetForVariable):
* runtime/SymbolTable.h:
(JSC::SymbolTable::add):
(JSC::SymbolTable::set):
* runtime/TypeSet.cpp: Added.
(JSC::TypeSet::TypeSet):
(JSC::TypeSet::getRuntimeTypeForValue):
(JSC::TypeSet::addTypeForValue):
(JSC::TypeSet::removeDuplicatesInStructureHistory):
(JSC::TypeSet::seenTypes):
(JSC::TypeSet::dumpSeenTypes):
(JSC::StructureShape::StructureShape):
(JSC::StructureShape::markAsFinal):
(JSC::StructureShape::addProperty):
(JSC::StructureShape::propertyHash):
(JSC::StructureShape::leastUpperBound):
(JSC::StructureShape::stringRepresentation):
* runtime/TypeSet.h: Added.
(JSC::StructureShape::create):
(JSC::TypeSet::create):
* runtime/VM.cpp:
(JSC::VM::VM):
(JSC::VM::getTypesForVariableInRange):
(JSC::VM::updateHighFidelityTypeProfileState):
(JSC::VM::dumpHighFidelityProfilingTypes):
* runtime/VM.h:
(JSC::VM::isProfilingTypesWithHighFidelity):
(JSC::VM::highFidelityLog):
(JSC::VM::highFidelityTypeProfiler):
(JSC::VM::nextLocation):
(JSC::VM::getNextUniqueVariableID):
2014-06-26 Mark Lam <mark.lam@apple.com>
Remove unused instantiation of the WithScope structure.
<https://webkit.org/b/134331>
Reviewed by Oliver Hunt.
The WithScope structure instance is the VM is unused, and is now removed.
* runtime/VM.cpp:
(JSC::VM::VM):
* runtime/VM.h:
2014-06-25 Mark Hahnenberg <mhahnenberg@apple.com>
Structure bit fields should have a consistent format
https://bugs.webkit.org/show_bug.cgi?id=134307
Reviewed by Filip Pizlo.
Currently we use C-style bit fields for a number of member variables in Structure to save space.
This makes it difficult to load these fields in the JIT. We should instead use our own bitfield
format to make it easy to load and test these variables in JIT code.
* runtime/JSObject.cpp:
(JSC::JSObject::putDirectNonIndexAccessor):
(JSC::JSObject::reifyStaticFunctionsForDelete):
* runtime/Structure.cpp:
(JSC::StructureTransitionTable::contains):
(JSC::StructureTransitionTable::get):
(JSC::StructureTransitionTable::add):
(JSC::Structure::Structure):
(JSC::Structure::materializePropertyMap):
(JSC::Structure::addPropertyTransition):
(JSC::Structure::despecifyFunctionTransition):
(JSC::Structure::toDictionaryTransition):
(JSC::Structure::freezeTransition):
(JSC::Structure::preventExtensionsTransition):
(JSC::Structure::takePropertyTableOrCloneIfPinned):
(JSC::Structure::nonPropertyTransition):
(JSC::Structure::flattenDictionaryStructure):
(JSC::Structure::addPropertyWithoutTransition):
(JSC::Structure::pin):
(JSC::Structure::allocateRareData):
(JSC::Structure::cloneRareDataFrom):
(JSC::Structure::getConcurrently):
(JSC::Structure::putSpecificValue):
(JSC::Structure::getPropertyNamesFromStructure):
(JSC::Structure::visitChildren):
(JSC::Structure::checkConsistency):
* runtime/Structure.h:
(JSC::Structure::isExtensible):
(JSC::Structure::isDictionary):
(JSC::Structure::isUncacheableDictionary):
(JSC::Structure::propertyAccessesAreCacheable):
(JSC::Structure::previousID):
(JSC::Structure::setHasGetterSetterPropertiesWithProtoCheck):
(JSC::Structure::setContainsReadOnlyProperties):
(JSC::Structure::disableSpecificFunctionTracking):
(JSC::Structure::objectToStringValue):
(JSC::Structure::setObjectToStringValue):
(JSC::Structure::setPreviousID):
(JSC::Structure::clearPreviousID):
(JSC::Structure::previous):
(JSC::Structure::rareData):
(JSC::Structure::didTransition): Deleted.
(JSC::Structure::hasGetterSetterProperties): Deleted.
(JSC::Structure::hasReadOnlyOrGetterSetterPropertiesExcludingProto): Deleted.
(JSC::Structure::setHasGetterSetterProperties): Deleted.
(JSC::Structure::hasNonEnumerableProperties): Deleted.
(JSC::Structure::staticFunctionsReified): Deleted.
(JSC::Structure::setStaticFunctionsReified): Deleted.
* runtime/StructureInlines.h:
(JSC::Structure::setEnumerationCache):
(JSC::Structure::enumerationCache):
(JSC::Structure::checkOffsetConsistency):
2014-06-24 Mark Lam <mark.lam@apple.com>
[ftlopt] Renamed DebuggerActivation to DebuggerScope.
<https://webkit.org/b/134273>
Reviewed by Michael Saboff.
* CMakeLists.txt:
* JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
* JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
* JavaScriptCore.xcodeproj/project.pbxproj:
* debugger/DebuggerActivation.cpp: Removed.
* debugger/DebuggerActivation.h: Removed.
* debugger/DebuggerScope.cpp: Copied from ../../trunk/Source/JavaScriptCore/debugger/DebuggerActivation.cpp.
(JSC::DebuggerScope::DebuggerScope):
(JSC::DebuggerScope::finishCreation):
(JSC::DebuggerScope::visitChildren):
(JSC::DebuggerScope::className):
(JSC::DebuggerScope::getOwnPropertySlot):
(JSC::DebuggerScope::put):
(JSC::DebuggerScope::deleteProperty):
(JSC::DebuggerScope::getOwnPropertyNames):
(JSC::DebuggerScope::defineOwnProperty):
(JSC::DebuggerActivation::DebuggerActivation): Deleted.
(JSC::DebuggerActivation::finishCreation): Deleted.
(JSC::DebuggerActivation::visitChildren): Deleted.
(JSC::DebuggerActivation::className): Deleted.
(JSC::DebuggerActivation::getOwnPropertySlot): Deleted.
(JSC::DebuggerActivation::put): Deleted.
(JSC::DebuggerActivation::deleteProperty): Deleted.
(JSC::DebuggerActivation::getOwnPropertyNames): Deleted.
(JSC::DebuggerActivation::defineOwnProperty): Deleted.
* debugger/DebuggerScope.h: Copied from ../../trunk/Source/JavaScriptCore/debugger/DebuggerActivation.h.
(JSC::DebuggerScope::create):
(JSC::DebuggerActivation::create): Deleted.
* runtime/VM.cpp:
(JSC::VM::VM):
* runtime/VM.h:
2014-06-24 Filip Pizlo <fpizlo@apple.com>
[ftlopt] PutByIdFlush can also be converted to a PutByOffset so don't assert otherwise
https://bugs.webkit.org/show_bug.cgi?id=134265
Reviewed by Geoffrey Garen.
More assertion fallout from the PutById folding work.
* dfg/DFGNode.h:
(JSC::DFG::Node::convertToPutByOffset):
2014-06-24 Filip Pizlo <fpizlo@apple.com>
[ftlopt] GC should notify us if it resets to_this
https://bugs.webkit.org/show_bug.cgi?id=128231
Reviewed by Geoffrey Garen.
* CMakeLists.txt:
* JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
* JavaScriptCore.xcodeproj/project.pbxproj:
* bytecode/BytecodeList.json:
* bytecode/CodeBlock.cpp:
(JSC::CodeBlock::dumpBytecode):
(JSC::CodeBlock::finalizeUnconditionally):
* bytecode/Instruction.h:
* bytecode/ToThisStatus.cpp: Added.
(JSC::merge):
(WTF::printInternal):
* bytecode/ToThisStatus.h: Added.
* bytecompiler/BytecodeGenerator.cpp:
(JSC::BytecodeGenerator::BytecodeGenerator):
* dfg/DFGByteCodeParser.cpp:
(JSC::DFG::ByteCodeParser::parseBlock):
* llint/LowLevelInterpreter32_64.asm:
* llint/LowLevelInterpreter64.asm:
* runtime/CommonSlowPaths.cpp:
(JSC::SLOW_PATH_DECL):
2014-06-24 Filip Pizlo <fpizlo@apple.com>
[ftlopt] StructureAbstractValue::onlyStructure() should return nullptr if isClobbered()
https://bugs.webkit.org/show_bug.cgi?id=134256
Reviewed by Michael Saboff.
This isn't testable right now (i.e. it's benign) but we should get it right anyway. The
point is to be able to precisely model what goes on in the snippets of code between a
side-effect and an InvalidationPoint.
This patch also cleans up onlyStructure() by delegating more work to
StructureSet::onlyStructure().
* dfg/DFGStructureAbstractValue.h:
(JSC::DFG::StructureAbstractValue::onlyStructure):
2014-06-24 Filip Pizlo <fpizlo@apple.com>
[ftlopt][REGRESSION] PutById AI is introducing watchable structures without watching them
https://bugs.webkit.org/show_bug.cgi?id=134260
Reviewed by Geoffrey Garen.
This was causing loads of assertion failures in debug builds.
* dfg/DFGAbstractInterpreterInlines.h:
(JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
2014-06-21 Filip Pizlo <fpizlo@apple.com>
[ftlopt] Fold GetById/PutById to MultiGetByOffset/GetByOffset or MultiPutByOffset/PutByOffset, which implies handling non-singleton sets
https://bugs.webkit.org/show_bug.cgi?id=134090
Reviewed by Oliver Hunt.
This pretty much finishes off the work to eliminate the special-casing of singleton
structure sets by making it possible to fold GetById and PutById to various polymorphic
forms of the ByOffset nodes.
* bytecode/GetByIdStatus.cpp:
(JSC::GetByIdStatus::computeForStubInfo):
(JSC::GetByIdStatus::computeFor):
* bytecode/GetByIdStatus.h:
* bytecode/PutByIdStatus.cpp:
(JSC::PutByIdStatus::computeFor):
* bytecode/PutByIdStatus.h:
* bytecode/PutByIdVariant.h:
(JSC::PutByIdVariant::constantChecks):
* dfg/DFGAbstractInterpreterInlines.h:
(JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
* dfg/DFGByteCodeParser.cpp:
(JSC::DFG::ByteCodeParser::parseBlock):
* dfg/DFGConstantFoldingPhase.cpp:
(JSC::DFG::ConstantFoldingPhase::foldConstants):
(JSC::DFG::ConstantFoldingPhase::emitPutByOffset):
(JSC::DFG::ConstantFoldingPhase::addChecks):
* dfg/DFGNode.h:
(JSC::DFG::Node::convertToMultiGetByOffset):
(JSC::DFG::Node::convertToMultiPutByOffset):
* dfg/DFGSpeculativeJIT64.cpp: Also convert all release assertions to DFG assertions in this file, because I was hitting some of them while debugging.
(JSC::DFG::SpeculativeJIT::fillJSValue):
(JSC::DFG::SpeculativeJIT::nonSpeculativeCompareNull):
(JSC::DFG::SpeculativeJIT::emitCall):
(JSC::DFG::SpeculativeJIT::fillSpeculateInt32Internal):
(JSC::DFG::SpeculativeJIT::fillSpeculateInt32Strict):
(JSC::DFG::SpeculativeJIT::fillSpeculateInt52):
(JSC::DFG::SpeculativeJIT::fillSpeculateDouble):
(JSC::DFG::SpeculativeJIT::fillSpeculateCell):
(JSC::DFG::SpeculativeJIT::fillSpeculateBoolean):
(JSC::DFG::SpeculativeJIT::compileLogicalNot):
(JSC::DFG::SpeculativeJIT::emitBranch):
(JSC::DFG::SpeculativeJIT::compile):
* dfg/DFGStructureAbstractValue.h:
(JSC::DFG::StructureAbstractValue::set):
2014-06-19 Filip Pizlo <fpizlo@apple.com>
[ftlopt] StructureSet::onlyStructure() should return nullptr if it's not a singleton (instead of asserting)
https://bugs.webkit.org/show_bug.cgi?id=134077
Reviewed by Sam Weinig.
This makes StructureSet and StructureAbstractValue more consistent and fixes a debug assert
in the abstract interpreter.
* bytecode/StructureSet.h:
(JSC::StructureSet::onlyStructure):
2014-06-18 Filip Pizlo <fpizlo@apple.com>
DFG AI and constant folder should be able to precisely prune MultiGetByOffset/MultiPutByOffset even if the base structure abstract value is not a singleton
https://bugs.webkit.org/show_bug.cgi?id=133918
Reviewed by Mark Hahnenberg.
This also adds pruning of PutStructure, since I basically had no choice but
to implement such logic within MultiPutByOffset.
Also adds a bunch of PutById cache status dumping to bytecode dumping.
* bytecode/GetByIdVariant.cpp:
(JSC::GetByIdVariant::dumpInContext):
* bytecode/GetByIdVariant.h:
(JSC::GetByIdVariant::structureSet):
* bytecode/PutByIdVariant.h:
(JSC::PutByIdVariant::oldStructure):
* bytecode/StructureSet.cpp:
(JSC::StructureSet::filter):
(JSC::StructureSet::filterArrayModes):
* bytecode/StructureSet.h:
* dfg/DFGAbstractInterpreterInlines.h:
(JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
* dfg/DFGAbstractValue.cpp:
(JSC::DFG::AbstractValue::changeStructure):
(JSC::DFG::AbstractValue::contains):
* dfg/DFGAbstractValue.h:
(JSC::DFG::AbstractValue::couldBeType):
(JSC::DFG::AbstractValue::isType):
* dfg/DFGConstantFoldingPhase.cpp:
(JSC::DFG::ConstantFoldingPhase::foldConstants):
(JSC::DFG::ConstantFoldingPhase::emitGetByOffset):
(JSC::DFG::ConstantFoldingPhase::emitPutByOffset):
(JSC::DFG::ConstantFoldingPhase::addBaseCheck):
* dfg/DFGGraph.cpp:
(JSC::DFG::Graph::freezeStrong):
* dfg/DFGGraph.h:
* dfg/DFGStructureAbstractValue.h:
(JSC::DFG::StructureAbstractValue::operator=):
* ftl/FTLLowerDFGToLLVM.cpp:
(JSC::FTL::LowerDFGToLLVM::compileMultiGetByOffset):
* tests/stress/fold-multi-get-by-offset-to-get-by-offset-without-folding-the-structure-check.js: Added.
(foo):
(fu):
(bar):
(baz):
(.bar):
(.baz):
* tests/stress/fold-multi-put-by-offset-to-put-by-offset-without-folding-the-structure-check.js: Added.
(foo):
(fu):
(bar):
(baz):
(.bar):
(.baz):
* tests/stress/prune-multi-put-by-offset-replace-or-transition-variant.js: Added.
(foo):
(fu):
(bar):
(baz):
(.bar):
(.baz):
2014-06-18 Mark Hahnenberg <mhahnenberg@apple.com>
Remove CompoundType and LeafType
https://bugs.webkit.org/show_bug.cgi?id=134037
Reviewed by Filip Pizlo.
We don't use them for anything. We'll replace them with a generic CellType type for all
the objects that are JSCells, aren't JSObjects, and for which we generally don't care about
their JSType at runtime.
* llint/LLIntData.cpp:
(JSC::LLInt::Data::performAssertions):
* runtime/ArrayBufferNeuteringWatchpoint.cpp:
(JSC::ArrayBufferNeuteringWatchpoint::createStructure):
* runtime/Executable.h:
(JSC::ExecutableBase::createStructure):
(JSC::NativeExecutable::createStructure):
* runtime/JSPromiseDeferred.h:
(JSC::JSPromiseDeferred::createStructure):
* runtime/JSPromiseReaction.h:
(JSC::JSPromiseReaction::createStructure):
* runtime/JSPropertyNameIterator.h:
(JSC::JSPropertyNameIterator::createStructure):
* runtime/JSType.h:
* runtime/JSTypeInfo.h:
(JSC::TypeInfo::TypeInfo):
* runtime/MapData.h:
(JSC::MapData::createStructure):
* runtime/PropertyMapHashTable.h:
(JSC::PropertyTable::createStructure):
* runtime/RegExp.h:
(JSC::RegExp::createStructure):
* runtime/SparseArrayValueMap.cpp:
(JSC::SparseArrayValueMap::createStructure):
* runtime/Structure.cpp:
(JSC::Structure::Structure):
* runtime/StructureChain.h:
(JSC::StructureChain::createStructure):
* runtime/StructureRareData.cpp:
(JSC::StructureRareData::createStructure):
* runtime/SymbolTable.h:
(JSC::SymbolTable::createStructure):
* runtime/WeakMapData.h:
(JSC::WeakMapData::createStructure):
2014-06-17 Filip Pizlo <fpizlo@apple.com>
[ftlopt] PutStructure and PhantomPutStructure shouldn't leave the world in a clobbered state
https://bugs.webkit.org/show_bug.cgi?id=134002
Reviewed by Mark Hahnenberg.
The effect of this bug was that if we had a PutStructure or PhantomPutStructure then any
JSConstants would be in a Clobbered state, so we wouldn't take advantage of our knowledge
of the structure if that structure was watchable.
Also kill PhantomPutStructure.
* dfg/DFGAbstractInterpreterInlines.h:
(JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
(JSC::DFG::AbstractInterpreter<AbstractStateType>::observeTransition):
(JSC::DFG::AbstractInterpreter<AbstractStateType>::observeTransitions):
* dfg/DFGClobberize.h:
(JSC::DFG::clobberize):
* dfg/DFGDoesGC.cpp:
(JSC::DFG::doesGC):
* dfg/DFGFixupPhase.cpp:
(JSC::DFG::FixupPhase::fixupNode):
* dfg/DFGGraph.cpp:
(JSC::DFG::Graph::visitChildren):
* dfg/DFGNode.h:
(JSC::DFG::Node::hasTransition):
* dfg/DFGNodeType.h:
* dfg/DFGPredictionPropagationPhase.cpp:
(JSC::DFG::PredictionPropagationPhase::propagate):
* dfg/DFGSafeToExecute.h:
(JSC::DFG::safeToExecute):
* dfg/DFGSpeculativeJIT32_64.cpp:
(JSC::DFG::SpeculativeJIT::compile):
* dfg/DFGSpeculativeJIT64.cpp:
(JSC::DFG::SpeculativeJIT::compile):
* dfg/DFGStructureAbstractValue.cpp:
(JSC::DFG::StructureAbstractValue::observeTransition):
(JSC::DFG::StructureAbstractValue::observeTransitions):
* dfg/DFGValidate.cpp:
(JSC::DFG::Validate::validate):
* dfg/DFGWatchableStructureWatchingPhase.cpp:
(JSC::DFG::WatchableStructureWatchingPhase::run):
* ftl/FTLCapabilities.cpp:
(JSC::FTL::canCompile):
* ftl/FTLLowerDFGToLLVM.cpp:
(JSC::FTL::LowerDFGToLLVM::compileNode):
(JSC::FTL::LowerDFGToLLVM::compilePhantomPutStructure): Deleted.
2014-06-17 Filip Pizlo <fpizlo@apple.com>
[ftlopt] DFG put_by_id should inline accesses with a slightly polymorphic base
https://bugs.webkit.org/show_bug.cgi?id=133964
Reviewed by Mark Hahnenberg.
* bytecode/PutByIdStatus.cpp:
(JSC::PutByIdStatus::appendVariant):
(JSC::PutByIdStatus::computeForStubInfo):
* bytecode/PutByIdVariant.cpp:
(JSC::PutByIdVariant::oldStructureForTransition):
(JSC::PutByIdVariant::writesStructures):
(JSC::PutByIdVariant::reallocatesStorage):
(JSC::PutByIdVariant::attemptToMerge):
(JSC::PutByIdVariant::attemptToMergeTransitionWithReplace):
(JSC::PutByIdVariant::dumpInContext):
* bytecode/PutByIdVariant.h:
(JSC::PutByIdVariant::PutByIdVariant):
(JSC::PutByIdVariant::replace):
(JSC::PutByIdVariant::transition):
(JSC::PutByIdVariant::structure):
(JSC::PutByIdVariant::oldStructure):
* dfg/DFGAbstractInterpreterInlines.h:
(JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
* dfg/DFGByteCodeParser.cpp:
(JSC::DFG::ByteCodeParser::handlePutById):
(JSC::DFG::ByteCodeParser::parseBlock):
* dfg/DFGConstantFoldingPhase.cpp:
(JSC::DFG::ConstantFoldingPhase::foldConstants):
(JSC::DFG::ConstantFoldingPhase::emitPutByOffset):
* dfg/DFGGraph.cpp:
(JSC::DFG::Graph::visitChildren):
* dfg/DFGNode.cpp:
(JSC::DFG::MultiPutByOffsetData::writesStructures):
(JSC::DFG::MultiPutByOffsetData::reallocatesStorage):
* ftl/FTLAbbreviations.h:
(JSC::FTL::getLinkage):
* ftl/FTLLowerDFGToLLVM.cpp:
(JSC::FTL::LowerDFGToLLVM::compileMultiPutByOffset):
(JSC::FTL::LowerDFGToLLVM::getModuleByPathForSymbol):
Source/WebCore:
This fixes the previous mismerge and adds test coverage for the thing that went wrong.
Also, this adds some helpers for making it easier to inspect JavaScript values.
* testing/Internals.cpp:
(WebCore::Internals::description):
* testing/Internals.h:
* testing/Internals.idl:
2014-07-25 Mark Lam <mark.lam@apple.com>
[ftlopt] Renamed DebuggerActivation to DebuggerScope.
<https://webkit.org/b/134273>
Reviewed by Michael Saboff.
No new tests.
* ForwardingHeaders/debugger/DebuggerActivation.h: Removed.
- Removed because this is not used.
Source/WebKit/mac:
2014-07-25 Mark Lam <mark.lam@apple.com>
[ftlopt] Renamed DebuggerActivation to DebuggerScope.
<https://webkit.org/b/134273>
Reviewed by Michael Saboff.
* WebView/WebScriptDebugDelegate.mm:
- Removed unneeded #include.
Source/WTF:
* wtf/text/WTFString.h:
LayoutTests:
* js/regress/fold-get-by-id-to-multi-get-by-offset-expected.txt: Added.
* js/regress/fold-get-by-id-to-multi-get-by-offset-rare-int-expected.txt: Added.
* js/regress/fold-get-by-id-to-multi-get-by-offset-rare-int.html: Added.
* js/regress/fold-get-by-id-to-multi-get-by-offset.html: Added.
* js/regress/fold-multi-get-by-offset-to-get-by-offset-expected.txt: Added.
* js/regress/fold-multi-get-by-offset-to-get-by-offset.html: Added.
* js/regress/fold-multi-get-by-offset-to-poly-get-by-offset-expected.txt: Added.
* js/regress/fold-multi-get-by-offset-to-poly-get-by-offset.html: Added.
* js/regress/fold-multi-put-by-offset-to-poly-put-by-offset-expected.txt: Added.
* js/regress/fold-multi-put-by-offset-to-poly-put-by-offset.html: Added.
* js/regress/fold-multi-put-by-offset-to-put-by-offset-expected.txt: Added.
* js/regress/fold-multi-put-by-offset-to-put-by-offset.html: Added.
* js/regress/fold-multi-put-by-offset-to-replace-or-transition-put-by-offset-expected.txt: Added.
* js/regress/fold-multi-put-by-offset-to-replace-or-transition-put-by-offset.html: Added.
* js/regress/fold-put-by-id-to-multi-put-by-offset-expected.txt: Added.
* js/regress/fold-put-by-id-to-multi-put-by-offset.html: Added.
* js/regress/fold-put-structure-expected.txt: Added.
* js/regress/fold-put-structure.html: Added.
* js/regress/hoist-poly-check-structure-effectful-loop-expected.txt: Added.
* js/regress/hoist-poly-check-structure-effectful-loop.html: Added.
* js/regress/hoist-poly-check-structure-expected.txt: Added.
* js/regress/hoist-poly-check-structure.html: Added.
* js/regress/put-by-id-replace-and-transition-expected.txt: Added.
* js/regress/put-by-id-replace-and-transition.html: Added.
* js/regress/put-by-id-slightly-polymorphic-expected.txt: Added.
* js/regress/put-by-id-slightly-polymorphic.html: Added.
* js/regress/script-tests/fold-get-by-id-to-multi-get-by-offset-rare-int.js: Added.
(foo):
(fu):
(bar):
(.bar):
(Number):
* js/regress/script-tests/fold-get-by-id-to-multi-get-by-offset.js: Added.
(foo):
(fu):
(bar):
(.bar):
(Number):
* js/regress/script-tests/fold-multi-get-by-offset-to-get-by-offset.js: Added.
(foo):
(fu):
(bar):
(.bar):
* js/regress/script-tests/fold-multi-get-by-offset-to-poly-get-by-offset.js: Added.
(foo):
(fu):
(bar):
(.bar):
* js/regress/script-tests/fold-multi-put-by-offset-to-poly-put-by-offset.js: Added.
(foo):
(fu):
(bar):
(.bar):
* js/regress/script-tests/fold-multi-put-by-offset-to-put-by-offset.js: Added.
(foo):
(fu):
(bar):
(.bar):
* js/regress/script-tests/fold-multi-put-by-offset-to-replace-or-transition-put-by-offset.js: Added.
(foo):
(fu):
(bar):
(.bar):
* js/regress/script-tests/fold-put-by-id-to-multi-put-by-offset.js: Added.
(foo):
(fu):
(bar):
(.bar):
* js/regress/script-tests/fold-put-structure.js: Added.
(foo):
(fu):
(bar):
(.bar):
* js/regress/script-tests/hoist-poly-check-structure-effectful-loop.js: Added.
(foo):
(test):
* js/regress/script-tests/hoist-poly-check-structure.js: Added.
(foo):
(test):
* js/regress/script-tests/put-by-id-replace-and-transition.js: Added.
* js/regress/script-tests/put-by-id-slightly-polymorphic.js: Added.</pre>
<h3>Modified Paths</h3>
<ul>
<li><a href="#trunkLayoutTestsChangeLog">trunk/LayoutTests/ChangeLog</a></li>
<li><a href="#trunkSourceJavaScriptCoreCMakeListstxt">trunk/Source/JavaScriptCore/CMakeLists.txt</a></li>
<li><a href="#trunkSourceJavaScriptCoreChangeLog">trunk/Source/JavaScriptCore/ChangeLog</a></li>
<li><a href="#trunkSourceJavaScriptCoreJavaScriptCorevcxprojJavaScriptCorevcxproj">trunk/Source/JavaScriptCore/JavaScriptCore.vcxproj/JavaScriptCore.vcxproj</a></li>
<li><a href="#trunkSourceJavaScriptCoreJavaScriptCorevcxprojJavaScriptCorevcxprojfilters">trunk/Source/JavaScriptCore/JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters</a></li>
<li><a href="#trunkSourceJavaScriptCoreJavaScriptCorexcodeprojprojectpbxproj">trunk/Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj</a></li>
<li><a href="#trunkSourceJavaScriptCorebytecodeBytecodeListjson">trunk/Source/JavaScriptCore/bytecode/BytecodeList.json</a></li>
<li><a href="#trunkSourceJavaScriptCorebytecodeBytecodeUseDefh">trunk/Source/JavaScriptCore/bytecode/BytecodeUseDef.h</a></li>
<li><a href="#trunkSourceJavaScriptCorebytecodeCodeBlockcpp">trunk/Source/JavaScriptCore/bytecode/CodeBlock.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCorebytecodeCodeBlockh">trunk/Source/JavaScriptCore/bytecode/CodeBlock.h</a></li>
<li><a href="#trunkSourceJavaScriptCorebytecodeGetByIdStatuscpp">trunk/Source/JavaScriptCore/bytecode/GetByIdStatus.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCorebytecodeGetByIdStatush">trunk/Source/JavaScriptCore/bytecode/GetByIdStatus.h</a></li>
<li><a href="#trunkSourceJavaScriptCorebytecodeGetByIdVariantcpp">trunk/Source/JavaScriptCore/bytecode/GetByIdVariant.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCorebytecodeGetByIdVarianth">trunk/Source/JavaScriptCore/bytecode/GetByIdVariant.h</a></li>
<li><a href="#trunkSourceJavaScriptCorebytecodeInstructionh">trunk/Source/JavaScriptCore/bytecode/Instruction.h</a></li>
<li><a href="#trunkSourceJavaScriptCorebytecodePutByIdStatuscpp">trunk/Source/JavaScriptCore/bytecode/PutByIdStatus.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCorebytecodePutByIdStatush">trunk/Source/JavaScriptCore/bytecode/PutByIdStatus.h</a></li>
<li><a href="#trunkSourceJavaScriptCorebytecodePutByIdVariantcpp">trunk/Source/JavaScriptCore/bytecode/PutByIdVariant.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCorebytecodePutByIdVarianth">trunk/Source/JavaScriptCore/bytecode/PutByIdVariant.h</a></li>
<li><a href="#trunkSourceJavaScriptCorebytecodeStructureSetcpp">trunk/Source/JavaScriptCore/bytecode/StructureSet.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCorebytecodeStructureSeth">trunk/Source/JavaScriptCore/bytecode/StructureSet.h</a></li>
<li><a href="#trunkSourceJavaScriptCorebytecompilerBytecodeGeneratorcpp">trunk/Source/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCorebytecompilerBytecodeGeneratorh">trunk/Source/JavaScriptCore/bytecompiler/BytecodeGenerator.h</a></li>
<li><a href="#trunkSourceJavaScriptCorebytecompilerNodesCodegencpp">trunk/Source/JavaScriptCore/bytecompiler/NodesCodegen.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGAbstractInterpreterInlinesh">trunk/Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGAbstractValuecpp">trunk/Source/JavaScriptCore/dfg/DFGAbstractValue.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGAbstractValueh">trunk/Source/JavaScriptCore/dfg/DFGAbstractValue.h</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGByteCodeParsercpp">trunk/Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGClobberizeh">trunk/Source/JavaScriptCore/dfg/DFGClobberize.h</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGConstantFoldingPhasecpp">trunk/Source/JavaScriptCore/dfg/DFGConstantFoldingPhase.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGDoesGCcpp">trunk/Source/JavaScriptCore/dfg/DFGDoesGC.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGFixupPhasecpp">trunk/Source/JavaScriptCore/dfg/DFGFixupPhase.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGGraphcpp">trunk/Source/JavaScriptCore/dfg/DFGGraph.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGGraphh">trunk/Source/JavaScriptCore/dfg/DFGGraph.h</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGNodecpp">trunk/Source/JavaScriptCore/dfg/DFGNode.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGNodeh">trunk/Source/JavaScriptCore/dfg/DFGNode.h</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGNodeTypeh">trunk/Source/JavaScriptCore/dfg/DFGNodeType.h</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGPredictionPropagationPhasecpp">trunk/Source/JavaScriptCore/dfg/DFGPredictionPropagationPhase.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGSafeToExecuteh">trunk/Source/JavaScriptCore/dfg/DFGSafeToExecute.h</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGSpeculativeJITcpp">trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGSpeculativeJIT32_64cpp">trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGSpeculativeJIT64cpp">trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGStructureAbstractValuecpp">trunk/Source/JavaScriptCore/dfg/DFGStructureAbstractValue.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGStructureAbstractValueh">trunk/Source/JavaScriptCore/dfg/DFGStructureAbstractValue.h</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGValidatecpp">trunk/Source/JavaScriptCore/dfg/DFGValidate.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGWatchableStructureWatchingPhasecpp">trunk/Source/JavaScriptCore/dfg/DFGWatchableStructureWatchingPhase.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreftlFTLAbbreviationsh">trunk/Source/JavaScriptCore/ftl/FTLAbbreviations.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreftlFTLCapabilitiescpp">trunk/Source/JavaScriptCore/ftl/FTLCapabilities.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreftlFTLLowerDFGToLLVMcpp">trunk/Source/JavaScriptCore/ftl/FTLLowerDFGToLLVM.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreheapHeapcpp">trunk/Source/JavaScriptCore/heap/Heap.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreheapMarkedSpacecpp">trunk/Source/JavaScriptCore/heap/MarkedSpace.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreinspectoragentsInspectorRuntimeAgentcpp">trunk/Source/JavaScriptCore/inspector/agents/InspectorRuntimeAgent.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreinspectoragentsInspectorRuntimeAgenth">trunk/Source/JavaScriptCore/inspector/agents/InspectorRuntimeAgent.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreinspectorprotocolRuntimejson">trunk/Source/JavaScriptCore/inspector/protocol/Runtime.json</a></li>
<li><a href="#trunkSourceJavaScriptCorejsccpp">trunk/Source/JavaScriptCore/jsc.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCorellintLLIntDatacpp">trunk/Source/JavaScriptCore/llint/LLIntData.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCorellintLLIntSlowPathscpp">trunk/Source/JavaScriptCore/llint/LLIntSlowPaths.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCorellintLLIntSlowPathsh">trunk/Source/JavaScriptCore/llint/LLIntSlowPaths.h</a></li>
<li><a href="#trunkSourceJavaScriptCorellintLowLevelInterpreterasm">trunk/Source/JavaScriptCore/llint/LowLevelInterpreter.asm</a></li>
<li><a href="#trunkSourceJavaScriptCorellintLowLevelInterpreter32_64asm">trunk/Source/JavaScriptCore/llint/LowLevelInterpreter32_64.asm</a></li>
<li><a href="#trunkSourceJavaScriptCorellintLowLevelInterpreter64asm">trunk/Source/JavaScriptCore/llint/LowLevelInterpreter64.asm</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeArrayBufferNeuteringWatchpointcpp">trunk/Source/JavaScriptCore/runtime/ArrayBufferNeuteringWatchpoint.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeCommonSlowPathscpp">trunk/Source/JavaScriptCore/runtime/CommonSlowPaths.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeExecutableh">trunk/Source/JavaScriptCore/runtime/Executable.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeJSObjectcpp">trunk/Source/JavaScriptCore/runtime/JSObject.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeJSPromiseDeferredh">trunk/Source/JavaScriptCore/runtime/JSPromiseDeferred.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeJSPromiseReactionh">trunk/Source/JavaScriptCore/runtime/JSPromiseReaction.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeJSPropertyNameIteratorh">trunk/Source/JavaScriptCore/runtime/JSPropertyNameIterator.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeJSTypeh">trunk/Source/JavaScriptCore/runtime/JSType.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeJSTypeInfoh">trunk/Source/JavaScriptCore/runtime/JSTypeInfo.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeMapDatah">trunk/Source/JavaScriptCore/runtime/MapData.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeOptionsh">trunk/Source/JavaScriptCore/runtime/Options.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimePropertyMapHashTableh">trunk/Source/JavaScriptCore/runtime/PropertyMapHashTable.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeRegExph">trunk/Source/JavaScriptCore/runtime/RegExp.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeSparseArrayValueMapcpp">trunk/Source/JavaScriptCore/runtime/SparseArrayValueMap.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeStructurecpp">trunk/Source/JavaScriptCore/runtime/Structure.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeStructureh">trunk/Source/JavaScriptCore/runtime/Structure.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeStructureChainh">trunk/Source/JavaScriptCore/runtime/StructureChain.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeStructureInlinesh">trunk/Source/JavaScriptCore/runtime/StructureInlines.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeStructureRareDatacpp">trunk/Source/JavaScriptCore/runtime/StructureRareData.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeSymbolTablecpp">trunk/Source/JavaScriptCore/runtime/SymbolTable.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeSymbolTableh">trunk/Source/JavaScriptCore/runtime/SymbolTable.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeVMcpp">trunk/Source/JavaScriptCore/runtime/VM.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeVMh">trunk/Source/JavaScriptCore/runtime/VM.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeWeakMapDatah">trunk/Source/JavaScriptCore/runtime/WeakMapData.h</a></li>
<li><a href="#trunkSourceWTFChangeLog">trunk/Source/WTF/ChangeLog</a></li>
<li><a href="#trunkSourceWTFwtftextWTFStringh">trunk/Source/WTF/wtf/text/WTFString.h</a></li>
<li><a href="#trunkSourceWebCoreChangeLog">trunk/Source/WebCore/ChangeLog</a></li>
<li><a href="#trunkSourceWebCoretestingInternalscpp">trunk/Source/WebCore/testing/Internals.cpp</a></li>
<li><a href="#trunkSourceWebCoretestingInternalsh">trunk/Source/WebCore/testing/Internals.h</a></li>
<li><a href="#trunkSourceWebCoretestingInternalsidl">trunk/Source/WebCore/testing/Internals.idl</a></li>
<li><a href="#trunkSourceWebKitmacChangeLog">trunk/Source/WebKit/mac/ChangeLog</a></li>
<li><a href="#trunkSourceWebKitmacWebViewWebScriptDebugDelegatemm">trunk/Source/WebKit/mac/WebView/WebScriptDebugDelegate.mm</a></li>
</ul>
<h3>Added Paths</h3>
<ul>
<li><a href="#trunkLayoutTestsjsregressfoldgetbyidtomultigetbyoffsetexpectedtxt">trunk/LayoutTests/js/regress/fold-get-by-id-to-multi-get-by-offset-expected.txt</a></li>
<li><a href="#trunkLayoutTestsjsregressfoldgetbyidtomultigetbyoffsetrareintexpectedtxt">trunk/LayoutTests/js/regress/fold-get-by-id-to-multi-get-by-offset-rare-int-expected.txt</a></li>
<li><a href="#trunkLayoutTestsjsregressfoldgetbyidtomultigetbyoffsetrareinthtml">trunk/LayoutTests/js/regress/fold-get-by-id-to-multi-get-by-offset-rare-int.html</a></li>
<li><a href="#trunkLayoutTestsjsregressfoldgetbyidtomultigetbyoffsethtml">trunk/LayoutTests/js/regress/fold-get-by-id-to-multi-get-by-offset.html</a></li>
<li><a href="#trunkLayoutTestsjsregressfoldmultigetbyoffsettogetbyoffsetexpectedtxt">trunk/LayoutTests/js/regress/fold-multi-get-by-offset-to-get-by-offset-expected.txt</a></li>
<li><a href="#trunkLayoutTestsjsregressfoldmultigetbyoffsettogetbyoffsethtml">trunk/LayoutTests/js/regress/fold-multi-get-by-offset-to-get-by-offset.html</a></li>
<li><a href="#trunkLayoutTestsjsregressfoldmultigetbyoffsettopolygetbyoffsetexpectedtxt">trunk/LayoutTests/js/regress/fold-multi-get-by-offset-to-poly-get-by-offset-expected.txt</a></li>
<li><a href="#trunkLayoutTestsjsregressfoldmultigetbyoffsettopolygetbyoffsethtml">trunk/LayoutTests/js/regress/fold-multi-get-by-offset-to-poly-get-by-offset.html</a></li>
<li><a href="#trunkLayoutTestsjsregressfoldmultiputbyoffsettopolyputbyoffsetexpectedtxt">trunk/LayoutTests/js/regress/fold-multi-put-by-offset-to-poly-put-by-offset-expected.txt</a></li>
<li><a href="#trunkLayoutTestsjsregressfoldmultiputbyoffsettopolyputbyoffsethtml">trunk/LayoutTests/js/regress/fold-multi-put-by-offset-to-poly-put-by-offset.html</a></li>
<li><a href="#trunkLayoutTestsjsregressfoldmultiputbyoffsettoputbyoffsetexpectedtxt">trunk/LayoutTests/js/regress/fold-multi-put-by-offset-to-put-by-offset-expected.txt</a></li>
<li><a href="#trunkLayoutTestsjsregressfoldmultiputbyoffsettoputbyoffsethtml">trunk/LayoutTests/js/regress/fold-multi-put-by-offset-to-put-by-offset.html</a></li>
<li><a href="#trunkLayoutTestsjsregressfoldmultiputbyoffsettoreplaceortransitionputbyoffsetexpectedtxt">trunk/LayoutTests/js/regress/fold-multi-put-by-offset-to-replace-or-transition-put-by-offset-expected.txt</a></li>
<li><a href="#trunkLayoutTestsjsregressfoldmultiputbyoffsettoreplaceortransitionputbyoffsethtml">trunk/LayoutTests/js/regress/fold-multi-put-by-offset-to-replace-or-transition-put-by-offset.html</a></li>
<li><a href="#trunkLayoutTestsjsregressfoldputbyidtomultiputbyoffsetexpectedtxt">trunk/LayoutTests/js/regress/fold-put-by-id-to-multi-put-by-offset-expected.txt</a></li>
<li><a href="#trunkLayoutTestsjsregressfoldputbyidtomultiputbyoffsethtml">trunk/LayoutTests/js/regress/fold-put-by-id-to-multi-put-by-offset.html</a></li>
<li><a href="#trunkLayoutTestsjsregressfoldputstructureexpectedtxt">trunk/LayoutTests/js/regress/fold-put-structure-expected.txt</a></li>
<li><a href="#trunkLayoutTestsjsregressfoldputstructurehtml">trunk/LayoutTests/js/regress/fold-put-structure.html</a></li>
<li><a href="#trunkLayoutTestsjsregresshoistpolycheckstructureeffectfulloopexpectedtxt">trunk/LayoutTests/js/regress/hoist-poly-check-structure-effectful-loop-expected.txt</a></li>
<li><a href="#trunkLayoutTestsjsregresshoistpolycheckstructureeffectfulloophtml">trunk/LayoutTests/js/regress/hoist-poly-check-structure-effectful-loop.html</a></li>
<li><a href="#trunkLayoutTestsjsregresshoistpolycheckstructureexpectedtxt">trunk/LayoutTests/js/regress/hoist-poly-check-structure-expected.txt</a></li>
<li><a href="#trunkLayoutTestsjsregresshoistpolycheckstructurehtml">trunk/LayoutTests/js/regress/hoist-poly-check-structure.html</a></li>
<li><a href="#trunkLayoutTestsjsregressputbyidreplaceandtransitionexpectedtxt">trunk/LayoutTests/js/regress/put-by-id-replace-and-transition-expected.txt</a></li>
<li><a href="#trunkLayoutTestsjsregressputbyidreplaceandtransitionhtml">trunk/LayoutTests/js/regress/put-by-id-replace-and-transition.html</a></li>
<li><a href="#trunkLayoutTestsjsregressputbyidslightlypolymorphicexpectedtxt">trunk/LayoutTests/js/regress/put-by-id-slightly-polymorphic-expected.txt</a></li>
<li><a href="#trunkLayoutTestsjsregressputbyidslightlypolymorphichtml">trunk/LayoutTests/js/regress/put-by-id-slightly-polymorphic.html</a></li>
<li><a href="#trunkLayoutTestsjsregressscripttestsfoldgetbyidtomultigetbyoffsetrareintjs">trunk/LayoutTests/js/regress/script-tests/fold-get-by-id-to-multi-get-by-offset-rare-int.js</a></li>
<li><a href="#trunkLayoutTestsjsregressscripttestsfoldgetbyidtomultigetbyoffsetjs">trunk/LayoutTests/js/regress/script-tests/fold-get-by-id-to-multi-get-by-offset.js</a></li>
<li><a href="#trunkLayoutTestsjsregressscripttestsfoldmultigetbyoffsettogetbyoffsetjs">trunk/LayoutTests/js/regress/script-tests/fold-multi-get-by-offset-to-get-by-offset.js</a></li>
<li><a href="#trunkLayoutTestsjsregressscripttestsfoldmultigetbyoffsettopolygetbyoffsetjs">trunk/LayoutTests/js/regress/script-tests/fold-multi-get-by-offset-to-poly-get-by-offset.js</a></li>
<li><a href="#trunkLayoutTestsjsregressscripttestsfoldmultiputbyoffsettopolyputbyoffsetjs">trunk/LayoutTests/js/regress/script-tests/fold-multi-put-by-offset-to-poly-put-by-offset.js</a></li>
<li><a href="#trunkLayoutTestsjsregressscripttestsfoldmultiputbyoffsettoputbyoffsetjs">trunk/LayoutTests/js/regress/script-tests/fold-multi-put-by-offset-to-put-by-offset.js</a></li>
<li><a href="#trunkLayoutTestsjsregressscripttestsfoldmultiputbyoffsettoreplaceortransitionputbyoffsetjs">trunk/LayoutTests/js/regress/script-tests/fold-multi-put-by-offset-to-replace-or-transition-put-by-offset.js</a></li>
<li><a href="#trunkLayoutTestsjsregressscripttestsfoldputbyidtomultiputbyoffsetjs">trunk/LayoutTests/js/regress/script-tests/fold-put-by-id-to-multi-put-by-offset.js</a></li>
<li><a href="#trunkLayoutTestsjsregressscripttestsfoldputstructurejs">trunk/LayoutTests/js/regress/script-tests/fold-put-structure.js</a></li>
<li><a href="#trunkLayoutTestsjsregressscripttestshoistpolycheckstructureeffectfulloopjs">trunk/LayoutTests/js/regress/script-tests/hoist-poly-check-structure-effectful-loop.js</a></li>
<li><a href="#trunkLayoutTestsjsregressscripttestshoistpolycheckstructurejs">trunk/LayoutTests/js/regress/script-tests/hoist-poly-check-structure.js</a></li>
<li><a href="#trunkLayoutTestsjsregressscripttestsputbyidreplaceandtransitionjs">trunk/LayoutTests/js/regress/script-tests/put-by-id-replace-and-transition.js</a></li>
<li><a href="#trunkLayoutTestsjsregressscripttestsputbyidslightlypolymorphicjs">trunk/LayoutTests/js/regress/script-tests/put-by-id-slightly-polymorphic.js</a></li>
<li><a href="#trunkSourceJavaScriptCorebytecodeToThisStatuscpp">trunk/Source/JavaScriptCore/bytecode/ToThisStatus.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCorebytecodeToThisStatush">trunk/Source/JavaScriptCore/bytecode/ToThisStatus.h</a></li>
<li><a href="#trunkSourceJavaScriptCorebytecodeTypeLocationh">trunk/Source/JavaScriptCore/bytecode/TypeLocation.h</a></li>
<li><a href="#trunkSourceJavaScriptCoredebuggerDebuggerScopecpp">trunk/Source/JavaScriptCore/debugger/DebuggerScope.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoredebuggerDebuggerScopeh">trunk/Source/JavaScriptCore/debugger/DebuggerScope.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeHighFidelityLogcpp">trunk/Source/JavaScriptCore/runtime/HighFidelityLog.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeHighFidelityLogh">trunk/Source/JavaScriptCore/runtime/HighFidelityLog.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeHighFidelityTypeProfilercpp">trunk/Source/JavaScriptCore/runtime/HighFidelityTypeProfiler.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeHighFidelityTypeProfilerh">trunk/Source/JavaScriptCore/runtime/HighFidelityTypeProfiler.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeTypeSetcpp">trunk/Source/JavaScriptCore/runtime/TypeSet.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeTypeSeth">trunk/Source/JavaScriptCore/runtime/TypeSet.h</a></li>
<li><a href="#trunkSourceJavaScriptCoretestsstressfoldmultigetbyoffsettogetbyoffsetwithoutfoldingthestructurecheckjs">trunk/Source/JavaScriptCore/tests/stress/fold-multi-get-by-offset-to-get-by-offset-without-folding-the-structure-check.js</a></li>
<li><a href="#trunkSourceJavaScriptCoretestsstressfoldmultiputbyoffsettoputbyoffsetwithoutfoldingthestructurecheckjs">trunk/Source/JavaScriptCore/tests/stress/fold-multi-put-by-offset-to-put-by-offset-without-folding-the-structure-check.js</a></li>
<li><a href="#trunkSourceJavaScriptCoretestsstresshascustompropertiesjs">trunk/Source/JavaScriptCore/tests/stress/has-custom-properties.js</a></li>
<li><a href="#trunkSourceJavaScriptCoretestsstressprunemultiputbyoffsetreplaceortransitionvariantjs">trunk/Source/JavaScriptCore/tests/stress/prune-multi-put-by-offset-replace-or-transition-variant.js</a></li>
</ul>
<h3>Removed Paths</h3>
<ul>
<li><a href="#trunkSourceJavaScriptCoredebuggerDebuggerActivationcpp">trunk/Source/JavaScriptCore/debugger/DebuggerActivation.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoredebuggerDebuggerActivationh">trunk/Source/JavaScriptCore/debugger/DebuggerActivation.h</a></li>
<li><a href="#trunkSourceWebCoreForwardingHeadersdebuggerDebuggerActivationh">trunk/Source/WebCore/ForwardingHeaders/debugger/DebuggerActivation.h</a></li>
</ul>
</div>
<div id="patch">
<h3>Diff</h3>
<a id="trunkLayoutTestsChangeLog"></a>
<div class="modfile"><h4>Modified: trunk/LayoutTests/ChangeLog (171659 => 171660)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/ChangeLog 2014-07-27 21:07:24 UTC (rev 171659)
+++ trunk/LayoutTests/ChangeLog 2014-07-27 23:14:40 UTC (rev 171660)
</span><span class="lines">@@ -1,3 +1,89 @@
</span><ins>+2014-07-27 Filip Pizlo <fpizlo@apple.com>
+
+ Merge r170090, r170092, r170129, r170141, r170161, r170215, r170275, r170375, r170376, r170382, r170383, r170399, r170436, r170489, r170490, r170556 from ftlopt.
+
+ * js/regress/fold-get-by-id-to-multi-get-by-offset-expected.txt: Added.
+ * js/regress/fold-get-by-id-to-multi-get-by-offset-rare-int-expected.txt: Added.
+ * js/regress/fold-get-by-id-to-multi-get-by-offset-rare-int.html: Added.
+ * js/regress/fold-get-by-id-to-multi-get-by-offset.html: Added.
+ * js/regress/fold-multi-get-by-offset-to-get-by-offset-expected.txt: Added.
+ * js/regress/fold-multi-get-by-offset-to-get-by-offset.html: Added.
+ * js/regress/fold-multi-get-by-offset-to-poly-get-by-offset-expected.txt: Added.
+ * js/regress/fold-multi-get-by-offset-to-poly-get-by-offset.html: Added.
+ * js/regress/fold-multi-put-by-offset-to-poly-put-by-offset-expected.txt: Added.
+ * js/regress/fold-multi-put-by-offset-to-poly-put-by-offset.html: Added.
+ * js/regress/fold-multi-put-by-offset-to-put-by-offset-expected.txt: Added.
+ * js/regress/fold-multi-put-by-offset-to-put-by-offset.html: Added.
+ * js/regress/fold-multi-put-by-offset-to-replace-or-transition-put-by-offset-expected.txt: Added.
+ * js/regress/fold-multi-put-by-offset-to-replace-or-transition-put-by-offset.html: Added.
+ * js/regress/fold-put-by-id-to-multi-put-by-offset-expected.txt: Added.
+ * js/regress/fold-put-by-id-to-multi-put-by-offset.html: Added.
+ * js/regress/fold-put-structure-expected.txt: Added.
+ * js/regress/fold-put-structure.html: Added.
+ * js/regress/hoist-poly-check-structure-effectful-loop-expected.txt: Added.
+ * js/regress/hoist-poly-check-structure-effectful-loop.html: Added.
+ * js/regress/hoist-poly-check-structure-expected.txt: Added.
+ * js/regress/hoist-poly-check-structure.html: Added.
+ * js/regress/put-by-id-replace-and-transition-expected.txt: Added.
+ * js/regress/put-by-id-replace-and-transition.html: Added.
+ * js/regress/put-by-id-slightly-polymorphic-expected.txt: Added.
+ * js/regress/put-by-id-slightly-polymorphic.html: Added.
+ * js/regress/script-tests/fold-get-by-id-to-multi-get-by-offset-rare-int.js: Added.
+ (foo):
+ (fu):
+ (bar):
+ (.bar):
+ (Number):
+ * js/regress/script-tests/fold-get-by-id-to-multi-get-by-offset.js: Added.
+ (foo):
+ (fu):
+ (bar):
+ (.bar):
+ (Number):
+ * js/regress/script-tests/fold-multi-get-by-offset-to-get-by-offset.js: Added.
+ (foo):
+ (fu):
+ (bar):
+ (.bar):
+ * js/regress/script-tests/fold-multi-get-by-offset-to-poly-get-by-offset.js: Added.
+ (foo):
+ (fu):
+ (bar):
+ (.bar):
+ * js/regress/script-tests/fold-multi-put-by-offset-to-poly-put-by-offset.js: Added.
+ (foo):
+ (fu):
+ (bar):
+ (.bar):
+ * js/regress/script-tests/fold-multi-put-by-offset-to-put-by-offset.js: Added.
+ (foo):
+ (fu):
+ (bar):
+ (.bar):
+ * js/regress/script-tests/fold-multi-put-by-offset-to-replace-or-transition-put-by-offset.js: Added.
+ (foo):
+ (fu):
+ (bar):
+ (.bar):
+ * js/regress/script-tests/fold-put-by-id-to-multi-put-by-offset.js: Added.
+ (foo):
+ (fu):
+ (bar):
+ (.bar):
+ * js/regress/script-tests/fold-put-structure.js: Added.
+ (foo):
+ (fu):
+ (bar):
+ (.bar):
+ * js/regress/script-tests/hoist-poly-check-structure-effectful-loop.js: Added.
+ (foo):
+ (test):
+ * js/regress/script-tests/hoist-poly-check-structure.js: Added.
+ (foo):
+ (test):
+ * js/regress/script-tests/put-by-id-replace-and-transition.js: Added.
+ * js/regress/script-tests/put-by-id-slightly-polymorphic.js: Added.
+
</ins><span class="cx"> 2014-07-26 Filip Pizlo <fpizlo@apple.com>
</span><span class="cx">
</span><span class="cx"> Unreviewed, roll out r171641-r171644. It broke some tests; will investigate and
</span></span></pre></div>
<a id="trunkLayoutTestsjsregressfoldgetbyidtomultigetbyoffsetexpectedtxt"></a>
<div class="addfile"><h4>Added: trunk/LayoutTests/js/regress/fold-get-by-id-to-multi-get-by-offset-expected.txt (0 => 171660)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/regress/fold-get-by-id-to-multi-get-by-offset-expected.txt (rev 0)
+++ trunk/LayoutTests/js/regress/fold-get-by-id-to-multi-get-by-offset-expected.txt 2014-07-27 23:14:40 UTC (rev 171660)
</span><span class="lines">@@ -0,0 +1,10 @@
</span><ins>+JSRegress/fold-get-by-id-to-multi-get-by-offset
+
+On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
+
+
+PASS no exception thrown
+PASS successfullyParsed is true
+
+TEST COMPLETE
+
</ins></span></pre></div>
<a id="trunkLayoutTestsjsregressfoldgetbyidtomultigetbyoffsetrareintexpectedtxt"></a>
<div class="addfile"><h4>Added: trunk/LayoutTests/js/regress/fold-get-by-id-to-multi-get-by-offset-rare-int-expected.txt (0 => 171660)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/regress/fold-get-by-id-to-multi-get-by-offset-rare-int-expected.txt (rev 0)
+++ trunk/LayoutTests/js/regress/fold-get-by-id-to-multi-get-by-offset-rare-int-expected.txt 2014-07-27 23:14:40 UTC (rev 171660)
</span><span class="lines">@@ -0,0 +1,10 @@
</span><ins>+JSRegress/fold-get-by-id-to-multi-get-by-offset-rare-int
+
+On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
+
+
+PASS no exception thrown
+PASS successfullyParsed is true
+
+TEST COMPLETE
+
</ins></span></pre></div>
<a id="trunkLayoutTestsjsregressfoldgetbyidtomultigetbyoffsetrareinthtml"></a>
<div class="addfile"><h4>Added: trunk/LayoutTests/js/regress/fold-get-by-id-to-multi-get-by-offset-rare-int.html (0 => 171660)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/regress/fold-get-by-id-to-multi-get-by-offset-rare-int.html (rev 0)
+++ trunk/LayoutTests/js/regress/fold-get-by-id-to-multi-get-by-offset-rare-int.html 2014-07-27 23:14:40 UTC (rev 171660)
</span><span class="lines">@@ -0,0 +1,12 @@
</span><ins>+<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
+<html>
+<head>
+<script src="../../resources/js-test-pre.js"></script>
+</head>
+<body>
+<script src="../../resources/regress-pre.js"></script>
+<script src="script-tests/fold-get-by-id-to-multi-get-by-offset-rare-int.js"></script>
+<script src="../../resources/regress-post.js"></script>
+<script src="../../resources/js-test-post.js"></script>
+</body>
+</html>
</ins></span></pre></div>
<a id="trunkLayoutTestsjsregressfoldgetbyidtomultigetbyoffsethtml"></a>
<div class="addfile"><h4>Added: trunk/LayoutTests/js/regress/fold-get-by-id-to-multi-get-by-offset.html (0 => 171660)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/regress/fold-get-by-id-to-multi-get-by-offset.html (rev 0)
+++ trunk/LayoutTests/js/regress/fold-get-by-id-to-multi-get-by-offset.html 2014-07-27 23:14:40 UTC (rev 171660)
</span><span class="lines">@@ -0,0 +1,12 @@
</span><ins>+<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
+<html>
+<head>
+<script src="../../resources/js-test-pre.js"></script>
+</head>
+<body>
+<script src="../../resources/regress-pre.js"></script>
+<script src="script-tests/fold-get-by-id-to-multi-get-by-offset.js"></script>
+<script src="../../resources/regress-post.js"></script>
+<script src="../../resources/js-test-post.js"></script>
+</body>
+</html>
</ins></span></pre></div>
<a id="trunkLayoutTestsjsregressfoldmultigetbyoffsettogetbyoffsetexpectedtxt"></a>
<div class="addfile"><h4>Added: trunk/LayoutTests/js/regress/fold-multi-get-by-offset-to-get-by-offset-expected.txt (0 => 171660)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/regress/fold-multi-get-by-offset-to-get-by-offset-expected.txt (rev 0)
+++ trunk/LayoutTests/js/regress/fold-multi-get-by-offset-to-get-by-offset-expected.txt 2014-07-27 23:14:40 UTC (rev 171660)
</span><span class="lines">@@ -0,0 +1,10 @@
</span><ins>+JSRegress/fold-multi-get-by-offset-to-get-by-offset
+
+On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
+
+
+PASS no exception thrown
+PASS successfullyParsed is true
+
+TEST COMPLETE
+
</ins></span></pre></div>
<a id="trunkLayoutTestsjsregressfoldmultigetbyoffsettogetbyoffsethtml"></a>
<div class="addfile"><h4>Added: trunk/LayoutTests/js/regress/fold-multi-get-by-offset-to-get-by-offset.html (0 => 171660)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/regress/fold-multi-get-by-offset-to-get-by-offset.html (rev 0)
+++ trunk/LayoutTests/js/regress/fold-multi-get-by-offset-to-get-by-offset.html 2014-07-27 23:14:40 UTC (rev 171660)
</span><span class="lines">@@ -0,0 +1,12 @@
</span><ins>+<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
+<html>
+<head>
+<script src="../../resources/js-test-pre.js"></script>
+</head>
+<body>
+<script src="../../resources/regress-pre.js"></script>
+<script src="script-tests/fold-multi-get-by-offset-to-get-by-offset.js"></script>
+<script src="../../resources/regress-post.js"></script>
+<script src="../../resources/js-test-post.js"></script>
+</body>
+</html>
</ins></span></pre></div>
<a id="trunkLayoutTestsjsregressfoldmultigetbyoffsettopolygetbyoffsetexpectedtxt"></a>
<div class="addfile"><h4>Added: trunk/LayoutTests/js/regress/fold-multi-get-by-offset-to-poly-get-by-offset-expected.txt (0 => 171660)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/regress/fold-multi-get-by-offset-to-poly-get-by-offset-expected.txt (rev 0)
+++ trunk/LayoutTests/js/regress/fold-multi-get-by-offset-to-poly-get-by-offset-expected.txt 2014-07-27 23:14:40 UTC (rev 171660)
</span><span class="lines">@@ -0,0 +1,10 @@
</span><ins>+JSRegress/fold-multi-get-by-offset-to-poly-get-by-offset
+
+On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
+
+
+PASS no exception thrown
+PASS successfullyParsed is true
+
+TEST COMPLETE
+
</ins></span></pre></div>
<a id="trunkLayoutTestsjsregressfoldmultigetbyoffsettopolygetbyoffsethtml"></a>
<div class="addfile"><h4>Added: trunk/LayoutTests/js/regress/fold-multi-get-by-offset-to-poly-get-by-offset.html (0 => 171660)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/regress/fold-multi-get-by-offset-to-poly-get-by-offset.html (rev 0)
+++ trunk/LayoutTests/js/regress/fold-multi-get-by-offset-to-poly-get-by-offset.html 2014-07-27 23:14:40 UTC (rev 171660)
</span><span class="lines">@@ -0,0 +1,12 @@
</span><ins>+<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
+<html>
+<head>
+<script src="../../resources/js-test-pre.js"></script>
+</head>
+<body>
+<script src="../../resources/regress-pre.js"></script>
+<script src="script-tests/fold-multi-get-by-offset-to-poly-get-by-offset.js"></script>
+<script src="../../resources/regress-post.js"></script>
+<script src="../../resources/js-test-post.js"></script>
+</body>
+</html>
</ins></span></pre></div>
<a id="trunkLayoutTestsjsregressfoldmultiputbyoffsettopolyputbyoffsetexpectedtxt"></a>
<div class="addfile"><h4>Added: trunk/LayoutTests/js/regress/fold-multi-put-by-offset-to-poly-put-by-offset-expected.txt (0 => 171660)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/regress/fold-multi-put-by-offset-to-poly-put-by-offset-expected.txt (rev 0)
+++ trunk/LayoutTests/js/regress/fold-multi-put-by-offset-to-poly-put-by-offset-expected.txt 2014-07-27 23:14:40 UTC (rev 171660)
</span><span class="lines">@@ -0,0 +1,10 @@
</span><ins>+JSRegress/fold-multi-put-by-offset-to-poly-put-by-offset
+
+On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
+
+
+PASS no exception thrown
+PASS successfullyParsed is true
+
+TEST COMPLETE
+
</ins></span></pre></div>
<a id="trunkLayoutTestsjsregressfoldmultiputbyoffsettopolyputbyoffsethtml"></a>
<div class="addfile"><h4>Added: trunk/LayoutTests/js/regress/fold-multi-put-by-offset-to-poly-put-by-offset.html (0 => 171660)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/regress/fold-multi-put-by-offset-to-poly-put-by-offset.html (rev 0)
+++ trunk/LayoutTests/js/regress/fold-multi-put-by-offset-to-poly-put-by-offset.html 2014-07-27 23:14:40 UTC (rev 171660)
</span><span class="lines">@@ -0,0 +1,12 @@
</span><ins>+<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
+<html>
+<head>
+<script src="../../resources/js-test-pre.js"></script>
+</head>
+<body>
+<script src="../../resources/regress-pre.js"></script>
+<script src="script-tests/fold-multi-put-by-offset-to-poly-put-by-offset.js"></script>
+<script src="../../resources/regress-post.js"></script>
+<script src="../../resources/js-test-post.js"></script>
+</body>
+</html>
</ins></span></pre></div>
<a id="trunkLayoutTestsjsregressfoldmultiputbyoffsettoputbyoffsetexpectedtxt"></a>
<div class="addfile"><h4>Added: trunk/LayoutTests/js/regress/fold-multi-put-by-offset-to-put-by-offset-expected.txt (0 => 171660)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/regress/fold-multi-put-by-offset-to-put-by-offset-expected.txt (rev 0)
+++ trunk/LayoutTests/js/regress/fold-multi-put-by-offset-to-put-by-offset-expected.txt 2014-07-27 23:14:40 UTC (rev 171660)
</span><span class="lines">@@ -0,0 +1,10 @@
</span><ins>+JSRegress/fold-multi-put-by-offset-to-put-by-offset
+
+On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
+
+
+PASS no exception thrown
+PASS successfullyParsed is true
+
+TEST COMPLETE
+
</ins></span></pre></div>
<a id="trunkLayoutTestsjsregressfoldmultiputbyoffsettoputbyoffsethtml"></a>
<div class="addfile"><h4>Added: trunk/LayoutTests/js/regress/fold-multi-put-by-offset-to-put-by-offset.html (0 => 171660)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/regress/fold-multi-put-by-offset-to-put-by-offset.html (rev 0)
+++ trunk/LayoutTests/js/regress/fold-multi-put-by-offset-to-put-by-offset.html 2014-07-27 23:14:40 UTC (rev 171660)
</span><span class="lines">@@ -0,0 +1,12 @@
</span><ins>+<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
+<html>
+<head>
+<script src="../../resources/js-test-pre.js"></script>
+</head>
+<body>
+<script src="../../resources/regress-pre.js"></script>
+<script src="script-tests/fold-multi-put-by-offset-to-put-by-offset.js"></script>
+<script src="../../resources/regress-post.js"></script>
+<script src="../../resources/js-test-post.js"></script>
+</body>
+</html>
</ins></span></pre></div>
<a id="trunkLayoutTestsjsregressfoldmultiputbyoffsettoreplaceortransitionputbyoffsetexpectedtxt"></a>
<div class="addfile"><h4>Added: trunk/LayoutTests/js/regress/fold-multi-put-by-offset-to-replace-or-transition-put-by-offset-expected.txt (0 => 171660)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/regress/fold-multi-put-by-offset-to-replace-or-transition-put-by-offset-expected.txt (rev 0)
+++ trunk/LayoutTests/js/regress/fold-multi-put-by-offset-to-replace-or-transition-put-by-offset-expected.txt 2014-07-27 23:14:40 UTC (rev 171660)
</span><span class="lines">@@ -0,0 +1,10 @@
</span><ins>+JSRegress/fold-multi-put-by-offset-to-replace-or-transition-put-by-offset
+
+On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
+
+
+PASS no exception thrown
+PASS successfullyParsed is true
+
+TEST COMPLETE
+
</ins></span></pre></div>
<a id="trunkLayoutTestsjsregressfoldmultiputbyoffsettoreplaceortransitionputbyoffsethtml"></a>
<div class="addfile"><h4>Added: trunk/LayoutTests/js/regress/fold-multi-put-by-offset-to-replace-or-transition-put-by-offset.html (0 => 171660)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/regress/fold-multi-put-by-offset-to-replace-or-transition-put-by-offset.html (rev 0)
+++ trunk/LayoutTests/js/regress/fold-multi-put-by-offset-to-replace-or-transition-put-by-offset.html 2014-07-27 23:14:40 UTC (rev 171660)
</span><span class="lines">@@ -0,0 +1,12 @@
</span><ins>+<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
+<html>
+<head>
+<script src="../../resources/js-test-pre.js"></script>
+</head>
+<body>
+<script src="../../resources/regress-pre.js"></script>
+<script src="script-tests/fold-multi-put-by-offset-to-replace-or-transition-put-by-offset.js"></script>
+<script src="../../resources/regress-post.js"></script>
+<script src="../../resources/js-test-post.js"></script>
+</body>
+</html>
</ins></span></pre></div>
<a id="trunkLayoutTestsjsregressfoldputbyidtomultiputbyoffsetexpectedtxt"></a>
<div class="addfile"><h4>Added: trunk/LayoutTests/js/regress/fold-put-by-id-to-multi-put-by-offset-expected.txt (0 => 171660)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/regress/fold-put-by-id-to-multi-put-by-offset-expected.txt (rev 0)
+++ trunk/LayoutTests/js/regress/fold-put-by-id-to-multi-put-by-offset-expected.txt 2014-07-27 23:14:40 UTC (rev 171660)
</span><span class="lines">@@ -0,0 +1,10 @@
</span><ins>+JSRegress/fold-put-by-id-to-multi-put-by-offset
+
+On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
+
+
+PASS no exception thrown
+PASS successfullyParsed is true
+
+TEST COMPLETE
+
</ins></span></pre></div>
<a id="trunkLayoutTestsjsregressfoldputbyidtomultiputbyoffsethtml"></a>
<div class="addfile"><h4>Added: trunk/LayoutTests/js/regress/fold-put-by-id-to-multi-put-by-offset.html (0 => 171660)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/regress/fold-put-by-id-to-multi-put-by-offset.html (rev 0)
+++ trunk/LayoutTests/js/regress/fold-put-by-id-to-multi-put-by-offset.html 2014-07-27 23:14:40 UTC (rev 171660)
</span><span class="lines">@@ -0,0 +1,12 @@
</span><ins>+<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
+<html>
+<head>
+<script src="../../resources/js-test-pre.js"></script>
+</head>
+<body>
+<script src="../../resources/regress-pre.js"></script>
+<script src="script-tests/fold-put-by-id-to-multi-put-by-offset.js"></script>
+<script src="../../resources/regress-post.js"></script>
+<script src="../../resources/js-test-post.js"></script>
+</body>
+</html>
</ins></span></pre></div>
<a id="trunkLayoutTestsjsregressfoldputstructureexpectedtxt"></a>
<div class="addfile"><h4>Added: trunk/LayoutTests/js/regress/fold-put-structure-expected.txt (0 => 171660)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/regress/fold-put-structure-expected.txt (rev 0)
+++ trunk/LayoutTests/js/regress/fold-put-structure-expected.txt 2014-07-27 23:14:40 UTC (rev 171660)
</span><span class="lines">@@ -0,0 +1,10 @@
</span><ins>+JSRegress/fold-put-structure
+
+On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
+
+
+PASS no exception thrown
+PASS successfullyParsed is true
+
+TEST COMPLETE
+
</ins></span></pre></div>
<a id="trunkLayoutTestsjsregressfoldputstructurehtml"></a>
<div class="addfile"><h4>Added: trunk/LayoutTests/js/regress/fold-put-structure.html (0 => 171660)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/regress/fold-put-structure.html (rev 0)
+++ trunk/LayoutTests/js/regress/fold-put-structure.html 2014-07-27 23:14:40 UTC (rev 171660)
</span><span class="lines">@@ -0,0 +1,12 @@
</span><ins>+<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
+<html>
+<head>
+<script src="../../resources/js-test-pre.js"></script>
+</head>
+<body>
+<script src="../../resources/regress-pre.js"></script>
+<script src="script-tests/fold-put-structure.js"></script>
+<script src="../../resources/regress-post.js"></script>
+<script src="../../resources/js-test-post.js"></script>
+</body>
+</html>
</ins></span></pre></div>
<a id="trunkLayoutTestsjsregresshoistpolycheckstructureeffectfulloopexpectedtxt"></a>
<div class="addfile"><h4>Added: trunk/LayoutTests/js/regress/hoist-poly-check-structure-effectful-loop-expected.txt (0 => 171660)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/regress/hoist-poly-check-structure-effectful-loop-expected.txt (rev 0)
+++ trunk/LayoutTests/js/regress/hoist-poly-check-structure-effectful-loop-expected.txt 2014-07-27 23:14:40 UTC (rev 171660)
</span><span class="lines">@@ -0,0 +1,10 @@
</span><ins>+JSRegress/hoist-poly-check-structure-effectful-loop
+
+On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
+
+
+PASS no exception thrown
+PASS successfullyParsed is true
+
+TEST COMPLETE
+
</ins></span></pre></div>
<a id="trunkLayoutTestsjsregresshoistpolycheckstructureeffectfulloophtml"></a>
<div class="addfile"><h4>Added: trunk/LayoutTests/js/regress/hoist-poly-check-structure-effectful-loop.html (0 => 171660)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/regress/hoist-poly-check-structure-effectful-loop.html (rev 0)
+++ trunk/LayoutTests/js/regress/hoist-poly-check-structure-effectful-loop.html 2014-07-27 23:14:40 UTC (rev 171660)
</span><span class="lines">@@ -0,0 +1,12 @@
</span><ins>+<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
+<html>
+<head>
+<script src="../../resources/js-test-pre.js"></script>
+</head>
+<body>
+<script src="../../resources/regress-pre.js"></script>
+<script src="script-tests/hoist-poly-check-structure-effectful-loop.js"></script>
+<script src="../../resources/regress-post.js"></script>
+<script src="../../resources/js-test-post.js"></script>
+</body>
+</html>
</ins></span></pre></div>
<a id="trunkLayoutTestsjsregresshoistpolycheckstructureexpectedtxt"></a>
<div class="addfile"><h4>Added: trunk/LayoutTests/js/regress/hoist-poly-check-structure-expected.txt (0 => 171660)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/regress/hoist-poly-check-structure-expected.txt (rev 0)
+++ trunk/LayoutTests/js/regress/hoist-poly-check-structure-expected.txt 2014-07-27 23:14:40 UTC (rev 171660)
</span><span class="lines">@@ -0,0 +1,10 @@
</span><ins>+JSRegress/hoist-poly-check-structure
+
+On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
+
+
+PASS no exception thrown
+PASS successfullyParsed is true
+
+TEST COMPLETE
+
</ins></span></pre></div>
<a id="trunkLayoutTestsjsregresshoistpolycheckstructurehtml"></a>
<div class="addfile"><h4>Added: trunk/LayoutTests/js/regress/hoist-poly-check-structure.html (0 => 171660)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/regress/hoist-poly-check-structure.html (rev 0)
+++ trunk/LayoutTests/js/regress/hoist-poly-check-structure.html 2014-07-27 23:14:40 UTC (rev 171660)
</span><span class="lines">@@ -0,0 +1,12 @@
</span><ins>+<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
+<html>
+<head>
+<script src="../../resources/js-test-pre.js"></script>
+</head>
+<body>
+<script src="../../resources/regress-pre.js"></script>
+<script src="script-tests/hoist-poly-check-structure.js"></script>
+<script src="../../resources/regress-post.js"></script>
+<script src="../../resources/js-test-post.js"></script>
+</body>
+</html>
</ins></span></pre></div>
<a id="trunkLayoutTestsjsregressputbyidreplaceandtransitionexpectedtxt"></a>
<div class="addfile"><h4>Added: trunk/LayoutTests/js/regress/put-by-id-replace-and-transition-expected.txt (0 => 171660)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/regress/put-by-id-replace-and-transition-expected.txt (rev 0)
+++ trunk/LayoutTests/js/regress/put-by-id-replace-and-transition-expected.txt 2014-07-27 23:14:40 UTC (rev 171660)
</span><span class="lines">@@ -0,0 +1,10 @@
</span><ins>+JSRegress/put-by-id-replace-and-transition
+
+On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
+
+
+PASS no exception thrown
+PASS successfullyParsed is true
+
+TEST COMPLETE
+
</ins></span></pre></div>
<a id="trunkLayoutTestsjsregressputbyidreplaceandtransitionhtml"></a>
<div class="addfile"><h4>Added: trunk/LayoutTests/js/regress/put-by-id-replace-and-transition.html (0 => 171660)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/regress/put-by-id-replace-and-transition.html (rev 0)
+++ trunk/LayoutTests/js/regress/put-by-id-replace-and-transition.html 2014-07-27 23:14:40 UTC (rev 171660)
</span><span class="lines">@@ -0,0 +1,12 @@
</span><ins>+<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
+<html>
+<head>
+<script src="../../resources/js-test-pre.js"></script>
+</head>
+<body>
+<script src="../../resources/regress-pre.js"></script>
+<script src="script-tests/put-by-id-replace-and-transition.js"></script>
+<script src="../../resources/regress-post.js"></script>
+<script src="../../resources/js-test-post.js"></script>
+</body>
+</html>
</ins></span></pre></div>
<a id="trunkLayoutTestsjsregressputbyidslightlypolymorphicexpectedtxt"></a>
<div class="addfile"><h4>Added: trunk/LayoutTests/js/regress/put-by-id-slightly-polymorphic-expected.txt (0 => 171660)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/regress/put-by-id-slightly-polymorphic-expected.txt (rev 0)
+++ trunk/LayoutTests/js/regress/put-by-id-slightly-polymorphic-expected.txt 2014-07-27 23:14:40 UTC (rev 171660)
</span><span class="lines">@@ -0,0 +1,10 @@
</span><ins>+JSRegress/put-by-id-slightly-polymorphic
+
+On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
+
+
+PASS no exception thrown
+PASS successfullyParsed is true
+
+TEST COMPLETE
+
</ins></span></pre></div>
<a id="trunkLayoutTestsjsregressputbyidslightlypolymorphichtml"></a>
<div class="addfile"><h4>Added: trunk/LayoutTests/js/regress/put-by-id-slightly-polymorphic.html (0 => 171660)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/regress/put-by-id-slightly-polymorphic.html (rev 0)
+++ trunk/LayoutTests/js/regress/put-by-id-slightly-polymorphic.html 2014-07-27 23:14:40 UTC (rev 171660)
</span><span class="lines">@@ -0,0 +1,12 @@
</span><ins>+<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
+<html>
+<head>
+<script src="../../resources/js-test-pre.js"></script>
+</head>
+<body>
+<script src="../../resources/regress-pre.js"></script>
+<script src="script-tests/put-by-id-slightly-polymorphic.js"></script>
+<script src="../../resources/regress-post.js"></script>
+<script src="../../resources/js-test-post.js"></script>
+</body>
+</html>
</ins></span></pre></div>
<a id="trunkLayoutTestsjsregressscripttestsfoldgetbyidtomultigetbyoffsetrareintjs"></a>
<div class="addfile"><h4>Added: trunk/LayoutTests/js/regress/script-tests/fold-get-by-id-to-multi-get-by-offset-rare-int.js (0 => 171660)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/regress/script-tests/fold-get-by-id-to-multi-get-by-offset-rare-int.js (rev 0)
+++ trunk/LayoutTests/js/regress/script-tests/fold-get-by-id-to-multi-get-by-offset-rare-int.js 2014-07-27 23:14:40 UTC (rev 171660)
</span><span class="lines">@@ -0,0 +1,47 @@
</span><ins>+function foo(o) {
+ return o.f;
+}
+
+function fu(o) {
+ return o.e;
+}
+
+function bar(f, o) {
+ return f(o);
+}
+
+for (var i = 0; i < 1000; ++i) {
+ var o = {f:1};
+ o["i" + i] = 42;
+ foo(o);
+ fu({f:1, e:2});
+ fu({e:1, f:2});
+}
+
+for (var i = 0; i < 100; ++i) {
+ bar(foo, {f:1});
+ bar(function() { }, null);
+ bar(function() { return 42 }, null);
+}
+
+Number.prototype.f = 100;
+
+(function(f, o, p) {
+ var result = 0;
+ var n = 1000000;
+ for (var i = 0; i < n + 1; ++i) {
+ result += fu(o);
+ var q;
+ if (i == n)
+ q = 42;
+ else
+ q = o;
+ result += bar(f, q);
+ var tmp = o;
+ o = p;
+ p = tmp;
+ }
+ if (result != (o.f + o.e + p.f + p.e) * n / 2 + 100 + p.e)
+ throw "Error: bad result: " + result;
+})(foo, {f:42, e:43}, {e:44, f:45});
+
</ins></span></pre></div>
<a id="trunkLayoutTestsjsregressscripttestsfoldgetbyidtomultigetbyoffsetjs"></a>
<div class="addfile"><h4>Added: trunk/LayoutTests/js/regress/script-tests/fold-get-by-id-to-multi-get-by-offset.js (0 => 171660)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/regress/script-tests/fold-get-by-id-to-multi-get-by-offset.js (rev 0)
+++ trunk/LayoutTests/js/regress/script-tests/fold-get-by-id-to-multi-get-by-offset.js 2014-07-27 23:14:40 UTC (rev 171660)
</span><span class="lines">@@ -0,0 +1,42 @@
</span><ins>+function foo(o) {
+ return o.f;
+}
+
+function fu(o) {
+ return o.e;
+}
+
+function bar(f, o) {
+ return f(o);
+}
+
+for (var i = 0; i < 1000; ++i) {
+ var o = {f:1};
+ o["i" + i] = 42;
+ foo(o);
+ fu({f:1, e:2});
+ fu({e:1, f:2});
+}
+
+for (var i = 0; i < 100; ++i) {
+ bar(foo, {f:1});
+ bar(function() { }, null);
+ bar(function() { return 42 }, null);
+}
+
+Number.prototype.f = 100;
+
+(function(f, o, p) {
+ var result = 0;
+ var n = 1000000;
+ for (var i = 0; i < n; ++i) {
+ result += fu(o);
+ result += bar(f, o);
+ var tmp = o;
+ o = p;
+ p = tmp;
+ }
+ if (result != (o.f + o.e + p.f + p.e) * n / 2)
+ throw "Error: bad result: " + result;
+})(foo, {f:42, e:43}, {e:44, f:45});
+
</ins></span></pre></div>
<a id="trunkLayoutTestsjsregressscripttestsfoldmultigetbyoffsettogetbyoffsetjs"></a>
<div class="addfile"><h4>Added: trunk/LayoutTests/js/regress/script-tests/fold-multi-get-by-offset-to-get-by-offset.js (0 => 171660)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/regress/script-tests/fold-multi-get-by-offset-to-get-by-offset.js (rev 0)
+++ trunk/LayoutTests/js/regress/script-tests/fold-multi-get-by-offset-to-get-by-offset.js 2014-07-27 23:14:40 UTC (rev 171660)
</span><span class="lines">@@ -0,0 +1,43 @@
</span><ins>+function foo(o) {
+ return o.f;
+}
+
+function fu(o) {
+ return o.e;
+}
+
+function bar(f, o) {
+ return f(o);
+}
+
+for (var i = 0; i < 100; ++i) {
+ foo({f:1, e:2});
+ foo({e:1, f:2});
+ foo({d:1, e:2, f:3});
+ fu({f:1, e:2});
+ fu({e:1, f:2});
+ fu({d:1, e:2, f:3});
+}
+
+for (var i = 0; i < 100; ++i) {
+ bar(foo, {f:1});
+ bar(function() { }, null);
+ bar(function() { return 42 }, null);
+}
+
+(function(f, o) {
+ var result = 0;
+ var n = 1000000;
+ for (var i = 0; i < n; ++i) {
+ var p;
+ if (i == n - 1) // Defeat LICM.
+ p = {f: 42, e: 42};
+ else
+ p = o;
+ result += fu(p);
+ result += bar(f, p);
+ }
+ if (result != (n - 1) * (o.f + o.e) + 42 * 2)
+ throw "Error: bad result: " + result;
+})(foo, {f:42, e:2});
+
</ins></span></pre></div>
<a id="trunkLayoutTestsjsregressscripttestsfoldmultigetbyoffsettopolygetbyoffsetjs"></a>
<div class="addfile"><h4>Added: trunk/LayoutTests/js/regress/script-tests/fold-multi-get-by-offset-to-poly-get-by-offset.js (0 => 171660)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/regress/script-tests/fold-multi-get-by-offset-to-poly-get-by-offset.js (rev 0)
+++ trunk/LayoutTests/js/regress/script-tests/fold-multi-get-by-offset-to-poly-get-by-offset.js 2014-07-27 23:14:40 UTC (rev 171660)
</span><span class="lines">@@ -0,0 +1,41 @@
</span><ins>+function foo(o) {
+ return o.f;
+}
+
+function fu(o) {
+ return o.e;
+}
+
+function bar(f, o) {
+ return f(o);
+}
+
+for (var i = 0; i < 100; ++i) {
+ foo({f:1, e:2});
+ foo({e:1, f:2});
+ foo({d:1, e:2, f:3});
+ fu({f:1, e:2});
+ fu({e:1, f:2});
+ fu({d:1, e:2, f:3});
+}
+
+for (var i = 0; i < 100; ++i) {
+ bar(foo, {f:1});
+ bar(function() { }, null);
+ bar(function() { return 42 }, null);
+}
+
+(function(f, o, p) {
+ var result = 0;
+ var n = 1000000;
+ for (var i = 0; i < n; ++i) {
+ result += fu(o);
+ result += bar(f, o);
+ var tmp = o;
+ o = p;
+ p = tmp;
+ }
+ if (result != n * o.f + n * o.e)
+ throw "Error: bad result: " + result;
+})(foo, {f:42, e:23}, {f:42, e:23, g:100});
+
</ins></span></pre></div>
<a id="trunkLayoutTestsjsregressscripttestsfoldmultiputbyoffsettopolyputbyoffsetjs"></a>
<div class="addfile"><h4>Added: trunk/LayoutTests/js/regress/script-tests/fold-multi-put-by-offset-to-poly-put-by-offset.js (0 => 171660)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/regress/script-tests/fold-multi-put-by-offset-to-poly-put-by-offset.js (rev 0)
+++ trunk/LayoutTests/js/regress/script-tests/fold-multi-put-by-offset-to-poly-put-by-offset.js 2014-07-27 23:14:40 UTC (rev 171660)
</span><span class="lines">@@ -0,0 +1,47 @@
</span><ins>+function foo(o) {
+ o.f = 1;
+}
+
+function fu(o) {
+ o.e = 2;
+}
+
+function bar(f, o) {
+ f(o);
+}
+
+for (var i = 0; i < 100; ++i) {
+ foo({f:1, e:2});
+ foo({e:1, f:2});
+ foo({d:1, e:2, f:3});
+ fu({f:1, e:2});
+ fu({e:1, f:2});
+ fu({d:1, e:2, f:3});
+}
+
+for (var i = 0; i < 100; ++i) {
+ bar(foo, {f:1});
+ bar(function() { }, null);
+ bar(function() { return 42 }, null);
+}
+
+(function(f, o, p) {
+ var result = 0;
+ var n = 1000000;
+ for (var i = 0; i < n; ++i) {
+ fu(o);
+ bar(f, o);
+ var tmp = o;
+ o = p;
+ p = tmp;
+ }
+ if (o.e != 2)
+ throw "Error: bad value in o.e: " + o.e;
+ if (o.f != 1)
+ throw "Error: bad value in o.f: " + o.f;
+ if (p.e != 2)
+ throw "Error: bad value in p.e: " + p.e;
+ if (p.f != 1)
+ throw "Error: bad value in p.f: " + p.f;
+})(foo, {f:42, e:23}, {f:42, e:23, g:100});
+
</ins></span></pre></div>
<a id="trunkLayoutTestsjsregressscripttestsfoldmultiputbyoffsettoputbyoffsetjs"></a>
<div class="addfile"><h4>Added: trunk/LayoutTests/js/regress/script-tests/fold-multi-put-by-offset-to-put-by-offset.js (0 => 171660)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/regress/script-tests/fold-multi-put-by-offset-to-put-by-offset.js (rev 0)
+++ trunk/LayoutTests/js/regress/script-tests/fold-multi-put-by-offset-to-put-by-offset.js 2014-07-27 23:14:40 UTC (rev 171660)
</span><span class="lines">@@ -0,0 +1,40 @@
</span><ins>+function foo(o) {
+ o.f = 1;
+}
+
+function fu(o) {
+ o.e = 2;
+}
+
+function bar(f, o) {
+ f(o);
+}
+
+for (var i = 0; i < 100; ++i) {
+ foo({f:1, e:2});
+ foo({e:1, f:2});
+ foo({d:1, e:2, f:3});
+ fu({f:1, e:2});
+ fu({e:1, f:2});
+ fu({d:1, e:2, f:3});
+}
+
+for (var i = 0; i < 100; ++i) {
+ bar(foo, {f:1});
+ bar(function() { }, null);
+ bar(function() { return 42 }, null);
+}
+
+(function(f, o) {
+ var result = 0;
+ var n = 1000000;
+ for (var i = 0; i < n; ++i) {
+ fu(o);
+ bar(f, o);
+ }
+ if (o.e != 2)
+ throw "Error: bad value in o.e: " + o.e;
+ if (o.f != 1)
+ throw "Error: bad value in o.f: " + o.f;
+})(foo, {f:42, e:23});
+
</ins></span></pre></div>
<a id="trunkLayoutTestsjsregressscripttestsfoldmultiputbyoffsettoreplaceortransitionputbyoffsetjs"></a>
<div class="addfile"><h4>Added: trunk/LayoutTests/js/regress/script-tests/fold-multi-put-by-offset-to-replace-or-transition-put-by-offset.js (0 => 171660)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/regress/script-tests/fold-multi-put-by-offset-to-replace-or-transition-put-by-offset.js (rev 0)
+++ trunk/LayoutTests/js/regress/script-tests/fold-multi-put-by-offset-to-replace-or-transition-put-by-offset.js 2014-07-27 23:14:40 UTC (rev 171660)
</span><span class="lines">@@ -0,0 +1,50 @@
</span><ins>+function foo(o) {
+ o.f = 1;
+}
+
+function fu(o) {
+ o.e = 2;
+}
+
+function bar(f, o) {
+ f(o);
+}
+
+for (var i = 0; i < 100; ++i) {
+ foo({f:1, e:2});
+ foo({e:1, f:2});
+ foo({d:1, e:2, f:3});
+ fu({f:1, e:2});
+ fu({e:1, f:2});
+ fu({d:1, e:2, f:3});
+}
+
+for (var i = 0; i < 100; ++i) {
+ bar(foo, {f:1});
+ bar(function() { }, null);
+ bar(function() { return 42 }, null);
+}
+
+(function(f, o) {
+ var result = 0;
+ var n = 1000000;
+ var p;
+ for (var i = 0; i < n; ++i) {
+ var q;
+ if (i & 1)
+ q = o;
+ else
+ p = q = {e:61};
+ fu(q);
+ bar(f, q);
+ }
+ if (o.e != 2)
+ throw "Error: bad value in o.e: " + o.e;
+ if (o.f != 1)
+ throw "Error: bad value in o.f: " + o.f;
+ if (p.e != 2)
+ throw "Error: bad value in p.e: " + p.e;
+ if (p.f != 1)
+ throw "Error: bad value in p.f: " + p.f;
+})(foo, {e:23, f:42});
+
</ins></span></pre></div>
<a id="trunkLayoutTestsjsregressscripttestsfoldputbyidtomultiputbyoffsetjs"></a>
<div class="addfile"><h4>Added: trunk/LayoutTests/js/regress/script-tests/fold-put-by-id-to-multi-put-by-offset.js (0 => 171660)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/regress/script-tests/fold-put-by-id-to-multi-put-by-offset.js (rev 0)
+++ trunk/LayoutTests/js/regress/script-tests/fold-put-by-id-to-multi-put-by-offset.js 2014-07-27 23:14:40 UTC (rev 171660)
</span><span class="lines">@@ -0,0 +1,46 @@
</span><ins>+function foo(o) {
+ o.f = 1;
+}
+
+function fu(o) {
+ o.e = 2;
+}
+
+function bar(f, o) {
+ f(o);
+}
+
+for (var i = 0; i < 1000; ++i) {
+ var o = {};
+ o["i" + i] = 42;
+ foo(o);
+ fu({f:1, e:2});
+ fu({e:1, f:2, g:3});
+}
+
+for (var i = 0; i < 100; ++i) {
+ bar(foo, {f:1});
+ bar(function() { }, null);
+ bar(function() { return 42 }, null);
+}
+
+(function(f, o, p) {
+ var result = 0;
+ var n = 1000000;
+ for (var i = 0; i < n; ++i) {
+ fu(o);
+ bar(f, o);
+ var tmp = o;
+ o = p;
+ p = tmp;
+ }
+ if (o.e != 2)
+ throw "Error: bad value in o.e: " + o.e;
+ if (o.f != 1)
+ throw "Error: bad value in o.f: " + o.f;
+ if (p.e != 2)
+ throw "Error: bad value in p.e: " + p.e;
+ if (p.f != 1)
+ throw "Error: bad value in p.f: " + p.f;
+})(foo, {f:42, e:23}, {e:23, f:42, g:100});
+
</ins></span></pre></div>
<a id="trunkLayoutTestsjsregressscripttestsfoldputstructurejs"></a>
<div class="addfile"><h4>Added: trunk/LayoutTests/js/regress/script-tests/fold-put-structure.js (0 => 171660)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/regress/script-tests/fold-put-structure.js (rev 0)
+++ trunk/LayoutTests/js/regress/script-tests/fold-put-structure.js 2014-07-27 23:14:40 UTC (rev 171660)
</span><span class="lines">@@ -0,0 +1,39 @@
</span><ins>+function foo(o) {
+ o.f = 1;
+}
+
+function fu(o) {
+ o.e = 2;
+}
+
+function bar(f, o) {
+ f(o);
+}
+
+for (var i = 0; i < 100; ++i) {
+ foo({e:2});
+ foo({e:1, f:2});
+ fu({f:1, e:2});
+ fu({e:1, f:2});
+ fu({d:1, e:2, f:3});
+}
+
+for (var i = 0; i < 100; ++i) {
+ bar(foo, {e:1});
+ bar(function() { }, null);
+ bar(function() { return 42 }, null);
+}
+
+(function(f, o) {
+ var result = 0;
+ var n = 1000000;
+ for (var i = 0; i < n; ++i) {
+ fu(o);
+ bar(f, o);
+ }
+ if (o.e != 2)
+ throw "Error: bad value in o.e: " + o.e;
+ if (o.f != 1)
+ throw "Error: bad value in o.f: " + o.f;
+})(foo, {e:42, f:23});
+
</ins></span></pre></div>
<a id="trunkLayoutTestsjsregressscripttestshoistpolycheckstructureeffectfulloopjs"></a>
<div class="addfile"><h4>Added: trunk/LayoutTests/js/regress/script-tests/hoist-poly-check-structure-effectful-loop.js (0 => 171660)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/regress/script-tests/hoist-poly-check-structure-effectful-loop.js (rev 0)
+++ trunk/LayoutTests/js/regress/script-tests/hoist-poly-check-structure-effectful-loop.js 2014-07-27 23:14:40 UTC (rev 171660)
</span><span class="lines">@@ -0,0 +1,27 @@
</span><ins>+function foo(o, p) {
+ var result = 0;
+ for (var i = 0; i < 100; ++i) {
+ result += o.f;
+ p.g = 42;
+ }
+ return result;
+}
+
+noInline(foo);
+
+function test(o) {
+ if (foo(o, {}) != 100)
+ throw new Error("Error: bad result: " + result);
+}
+
+for (var i = 0; i < 100; ++i) {
+ test({f:1, g:2});
+ test({f:1, h:2});
+ test({f:1, i:2});
+ test({f:1, j:2});
+ test({f:1, k:2});
+ test({f:1, l:2});
+}
+
+for (var i = 0; i < 10000; ++i)
+ test({f:1, g:2});
</ins></span></pre></div>
<a id="trunkLayoutTestsjsregressscripttestshoistpolycheckstructurejs"></a>
<div class="addfile"><h4>Added: trunk/LayoutTests/js/regress/script-tests/hoist-poly-check-structure.js (0 => 171660)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/regress/script-tests/hoist-poly-check-structure.js (rev 0)
+++ trunk/LayoutTests/js/regress/script-tests/hoist-poly-check-structure.js 2014-07-27 23:14:40 UTC (rev 171660)
</span><span class="lines">@@ -0,0 +1,25 @@
</span><ins>+function foo(o) {
+ var result = 0;
+ for (var i = 0; i < 100; ++i)
+ result += o.f;
+ return result;
+}
+
+noInline(foo);
+
+function test(o) {
+ if (foo(o) != 100)
+ throw new Error("Error: bad result: " + result);
+}
+
+for (var i = 0; i < 100; ++i) {
+ test({f:1});
+ test({f:1, g:2});
+ test({f:1, g:2, h:3});
+ test({f:1, g:2, h:3, i:4});
+ test({f:1, g:2, h:3, i:4, j:5});
+ test({f:1, g:2, h:3, i:4, j:5, k:6});
+}
+
+for (var i = 0; i < 10000; ++i)
+ test({f:1});
</ins></span></pre></div>
<a id="trunkLayoutTestsjsregressscripttestsputbyidreplaceandtransitionjs"></a>
<div class="addfile"><h4>Added: trunk/LayoutTests/js/regress/script-tests/put-by-id-replace-and-transition.js (0 => 171660)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/regress/script-tests/put-by-id-replace-and-transition.js (rev 0)
+++ trunk/LayoutTests/js/regress/script-tests/put-by-id-replace-and-transition.js 2014-07-27 23:14:40 UTC (rev 171660)
</span><span class="lines">@@ -0,0 +1,13 @@
</span><ins>+(function() {
+ var o;
+ var n = 1000000;
+ for (var i = 0; i < n; ++i) {
+ if (i & 1)
+ o = {f: 1};
+ else
+ o = {f: 1, g: 2};
+ o.g = i;
+ }
+ if (o.g != n - 1)
+ throw "Error: bad value of o.g: " + o.g;
+})();
</ins></span></pre></div>
<a id="trunkLayoutTestsjsregressscripttestsputbyidslightlypolymorphicjs"></a>
<div class="addfile"><h4>Added: trunk/LayoutTests/js/regress/script-tests/put-by-id-slightly-polymorphic.js (0 => 171660)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/regress/script-tests/put-by-id-slightly-polymorphic.js (rev 0)
+++ trunk/LayoutTests/js/regress/script-tests/put-by-id-slightly-polymorphic.js 2014-07-27 23:14:40 UTC (rev 171660)
</span><span class="lines">@@ -0,0 +1,15 @@
</span><ins>+(function() {
+ var o = {f: 1, g: 2};
+ var p = {f: 1};
+ var n = 1000000;
+ for (var i = 0; i < n; ++i) {
+ o.f = i;
+ var tmp = o;
+ o = p;
+ p = tmp;
+ }
+ if (o.f != n - 2)
+ throw "Error: bad value of o.f: " + o.f;
+ if (p.f != n - 1)
+ throw "Error: vad value of p.f: " + p.f;
+})();
</ins></span></pre></div>
<a id="trunkSourceJavaScriptCoreCMakeListstxt"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/CMakeLists.txt (171659 => 171660)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/CMakeLists.txt 2014-07-27 21:07:24 UTC (rev 171659)
+++ trunk/Source/JavaScriptCore/CMakeLists.txt 2014-07-27 23:14:40 UTC (rev 171660)
</span><span class="lines">@@ -94,6 +94,7 @@
</span><span class="cx"> bytecode/StructureSet.cpp
</span><span class="cx"> bytecode/StructureStubClearingWatchpoint.cpp
</span><span class="cx"> bytecode/StructureStubInfo.cpp
</span><ins>+ bytecode/ToThisStatus.cpp
</ins><span class="cx"> bytecode/UnlinkedCodeBlock.cpp
</span><span class="cx"> bytecode/UnlinkedInstructionStream.cpp
</span><span class="cx"> bytecode/ValueRecovery.cpp
</span><span class="lines">@@ -103,8 +104,8 @@
</span><span class="cx"> bytecompiler/NodesCodegen.cpp
</span><span class="cx">
</span><span class="cx"> debugger/Debugger.cpp
</span><del>- debugger/DebuggerActivation.cpp
</del><span class="cx"> debugger/DebuggerCallFrame.cpp
</span><ins>+ debugger/DebuggerScope.cpp
</ins><span class="cx">
</span><span class="cx"> dfg/DFGAbstractHeap.cpp
</span><span class="cx"> dfg/DFGAbstractValue.cpp
</span><span class="lines">@@ -395,6 +396,8 @@
</span><span class="cx"> runtime/FunctionExecutableDump.cpp
</span><span class="cx"> runtime/FunctionPrototype.cpp
</span><span class="cx"> runtime/GetterSetter.cpp
</span><ins>+ runtime/HighFidelityLog.cpp
+ runtime/HighFidelityTypeProfiler.cpp
</ins><span class="cx"> runtime/Identifier.cpp
</span><span class="cx"> runtime/IndexingType.cpp
</span><span class="cx"> runtime/InitializeThreading.cpp
</span><span class="lines">@@ -500,6 +503,7 @@
</span><span class="cx"> runtime/StructureRareData.cpp
</span><span class="cx"> runtime/SymbolTable.cpp
</span><span class="cx"> runtime/TestRunnerUtils.cpp
</span><ins>+ runtime/TypeSet.cpp
</ins><span class="cx"> runtime/TypedArrayController.cpp
</span><span class="cx"> runtime/TypedArrayType.cpp
</span><span class="cx"> runtime/VM.cpp
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreChangeLog"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/ChangeLog (171659 => 171660)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/ChangeLog 2014-07-27 21:07:24 UTC (rev 171659)
+++ trunk/Source/JavaScriptCore/ChangeLog 2014-07-27 23:14:40 UTC (rev 171660)
</span><span class="lines">@@ -1,3 +1,585 @@
</span><ins>+2014-07-27 Filip Pizlo <fpizlo@apple.com>
+
+ Merge r170090, r170092, r170129, r170141, r170161, r170215, r170275, r170375, r170376, r170382, r170383, r170399, r170436, r170489, r170490, r170556 from ftlopt.
+
+ This fixes the previous mismerge and adds test coverage for the thing that went wrong.
+
+ Additional changes listed here:
+
+ * jsc.cpp:
+ (functionHasCustomProperties): Expose a way of checking hasCustomProperties(), which the DOM relies on. The regression I previously introduced was because this didn't work right. Now we can test it!
+ * runtime/Structure.cpp:
+ (JSC::Structure::Structure): This was supposed to be setDidTransition(true); the last merge had it set to false.
+ * tests/stress/has-custom-properties.js: Added. This test failed with the mismerge.
+
+ 2014-06-27 Michael Saboff <msaboff@apple.com>
+
+ Unreviewed build fix after r169795.
+
+ Fixed ASSERT for 32 bit build.
+
+ * dfg/DFGSpeculativeJIT.cpp:
+ (JSC::DFG::SpeculativeJIT::silentSavePlanForGPR):
+
+ 2014-06-24 Saam Barati <sbarati@apple.com>
+
+ Web Inspector: debugger should be able to show variable types
+ https://bugs.webkit.org/show_bug.cgi?id=133395
+
+ Reviewed by Filip Pizlo.
+
+ Increase the amount of type information the VM gathers when directed
+ to do so. This initial commit is working towards the goal of
+ capturing, and then showing (via the Web Inspector) type information for all
+ assignment and load operations. This patch doesn't have the feature fully
+ implemented, but it ensures the VM has no performance regressions
+ unless the feature is specifically turned on.
+
+ * JavaScriptCore.xcodeproj/project.pbxproj:
+ * bytecode/BytecodeList.json:
+ * bytecode/BytecodeUseDef.h:
+ (JSC::computeUsesForBytecodeOffset):
+ (JSC::computeDefsForBytecodeOffset):
+ * bytecode/CodeBlock.cpp:
+ (JSC::CodeBlock::dumpBytecode):
+ (JSC::CodeBlock::CodeBlock):
+ (JSC::CodeBlock::finalizeUnconditionally):
+ * bytecode/CodeBlock.h:
+ * bytecode/Instruction.h:
+ * bytecode/TypeLocation.h: Added.
+ (JSC::TypeLocation::TypeLocation):
+ * bytecompiler/BytecodeGenerator.cpp:
+ (JSC::BytecodeGenerator::emitMove):
+ (JSC::BytecodeGenerator::emitProfileTypesWithHighFidelity):
+ (JSC::BytecodeGenerator::emitPutToScope):
+ (JSC::BytecodeGenerator::emitPutById):
+ (JSC::BytecodeGenerator::emitPutByVal):
+ * bytecompiler/BytecodeGenerator.h:
+ (JSC::BytecodeGenerator::isProfilingTypesWithHighFidelity):
+ * bytecompiler/NodesCodegen.cpp:
+ (JSC::PostfixNode::emitResolve):
+ (JSC::PrefixNode::emitResolve):
+ (JSC::ReadModifyResolveNode::emitBytecode):
+ (JSC::AssignResolveNode::emitBytecode):
+ (JSC::ConstDeclNode::emitCodeSingle):
+ (JSC::ForInNode::emitBytecode):
+ * heap/Heap.cpp:
+ (JSC::Heap::collect):
+ * inspector/agents/InspectorRuntimeAgent.cpp:
+ (Inspector::InspectorRuntimeAgent::getRuntimeTypeForVariableInTextRange):
+ * inspector/agents/InspectorRuntimeAgent.h:
+ * inspector/protocol/Runtime.json:
+ * jsc.cpp:
+ (GlobalObject::finishCreation):
+ (functionDumpTypesForAllVariables):
+ * llint/LLIntSlowPaths.cpp:
+ (JSC::LLInt::LLINT_SLOW_PATH_DECL):
+ (JSC::LLInt::putToScopeCommon):
+ * llint/LLIntSlowPaths.h:
+ * llint/LowLevelInterpreter.asm:
+ * runtime/HighFidelityLog.cpp: Added.
+ (JSC::HighFidelityLog::initializeHighFidelityLog):
+ (JSC::HighFidelityLog::~HighFidelityLog):
+ (JSC::HighFidelityLog::recordTypeInformationForLocation):
+ (JSC::HighFidelityLog::processHighFidelityLog):
+ (JSC::HighFidelityLog::actuallyProcessLogThreadFunction):
+ * runtime/HighFidelityLog.h: Added.
+ (JSC::HighFidelityLog::HighFidelityLog):
+ * runtime/HighFidelityTypeProfiler.cpp: Added.
+ (JSC::HighFidelityTypeProfiler::getTypesForVariableInRange):
+ (JSC::HighFidelityTypeProfiler::getGlobalTypesForVariableInRange):
+ (JSC::HighFidelityTypeProfiler::getLocalTypesForVariableInRange):
+ (JSC::HighFidelityTypeProfiler::insertNewLocation):
+ (JSC::HighFidelityTypeProfiler::getLocationBasedHash):
+ * runtime/HighFidelityTypeProfiler.h: Added.
+ * runtime/Options.h:
+ * runtime/Structure.cpp:
+ (JSC::Structure::toStructureShape):
+ * runtime/Structure.h:
+ * runtime/SymbolTable.cpp:
+ (JSC::SymbolTable::SymbolTable):
+ (JSC::SymbolTable::cloneCapturedNames):
+ (JSC::SymbolTable::uniqueIDForVariable):
+ (JSC::SymbolTable::uniqueIDForRegister):
+ (JSC::SymbolTable::globalTypeSetForRegister):
+ (JSC::SymbolTable::globalTypeSetForVariable):
+ * runtime/SymbolTable.h:
+ (JSC::SymbolTable::add):
+ (JSC::SymbolTable::set):
+ * runtime/TypeSet.cpp: Added.
+ (JSC::TypeSet::TypeSet):
+ (JSC::TypeSet::getRuntimeTypeForValue):
+ (JSC::TypeSet::addTypeForValue):
+ (JSC::TypeSet::removeDuplicatesInStructureHistory):
+ (JSC::TypeSet::seenTypes):
+ (JSC::TypeSet::dumpSeenTypes):
+ (JSC::StructureShape::StructureShape):
+ (JSC::StructureShape::markAsFinal):
+ (JSC::StructureShape::addProperty):
+ (JSC::StructureShape::propertyHash):
+ (JSC::StructureShape::leastUpperBound):
+ (JSC::StructureShape::stringRepresentation):
+ * runtime/TypeSet.h: Added.
+ (JSC::StructureShape::create):
+ (JSC::TypeSet::create):
+ * runtime/VM.cpp:
+ (JSC::VM::VM):
+ (JSC::VM::getTypesForVariableInRange):
+ (JSC::VM::updateHighFidelityTypeProfileState):
+ (JSC::VM::dumpHighFidelityProfilingTypes):
+ * runtime/VM.h:
+ (JSC::VM::isProfilingTypesWithHighFidelity):
+ (JSC::VM::highFidelityLog):
+ (JSC::VM::highFidelityTypeProfiler):
+ (JSC::VM::nextLocation):
+ (JSC::VM::getNextUniqueVariableID):
+
+ 2014-06-26 Mark Lam <mark.lam@apple.com>
+
+ Remove unused instantiation of the WithScope structure.
+ <https://webkit.org/b/134331>
+
+ Reviewed by Oliver Hunt.
+
+ The WithScope structure instance is the VM is unused, and is now removed.
+
+ * runtime/VM.cpp:
+ (JSC::VM::VM):
+ * runtime/VM.h:
+
+ 2014-06-25 Mark Hahnenberg <mhahnenberg@apple.com>
+
+ Structure bit fields should have a consistent format
+ https://bugs.webkit.org/show_bug.cgi?id=134307
+
+ Reviewed by Filip Pizlo.
+
+ Currently we use C-style bit fields for a number of member variables in Structure to save space.
+ This makes it difficult to load these fields in the JIT. We should instead use our own bitfield
+ format to make it easy to load and test these variables in JIT code.
+
+ * runtime/JSObject.cpp:
+ (JSC::JSObject::putDirectNonIndexAccessor):
+ (JSC::JSObject::reifyStaticFunctionsForDelete):
+ * runtime/Structure.cpp:
+ (JSC::StructureTransitionTable::contains):
+ (JSC::StructureTransitionTable::get):
+ (JSC::StructureTransitionTable::add):
+ (JSC::Structure::Structure):
+ (JSC::Structure::materializePropertyMap):
+ (JSC::Structure::addPropertyTransition):
+ (JSC::Structure::despecifyFunctionTransition):
+ (JSC::Structure::toDictionaryTransition):
+ (JSC::Structure::freezeTransition):
+ (JSC::Structure::preventExtensionsTransition):
+ (JSC::Structure::takePropertyTableOrCloneIfPinned):
+ (JSC::Structure::nonPropertyTransition):
+ (JSC::Structure::flattenDictionaryStructure):
+ (JSC::Structure::addPropertyWithoutTransition):
+ (JSC::Structure::pin):
+ (JSC::Structure::allocateRareData):
+ (JSC::Structure::cloneRareDataFrom):
+ (JSC::Structure::getConcurrently):
+ (JSC::Structure::putSpecificValue):
+ (JSC::Structure::getPropertyNamesFromStructure):
+ (JSC::Structure::visitChildren):
+ (JSC::Structure::checkConsistency):
+ * runtime/Structure.h:
+ (JSC::Structure::isExtensible):
+ (JSC::Structure::isDictionary):
+ (JSC::Structure::isUncacheableDictionary):
+ (JSC::Structure::propertyAccessesAreCacheable):
+ (JSC::Structure::previousID):
+ (JSC::Structure::setHasGetterSetterPropertiesWithProtoCheck):
+ (JSC::Structure::setContainsReadOnlyProperties):
+ (JSC::Structure::disableSpecificFunctionTracking):
+ (JSC::Structure::objectToStringValue):
+ (JSC::Structure::setObjectToStringValue):
+ (JSC::Structure::setPreviousID):
+ (JSC::Structure::clearPreviousID):
+ (JSC::Structure::previous):
+ (JSC::Structure::rareData):
+ (JSC::Structure::didTransition): Deleted.
+ (JSC::Structure::hasGetterSetterProperties): Deleted.
+ (JSC::Structure::hasReadOnlyOrGetterSetterPropertiesExcludingProto): Deleted.
+ (JSC::Structure::setHasGetterSetterProperties): Deleted.
+ (JSC::Structure::hasNonEnumerableProperties): Deleted.
+ (JSC::Structure::staticFunctionsReified): Deleted.
+ (JSC::Structure::setStaticFunctionsReified): Deleted.
+ * runtime/StructureInlines.h:
+ (JSC::Structure::setEnumerationCache):
+ (JSC::Structure::enumerationCache):
+ (JSC::Structure::checkOffsetConsistency):
+
+ 2014-06-24 Mark Lam <mark.lam@apple.com>
+
+ [ftlopt] Renamed DebuggerActivation to DebuggerScope.
+ <https://webkit.org/b/134273>
+
+ Reviewed by Michael Saboff.
+
+ * CMakeLists.txt:
+ * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+ * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
+ * JavaScriptCore.xcodeproj/project.pbxproj:
+ * debugger/DebuggerActivation.cpp: Removed.
+ * debugger/DebuggerActivation.h: Removed.
+ * debugger/DebuggerScope.cpp: Copied from ../../trunk/Source/JavaScriptCore/debugger/DebuggerActivation.cpp.
+ (JSC::DebuggerScope::DebuggerScope):
+ (JSC::DebuggerScope::finishCreation):
+ (JSC::DebuggerScope::visitChildren):
+ (JSC::DebuggerScope::className):
+ (JSC::DebuggerScope::getOwnPropertySlot):
+ (JSC::DebuggerScope::put):
+ (JSC::DebuggerScope::deleteProperty):
+ (JSC::DebuggerScope::getOwnPropertyNames):
+ (JSC::DebuggerScope::defineOwnProperty):
+ (JSC::DebuggerActivation::DebuggerActivation): Deleted.
+ (JSC::DebuggerActivation::finishCreation): Deleted.
+ (JSC::DebuggerActivation::visitChildren): Deleted.
+ (JSC::DebuggerActivation::className): Deleted.
+ (JSC::DebuggerActivation::getOwnPropertySlot): Deleted.
+ (JSC::DebuggerActivation::put): Deleted.
+ (JSC::DebuggerActivation::deleteProperty): Deleted.
+ (JSC::DebuggerActivation::getOwnPropertyNames): Deleted.
+ (JSC::DebuggerActivation::defineOwnProperty): Deleted.
+ * debugger/DebuggerScope.h: Copied from ../../trunk/Source/JavaScriptCore/debugger/DebuggerActivation.h.
+ (JSC::DebuggerScope::create):
+ (JSC::DebuggerActivation::create): Deleted.
+ * runtime/VM.cpp:
+ (JSC::VM::VM):
+ * runtime/VM.h:
+
+ 2014-06-24 Filip Pizlo <fpizlo@apple.com>
+
+ [ftlopt] PutByIdFlush can also be converted to a PutByOffset so don't assert otherwise
+ https://bugs.webkit.org/show_bug.cgi?id=134265
+
+ Reviewed by Geoffrey Garen.
+
+ More assertion fallout from the PutById folding work.
+
+ * dfg/DFGNode.h:
+ (JSC::DFG::Node::convertToPutByOffset):
+
+ 2014-06-24 Filip Pizlo <fpizlo@apple.com>
+
+ [ftlopt] GC should notify us if it resets to_this
+ https://bugs.webkit.org/show_bug.cgi?id=128231
+
+ Reviewed by Geoffrey Garen.
+
+ * CMakeLists.txt:
+ * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+ * JavaScriptCore.xcodeproj/project.pbxproj:
+ * bytecode/BytecodeList.json:
+ * bytecode/CodeBlock.cpp:
+ (JSC::CodeBlock::dumpBytecode):
+ (JSC::CodeBlock::finalizeUnconditionally):
+ * bytecode/Instruction.h:
+ * bytecode/ToThisStatus.cpp: Added.
+ (JSC::merge):
+ (WTF::printInternal):
+ * bytecode/ToThisStatus.h: Added.
+ * bytecompiler/BytecodeGenerator.cpp:
+ (JSC::BytecodeGenerator::BytecodeGenerator):
+ * dfg/DFGByteCodeParser.cpp:
+ (JSC::DFG::ByteCodeParser::parseBlock):
+ * llint/LowLevelInterpreter32_64.asm:
+ * llint/LowLevelInterpreter64.asm:
+ * runtime/CommonSlowPaths.cpp:
+ (JSC::SLOW_PATH_DECL):
+
+ 2014-06-24 Filip Pizlo <fpizlo@apple.com>
+
+ [ftlopt] StructureAbstractValue::onlyStructure() should return nullptr if isClobbered()
+ https://bugs.webkit.org/show_bug.cgi?id=134256
+
+ Reviewed by Michael Saboff.
+
+ This isn't testable right now (i.e. it's benign) but we should get it right anyway. The
+ point is to be able to precisely model what goes on in the snippets of code between a
+ side-effect and an InvalidationPoint.
+
+ This patch also cleans up onlyStructure() by delegating more work to
+ StructureSet::onlyStructure().
+
+ * dfg/DFGStructureAbstractValue.h:
+ (JSC::DFG::StructureAbstractValue::onlyStructure):
+
+ 2014-06-24 Filip Pizlo <fpizlo@apple.com>
+
+ [ftlopt][REGRESSION] PutById AI is introducing watchable structures without watching them
+ https://bugs.webkit.org/show_bug.cgi?id=134260
+
+ Reviewed by Geoffrey Garen.
+
+ This was causing loads of assertion failures in debug builds.
+
+ * dfg/DFGAbstractInterpreterInlines.h:
+ (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+
+ 2014-06-21 Filip Pizlo <fpizlo@apple.com>
+
+ [ftlopt] Fold GetById/PutById to MultiGetByOffset/GetByOffset or MultiPutByOffset/PutByOffset, which implies handling non-singleton sets
+ https://bugs.webkit.org/show_bug.cgi?id=134090
+
+ Reviewed by Oliver Hunt.
+
+ This pretty much finishes off the work to eliminate the special-casing of singleton
+ structure sets by making it possible to fold GetById and PutById to various polymorphic
+ forms of the ByOffset nodes.
+
+ * bytecode/GetByIdStatus.cpp:
+ (JSC::GetByIdStatus::computeForStubInfo):
+ (JSC::GetByIdStatus::computeFor):
+ * bytecode/GetByIdStatus.h:
+ * bytecode/PutByIdStatus.cpp:
+ (JSC::PutByIdStatus::computeFor):
+ * bytecode/PutByIdStatus.h:
+ * bytecode/PutByIdVariant.h:
+ (JSC::PutByIdVariant::constantChecks):
+ * dfg/DFGAbstractInterpreterInlines.h:
+ (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+ * dfg/DFGByteCodeParser.cpp:
+ (JSC::DFG::ByteCodeParser::parseBlock):
+ * dfg/DFGConstantFoldingPhase.cpp:
+ (JSC::DFG::ConstantFoldingPhase::foldConstants):
+ (JSC::DFG::ConstantFoldingPhase::emitPutByOffset):
+ (JSC::DFG::ConstantFoldingPhase::addChecks):
+ * dfg/DFGNode.h:
+ (JSC::DFG::Node::convertToMultiGetByOffset):
+ (JSC::DFG::Node::convertToMultiPutByOffset):
+ * dfg/DFGSpeculativeJIT64.cpp: Also convert all release assertions to DFG assertions in this file, because I was hitting some of them while debugging.
+ (JSC::DFG::SpeculativeJIT::fillJSValue):
+ (JSC::DFG::SpeculativeJIT::nonSpeculativeCompareNull):
+ (JSC::DFG::SpeculativeJIT::emitCall):
+ (JSC::DFG::SpeculativeJIT::fillSpeculateInt32Internal):
+ (JSC::DFG::SpeculativeJIT::fillSpeculateInt32Strict):
+ (JSC::DFG::SpeculativeJIT::fillSpeculateInt52):
+ (JSC::DFG::SpeculativeJIT::fillSpeculateDouble):
+ (JSC::DFG::SpeculativeJIT::fillSpeculateCell):
+ (JSC::DFG::SpeculativeJIT::fillSpeculateBoolean):
+ (JSC::DFG::SpeculativeJIT::compileLogicalNot):
+ (JSC::DFG::SpeculativeJIT::emitBranch):
+ (JSC::DFG::SpeculativeJIT::compile):
+ * dfg/DFGStructureAbstractValue.h:
+ (JSC::DFG::StructureAbstractValue::set):
+
+ 2014-06-19 Filip Pizlo <fpizlo@apple.com>
+
+ [ftlopt] StructureSet::onlyStructure() should return nullptr if it's not a singleton (instead of asserting)
+ https://bugs.webkit.org/show_bug.cgi?id=134077
+
+ Reviewed by Sam Weinig.
+
+ This makes StructureSet and StructureAbstractValue more consistent and fixes a debug assert
+ in the abstract interpreter.
+
+ * bytecode/StructureSet.h:
+ (JSC::StructureSet::onlyStructure):
+
+ 2014-06-18 Filip Pizlo <fpizlo@apple.com>
+
+ DFG AI and constant folder should be able to precisely prune MultiGetByOffset/MultiPutByOffset even if the base structure abstract value is not a singleton
+ https://bugs.webkit.org/show_bug.cgi?id=133918
+
+ Reviewed by Mark Hahnenberg.
+
+ This also adds pruning of PutStructure, since I basically had no choice but
+ to implement such logic within MultiPutByOffset.
+
+ Also adds a bunch of PutById cache status dumping to bytecode dumping.
+
+ * bytecode/GetByIdVariant.cpp:
+ (JSC::GetByIdVariant::dumpInContext):
+ * bytecode/GetByIdVariant.h:
+ (JSC::GetByIdVariant::structureSet):
+ * bytecode/PutByIdVariant.h:
+ (JSC::PutByIdVariant::oldStructure):
+ * bytecode/StructureSet.cpp:
+ (JSC::StructureSet::filter):
+ (JSC::StructureSet::filterArrayModes):
+ * bytecode/StructureSet.h:
+ * dfg/DFGAbstractInterpreterInlines.h:
+ (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+ * dfg/DFGAbstractValue.cpp:
+ (JSC::DFG::AbstractValue::changeStructure):
+ (JSC::DFG::AbstractValue::contains):
+ * dfg/DFGAbstractValue.h:
+ (JSC::DFG::AbstractValue::couldBeType):
+ (JSC::DFG::AbstractValue::isType):
+ * dfg/DFGConstantFoldingPhase.cpp:
+ (JSC::DFG::ConstantFoldingPhase::foldConstants):
+ (JSC::DFG::ConstantFoldingPhase::emitGetByOffset):
+ (JSC::DFG::ConstantFoldingPhase::emitPutByOffset):
+ (JSC::DFG::ConstantFoldingPhase::addBaseCheck):
+ * dfg/DFGGraph.cpp:
+ (JSC::DFG::Graph::freezeStrong):
+ * dfg/DFGGraph.h:
+ * dfg/DFGStructureAbstractValue.h:
+ (JSC::DFG::StructureAbstractValue::operator=):
+ * ftl/FTLLowerDFGToLLVM.cpp:
+ (JSC::FTL::LowerDFGToLLVM::compileMultiGetByOffset):
+ * tests/stress/fold-multi-get-by-offset-to-get-by-offset-without-folding-the-structure-check.js: Added.
+ (foo):
+ (fu):
+ (bar):
+ (baz):
+ (.bar):
+ (.baz):
+ * tests/stress/fold-multi-put-by-offset-to-put-by-offset-without-folding-the-structure-check.js: Added.
+ (foo):
+ (fu):
+ (bar):
+ (baz):
+ (.bar):
+ (.baz):
+ * tests/stress/prune-multi-put-by-offset-replace-or-transition-variant.js: Added.
+ (foo):
+ (fu):
+ (bar):
+ (baz):
+ (.bar):
+ (.baz):
+
+ 2014-06-18 Mark Hahnenberg <mhahnenberg@apple.com>
+
+ Remove CompoundType and LeafType
+ https://bugs.webkit.org/show_bug.cgi?id=134037
+
+ Reviewed by Filip Pizlo.
+
+ We don't use them for anything. We'll replace them with a generic CellType type for all
+ the objects that are JSCells, aren't JSObjects, and for which we generally don't care about
+ their JSType at runtime.
+
+ * llint/LLIntData.cpp:
+ (JSC::LLInt::Data::performAssertions):
+ * runtime/ArrayBufferNeuteringWatchpoint.cpp:
+ (JSC::ArrayBufferNeuteringWatchpoint::createStructure):
+ * runtime/Executable.h:
+ (JSC::ExecutableBase::createStructure):
+ (JSC::NativeExecutable::createStructure):
+ * runtime/JSPromiseDeferred.h:
+ (JSC::JSPromiseDeferred::createStructure):
+ * runtime/JSPromiseReaction.h:
+ (JSC::JSPromiseReaction::createStructure):
+ * runtime/JSPropertyNameIterator.h:
+ (JSC::JSPropertyNameIterator::createStructure):
+ * runtime/JSType.h:
+ * runtime/JSTypeInfo.h:
+ (JSC::TypeInfo::TypeInfo):
+ * runtime/MapData.h:
+ (JSC::MapData::createStructure):
+ * runtime/PropertyMapHashTable.h:
+ (JSC::PropertyTable::createStructure):
+ * runtime/RegExp.h:
+ (JSC::RegExp::createStructure):
+ * runtime/SparseArrayValueMap.cpp:
+ (JSC::SparseArrayValueMap::createStructure):
+ * runtime/Structure.cpp:
+ (JSC::Structure::Structure):
+ * runtime/StructureChain.h:
+ (JSC::StructureChain::createStructure):
+ * runtime/StructureRareData.cpp:
+ (JSC::StructureRareData::createStructure):
+ * runtime/SymbolTable.h:
+ (JSC::SymbolTable::createStructure):
+ * runtime/WeakMapData.h:
+ (JSC::WeakMapData::createStructure):
+
+ 2014-06-17 Filip Pizlo <fpizlo@apple.com>
+
+ [ftlopt] PutStructure and PhantomPutStructure shouldn't leave the world in a clobbered state
+ https://bugs.webkit.org/show_bug.cgi?id=134002
+
+ Reviewed by Mark Hahnenberg.
+
+ The effect of this bug was that if we had a PutStructure or PhantomPutStructure then any
+ JSConstants would be in a Clobbered state, so we wouldn't take advantage of our knowledge
+ of the structure if that structure was watchable.
+
+ Also kill PhantomPutStructure.
+
+ * dfg/DFGAbstractInterpreterInlines.h:
+ (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+ (JSC::DFG::AbstractInterpreter<AbstractStateType>::observeTransition):
+ (JSC::DFG::AbstractInterpreter<AbstractStateType>::observeTransitions):
+ * dfg/DFGClobberize.h:
+ (JSC::DFG::clobberize):
+ * dfg/DFGDoesGC.cpp:
+ (JSC::DFG::doesGC):
+ * dfg/DFGFixupPhase.cpp:
+ (JSC::DFG::FixupPhase::fixupNode):
+ * dfg/DFGGraph.cpp:
+ (JSC::DFG::Graph::visitChildren):
+ * dfg/DFGNode.h:
+ (JSC::DFG::Node::hasTransition):
+ * dfg/DFGNodeType.h:
+ * dfg/DFGPredictionPropagationPhase.cpp:
+ (JSC::DFG::PredictionPropagationPhase::propagate):
+ * dfg/DFGSafeToExecute.h:
+ (JSC::DFG::safeToExecute):
+ * dfg/DFGSpeculativeJIT32_64.cpp:
+ (JSC::DFG::SpeculativeJIT::compile):
+ * dfg/DFGSpeculativeJIT64.cpp:
+ (JSC::DFG::SpeculativeJIT::compile):
+ * dfg/DFGStructureAbstractValue.cpp:
+ (JSC::DFG::StructureAbstractValue::observeTransition):
+ (JSC::DFG::StructureAbstractValue::observeTransitions):
+ * dfg/DFGValidate.cpp:
+ (JSC::DFG::Validate::validate):
+ * dfg/DFGWatchableStructureWatchingPhase.cpp:
+ (JSC::DFG::WatchableStructureWatchingPhase::run):
+ * ftl/FTLCapabilities.cpp:
+ (JSC::FTL::canCompile):
+ * ftl/FTLLowerDFGToLLVM.cpp:
+ (JSC::FTL::LowerDFGToLLVM::compileNode):
+ (JSC::FTL::LowerDFGToLLVM::compilePhantomPutStructure): Deleted.
+
+ 2014-06-17 Filip Pizlo <fpizlo@apple.com>
+
+ [ftlopt] DFG put_by_id should inline accesses with a slightly polymorphic base
+ https://bugs.webkit.org/show_bug.cgi?id=133964
+
+ Reviewed by Mark Hahnenberg.
+
+ * bytecode/PutByIdStatus.cpp:
+ (JSC::PutByIdStatus::appendVariant):
+ (JSC::PutByIdStatus::computeForStubInfo):
+ * bytecode/PutByIdVariant.cpp:
+ (JSC::PutByIdVariant::oldStructureForTransition):
+ (JSC::PutByIdVariant::writesStructures):
+ (JSC::PutByIdVariant::reallocatesStorage):
+ (JSC::PutByIdVariant::attemptToMerge):
+ (JSC::PutByIdVariant::attemptToMergeTransitionWithReplace):
+ (JSC::PutByIdVariant::dumpInContext):
+ * bytecode/PutByIdVariant.h:
+ (JSC::PutByIdVariant::PutByIdVariant):
+ (JSC::PutByIdVariant::replace):
+ (JSC::PutByIdVariant::transition):
+ (JSC::PutByIdVariant::structure):
+ (JSC::PutByIdVariant::oldStructure):
+ * dfg/DFGAbstractInterpreterInlines.h:
+ (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+ * dfg/DFGByteCodeParser.cpp:
+ (JSC::DFG::ByteCodeParser::handlePutById):
+ (JSC::DFG::ByteCodeParser::parseBlock):
+ * dfg/DFGConstantFoldingPhase.cpp:
+ (JSC::DFG::ConstantFoldingPhase::foldConstants):
+ (JSC::DFG::ConstantFoldingPhase::emitPutByOffset):
+ * dfg/DFGGraph.cpp:
+ (JSC::DFG::Graph::visitChildren):
+ * dfg/DFGNode.cpp:
+ (JSC::DFG::MultiPutByOffsetData::writesStructures):
+ (JSC::DFG::MultiPutByOffsetData::reallocatesStorage):
+ * ftl/FTLAbbreviations.h:
+ (JSC::FTL::getLinkage):
+ * ftl/FTLLowerDFGToLLVM.cpp:
+ (JSC::FTL::LowerDFGToLLVM::compileMultiPutByOffset):
+ (JSC::FTL::LowerDFGToLLVM::getModuleByPathForSymbol):
+
</ins><span class="cx"> 2014-07-26 Filip Pizlo <fpizlo@apple.com>
</span><span class="cx">
</span><span class="cx"> Unreviewed, roll out r171641-r171644. It broke some tests; will investigate and
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreJavaScriptCorevcxprojJavaScriptCorevcxproj"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/JavaScriptCore.vcxproj/JavaScriptCore.vcxproj (171659 => 171660)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/JavaScriptCore.vcxproj/JavaScriptCore.vcxproj 2014-07-27 21:07:24 UTC (rev 171659)
+++ trunk/Source/JavaScriptCore/JavaScriptCore.vcxproj/JavaScriptCore.vcxproj 2014-07-27 23:14:40 UTC (rev 171660)
</span><span class="lines">@@ -347,6 +347,7 @@
</span><span class="cx"> <ClCompile Include="..\bytecode\StructureSet.cpp" />
</span><span class="cx"> <ClCompile Include="..\bytecode\StructureStubClearingWatchpoint.cpp" />
</span><span class="cx"> <ClCompile Include="..\bytecode\StructureStubInfo.cpp" />
</span><ins>+ <ClCompile Include="..\bytecode\ToThisStatus.cpp" />
</ins><span class="cx"> <ClCompile Include="..\bytecode\UnlinkedCodeBlock.cpp" />
</span><span class="cx"> <ClCompile Include="..\bytecode\UnlinkedInstructionStream.cpp" />
</span><span class="cx"> <ClCompile Include="..\bytecode\ValueRecovery.cpp" />
</span><span class="lines">@@ -354,8 +355,8 @@
</span><span class="cx"> <ClCompile Include="..\bytecompiler\BytecodeGenerator.cpp" />
</span><span class="cx"> <ClCompile Include="..\bytecompiler\NodesCodegen.cpp" />
</span><span class="cx"> <ClCompile Include="..\debugger\Debugger.cpp" />
</span><del>- <ClCompile Include="..\debugger\DebuggerActivation.cpp" />
</del><span class="cx"> <ClCompile Include="..\debugger\DebuggerCallFrame.cpp" />
</span><ins>+ <ClCompile Include="..\debugger\DebuggerScope.cpp" />
</ins><span class="cx"> <ClCompile Include="..\dfg\DFGAbstractHeap.cpp" />
</span><span class="cx"> <ClCompile Include="..\dfg\DFGAbstractValue.cpp" />
</span><span class="cx"> <ClCompile Include="..\dfg\DFGArgumentsSimplificationPhase.cpp" />
</span><span class="lines">@@ -682,6 +683,8 @@
</span><span class="cx"> <ClCompile Include="..\runtime\FunctionExecutableDump.cpp" />
</span><span class="cx"> <ClCompile Include="..\runtime\FunctionPrototype.cpp" />
</span><span class="cx"> <ClCompile Include="..\runtime\GetterSetter.cpp" />
</span><ins>+ <ClCompile Include="..\runtime\HighFidelityLog.cpp" />
+ <ClCompile Include="..\runtime\HighFidelityTypeProfiler.cpp" />
</ins><span class="cx"> <ClCompile Include="..\runtime\Identifier.cpp" />
</span><span class="cx"> <ClCompile Include="..\runtime\IndexingType.cpp" />
</span><span class="cx"> <ClCompile Include="..\runtime\InitializeThreading.cpp" />
</span><span class="lines">@@ -789,6 +792,7 @@
</span><span class="cx"> <ClCompile Include="..\runtime\TestRunnerUtils.cpp" />
</span><span class="cx"> <ClCompile Include="..\runtime\TypedArrayController.cpp" />
</span><span class="cx"> <ClCompile Include="..\runtime\TypedArrayType.cpp" />
</span><ins>+ <ClCompile Include="..\runtime\TypeSet.cpp" />
</ins><span class="cx"> <ClCompile Include="..\runtime\VM.cpp" />
</span><span class="cx"> <ClCompile Include="..\runtime\VMEntryScope.cpp" />
</span><span class="cx"> <ClCompile Include="..\runtime\Watchdog.cpp" />
</span><span class="lines">@@ -937,6 +941,8 @@
</span><span class="cx"> <ClInclude Include="..\bytecode\StructureSet.h" />
</span><span class="cx"> <ClInclude Include="..\bytecode\StructureStubClearingWatchpoint.h" />
</span><span class="cx"> <ClInclude Include="..\bytecode\StructureStubInfo.h" />
</span><ins>+ <ClInclude Include="..\bytecode\ToThisStatus.h" />
+ <ClInclude Include="..\bytecode\TypeLocation.h" />
</ins><span class="cx"> <ClInclude Include="..\bytecode\UnlinkedCodeBlock.h" />
</span><span class="cx"> <ClInclude Include="..\bytecode\UnlinkedInstructionStream.h" />
</span><span class="cx"> <ClInclude Include="..\bytecode\ValueProfile.h" />
</span><span class="lines">@@ -951,9 +957,9 @@
</span><span class="cx"> <ClInclude Include="..\config.h" />
</span><span class="cx"> <ClInclude Include="..\debugger\Breakpoint.h" />
</span><span class="cx"> <ClInclude Include="..\debugger\Debugger.h" />
</span><del>- <ClInclude Include="..\debugger\DebuggerActivation.h" />
</del><span class="cx"> <ClInclude Include="..\debugger\DebuggerCallFrame.h" />
</span><span class="cx"> <ClInclude Include="..\debugger\DebuggerPrimitives.h" />
</span><ins>+ <ClInclude Include="..\debugger\DebuggerScope.h" />
</ins><span class="cx"> <ClInclude Include="..\dfg\DFGAbstractHeap.h" />
</span><span class="cx"> <ClInclude Include="..\dfg\DFGAbstractInterpreter.h" />
</span><span class="cx"> <ClInclude Include="..\dfg\DFGAbstractInterpreterInlines.h" />
</span><span class="lines">@@ -1405,6 +1411,8 @@
</span><span class="cx"> <ClInclude Include="..\runtime\GenericTypedArrayView.h" />
</span><span class="cx"> <ClInclude Include="..\runtime\GenericTypedArrayViewInlines.h" />
</span><span class="cx"> <ClInclude Include="..\runtime\GetterSetter.h" />
</span><ins>+ <ClInclude Include="..\runtime\HighFidelityLog.h" />
+ <ClInclude Include="..\runtime\HighFidelityTypeProfiler.h" />
</ins><span class="cx"> <ClInclude Include="..\runtime\Identifier.h" />
</span><span class="cx"> <ClInclude Include="..\runtime\IndexingHeader.h" />
</span><span class="cx"> <ClInclude Include="..\runtime\IndexingHeaderInlines.h" />
</span><span class="lines">@@ -1561,6 +1569,7 @@
</span><span class="cx"> <ClInclude Include="..\runtime\TypedArrayController.h" />
</span><span class="cx"> <ClInclude Include="..\runtime\TypedArrayInlines.h" />
</span><span class="cx"> <ClInclude Include="..\runtime\TypedArrayType.h" />
</span><ins>+ <ClInclude Include="..\runtime\TypeSet.h" />
</ins><span class="cx"> <ClInclude Include="..\runtime\TypedArrays.h" />
</span><span class="cx"> <ClInclude Include="..\runtime\Uint16Array.h" />
</span><span class="cx"> <ClInclude Include="..\runtime\Uint16WithFraction.h" />
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreJavaScriptCorevcxprojJavaScriptCorevcxprojfilters"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters (171659 => 171660)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters 2014-07-27 21:07:24 UTC (rev 171659)
+++ trunk/Source/JavaScriptCore/JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters 2014-07-27 23:14:40 UTC (rev 171660)
</span><span class="lines">@@ -213,10 +213,10 @@
</span><span class="cx"> <ClCompile Include="..\debugger\Debugger.cpp">
</span><span class="cx"> <Filter>debugger</Filter>
</span><span class="cx"> </ClCompile>
</span><del>- <ClCompile Include="..\debugger\DebuggerActivation.cpp">
</del><ins>+ <ClCompile Include="..\debugger\DebuggerCallFrame.cpp">
</ins><span class="cx"> <Filter>debugger</Filter>
</span><span class="cx"> </ClCompile>
</span><del>- <ClCompile Include="..\debugger\DebuggerCallFrame.cpp">
</del><ins>+ <ClCompile Include="..\debugger\DebuggerScope.cpp">
</ins><span class="cx"> <Filter>debugger</Filter>
</span><span class="cx"> </ClCompile>
</span><span class="cx"> <ClCompile Include="..\disassembler\Disassembler.cpp">
</span><span class="lines">@@ -1883,15 +1883,15 @@
</span><span class="cx"> <ClInclude Include="..\debugger\Debugger.h">
</span><span class="cx"> <Filter>debugger</Filter>
</span><span class="cx"> </ClInclude>
</span><del>- <ClInclude Include="..\debugger\DebuggerActivation.h">
- <Filter>debugger</Filter>
- </ClInclude>
</del><span class="cx"> <ClInclude Include="..\debugger\DebuggerCallFrame.h">
</span><span class="cx"> <Filter>debugger</Filter>
</span><span class="cx"> </ClInclude>
</span><span class="cx"> <ClInclude Include="..\debugger\DebuggerPrimitives.h">
</span><span class="cx"> <Filter>debugger</Filter>
</span><span class="cx"> </ClInclude>
</span><ins>+ <ClInclude Include="..\debugger\DebuggerScope.h">
+ <Filter>debugger</Filter>
+ </ClInclude>
</ins><span class="cx"> <ClInclude Include="..\dfg\DFGDriver.h">
</span><span class="cx"> <Filter>dfg</Filter>
</span><span class="cx"> </ClInclude>
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreJavaScriptCorexcodeprojprojectpbxproj"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj (171659 => 171660)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj 2014-07-27 21:07:24 UTC (rev 171659)
+++ trunk/Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj 2014-07-27 23:14:40 UTC (rev 171660)
</span><span class="lines">@@ -223,6 +223,17 @@
</span><span class="cx"> 0F2BDC4D1522818600CD8910 /* DFGMinifiedNode.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F2BDC4C1522818300CD8910 /* DFGMinifiedNode.cpp */; };
</span><span class="cx"> 0F2BDC4F15228BF300CD8910 /* DFGValueSource.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F2BDC4E15228BE700CD8910 /* DFGValueSource.cpp */; };
</span><span class="cx"> 0F2BDC5115228FFD00CD8910 /* DFGVariableEvent.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F2BDC5015228FFA00CD8910 /* DFGVariableEvent.cpp */; };
</span><ins>+ 0F2D4DDD19832D34007D4B19 /* DebuggerScope.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F2D4DDB19832D34007D4B19 /* DebuggerScope.cpp */; };
+ 0F2D4DDE19832D34007D4B19 /* DebuggerScope.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F2D4DDC19832D34007D4B19 /* DebuggerScope.h */; settings = {ATTRIBUTES = (Private, ); }; };
+ 0F2D4DE819832DAC007D4B19 /* ToThisStatus.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F2D4DE519832DAC007D4B19 /* ToThisStatus.cpp */; };
+ 0F2D4DE919832DAC007D4B19 /* ToThisStatus.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F2D4DE619832DAC007D4B19 /* ToThisStatus.h */; settings = {ATTRIBUTES = (Private, ); }; };
+ 0F2D4DEA19832DAC007D4B19 /* TypeLocation.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F2D4DE719832DAC007D4B19 /* TypeLocation.h */; settings = {ATTRIBUTES = (Private, ); }; };
+ 0F2D4DEB19832DC4007D4B19 /* HighFidelityLog.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F2D4DDF19832D91007D4B19 /* HighFidelityLog.cpp */; };
+ 0F2D4DEC19832DC4007D4B19 /* HighFidelityLog.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F2D4DE019832D91007D4B19 /* HighFidelityLog.h */; settings = {ATTRIBUTES = (Private, ); }; };
+ 0F2D4DED19832DC4007D4B19 /* HighFidelityTypeProfiler.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F2D4DE119832D91007D4B19 /* HighFidelityTypeProfiler.cpp */; };
+ 0F2D4DEE19832DC4007D4B19 /* HighFidelityTypeProfiler.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F2D4DE219832D91007D4B19 /* HighFidelityTypeProfiler.h */; settings = {ATTRIBUTES = (Private, ); }; };
+ 0F2D4DEF19832DD3007D4B19 /* TypeSet.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F2D4DE319832D91007D4B19 /* TypeSet.cpp */; };
+ 0F2D4DF019832DD6007D4B19 /* TypeSet.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F2D4DE419832D91007D4B19 /* TypeSet.h */; settings = {ATTRIBUTES = (Private, ); }; };
</ins><span class="cx"> 0F2E892C16D028AD009E4FD2 /* UnusedPointer.h in Headers */ = {isa = PBXBuildFile; fileRef = 65987F2F16828A7E003C2F8D /* UnusedPointer.h */; settings = {ATTRIBUTES = (Private, ); }; };
</span><span class="cx"> 0F2E892D16D02BAF009E4FD2 /* DFGMinifiedID.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FB4B51016B3A964003F696B /* DFGMinifiedID.h */; settings = {ATTRIBUTES = (Private, ); }; };
</span><span class="cx"> 0F2FC77216E12F710038D976 /* DFGDCEPhase.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F2FC77016E12F6F0038D976 /* DFGDCEPhase.cpp */; };
</span><span class="lines">@@ -1961,8 +1972,6 @@
</span><span class="cx"> BC18C52E0E16FCE100B34460 /* Lexer.lut.h in Headers */ = {isa = PBXBuildFile; fileRef = BC18C52D0E16FCE100B34460 /* Lexer.lut.h */; };
</span><span class="cx"> BC257DE80E1F51C50016B6C9 /* Arguments.h in Headers */ = {isa = PBXBuildFile; fileRef = BC257DE60E1F51C50016B6C9 /* Arguments.h */; };
</span><span class="cx"> BC3046070E1F497F003232CF /* Error.h in Headers */ = {isa = PBXBuildFile; fileRef = BC3046060E1F497F003232CF /* Error.h */; settings = {ATTRIBUTES = (Private, ); }; };
</span><del>- BC3135640F302FA3003DFD3A /* DebuggerActivation.h in Headers */ = {isa = PBXBuildFile; fileRef = BC3135620F302FA3003DFD3A /* DebuggerActivation.h */; settings = {ATTRIBUTES = (Private, ); }; };
- BC3135650F302FA3003DFD3A /* DebuggerActivation.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BC3135630F302FA3003DFD3A /* DebuggerActivation.cpp */; };
</del><span class="cx"> BC6AAAE50E1F426500AD87D8 /* ClassInfo.h in Headers */ = {isa = PBXBuildFile; fileRef = BC6AAAE40E1F426500AD87D8 /* ClassInfo.h */; settings = {ATTRIBUTES = (Private, ); }; };
</span><span class="cx"> BC756FC90E2031B200DE7D12 /* JSGlobalObjectFunctions.h in Headers */ = {isa = PBXBuildFile; fileRef = BC756FC70E2031B200DE7D12 /* JSGlobalObjectFunctions.h */; };
</span><span class="cx"> BC87CDB910712AD4000614CF /* JSONObject.lut.h in Headers */ = {isa = PBXBuildFile; fileRef = BC87CDB810712ACA000614CF /* JSONObject.lut.h */; };
</span><span class="lines">@@ -2398,6 +2407,17 @@
</span><span class="cx"> 0F2BDC4C1522818300CD8910 /* DFGMinifiedNode.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGMinifiedNode.cpp; path = dfg/DFGMinifiedNode.cpp; sourceTree = "<group>"; };
</span><span class="cx"> 0F2BDC4E15228BE700CD8910 /* DFGValueSource.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGValueSource.cpp; path = dfg/DFGValueSource.cpp; sourceTree = "<group>"; };
</span><span class="cx"> 0F2BDC5015228FFA00CD8910 /* DFGVariableEvent.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGVariableEvent.cpp; path = dfg/DFGVariableEvent.cpp; sourceTree = "<group>"; };
</span><ins>+ 0F2D4DDB19832D34007D4B19 /* DebuggerScope.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = DebuggerScope.cpp; sourceTree = "<group>"; };
+ 0F2D4DDC19832D34007D4B19 /* DebuggerScope.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DebuggerScope.h; sourceTree = "<group>"; };
+ 0F2D4DDF19832D91007D4B19 /* HighFidelityLog.cpp */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.cpp.cpp; path = HighFidelityLog.cpp; sourceTree = "<group>"; };
+ 0F2D4DE019832D91007D4B19 /* HighFidelityLog.h */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.c.h; path = HighFidelityLog.h; sourceTree = "<group>"; };
+ 0F2D4DE119832D91007D4B19 /* HighFidelityTypeProfiler.cpp */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.cpp.cpp; path = HighFidelityTypeProfiler.cpp; sourceTree = "<group>"; };
+ 0F2D4DE219832D91007D4B19 /* HighFidelityTypeProfiler.h */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.c.h; path = HighFidelityTypeProfiler.h; sourceTree = "<group>"; };
+ 0F2D4DE319832D91007D4B19 /* TypeSet.cpp */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.cpp.cpp; path = TypeSet.cpp; sourceTree = "<group>"; };
+ 0F2D4DE419832D91007D4B19 /* TypeSet.h */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.c.h; path = TypeSet.h; sourceTree = "<group>"; };
+ 0F2D4DE519832DAC007D4B19 /* ToThisStatus.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ToThisStatus.cpp; sourceTree = "<group>"; };
+ 0F2D4DE619832DAC007D4B19 /* ToThisStatus.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ToThisStatus.h; sourceTree = "<group>"; };
+ 0F2D4DE719832DAC007D4B19 /* TypeLocation.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = TypeLocation.h; sourceTree = "<group>"; };
</ins><span class="cx"> 0F2FC77016E12F6F0038D976 /* DFGDCEPhase.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGDCEPhase.cpp; path = dfg/DFGDCEPhase.cpp; sourceTree = "<group>"; };
</span><span class="cx"> 0F2FC77116E12F6F0038D976 /* DFGDCEPhase.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGDCEPhase.h; path = dfg/DFGDCEPhase.h; sourceTree = "<group>"; };
</span><span class="cx"> 0F2FCCF218A60070001A27F8 /* DFGGraphSafepoint.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGGraphSafepoint.cpp; path = dfg/DFGGraphSafepoint.cpp; sourceTree = "<group>"; };
</span><span class="lines">@@ -3583,8 +3603,6 @@
</span><span class="cx"> BC2680C90E16D4E900A06E92 /* ObjectPrototype.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ObjectPrototype.h; sourceTree = "<group>"; };
</span><span class="cx"> BC2680E60E16D52300A06E92 /* NumberConstructor.lut.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = NumberConstructor.lut.h; sourceTree = "<group>"; };
</span><span class="cx"> BC3046060E1F497F003232CF /* Error.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = Error.h; sourceTree = "<group>"; };
</span><del>- BC3135620F302FA3003DFD3A /* DebuggerActivation.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DebuggerActivation.h; sourceTree = "<group>"; };
- BC3135630F302FA3003DFD3A /* DebuggerActivation.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = DebuggerActivation.cpp; sourceTree = "<group>"; };
</del><span class="cx"> BC337BDE0E1AF0B80076918A /* GetterSetter.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = GetterSetter.h; sourceTree = "<group>"; };
</span><span class="cx"> BC337BEA0E1B00CB0076918A /* Error.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = Error.cpp; sourceTree = "<group>"; };
</span><span class="cx"> BC6AAAE40E1F426500AD87D8 /* ClassInfo.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ClassInfo.h; sourceTree = "<group>"; };
</span><span class="lines">@@ -4426,11 +4444,11 @@
</span><span class="cx"> FEA0861E182B7A0400F6D851 /* Breakpoint.h */,
</span><span class="cx"> F692A8580255597D01FF60F7 /* Debugger.cpp */,
</span><span class="cx"> F692A8590255597D01FF60F7 /* Debugger.h */,
</span><del>- BC3135630F302FA3003DFD3A /* DebuggerActivation.cpp */,
- BC3135620F302FA3003DFD3A /* DebuggerActivation.h */,
</del><span class="cx"> 149559ED0DDCDDF700648087 /* DebuggerCallFrame.cpp */,
</span><span class="cx"> 1480DB9B0DDC227F003CFDF2 /* DebuggerCallFrame.h */,
</span><span class="cx"> FEA0861F182B7A0400F6D851 /* DebuggerPrimitives.h */,
</span><ins>+ 0F2D4DDB19832D34007D4B19 /* DebuggerScope.cpp */,
+ 0F2D4DDC19832D34007D4B19 /* DebuggerScope.h */,
</ins><span class="cx"> );
</span><span class="cx"> path = debugger;
</span><span class="cx"> sourceTree = "<group>";
</span><span class="lines">@@ -4559,8 +4577,6 @@
</span><span class="cx"> 7EF6E0BB0EB7A1EC0079AFAF /* runtime */ = {
</span><span class="cx"> isa = PBXGroup;
</span><span class="cx"> children = (
</span><del>- 9E72940A190F0514001A91B5 /* BundlePath.h */,
- 9E729409190F0306001A91B5 /* BundlePath.mm */,
</del><span class="cx"> BCF605110E203EF800B9A64D /* ArgList.cpp */,
</span><span class="cx"> BCF605120E203EF800B9A64D /* ArgList.h */,
</span><span class="cx"> BC257DE50E1F51C50016B6C9 /* Arguments.cpp */,
</span><span class="lines">@@ -4594,6 +4610,8 @@
</span><span class="cx"> 704FD35305697E6D003DBED9 /* BooleanObject.h */,
</span><span class="cx"> BC7952340E15EB5600A898AB /* BooleanPrototype.cpp */,
</span><span class="cx"> BC7952350E15EB5600A898AB /* BooleanPrototype.h */,
</span><ins>+ 9E72940A190F0514001A91B5 /* BundlePath.h */,
+ 9E729409190F0306001A91B5 /* BundlePath.mm */,
</ins><span class="cx"> 0FB7F38B15ED8E3800F167B2 /* Butterfly.h */,
</span><span class="cx"> 0FB7F38C15ED8E3800F167B2 /* ButterflyInlines.h */,
</span><span class="cx"> BCA62DFE0E2826230004F30D /* CallData.cpp */,
</span><span class="lines">@@ -4665,6 +4683,10 @@
</span><span class="cx"> 0F2B66B317B6B5AB00A7AE3F /* GenericTypedArrayViewInlines.h */,
</span><span class="cx"> BC02E9B80E184545000F9297 /* GetterSetter.cpp */,
</span><span class="cx"> BC337BDE0E1AF0B80076918A /* GetterSetter.h */,
</span><ins>+ 0F2D4DDF19832D91007D4B19 /* HighFidelityLog.cpp */,
+ 0F2D4DE019832D91007D4B19 /* HighFidelityLog.h */,
+ 0F2D4DE119832D91007D4B19 /* HighFidelityTypeProfiler.cpp */,
+ 0F2D4DE219832D91007D4B19 /* HighFidelityTypeProfiler.h */,
</ins><span class="cx"> 933A349D038AE80F008635CE /* Identifier.cpp */,
</span><span class="cx"> 933A349A038AE7C6008635CE /* Identifier.h */,
</span><span class="cx"> 8606DDE918DA44AB00A383D0 /* IdentifierInlines.h */,
</span><span class="lines">@@ -4674,9 +4696,9 @@
</span><span class="cx"> 0FB7F38F15ED8E3800F167B2 /* IndexingType.h */,
</span><span class="cx"> E178636C0D9BEEC300D74E75 /* InitializeThreading.cpp */,
</span><span class="cx"> E178633F0D9BEC0000D74E75 /* InitializeThreading.h */,
</span><del>- A7A8AF2B17ADB5F3005AB174 /* Int8Array.h */,
</del><span class="cx"> A7A8AF2C17ADB5F3005AB174 /* Int16Array.h */,
</span><span class="cx"> A7A8AF2D17ADB5F3005AB174 /* Int32Array.h */,
</span><ins>+ A7A8AF2B17ADB5F3005AB174 /* Int8Array.h */,
</ins><span class="cx"> A78853F717972629001440E4 /* IntendedStructureChain.cpp */,
</span><span class="cx"> A78853F817972629001440E4 /* IntendedStructureChain.h */,
</span><span class="cx"> BC9BB95B0E19680600DF8855 /* InternalFunction.cpp */,
</span><span class="lines">@@ -4735,9 +4757,9 @@
</span><span class="cx"> A59455911824744700CC3843 /* JSGlobalObjectDebuggable.h */,
</span><span class="cx"> BC756FC60E2031B200DE7D12 /* JSGlobalObjectFunctions.cpp */,
</span><span class="cx"> BC756FC70E2031B200DE7D12 /* JSGlobalObjectFunctions.h */,
</span><del>- 0F2B66C917B6B5AB00A7AE3F /* JSInt8Array.h */,
</del><span class="cx"> 0F2B66CA17B6B5AB00A7AE3F /* JSInt16Array.h */,
</span><span class="cx"> 0F2B66CB17B6B5AB00A7AE3F /* JSInt32Array.h */,
</span><ins>+ 0F2B66C917B6B5AB00A7AE3F /* JSInt8Array.h */,
</ins><span class="cx"> 65EA4C99092AF9E20093D800 /* JSLock.cpp */,
</span><span class="cx"> 65EA4C9A092AF9E20093D800 /* JSLock.h */,
</span><span class="cx"> A700873F17CBE8EB00C3E643 /* JSMap.cpp */,
</span><span class="lines">@@ -4791,10 +4813,10 @@
</span><span class="cx"> 0F2B66D017B6B5AB00A7AE3F /* JSTypedArrays.cpp */,
</span><span class="cx"> 0F2B66D117B6B5AB00A7AE3F /* JSTypedArrays.h */,
</span><span class="cx"> 6507D2970E871E4A00D7D896 /* JSTypeInfo.h */,
</span><ins>+ 0F2B66D417B6B5AB00A7AE3F /* JSUint16Array.h */,
+ 0F2B66D517B6B5AB00A7AE3F /* JSUint32Array.h */,
</ins><span class="cx"> 0F2B66D217B6B5AB00A7AE3F /* JSUint8Array.h */,
</span><span class="cx"> 0F2B66D317B6B5AB00A7AE3F /* JSUint8ClampedArray.h */,
</span><del>- 0F2B66D417B6B5AB00A7AE3F /* JSUint16Array.h */,
- 0F2B66D517B6B5AB00A7AE3F /* JSUint32Array.h */,
</del><span class="cx"> BC22A39A0E16E14800AF21C8 /* JSVariableObject.cpp */,
</span><span class="cx"> 14F252560D08DD8D004ECFFF /* JSVariableObject.h */,
</span><span class="cx"> A7CA3AE117DA41AE006538AF /* JSWeakMap.cpp */,
</span><span class="lines">@@ -4936,11 +4958,13 @@
</span><span class="cx"> 0F2B66DB17B6B5AB00A7AE3F /* TypedArrays.h */,
</span><span class="cx"> 0F2B66DC17B6B5AB00A7AE3F /* TypedArrayType.cpp */,
</span><span class="cx"> 0F2B66DD17B6B5AB00A7AE3F /* TypedArrayType.h */,
</span><del>- A7A8AF3017ADB5F3005AB174 /* Uint8Array.h */,
- A7A8AF3117ADB5F3005AB174 /* Uint8ClampedArray.h */,
</del><ins>+ 0F2D4DE319832D91007D4B19 /* TypeSet.cpp */,
+ 0F2D4DE419832D91007D4B19 /* TypeSet.h */,
</ins><span class="cx"> A7A8AF3217ADB5F3005AB174 /* Uint16Array.h */,
</span><span class="cx"> 866739D113BFDE710023D87C /* Uint16WithFraction.h */,
</span><span class="cx"> A7A8AF3317ADB5F3005AB174 /* Uint32Array.h */,
</span><ins>+ A7A8AF3017ADB5F3005AB174 /* Uint8Array.h */,
+ A7A8AF3117ADB5F3005AB174 /* Uint8ClampedArray.h */,
</ins><span class="cx"> E18E3A570DF9278C00D90B34 /* VM.cpp */,
</span><span class="cx"> E18E3A560DF9278C00D90B34 /* VM.h */,
</span><span class="cx"> FE5932A5183C5A2600A1ECCC /* VMEntryScope.cpp */,
</span><span class="lines">@@ -5443,6 +5467,9 @@
</span><span class="cx"> 0F766D3715AE4A1A008F363E /* StructureStubClearingWatchpoint.h */,
</span><span class="cx"> BCCF0D0B0EF0B8A500413C8F /* StructureStubInfo.cpp */,
</span><span class="cx"> BCCF0D070EF0AAB900413C8F /* StructureStubInfo.h */,
</span><ins>+ 0F2D4DE519832DAC007D4B19 /* ToThisStatus.cpp */,
+ 0F2D4DE619832DAC007D4B19 /* ToThisStatus.h */,
+ 0F2D4DE719832DAC007D4B19 /* TypeLocation.h */,
</ins><span class="cx"> A79E781E15EECBA80047C855 /* UnlinkedCodeBlock.cpp */,
</span><span class="cx"> A79E781F15EECBA80047C855 /* UnlinkedCodeBlock.h */,
</span><span class="cx"> B59F89381891ADB500D5CCDC /* UnlinkedInstructionStream.cpp */,
</span><span class="lines">@@ -6019,7 +6046,6 @@
</span><span class="cx"> BCD2034C0E17135E002C7E82 /* DatePrototype.h in Headers */,
</span><span class="cx"> BCD203E80E1718F4002C7E82 /* DatePrototype.lut.h in Headers */,
</span><span class="cx"> BC18C3FA0E16F5CD00B34460 /* Debugger.h in Headers */,
</span><del>- BC3135640F302FA3003DFD3A /* DebuggerActivation.h in Headers */,
</del><span class="cx"> BC18C3FB0E16F5CD00B34460 /* DebuggerCallFrame.h in Headers */,
</span><span class="cx"> FEA08621182B7A0400F6D851 /* DebuggerPrimitives.h in Headers */,
</span><span class="cx"> 0F136D4D174AD69E0075B354 /* DeferGC.h in Headers */,
</span><span class="lines">@@ -6260,6 +6286,7 @@
</span><span class="cx"> C283190016FE4B7D00157BFD /* HandleBlock.h in Headers */,
</span><span class="cx"> C283190216FE533E00157BFD /* HandleBlockInlines.h in Headers */,
</span><span class="cx"> 0F0B83A914BCF56200885B4F /* HandlerInfo.h in Headers */,
</span><ins>+ 0F2D4DEC19832DC4007D4B19 /* HighFidelityLog.h in Headers */,
</ins><span class="cx"> 142E3136134FF0A600AFADB5 /* HandleSet.h in Headers */,
</span><span class="cx"> 142E3138134FF0A600AFADB5 /* HandleStack.h in Headers */,
</span><span class="cx"> 1478297B1379E8A800A7C2A3 /* HandleTypes.h in Headers */,
</span><span class="lines">@@ -6300,6 +6327,7 @@
</span><span class="cx"> A53243981856A489002ED692 /* InspectorJS.json in Headers */,
</span><span class="cx"> A532438818568335002ED692 /* InspectorJSBackendDispatchers.h in Headers */,
</span><span class="cx"> A532438A18568335002ED692 /* InspectorJSFrontendDispatchers.h in Headers */,
</span><ins>+ 0F2D4DEE19832DC4007D4B19 /* HighFidelityTypeProfiler.h in Headers */,
</ins><span class="cx"> 8606DDEA18DA44AB00A383D0 /* IdentifierInlines.h in Headers */,
</span><span class="cx"> A532438C18568335002ED692 /* InspectorJSTypeBuilders.h in Headers */,
</span><span class="cx"> A50E4B6218809DD50068A46D /* InspectorRuntimeAgent.h in Headers */,
</span><span class="lines">@@ -6350,6 +6378,7 @@
</span><span class="cx"> 0F2B66EA17B6B5AB00A7AE3F /* JSArrayBufferViewInlines.h in Headers */,
</span><span class="cx"> A7BDAECB17F4EA1400F6140C /* JSArrayIterator.h in Headers */,
</span><span class="cx"> BC18C4180E16F5CD00B34460 /* JSBase.h in Headers */,
</span><ins>+ 0F2D4DE919832DAC007D4B19 /* ToThisStatus.h in Headers */,
</ins><span class="cx"> 140D17D70E8AD4A9000CD17D /* JSBasePrivate.h in Headers */,
</span><span class="cx"> 86FA9E92142BBB2E001773B7 /* JSBoundFunction.h in Headers */,
</span><span class="cx"> BC18C4190E16F5CD00B34460 /* JSCallbackConstructor.h in Headers */,
</span><span class="lines">@@ -6445,6 +6474,7 @@
</span><span class="cx"> 6507D29E0E871E5E00D7D896 /* JSTypeInfo.h in Headers */,
</span><span class="cx"> 0F2B670217B6B5AB00A7AE3F /* JSUint16Array.h in Headers */,
</span><span class="cx"> 0F2B670317B6B5AB00A7AE3F /* JSUint32Array.h in Headers */,
</span><ins>+ 0F2D4DF019832DD6007D4B19 /* TypeSet.h in Headers */,
</ins><span class="cx"> 0F2B670017B6B5AB00A7AE3F /* JSUint8Array.h in Headers */,
</span><span class="cx"> 0F2B670117B6B5AB00A7AE3F /* JSUint8ClampedArray.h in Headers */,
</span><span class="cx"> 86E3C612167BABD7006D760A /* JSValue.h in Headers */,
</span><span class="lines">@@ -6544,6 +6574,7 @@
</span><span class="cx"> 969A079B0ED1D3AE00F1F681 /* Opcode.h in Headers */,
</span><span class="cx"> 0F2BDC2C151FDE9100CD8910 /* Operands.h in Headers */,
</span><span class="cx"> A70447EA17A0BD4600F5898E /* OperandsInlines.h in Headers */,
</span><ins>+ 0F2D4DDE19832D34007D4B19 /* DebuggerScope.h in Headers */,
</ins><span class="cx"> BC18C4480E16F5CD00B34460 /* Operations.h in Headers */,
</span><span class="cx"> 0FE228ED1436AB2700196C48 /* Options.h in Headers */,
</span><span class="cx"> BC18C44B0E16F5CD00B34460 /* Parser.h in Headers */,
</span><span class="lines">@@ -6608,6 +6639,7 @@
</span><span class="cx"> 0F50AF3C193E8B3900674EE8 /* DFGStructureClobberState.h in Headers */,
</span><span class="cx"> A57D23EE1891B5540031C7FA /* RegularExpression.h in Headers */,
</span><span class="cx"> 0FB7F39D15ED8E4600F167B2 /* Reject.h in Headers */,
</span><ins>+ 0F2D4DEA19832DAC007D4B19 /* TypeLocation.h in Headers */,
</ins><span class="cx"> A5BA15E8182340B300A82E69 /* RemoteInspector.h in Headers */,
</span><span class="cx"> A5BA15EA182340B400A82E69 /* RemoteInspectorConstants.h in Headers */,
</span><span class="cx"> A5BA15F0182345AF00A82E69 /* RemoteInspectorDebuggable.h in Headers */,
</span><span class="lines">@@ -7622,7 +7654,6 @@
</span><span class="cx"> 147F39C5107EC37600427A48 /* DateInstance.cpp in Sources */,
</span><span class="cx"> 147F39C6107EC37600427A48 /* DatePrototype.cpp in Sources */,
</span><span class="cx"> 14280823107EC02C0013E7B2 /* Debugger.cpp in Sources */,
</span><del>- BC3135650F302FA3003DFD3A /* DebuggerActivation.cpp in Sources */,
</del><span class="cx"> 149559EE0DDCDDF700648087 /* DebuggerCallFrame.cpp in Sources */,
</span><span class="cx"> 2A7A58EF1808A4C40020BDF7 /* DeferGC.cpp in Sources */,
</span><span class="cx"> 0FC712DE17CD8779008CC93C /* DeferredCompilationCallback.cpp in Sources */,
</span><span class="lines">@@ -7630,7 +7661,9 @@
</span><span class="cx"> 0F55C19417276E4600CEABFD /* DFGAbstractValue.cpp in Sources */,
</span><span class="cx"> 0F16015D156198C900C2587C /* DFGArgumentsSimplificationPhase.cpp in Sources */,
</span><span class="cx"> 0F485321187750560083B687 /* DFGArithMode.cpp in Sources */,
</span><ins>+ 0F2D4DDD19832D34007D4B19 /* DebuggerScope.cpp in Sources */,
</ins><span class="cx"> 0F63948415E48118006A597C /* DFGArrayMode.cpp in Sources */,
</span><ins>+ 0F2D4DED19832DC4007D4B19 /* HighFidelityTypeProfiler.cpp in Sources */,
</ins><span class="cx"> A7D9A29417A0BC7400EE2618 /* DFGAtTailAbstractState.cpp in Sources */,
</span><span class="cx"> 0F666EC61835672B00D017F1 /* DFGAvailability.cpp in Sources */,
</span><span class="cx"> 0F714CA416EA92F000F3EBEB /* DFGBackwardsPropagationPhase.cpp in Sources */,
</span><span class="lines">@@ -7750,6 +7783,7 @@
</span><span class="cx"> A7B48F490EE8936F00DCBDB6 /* ExecutableAllocator.cpp in Sources */,
</span><span class="cx"> 86DB64640F95C6FC00D7D921 /* ExecutableAllocatorFixedVMPool.cpp in Sources */,
</span><span class="cx"> 0F56A1D515001CF4002992B1 /* ExecutionCounter.cpp in Sources */,
</span><ins>+ 0F2D4DEB19832DC4007D4B19 /* HighFidelityLog.cpp in Sources */,
</ins><span class="cx"> 0F0332C018ADFAE1005F979A /* ExitingJITType.cpp in Sources */,
</span><span class="cx"> 0FB105851675480F00F8AB6E /* ExitKind.cpp in Sources */,
</span><span class="cx"> 0FEA0A1C1708B00700BB722C /* FTLAbstractHeap.cpp in Sources */,
</span><span class="lines">@@ -7877,6 +7911,7 @@
</span><span class="cx"> A72028B61797601E0098028C /* JSCTestRunnerUtils.cpp in Sources */,
</span><span class="cx"> 0F2B66EB17B6B5AB00A7AE3F /* JSDataView.cpp in Sources */,
</span><span class="cx"> 0F2B66ED17B6B5AB00A7AE3F /* JSDataViewPrototype.cpp in Sources */,
</span><ins>+ 0F2D4DE819832DAC007D4B19 /* ToThisStatus.cpp in Sources */,
</ins><span class="cx"> 978801401471AD920041B016 /* JSDateMath.cpp in Sources */,
</span><span class="cx"> 140566D6107EC271005DBC8D /* JSFunction.cpp in Sources */,
</span><span class="cx"> 147F39D2107EC37600427A48 /* JSGlobalObject.cpp in Sources */,
</span><span class="lines">@@ -8066,6 +8101,7 @@
</span><span class="cx"> 14469DEB107EC7E700650446 /* StringConstructor.cpp in Sources */,
</span><span class="cx"> 14469DEC107EC7E700650446 /* StringObject.cpp in Sources */,
</span><span class="cx"> 14469DED107EC7E700650446 /* StringPrototype.cpp in Sources */,
</span><ins>+ 0F2D4DEF19832DD3007D4B19 /* TypeSet.cpp in Sources */,
</ins><span class="cx"> 9335F24D12E6765B002B5553 /* StringRecursionChecker.cpp in Sources */,
</span><span class="cx"> BCDE3B430E6C832D001453A7 /* Structure.cpp in Sources */,
</span><span class="cx"> 7E4EE70F0EBB7A5B005934AA /* StructureChain.cpp in Sources */,
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorebytecodeBytecodeListjson"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/bytecode/BytecodeList.json (171659 => 171660)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/bytecode/BytecodeList.json 2014-07-27 21:07:24 UTC (rev 171659)
+++ trunk/Source/JavaScriptCore/bytecode/BytecodeList.json 2014-07-27 23:14:40 UTC (rev 171660)
</span><span class="lines">@@ -10,7 +10,7 @@
</span><span class="cx"> { "name" : "op_create_arguments", "length" : 2 },
</span><span class="cx"> { "name" : "op_create_this", "length" : 4 },
</span><span class="cx"> { "name" : "op_get_callee", "length" : 3 },
</span><del>- { "name" : "op_to_this", "length" : 3 },
</del><ins>+ { "name" : "op_to_this", "length" : 4 },
</ins><span class="cx"> { "name" : "op_new_object", "length" : 4 },
</span><span class="cx"> { "name" : "op_new_array", "length" : 5 },
</span><span class="cx"> { "name" : "op_new_array_with_size", "length" : 4 },
</span><span class="lines">@@ -113,6 +113,7 @@
</span><span class="cx"> { "name" : "op_resolve_scope", "length" : 6 },
</span><span class="cx"> { "name" : "op_get_from_scope", "length" : 8 },
</span><span class="cx"> { "name" : "op_put_to_scope", "length" : 7 },
</span><ins>+ { "name" : "op_put_to_scope_with_profile", "length" : 8 },
</ins><span class="cx"> { "name" : "op_push_with_scope", "length" : 2 },
</span><span class="cx"> { "name" : "op_pop_scope", "length" : 1 },
</span><span class="cx"> { "name" : "op_push_name_scope", "length" : 4 },
</span><span class="lines">@@ -122,7 +123,8 @@
</span><span class="cx"> { "name" : "op_debug", "length" : 3 },
</span><span class="cx"> { "name" : "op_profile_will_call", "length" : 2 },
</span><span class="cx"> { "name" : "op_profile_did_call", "length" : 2 },
</span><del>- { "name" : "op_end", "length" : 2 }
</del><ins>+ { "name" : "op_end", "length" : 2 },
+ { "name" : "op_profile_types_with_high_fidelity", "length" : 4 }
</ins><span class="cx"> ]
</span><span class="cx"> },
</span><span class="cx"> {
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorebytecodeBytecodeUseDefh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/bytecode/BytecodeUseDef.h (171659 => 171660)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/bytecode/BytecodeUseDef.h 2014-07-27 21:07:24 UTC (rev 171659)
+++ trunk/Source/JavaScriptCore/bytecode/BytecodeUseDef.h 2014-07-27 23:14:40 UTC (rev 171660)
</span><span class="lines">@@ -65,6 +65,7 @@
</span><span class="cx"> case op_tear_off_activation:
</span><span class="cx"> case op_profile_will_call:
</span><span class="cx"> case op_profile_did_call:
</span><ins>+ case op_profile_types_with_high_fidelity:
</ins><span class="cx"> case op_throw:
</span><span class="cx"> case op_push_with_scope:
</span><span class="cx"> case op_end:
</span><span class="lines">@@ -105,6 +106,7 @@
</span><span class="cx"> case op_put_by_id_transition_normal_out_of_line:
</span><span class="cx"> case op_put_by_id_out_of_line:
</span><span class="cx"> case op_put_by_id:
</span><ins>+ case op_put_to_scope_with_profile:
</ins><span class="cx"> case op_put_to_scope: {
</span><span class="cx"> functor(codeBlock, instruction, opcodeID, instruction[1].u.operand);
</span><span class="cx"> functor(codeBlock, instruction, opcodeID, instruction[3].u.operand);
</span><span class="lines">@@ -249,6 +251,7 @@
</span><span class="cx"> case op_push_name_scope:
</span><span class="cx"> case op_push_with_scope:
</span><span class="cx"> case op_put_to_scope:
</span><ins>+ case op_put_to_scope_with_profile:
</ins><span class="cx"> case op_pop_scope:
</span><span class="cx"> case op_end:
</span><span class="cx"> case op_profile_will_call:
</span><span class="lines">@@ -287,6 +290,7 @@
</span><span class="cx"> case op_put_by_val_direct:
</span><span class="cx"> case op_put_by_index:
</span><span class="cx"> case op_tear_off_arguments:
</span><ins>+ case op_profile_types_with_high_fidelity:
</ins><span class="cx"> case op_touch_entry:
</span><span class="cx"> #define LLINT_HELPER_OPCODES(opcode, length) case opcode:
</span><span class="cx"> FOR_EACH_LLINT_OPCODE_EXTENSION(LLINT_HELPER_OPCODES);
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorebytecodeCodeBlockcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/bytecode/CodeBlock.cpp (171659 => 171660)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/bytecode/CodeBlock.cpp 2014-07-27 21:07:24 UTC (rev 171659)
+++ trunk/Source/JavaScriptCore/bytecode/CodeBlock.cpp 2014-07-27 23:14:40 UTC (rev 171660)
</span><span class="lines">@@ -39,6 +39,7 @@
</span><span class="cx"> #include "DFGJITCode.h"
</span><span class="cx"> #include "DFGWorklist.h"
</span><span class="cx"> #include "Debugger.h"
</span><ins>+#include "HighFidelityTypeProfiler.h"
</ins><span class="cx"> #include "Interpreter.h"
</span><span class="cx"> #include "JIT.h"
</span><span class="cx"> #include "JITStubs.h"
</span><span class="lines">@@ -47,6 +48,7 @@
</span><span class="cx"> #include "JSFunction.h"
</span><span class="cx"> #include "JSNameScope.h"
</span><span class="cx"> #include "LLIntEntrypoint.h"
</span><ins>+#include "TypeLocation.h"
</ins><span class="cx"> #include "LowLevelInterpreter.h"
</span><span class="cx"> #include "JSCInlines.h"
</span><span class="cx"> #include "PolymorphicGetByIdList.h"
</span><span class="lines">@@ -295,7 +297,6 @@
</span><span class="cx"> out.printf(" (offset = %d)", offset);
</span><span class="cx"> }
</span><span class="cx">
</span><del>-#if ENABLE(JIT) // unused when not ENABLE(JIT), leading to silly warnings
</del><span class="cx"> static void dumpChain(PrintStream& out, ExecState* exec, StructureChain* chain, const Identifier& ident)
</span><span class="cx"> {
</span><span class="cx"> out.printf("chain = %p: [", chain);
</span><span class="lines">@@ -311,7 +312,6 @@
</span><span class="cx"> }
</span><span class="cx"> out.printf("]");
</span><span class="cx"> }
</span><del>-#endif
</del><span class="cx">
</span><span class="cx"> void CodeBlock::printGetByIdCacheStatus(PrintStream& out, ExecState* exec, int location, const StubInfoMap& map)
</span><span class="cx"> {
</span><span class="lines">@@ -398,6 +398,118 @@
</span><span class="cx"> #endif
</span><span class="cx"> }
</span><span class="cx">
</span><ins>+void CodeBlock::printPutByIdCacheStatus(PrintStream& out, ExecState* exec, int location, const StubInfoMap& map)
+{
+ Instruction* instruction = instructions().begin() + location;
+
+ const Identifier& ident = identifier(instruction[2].u.operand);
+
+ UNUSED_PARAM(ident); // tell the compiler to shut up in certain platform configurations.
+
+ if (Structure* structure = instruction[4].u.structure.get()) {
+ switch (exec->interpreter()->getOpcodeID(instruction[0].u.opcode)) {
+ case op_put_by_id:
+ case op_put_by_id_out_of_line:
+ out.print(" llint(");
+ dumpStructure(out, "struct", exec, structure, ident);
+ out.print(")");
+ break;
+
+ case op_put_by_id_transition_direct:
+ case op_put_by_id_transition_normal:
+ case op_put_by_id_transition_direct_out_of_line:
+ case op_put_by_id_transition_normal_out_of_line:
+ out.print(" llint(");
+ dumpStructure(out, "prev", exec, structure, ident);
+ out.print(", ");
+ dumpStructure(out, "next", exec, instruction[6].u.structure.get(), ident);
+ if (StructureChain* chain = instruction[7].u.structureChain.get()) {
+ out.print(", ");
+ dumpChain(out, exec, chain, ident);
+ }
+ out.print(")");
+ break;
+
+ default:
+ out.print(" llint(unknown)");
+ break;
+ }
+ }
+
+#if ENABLE(JIT)
+ if (StructureStubInfo* stubPtr = map.get(CodeOrigin(location))) {
+ StructureStubInfo& stubInfo = *stubPtr;
+ if (stubInfo.resetByGC)
+ out.print(" (Reset By GC)");
+
+ if (stubInfo.seen) {
+ out.printf(" jit(");
+
+ switch (stubInfo.accessType) {
+ case access_put_by_id_replace:
+ out.print("replace, ");
+ dumpStructure(out, "struct", exec, stubInfo.u.putByIdReplace.baseObjectStructure.get(), ident);
+ break;
+ case access_put_by_id_transition_normal:
+ case access_put_by_id_transition_direct:
+ out.print("transition, ");
+ dumpStructure(out, "prev", exec, stubInfo.u.putByIdTransition.previousStructure.get(), ident);
+ out.print(", ");
+ dumpStructure(out, "next", exec, stubInfo.u.putByIdTransition.structure.get(), ident);
+ if (StructureChain* chain = stubInfo.u.putByIdTransition.chain.get()) {
+ out.print(", ");
+ dumpChain(out, exec, chain, ident);
+ }
+ break;
+ case access_put_by_id_list: {
+ out.printf("list = [");
+ PolymorphicPutByIdList* list = stubInfo.u.putByIdList.list;
+ CommaPrinter comma;
+ for (unsigned i = 0; i < list->size(); ++i) {
+ out.print(comma, "(");
+ const PutByIdAccess& access = list->at(i);
+
+ if (access.isReplace()) {
+ out.print("replace, ");
+ dumpStructure(out, "struct", exec, access.oldStructure(), ident);
+ } else if (access.isSetter()) {
+ out.print("setter, ");
+ dumpStructure(out, "struct", exec, access.oldStructure(), ident);
+ } else if (access.isCustom()) {
+ out.print("custom, ");
+ dumpStructure(out, "struct", exec, access.oldStructure(), ident);
+ } else if (access.isTransition()) {
+ out.print("transition, ");
+ dumpStructure(out, "prev", exec, access.oldStructure(), ident);
+ out.print(", ");
+ dumpStructure(out, "next", exec, access.newStructure(), ident);
+ if (access.chain()) {
+ out.print(", ");
+ dumpChain(out, exec, access.chain(), ident);
+ }
+ } else
+ out.print("unknown");
+
+ out.print(")");
+ }
+ out.print("]");
+ break;
+ }
+ case access_unset:
+ out.printf("unset");
+ break;
+ default:
+ RELEASE_ASSERT_NOT_REACHED();
+ break;
+ }
+ out.printf(")");
+ }
+ }
+#else
+ UNUSED_PARAM(map);
+#endif
+}
+
</ins><span class="cx"> void CodeBlock::printCallOp(PrintStream& out, ExecState* exec, int location, const Instruction*& it, const char* op, CacheDumpMode cacheDumpMode, bool& hasPrintedProfiling, const CallLinkInfoMap& map)
</span><span class="cx"> {
</span><span class="cx"> int dst = (++it)->u.operand;
</span><span class="lines">@@ -660,6 +772,7 @@
</span><span class="cx"> Structure* structure = (++it)->u.structure.get();
</span><span class="cx"> if (structure)
</span><span class="cx"> out.print(" cache(struct = ", RawPointer(structure), ")");
</span><ins>+ out.print(" ", (++it)->u.toThisStatus);
</ins><span class="cx"> break;
</span><span class="cx"> }
</span><span class="cx"> case op_new_object: {
</span><span class="lines">@@ -722,6 +835,14 @@
</span><span class="cx"> ++it;
</span><span class="cx"> break;
</span><span class="cx"> }
</span><ins>+ case op_profile_types_with_high_fidelity: {
+ int r0 = (++it)->u.operand;
+ ++it;
+ ++it;
+ printLocationAndOp(out, exec, location, it, "op_profile_types_with_high_fidelity");
+ out.printf("%s", registerName(r0).data());
+ break;
+ }
</ins><span class="cx"> case op_not: {
</span><span class="cx"> printUnaryOp(out, exec, location, it, "not");
</span><span class="cx"> break;
</span><span class="lines">@@ -920,26 +1041,32 @@
</span><span class="cx"> }
</span><span class="cx"> case op_put_by_id: {
</span><span class="cx"> printPutByIdOp(out, exec, location, it, "put_by_id");
</span><ins>+ printPutByIdCacheStatus(out, exec, location, stubInfos);
</ins><span class="cx"> break;
</span><span class="cx"> }
</span><span class="cx"> case op_put_by_id_out_of_line: {
</span><span class="cx"> printPutByIdOp(out, exec, location, it, "put_by_id_out_of_line");
</span><ins>+ printPutByIdCacheStatus(out, exec, location, stubInfos);
</ins><span class="cx"> break;
</span><span class="cx"> }
</span><span class="cx"> case op_put_by_id_transition_direct: {
</span><span class="cx"> printPutByIdOp(out, exec, location, it, "put_by_id_transition_direct");
</span><ins>+ printPutByIdCacheStatus(out, exec, location, stubInfos);
</ins><span class="cx"> break;
</span><span class="cx"> }
</span><span class="cx"> case op_put_by_id_transition_direct_out_of_line: {
</span><span class="cx"> printPutByIdOp(out, exec, location, it, "put_by_id_transition_direct_out_of_line");
</span><ins>+ printPutByIdCacheStatus(out, exec, location, stubInfos);
</ins><span class="cx"> break;
</span><span class="cx"> }
</span><span class="cx"> case op_put_by_id_transition_normal: {
</span><span class="cx"> printPutByIdOp(out, exec, location, it, "put_by_id_transition_normal");
</span><ins>+ printPutByIdCacheStatus(out, exec, location, stubInfos);
</ins><span class="cx"> break;
</span><span class="cx"> }
</span><span class="cx"> case op_put_by_id_transition_normal_out_of_line: {
</span><span class="cx"> printPutByIdOp(out, exec, location, it, "put_by_id_transition_normal_out_of_line");
</span><ins>+ printPutByIdCacheStatus(out, exec, location, stubInfos);
</ins><span class="cx"> break;
</span><span class="cx"> }
</span><span class="cx"> case op_put_getter_setter: {
</span><span class="lines">@@ -1342,6 +1469,7 @@
</span><span class="cx"> operand);
</span><span class="cx"> break;
</span><span class="cx"> }
</span><ins>+ case op_put_to_scope_with_profile:
</ins><span class="cx"> case op_put_to_scope: {
</span><span class="cx"> int r0 = (++it)->u.operand;
</span><span class="cx"> int id0 = (++it)->u.operand;
</span><span class="lines">@@ -1350,6 +1478,8 @@
</span><span class="cx"> ++it; // Structure
</span><span class="cx"> int operand = (++it)->u.operand; // Operand
</span><span class="cx"> printLocationAndOp(out, exec, location, it, "put_to_scope");
</span><ins>+ if (opcode == op_put_to_scope_with_profile)
+ ++it;
</ins><span class="cx"> out.printf("%s, %s, %s, %u<%s|%s>, <structure>, %d",
</span><span class="cx"> registerName(r0).data(), idName(id0, identifier(id0)).data(), registerName(r1).data(),
</span><span class="cx"> modeAndType.operand(), resolveModeName(modeAndType.mode()), resolveTypeName(modeAndType.type()),
</span><span class="lines">@@ -1747,6 +1877,7 @@
</span><span class="cx"> break;
</span><span class="cx"> }
</span><span class="cx">
</span><ins>+ case op_put_to_scope_with_profile:
</ins><span class="cx"> case op_put_to_scope: {
</span><span class="cx"> // put_to_scope scope, id, value, ResolveModeAndType, Structure, Operand
</span><span class="cx"> const Identifier& ident = identifier(pc[2].u.operand);
</span><span class="lines">@@ -1762,9 +1893,68 @@
</span><span class="cx"> } else if (op.structure)
</span><span class="cx"> instructions[i + 5].u.structure.set(*vm(), ownerExecutable, op.structure);
</span><span class="cx"> instructions[i + 6].u.pointer = reinterpret_cast<void*>(op.operand);
</span><ins>+
+ if (pc[0].u.opcode == op_put_to_scope_with_profile) {
+ // The format of this instruction is: put_to_scope_with_profile scope, id, value, ResolveModeAndType, Structure, Operand, TypeLocation*
+ TypeLocation* location = vm()->nextLocation();
+ size_t instructionOffset = i + opLength - 1;
+ int divot, startOffset, endOffset;
+ unsigned line = 0, column = 0;
+ expressionRangeForBytecodeOffset(instructionOffset, divot, startOffset, endOffset, line, column);
+
+ location->m_line = line;
+ location->m_column = column;
+ location->m_sourceID = m_ownerExecutable->sourceID();
+
+ // FIXME: handle other values for op.type here, and also consider what to do when we can't statically determine the globalID
+ SymbolTable* symbolTable = 0;
+ if (op.type == ClosureVar)
+ symbolTable = op.activation->symbolTable();
+ else if (op.type == GlobalVar)
+ symbolTable = m_globalObject.get()->symbolTable();
+
+ if (symbolTable) {
+ ConcurrentJITLocker locker(symbolTable->m_lock);
+ location->m_globalVariableID = symbolTable->uniqueIDForVariable(locker, ident.impl(), *vm());
+ location->m_globalTypeSet =symbolTable->globalTypeSetForVariable(locker, ident.impl(), *vm());
+ } else
+ location->m_globalVariableID = HighFidelityNoGlobalIDExists;
+
+ vm()->highFidelityTypeProfiler()->insertNewLocation(location);
+ instructions[i + 7].u.location = location;
+ }
</ins><span class="cx"> break;
</span><span class="cx"> }
</span><ins>+
+ case op_profile_types_with_high_fidelity: {
+
+ VirtualRegister virtualRegister(pc[1].u.operand);
+ SymbolTable* symbolTable = m_symbolTable.get();
+ TypeLocation* location = vm()->nextLocation();
+ size_t instructionOffset = i + opLength - 1;
+ int divot, startOffset, endOffset;
+ unsigned line = 0, column = 0;
+ expressionRangeForBytecodeOffset(instructionOffset, divot, startOffset, endOffset, line, column);
+
+ int hasGlobalIDFlag = pc[3].u.operand;
+ if (hasGlobalIDFlag) {
+ ConcurrentJITLocker locker(symbolTable->m_lock);
+ location->m_globalVariableID = symbolTable->uniqueIDForRegister(locker, virtualRegister.offset(), *vm());
+ location->m_globalTypeSet = symbolTable->globalTypeSetForRegister(locker, virtualRegister.offset(), *vm());
+ } else
+ location->m_globalVariableID = HighFidelityNoGlobalIDExists;
</ins><span class="cx">
</span><ins>+
+ location->m_line = line;
+ location->m_column = column;
+ location->m_sourceID = m_ownerExecutable->sourceID();
+
+ vm()->highFidelityTypeProfiler()->insertNewLocation(location);
+ instructions[i + 2].u.location = location;
+ break;
+ }
+
+
</ins><span class="cx"> case op_captured_mov:
</span><span class="cx"> case op_new_captured_func: {
</span><span class="cx"> if (pc[3].u.index == UINT_MAX) {
</span><span class="lines">@@ -2185,6 +2375,8 @@
</span><span class="cx"> if (Options::verboseOSR())
</span><span class="cx"> dataLogF("Clearing LLInt to_this with structure %p.\n", curInstruction[2].u.structure.get());
</span><span class="cx"> curInstruction[2].u.structure.clear();
</span><ins>+ curInstruction[3].u.toThisStatus = merge(
+ curInstruction[3].u.toThisStatus, ToThisClearedByGC);
</ins><span class="cx"> break;
</span><span class="cx"> case op_get_callee:
</span><span class="cx"> if (!curInstruction[2].u.jsCell || Heap::isMarked(curInstruction[2].u.jsCell.get()))
</span><span class="lines">@@ -2203,6 +2395,7 @@
</span><span class="cx"> break;
</span><span class="cx"> }
</span><span class="cx"> case op_get_from_scope:
</span><ins>+ case op_put_to_scope_with_profile:
</ins><span class="cx"> case op_put_to_scope: {
</span><span class="cx"> ResolveModeAndType modeAndType =
</span><span class="cx"> ResolveModeAndType(curInstruction[4].u.operand);
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorebytecodeCodeBlockh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/bytecode/CodeBlock.h (171659 => 171660)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/bytecode/CodeBlock.h 2014-07-27 21:07:24 UTC (rev 171659)
+++ trunk/Source/JavaScriptCore/bytecode/CodeBlock.h 2014-07-27 23:14:40 UTC (rev 171660)
</span><span class="lines">@@ -941,6 +941,7 @@
</span><span class="cx">
</span><span class="cx"> bool isKnownToBeLiveDuringGC(); // Will only return valid results when called during GC. Assumes that you've already established that the owner executable is live.
</span><span class="cx">
</span><ins>+
</ins><span class="cx"> protected:
</span><span class="cx"> virtual void visitWeakReferences(SlotVisitor&) override;
</span><span class="cx"> virtual void finalizeUnconditionally() override;
</span><span class="lines">@@ -987,6 +988,7 @@
</span><span class="cx"> enum CacheDumpMode { DumpCaches, DontDumpCaches };
</span><span class="cx"> void printCallOp(PrintStream&, ExecState*, int location, const Instruction*&, const char* op, CacheDumpMode, bool& hasPrintedProfiling, const CallLinkInfoMap&);
</span><span class="cx"> void printPutByIdOp(PrintStream&, ExecState*, int location, const Instruction*&, const char* op);
</span><ins>+ void printPutByIdCacheStatus(PrintStream&, ExecState*, int location, const StubInfoMap&);
</ins><span class="cx"> void printLocationAndOp(PrintStream&, ExecState*, int location, const Instruction*&, const char* op);
</span><span class="cx"> void printLocationOpAndRegisterOperand(PrintStream&, ExecState*, int location, const Instruction*& it, const char* op, int operand);
</span><span class="cx">
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorebytecodeGetByIdStatuscpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/bytecode/GetByIdStatus.cpp (171659 => 171660)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/bytecode/GetByIdStatus.cpp 2014-07-27 21:07:24 UTC (rev 171659)
+++ trunk/Source/JavaScriptCore/bytecode/GetByIdStatus.cpp 2014-07-27 23:14:40 UTC (rev 171660)
</span><span class="lines">@@ -166,7 +166,8 @@
</span><span class="cx">
</span><span class="cx"> variant.m_structureSet.add(structure);
</span><span class="cx"> variant.m_specificValue = JSValue(specificValue);
</span><del>- result.appendVariant(variant);
</del><ins>+ bool didAppend = result.appendVariant(variant);
+ ASSERT_UNUSED(didAppend, didAppend);
</ins><span class="cx"> return result;
</span><span class="cx"> }
</span><span class="cx">
</span><span class="lines">@@ -310,34 +311,43 @@
</span><span class="cx"> return computeFor(profiledBlock, baselineMap, codeOrigin.bytecodeIndex, uid);
</span><span class="cx"> }
</span><span class="cx">
</span><del>-GetByIdStatus GetByIdStatus::computeFor(VM& vm, Structure* structure, StringImpl* uid)
</del><ins>+GetByIdStatus GetByIdStatus::computeFor(VM& vm, const StructureSet& set, StringImpl* uid)
</ins><span class="cx"> {
</span><span class="cx"> // For now we only handle the super simple self access case. We could handle the
</span><span class="cx"> // prototype case in the future.
</span><span class="cx">
</span><del>- if (!structure)
- return GetByIdStatus(TakesSlowPath);
</del><ins>+ if (set.isEmpty())
+ return GetByIdStatus();
</ins><span class="cx">
</span><span class="cx"> if (toUInt32FromStringImpl(uid) != PropertyName::NotAnIndex)
</span><span class="cx"> return GetByIdStatus(TakesSlowPath);
</span><span class="cx">
</span><del>- if (structure->typeInfo().overridesGetOwnPropertySlot() && structure->typeInfo().type() != GlobalObjectType)
- return GetByIdStatus(TakesSlowPath);
</del><ins>+ GetByIdStatus result;
+ result.m_state = Simple;
+ result.m_wasSeenInJIT = false;
+ for (unsigned i = 0; i < set.size(); ++i) {
+ Structure* structure = set[i];
+ if (structure->typeInfo().overridesGetOwnPropertySlot() && structure->typeInfo().type() != GlobalObjectType)
+ return GetByIdStatus(TakesSlowPath);
+
+ if (!structure->propertyAccessesAreCacheable())
+ return GetByIdStatus(TakesSlowPath);
+
+ unsigned attributes;
+ JSCell* specificValue;
+ PropertyOffset offset = structure->getConcurrently(vm, uid, attributes, specificValue);
+ if (!isValidOffset(offset))
+ return GetByIdStatus(TakesSlowPath); // It's probably a prototype lookup. Give up on life for now, even though we could totally be way smarter about it.
+ if (attributes & Accessor)
+ return GetByIdStatus(MakesCalls); // We could be smarter here, like strenght-reducing this to a Call.
+ if (structure->isDictionary())
+ specificValue = 0;
+
+ if (!result.appendVariant(GetByIdVariant(structure, offset, specificValue)))
+ return GetByIdStatus(TakesSlowPath);
+ }
</ins><span class="cx">
</span><del>- if (!structure->propertyAccessesAreCacheable())
- return GetByIdStatus(TakesSlowPath);
-
- unsigned attributes;
- JSCell* specificValue;
- PropertyOffset offset = structure->getConcurrently(vm, uid, attributes, specificValue);
- if (!isValidOffset(offset))
- return GetByIdStatus(TakesSlowPath); // It's probably a prototype lookup. Give up on life for now, even though we could totally be way smarter about it.
- if (attributes & Accessor)
- return GetByIdStatus(MakesCalls);
- if (structure->isDictionary())
- specificValue = 0;
- return GetByIdStatus(
- Simple, false, GetByIdVariant(StructureSet(structure), offset, specificValue));
</del><ins>+ return result;
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> bool GetByIdStatus::makesCalls() const
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorebytecodeGetByIdStatush"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/bytecode/GetByIdStatus.h (171659 => 171660)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/bytecode/GetByIdStatus.h 2014-07-27 21:07:24 UTC (rev 171659)
+++ trunk/Source/JavaScriptCore/bytecode/GetByIdStatus.h 2014-07-27 23:14:40 UTC (rev 171660)
</span><span class="lines">@@ -68,7 +68,7 @@
</span><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> static GetByIdStatus computeFor(CodeBlock*, StubInfoMap&, unsigned bytecodeIndex, StringImpl* uid);
</span><del>- static GetByIdStatus computeFor(VM&, Structure*, StringImpl* uid);
</del><ins>+ static GetByIdStatus computeFor(VM&, const StructureSet&, StringImpl* uid);
</ins><span class="cx">
</span><span class="cx"> static GetByIdStatus computeFor(CodeBlock* baselineBlock, CodeBlock* dfgBlock, StubInfoMap& baselineMap, StubInfoMap& dfgMap, CodeOrigin, StringImpl* uid);
</span><span class="cx">
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorebytecodeGetByIdVariantcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/bytecode/GetByIdVariant.cpp (171659 => 171660)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/bytecode/GetByIdVariant.cpp 2014-07-27 21:07:24 UTC (rev 171659)
+++ trunk/Source/JavaScriptCore/bytecode/GetByIdVariant.cpp 2014-07-27 23:14:40 UTC (rev 171660)
</span><span class="lines">@@ -108,12 +108,14 @@
</span><span class="cx">
</span><span class="cx"> out.print(
</span><span class="cx"> "<", inContext(structureSet(), context), ", ",
</span><del>- "[", listDumpInContext(m_constantChecks, context), "], ",
- "alternateBase = ", inContext(JSValue(m_alternateBase), context), ", ",
- "specificValue = ", inContext(specificValue(), context), ", ",
- "offset = ", offset());
</del><ins>+ "[", listDumpInContext(m_constantChecks, context), "]");
+ if (m_alternateBase)
+ out.print(", alternateBase = ", inContext(JSValue(m_alternateBase), context));
+ if (specificValue())
+ out.print(", specificValue = ", inContext(specificValue(), context));
+ out.print(", offset = ", offset());
</ins><span class="cx"> if (m_callLinkStatus)
</span><del>- out.print("call = ", *m_callLinkStatus);
</del><ins>+ out.print(", call = ", *m_callLinkStatus);
</ins><span class="cx"> out.print(">");
</span><span class="cx"> }
</span><span class="cx">
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorebytecodeGetByIdVarianth"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/bytecode/GetByIdVariant.h (171659 => 171660)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/bytecode/GetByIdVariant.h 2014-07-27 21:07:24 UTC (rev 171659)
+++ trunk/Source/JavaScriptCore/bytecode/GetByIdVariant.h 2014-07-27 23:14:40 UTC (rev 171660)
</span><span class="lines">@@ -55,6 +55,7 @@
</span><span class="cx"> bool isSet() const { return !!m_structureSet.size(); }
</span><span class="cx"> bool operator!() const { return !isSet(); }
</span><span class="cx"> const StructureSet& structureSet() const { return m_structureSet; }
</span><ins>+ StructureSet& structureSet() { return m_structureSet; }
</ins><span class="cx"> const ConstantStructureCheckVector& constantChecks() const { return m_constantChecks; }
</span><span class="cx"> JSObject* alternateBase() const { return m_alternateBase; }
</span><span class="cx"> JSValue specificValue() const { return m_specificValue; }
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorebytecodeInstructionh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/bytecode/Instruction.h (171659 => 171660)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/bytecode/Instruction.h 2014-07-27 21:07:24 UTC (rev 171659)
+++ trunk/Source/JavaScriptCore/bytecode/Instruction.h 2014-07-27 23:14:40 UTC (rev 171660)
</span><span class="lines">@@ -1,5 +1,5 @@
</span><span class="cx"> /*
</span><del>- * Copyright (C) 2008, 2012, 2013 Apple Inc. All rights reserved.
</del><ins>+ * Copyright (C) 2008, 2012, 2013, 2014 Apple Inc. All rights reserved.
</ins><span class="cx"> *
</span><span class="cx"> * Redistribution and use in source and binary forms, with or without
</span><span class="cx"> * modification, are permitted provided that the following conditions
</span><span class="lines">@@ -31,10 +31,12 @@
</span><span class="cx">
</span><span class="cx"> #include "MacroAssembler.h"
</span><span class="cx"> #include "Opcode.h"
</span><ins>+#include "TypeLocation.h"
</ins><span class="cx"> #include "PropertySlot.h"
</span><span class="cx"> #include "SpecialPointer.h"
</span><span class="cx"> #include "Structure.h"
</span><span class="cx"> #include "StructureChain.h"
</span><ins>+#include "ToThisStatus.h"
</ins><span class="cx"> #include "VirtualRegister.h"
</span><span class="cx"> #include <wtf/VectorTraits.h>
</span><span class="cx">
</span><span class="lines">@@ -118,6 +120,8 @@
</span><span class="cx"> WriteBarrierBase<JSActivation> activation;
</span><span class="cx"> void* pointer;
</span><span class="cx"> bool* predicatePointer;
</span><ins>+ ToThisStatus toThisStatus;
+ TypeLocation* location;
</ins><span class="cx"> } u;
</span><span class="cx">
</span><span class="cx"> private:
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorebytecodePutByIdStatuscpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/bytecode/PutByIdStatus.cpp (171659 => 171660)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/bytecode/PutByIdStatus.cpp 2014-07-27 21:07:24 UTC (rev 171659)
+++ trunk/Source/JavaScriptCore/bytecode/PutByIdStatus.cpp 2014-07-27 23:14:40 UTC (rev 171660)
</span><span class="lines">@@ -40,7 +40,11 @@
</span><span class="cx"> bool PutByIdStatus::appendVariant(const PutByIdVariant& variant)
</span><span class="cx"> {
</span><span class="cx"> for (unsigned i = 0; i < m_variants.size(); ++i) {
</span><del>- if (m_variants[i].oldStructure() == variant.oldStructure())
</del><ins>+ if (m_variants[i].attemptToMerge(variant))
+ return true;
+ }
+ for (unsigned i = 0; i < m_variants.size(); ++i) {
+ if (m_variants[i].oldStructure().overlaps(variant.oldStructure()))
</ins><span class="cx"> return false;
</span><span class="cx"> }
</span><span class="cx"> m_variants.append(variant);
</span><span class="lines">@@ -190,11 +194,15 @@
</span><span class="cx"> access.newStructure()->getConcurrently(*profiledBlock->vm(), uid);
</span><span class="cx"> if (!isValidOffset(offset))
</span><span class="cx"> return PutByIdStatus(TakesSlowPath);
</span><ins>+ RefPtr<IntendedStructureChain> chain;
+ if (access.chain()) {
+ chain = adoptRef(new IntendedStructureChain(
+ profiledBlock, access.oldStructure(), access.chain()));
+ if (!chain->isStillValid())
+ continue;
+ }
</ins><span class="cx"> bool ok = result.appendVariant(PutByIdVariant::transition(
</span><del>- access.oldStructure(), access.newStructure(),
- access.chain() ? adoptRef(new IntendedStructureChain(
- profiledBlock, access.oldStructure(), access.chain())) : 0,
- offset));
</del><ins>+ access.oldStructure(), access.newStructure(), chain.get(), offset));
</ins><span class="cx"> if (!ok)
</span><span class="cx"> return PutByIdStatus(TakesSlowPath);
</span><span class="cx"> break;
</span><span class="lines">@@ -247,88 +255,101 @@
</span><span class="cx"> return computeFor(baselineBlock, baselineMap, codeOrigin.bytecodeIndex, uid);
</span><span class="cx"> }
</span><span class="cx">
</span><del>-PutByIdStatus PutByIdStatus::computeFor(VM& vm, JSGlobalObject* globalObject, Structure* structure, StringImpl* uid, bool isDirect)
</del><ins>+PutByIdStatus PutByIdStatus::computeFor(VM& vm, JSGlobalObject* globalObject, const StructureSet& set, StringImpl* uid, bool isDirect)
</ins><span class="cx"> {
</span><span class="cx"> if (toUInt32FromStringImpl(uid) != PropertyName::NotAnIndex)
</span><span class="cx"> return PutByIdStatus(TakesSlowPath);
</span><span class="cx">
</span><del>- if (!structure)
- return PutByIdStatus(TakesSlowPath);
</del><ins>+ if (set.isEmpty())
+ return PutByIdStatus();
</ins><span class="cx">
</span><del>- if (structure->typeInfo().overridesGetOwnPropertySlot() && structure->typeInfo().type() != GlobalObjectType)
- return PutByIdStatus(TakesSlowPath);
</del><ins>+ PutByIdStatus result;
+ result.m_state = Simple;
+ for (unsigned i = 0; i < set.size(); ++i) {
+ Structure* structure = set[i];
+
+ if (structure->typeInfo().overridesGetOwnPropertySlot() && structure->typeInfo().type() != GlobalObjectType)
+ return PutByIdStatus(TakesSlowPath);
</ins><span class="cx">
</span><del>- if (!structure->propertyAccessesAreCacheable())
- return PutByIdStatus(TakesSlowPath);
</del><ins>+ if (!structure->propertyAccessesAreCacheable())
+ return PutByIdStatus(TakesSlowPath);
</ins><span class="cx">
</span><del>- unsigned attributes;
- JSCell* specificValue;
- PropertyOffset offset = structure->getConcurrently(vm, uid, attributes, specificValue);
- if (isValidOffset(offset)) {
- if (attributes & CustomAccessor)
- return PutByIdStatus(MakesCalls);
</del><ins>+ unsigned attributes;
+ JSCell* specificValue;
+ PropertyOffset offset = structure->getConcurrently(vm, uid, attributes, specificValue);
+ if (isValidOffset(offset)) {
+ if (attributes & CustomAccessor)
+ return PutByIdStatus(MakesCalls);
</ins><span class="cx">
</span><del>- if (attributes & (Accessor | ReadOnly))
- return PutByIdStatus(TakesSlowPath);
- if (specificValue) {
- // We need the PutById slow path to verify that we're storing the right value into
- // the specialized slot.
- return PutByIdStatus(TakesSlowPath);
</del><ins>+ if (attributes & (Accessor | ReadOnly))
+ return PutByIdStatus(TakesSlowPath);
+ if (specificValue) {
+ // We need the PutById slow path to verify that we're storing the right value into
+ // the specialized slot.
+ return PutByIdStatus(TakesSlowPath);
+ }
+ if (!result.appendVariant(PutByIdVariant::replace(structure, offset)))
+ return PutByIdStatus(TakesSlowPath);
+ continue;
</ins><span class="cx"> }
</span><del>- return PutByIdVariant::replace(structure, offset);
- }
</del><span class="cx">
</span><del>- // Our hypothesis is that we're doing a transition. Before we prove that this is really
- // true, we want to do some sanity checks.
</del><ins>+ // Our hypothesis is that we're doing a transition. Before we prove that this is really
+ // true, we want to do some sanity checks.
</ins><span class="cx">
</span><del>- // Don't cache put transitions on dictionaries.
- if (structure->isDictionary())
- return PutByIdStatus(TakesSlowPath);
</del><ins>+ // Don't cache put transitions on dictionaries.
+ if (structure->isDictionary())
+ return PutByIdStatus(TakesSlowPath);
</ins><span class="cx">
</span><del>- // If the structure corresponds to something that isn't an object, then give up, since
- // we don't want to be adding properties to strings.
- if (structure->typeInfo().type() == StringType)
- return PutByIdStatus(TakesSlowPath);
</del><ins>+ // If the structure corresponds to something that isn't an object, then give up, since
+ // we don't want to be adding properties to strings.
+ if (structure->typeInfo().type() == StringType)
+ return PutByIdStatus(TakesSlowPath);
</ins><span class="cx">
</span><del>- RefPtr<IntendedStructureChain> chain;
- if (!isDirect) {
- chain = adoptRef(new IntendedStructureChain(globalObject, structure));
</del><ins>+ RefPtr<IntendedStructureChain> chain;
+ if (!isDirect) {
+ chain = adoptRef(new IntendedStructureChain(globalObject, structure));
</ins><span class="cx">
</span><del>- // If the prototype chain has setters or read-only properties, then give up.
- if (chain->mayInterceptStoreTo(vm, uid))
- return PutByIdStatus(TakesSlowPath);
</del><ins>+ // If the prototype chain has setters or read-only properties, then give up.
+ if (chain->mayInterceptStoreTo(vm, uid))
+ return PutByIdStatus(TakesSlowPath);
</ins><span class="cx">
</span><del>- // If the prototype chain hasn't been normalized (i.e. there are proxies or dictionaries)
- // then give up. The dictionary case would only happen if this structure has not been
- // used in an optimized put_by_id transition. And really the only reason why we would
- // bail here is that I don't really feel like having the optimizing JIT go and flatten
- // dictionaries if we have evidence to suggest that those objects were never used as
- // prototypes in a cacheable prototype access - i.e. there's a good chance that some of
- // the other checks below will fail.
- if (structure->isProxy() || !chain->isNormalized())
</del><ins>+ // If the prototype chain hasn't been normalized (i.e. there are proxies or dictionaries)
+ // then give up. The dictionary case would only happen if this structure has not been
+ // used in an optimized put_by_id transition. And really the only reason why we would
+ // bail here is that I don't really feel like having the optimizing JIT go and flatten
+ // dictionaries if we have evidence to suggest that those objects were never used as
+ // prototypes in a cacheable prototype access - i.e. there's a good chance that some of
+ // the other checks below will fail.
+ if (structure->isProxy() || !chain->isNormalized())
+ return PutByIdStatus(TakesSlowPath);
+ }
+
+ // We only optimize if there is already a structure that the transition is cached to.
+ // Among other things, this allows us to guard against a transition with a specific
+ // value.
+ //
+ // - If we're storing a value that could be specific: this would only be a problem if
+ // the existing transition did have a specific value already, since if it didn't,
+ // then we would behave "as if" we were not storing a specific value. If it did
+ // have a specific value, then we'll know - the fact that we pass 0 for
+ // specificValue will tell us.
+ //
+ // - If we're not storing a value that could be specific: again, this would only be a
+ // problem if the existing transition did have a specific value, which we check for
+ // by passing 0 for the specificValue.
+ Structure* transition = Structure::addPropertyTransitionToExistingStructureConcurrently(structure, uid, 0, 0, offset);
+ if (!transition)
+ return PutByIdStatus(TakesSlowPath); // This occurs in bizarre cases only. See above.
+ ASSERT(!transition->transitionDidInvolveSpecificValue());
+ ASSERT(isValidOffset(offset));
+
+ bool didAppend = result.appendVariant(
+ PutByIdVariant::transition(structure, transition, chain.release(), offset));
+ if (!didAppend)
</ins><span class="cx"> return PutByIdStatus(TakesSlowPath);
</span><span class="cx"> }
</span><span class="cx">
</span><del>- // We only optimize if there is already a structure that the transition is cached to.
- // Among other things, this allows us to guard against a transition with a specific
- // value.
- //
- // - If we're storing a value that could be specific: this would only be a problem if
- // the existing transition did have a specific value already, since if it didn't,
- // then we would behave "as if" we were not storing a specific value. If it did
- // have a specific value, then we'll know - the fact that we pass 0 for
- // specificValue will tell us.
- //
- // - If we're not storing a value that could be specific: again, this would only be a
- // problem if the existing transition did have a specific value, which we check for
- // by passing 0 for the specificValue.
- Structure* transition = Structure::addPropertyTransitionToExistingStructureConcurrently(structure, uid, 0, 0, offset);
- if (!transition)
- return PutByIdStatus(TakesSlowPath); // This occurs in bizarre cases only. See above.
- ASSERT(!transition->transitionDidInvolveSpecificValue());
- ASSERT(isValidOffset(offset));
-
- return PutByIdVariant::transition(structure, transition, chain.release(), offset);
</del><ins>+ return result;
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> void PutByIdStatus::dump(PrintStream& out) const
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorebytecodePutByIdStatush"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/bytecode/PutByIdStatus.h (171659 => 171660)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/bytecode/PutByIdStatus.h 2014-07-27 21:07:24 UTC (rev 171659)
+++ trunk/Source/JavaScriptCore/bytecode/PutByIdStatus.h 2014-07-27 23:14:40 UTC (rev 171660)
</span><span class="lines">@@ -70,7 +70,7 @@
</span><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> static PutByIdStatus computeFor(CodeBlock*, StubInfoMap&, unsigned bytecodeIndex, StringImpl* uid);
</span><del>- static PutByIdStatus computeFor(VM&, JSGlobalObject*, Structure*, StringImpl* uid, bool isDirect);
</del><ins>+ static PutByIdStatus computeFor(VM&, JSGlobalObject*, const StructureSet&, StringImpl* uid, bool isDirect);
</ins><span class="cx">
</span><span class="cx"> static PutByIdStatus computeFor(CodeBlock* baselineBlock, CodeBlock* dfgBlock, StubInfoMap& baselineMap, StubInfoMap& dfgMap, CodeOrigin, StringImpl* uid);
</span><span class="cx">
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorebytecodePutByIdVariantcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/bytecode/PutByIdVariant.cpp (171659 => 171660)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/bytecode/PutByIdVariant.cpp 2014-07-27 21:07:24 UTC (rev 171659)
+++ trunk/Source/JavaScriptCore/bytecode/PutByIdVariant.cpp 2014-07-27 23:14:40 UTC (rev 171660)
</span><span class="lines">@@ -30,6 +30,99 @@
</span><span class="cx">
</span><span class="cx"> namespace JSC {
</span><span class="cx">
</span><ins>+Structure* PutByIdVariant::oldStructureForTransition() const
+{
+ ASSERT(kind() == Transition);
+ ASSERT(m_oldStructure.size() <= 2);
+ for (unsigned i = m_oldStructure.size(); i--;) {
+ Structure* structure = m_oldStructure[i];
+ if (structure != m_newStructure)
+ return structure;
+ }
+ RELEASE_ASSERT_NOT_REACHED();
+}
+
+bool PutByIdVariant::writesStructures() const
+{
+ return kind() == Transition;
+}
+
+bool PutByIdVariant::reallocatesStorage() const
+{
+ if (kind() != Transition)
+ return false;
+
+ if (oldStructureForTransition()->outOfLineCapacity() == newStructure()->outOfLineCapacity())
+ return false;
+
+ return true;
+}
+
+bool PutByIdVariant::attemptToMerge(const PutByIdVariant& other)
+{
+ if (m_offset != other.m_offset)
+ return false;
+
+ switch (m_kind) {
+ case Replace:
+ switch (other.m_kind) {
+ case Replace: {
+ ASSERT(m_constantChecks.isEmpty());
+ ASSERT(other.m_constantChecks.isEmpty());
+
+ m_oldStructure.merge(other.m_oldStructure);
+ return true;
+ }
+
+ case Transition: {
+ PutByIdVariant newVariant = other;
+ if (newVariant.attemptToMergeTransitionWithReplace(*this)) {
+ *this = newVariant;
+ return true;
+ }
+ return false;
+ }
+
+ default:
+ return false;
+ }
+
+ case Transition:
+ switch (other.m_kind) {
+ case Replace:
+ return attemptToMergeTransitionWithReplace(other);
+
+ default:
+ return false;
+ }
+
+ default:
+ return false;
+ }
+}
+
+bool PutByIdVariant::attemptToMergeTransitionWithReplace(const PutByIdVariant& replace)
+{
+ ASSERT(m_kind == Transition);
+ ASSERT(replace.m_kind == Replace);
+ ASSERT(m_offset == replace.m_offset);
+ ASSERT(!replace.writesStructures());
+ ASSERT(!replace.reallocatesStorage());
+
+ // This sort of merging only works when we have one path along which we add a new field which
+ // transitions to structure S while the other path was already on structure S. This doesn't
+ // work if we need to reallocate anything or if the replace path is polymorphic.
+
+ if (reallocatesStorage())
+ return false;
+
+ if (replace.m_oldStructure.onlyStructure() != m_newStructure)
+ return false;
+
+ m_oldStructure.merge(m_newStructure);
+ return true;
+}
+
</ins><span class="cx"> void PutByIdVariant::dump(PrintStream& out) const
</span><span class="cx"> {
</span><span class="cx"> dumpInContext(out, 0);
</span><span class="lines">@@ -44,12 +137,12 @@
</span><span class="cx">
</span><span class="cx"> case Replace:
</span><span class="cx"> out.print(
</span><del>- "<Replace: ", pointerDumpInContext(structure(), context), ", ", offset(), ">");
</del><ins>+ "<Replace: ", inContext(structure(), context), ", ", offset(), ">");
</ins><span class="cx"> return;
</span><span class="cx">
</span><span class="cx"> case Transition:
</span><span class="cx"> out.print(
</span><del>- "<Transition: ", pointerDumpInContext(oldStructure(), context), " -> ",
</del><ins>+ "<Transition: ", inContext(oldStructure(), context), " -> ",
</ins><span class="cx"> pointerDumpInContext(newStructure(), context), ", [",
</span><span class="cx"> listDumpInContext(constantChecks(), context), "], ", offset(), ">");
</span><span class="cx"> return;
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorebytecodePutByIdVarianth"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/bytecode/PutByIdVariant.h (171659 => 171660)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/bytecode/PutByIdVariant.h 2014-07-27 21:07:24 UTC (rev 171659)
+++ trunk/Source/JavaScriptCore/bytecode/PutByIdVariant.h 2014-07-27 23:14:40 UTC (rev 171660)
</span><span class="lines">@@ -28,6 +28,7 @@
</span><span class="cx">
</span><span class="cx"> #include "IntendedStructureChain.h"
</span><span class="cx"> #include "PropertyOffset.h"
</span><ins>+#include "StructureSet.h"
</ins><span class="cx">
</span><span class="cx"> namespace JSC {
</span><span class="cx">
</span><span class="lines">@@ -41,13 +42,12 @@
</span><span class="cx">
</span><span class="cx"> PutByIdVariant()
</span><span class="cx"> : m_kind(NotSet)
</span><del>- , m_oldStructure(0)
- , m_newStructure(0)
</del><ins>+ , m_newStructure(nullptr)
</ins><span class="cx"> , m_offset(invalidOffset)
</span><span class="cx"> {
</span><span class="cx"> }
</span><span class="cx">
</span><del>- static PutByIdVariant replace(Structure* structure, PropertyOffset offset)
</del><ins>+ static PutByIdVariant replace(const StructureSet& structure, PropertyOffset offset)
</ins><span class="cx"> {
</span><span class="cx"> PutByIdVariant result;
</span><span class="cx"> result.m_kind = Replace;
</span><span class="lines">@@ -57,7 +57,7 @@
</span><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> static PutByIdVariant transition(
</span><del>- Structure* oldStructure, Structure* newStructure,
</del><ins>+ const StructureSet& oldStructure, Structure* newStructure,
</ins><span class="cx"> PassRefPtr<IntendedStructureChain> structureChain, PropertyOffset offset)
</span><span class="cx"> {
</span><span class="cx"> PutByIdVariant result;
</span><span class="lines">@@ -75,27 +75,37 @@
</span><span class="cx"> bool isSet() const { return kind() != NotSet; }
</span><span class="cx"> bool operator!() const { return !isSet(); }
</span><span class="cx">
</span><del>- Structure* structure() const
</del><ins>+ const StructureSet& structure() const
</ins><span class="cx"> {
</span><span class="cx"> ASSERT(kind() == Replace);
</span><span class="cx"> return m_oldStructure;
</span><span class="cx"> }
</span><span class="cx">
</span><del>- Structure* oldStructure() const
</del><ins>+ const StructureSet& oldStructure() const
</ins><span class="cx"> {
</span><span class="cx"> ASSERT(kind() == Transition || kind() == Replace);
</span><span class="cx"> return m_oldStructure;
</span><span class="cx"> }
</span><span class="cx">
</span><ins>+ StructureSet& oldStructure()
+ {
+ ASSERT(kind() == Transition || kind() == Replace);
+ return m_oldStructure;
+ }
+
+ Structure* oldStructureForTransition() const;
+
</ins><span class="cx"> Structure* newStructure() const
</span><span class="cx"> {
</span><span class="cx"> ASSERT(kind() == Transition);
</span><span class="cx"> return m_newStructure;
</span><span class="cx"> }
</span><ins>+
+ bool writesStructures() const;
+ bool reallocatesStorage() const;
</ins><span class="cx">
</span><span class="cx"> const ConstantStructureCheckVector& constantChecks() const
</span><span class="cx"> {
</span><del>- ASSERT(kind() == Transition);
</del><span class="cx"> return m_constantChecks;
</span><span class="cx"> }
</span><span class="cx">
</span><span class="lines">@@ -105,12 +115,16 @@
</span><span class="cx"> return m_offset;
</span><span class="cx"> }
</span><span class="cx">
</span><ins>+ bool attemptToMerge(const PutByIdVariant& other);
+
</ins><span class="cx"> void dump(PrintStream&) const;
</span><span class="cx"> void dumpInContext(PrintStream&, DumpContext*) const;
</span><span class="cx">
</span><span class="cx"> private:
</span><ins>+ bool attemptToMergeTransitionWithReplace(const PutByIdVariant& replace);
+
</ins><span class="cx"> Kind m_kind;
</span><del>- Structure* m_oldStructure;
</del><ins>+ StructureSet m_oldStructure;
</ins><span class="cx"> Structure* m_newStructure;
</span><span class="cx"> ConstantStructureCheckVector m_constantChecks;
</span><span class="cx"> PropertyOffset m_offset;
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorebytecodeStructureSetcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/bytecode/StructureSet.cpp (171659 => 171660)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/bytecode/StructureSet.cpp 2014-07-27 21:07:24 UTC (rev 171659)
+++ trunk/Source/JavaScriptCore/bytecode/StructureSet.cpp 2014-07-27 23:14:40 UTC (rev 171660)
</span><span class="lines">@@ -26,6 +26,7 @@
</span><span class="cx"> #include "config.h"
</span><span class="cx"> #include "StructureSet.h"
</span><span class="cx">
</span><ins>+#include "DFGAbstractValue.h"
</ins><span class="cx"> #include <wtf/CommaPrinter.h>
</span><span class="cx">
</span><span class="cx"> namespace JSC {
</span><span class="lines">@@ -160,6 +161,84 @@
</span><span class="cx"> clear();
</span><span class="cx"> }
</span><span class="cx">
</span><ins>+#if ENABLE(DFG_JIT)
+
+namespace {
+
+class StructureAbstractValueContains {
+public:
+ StructureAbstractValueContains(const DFG::StructureAbstractValue& value)
+ : m_value(value)
+ {
+ }
+
+ bool operator()(Structure* structure)
+ {
+ return m_value.contains(structure);
+ }
+private:
+ const DFG::StructureAbstractValue& m_value;
+};
+
+class SpeculatedTypeContains {
+public:
+ SpeculatedTypeContains(SpeculatedType type)
+ : m_type(type)
+ {
+ }
+
+ bool operator()(Structure* structure)
+ {
+ return m_type & speculationFromStructure(structure);
+ }
+private:
+ SpeculatedType m_type;
+};
+
+class ArrayModesContains {
+public:
+ ArrayModesContains(ArrayModes arrayModes)
+ : m_arrayModes(arrayModes)
+ {
+ }
+
+ bool operator()(Structure* structure)
+ {
+ return m_arrayModes & arrayModeFromStructure(structure);
+ }
+private:
+ ArrayModes m_arrayModes;
+};
+
+} // anonymous namespace
+
+void StructureSet::filter(const DFG::StructureAbstractValue& other)
+{
+ StructureAbstractValueContains functor(other);
+ genericFilter(functor);
+}
+
+void StructureSet::filter(SpeculatedType type)
+{
+ SpeculatedTypeContains functor(type);
+ genericFilter(functor);
+}
+
+void StructureSet::filterArrayModes(ArrayModes arrayModes)
+{
+ ArrayModesContains functor(arrayModes);
+ genericFilter(functor);
+}
+
+void StructureSet::filter(const DFG::AbstractValue& other)
+{
+ filter(other.m_structure);
+ filter(other.m_type);
+ filterArrayModes(other.m_arrayModes);
+}
+
+#endif // ENABLE(DFG_JIT)
+
</ins><span class="cx"> bool StructureSet::isSubsetOf(const StructureSet& other) const
</span><span class="cx"> {
</span><span class="cx"> if (isThin()) {
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorebytecodeStructureSeth"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/bytecode/StructureSet.h (171659 => 171660)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/bytecode/StructureSet.h 2014-07-27 21:07:24 UTC (rev 171659)
+++ trunk/Source/JavaScriptCore/bytecode/StructureSet.h 2014-07-27 23:14:40 UTC (rev 171660)
</span><span class="lines">@@ -35,6 +35,7 @@
</span><span class="cx">
</span><span class="cx"> namespace DFG {
</span><span class="cx"> class StructureAbstractValue;
</span><ins>+struct AbstractValue;
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> class StructureSet {
</span><span class="lines">@@ -72,12 +73,12 @@
</span><span class="cx">
</span><span class="cx"> Structure* onlyStructure() const
</span><span class="cx"> {
</span><del>- if (isThin()) {
- ASSERT(singleStructure());
</del><ins>+ if (isThin())
</ins><span class="cx"> return singleStructure();
</span><del>- }
- ASSERT(structureList()->m_length == 1);
- return structureList()->list()[0];
</del><ins>+ OutOfLineList* list = structureList();
+ if (list->m_length != 1)
+ return nullptr;
+ return list->list()[0];
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> bool isEmpty() const
</span><span class="lines">@@ -96,6 +97,13 @@
</span><span class="cx"> void filter(const StructureSet&);
</span><span class="cx"> void exclude(const StructureSet&);
</span><span class="cx">
</span><ins>+#if ENABLE(DFG_JIT)
+ void filter(const DFG::StructureAbstractValue&);
+ void filter(SpeculatedType);
+ void filterArrayModes(ArrayModes);
+ void filter(const DFG::AbstractValue&);
+#endif // ENABLE(DFG_JIT)
+
</ins><span class="cx"> template<typename Functor>
</span><span class="cx"> void genericFilter(Functor& functor)
</span><span class="cx"> {
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorebytecodeToThisStatuscpp"></a>
<div class="addfile"><h4>Added: trunk/Source/JavaScriptCore/bytecode/ToThisStatus.cpp (0 => 171660)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/bytecode/ToThisStatus.cpp (rev 0)
+++ trunk/Source/JavaScriptCore/bytecode/ToThisStatus.cpp 2014-07-27 23:14:40 UTC (rev 171660)
</span><span class="lines">@@ -0,0 +1,72 @@
</span><ins>+/*
+ * Copyright (C) 2014 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ * notice, this list of conditions and the following disclaimer in the
+ * documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "ToThisStatus.h"
+
+namespace JSC {
+
+ToThisStatus merge(ToThisStatus a, ToThisStatus b)
+{
+ switch (a) {
+ case ToThisOK:
+ return b;
+ case ToThisConflicted:
+ return ToThisConflicted;
+ case ToThisClearedByGC:
+ if (b == ToThisConflicted)
+ return ToThisConflicted;
+ return ToThisClearedByGC;
+ }
+
+ RELEASE_ASSERT_NOT_REACHED();
+ return ToThisConflicted;
+}
+
+} // namespace JSC
+
+namespace WTF {
+
+using namespace JSC;
+
+void printInternal(PrintStream& out, ToThisStatus status)
+{
+ switch (status) {
+ case ToThisOK:
+ out.print("OK");
+ return;
+ case ToThisConflicted:
+ out.print("Conflicted");
+ return;
+ case ToThisClearedByGC:
+ out.print("ClearedByGC");
+ return;
+ }
+
+ RELEASE_ASSERT_NOT_REACHED();
+}
+
+} // namespace WTF
+
</ins></span></pre></div>
<a id="trunkSourceJavaScriptCorebytecodeToThisStatush"></a>
<div class="addfile"><h4>Added: trunk/Source/JavaScriptCore/bytecode/ToThisStatus.h (0 => 171660)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/bytecode/ToThisStatus.h (rev 0)
+++ trunk/Source/JavaScriptCore/bytecode/ToThisStatus.h 2014-07-27 23:14:40 UTC (rev 171660)
</span><span class="lines">@@ -0,0 +1,50 @@
</span><ins>+/*
+ * Copyright (C) 2014 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ * notice, this list of conditions and the following disclaimer in the
+ * documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef ToThisStatus_h
+#define ToThisStatus_h
+
+#include <wtf/PrintStream.h>
+
+namespace JSC {
+
+enum ToThisStatus {
+ ToThisOK,
+ ToThisConflicted,
+ ToThisClearedByGC
+};
+
+ToThisStatus merge(ToThisStatus, ToThisStatus);
+
+} // namespace JSC
+
+namespace WTF {
+
+void printInternal(PrintStream&, JSC::ToThisStatus);
+
+} // namespace WTF
+
+#endif // ToThisStatus_h
+
</ins></span></pre></div>
<a id="trunkSourceJavaScriptCorebytecodeTypeLocationh"></a>
<div class="addfile"><h4>Added: trunk/Source/JavaScriptCore/bytecode/TypeLocation.h (0 => 171660)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/bytecode/TypeLocation.h (rev 0)
+++ trunk/Source/JavaScriptCore/bytecode/TypeLocation.h 2014-07-27 23:14:40 UTC (rev 171660)
</span><span class="lines">@@ -0,0 +1,57 @@
</span><ins>+/*
+ * Copyright (C) 2014 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ * notice, this list of conditions and the following disclaimer in the
+ * documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef TypeLocation_h
+#define TypeLocation_h
+
+#include "TypeSet.h"
+
+namespace JSC {
+
+enum HighFidelityGlobalIDFlags {
+ HighFidelityNeedsUniqueIDGeneration = -1,
+ HighFidelityNoGlobalIDExists = -2
+};
+
+class TypeLocation {
+
+public:
+ TypeLocation()
+ : m_instructionTypeSet(TypeSet::create())
+ , m_globalTypeSet(nullptr)
+ {
+ }
+
+ int64_t m_globalVariableID;
+ intptr_t m_sourceID;
+ unsigned m_line;
+ unsigned m_column;
+ RefPtr<TypeSet> m_instructionTypeSet;
+ RefPtr<TypeSet> m_globalTypeSet;
+};
+
+} //namespace JSC
+
+#endif //TypeLocation_h
</ins></span></pre></div>
<a id="trunkSourceJavaScriptCorebytecompilerBytecodeGeneratorcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp (171659 => 171660)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp 2014-07-27 21:07:24 UTC (rev 171659)
+++ trunk/Source/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp 2014-07-27 23:14:40 UTC (rev 171660)
</span><span class="lines">@@ -410,6 +410,7 @@
</span><span class="cx"> emitOpcode(op_to_this);
</span><span class="cx"> instructions().append(kill(&m_thisRegister));
</span><span class="cx"> instructions().append(0);
</span><ins>+ instructions().append(0);
</ins><span class="cx"> }
</span><span class="cx"> }
</span><span class="cx">
</span><span class="lines">@@ -1002,6 +1003,10 @@
</span><span class="cx"> instructions().append(src->index());
</span><span class="cx"> if (captureMode == IsCaptured)
</span><span class="cx"> instructions().append(watchableVariable(dst->index()));
</span><ins>+
+ if (!dst->isTemporary() && isProfilingTypesWithHighFidelity())
+ emitProfileTypesWithHighFidelity(dst, true);
+
</ins><span class="cx"> return dst;
</span><span class="cx"> }
</span><span class="cx">
</span><span class="lines">@@ -1111,6 +1116,18 @@
</span><span class="cx"> return dst;
</span><span class="cx"> }
</span><span class="cx">
</span><ins>+void BytecodeGenerator::emitProfileTypesWithHighFidelity(RegisterID* registerToProfile, bool hasGlobalID)
+{
+ emitOpcode(op_profile_types_with_high_fidelity);
+ instructions().append(registerToProfile->index());
+ instructions().append(0); // placeholder for TypeLocation
+ // This is a flag indicating whether we should track this value to its globalID or not.
+ if (hasGlobalID)
+ instructions().append(1);
+ else
+ instructions().append(0);
+}
+
</ins><span class="cx"> RegisterID* BytecodeGenerator::emitLoad(RegisterID* dst, bool b)
</span><span class="cx"> {
</span><span class="cx"> return emitLoad(dst, jsBoolean(b));
</span><span class="lines">@@ -1255,13 +1272,18 @@
</span><span class="cx"> m_codeBlock->addPropertyAccessInstruction(instructions().size());
</span><span class="cx">
</span><span class="cx"> // put_to_scope scope, id, value, ResolveModeAndType, Structure, Operand
</span><del>- emitOpcode(op_put_to_scope);
</del><ins>+ if (isProfilingTypesWithHighFidelity())
+ emitOpcode(op_put_to_scope_with_profile);
+ else
+ emitOpcode(op_put_to_scope);
</ins><span class="cx"> instructions().append(scope->index());
</span><span class="cx"> instructions().append(addConstant(identifier));
</span><span class="cx"> instructions().append(value->index());
</span><span class="cx"> instructions().append(ResolveModeAndType(resolveMode, resolveType()).operand());
</span><span class="cx"> instructions().append(0);
</span><span class="cx"> instructions().append(0);
</span><ins>+ if (isProfilingTypesWithHighFidelity())
+ instructions().append(0);
</ins><span class="cx"> return value;
</span><span class="cx"> }
</span><span class="cx">
</span><span class="lines">@@ -1328,6 +1350,10 @@
</span><span class="cx"> instructions().append(0);
</span><span class="cx"> instructions().append(0);
</span><span class="cx"> instructions().append(0);
</span><ins>+
+ if (isProfilingTypesWithHighFidelity())
+ emitProfileTypesWithHighFidelity(value, false);
+
</ins><span class="cx"> return value;
</span><span class="cx"> }
</span><span class="cx">
</span><span class="lines">@@ -1424,6 +1450,10 @@
</span><span class="cx"> instructions().append(property->index());
</span><span class="cx"> instructions().append(value->index());
</span><span class="cx"> instructions().append(arrayProfile);
</span><ins>+
+ if (isProfilingTypesWithHighFidelity())
+ emitProfileTypesWithHighFidelity(value, false);
+
</ins><span class="cx"> return value;
</span><span class="cx"> }
</span><span class="cx">
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorebytecompilerBytecodeGeneratorh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/bytecompiler/BytecodeGenerator.h (171659 => 171660)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/bytecompiler/BytecodeGenerator.h 2014-07-27 21:07:24 UTC (rev 171659)
+++ trunk/Source/JavaScriptCore/bytecompiler/BytecodeGenerator.h 2014-07-27 23:14:40 UTC (rev 171660)
</span><span class="lines">@@ -332,6 +332,8 @@
</span><span class="cx"> return emitNode(n);
</span><span class="cx"> }
</span><span class="cx">
</span><ins>+ void emitProfileTypesWithHighFidelity(RegisterID* dst, bool);
+
</ins><span class="cx"> RegisterID* emitLoad(RegisterID* dst, bool);
</span><span class="cx"> RegisterID* emitLoad(RegisterID* dst, double);
</span><span class="cx"> RegisterID* emitLoad(RegisterID* dst, const Identifier&);
</span><span class="lines">@@ -677,6 +679,8 @@
</span><span class="cx">
</span><span class="cx"> VM* m_vm;
</span><span class="cx">
</span><ins>+ bool isProfilingTypesWithHighFidelity() { return vm()->isProfilingTypesWithHighFidelity(); }
+
</ins><span class="cx"> OpcodeID m_lastOpcodeID;
</span><span class="cx"> #ifndef NDEBUG
</span><span class="cx"> size_t m_lastOpcodePosition;
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorebytecompilerNodesCodegencpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/bytecompiler/NodesCodegen.cpp (171659 => 171660)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/bytecompiler/NodesCodegen.cpp 2014-07-27 21:07:24 UTC (rev 171659)
+++ trunk/Source/JavaScriptCore/bytecompiler/NodesCodegen.cpp 2014-07-27 23:14:40 UTC (rev 171660)
</span><span class="lines">@@ -740,13 +740,15 @@
</span><span class="cx"> if (local.isReadOnly()) {
</span><span class="cx"> generator.emitReadOnlyExceptionIfNeeded();
</span><span class="cx"> localReg = generator.emitMove(generator.tempDestination(dst), localReg);
</span><del>- } else if (local.isCaptured()) {
</del><ins>+ } else if (local.isCaptured() || generator.isProfilingTypesWithHighFidelity()) {
</ins><span class="cx"> RefPtr<RegisterID> tempDst = generator.finalDestination(dst);
</span><span class="cx"> ASSERT(dst != localReg);
</span><span class="cx"> RefPtr<RegisterID> tempDstSrc = generator.newTemporary();
</span><span class="cx"> generator.emitToNumber(tempDst.get(), localReg);
</span><span class="cx"> generator.emitMove(tempDstSrc.get(), localReg);
</span><span class="cx"> emitIncOrDec(generator, tempDstSrc.get(), m_operator);
</span><ins>+ if (generator.isProfilingTypesWithHighFidelity())
+ generator.emitExpressionInfo(divot(), divotStart(), divotEnd());
</ins><span class="cx"> generator.emitMove(localReg, tempDstSrc.get());
</span><span class="cx"> return tempDst.get();
</span><span class="cx"> }
</span><span class="lines">@@ -915,10 +917,12 @@
</span><span class="cx"> if (local.isReadOnly()) {
</span><span class="cx"> generator.emitReadOnlyExceptionIfNeeded();
</span><span class="cx"> localReg = generator.emitMove(generator.tempDestination(dst), localReg);
</span><del>- } else if (local.isCaptured()) {
</del><ins>+ } else if (local.isCaptured() || generator.isProfilingTypesWithHighFidelity()) {
</ins><span class="cx"> RefPtr<RegisterID> tempDst = generator.tempDestination(dst);
</span><span class="cx"> generator.emitMove(tempDst.get(), localReg);
</span><span class="cx"> emitIncOrDec(generator, tempDst.get(), m_operator);
</span><ins>+ if (generator.isProfilingTypesWithHighFidelity())
+ generator.emitExpressionInfo(divot(), divotStart(), divotEnd());
</ins><span class="cx"> generator.emitMove(localReg, tempDst.get());
</span><span class="cx"> return generator.moveToDestinationIfNeeded(dst, tempDst.get());
</span><span class="cx"> }
</span><span class="lines">@@ -1407,6 +1411,7 @@
</span><span class="cx">
</span><span class="cx"> RegisterID* ReadModifyResolveNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
</span><span class="cx"> {
</span><ins>+ JSTextPosition newDivot = divotStart() + m_ident.length();
</ins><span class="cx"> if (Local local = generator.local(m_ident)) {
</span><span class="cx"> if (local.isReadOnly()) {
</span><span class="cx"> generator.emitReadOnlyExceptionIfNeeded();
</span><span class="lines">@@ -1414,10 +1419,13 @@
</span><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> if (local.isCaptured()
</span><ins>+ || generator.isProfilingTypesWithHighFidelity()
</ins><span class="cx"> || generator.leftHandSideNeedsCopy(m_rightHasAssignments, m_right->isPure(generator))) {
</span><span class="cx"> RefPtr<RegisterID> result = generator.newTemporary();
</span><span class="cx"> generator.emitMove(result.get(), local.get());
</span><span class="cx"> emitReadModifyAssignment(generator, result.get(), result.get(), m_right, m_operator, OperandTypes(ResultType::unknownType(), m_right->resultDescriptor()));
</span><ins>+ if (generator.isProfilingTypesWithHighFidelity())
+ generator.emitExpressionInfo(newDivot, divotStart(), newDivot);
</ins><span class="cx"> generator.emitMove(local.get(), result.get());
</span><span class="cx"> return generator.moveToDestinationIfNeeded(dst, result.get());
</span><span class="cx"> }
</span><span class="lines">@@ -1426,7 +1434,6 @@
</span><span class="cx"> return generator.moveToDestinationIfNeeded(dst, result);
</span><span class="cx"> }
</span><span class="cx">
</span><del>- JSTextPosition newDivot = divotStart() + m_ident.length();
</del><span class="cx"> generator.emitExpressionInfo(newDivot, divotStart(), newDivot);
</span><span class="cx"> RefPtr<RegisterID> scope = generator.emitResolveScope(generator.newTemporary(), m_ident);
</span><span class="cx"> RefPtr<RegisterID> value = generator.emitGetFromScope(generator.newTemporary(), scope.get(), m_ident, ThrowIfNotFound);
</span><span class="lines">@@ -1443,9 +1450,11 @@
</span><span class="cx"> generator.emitReadOnlyExceptionIfNeeded();
</span><span class="cx"> return generator.emitNode(dst, m_right);
</span><span class="cx"> }
</span><del>- if (local.isCaptured()) {
</del><ins>+ if (local.isCaptured() || generator.isProfilingTypesWithHighFidelity()) {
</ins><span class="cx"> RefPtr<RegisterID> tempDst = generator.tempDestination(dst);
</span><span class="cx"> generator.emitNode(tempDst.get(), m_right);
</span><ins>+ if (generator.isProfilingTypesWithHighFidelity())
+ generator.emitExpressionInfo(divot(), divotStart(), divotEnd());
</ins><span class="cx"> generator.emitMove(local.get(), tempDst.get());
</span><span class="cx"> return generator.moveToDestinationIfNeeded(dst, tempDst.get());
</span><span class="cx"> }
</span><span class="lines">@@ -1548,7 +1557,8 @@
</span><span class="cx"> if (!m_init)
</span><span class="cx"> return local.get();
</span><span class="cx">
</span><del>- if (local.isCaptured()) {
</del><ins>+ // FIXME: Maybe call emitExpressionInfo here.
+ if (local.isCaptured() || generator.isProfilingTypesWithHighFidelity()) {
</ins><span class="cx"> RefPtr<RegisterID> tempDst = generator.newTemporary();
</span><span class="cx"> generator.emitNode(tempDst.get(), m_init);
</span><span class="cx"> return generator.emitMove(local.get(), tempDst.get());
</span><span class="lines">@@ -1871,7 +1881,8 @@
</span><span class="cx"> Identifier ident = simpleBinding->boundProperty();
</span><span class="cx"> Local local = generator.local(ident);
</span><span class="cx"> propertyName = local.get();
</span><del>- if (!propertyName || local.isCaptured())
</del><ins>+ // FIXME: Should I emit expression info here?
+ if (!propertyName || local.isCaptured() || generator.isProfilingTypesWithHighFidelity())
</ins><span class="cx"> goto genericBinding;
</span><span class="cx"> expectedSubscript = generator.emitMove(generator.newTemporary(), propertyName);
</span><span class="cx"> generator.pushOptimisedForIn(expectedSubscript.get(), iter.get(), i.get(), propertyName);
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredebuggerDebuggerActivationcpp"></a>
<div class="delfile"><h4>Deleted: trunk/Source/JavaScriptCore/debugger/DebuggerActivation.cpp (171659 => 171660)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/debugger/DebuggerActivation.cpp 2014-07-27 21:07:24 UTC (rev 171659)
+++ trunk/Source/JavaScriptCore/debugger/DebuggerActivation.cpp 2014-07-27 23:14:40 UTC (rev 171660)
</span><span class="lines">@@ -1,98 +0,0 @@
</span><del>-/*
- * Copyright (C) 2008, 2009 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- * notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- * notice, this list of conditions and the following disclaimer in the
- * documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include "config.h"
-#include "DebuggerActivation.h"
-
-#include "JSActivation.h"
-#include "JSCInlines.h"
-
-namespace JSC {
-
-STATIC_ASSERT_IS_TRIVIALLY_DESTRUCTIBLE(DebuggerActivation);
-
-const ClassInfo DebuggerActivation::s_info = { "DebuggerActivation", &Base::s_info, 0, 0, CREATE_METHOD_TABLE(DebuggerActivation) };
-
-DebuggerActivation::DebuggerActivation(VM& vm)
- : JSNonFinalObject(vm, vm.debuggerActivationStructure.get())
-{
-}
-
-void DebuggerActivation::finishCreation(VM& vm, JSObject* activation)
-{
- Base::finishCreation(vm);
- ASSERT(activation);
- ASSERT(activation->isActivationObject());
- m_activation.set(vm, this, jsCast<JSActivation*>(activation));
-}
-
-void DebuggerActivation::visitChildren(JSCell* cell, SlotVisitor& visitor)
-{
- DebuggerActivation* thisObject = jsCast<DebuggerActivation*>(cell);
- ASSERT_GC_OBJECT_INHERITS(thisObject, info());
- COMPILE_ASSERT(StructureFlags & OverridesVisitChildren, OverridesVisitChildrenWithoutSettingFlag);
- ASSERT(thisObject->structure()->typeInfo().overridesVisitChildren());
-
- JSObject::visitChildren(thisObject, visitor);
- visitor.append(&thisObject->m_activation);
-}
-
-String DebuggerActivation::className(const JSObject* object)
-{
- const DebuggerActivation* thisObject = jsCast<const DebuggerActivation*>(object);
- return thisObject->m_activation->methodTable()->className(thisObject->m_activation.get());
-}
-
-bool DebuggerActivation::getOwnPropertySlot(JSObject* object, ExecState* exec, PropertyName propertyName, PropertySlot& slot)
-{
- DebuggerActivation* thisObject = jsCast<DebuggerActivation*>(object);
- return thisObject->m_activation->methodTable()->getOwnPropertySlot(thisObject->m_activation.get(), exec, propertyName, slot);
-}
-
-void DebuggerActivation::put(JSCell* cell, ExecState* exec, PropertyName propertyName, JSValue value, PutPropertySlot& slot)
-{
- DebuggerActivation* thisObject = jsCast<DebuggerActivation*>(cell);
- thisObject->m_activation->methodTable()->put(thisObject->m_activation.get(), exec, propertyName, value, slot);
-}
-
-bool DebuggerActivation::deleteProperty(JSCell* cell, ExecState* exec, PropertyName propertyName)
-{
- DebuggerActivation* thisObject = jsCast<DebuggerActivation*>(cell);
- return thisObject->m_activation->methodTable()->deleteProperty(thisObject->m_activation.get(), exec, propertyName);
-}
-
-void DebuggerActivation::getOwnPropertyNames(JSObject* object, ExecState* exec, PropertyNameArray& propertyNames, EnumerationMode mode)
-{
- DebuggerActivation* thisObject = jsCast<DebuggerActivation*>(object);
- thisObject->m_activation->methodTable()->getPropertyNames(thisObject->m_activation.get(), exec, propertyNames, mode);
-}
-
-bool DebuggerActivation::defineOwnProperty(JSObject* object, ExecState* exec, PropertyName propertyName, const PropertyDescriptor& descriptor, bool shouldThrow)
-{
- DebuggerActivation* thisObject = jsCast<DebuggerActivation*>(object);
- return thisObject->m_activation->methodTable()->defineOwnProperty(thisObject->m_activation.get(), exec, propertyName, descriptor, shouldThrow);
-}
-
-} // namespace JSC
</del></span></pre></div>
<a id="trunkSourceJavaScriptCoredebuggerDebuggerActivationh"></a>
<div class="delfile"><h4>Deleted: trunk/Source/JavaScriptCore/debugger/DebuggerActivation.h (171659 => 171660)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/debugger/DebuggerActivation.h 2014-07-27 21:07:24 UTC (rev 171659)
+++ trunk/Source/JavaScriptCore/debugger/DebuggerActivation.h 2014-07-27 23:14:40 UTC (rev 171660)
</span><span class="lines">@@ -1,71 +0,0 @@
</span><del>-/*
- * Copyright (C) 2008, 2009 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- * notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- * notice, this list of conditions and the following disclaimer in the
- * documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#ifndef DebuggerActivation_h
-#define DebuggerActivation_h
-
-#include "JSObject.h"
-
-namespace JSC {
-
-class DebuggerActivation : public JSNonFinalObject {
-public:
- typedef JSNonFinalObject Base;
-
- static DebuggerActivation* create(VM& vm, JSObject* object)
- {
- DebuggerActivation* activation = new (NotNull, allocateCell<DebuggerActivation>(vm.heap)) DebuggerActivation(vm);
- activation->finishCreation(vm, object);
- return activation;
- }
-
- static void visitChildren(JSCell*, SlotVisitor&);
- static String className(const JSObject*);
- static bool getOwnPropertySlot(JSObject*, ExecState*, PropertyName, PropertySlot&);
- static void put(JSCell*, ExecState*, PropertyName, JSValue, PutPropertySlot&);
- static bool deleteProperty(JSCell*, ExecState*, PropertyName);
- static void getOwnPropertyNames(JSObject*, ExecState*, PropertyNameArray&, EnumerationMode);
- static bool defineOwnProperty(JSObject*, ExecState*, PropertyName, const PropertyDescriptor&, bool shouldThrow);
-
- DECLARE_EXPORT_INFO;
-
- static Structure* createStructure(VM& vm, JSGlobalObject* globalObject, JSValue prototype)
- {
- return Structure::create(vm, globalObject, prototype, TypeInfo(ObjectType, StructureFlags), info());
- }
-
-protected:
- static const unsigned StructureFlags = OverridesGetOwnPropertySlot | OverridesVisitChildren | JSObject::StructureFlags;
-
- JS_EXPORT_PRIVATE void finishCreation(VM&, JSObject* activation);
-
-private:
- JS_EXPORT_PRIVATE DebuggerActivation(VM&);
- WriteBarrier<JSActivation> m_activation;
-};
-
-} // namespace JSC
-
-#endif // DebuggerActivation_h
</del></span></pre></div>
<a id="trunkSourceJavaScriptCoredebuggerDebuggerScopecpp"></a>
<div class="addfile"><h4>Added: trunk/Source/JavaScriptCore/debugger/DebuggerScope.cpp (0 => 171660)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/debugger/DebuggerScope.cpp (rev 0)
+++ trunk/Source/JavaScriptCore/debugger/DebuggerScope.cpp 2014-07-27 23:14:40 UTC (rev 171660)
</span><span class="lines">@@ -0,0 +1,98 @@
</span><ins>+/*
+ * Copyright (C) 2008-2009, 2014 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ * notice, this list of conditions and the following disclaimer in the
+ * documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "DebuggerScope.h"
+
+#include "JSActivation.h"
+#include "JSCInlines.h"
+
+namespace JSC {
+
+STATIC_ASSERT_IS_TRIVIALLY_DESTRUCTIBLE(DebuggerScope);
+
+const ClassInfo DebuggerScope::s_info = { "DebuggerScope", &Base::s_info, 0, 0, CREATE_METHOD_TABLE(DebuggerScope) };
+
+DebuggerScope::DebuggerScope(VM& vm)
+ : JSNonFinalObject(vm, vm.debuggerScopeStructure.get())
+{
+}
+
+void DebuggerScope::finishCreation(VM& vm, JSObject* activation)
+{
+ Base::finishCreation(vm);
+ ASSERT(activation);
+ ASSERT(activation->isActivationObject());
+ m_activation.set(vm, this, jsCast<JSActivation*>(activation));
+}
+
+void DebuggerScope::visitChildren(JSCell* cell, SlotVisitor& visitor)
+{
+ DebuggerScope* thisObject = jsCast<DebuggerScope*>(cell);
+ ASSERT_GC_OBJECT_INHERITS(thisObject, info());
+ COMPILE_ASSERT(StructureFlags & OverridesVisitChildren, OverridesVisitChildrenWithoutSettingFlag);
+ ASSERT(thisObject->structure()->typeInfo().overridesVisitChildren());
+
+ JSObject::visitChildren(thisObject, visitor);
+ visitor.append(&thisObject->m_activation);
+}
+
+String DebuggerScope::className(const JSObject* object)
+{
+ const DebuggerScope* thisObject = jsCast<const DebuggerScope*>(object);
+ return thisObject->m_activation->methodTable()->className(thisObject->m_activation.get());
+}
+
+bool DebuggerScope::getOwnPropertySlot(JSObject* object, ExecState* exec, PropertyName propertyName, PropertySlot& slot)
+{
+ DebuggerScope* thisObject = jsCast<DebuggerScope*>(object);
+ return thisObject->m_activation->methodTable()->getOwnPropertySlot(thisObject->m_activation.get(), exec, propertyName, slot);
+}
+
+void DebuggerScope::put(JSCell* cell, ExecState* exec, PropertyName propertyName, JSValue value, PutPropertySlot& slot)
+{
+ DebuggerScope* thisObject = jsCast<DebuggerScope*>(cell);
+ thisObject->m_activation->methodTable()->put(thisObject->m_activation.get(), exec, propertyName, value, slot);
+}
+
+bool DebuggerScope::deleteProperty(JSCell* cell, ExecState* exec, PropertyName propertyName)
+{
+ DebuggerScope* thisObject = jsCast<DebuggerScope*>(cell);
+ return thisObject->m_activation->methodTable()->deleteProperty(thisObject->m_activation.get(), exec, propertyName);
+}
+
+void DebuggerScope::getOwnPropertyNames(JSObject* object, ExecState* exec, PropertyNameArray& propertyNames, EnumerationMode mode)
+{
+ DebuggerScope* thisObject = jsCast<DebuggerScope*>(object);
+ thisObject->m_activation->methodTable()->getPropertyNames(thisObject->m_activation.get(), exec, propertyNames, mode);
+}
+
+bool DebuggerScope::defineOwnProperty(JSObject* object, ExecState* exec, PropertyName propertyName, const PropertyDescriptor& descriptor, bool shouldThrow)
+{
+ DebuggerScope* thisObject = jsCast<DebuggerScope*>(object);
+ return thisObject->m_activation->methodTable()->defineOwnProperty(thisObject->m_activation.get(), exec, propertyName, descriptor, shouldThrow);
+}
+
+} // namespace JSC
</ins></span></pre></div>
<a id="trunkSourceJavaScriptCoredebuggerDebuggerScopeh"></a>
<div class="addfile"><h4>Added: trunk/Source/JavaScriptCore/debugger/DebuggerScope.h (0 => 171660)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/debugger/DebuggerScope.h (rev 0)
+++ trunk/Source/JavaScriptCore/debugger/DebuggerScope.h 2014-07-27 23:14:40 UTC (rev 171660)
</span><span class="lines">@@ -0,0 +1,71 @@
</span><ins>+/*
+ * Copyright (C) 2008-2009, 2014 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ * notice, this list of conditions and the following disclaimer in the
+ * documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef DebuggerScope_h
+#define DebuggerScope_h
+
+#include "JSObject.h"
+
+namespace JSC {
+
+class DebuggerScope : public JSNonFinalObject {
+public:
+ typedef JSNonFinalObject Base;
+
+ static DebuggerScope* create(VM& vm, JSObject* object)
+ {
+ DebuggerScope* activation = new (NotNull, allocateCell<DebuggerScope>(vm.heap)) DebuggerScope(vm);
+ activation->finishCreation(vm, object);
+ return activation;
+ }
+
+ static void visitChildren(JSCell*, SlotVisitor&);
+ static String className(const JSObject*);
+ static bool getOwnPropertySlot(JSObject*, ExecState*, PropertyName, PropertySlot&);
+ static void put(JSCell*, ExecState*, PropertyName, JSValue, PutPropertySlot&);
+ static bool deleteProperty(JSCell*, ExecState*, PropertyName);
+ static void getOwnPropertyNames(JSObject*, ExecState*, PropertyNameArray&, EnumerationMode);
+ static bool defineOwnProperty(JSObject*, ExecState*, PropertyName, const PropertyDescriptor&, bool shouldThrow);
+
+ DECLARE_EXPORT_INFO;
+
+ static Structure* createStructure(VM& vm, JSGlobalObject* globalObject, JSValue prototype)
+ {
+ return Structure::create(vm, globalObject, prototype, TypeInfo(ObjectType, StructureFlags), info());
+ }
+
+protected:
+ static const unsigned StructureFlags = OverridesGetOwnPropertySlot | OverridesVisitChildren | JSObject::StructureFlags;
+
+ JS_EXPORT_PRIVATE void finishCreation(VM&, JSObject* activation);
+
+private:
+ JS_EXPORT_PRIVATE DebuggerScope(VM&);
+ WriteBarrier<JSActivation> m_activation;
+};
+
+} // namespace JSC
+
+#endif // DebuggerScope_h
</ins></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGAbstractInterpreterInlinesh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h (171659 => 171660)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h 2014-07-27 21:07:24 UTC (rev 171659)
+++ trunk/Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h 2014-07-27 23:14:40 UTC (rev 171660)
</span><span class="lines">@@ -1388,46 +1388,45 @@
</span><span class="cx"> break;
</span><span class="cx">
</span><span class="cx"> case GetById:
</span><del>- case GetByIdFlush:
</del><ins>+ case GetByIdFlush: {
</ins><span class="cx"> if (!node->prediction()) {
</span><span class="cx"> m_state.setIsValid(false);
</span><span class="cx"> break;
</span><span class="cx"> }
</span><del>- if (isCellSpeculation(node->child1()->prediction())) {
- // This use of onlyStructure() should be replaced by giving GetByIdStatus the ability
- // to compute things based on a StructureSet, and then to factor ByteCodeParser's
- // ability to generate code based on a GetByIdStatus out of ByteCodeParser so that
- // ConstantFoldingPhase can use it.
- // https://bugs.webkit.org/show_bug.cgi?id=133229
- if (Structure* structure = forNode(node->child1()).m_structure.onlyStructure()) {
- GetByIdStatus status = GetByIdStatus::computeFor(
- m_graph.m_vm, structure,
- m_graph.identifiers()[node->identifierNumber()]);
- if (status.isSimple() && status.numVariants() == 1) {
- // Assert things that we can't handle and that the computeFor() method
- // above won't be able to return.
- ASSERT(status[0].structureSet().size() == 1);
- ASSERT(status[0].constantChecks().isEmpty());
- ASSERT(!status[0].alternateBase());
</del><ins>+
+ AbstractValue& value = forNode(node->child1());
+ if (!value.m_structure.isTop() && !value.m_structure.isClobbered()
+ && (node->child1().useKind() == CellUse || !(value.m_type & ~SpecCell))) {
+ GetByIdStatus status = GetByIdStatus::computeFor(
+ m_graph.m_vm, value.m_structure.set(),
+ m_graph.identifiers()[node->identifierNumber()]);
+ if (status.isSimple()) {
+ // Figure out what the result is going to be - is it TOP, a constant, or maybe
+ // something more subtle?
+ AbstractValue result;
+ for (unsigned i = status.numVariants(); i--;) {
+ if (!status[i].specificValue()) {
+ result.makeHeapTop();
+ break;
+ }
</ins><span class="cx">
</span><del>- if (status[0].specificValue()) {
- if (status[0].specificValue().isCell()) {
- Structure* structure = status[0].specificValue().asCell()->structure();
- m_graph.watchpoints().consider(structure);
- }
- setConstant(node, *m_graph.freeze(status[0].specificValue()));
- } else
- forNode(node).makeHeapTop();
- filter(node->child1(), status[0].structureSet());
-
</del><ins>+ AbstractValue thisResult;
+ thisResult.set(
+ m_graph, *m_graph.freeze(status[i].specificValue()),
+ m_state.structureClobberState());
+ result.merge(thisResult);
+ }
+ if (status.numVariants() == 1 || isFTL(m_graph.m_plan.mode))
</ins><span class="cx"> m_state.setFoundConstants(true);
</span><del>- break;
- }
</del><ins>+ forNode(node) = result;
+ break;
</ins><span class="cx"> }
</span><span class="cx"> }
</span><ins>+
</ins><span class="cx"> clobberWorld(node->origin.semantic, clobberLimit);
</span><span class="cx"> forNode(node).makeHeapTop();
</span><span class="cx"> break;
</span><ins>+ }
</ins><span class="cx">
</span><span class="cx"> case GetArrayLength:
</span><span class="cx"> forNode(node).setType(SpecInt32);
</span><span class="lines">@@ -1462,11 +1461,14 @@
</span><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> case PutStructure:
</span><del>- case PhantomPutStructure:
</del><span class="cx"> if (!forNode(node->child1()).m_structure.isClear()) {
</span><del>- observeTransition(
- clobberLimit, node->transition()->previous, node->transition()->next);
- forNode(node->child1()).set(m_graph, node->transition()->next);
</del><ins>+ if (forNode(node->child1()).m_structure.onlyStructure() == node->transition()->next)
+ m_state.setFoundConstants(true);
+ else {
+ observeTransition(
+ clobberLimit, node->transition()->previous, node->transition()->next);
+ forNode(node->child1()).changeStructure(m_graph, node->transition()->next);
+ }
</ins><span class="cx"> }
</span><span class="cx"> break;
</span><span class="cx"> case GetButterfly:
</span><span class="lines">@@ -1595,39 +1597,45 @@
</span><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> case MultiGetByOffset: {
</span><del>- AbstractValue& value = forNode(node->child1());
- ASSERT(!(value.m_type & ~SpecCell)); // Edge filtering should have already ensured this.
-
- // This should just filter down the cases in MultiGetByOffset. If that results in all
- // cases having the same offset then we should strength reduce it to a CheckStructure +
- // GetByOffset.
- // https://bugs.webkit.org/show_bug.cgi?id=133229
- if (Structure* structure = value.m_structure.onlyStructure()) {
- bool done = false;
- for (unsigned i = node->multiGetByOffsetData().variants.size(); i--;) {
- const GetByIdVariant& variant = node->multiGetByOffsetData().variants[i];
- if (!variant.structureSet().contains(structure))
- continue;
-
- if (variant.alternateBase())
- break;
-
- filter(value, structure);
- forNode(node).makeHeapTop();
- m_state.setFoundConstants(true);
- done = true;
- break;
</del><ins>+ // This code will filter the base value in a manner that is possibly different (either more
+ // or less precise) than the way it would be filtered if this was strength-reduced to a
+ // CheckStructure. This is fine. It's legal for different passes over the code to prove
+ // different things about the code, so long as all of them are sound. That even includes
+ // one guy proving that code should never execute (due to a contradiction) and another guy
+ // not finding that contradiction. If someone ever proved that there would be a
+ // contradiction then there must always be a contradiction even if subsequent passes don't
+ // realize it. This is the case here.
+
+ // Ordinarily you have to be careful with calling setFoundConstants()
+ // because of the effect on compile times, but this node is FTL-only.
+ m_state.setFoundConstants(true);
+
+ AbstractValue base = forNode(node->child1());
+ StructureSet baseSet;
+ AbstractValue result;
+ for (unsigned i = node->multiGetByOffsetData().variants.size(); i--;) {
+ GetByIdVariant& variant = node->multiGetByOffsetData().variants[i];
+ StructureSet set = variant.structureSet();
+ set.filter(base);
+ if (set.isEmpty())
+ continue;
+ baseSet.merge(set);
+ if (!variant.specificValue()) {
+ result.makeHeapTop();
+ continue;
</ins><span class="cx"> }
</span><del>- if (done)
- break;
</del><ins>+ AbstractValue thisResult;
+ thisResult.set(
+ m_graph,
+ *m_graph.freeze(variant.specificValue()),
+ m_state.structureClobberState());
+ result.merge(thisResult);
</ins><span class="cx"> }
</span><span class="cx">
</span><del>- StructureSet set;
- for (unsigned i = node->multiGetByOffsetData().variants.size(); i--;)
- set.merge(node->multiGetByOffsetData().variants[i].structureSet());
</del><ins>+ if (forNode(node->child1()).changeStructure(m_graph, baseSet) == Contradiction)
+ m_state.setIsValid(false);
</ins><span class="cx">
</span><del>- filter(node->child1(), set);
- forNode(node).makeHeapTop();
</del><ins>+ forNode(node) = result;
</ins><span class="cx"> break;
</span><span class="cx"> }
</span><span class="cx">
</span><span class="lines">@@ -1636,57 +1644,36 @@
</span><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> case MultiPutByOffset: {
</span><del>- AbstractValue& value = forNode(node->child1());
- ASSERT(!(value.m_type & ~SpecCell)); // Edge filtering should have already ensured this.
-
- // This should just filter down the cases in MultiPutByOffset. If that results in either
- // one case, or nothing but replace cases and they have the same offset, then we should
- // just strength reduce it to the appropriate combination of CheckStructure,
- // [Re]AllocatePropertyStorage, PutStructure, and PutByOffset.
- // https://bugs.webkit.org/show_bug.cgi?id=133229
- if (Structure* structure = value.m_structure.onlyStructure()) {
- bool done = false;
- for (unsigned i = node->multiPutByOffsetData().variants.size(); i--;) {
- const PutByIdVariant& variant = node->multiPutByOffsetData().variants[i];
- if (variant.oldStructure() != structure)
- continue;
-
- if (variant.kind() == PutByIdVariant::Replace) {
- filter(node->child1(), structure);
- m_state.setFoundConstants(true);
- done = true;
- break;
- }
-
- ASSERT(variant.kind() == PutByIdVariant::Transition);
- clobberStructures(clobberLimit);
- forNode(node->child1()).set(m_graph, variant.newStructure());
- m_state.setFoundConstants(true);
- done = true;
- break;
- }
- if (done)
- break;
- }
-
- StructureSet oldSet;
</del><span class="cx"> StructureSet newSet;
</span><span class="cx"> TransitionVector transitions;
</span><ins>+
+ // Ordinarily you have to be careful with calling setFoundConstants()
+ // because of the effect on compile times, but this node is FTL-only.
+ m_state.setFoundConstants(true);
+
+ AbstractValue base = forNode(node->child1());
+
</ins><span class="cx"> for (unsigned i = node->multiPutByOffsetData().variants.size(); i--;) {
</span><span class="cx"> const PutByIdVariant& variant = node->multiPutByOffsetData().variants[i];
</span><del>- oldSet.add(variant.oldStructure());
</del><ins>+ StructureSet thisSet = variant.oldStructure();
+ thisSet.filter(base);
+ if (thisSet.isEmpty())
+ continue;
</ins><span class="cx"> if (variant.kind() == PutByIdVariant::Transition) {
</span><del>- transitions.append(Transition(variant.oldStructure(), variant.newStructure()));
</del><ins>+ if (thisSet.onlyStructure() != variant.newStructure()) {
+ transitions.append(
+ Transition(variant.oldStructureForTransition(), variant.newStructure()));
+ } // else this is really a replace.
</ins><span class="cx"> newSet.add(variant.newStructure());
</span><span class="cx"> } else {
</span><span class="cx"> ASSERT(variant.kind() == PutByIdVariant::Replace);
</span><del>- newSet.add(variant.oldStructure());
</del><ins>+ newSet.merge(thisSet);
</ins><span class="cx"> }
</span><span class="cx"> }
</span><span class="cx">
</span><del>- filter(node->child1(), oldSet);
</del><span class="cx"> observeTransitions(clobberLimit, transitions);
</span><del>- forNode(node->child1()).set(m_graph, newSet);
</del><ins>+ if (forNode(node->child1()).changeStructure(m_graph, newSet) == Contradiction)
+ m_state.setIsValid(false);
</ins><span class="cx"> break;
</span><span class="cx"> }
</span><span class="cx">
</span><span class="lines">@@ -1715,37 +1702,47 @@
</span><span class="cx">
</span><span class="cx"> case PutById:
</span><span class="cx"> case PutByIdFlush:
</span><del>- case PutByIdDirect:
- // This use of onlyStructure() should be replaced by giving PutByIdStatus the ability
- // to compute things based on a StructureSet, and then to factor ByteCodeParser's
- // ability to generate code based on a PutByIdStatus out of ByteCodeParser so that
- // ConstantFoldingPhase can use it.
- // https://bugs.webkit.org/show_bug.cgi?id=133229
- if (Structure* structure = forNode(node->child1()).m_structure.onlyStructure()) {
</del><ins>+ case PutByIdDirect: {
+ AbstractValue& value = forNode(node->child1());
+ if (!value.m_structure.isTop() && !value.m_structure.isClobbered()) {
</ins><span class="cx"> PutByIdStatus status = PutByIdStatus::computeFor(
</span><span class="cx"> m_graph.m_vm,
</span><span class="cx"> m_graph.globalObjectFor(node->origin.semantic),
</span><del>- structure,
</del><ins>+ value.m_structure.set(),
</ins><span class="cx"> m_graph.identifiers()[node->identifierNumber()],
</span><span class="cx"> node->op() == PutByIdDirect);
</span><del>- if (status.isSimple() && status.numVariants() == 1) {
- if (status[0].kind() == PutByIdVariant::Replace) {
- filter(node->child1(), structure);
- m_state.setFoundConstants(true);
- break;
</del><ins>+
+ if (status.isSimple()) {
+ StructureSet newSet;
+ TransitionVector transitions;
+
+ for (unsigned i = status.numVariants(); i--;) {
+ const PutByIdVariant& variant = status[i];
+ if (variant.kind() == PutByIdVariant::Transition) {
+ transitions.append(
+ Transition(
+ variant.oldStructureForTransition(), variant.newStructure()));
+ m_graph.watchpoints().consider(variant.newStructure());
+ newSet.add(variant.newStructure());
+ } else {
+ ASSERT(variant.kind() == PutByIdVariant::Replace);
+ newSet.merge(variant.oldStructure());
+ }
</ins><span class="cx"> }
</span><del>- if (status[0].kind() == PutByIdVariant::Transition
- && structure->transitionWatchpointSetHasBeenInvalidated()) {
- m_graph.watchpoints().consider(status[0].newStructure());
- clobberStructures(clobberLimit);
- forNode(node->child1()).set(m_graph, status[0].newStructure());
</del><ins>+
+ if (status.numVariants() == 1 || isFTL(m_graph.m_plan.mode))
</ins><span class="cx"> m_state.setFoundConstants(true);
</span><del>- break;
- }
</del><ins>+
+ observeTransitions(clobberLimit, transitions);
+ if (forNode(node->child1()).changeStructure(m_graph, newSet) == Contradiction)
+ m_state.setIsValid(false);
+ break;
</ins><span class="cx"> }
</span><span class="cx"> }
</span><ins>+
</ins><span class="cx"> clobberWorld(node->origin.semantic, clobberLimit);
</span><span class="cx"> break;
</span><ins>+ }
</ins><span class="cx">
</span><span class="cx"> case In:
</span><span class="cx"> // FIXME: We can determine when the property definitely exists based on abstract
</span><span class="lines">@@ -1948,7 +1945,8 @@
</span><span class="cx"> {
</span><span class="cx"> AbstractValue::TransitionObserver transitionObserver(from, to);
</span><span class="cx"> forAllValues(clobberLimit, transitionObserver);
</span><del>- setDidClobber();
</del><ins>+
+ ASSERT(!from->dfgShouldWatch()); // We don't need to claim to be in a clobbered state because 'from' was never watchable (during the time we were compiling), hence no constants ever introduced into the DFG IR that ever had a watchable structure would ever have the same structure as from.
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> template<typename AbstractStateType>
</span><span class="lines">@@ -1957,7 +1955,12 @@
</span><span class="cx"> {
</span><span class="cx"> AbstractValue::TransitionsObserver transitionsObserver(vector);
</span><span class="cx"> forAllValues(clobberLimit, transitionsObserver);
</span><del>- setDidClobber();
</del><ins>+
+ if (!ASSERT_DISABLED) {
+ // We don't need to claim to be in a clobbered state because none of the Transition::previous structures are watchable.
+ for (unsigned i = vector.size(); i--;)
+ ASSERT(!vector[i].previous->dfgShouldWatch());
+ }
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> template<typename AbstractStateType>
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGAbstractValuecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGAbstractValue.cpp (171659 => 171660)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGAbstractValue.cpp 2014-07-27 21:07:24 UTC (rev 171659)
+++ trunk/Source/JavaScriptCore/dfg/DFGAbstractValue.cpp 2014-07-27 23:14:40 UTC (rev 171660)
</span><span class="lines">@@ -191,6 +191,17 @@
</span><span class="cx"> return normalizeClarity(graph);
</span><span class="cx"> }
</span><span class="cx">
</span><ins>+FiltrationResult AbstractValue::changeStructure(Graph& graph, const StructureSet& other)
+{
+ m_type &= other.speculationFromStructures();
+ m_arrayModes = other.arrayModesFromStructures();
+ m_structure = other;
+
+ filterValueByType();
+
+ return normalizeClarity(graph);
+}
+
</ins><span class="cx"> FiltrationResult AbstractValue::filterArrayModes(ArrayModes arrayModes)
</span><span class="cx"> {
</span><span class="cx"> ASSERT(arrayModes);
</span><span class="lines">@@ -241,6 +252,13 @@
</span><span class="cx"> return result;
</span><span class="cx"> }
</span><span class="cx">
</span><ins>+bool AbstractValue::contains(Structure* structure) const
+{
+ return couldBeType(speculationFromStructure(structure))
+ && (m_arrayModes & arrayModeFromStructure(structure))
+ && m_structure.contains(structure);
+}
+
</ins><span class="cx"> FiltrationResult AbstractValue::filter(const AbstractValue& other)
</span><span class="cx"> {
</span><span class="cx"> m_type &= other.m_type;
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGAbstractValueh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGAbstractValue.h (171659 => 171660)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGAbstractValue.h 2014-07-27 21:07:24 UTC (rev 171659)
+++ trunk/Source/JavaScriptCore/dfg/DFGAbstractValue.h 2014-07-27 23:14:40 UTC (rev 171660)
</span><span class="lines">@@ -267,12 +267,12 @@
</span><span class="cx"> checkConsistency();
</span><span class="cx"> }
</span><span class="cx">
</span><del>- bool couldBeType(SpeculatedType desiredType)
</del><ins>+ bool couldBeType(SpeculatedType desiredType) const
</ins><span class="cx"> {
</span><span class="cx"> return !!(m_type & desiredType);
</span><span class="cx"> }
</span><span class="cx">
</span><del>- bool isType(SpeculatedType desiredType)
</del><ins>+ bool isType(SpeculatedType desiredType) const
</ins><span class="cx"> {
</span><span class="cx"> return !(m_type & ~desiredType);
</span><span class="cx"> }
</span><span class="lines">@@ -283,6 +283,10 @@
</span><span class="cx"> FiltrationResult filterByValue(const FrozenValue& value);
</span><span class="cx"> FiltrationResult filter(const AbstractValue&);
</span><span class="cx">
</span><ins>+ FiltrationResult changeStructure(Graph&, const StructureSet&);
+
+ bool contains(Structure*) const;
+
</ins><span class="cx"> bool validate(JSValue value) const
</span><span class="cx"> {
</span><span class="cx"> if (isHeapTop())
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGByteCodeParsercpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp (171659 => 171660)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp 2014-07-27 21:07:24 UTC (rev 171659)
+++ trunk/Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp 2014-07-27 23:14:40 UTC (rev 171660)
</span><span class="lines">@@ -1891,20 +1891,19 @@
</span><span class="cx"> addToGraph(CheckStructure, OpInfo(m_graph.addStructureSet(variant.oldStructure())), base);
</span><span class="cx"> emitChecks(variant.constantChecks());
</span><span class="cx">
</span><del>- ASSERT(variant.oldStructure()->transitionWatchpointSetHasBeenInvalidated());
</del><ins>+ ASSERT(variant.oldStructureForTransition()->transitionWatchpointSetHasBeenInvalidated());
</ins><span class="cx">
</span><span class="cx"> Node* propertyStorage;
</span><span class="cx"> Transition* transition = m_graph.m_transitions.add(
</span><del>- variant.oldStructure(), variant.newStructure());
</del><ins>+ variant.oldStructureForTransition(), variant.newStructure());
</ins><span class="cx">
</span><del>- if (variant.oldStructure()->outOfLineCapacity()
- != variant.newStructure()->outOfLineCapacity()) {
</del><ins>+ if (variant.reallocatesStorage()) {
</ins><span class="cx">
</span><span class="cx"> // If we're growing the property storage then it must be because we're
</span><span class="cx"> // storing into the out-of-line storage.
</span><span class="cx"> ASSERT(!isInlineOffset(variant.offset()));
</span><span class="cx">
</span><del>- if (!variant.oldStructure()->outOfLineCapacity()) {
</del><ins>+ if (!variant.oldStructureForTransition()->outOfLineCapacity()) {
</ins><span class="cx"> propertyStorage = addToGraph(
</span><span class="cx"> AllocatePropertyStorage, OpInfo(transition), base);
</span><span class="cx"> } else {
</span><span class="lines">@@ -2036,7 +2035,8 @@
</span><span class="cx"> Node* op1 = getThis();
</span><span class="cx"> if (op1->op() != ToThis) {
</span><span class="cx"> Structure* cachedStructure = currentInstruction[2].u.structure.get();
</span><del>- if (!cachedStructure
</del><ins>+ if (currentInstruction[2].u.toThisStatus != ToThisOK
+ || !cachedStructure
</ins><span class="cx"> || cachedStructure->classInfo()->methodTable.toThis != JSObject::info()->methodTable.toThis
</span><span class="cx"> || m_inlineStackTop->m_profiledBlock->couldTakeSlowCase(m_currentIndex)
</span><span class="cx"> || m_inlineStackTop->m_exitProfile.hasExitSite(m_currentIndex, BadCache)
</span><span class="lines">@@ -2886,7 +2886,9 @@
</span><span class="cx"> case GlobalPropertyWithVarInjectionChecks: {
</span><span class="cx"> SpeculatedType prediction = getPrediction();
</span><span class="cx"> GetByIdStatus status = GetByIdStatus::computeFor(*m_vm, structure, uid);
</span><del>- if (status.state() != GetByIdStatus::Simple || status.numVariants() != 1) {
</del><ins>+ if (status.state() != GetByIdStatus::Simple
+ || status.numVariants() != 1
+ || status[0].structureSet().size() != 1) {
</ins><span class="cx"> set(VirtualRegister(dst), addToGraph(GetByIdFlush, OpInfo(identifierNumber), OpInfo(prediction), get(VirtualRegister(scope))));
</span><span class="cx"> break;
</span><span class="cx"> }
</span><span class="lines">@@ -2971,11 +2973,14 @@
</span><span class="cx"> case GlobalProperty:
</span><span class="cx"> case GlobalPropertyWithVarInjectionChecks: {
</span><span class="cx"> PutByIdStatus status = PutByIdStatus::computeFor(*m_vm, globalObject, structure, uid, false);
</span><del>- if (status.numVariants() != 1 || status[0].kind() != PutByIdVariant::Replace) {
</del><ins>+ if (status.numVariants() != 1
+ || status[0].kind() != PutByIdVariant::Replace
+ || status[0].structure().size() != 1) {
</ins><span class="cx"> addToGraph(PutById, OpInfo(identifierNumber), get(VirtualRegister(scope)), get(VirtualRegister(value)));
</span><span class="cx"> break;
</span><span class="cx"> }
</span><del>- Node* base = cellConstantWithStructureCheck(globalObject, status[0].structure());
</del><ins>+ ASSERT(status[0].structure().onlyStructure() == structure);
+ Node* base = cellConstantWithStructureCheck(globalObject, structure);
</ins><span class="cx"> addToGraph(Phantom, get(VirtualRegister(scope)));
</span><span class="cx"> handlePutByOffset(base, identifierNumber, static_cast<PropertyOffset>(operand), get(VirtualRegister(value)));
</span><span class="cx"> // Keep scope alive until after put.
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGClobberizeh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGClobberize.h (171659 => 171660)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGClobberize.h 2014-07-27 21:07:24 UTC (rev 171659)
+++ trunk/Source/JavaScriptCore/dfg/DFGClobberize.h 2014-07-27 23:14:40 UTC (rev 171660)
</span><span class="lines">@@ -440,7 +440,6 @@
</span><span class="cx"> return;
</span><span class="cx">
</span><span class="cx"> case PutStructure:
</span><del>- case PhantomPutStructure:
</del><span class="cx"> write(JSCell_structureID);
</span><span class="cx"> write(JSCell_typeInfoType);
</span><span class="cx"> write(JSCell_typeInfoFlags);
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGConstantFoldingPhasecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGConstantFoldingPhase.cpp (171659 => 171660)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGConstantFoldingPhase.cpp 2014-07-27 21:07:24 UTC (rev 171659)
+++ trunk/Source/JavaScriptCore/dfg/DFGConstantFoldingPhase.cpp 2014-07-27 23:14:40 UTC (rev 171660)
</span><span class="lines">@@ -132,6 +132,15 @@
</span><span class="cx"> break;
</span><span class="cx"> }
</span><span class="cx">
</span><ins>+ case PutStructure: {
+ if (m_state.forNode(node->child1()).m_structure.onlyStructure() != node->transition()->next)
+ break;
+
+ node->convertToPhantom();
+ eliminated = true;
+ break;
+ }
+
</ins><span class="cx"> case CheckFunction: {
</span><span class="cx"> if (m_state.forNode(node->child1()).value() != node->function()->value())
</span><span class="cx"> break;
</span><span class="lines">@@ -154,47 +163,69 @@
</span><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> case MultiGetByOffset: {
</span><del>- Edge childEdge = node->child1();
- Node* child = childEdge.node();
</del><ins>+ Edge baseEdge = node->child1();
+ Node* base = baseEdge.node();
</ins><span class="cx"> MultiGetByOffsetData& data = node->multiGetByOffsetData();
</span><span class="cx">
</span><del>- Structure* structure = m_state.forNode(child).m_structure.onlyStructure();
- if (!structure)
</del><ins>+ // First prune the variants, then check if the MultiGetByOffset can be
+ // strength-reduced to a GetByOffset.
+
+ AbstractValue baseValue = m_state.forNode(base);
+
+ m_interpreter.execute(indexInBlock); // Push CFA over this node after we get the state before.
+ eliminated = true; // Don't allow the default constant folder to do things to this.
+
+ for (unsigned i = 0; i < data.variants.size(); ++i) {
+ GetByIdVariant& variant = data.variants[i];
+ variant.structureSet().filter(baseValue);
+ if (variant.structureSet().isEmpty()) {
+ data.variants[i--] = data.variants.last();
+ data.variants.removeLast();
+ }
+ }
+
+ if (data.variants.size() != 1)
</ins><span class="cx"> break;
</span><span class="cx">
</span><del>- for (unsigned i = data.variants.size(); i--;) {
- const GetByIdVariant& variant = data.variants[i];
- if (!variant.structureSet().contains(structure))
- continue;
-
- if (variant.alternateBase())
- break;
-
- emitGetByOffset(indexInBlock, node, structure, variant, data.identifierNumber);
- eliminated = true;
- break;
- }
</del><ins>+ emitGetByOffset(
+ indexInBlock, node, baseValue, data.variants[0], data.identifierNumber);
</ins><span class="cx"> break;
</span><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> case MultiPutByOffset: {
</span><del>- Edge childEdge = node->child1();
- Node* child = childEdge.node();
</del><ins>+ Edge baseEdge = node->child1();
+ Node* base = baseEdge.node();
</ins><span class="cx"> MultiPutByOffsetData& data = node->multiPutByOffsetData();
</span><ins>+
+ AbstractValue baseValue = m_state.forNode(base);
</ins><span class="cx">
</span><del>- Structure* structure = m_state.forNode(child).m_structure.onlyStructure();
- if (!structure)
- break;
</del><ins>+ m_interpreter.execute(indexInBlock); // Push CFA over this node after we get the state before.
+ eliminated = true; // Don't allow the default constant folder to do things to this.
</ins><span class="cx">
</span><del>- for (unsigned i = data.variants.size(); i--;) {
- const PutByIdVariant& variant = data.variants[i];
- if (variant.oldStructure() != structure)
</del><ins>+
+ for (unsigned i = 0; i < data.variants.size(); ++i) {
+ PutByIdVariant& variant = data.variants[i];
+ variant.oldStructure().filter(baseValue);
+
+ if (variant.oldStructure().isEmpty()) {
+ data.variants[i--] = data.variants.last();
+ data.variants.removeLast();
</ins><span class="cx"> continue;
</span><ins>+ }
</ins><span class="cx">
</span><del>- emitPutByOffset(indexInBlock, node, structure, variant, data.identifierNumber);
- eliminated = true;
</del><ins>+ if (variant.kind() == PutByIdVariant::Transition
+ && variant.oldStructure().onlyStructure() == variant.newStructure()) {
+ variant = PutByIdVariant::replace(
+ variant.oldStructure(),
+ variant.offset());
+ }
+ }
+
+ if (data.variants.size() != 1)
</ins><span class="cx"> break;
</span><del>- }
</del><ins>+
+ emitPutByOffset(
+ indexInBlock, node, baseValue, data.variants[0], data.identifierNumber);
</ins><span class="cx"> break;
</span><span class="cx"> }
</span><span class="cx">
</span><span class="lines">@@ -204,30 +235,47 @@
</span><span class="cx"> Node* child = childEdge.node();
</span><span class="cx"> unsigned identifierNumber = node->identifierNumber();
</span><span class="cx">
</span><del>- if (childEdge.useKind() != CellUse)
</del><ins>+ AbstractValue baseValue = m_state.forNode(child);
+
+ m_interpreter.execute(indexInBlock); // Push CFA over this node after we get the state before.
+ eliminated = true; // Don't allow the default constant folder to do things to this.
+
+ if (baseValue.m_structure.isTop() || baseValue.m_structure.isClobbered()
+ || (node->child1().useKind() == UntypedUse || (baseValue.m_type & ~SpecCell)))
</ins><span class="cx"> break;
</span><span class="cx">
</span><del>- Structure* structure = m_state.forNode(child).m_structure.onlyStructure();
- if (!structure)
</del><ins>+ GetByIdStatus status = GetByIdStatus::computeFor(
+ vm(), baseValue.m_structure.set(), m_graph.identifiers()[identifierNumber]);
+ if (!status.isSimple())
</ins><span class="cx"> break;
</span><del>-
- GetByIdStatus status = GetByIdStatus::computeFor(
- vm(), structure, m_graph.identifiers()[identifierNumber]);
</del><span class="cx">
</span><del>- if (!status.isSimple() || status.numVariants() != 1 ||
- !status[0].constantChecks().isEmpty() || status[0].alternateBase()) {
- // FIXME: We could handle prototype cases.
- // https://bugs.webkit.org/show_bug.cgi?id=110386
</del><ins>+ for (unsigned i = status.numVariants(); i--;) {
+ if (!status[i].constantChecks().isEmpty()
+ || status[i].alternateBase()) {
+ // FIXME: We could handle prototype cases.
+ // https://bugs.webkit.org/show_bug.cgi?id=110386
+ break;
+ }
+ }
+
+ if (status.numVariants() == 1) {
+ emitGetByOffset(indexInBlock, node, baseValue, status[0], identifierNumber);
</ins><span class="cx"> break;
</span><span class="cx"> }
</span><span class="cx">
</span><del>- emitGetByOffset(indexInBlock, node, structure, status[0], identifierNumber);
- eliminated = true;
</del><ins>+ if (!isFTL(m_graph.m_plan.mode))
+ break;
+
+ MultiGetByOffsetData* data = m_graph.m_multiGetByOffsetData.add();
+ data->variants = status.variants();
+ data->identifierNumber = identifierNumber;
+ node->convertToMultiGetByOffset(data);
</ins><span class="cx"> break;
</span><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> case PutById:
</span><del>- case PutByIdDirect: {
</del><ins>+ case PutByIdDirect:
+ case PutByIdFlush: {
</ins><span class="cx"> NodeOrigin origin = node->origin;
</span><span class="cx"> Edge childEdge = node->child1();
</span><span class="cx"> Node* child = childEdge.node();
</span><span class="lines">@@ -235,24 +283,39 @@
</span><span class="cx">
</span><span class="cx"> ASSERT(childEdge.useKind() == CellUse);
</span><span class="cx">
</span><del>- Structure* structure = m_state.forNode(child).m_structure.onlyStructure();
- if (!structure)
</del><ins>+ AbstractValue baseValue = m_state.forNode(child);
+
+ m_interpreter.execute(indexInBlock); // Push CFA over this node after we get the state before.
+ eliminated = true; // Don't allow the default constant folder to do things to this.
+
+ if (baseValue.m_structure.isTop() || baseValue.m_structure.isClobbered())
</ins><span class="cx"> break;
</span><span class="cx">
</span><span class="cx"> PutByIdStatus status = PutByIdStatus::computeFor(
</span><span class="cx"> vm(),
</span><span class="cx"> m_graph.globalObjectFor(origin.semantic),
</span><del>- structure,
</del><ins>+ baseValue.m_structure.set(),
</ins><span class="cx"> m_graph.identifiers()[identifierNumber],
</span><span class="cx"> node->op() == PutByIdDirect);
</span><span class="cx">
</span><span class="cx"> if (!status.isSimple())
</span><span class="cx"> break;
</span><del>- if (status.numVariants() != 1)
</del><ins>+
+ for (unsigned i = status.numVariants(); i--;)
+ addChecks(origin, indexInBlock, status[i].constantChecks());
+
+ if (status.numVariants() == 1) {
+ emitPutByOffset(indexInBlock, node, baseValue, status[0], identifierNumber);
</ins><span class="cx"> break;
</span><ins>+ }
</ins><span class="cx">
</span><del>- emitPutByOffset(indexInBlock, node, structure, status[0], identifierNumber);
- eliminated = true;
</del><ins>+ if (!isFTL(m_graph.m_plan.mode))
+ break;
+
+ MultiPutByOffsetData* data = m_graph.m_multiPutByOffsetData.add();
+ data->variants = status.variants();
+ data->identifierNumber = identifierNumber;
+ node->convertToMultiPutByOffset(data);
</ins><span class="cx"> break;
</span><span class="cx"> }
</span><span class="cx">
</span><span class="lines">@@ -343,33 +406,24 @@
</span><span class="cx"> return changed;
</span><span class="cx"> }
</span><span class="cx">
</span><del>- void emitGetByOffset(unsigned indexInBlock, Node* node, Structure* structure, const GetByIdVariant& variant, unsigned identifierNumber)
</del><ins>+ void emitGetByOffset(unsigned indexInBlock, Node* node, const AbstractValue& baseValue, const GetByIdVariant& variant, unsigned identifierNumber)
</ins><span class="cx"> {
</span><span class="cx"> NodeOrigin origin = node->origin;
</span><span class="cx"> Edge childEdge = node->child1();
</span><span class="cx"> Node* child = childEdge.node();
</span><span class="cx">
</span><del>- bool needsCellCheck = m_state.forNode(child).m_type & ~SpecCell;
</del><ins>+ addBaseCheck(indexInBlock, node, baseValue, variant.structureSet());
</ins><span class="cx">
</span><del>- ASSERT(!variant.alternateBase());
- ASSERT_UNUSED(structure, variant.structureSet().contains(structure));
-
- // Now before we do anything else, push the CFA forward over the GetById
- // and make sure we signal to the loop that it should continue and not
- // do any eliminations.
- m_interpreter.execute(indexInBlock);
-
- if (needsCellCheck) {
- m_insertionSet.insertNode(
- indexInBlock, SpecNone, Phantom, origin, childEdge);
- }
-
</del><span class="cx"> if (variant.specificValue()) {
</span><span class="cx"> m_graph.convertToConstant(node, m_graph.freeze(variant.specificValue()));
</span><span class="cx"> return;
</span><span class="cx"> }
</span><span class="cx">
</span><del>- childEdge.setUseKind(KnownCellUse);
</del><ins>+ if (variant.alternateBase()) {
+ child = m_insertionSet.insertConstant(indexInBlock, origin, variant.alternateBase());
+ childEdge = Edge(child, KnownCellUse);
+ } else
+ childEdge.setUseKind(KnownCellUse);
</ins><span class="cx">
</span><span class="cx"> Edge propertyStorage;
</span><span class="cx">
</span><span class="lines">@@ -388,50 +442,29 @@
</span><span class="cx"> m_graph.m_storageAccessData.append(storageAccessData);
</span><span class="cx"> }
</span><span class="cx">
</span><del>- void emitPutByOffset(unsigned indexInBlock, Node* node, Structure* structure, const PutByIdVariant& variant, unsigned identifierNumber)
</del><ins>+ void emitPutByOffset(unsigned indexInBlock, Node* node, const AbstractValue& baseValue, const PutByIdVariant& variant, unsigned identifierNumber)
</ins><span class="cx"> {
</span><span class="cx"> NodeOrigin origin = node->origin;
</span><span class="cx"> Edge childEdge = node->child1();
</span><del>- Node* child = childEdge.node();
-
- ASSERT(variant.oldStructure() == structure);
</del><span class="cx">
</span><del>- bool needsCellCheck = m_state.forNode(child).m_type & ~SpecCell;
-
- // Now before we do anything else, push the CFA forward over the PutById
- // and make sure we signal to the loop that it should continue and not
- // do any eliminations.
- m_interpreter.execute(indexInBlock);
</del><ins>+ addBaseCheck(indexInBlock, node, baseValue, variant.oldStructure());
</ins><span class="cx">
</span><del>- if (needsCellCheck) {
- m_insertionSet.insertNode(
- indexInBlock, SpecNone, Phantom, origin, childEdge);
- }
-
</del><span class="cx"> childEdge.setUseKind(KnownCellUse);
</span><span class="cx">
</span><span class="cx"> Transition* transition = 0;
</span><span class="cx"> if (variant.kind() == PutByIdVariant::Transition) {
</span><del>- transition = m_graph.m_transitions.add(structure, variant.newStructure());
-
- for (unsigned i = 0; i < variant.constantChecks().size(); ++i) {
- addStructureTransitionCheck(
- origin, indexInBlock,
- variant.constantChecks()[i].constant(),
- variant.constantChecks()[i].structure());
- }
</del><ins>+ transition = m_graph.m_transitions.add(
+ variant.oldStructureForTransition(), variant.newStructure());
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> Edge propertyStorage;
</span><span class="cx">
</span><span class="cx"> if (isInlineOffset(variant.offset()))
</span><span class="cx"> propertyStorage = childEdge;
</span><del>- else if (
- variant.kind() == PutByIdVariant::Replace
- || structure->outOfLineCapacity() == variant.newStructure()->outOfLineCapacity()) {
</del><ins>+ else if (!variant.reallocatesStorage()) {
</ins><span class="cx"> propertyStorage = Edge(m_insertionSet.insertNode(
</span><span class="cx"> indexInBlock, SpecNone, GetButterfly, origin, childEdge));
</span><del>- } else if (!structure->outOfLineCapacity()) {
</del><ins>+ } else if (!variant.oldStructureForTransition()->outOfLineCapacity()) {
</ins><span class="cx"> ASSERT(variant.newStructure()->outOfLineCapacity());
</span><span class="cx"> ASSERT(!isInlineOffset(variant.offset()));
</span><span class="cx"> Node* allocatePropertyStorage = m_insertionSet.insertNode(
</span><span class="lines">@@ -440,8 +473,8 @@
</span><span class="cx"> m_insertionSet.insertNode(indexInBlock, SpecNone, StoreBarrier, origin, Edge(node->child1().node(), KnownCellUse));
</span><span class="cx"> propertyStorage = Edge(allocatePropertyStorage);
</span><span class="cx"> } else {
</span><del>- ASSERT(structure->outOfLineCapacity());
- ASSERT(variant.newStructure()->outOfLineCapacity() > structure->outOfLineCapacity());
</del><ins>+ ASSERT(variant.oldStructureForTransition()->outOfLineCapacity());
+ ASSERT(variant.newStructure()->outOfLineCapacity() > variant.oldStructureForTransition()->outOfLineCapacity());
</ins><span class="cx"> ASSERT(!isInlineOffset(variant.offset()));
</span><span class="cx">
</span><span class="cx"> Node* reallocatePropertyStorage = m_insertionSet.insertNode(
</span><span class="lines">@@ -469,6 +502,34 @@
</span><span class="cx"> storageAccessData.identifierNumber = identifierNumber;
</span><span class="cx"> m_graph.m_storageAccessData.append(storageAccessData);
</span><span class="cx"> }
</span><ins>+
+ void addBaseCheck(
+ unsigned indexInBlock, Node* node, const AbstractValue& baseValue, const StructureSet& set)
+ {
+ if (!baseValue.m_structure.isSubsetOf(set)) {
+ // Arises when we prune MultiGetByOffset. We could have a
+ // MultiGetByOffset with a single variant that checks for structure S,
+ // and the input has structures S and T, for example.
+ m_insertionSet.insertNode(
+ indexInBlock, SpecNone, CheckStructure, node->origin,
+ OpInfo(m_graph.addStructureSet(set)), node->child1());
+ return;
+ }
+
+ if (baseValue.m_type & ~SpecCell) {
+ m_insertionSet.insertNode(
+ indexInBlock, SpecNone, Phantom, node->origin, node->child1());
+ }
+ }
+
+ void addChecks(
+ NodeOrigin origin, unsigned indexInBlock, const ConstantStructureCheckVector& checks)
+ {
+ for (unsigned i = 0; i < checks.size(); ++i) {
+ addStructureTransitionCheck(
+ origin, indexInBlock, checks[i].constant(), checks[i].structure());
+ }
+ }
</ins><span class="cx">
</span><span class="cx"> void addStructureTransitionCheck(NodeOrigin origin, unsigned indexInBlock, JSCell* cell, Structure* structure)
</span><span class="cx"> {
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGDoesGCcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGDoesGC.cpp (171659 => 171660)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGDoesGC.cpp 2014-07-27 21:07:24 UTC (rev 171659)
+++ trunk/Source/JavaScriptCore/dfg/DFGDoesGC.cpp 2014-07-27 23:14:40 UTC (rev 171660)
</span><span class="lines">@@ -186,7 +186,6 @@
</span><span class="cx"> case PutByVal:
</span><span class="cx"> case PutByValAlias:
</span><span class="cx"> case PutStructure:
</span><del>- case PhantomPutStructure:
</del><span class="cx"> case GetByOffset:
</span><span class="cx"> case GetGetterSetterByOffset:
</span><span class="cx"> case PutByOffset:
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGFixupPhasecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGFixupPhase.cpp (171659 => 171660)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGFixupPhase.cpp 2014-07-27 21:07:24 UTC (rev 171659)
+++ trunk/Source/JavaScriptCore/dfg/DFGFixupPhase.cpp 2014-07-27 23:14:40 UTC (rev 171660)
</span><span class="lines">@@ -980,7 +980,6 @@
</span><span class="cx"> case Phi:
</span><span class="cx"> case Upsilon:
</span><span class="cx"> case GetArgument:
</span><del>- case PhantomPutStructure:
</del><span class="cx"> case GetIndexedPropertyStorage:
</span><span class="cx"> case GetTypedArrayByteOffset:
</span><span class="cx"> case LastNodeType:
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGGraphcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGGraph.cpp (171659 => 171660)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGGraph.cpp 2014-07-27 21:07:24 UTC (rev 171659)
+++ trunk/Source/JavaScriptCore/dfg/DFGGraph.cpp 2014-07-27 23:14:40 UTC (rev 171660)
</span><span class="lines">@@ -889,7 +889,6 @@
</span><span class="cx"> break;
</span><span class="cx">
</span><span class="cx"> case PutStructure:
</span><del>- case PhantomPutStructure:
</del><span class="cx"> case AllocatePropertyStorage:
</span><span class="cx"> case ReallocatePropertyStorage:
</span><span class="cx"> visitor.appendUnbarrieredReadOnlyPointer(
</span><span class="lines">@@ -917,7 +916,9 @@
</span><span class="cx"> case MultiPutByOffset:
</span><span class="cx"> for (unsigned i = node->multiPutByOffsetData().variants.size(); i--;) {
</span><span class="cx"> PutByIdVariant& variant = node->multiPutByOffsetData().variants[i];
</span><del>- visitor.appendUnbarrieredReadOnlyPointer(variant.oldStructure());
</del><ins>+ const StructureSet& set = variant.oldStructure();
+ for (unsigned j = set.size(); j--;)
+ visitor.appendUnbarrieredReadOnlyPointer(set[j]);
</ins><span class="cx"> if (variant.kind() == PutByIdVariant::Transition)
</span><span class="cx"> visitor.appendUnbarrieredReadOnlyPointer(variant.newStructure());
</span><span class="cx"> }
</span><span class="lines">@@ -951,7 +952,7 @@
</span><span class="cx">
</span><span class="cx"> FrozenValue* Graph::freezeStrong(JSValue value)
</span><span class="cx"> {
</span><del>- FrozenValue* result = freeze(value);
</del><ins>+ FrozenValue* result = freezeFragile(value);
</ins><span class="cx"> result->strengthenTo(StrongValue);
</span><span class="cx"> return result;
</span><span class="cx"> }
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGGraphh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGGraph.h (171659 => 171660)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGGraph.h 2014-07-27 21:07:24 UTC (rev 171659)
+++ trunk/Source/JavaScriptCore/dfg/DFGGraph.h 2014-07-27 23:14:40 UTC (rev 171660)
</span><span class="lines">@@ -147,8 +147,8 @@
</span><span class="cx"> void dethread();
</span><span class="cx">
</span><span class="cx"> FrozenValue* freezeFragile(JSValue value);
</span><del>- FrozenValue* freeze(JSValue value); // We use weak freezing by default.
- FrozenValue* freezeStrong(JSValue value); // Shorthand for freeze(value)->markStrongly().
</del><ins>+ FrozenValue* freeze(JSValue value); // We use weak freezing by default. Shorthand for freezeFragile(value)->strengthenTo(WeakValue);
+ FrozenValue* freezeStrong(JSValue value); // Shorthand for freezeFragile(value)->strengthenTo(StrongValue).
</ins><span class="cx">
</span><span class="cx"> void convertToConstant(Node* node, FrozenValue* value);
</span><span class="cx"> void convertToConstant(Node* node, JSValue value);
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGNodecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGNode.cpp (171659 => 171660)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGNode.cpp 2014-07-27 21:07:24 UTC (rev 171659)
+++ trunk/Source/JavaScriptCore/dfg/DFGNode.cpp 2014-07-27 23:14:40 UTC (rev 171660)
</span><span class="lines">@@ -37,7 +37,7 @@
</span><span class="cx"> bool MultiPutByOffsetData::writesStructures() const
</span><span class="cx"> {
</span><span class="cx"> for (unsigned i = variants.size(); i--;) {
</span><del>- if (variants[i].kind() == PutByIdVariant::Transition)
</del><ins>+ if (variants[i].writesStructures())
</ins><span class="cx"> return true;
</span><span class="cx"> }
</span><span class="cx"> return false;
</span><span class="lines">@@ -46,14 +46,8 @@
</span><span class="cx"> bool MultiPutByOffsetData::reallocatesStorage() const
</span><span class="cx"> {
</span><span class="cx"> for (unsigned i = variants.size(); i--;) {
</span><del>- if (variants[i].kind() != PutByIdVariant::Transition)
- continue;
-
- if (variants[i].oldStructure()->outOfLineCapacity() ==
- variants[i].newStructure()->outOfLineCapacity())
- continue;
-
- return true;
</del><ins>+ if (variants[i].reallocatesStorage())
+ return true;
</ins><span class="cx"> }
</span><span class="cx"> return false;
</span><span class="cx"> }
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGNodeh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGNode.h (171659 => 171660)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGNode.h 2014-07-27 21:07:24 UTC (rev 171659)
+++ trunk/Source/JavaScriptCore/dfg/DFGNode.h 2014-07-27 23:14:40 UTC (rev 171660)
</span><span class="lines">@@ -458,9 +458,18 @@
</span><span class="cx"> m_flags &= ~NodeClobbersWorld;
</span><span class="cx"> }
</span><span class="cx">
</span><ins>+ void convertToMultiGetByOffset(MultiGetByOffsetData* data)
+ {
+ ASSERT(m_op == GetById || m_op == GetByIdFlush);
+ m_opInfo = bitwise_cast<intptr_t>(data);
+ child1().setUseKind(CellUse);
+ m_op = MultiGetByOffset;
+ m_flags &= ~NodeClobbersWorld;
+ }
+
</ins><span class="cx"> void convertToPutByOffset(unsigned storageAccessDataIndex, Edge storage)
</span><span class="cx"> {
</span><del>- ASSERT(m_op == PutById || m_op == PutByIdDirect || m_op == MultiPutByOffset);
</del><ins>+ ASSERT(m_op == PutById || m_op == PutByIdDirect || m_op == PutByIdFlush || m_op == MultiPutByOffset);
</ins><span class="cx"> m_opInfo = storageAccessDataIndex;
</span><span class="cx"> children.setChild3(children.child2());
</span><span class="cx"> children.setChild2(children.child1());
</span><span class="lines">@@ -469,6 +478,14 @@
</span><span class="cx"> m_flags &= ~NodeClobbersWorld;
</span><span class="cx"> }
</span><span class="cx">
</span><ins>+ void convertToMultiPutByOffset(MultiPutByOffsetData* data)
+ {
+ ASSERT(m_op == PutById || m_op == PutByIdDirect || m_op == PutByIdFlush);
+ m_opInfo = bitwise_cast<intptr_t>(data);
+ m_op = MultiPutByOffset;
+ m_flags &= ~NodeClobbersWorld;
+ }
+
</ins><span class="cx"> void convertToPhantomLocal()
</span><span class="cx"> {
</span><span class="cx"> ASSERT(m_op == Phantom && (child1()->op() == Phi || child1()->op() == SetLocal || child1()->op() == SetArgument));
</span><span class="lines">@@ -1107,7 +1124,6 @@
</span><span class="cx"> {
</span><span class="cx"> switch (op()) {
</span><span class="cx"> case PutStructure:
</span><del>- case PhantomPutStructure:
</del><span class="cx"> case AllocatePropertyStorage:
</span><span class="cx"> case ReallocatePropertyStorage:
</span><span class="cx"> return true;
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGNodeTypeh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGNodeType.h (171659 => 171660)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGNodeType.h 2014-07-27 21:07:24 UTC (rev 171659)
+++ trunk/Source/JavaScriptCore/dfg/DFGNodeType.h 2014-07-27 23:14:40 UTC (rev 171660)
</span><span class="lines">@@ -155,7 +155,6 @@
</span><span class="cx"> macro(CheckStructure, NodeMustGenerate) \
</span><span class="cx"> macro(CheckExecutable, NodeMustGenerate) \
</span><span class="cx"> macro(PutStructure, NodeMustGenerate) \
</span><del>- macro(PhantomPutStructure, NodeMustGenerate) \
</del><span class="cx"> macro(AllocatePropertyStorage, NodeMustGenerate | NodeResultStorage) \
</span><span class="cx"> macro(ReallocatePropertyStorage, NodeMustGenerate | NodeResultStorage) \
</span><span class="cx"> macro(GetButterfly, NodeResultStorage) \
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGPredictionPropagationPhasecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGPredictionPropagationPhase.cpp (171659 => 171660)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGPredictionPropagationPhase.cpp 2014-07-27 21:07:24 UTC (rev 171659)
+++ trunk/Source/JavaScriptCore/dfg/DFGPredictionPropagationPhase.cpp 2014-07-27 23:14:40 UTC (rev 171660)
</span><span class="lines">@@ -540,7 +540,6 @@
</span><span class="cx"> case GetLocalUnlinked:
</span><span class="cx"> case GetMyArgumentsLength:
</span><span class="cx"> case GetMyArgumentByVal:
</span><del>- case PhantomPutStructure:
</del><span class="cx"> case PhantomArguments:
</span><span class="cx"> case CheckArray:
</span><span class="cx"> case Arrayify:
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGSafeToExecuteh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGSafeToExecute.h (171659 => 171660)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGSafeToExecute.h 2014-07-27 21:07:24 UTC (rev 171659)
+++ trunk/Source/JavaScriptCore/dfg/DFGSafeToExecute.h 2014-07-27 23:14:40 UTC (rev 171660)
</span><span class="lines">@@ -283,7 +283,6 @@
</span><span class="cx"> graph, node, state.forNode(graph.varArgChild(node, 0)));
</span><span class="cx">
</span><span class="cx"> case PutStructure:
</span><del>- case PhantomPutStructure:
</del><span class="cx"> case AllocatePropertyStorage:
</span><span class="cx"> case ReallocatePropertyStorage:
</span><span class="cx"> return state.forNode(node->child1()).m_structure.isSubsetOf(
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGSpeculativeJITcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp (171659 => 171660)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp 2014-07-27 21:07:24 UTC (rev 171659)
+++ trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp 2014-07-27 23:14:40 UTC (rev 171660)
</span><span class="lines">@@ -343,7 +343,6 @@
</span><span class="cx"> } else if (registerFormat == DataFormatCell) {
</span><span class="cx"> ASSERT(info.gpr() == source);
</span><span class="cx"> if (node->hasConstant()) {
</span><del>- DFG_ASSERT(m_jit.graph(), m_currentNode, node->isCellConstant());
</del><span class="cx"> node->asCell(); // To get the assertion.
</span><span class="cx"> fillAction = SetCellConstant;
</span><span class="cx"> } else {
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGSpeculativeJIT32_64cpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp (171659 => 171660)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp 2014-07-27 21:07:24 UTC (rev 171659)
+++ trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp 2014-07-27 23:14:40 UTC (rev 171660)
</span><span class="lines">@@ -867,15 +867,6 @@
</span><span class="cx"> m_interpreter.filter(value, SpecCell);
</span><span class="cx"> VirtualRegister virtualRegister = edge->virtualRegister();
</span><span class="cx"> GenerationInfo& info = generationInfoFromVirtualRegister(virtualRegister);
</span><del>-
- if (edge->hasConstant() && !edge->isCellConstant()) {
- // Protect the silent spill/fill logic by failing early. If we "speculate" on
- // the constant then the silent filler may think that we have a cell and a
- // constant, so it will try to fill this as an cell constant. Bad things will
- // happen.
- terminateSpeculativeExecution(Uncountable, JSValueRegs(), 0);
- return allocate();
- }
</del><span class="cx">
</span><span class="cx"> switch (info.registerFormat()) {
</span><span class="cx"> case DataFormatNone: {
</span><span class="lines">@@ -887,9 +878,13 @@
</span><span class="cx"> if (edge->hasConstant()) {
</span><span class="cx"> JSValue jsValue = edge->asJSValue();
</span><span class="cx"> GPRReg gpr = allocate();
</span><del>- m_gprs.retain(gpr, virtualRegister, SpillOrderConstant);
- m_jit.move(MacroAssembler::TrustedImmPtr(jsValue.asCell()), gpr);
- info.fillCell(*m_stream, gpr);
</del><ins>+ if (jsValue.isCell()) {
+ m_gprs.retain(gpr, virtualRegister, SpillOrderConstant);
+ m_jit.move(MacroAssembler::TrustedImmPtr(jsValue.asCell()), gpr);
+ info.fillCell(*m_stream, gpr);
+ return gpr;
+ }
+ terminateSpeculativeExecution(Uncountable, JSValueRegs(), 0);
</ins><span class="cx"> return gpr;
</span><span class="cx"> }
</span><span class="cx">
</span><span class="lines">@@ -3739,13 +3734,6 @@
</span><span class="cx"> break;
</span><span class="cx"> }
</span><span class="cx">
</span><del>- case PhantomPutStructure: {
- ASSERT(isKnownCell(node->child1().node()));
- m_jit.jitCode()->common.notifyCompilingStructureTransition(m_jit.graph().m_plan, m_jit.codeBlock(), node);
- noResult(node);
- break;
- }
-
</del><span class="cx"> case PutStructure: {
</span><span class="cx"> Structure* oldStructure = node->transition()->previous;
</span><span class="cx"> Structure* newStructure = node->transition()->next;
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGSpeculativeJIT64cpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp (171659 => 171660)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp 2014-07-27 21:07:24 UTC (rev 171659)
+++ trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp 2014-07-27 23:14:40 UTC (rev 171660)
</span><span class="lines">@@ -97,7 +97,7 @@
</span><span class="cx">
</span><span class="cx"> default:
</span><span class="cx"> m_jit.load64(JITCompiler::addressFor(virtualRegister), gpr);
</span><del>- RELEASE_ASSERT(spillFormat & DataFormatJS);
</del><ins>+ DFG_ASSERT(m_jit.graph(), m_currentNode, spillFormat & DataFormatJS);
</ins><span class="cx"> break;
</span><span class="cx"> }
</span><span class="cx"> info.fillJSValue(*m_stream, gpr, spillFormat);
</span><span class="lines">@@ -137,10 +137,10 @@
</span><span class="cx"> case DataFormatDouble:
</span><span class="cx"> case DataFormatInt52:
</span><span class="cx"> // this type currently never occurs
</span><del>- RELEASE_ASSERT_NOT_REACHED();
</del><ins>+ DFG_CRASH(m_jit.graph(), m_currentNode, "Bad data format");
</ins><span class="cx">
</span><span class="cx"> default:
</span><del>- RELEASE_ASSERT_NOT_REACHED();
</del><ins>+ DFG_CRASH(m_jit.graph(), m_currentNode, "Corrupt data format");
</ins><span class="cx"> return InvalidGPRReg;
</span><span class="cx"> }
</span><span class="cx"> }
</span><span class="lines">@@ -311,7 +311,7 @@
</span><span class="cx"> if (branchIndexInBlock != UINT_MAX) {
</span><span class="cx"> Node* branchNode = m_block->at(branchIndexInBlock);
</span><span class="cx">
</span><del>- RELEASE_ASSERT(node->adjustedRefCount() == 1);
</del><ins>+ DFG_ASSERT(m_jit.graph(), node, node->adjustedRefCount() == 1);
</ins><span class="cx">
</span><span class="cx"> nonSpeculativePeepholeBranchNull(operand, branchNode, invert);
</span><span class="cx">
</span><span class="lines">@@ -628,8 +628,8 @@
</span><span class="cx">
</span><span class="cx"> bool isCall = node->op() == Call;
</span><span class="cx"> if (!isCall)
</span><del>- RELEASE_ASSERT(node->op() == Construct);
-
</del><ins>+ DFG_ASSERT(m_jit.graph(), node, node->op() == Construct);
+
</ins><span class="cx"> // For constructors, the this argument is not passed but we have to make space
</span><span class="cx"> // for it.
</span><span class="cx"> int dummyThisArgument = isCall ? 0 : 1;
</span><span class="lines">@@ -741,7 +741,7 @@
</span><span class="cx">
</span><span class="cx"> DataFormat spillFormat = info.spillFormat();
</span><span class="cx">
</span><del>- RELEASE_ASSERT((spillFormat & DataFormatJS) || spillFormat == DataFormatInt32);
</del><ins>+ DFG_ASSERT(m_jit.graph(), m_currentNode, (spillFormat & DataFormatJS) || spillFormat == DataFormatInt32);
</ins><span class="cx">
</span><span class="cx"> m_gprs.retain(gpr, virtualRegister, SpillOrderSpilled);
</span><span class="cx">
</span><span class="lines">@@ -771,7 +771,7 @@
</span><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> case DataFormatJS: {
</span><del>- RELEASE_ASSERT(!(type & SpecInt52));
</del><ins>+ DFG_ASSERT(m_jit.graph(), m_currentNode, !(type & SpecInt52));
</ins><span class="cx"> // Check the value is an integer.
</span><span class="cx"> GPRReg gpr = info.gpr();
</span><span class="cx"> m_gprs.lock(gpr);
</span><span class="lines">@@ -834,10 +834,10 @@
</span><span class="cx"> case DataFormatStorage:
</span><span class="cx"> case DataFormatInt52:
</span><span class="cx"> case DataFormatStrictInt52:
</span><del>- RELEASE_ASSERT_NOT_REACHED();
</del><ins>+ DFG_CRASH(m_jit.graph(), m_currentNode, "Bad data format");
</ins><span class="cx">
</span><span class="cx"> default:
</span><del>- RELEASE_ASSERT_NOT_REACHED();
</del><ins>+ DFG_CRASH(m_jit.graph(), m_currentNode, "Corrupt data format");
</ins><span class="cx"> return InvalidGPRReg;
</span><span class="cx"> }
</span><span class="cx"> }
</span><span class="lines">@@ -854,7 +854,7 @@
</span><span class="cx"> {
</span><span class="cx"> DataFormat mustBeDataFormatInt32;
</span><span class="cx"> GPRReg result = fillSpeculateInt32Internal<true>(edge, mustBeDataFormatInt32);
</span><del>- RELEASE_ASSERT(mustBeDataFormatInt32 == DataFormatInt32);
</del><ins>+ DFG_ASSERT(m_jit.graph(), m_currentNode, mustBeDataFormatInt32 == DataFormatInt32);
</ins><span class="cx"> return result;
</span><span class="cx"> }
</span><span class="cx">
</span><span class="lines">@@ -889,7 +889,7 @@
</span><span class="cx">
</span><span class="cx"> DataFormat spillFormat = info.spillFormat();
</span><span class="cx">
</span><del>- RELEASE_ASSERT(spillFormat == DataFormatInt52 || spillFormat == DataFormatStrictInt52);
</del><ins>+ DFG_ASSERT(m_jit.graph(), m_currentNode, spillFormat == DataFormatInt52 || spillFormat == DataFormatStrictInt52);
</ins><span class="cx">
</span><span class="cx"> m_gprs.retain(gpr, virtualRegister, SpillOrderSpilled);
</span><span class="cx">
</span><span class="lines">@@ -941,7 +941,7 @@
</span><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> default:
</span><del>- RELEASE_ASSERT_NOT_REACHED();
</del><ins>+ DFG_CRASH(m_jit.graph(), m_currentNode, "Bad data format");
</ins><span class="cx"> return InvalidGPRReg;
</span><span class="cx"> }
</span><span class="cx"> }
</span><span class="lines">@@ -972,7 +972,7 @@
</span><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> DataFormat spillFormat = info.spillFormat();
</span><del>- RELEASE_ASSERT(spillFormat == DataFormatDouble);
</del><ins>+ DFG_ASSERT(m_jit.graph(), m_currentNode, spillFormat == DataFormatDouble);
</ins><span class="cx"> FPRReg fpr = fprAllocate();
</span><span class="cx"> m_jit.loadDouble(JITCompiler::addressFor(virtualRegister), fpr);
</span><span class="cx"> m_fprs.retain(fpr, virtualRegister, SpillOrderDouble);
</span><span class="lines">@@ -980,7 +980,7 @@
</span><span class="cx"> return fpr;
</span><span class="cx"> }
</span><span class="cx">
</span><del>- RELEASE_ASSERT(info.registerFormat() == DataFormatDouble);
</del><ins>+ DFG_ASSERT(m_jit.graph(), m_currentNode, info.registerFormat() == DataFormatDouble);
</ins><span class="cx"> FPRReg fpr = info.fpr();
</span><span class="cx"> m_fprs.lock(fpr);
</span><span class="cx"> return fpr;
</span><span class="lines">@@ -995,21 +995,19 @@
</span><span class="cx"> VirtualRegister virtualRegister = edge->virtualRegister();
</span><span class="cx"> GenerationInfo& info = generationInfoFromVirtualRegister(virtualRegister);
</span><span class="cx">
</span><del>- if (edge->hasConstant() && !edge->isCellConstant()) {
- // Better to fail early on constants.
- terminateSpeculativeExecution(Uncountable, JSValueRegs(), 0);
- return allocate();
- }
-
</del><span class="cx"> switch (info.registerFormat()) {
</span><span class="cx"> case DataFormatNone: {
</span><span class="cx"> GPRReg gpr = allocate();
</span><span class="cx">
</span><span class="cx"> if (edge->hasConstant()) {
</span><span class="cx"> JSValue jsValue = edge->asJSValue();
</span><del>- m_gprs.retain(gpr, virtualRegister, SpillOrderConstant);
- m_jit.move(MacroAssembler::TrustedImm64(JSValue::encode(jsValue)), gpr);
- info.fillJSValue(*m_stream, gpr, DataFormatJSCell);
</del><ins>+ if (jsValue.isCell()) {
+ m_gprs.retain(gpr, virtualRegister, SpillOrderConstant);
+ m_jit.move(MacroAssembler::TrustedImm64(JSValue::encode(jsValue)), gpr);
+ info.fillJSValue(*m_stream, gpr, DataFormatJSCell);
+ return gpr;
+ }
+ terminateSpeculativeExecution(Uncountable, JSValueRegs(), 0);
</ins><span class="cx"> return gpr;
</span><span class="cx"> }
</span><span class="cx">
</span><span class="lines">@@ -1062,10 +1060,10 @@
</span><span class="cx"> case DataFormatStorage:
</span><span class="cx"> case DataFormatInt52:
</span><span class="cx"> case DataFormatStrictInt52:
</span><del>- RELEASE_ASSERT_NOT_REACHED();
</del><ins>+ DFG_CRASH(m_jit.graph(), m_currentNode, "Bad data format");
</ins><span class="cx">
</span><span class="cx"> default:
</span><del>- RELEASE_ASSERT_NOT_REACHED();
</del><ins>+ DFG_CRASH(m_jit.graph(), m_currentNode, "Corrupt data format");
</ins><span class="cx"> return InvalidGPRReg;
</span><span class="cx"> }
</span><span class="cx"> }
</span><span class="lines">@@ -1098,7 +1096,7 @@
</span><span class="cx"> terminateSpeculativeExecution(Uncountable, JSValueRegs(), 0);
</span><span class="cx"> return gpr;
</span><span class="cx"> }
</span><del>- RELEASE_ASSERT(info.spillFormat() & DataFormatJS);
</del><ins>+ DFG_ASSERT(m_jit.graph(), m_currentNode, info.spillFormat() & DataFormatJS);
</ins><span class="cx"> m_gprs.retain(gpr, virtualRegister, SpillOrderSpilled);
</span><span class="cx"> m_jit.load64(JITCompiler::addressFor(virtualRegister), gpr);
</span><span class="cx">
</span><span class="lines">@@ -1143,10 +1141,10 @@
</span><span class="cx"> case DataFormatStorage:
</span><span class="cx"> case DataFormatInt52:
</span><span class="cx"> case DataFormatStrictInt52:
</span><del>- RELEASE_ASSERT_NOT_REACHED();
</del><ins>+ DFG_CRASH(m_jit.graph(), m_currentNode, "Bad data format");
</ins><span class="cx">
</span><span class="cx"> default:
</span><del>- RELEASE_ASSERT_NOT_REACHED();
</del><ins>+ DFG_CRASH(m_jit.graph(), m_currentNode, "Corrupt data format");
</ins><span class="cx"> return InvalidGPRReg;
</span><span class="cx"> }
</span><span class="cx"> }
</span><span class="lines">@@ -1610,7 +1608,7 @@
</span><span class="cx"> return compileStringZeroLength(node);
</span><span class="cx">
</span><span class="cx"> default:
</span><del>- RELEASE_ASSERT_NOT_REACHED();
</del><ins>+ DFG_CRASH(m_jit.graph(), node, "Bad use kind");
</ins><span class="cx"> break;
</span><span class="cx"> }
</span><span class="cx"> }
</span><span class="lines">@@ -1765,7 +1763,7 @@
</span><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> default:
</span><del>- RELEASE_ASSERT_NOT_REACHED();
</del><ins>+ DFG_CRASH(m_jit.graph(), m_currentNode, "Bad use kind");
</ins><span class="cx"> }
</span><span class="cx"> }
</span><span class="cx">
</span><span class="lines">@@ -1790,7 +1788,7 @@
</span><span class="cx">
</span><span class="cx"> case Identity: {
</span><span class="cx"> // CSE should always eliminate this.
</span><del>- RELEASE_ASSERT_NOT_REACHED();
</del><ins>+ DFG_CRASH(m_jit.graph(), node, "Unexpected Identity node");
</ins><span class="cx"> break;
</span><span class="cx"> }
</span><span class="cx">
</span><span class="lines">@@ -1871,7 +1869,7 @@
</span><span class="cx"> case MovHint:
</span><span class="cx"> case ZombieHint:
</span><span class="cx"> case Check: {
</span><del>- RELEASE_ASSERT_NOT_REACHED();
</del><ins>+ DFG_CRASH(m_jit.graph(), node, "Unexpected node");
</ins><span class="cx"> break;
</span><span class="cx"> }
</span><span class="cx">
</span><span class="lines">@@ -1931,7 +1929,7 @@
</span><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> default:
</span><del>- RELEASE_ASSERT_NOT_REACHED();
</del><ins>+ DFG_CRASH(m_jit.graph(), node, "Bad flush format");
</ins><span class="cx"> break;
</span><span class="cx"> }
</span><span class="cx">
</span><span class="lines">@@ -2069,7 +2067,7 @@
</span><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> default:
</span><del>- RELEASE_ASSERT_NOT_REACHED();
</del><ins>+ DFG_CRASH(m_jit.graph(), node, "Bad use kind");
</ins><span class="cx"> }
</span><span class="cx"> break;
</span><span class="cx"> }
</span><span class="lines">@@ -2149,7 +2147,7 @@
</span><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> default:
</span><del>- RELEASE_ASSERT_NOT_REACHED();
</del><ins>+ DFG_CRASH(m_jit.graph(), node, "Bad use kind");
</ins><span class="cx"> break;
</span><span class="cx"> }
</span><span class="cx"> break;
</span><span class="lines">@@ -2216,7 +2214,7 @@
</span><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> default:
</span><del>- RELEASE_ASSERT_NOT_REACHED();
</del><ins>+ DFG_CRASH(m_jit.graph(), node, "Bad use kind");
</ins><span class="cx"> break;
</span><span class="cx"> }
</span><span class="cx"> break;
</span><span class="lines">@@ -2338,8 +2336,7 @@
</span><span class="cx"> switch (node->arrayMode().type()) {
</span><span class="cx"> case Array::SelectUsingPredictions:
</span><span class="cx"> case Array::ForceExit:
</span><del>- RELEASE_ASSERT_NOT_REACHED();
- terminateSpeculativeExecution(InadequateCoverage, JSValueRegs(), 0);
</del><ins>+ DFG_CRASH(m_jit.graph(), node, "Bad array mode type");
</ins><span class="cx"> break;
</span><span class="cx"> case Array::Generic: {
</span><span class="cx"> JSValueOperand base(this, node->child1());
</span><span class="lines">@@ -2540,12 +2537,10 @@
</span><span class="cx"> switch (arrayMode.type()) {
</span><span class="cx"> case Array::SelectUsingPredictions:
</span><span class="cx"> case Array::ForceExit:
</span><del>- RELEASE_ASSERT_NOT_REACHED();
- terminateSpeculativeExecution(InadequateCoverage, JSValueRegs(), 0);
- alreadyHandled = true;
</del><ins>+ DFG_CRASH(m_jit.graph(), node, "Bad array mode type");
</ins><span class="cx"> break;
</span><span class="cx"> case Array::Generic: {
</span><del>- RELEASE_ASSERT(node->op() == PutByVal);
</del><ins>+ DFG_ASSERT(m_jit.graph(), node, node->op() == PutByVal);
</ins><span class="cx">
</span><span class="cx"> JSValueOperand arg1(this, child1);
</span><span class="cx"> JSValueOperand arg2(this, child2);
</span><span class="lines">@@ -3118,14 +3113,14 @@
</span><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> default:
</span><del>- RELEASE_ASSERT_NOT_REACHED();
</del><ins>+ DFG_CRASH(m_jit.graph(), node, "Bad use kind");
</ins><span class="cx"> break;
</span><span class="cx"> }
</span><span class="cx"> break;
</span><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> case ToPrimitive: {
</span><del>- RELEASE_ASSERT(node->child1().useKind() == UntypedUse);
</del><ins>+ DFG_ASSERT(m_jit.graph(), node, node->child1().useKind() == UntypedUse);
</ins><span class="cx"> JSValueOperand op1(this, node->child1());
</span><span class="cx"> GPRTemporary result(this, Reuse, op1);
</span><span class="cx">
</span><span class="lines">@@ -3192,7 +3187,7 @@
</span><span class="cx"> JSGlobalObject* globalObject = m_jit.graph().globalObjectFor(node->origin.semantic);
</span><span class="cx"> if (!globalObject->isHavingABadTime() && !hasAnyArrayStorage(node->indexingType())) {
</span><span class="cx"> Structure* structure = globalObject->arrayStructureForIndexingTypeDuringAllocation(node->indexingType());
</span><del>- RELEASE_ASSERT(structure->indexingType() == node->indexingType());
</del><ins>+ DFG_ASSERT(m_jit.graph(), node, structure->indexingType() == node->indexingType());
</ins><span class="cx"> ASSERT(
</span><span class="cx"> hasUndecided(structure->indexingType())
</span><span class="cx"> || hasInt32(structure->indexingType())
</span><span class="lines">@@ -3443,7 +3438,7 @@
</span><span class="cx">
</span><span class="cx"> emitAllocateJSArray(resultGPR, globalObject->arrayStructureForIndexingTypeDuringAllocation(indexingType), storageGPR, numElements);
</span><span class="cx">
</span><del>- RELEASE_ASSERT(indexingType & IsArray);
</del><ins>+ DFG_ASSERT(m_jit.graph(), node, indexingType & IsArray);
</ins><span class="cx"> JSValue* data = m_jit.codeBlock()->constantBuffer(node->startConstant());
</span><span class="cx"> if (indexingType == ArrayWithDouble) {
</span><span class="cx"> for (unsigned index = 0; index < node->numConstants(); ++index) {
</span><span class="lines">@@ -3497,7 +3492,7 @@
</span><span class="cx"> break;
</span><span class="cx"> }
</span><span class="cx"> default:
</span><del>- RELEASE_ASSERT_NOT_REACHED();
</del><ins>+ DFG_CRASH(m_jit.graph(), node, "Bad use kind");
</ins><span class="cx"> break;
</span><span class="cx"> }
</span><span class="cx"> break;
</span><span class="lines">@@ -3727,7 +3722,7 @@
</span><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> default:
</span><del>- RELEASE_ASSERT_NOT_REACHED();
</del><ins>+ DFG_CRASH(m_jit.graph(), node, "Bad use kind");
</ins><span class="cx"> break;
</span><span class="cx"> }
</span><span class="cx"> break;
</span><span class="lines">@@ -3777,7 +3772,7 @@
</span><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> default:
</span><del>- RELEASE_ASSERT_NOT_REACHED();
</del><ins>+ DFG_CRASH(m_jit.graph(), node, "Bad use kind");
</ins><span class="cx"> break;
</span><span class="cx"> }
</span><span class="cx"> break;
</span><span class="lines">@@ -3837,13 +3832,6 @@
</span><span class="cx"> break;
</span><span class="cx"> }
</span><span class="cx">
</span><del>- case PhantomPutStructure: {
- ASSERT(isKnownCell(node->child1().node()));
- m_jit.jitCode()->common.notifyCompilingStructureTransition(m_jit.graph().m_plan, m_jit.codeBlock(), node);
- noResult(node);
- break;
- }
-
</del><span class="cx"> case PutStructure: {
</span><span class="cx"> Structure* oldStructure = node->transition()->previous;
</span><span class="cx"> Structure* newStructure = node->transition()->next;
</span><span class="lines">@@ -4248,7 +4236,7 @@
</span><span class="cx"> break;
</span><span class="cx">
</span><span class="cx"> case CreateActivation: {
</span><del>- RELEASE_ASSERT(!node->origin.semantic.inlineCallFrame);
</del><ins>+ DFG_ASSERT(m_jit.graph(), node, !node->origin.semantic.inlineCallFrame);
</ins><span class="cx">
</span><span class="cx"> JSValueOperand value(this, node->child1());
</span><span class="cx"> GPRTemporary result(this, Reuse, value);
</span><span class="lines">@@ -4321,7 +4309,7 @@
</span><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> case TearOffActivation: {
</span><del>- RELEASE_ASSERT(!node->origin.semantic.inlineCallFrame);
</del><ins>+ DFG_ASSERT(m_jit.graph(), node, !node->origin.semantic.inlineCallFrame);
</ins><span class="cx">
</span><span class="cx"> JSValueOperand activationValue(this, node->child1());
</span><span class="cx"> GPRTemporary scratch(this);
</span><span class="lines">@@ -4393,7 +4381,7 @@
</span><span class="cx"> m_jit.graph().machineArgumentsRegisterFor(node->origin.semantic))));
</span><span class="cx"> }
</span><span class="cx">
</span><del>- RELEASE_ASSERT(!node->origin.semantic.inlineCallFrame);
</del><ins>+ DFG_ASSERT(m_jit.graph(), node, !node->origin.semantic.inlineCallFrame);
</ins><span class="cx"> m_jit.load32(JITCompiler::payloadFor(JSStack::ArgumentCount), resultGPR);
</span><span class="cx"> m_jit.sub32(TrustedImm32(1), resultGPR);
</span><span class="cx"> int32Result(resultGPR, node);
</span><span class="lines">@@ -4469,7 +4457,7 @@
</span><span class="cx"> JITCompiler::JumpList slowArgument;
</span><span class="cx"> JITCompiler::JumpList slowArgumentOutOfBounds;
</span><span class="cx"> if (m_jit.symbolTableFor(node->origin.semantic)->slowArguments()) {
</span><del>- RELEASE_ASSERT(!node->origin.semantic.inlineCallFrame);
</del><ins>+ DFG_ASSERT(m_jit.graph(), node, !node->origin.semantic.inlineCallFrame);
</ins><span class="cx"> const SlowArgument* slowArguments = m_jit.graph().m_slowArguments.get();
</span><span class="cx">
</span><span class="cx"> slowArgumentOutOfBounds.append(
</span><span class="lines">@@ -4536,7 +4524,7 @@
</span><span class="cx"> JITCompiler::JumpList slowArgument;
</span><span class="cx"> JITCompiler::JumpList slowArgumentOutOfBounds;
</span><span class="cx"> if (m_jit.symbolTableFor(node->origin.semantic)->slowArguments()) {
</span><del>- RELEASE_ASSERT(!node->origin.semantic.inlineCallFrame);
</del><ins>+ DFG_ASSERT(m_jit.graph(), node, !node->origin.semantic.inlineCallFrame);
</ins><span class="cx"> const SlowArgument* slowArguments = m_jit.graph().m_slowArguments.get();
</span><span class="cx">
</span><span class="cx"> slowArgumentOutOfBounds.append(
</span><span class="lines">@@ -4671,7 +4659,7 @@
</span><span class="cx"> break;
</span><span class="cx">
</span><span class="cx"> case Unreachable:
</span><del>- RELEASE_ASSERT_NOT_REACHED();
</del><ins>+ DFG_CRASH(m_jit.graph(), node, "Unexpected Unreachable node");
</ins><span class="cx"> break;
</span><span class="cx">
</span><span class="cx"> case StoreBarrier:
</span><span class="lines">@@ -4739,7 +4727,7 @@
</span><span class="cx"> case CheckTierUpInLoop:
</span><span class="cx"> case CheckTierUpAtReturn:
</span><span class="cx"> case CheckTierUpAndOSREnter:
</span><del>- RELEASE_ASSERT_NOT_REACHED();
</del><ins>+ DFG_CRASH(m_jit.graph(), node, "Unexpected tier-up node");
</ins><span class="cx"> break;
</span><span class="cx"> #endif // ENABLE(FTL_JIT)
</span><span class="cx">
</span><span class="lines">@@ -4755,7 +4743,7 @@
</span><span class="cx"> case MultiGetByOffset:
</span><span class="cx"> case MultiPutByOffset:
</span><span class="cx"> case FiatInt52:
</span><del>- RELEASE_ASSERT_NOT_REACHED();
</del><ins>+ DFG_CRASH(m_jit.graph(), node, "Unexpected FTL node");
</ins><span class="cx"> break;
</span><span class="cx"> }
</span><span class="cx">
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGStructureAbstractValuecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGStructureAbstractValue.cpp (171659 => 171660)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGStructureAbstractValue.cpp 2014-07-27 21:07:24 UTC (rev 171659)
+++ trunk/Source/JavaScriptCore/dfg/DFGStructureAbstractValue.cpp 2014-07-27 23:14:40 UTC (rev 171660)
</span><span class="lines">@@ -83,6 +83,8 @@
</span><span class="cx"> void StructureAbstractValue::observeTransition(Structure* from, Structure* to)
</span><span class="cx"> {
</span><span class="cx"> SAMPLE("StructureAbstractValue observeTransition");
</span><ins>+
+ ASSERT(!from->dfgShouldWatch());
</ins><span class="cx">
</span><span class="cx"> if (isTop())
</span><span class="cx"> return;
</span><span class="lines">@@ -90,11 +92,6 @@
</span><span class="cx"> if (!m_set.contains(from))
</span><span class="cx"> return;
</span><span class="cx">
</span><del>- if (from->dfgShouldWatch()) {
- setClobbered(true);
- return;
- }
-
</del><span class="cx"> if (!m_set.add(to))
</span><span class="cx"> return;
</span><span class="cx">
</span><span class="lines">@@ -111,13 +108,12 @@
</span><span class="cx">
</span><span class="cx"> StructureSet newStructures;
</span><span class="cx"> for (unsigned i = vector.size(); i--;) {
</span><ins>+ ASSERT(!vector[i].previous->dfgShouldWatch());
+
</ins><span class="cx"> if (!m_set.contains(vector[i].previous))
</span><span class="cx"> continue;
</span><span class="cx">
</span><del>- if (vector[i].previous->dfgShouldWatch())
- setClobbered(true);
- else
- newStructures.add(vector[i].next);
</del><ins>+ newStructures.add(vector[i].next);
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> if (!m_set.merge(newStructures))
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGStructureAbstractValueh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGStructureAbstractValue.h (171659 => 171660)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGStructureAbstractValue.h 2014-07-27 21:07:24 UTC (rev 171659)
+++ trunk/Source/JavaScriptCore/dfg/DFGStructureAbstractValue.h 2014-07-27 23:14:40 UTC (rev 171660)
</span><span class="lines">@@ -55,6 +55,18 @@
</span><span class="cx"> setClobbered(other.isClobbered());
</span><span class="cx"> }
</span><span class="cx">
</span><ins>+ ALWAYS_INLINE StructureAbstractValue& operator=(Structure* structure)
+ {
+ m_set = structure;
+ setClobbered(false);
+ return *this;
+ }
+ ALWAYS_INLINE StructureAbstractValue& operator=(const StructureSet& other)
+ {
+ m_set = other;
+ setClobbered(false);
+ return *this;
+ }
</ins><span class="cx"> ALWAYS_INLINE StructureAbstractValue& operator=(const StructureAbstractValue& other)
</span><span class="cx"> {
</span><span class="cx"> m_set = other.m_set;
</span><span class="lines">@@ -149,6 +161,12 @@
</span><span class="cx"> return equalsSlow(other);
</span><span class="cx"> }
</span><span class="cx">
</span><ins>+ const StructureSet& set() const
+ {
+ ASSERT(!isTop());
+ return m_set;
+ }
+
</ins><span class="cx"> size_t size() const
</span><span class="cx"> {
</span><span class="cx"> ASSERT(!isTop());
</span><span class="lines">@@ -163,14 +181,14 @@
</span><span class="cx">
</span><span class="cx"> Structure* operator[](size_t i) const { return at(i); }
</span><span class="cx">
</span><del>- // FIXME: Eliminate all uses of this method. There shouldn't be any
- // special-casing for the one-structure case.
- // https://bugs.webkit.org/show_bug.cgi?id=133229
</del><ins>+ // In most cases, what you really want to do is verify whether the set is top or clobbered, and
+ // if not, enumerate the set of structures. Use this only in cases where the singleton case is
+ // meaningfully special, like for transitions.
</ins><span class="cx"> Structure* onlyStructure() const
</span><span class="cx"> {
</span><del>- if (isTop() || size() != 1)
</del><ins>+ if (isTop() || isClobbered())
</ins><span class="cx"> return nullptr;
</span><del>- return at(0);
</del><ins>+ return m_set.onlyStructure();
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> void dumpInContext(PrintStream&, DumpContext*) const;
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGValidatecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGValidate.cpp (171659 => 171660)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGValidate.cpp 2014-07-27 21:07:24 UTC (rev 171659)
+++ trunk/Source/JavaScriptCore/dfg/DFGValidate.cpp 2014-07-27 23:14:40 UTC (rev 171660)
</span><span class="lines">@@ -233,6 +233,17 @@
</span><span class="cx"> VALIDATE((node), !!node->child1());
</span><span class="cx"> VALIDATE((node), !!node->child2());
</span><span class="cx"> break;
</span><ins>+ case PutStructure:
+ VALIDATE((node), !node->transition()->previous->dfgShouldWatch());
+ break;
+ case MultiPutByOffset:
+ for (unsigned i = node->multiPutByOffsetData().variants.size(); i--;) {
+ const PutByIdVariant& variant = node->multiPutByOffsetData().variants[i];
+ if (variant.kind() != PutByIdVariant::Transition)
+ continue;
+ VALIDATE((node), !variant.oldStructureForTransition()->dfgShouldWatch());
+ }
+ break;
</ins><span class="cx"> default:
</span><span class="cx"> break;
</span><span class="cx"> }
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGWatchableStructureWatchingPhasecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGWatchableStructureWatchingPhase.cpp (171659 => 171660)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGWatchableStructureWatchingPhase.cpp 2014-07-27 21:07:24 UTC (rev 171659)
+++ trunk/Source/JavaScriptCore/dfg/DFGWatchableStructureWatchingPhase.cpp 2014-07-27 23:14:40 UTC (rev 171660)
</span><span class="lines">@@ -77,7 +77,6 @@
</span><span class="cx"> break;
</span><span class="cx">
</span><span class="cx"> case PutStructure:
</span><del>- case PhantomPutStructure:
</del><span class="cx"> case AllocatePropertyStorage:
</span><span class="cx"> case ReallocatePropertyStorage:
</span><span class="cx"> RELEASE_ASSERT(node->transition()->previous->transitionWatchpointSetHasBeenInvalidated());
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreftlFTLAbbreviationsh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/ftl/FTLAbbreviations.h (171659 => 171660)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/ftl/FTLAbbreviations.h 2014-07-27 21:07:24 UTC (rev 171659)
+++ trunk/Source/JavaScriptCore/ftl/FTLAbbreviations.h 2014-07-27 23:14:40 UTC (rev 171660)
</span><span class="lines">@@ -149,8 +149,7 @@
</span><span class="cx"> static inline void addTargetDependentFunctionAttr(LValue function, const char* key, const char* value) { llvm->AddTargetDependentFunctionAttr(function, key, value); }
</span><span class="cx"> static inline void removeFunctionAttr(LValue function, LLVMAttribute pa) { llvm->RemoveFunctionAttr(function, pa); }
</span><span class="cx">
</span><del>-
-
</del><ins>+static inline LLVMLinkage getLinkage(LValue global) { return llvm->GetLinkage(global); }
</ins><span class="cx"> static inline void setLinkage(LValue global, LLVMLinkage linkage) { llvm->SetLinkage(global, linkage); }
</span><span class="cx"> static inline void setVisibility(LValue global, LLVMVisibility viz) { llvm->SetVisibility(global, viz); }
</span><span class="cx"> static inline LLVMBool isDeclaration(LValue global) { return llvm->IsDeclaration(global); }
</span><span class="lines">@@ -163,10 +162,6 @@
</span><span class="cx"> static inline LValue getFirstGlobal(LModule module) { return llvm->GetFirstGlobal(module); }
</span><span class="cx"> static inline LValue getNextGlobal(LValue global) { return llvm->GetNextGlobal(global); }
</span><span class="cx">
</span><del>-
-
-
-
</del><span class="cx"> static inline LValue addExternFunction(LModule module, const char* name, LType type)
</span><span class="cx"> {
</span><span class="cx"> LValue result = addFunction(module, name, type);
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreftlFTLCapabilitiescpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/ftl/FTLCapabilities.cpp (171659 => 171660)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/ftl/FTLCapabilities.cpp 2014-07-27 21:07:24 UTC (rev 171659)
+++ trunk/Source/JavaScriptCore/ftl/FTLCapabilities.cpp 2014-07-27 23:14:40 UTC (rev 171660)
</span><span class="lines">@@ -64,7 +64,6 @@
</span><span class="cx"> case CheckStructure:
</span><span class="cx"> case ArrayifyToStructure:
</span><span class="cx"> case PutStructure:
</span><del>- case PhantomPutStructure:
</del><span class="cx"> case GetButterfly:
</span><span class="cx"> case NewObject:
</span><span class="cx"> case NewArray:
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreftlFTLLowerDFGToLLVMcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/ftl/FTLLowerDFGToLLVM.cpp (171659 => 171660)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/ftl/FTLLowerDFGToLLVM.cpp 2014-07-27 21:07:24 UTC (rev 171659)
+++ trunk/Source/JavaScriptCore/ftl/FTLLowerDFGToLLVM.cpp 2014-07-27 23:14:40 UTC (rev 171660)
</span><span class="lines">@@ -476,9 +476,6 @@
</span><span class="cx"> case PutStructure:
</span><span class="cx"> compilePutStructure();
</span><span class="cx"> break;
</span><del>- case PhantomPutStructure:
- compilePhantomPutStructure();
- break;
</del><span class="cx"> case GetById:
</span><span class="cx"> compileGetById();
</span><span class="cx"> break;
</span><span class="lines">@@ -1806,11 +1803,6 @@
</span><span class="cx"> cell, m_heaps.JSCell_structureID);
</span><span class="cx"> }
</span><span class="cx">
</span><del>- void compilePhantomPutStructure()
- {
- m_ftlState.jitCode->common.notifyCompilingStructureTransition(m_graph.m_plan, codeBlock(), m_node);
- }
-
</del><span class="cx"> void compileGetById()
</span><span class="cx"> {
</span><span class="cx"> // Pretty much the only reason why we don't also support GetByIdFlush is because:
</span><span class="lines">@@ -3256,6 +3248,12 @@
</span><span class="cx"> LValue base = lowCell(m_node->child1());
</span><span class="cx">
</span><span class="cx"> MultiGetByOffsetData& data = m_node->multiGetByOffsetData();
</span><ins>+
+ if (data.variants.isEmpty()) {
+ // Protect against creating a Phi function with zero inputs. LLVM doesn't like that.
+ terminate(BadCache);
+ return;
+ }
</ins><span class="cx">
</span><span class="cx"> Vector<LBasicBlock, 2> blocks(data.variants.size());
</span><span class="cx"> for (unsigned i = data.variants.size(); i--;)
</span><span class="lines">@@ -3333,8 +3331,10 @@
</span><span class="cx"> Vector<SwitchCase, 2> cases;
</span><span class="cx"> for (unsigned i = data.variants.size(); i--;) {
</span><span class="cx"> PutByIdVariant variant = data.variants[i];
</span><del>- cases.append(
- SwitchCase(weakStructure(variant.oldStructure()), blocks[i], Weight(1)));
</del><ins>+ for (unsigned j = variant.oldStructure().size(); j--;) {
+ cases.append(
+ SwitchCase(weakStructure(variant.oldStructure()[j]), blocks[i], Weight(1)));
+ }
</ins><span class="cx"> }
</span><span class="cx"> m_out.switchInstruction(
</span><span class="cx"> m_out.load32(base, m_heaps.JSCell_structureID), cases, exit, Weight(0));
</span><span class="lines">@@ -3355,14 +3355,15 @@
</span><span class="cx"> } else {
</span><span class="cx"> m_graph.m_plan.transitions.addLazily(
</span><span class="cx"> codeBlock(), m_node->origin.semantic.codeOriginOwner(),
</span><del>- variant.oldStructure(), variant.newStructure());
</del><ins>+ variant.oldStructureForTransition(), variant.newStructure());
</ins><span class="cx">
</span><span class="cx"> storage = storageForTransition(
</span><del>- base, variant.offset(), variant.oldStructure(), variant.newStructure());
</del><ins>+ base, variant.offset(),
+ variant.oldStructureForTransition(), variant.newStructure());
</ins><span class="cx">
</span><del>- ASSERT(variant.oldStructure()->indexingType() == variant.newStructure()->indexingType());
- ASSERT(variant.oldStructure()->typeInfo().inlineTypeFlags() == variant.newStructure()->typeInfo().inlineTypeFlags());
- ASSERT(variant.oldStructure()->typeInfo().type() == variant.newStructure()->typeInfo().type());
</del><ins>+ ASSERT(variant.oldStructureForTransition()->indexingType() == variant.newStructure()->indexingType());
+ ASSERT(variant.oldStructureForTransition()->typeInfo().inlineTypeFlags() == variant.newStructure()->typeInfo().inlineTypeFlags());
+ ASSERT(variant.oldStructureForTransition()->typeInfo().type() == variant.newStructure()->typeInfo().type());
</ins><span class="cx"> m_out.store32(
</span><span class="cx"> weakStructure(variant.newStructure()), base, m_heaps.JSCell_structureID);
</span><span class="cx"> }
</span><span class="lines">@@ -4136,7 +4137,9 @@
</span><span class="cx">
</span><span class="cx"> for (CString* symbol = namedFunctions.begin(); symbol != namedFunctions.end(); ++symbol) {
</span><span class="cx"> LValue function = getNamedFunction(m_ftlState.module, symbol->data());
</span><del>- setVisibility(function, LLVMHiddenVisibility);
</del><ins>+ LLVMLinkage linkage = getLinkage(function);
+ if (linkage != LLVMInternalLinkage && linkage != LLVMPrivateLinkage)
+ setVisibility(function, LLVMHiddenVisibility);
</ins><span class="cx"> if (!isDeclaration(function)) {
</span><span class="cx"> setLinkage(function, LLVMPrivateLinkage);
</span><span class="cx">
</span><span class="lines">@@ -4147,7 +4150,9 @@
</span><span class="cx">
</span><span class="cx"> for (CString* symbol = namedGlobals.begin(); symbol != namedGlobals.end(); ++symbol) {
</span><span class="cx"> LValue global = getNamedGlobal(m_ftlState.module, symbol->data());
</span><del>- setVisibility(global, LLVMHiddenVisibility);
</del><ins>+ LLVMLinkage linkage = getLinkage(global);
+ if (linkage != LLVMInternalLinkage && linkage != LLVMPrivateLinkage)
+ setVisibility(global, LLVMHiddenVisibility);
</ins><span class="cx"> if (!isDeclaration(global))
</span><span class="cx"> setLinkage(global, LLVMPrivateLinkage);
</span><span class="cx"> }
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreheapHeapcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/heap/Heap.cpp (171659 => 171660)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/heap/Heap.cpp 2014-07-27 21:07:24 UTC (rev 171659)
+++ trunk/Source/JavaScriptCore/heap/Heap.cpp 2014-07-27 23:14:40 UTC (rev 171660)
</span><span class="lines">@@ -35,6 +35,7 @@
</span><span class="cx"> #include "HeapIterationScope.h"
</span><span class="cx"> #include "HeapRootVisitor.h"
</span><span class="cx"> #include "HeapStatistics.h"
</span><ins>+#include "HighFidelityLog.h"
</ins><span class="cx"> #include "IncrementalSweeper.h"
</span><span class="cx"> #include "Interpreter.h"
</span><span class="cx"> #include "JSGlobalObject.h"
</span><span class="lines">@@ -969,6 +970,8 @@
</span><span class="cx"> #if ENABLE(ALLOCATION_LOGGING)
</span><span class="cx"> dataLogF("JSC GC starting collection.\n");
</span><span class="cx"> #endif
</span><ins>+ if (vm()->isProfilingTypesWithHighFidelity())
+ vm()->highFidelityLog()->processHighFidelityLog(false, "GC");
</ins><span class="cx">
</span><span class="cx"> double before = 0;
</span><span class="cx"> if (Options::logGC()) {
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreheapMarkedSpacecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/heap/MarkedSpace.cpp (171659 => 171660)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/heap/MarkedSpace.cpp 2014-07-27 21:07:24 UTC (rev 171659)
+++ trunk/Source/JavaScriptCore/heap/MarkedSpace.cpp 2014-07-27 23:14:40 UTC (rev 171660)
</span><span class="lines">@@ -121,8 +121,6 @@
</span><span class="cx">
</span><span class="cx"> void MarkedSpace::sweep()
</span><span class="cx"> {
</span><del>- if (Options::logGC())
- dataLog("Eagerly sweeping...");
</del><span class="cx"> m_heap->sweeper()->willFinishSweeping();
</span><span class="cx"> forEachBlock<Sweep>();
</span><span class="cx"> }
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreinspectoragentsInspectorRuntimeAgentcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/inspector/agents/InspectorRuntimeAgent.cpp (171659 => 171660)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/inspector/agents/InspectorRuntimeAgent.cpp 2014-07-27 21:07:24 UTC (rev 171659)
+++ trunk/Source/JavaScriptCore/inspector/agents/InspectorRuntimeAgent.cpp 2014-07-27 23:14:40 UTC (rev 171660)
</span><span class="lines">@@ -191,6 +191,13 @@
</span><span class="cx"> {
</span><span class="cx"> }
</span><span class="cx">
</span><ins>+void InspectorRuntimeAgent::getRuntimeTypeForVariableInTextRange(ErrorString*, const String& in_variableName, const String& in_id, int in_startLine, int in_startColumn, int in_endLine, int in_endColumn, String* out_types)
+{
+ VM& vm = globalVM();
+ String types(vm.getTypesForVariableInRange(in_startLine, in_startColumn, in_endLine, in_endColumn, in_variableName, in_id));
+ *out_types = types;
+}
+
</ins><span class="cx"> } // namespace Inspector
</span><span class="cx">
</span><span class="cx"> #endif // ENABLE(INSPECTOR)
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreinspectoragentsInspectorRuntimeAgenth"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/inspector/agents/InspectorRuntimeAgent.h (171659 => 171660)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/inspector/agents/InspectorRuntimeAgent.h 2014-07-27 21:07:24 UTC (rev 171659)
+++ trunk/Source/JavaScriptCore/inspector/agents/InspectorRuntimeAgent.h 2014-07-27 23:14:40 UTC (rev 171660)
</span><span class="lines">@@ -66,6 +66,7 @@
</span><span class="cx"> virtual void getProperties(ErrorString*, const String& objectId, const bool* ownProperties, RefPtr<Inspector::TypeBuilder::Array<Inspector::TypeBuilder::Runtime::PropertyDescriptor>>& result, RefPtr<Inspector::TypeBuilder::Array<Inspector::TypeBuilder::Runtime::InternalPropertyDescriptor>>& internalProperties) override final;
</span><span class="cx"> virtual void releaseObjectGroup(ErrorString*, const String& objectGroup) override final;
</span><span class="cx"> virtual void run(ErrorString*) override;
</span><ins>+ virtual void getRuntimeTypeForVariableInTextRange(ErrorString*, const String& in_variableName, const String& in_id, int in_startLine, int in_startColumn, int in_endLine, int in_endColumn, String* out_types) override;
</ins><span class="cx">
</span><span class="cx"> void setScriptDebugServer(ScriptDebugServer* scriptDebugServer) { m_scriptDebugServer = scriptDebugServer; }
</span><span class="cx">
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreinspectorprotocolRuntimejson"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/inspector/protocol/Runtime.json (171659 => 171660)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/inspector/protocol/Runtime.json 2014-07-27 21:07:24 UTC (rev 171659)
+++ trunk/Source/JavaScriptCore/inspector/protocol/Runtime.json 2014-07-27 23:14:40 UTC (rev 171660)
</span><span class="lines">@@ -196,6 +196,21 @@
</span><span class="cx"> {
</span><span class="cx"> "name": "disable",
</span><span class="cx"> "description": "Disables reporting of execution contexts creation."
</span><ins>+ },
+ {
+ "name": "getRuntimeTypeForVariableInTextRange",
+ "parameters": [
+ { "name": "variableName", "type": "string", "description": "Variable we want type infromation for." },
+ { "name": "sourceID", "type": "string", "description": "sourceID uniquely identifying a script" },
+ { "name": "startLine", "type": "integer", "description": "start line for variable name" },
+ { "name": "startColumn", "type": "integer", "description": "start column for variable name" },
+ { "name": "endLine", "type": "integer", "description": "end line for variable name" },
+ { "name": "endColumn", "type": "integer", "description": "end column for variable name" }
+ ],
+ "returns": [
+ { "name": "types", "type": "string", "description": "Types for requested variable." }
+ ],
+ "description": "Returns detailed informtation on given function."
</ins><span class="cx"> }
</span><span class="cx"> ],
</span><span class="cx"> "events": [
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorejsccpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/jsc.cpp (171659 => 171660)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/jsc.cpp 2014-07-27 21:07:24 UTC (rev 171659)
+++ trunk/Source/JavaScriptCore/jsc.cpp 2014-07-27 23:14:40 UTC (rev 171660)
</span><span class="lines">@@ -25,6 +25,7 @@
</span><span class="cx"> #include "ArrayPrototype.h"
</span><span class="cx"> #include "ButterflyInlines.h"
</span><span class="cx"> #include "BytecodeGenerator.h"
</span><ins>+#include "CodeBlock.h"
</ins><span class="cx"> #include "Completion.h"
</span><span class="cx"> #include "CopiedSpaceInlines.h"
</span><span class="cx"> #include "ExceptionHelpers.h"
</span><span class="lines">@@ -470,6 +471,8 @@
</span><span class="cx"> static EncodedJSValue JSC_HOST_CALL functionEffectful42(ExecState*);
</span><span class="cx"> static EncodedJSValue JSC_HOST_CALL functionIdentity(ExecState*);
</span><span class="cx"> static EncodedJSValue JSC_HOST_CALL functionMakeMasquerader(ExecState*);
</span><ins>+static EncodedJSValue JSC_HOST_CALL functionHasCustomProperties(ExecState*);
+static EncodedJSValue JSC_HOST_CALL functionDumpTypesForAllVariables (ExecState*);
</ins><span class="cx">
</span><span class="cx"> #if ENABLE(SAMPLING_FLAGS)
</span><span class="cx"> static EncodedJSValue JSC_HOST_CALL functionSetSamplingFlags(ExecState*);
</span><span class="lines">@@ -613,12 +616,14 @@
</span><span class="cx">
</span><span class="cx"> addFunction(vm, "effectful42", functionEffectful42, 0);
</span><span class="cx"> addFunction(vm, "makeMasquerader", functionMakeMasquerader, 0);
</span><ins>+ addFunction(vm, "hasCustomProperties", functionHasCustomProperties, 0);
</ins><span class="cx">
</span><span class="cx"> addFunction(vm, "createProxy", functionCreateProxy, 1);
</span><span class="cx"> addFunction(vm, "createRuntimeArray", functionCreateRuntimeArray, 0);
</span><span class="cx">
</span><span class="cx"> addFunction(vm, "createImpureGetter", functionCreateImpureGetter, 1);
</span><span class="cx"> addFunction(vm, "setImpureGetterDelegate", functionSetImpureGetterDelegate, 2);
</span><ins>+ addFunction(vm, "dumpTypesForAllVariables", functionDumpTypesForAllVariables , 4);
</ins><span class="cx">
</span><span class="cx"> JSArray* array = constructEmptyArray(globalExec(), 0);
</span><span class="cx"> for (size_t i = 0; i < arguments.size(); ++i)
</span><span class="lines">@@ -1053,6 +1058,20 @@
</span><span class="cx"> return JSValue::encode(Masquerader::create(exec->vm(), exec->lexicalGlobalObject()));
</span><span class="cx"> }
</span><span class="cx">
</span><ins>+EncodedJSValue JSC_HOST_CALL functionHasCustomProperties(ExecState* exec)
+{
+ JSValue value = exec->argument(0);
+ if (value.isObject())
+ return JSValue::encode(jsBoolean(asObject(value)->hasCustomProperties()));
+ return JSValue::encode(jsBoolean(false));
+}
+
+EncodedJSValue JSC_HOST_CALL functionDumpTypesForAllVariables(ExecState* exec)
+{
+ exec->vm().dumpHighFidelityProfilingTypes();
+ return JSValue::encode(jsUndefined());
+}
+
</ins><span class="cx"> // Use SEH for Release builds only to get rid of the crash report dialog
</span><span class="cx"> // (luckily the same tests fail in Release and Debug builds so far). Need to
</span><span class="cx"> // be in a separate main function because the jscmain function requires object
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorellintLLIntDatacpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/llint/LLIntData.cpp (171659 => 171660)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/llint/LLIntData.cpp 2014-07-27 21:07:24 UTC (rev 171659)
+++ trunk/Source/JavaScriptCore/llint/LLIntData.cpp 2014-07-27 23:14:40 UTC (rev 171660)
</span><span class="lines">@@ -132,9 +132,9 @@
</span><span class="cx"> #elif CPU(X86_64) && OS(WINDOWS)
</span><span class="cx"> ASSERT(maxFrameExtentForSlowPathCall == 64);
</span><span class="cx"> #endif
</span><del>- ASSERT(StringType == 5);
- ASSERT(ObjectType == 18);
- ASSERT(FinalObjectType == 19);
</del><ins>+ ASSERT(StringType == 6);
+ ASSERT(ObjectType == 17);
+ ASSERT(FinalObjectType == 18);
</ins><span class="cx"> ASSERT(MasqueradesAsUndefined == 1);
</span><span class="cx"> ASSERT(ImplementsHasInstance == 2);
</span><span class="cx"> ASSERT(ImplementsDefaultHasInstance == 8);
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorellintLLIntSlowPathscpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/llint/LLIntSlowPaths.cpp (171659 => 171660)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/llint/LLIntSlowPaths.cpp 2014-07-27 21:07:24 UTC (rev 171659)
+++ trunk/Source/JavaScriptCore/llint/LLIntSlowPaths.cpp 2014-07-27 23:14:40 UTC (rev 171660)
</span><span class="lines">@@ -34,6 +34,7 @@
</span><span class="cx"> #include "ExceptionFuzz.h"
</span><span class="cx"> #include "GetterSetter.h"
</span><span class="cx"> #include "HostCallReturnValue.h"
</span><ins>+#include "HighFidelityLog.h"
</ins><span class="cx"> #include "Interpreter.h"
</span><span class="cx"> #include "JIT.h"
</span><span class="cx"> #include "JITExceptions.h"
</span><span class="lines">@@ -169,7 +170,6 @@
</span><span class="cx"> ExecState* __rcf_exec = (execCallee); \
</span><span class="cx"> LLINT_RETURN_TWO(pc, __rcf_exec); \
</span><span class="cx"> } while (false)
</span><del>-
</del><span class="cx">
</span><span class="cx"> extern "C" SlowPathReturnType llint_trace_operand(ExecState* exec, Instruction* pc, int fromWhere, int operand)
</span><span class="cx"> {
</span><span class="lines">@@ -541,6 +541,15 @@
</span><span class="cx"> LLINT_RETURN(RegExpObject::create(vm, exec->lexicalGlobalObject()->regExpStructure(), regExp));
</span><span class="cx"> }
</span><span class="cx">
</span><ins>+LLINT_SLOW_PATH_DECL(slow_path_profile_types_with_high_fidelity)
+{
+ LLINT_BEGIN();
+ TypeLocation* location = pc[2].u.location;
+ JSValue val = LLINT_OP_C(1).jsValue();
+ vm.highFidelityLog()->recordTypeInformationForLocation(val, location);
+ LLINT_END_IMPL();
+}
+
</ins><span class="cx"> LLINT_SLOW_PATH_DECL(slow_path_check_has_instance)
</span><span class="cx"> {
</span><span class="cx"> LLINT_BEGIN();
</span><span class="lines">@@ -1435,9 +1444,8 @@
</span><span class="cx"> LLINT_RETURN(slot.getValue(exec, ident));
</span><span class="cx"> }
</span><span class="cx">
</span><del>-LLINT_SLOW_PATH_DECL(slow_path_put_to_scope)
</del><ins>+static JSObject* putToScopeCommon(ExecState* exec, Instruction* pc, VM& vm)
</ins><span class="cx"> {
</span><del>- LLINT_BEGIN();
</del><span class="cx"> CodeBlock* codeBlock = exec->codeBlock();
</span><span class="cx"> const Identifier& ident = codeBlock->identifier(pc[2].u.operand);
</span><span class="cx"> JSObject* scope = jsCast<JSObject*>(LLINT_OP(1).jsValue());
</span><span class="lines">@@ -1445,7 +1453,7 @@
</span><span class="cx"> ResolveModeAndType modeAndType = ResolveModeAndType(pc[4].u.operand);
</span><span class="cx">
</span><span class="cx"> if (modeAndType.mode() == ThrowIfNotFound && !scope->hasProperty(exec, ident))
</span><del>- LLINT_THROW(createUndefinedVariableError(exec, ident));
</del><ins>+ return createUndefinedVariableError(exec, ident);
</ins><span class="cx">
</span><span class="cx"> PutPropertySlot slot(scope, codeBlock->isStrictMode());
</span><span class="cx"> scope->methodTable()->put(scope, exec, ident, value, slot);
</span><span class="lines">@@ -1459,9 +1467,31 @@
</span><span class="cx"> }
</span><span class="cx"> }
</span><span class="cx">
</span><ins>+ return nullptr;
+}
+
+LLINT_SLOW_PATH_DECL(slow_path_put_to_scope)
+{
+ LLINT_BEGIN();
+ JSObject* error = putToScopeCommon(exec, pc, vm);
+ if (error)
+ LLINT_THROW(error);
</ins><span class="cx"> LLINT_END();
</span><span class="cx"> }
</span><span class="cx">
</span><ins>+LLINT_SLOW_PATH_DECL(slow_path_put_to_scope_with_profile)
+{
+ // The format of this instruction is the same as put_to_scope with a TypeLocation appended: put_to_scope_with_profile scope, id, value, ResolveModeAndType, Structure, Operand, TypeLocation*
+ LLINT_BEGIN();
+ JSObject* error = putToScopeCommon(exec, pc, vm);
+ if (error)
+ LLINT_THROW(error);
+ TypeLocation* location = pc[7].u.location;
+ JSValue val = LLINT_OP_C(3).jsValue();
+ vm.highFidelityLog()->recordTypeInformationForLocation(val, location);
+ LLINT_END();
+}
+
</ins><span class="cx"> extern "C" SlowPathReturnType llint_throw_stack_overflow_error(VM* vm, ProtoCallFrame* protoFrame)
</span><span class="cx"> {
</span><span class="cx"> ExecState* exec = vm->topCallFrame;
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorellintLLIntSlowPathsh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/llint/LLIntSlowPaths.h (171659 => 171660)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/llint/LLIntSlowPaths.h 2014-07-27 21:07:24 UTC (rev 171659)
+++ trunk/Source/JavaScriptCore/llint/LLIntSlowPaths.h 2014-07-27 23:14:40 UTC (rev 171660)
</span><span class="lines">@@ -122,6 +122,8 @@
</span><span class="cx"> LLINT_SLOW_PATH_HIDDEN_DECL(slow_path_resolve_scope);
</span><span class="cx"> LLINT_SLOW_PATH_HIDDEN_DECL(slow_path_get_from_scope);
</span><span class="cx"> LLINT_SLOW_PATH_HIDDEN_DECL(slow_path_put_to_scope);
</span><ins>+LLINT_SLOW_PATH_HIDDEN_DECL(slow_path_put_to_scope_with_profile);
+LLINT_SLOW_PATH_HIDDEN_DECL(slow_path_profile_types_with_high_fidelity);
</ins><span class="cx"> extern "C" SlowPathReturnType llint_throw_stack_overflow_error(VM*, ProtoCallFrame*) WTF_INTERNAL;
</span><span class="cx"> #if !ENABLE(JIT)
</span><span class="cx"> extern "C" SlowPathReturnType llint_stack_check_at_vm_entry(VM*, Register*) WTF_INTERNAL;
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorellintLowLevelInterpreterasm"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/llint/LowLevelInterpreter.asm (171659 => 171660)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/llint/LowLevelInterpreter.asm 2014-07-27 21:07:24 UTC (rev 171659)
+++ trunk/Source/JavaScriptCore/llint/LowLevelInterpreter.asm 2014-07-27 23:14:40 UTC (rev 171660)
</span><span class="lines">@@ -150,9 +150,9 @@
</span><span class="cx"> const SlowPutArrayStorageShape = 30
</span><span class="cx">
</span><span class="cx"> # Type constants.
</span><del>-const StringType = 5
-const ObjectType = 18
-const FinalObjectType = 19
</del><ins>+const StringType = 6
+const ObjectType = 17
+const FinalObjectType = 18
</ins><span class="cx">
</span><span class="cx"> # Type flags constants.
</span><span class="cx"> const MasqueradesAsUndefined = 1
</span><span class="lines">@@ -1242,3 +1242,11 @@
</span><span class="cx"> _llint_op_init_global_const_nop:
</span><span class="cx"> dispatch(5)
</span><span class="cx">
</span><ins>+_llint_op_profile_types_with_high_fidelity:
+ callSlowPath(_llint_slow_path_profile_types_with_high_fidelity)
+ dispatch(4)
+
+_llint_op_put_to_scope_with_profile:
+ traceExecution()
+ callSlowPath(_llint_slow_path_put_to_scope_with_profile)
+ dispatch(8)
</ins></span></pre></div>
<a id="trunkSourceJavaScriptCorellintLowLevelInterpreter32_64asm"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/llint/LowLevelInterpreter32_64.asm (171659 => 171660)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/llint/LowLevelInterpreter32_64.asm 2014-07-27 21:07:24 UTC (rev 171659)
+++ trunk/Source/JavaScriptCore/llint/LowLevelInterpreter32_64.asm 2014-07-27 23:14:40 UTC (rev 171660)
</span><span class="lines">@@ -760,11 +760,11 @@
</span><span class="cx"> bbneq JSCell::m_type[t0], FinalObjectType, .opToThisSlow
</span><span class="cx"> loadpFromInstruction(2, t2)
</span><span class="cx"> bpneq JSCell::m_structureID[t0], t2, .opToThisSlow
</span><del>- dispatch(3)
</del><ins>+ dispatch(4)
</ins><span class="cx">
</span><span class="cx"> .opToThisSlow:
</span><span class="cx"> callSlowPath(_slow_path_to_this)
</span><del>- dispatch(3)
</del><ins>+ dispatch(4)
</ins><span class="cx">
</span><span class="cx">
</span><span class="cx"> _llint_op_new_object:
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorellintLowLevelInterpreter64asm"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/llint/LowLevelInterpreter64.asm (171659 => 171660)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/llint/LowLevelInterpreter64.asm 2014-07-27 21:07:24 UTC (rev 171659)
+++ trunk/Source/JavaScriptCore/llint/LowLevelInterpreter64.asm 2014-07-27 23:14:40 UTC (rev 171660)
</span><span class="lines">@@ -685,11 +685,11 @@
</span><span class="cx"> loadStructureWithScratch(t0, t1, t2)
</span><span class="cx"> loadpFromInstruction(2, t2)
</span><span class="cx"> bpneq t1, t2, .opToThisSlow
</span><del>- dispatch(3)
</del><ins>+ dispatch(4)
</ins><span class="cx">
</span><span class="cx"> .opToThisSlow:
</span><span class="cx"> callSlowPath(_slow_path_to_this)
</span><del>- dispatch(3)
</del><ins>+ dispatch(4)
</ins><span class="cx">
</span><span class="cx">
</span><span class="cx"> _llint_op_new_object:
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeArrayBufferNeuteringWatchpointcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/ArrayBufferNeuteringWatchpoint.cpp (171659 => 171660)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/ArrayBufferNeuteringWatchpoint.cpp 2014-07-27 21:07:24 UTC (rev 171659)
+++ trunk/Source/JavaScriptCore/runtime/ArrayBufferNeuteringWatchpoint.cpp 2014-07-27 23:14:40 UTC (rev 171660)
</span><span class="lines">@@ -57,7 +57,7 @@
</span><span class="cx">
</span><span class="cx"> Structure* ArrayBufferNeuteringWatchpoint::createStructure(VM& vm)
</span><span class="cx"> {
</span><del>- return Structure::create(vm, 0, jsNull(), TypeInfo(CompoundType, StructureFlags), info());
</del><ins>+ return Structure::create(vm, 0, jsNull(), TypeInfo(CellType, StructureFlags), info());
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> } // namespace JSC
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeCommonSlowPathscpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/CommonSlowPaths.cpp (171659 => 171660)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/CommonSlowPaths.cpp 2014-07-27 21:07:24 UTC (rev 171659)
+++ trunk/Source/JavaScriptCore/runtime/CommonSlowPaths.cpp 2014-07-27 23:14:40 UTC (rev 171660)
</span><span class="lines">@@ -246,10 +246,18 @@
</span><span class="cx"> {
</span><span class="cx"> BEGIN();
</span><span class="cx"> JSValue v1 = OP(1).jsValue();
</span><del>- if (v1.isCell())
- pc[2].u.structure.set(vm, exec->codeBlock()->ownerExecutable(), v1.asCell()->structure(vm));
- else
</del><ins>+ if (v1.isCell()) {
+ Structure* myStructure = v1.asCell()->structure(vm);
+ Structure* otherStructure = pc[2].u.structure.get();
+ if (myStructure != otherStructure) {
+ if (otherStructure)
+ pc[3].u.toThisStatus = ToThisConflicted;
+ pc[2].u.structure.set(vm, exec->codeBlock()->ownerExecutable(), myStructure);
+ }
+ } else {
+ pc[3].u.toThisStatus = ToThisConflicted;
</ins><span class="cx"> pc[2].u.structure.clear();
</span><ins>+ }
</ins><span class="cx"> RETURN(v1.toThis(exec, exec->codeBlock()->isStrictMode() ? StrictMode : NotStrictMode));
</span><span class="cx"> }
</span><span class="cx">
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeExecutableh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/Executable.h (171659 => 171660)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/Executable.h 2014-07-27 21:07:24 UTC (rev 171659)
+++ trunk/Source/JavaScriptCore/runtime/Executable.h 2014-07-27 23:14:40 UTC (rev 171660)
</span><span class="lines">@@ -113,7 +113,7 @@
</span><span class="cx"> return m_numParametersForCall == NUM_PARAMETERS_IS_HOST;
</span><span class="cx"> }
</span><span class="cx">
</span><del>- static Structure* createStructure(VM& vm, JSGlobalObject* globalObject, JSValue proto) { return Structure::create(vm, globalObject, proto, TypeInfo(CompoundType, StructureFlags), info()); }
</del><ins>+ static Structure* createStructure(VM& vm, JSGlobalObject* globalObject, JSValue proto) { return Structure::create(vm, globalObject, proto, TypeInfo(CellType, StructureFlags), info()); }
</ins><span class="cx">
</span><span class="cx"> void clearCode();
</span><span class="cx">
</span><span class="lines">@@ -323,7 +323,7 @@
</span><span class="cx"> return OBJECT_OFFSETOF(NativeExecutable, m_constructor);
</span><span class="cx"> }
</span><span class="cx">
</span><del>- static Structure* createStructure(VM& vm, JSGlobalObject* globalObject, JSValue proto) { return Structure::create(vm, globalObject, proto, TypeInfo(LeafType, StructureFlags), info()); }
</del><ins>+ static Structure* createStructure(VM& vm, JSGlobalObject* globalObject, JSValue proto) { return Structure::create(vm, globalObject, proto, TypeInfo(CellType, StructureFlags), info()); }
</ins><span class="cx">
</span><span class="cx"> DECLARE_INFO;
</span><span class="cx">
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeHighFidelityLogcpp"></a>
<div class="addfile"><h4>Added: trunk/Source/JavaScriptCore/runtime/HighFidelityLog.cpp (0 => 171660)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/HighFidelityLog.cpp (rev 0)
+++ trunk/Source/JavaScriptCore/runtime/HighFidelityLog.cpp 2014-07-27 23:14:40 UTC (rev 171660)
</span><span class="lines">@@ -0,0 +1,124 @@
</span><ins>+/*
+ * Copyright (C) 2014 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ * notice, this list of conditions and the following disclaimer in the
+ * documentation and/or other materials provided with the distribution.
+ * 3. Neither the name of Apple Inc. ("Apple") nor the names of
+ * its contributors may be used to endorse or promote products derived
+ * from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "HighFidelityLog.h"
+
+#include "JSCJSValueInlines.h"
+#include "TypeLocation.h"
+#include <wtf/CurrentTime.h>
+
+
+namespace JSC {
+
+static const bool verbose = false;
+
+void HighFidelityLog::initializeHighFidelityLog()
+{
+ ASSERT(!m_logStartPtr);
+ m_highFidelityLogSize = 50000;
+ m_logStartPtr = new LogEntry[m_highFidelityLogSize];
+ m_nextBuffer = new LogEntry[m_highFidelityLogSize];
+ m_currentOffset = 0;
+}
+
+HighFidelityLog::~HighFidelityLog()
+{
+ delete[] m_logStartPtr;
+ delete[] m_nextBuffer;
+}
+
+void HighFidelityLog::recordTypeInformationForLocation(JSValue v, TypeLocation* location)
+{
+ ASSERT(m_logStartPtr);
+ ASSERT(m_currentOffset < m_highFidelityLogSize);
+
+ LogEntry* entry = m_logStartPtr + m_currentOffset;
+
+ entry->location = location;
+ entry->value = v;
+ entry->structure = (v.isCell() ? v.asCell()->structure() : nullptr);
+
+ m_currentOffset += 1;
+ if (m_currentOffset == m_highFidelityLogSize)
+ processHighFidelityLog(true, "Log Full");
+}
+
+void HighFidelityLog::processHighFidelityLog(bool asynchronously, String reason)
+{
+ // This should only be called from the main execution thread.
+ if (!m_currentOffset)
+ return;
+
+ if (verbose)
+ dataLog("Process caller:'", reason,"'");
+
+ ByteSpinLocker* locker = new ByteSpinLocker(m_lock);
+ ThreadData* data = new ThreadData;
+ data->m_proccessLogToOffset = m_currentOffset;
+ data->m_processLogPtr = m_logStartPtr;
+ data->m_locker = locker;
+
+ m_currentOffset = 0;
+ LogEntry* temp = m_logStartPtr;
+ m_logStartPtr = m_nextBuffer;
+ m_nextBuffer = temp;
+
+ if (asynchronously)
+ createThread(actuallyProcessLogThreadFunction, data, "ProcessHighFidelityLog");
+ else
+ actuallyProcessLogThreadFunction(data);
+}
+
+void HighFidelityLog::actuallyProcessLogThreadFunction(void* arg)
+{
+ double before = currentTimeMS();
+ ThreadData* data = static_cast<ThreadData*>(arg);
+ LogEntry* entry = data->m_processLogPtr;
+ size_t processLogToOffset = data->m_proccessLogToOffset;
+ size_t i = 0;
+ while (i < processLogToOffset) {
+ Structure* structure = entry->structure ? entry->structure : nullptr;
+ RefPtr<StructureShape> shape;
+ if (structure)
+ shape = structure->toStructureShape();
+ if (entry->location->m_globalTypeSet)
+ entry->location->m_globalTypeSet->addTypeForValue(entry->value, shape);
+ entry->location->m_instructionTypeSet->addTypeForValue(entry->value, shape);
+ entry++;
+ i++;
+ }
+
+ delete data->m_locker;
+ delete data;
+ double after = currentTimeMS();
+ if (verbose)
+ dataLogF("Processing the log took: '%f' ms\n", after - before);
+}
+
+} //namespace JSC
</ins></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeHighFidelityLogh"></a>
<div class="addfile"><h4>Added: trunk/Source/JavaScriptCore/runtime/HighFidelityLog.h (0 => 171660)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/HighFidelityLog.h (rev 0)
+++ trunk/Source/JavaScriptCore/runtime/HighFidelityLog.h 2014-07-27 23:14:40 UTC (rev 171660)
</span><span class="lines">@@ -0,0 +1,83 @@
</span><ins>+/*
+ * Copyright (C) 2014 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ * notice, this list of conditions and the following disclaimer in the
+ * documentation and/or other materials provided with the distribution.
+ * 3. Neither the name of Apple Inc. ("Apple") nor the names of
+ * its contributors may be used to endorse or promote products derived
+ * from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef HighFidelityLog_h
+#define HighFidelityLog_h
+
+#include "JSCJSValue.h"
+#include "HighFidelityTypeProfiler.h"
+#include "Structure.h"
+#include <wtf/ByteSpinLock.h>
+
+namespace JSC {
+
+class TypeLocation;
+
+class HighFidelityLog {
+
+public:
+ struct LogEntry {
+ public:
+ JSValue value;
+ TypeLocation* location;
+ Structure* structure;
+ };
+
+ HighFidelityLog()
+ : m_logStartPtr(0)
+ {
+ initializeHighFidelityLog();
+ }
+
+ ~HighFidelityLog();
+
+ void recordTypeInformationForLocation(JSValue v, TypeLocation*);
+ void processHighFidelityLog(bool asynchronously = false, String = "");
+
+private:
+ void initializeHighFidelityLog();
+ static void actuallyProcessLogThreadFunction(void*);
+
+ unsigned m_highFidelityLogSize;
+ size_t m_currentOffset;
+ LogEntry* m_logStartPtr;
+ LogEntry* m_nextBuffer;
+
+ ByteSpinLock m_lock;
+
+ struct ThreadData {
+ public:
+ LogEntry* m_processLogPtr;
+ size_t m_proccessLogToOffset;
+ ByteSpinLocker* m_locker;
+ };
+};
+
+} //namespace JSC
+
+#endif //HighFidelityLog_h
</ins></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeHighFidelityTypeProfilercpp"></a>
<div class="addfile"><h4>Added: trunk/Source/JavaScriptCore/runtime/HighFidelityTypeProfiler.cpp (0 => 171660)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/HighFidelityTypeProfiler.cpp (rev 0)
+++ trunk/Source/JavaScriptCore/runtime/HighFidelityTypeProfiler.cpp 2014-07-27 23:14:40 UTC (rev 171660)
</span><span class="lines">@@ -0,0 +1,88 @@
</span><ins>+/*
+ * Copyright (C) 2014 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ * notice, this list of conditions and the following disclaimer in the
+ * documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "HighFidelityTypeProfiler.h"
+
+#include "TypeLocation.h"
+
+namespace JSC {
+
+static const bool verbose = false;
+
+String HighFidelityTypeProfiler::getTypesForVariableInRange(unsigned startLine, unsigned startColumn, unsigned endLine , unsigned endColumn, const String& variableName, intptr_t sourceID)
+{
+ String global = getGlobalTypesForVariableInRange(startLine, startColumn, endLine, endColumn, variableName, sourceID);
+ if (!global.isEmpty())
+ return global;
+
+ return getLocalTypesForVariableInRange(startLine, startColumn, endLine, endColumn, variableName, sourceID);
+}
+
+WTF::String HighFidelityTypeProfiler::getGlobalTypesForVariableInRange(unsigned startLine, unsigned, unsigned, unsigned, const WTF::String&, intptr_t sourceID)
+{
+ auto iterLocationMap = m_globalLocationToGlobalIDMap.find(getLocationBasedHash(sourceID, startLine));
+ if (iterLocationMap == m_globalLocationToGlobalIDMap.end())
+ return "";
+
+ auto iterIDMap = m_globalIDMap.find(iterLocationMap->second);
+ if (iterIDMap == m_globalIDMap.end())
+ return "";
+
+ return iterIDMap->second->seenTypes();
+}
+
+WTF::String HighFidelityTypeProfiler::getLocalTypesForVariableInRange(unsigned startLine, unsigned , unsigned , unsigned , const WTF::String& , intptr_t sourceID)
+{
+ auto iter = m_globalLocationMap.find(getLocationBasedHash(sourceID, startLine));
+ auto end = m_globalLocationMap.end();
+ if (iter == end)
+ return "";
+
+ return iter->second->seenTypes();
+}
+
+void HighFidelityTypeProfiler::insertNewLocation(TypeLocation* location)
+{
+ if (verbose)
+ dataLogF("Registering location:: line:%u, column:%u\n", location->m_line, location->m_column);
+
+ LocationKey key(getLocationBasedHash(location->m_sourceID, location->m_line));
+
+ if (location->m_globalVariableID != HighFidelityNoGlobalIDExists) {
+ // Build the mapping relationships Map1:key=>globalId, Map2:globalID=>TypeSet
+ m_globalLocationToGlobalIDMap[key] = location->m_globalVariableID;
+ m_globalIDMap[location->m_globalVariableID] = location->m_globalTypeSet;
+ }
+
+ m_globalLocationMap[key] = location->m_instructionTypeSet;
+}
+
+LocationKey HighFidelityTypeProfiler::getLocationBasedHash(intptr_t id, unsigned line)
+{
+ return LocationKey(id, line, 1);
+}
+
+} //namespace JSC
</ins></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeHighFidelityTypeProfilerh"></a>
<div class="addfile"><h4>Added: trunk/Source/JavaScriptCore/runtime/HighFidelityTypeProfiler.h (0 => 171660)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/HighFidelityTypeProfiler.h (rev 0)
+++ trunk/Source/JavaScriptCore/runtime/HighFidelityTypeProfiler.h 2014-07-27 23:14:40 UTC (rev 171660)
</span><span class="lines">@@ -0,0 +1,89 @@
</span><ins>+/*
+ * Copyright (C) 2014 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ * notice, this list of conditions and the following disclaimer in the
+ * documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef HighFidelityTypeProfiler_h
+#define HighFidelityTypeProfiler_h
+
+#include "CodeBlock.h"
+#include <unordered_map>
+#include <wtf/HashMap.h>
+#include <wtf/HashMethod.h>
+#include <wtf/text/WTFString.h>
+
+namespace JSC {
+
+class TypeLocation;
+
+struct LocationKey {
+
+public:
+ LocationKey(intptr_t sourceID, unsigned line, unsigned column)
+ : m_sourceID(sourceID)
+ , m_line(line)
+ , m_column(column)
+
+ {
+ }
+
+ unsigned hash() const
+ {
+ return m_line + m_sourceID;
+ }
+
+ // FIXME: For now, this is a hack. We do the following: Map:"ID:Line" => TypeSet. Obviously, this assumes all assignments are on discrete lines, which is an incorrect assumption.
+ bool operator==(const LocationKey& other) const
+ {
+ return m_sourceID == other.m_sourceID
+ && m_line == other.m_line;
+ }
+
+ intptr_t m_sourceID;
+ unsigned m_line;
+ unsigned m_column;
+};
+
+class HighFidelityTypeProfiler {
+
+public:
+ String getTypesForVariableInRange(unsigned startLine, unsigned startColumn, unsigned endLine, unsigned endColumn, const String& variableName, intptr_t sourceID);
+ String getGlobalTypesForVariableInRange(unsigned startLine, unsigned startColumn, unsigned endLine, unsigned endColumn, const String& variableName, intptr_t sourceID);
+ String getLocalTypesForVariableInRange(unsigned startLine, unsigned startColumn, unsigned endLine, unsigned endColumn, const String& variableName, intptr_t sourceID);
+ void insertNewLocation(TypeLocation*);
+
+private:
+ static LocationKey getLocationBasedHash(intptr_t, unsigned);
+
+ typedef std::unordered_map<LocationKey, RefPtr<TypeSet>, HashMethod<LocationKey>> GlobalLocationMap;
+ typedef std::unordered_map<int64_t, RefPtr<TypeSet>> GlobalIDMap;
+ typedef std::unordered_map<LocationKey, int64_t, HashMethod<LocationKey>> GlobalLocationToGlobalIDMap;
+
+ GlobalIDMap m_globalIDMap;
+ GlobalLocationMap m_globalLocationMap;
+ GlobalLocationToGlobalIDMap m_globalLocationToGlobalIDMap;
+};
+
+} //namespace JSC
+
+#endif //HighFidelityTypeProfiler_h
</ins></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeJSObjectcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/JSObject.cpp (171659 => 171660)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/JSObject.cpp 2014-07-27 21:07:24 UTC (rev 171659)
+++ trunk/Source/JavaScriptCore/runtime/JSObject.cpp 2014-07-27 23:14:40 UTC (rev 171660)
</span><span class="lines">@@ -1242,7 +1242,7 @@
</span><span class="cx"> Structure* structure = this->structure(vm);
</span><span class="cx"> if (attributes & ReadOnly)
</span><span class="cx"> structure->setContainsReadOnlyProperties();
</span><del>- structure->setHasCustomGetterSetterProperties(propertyName == vm.propertyNames->underscoreProto);
</del><ins>+ structure->setHasCustomGetterSetterPropertiesWithProtoCheck(propertyName == vm.propertyNames->underscoreProto);
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> void JSObject::putDirectNonIndexAccessor(VM& vm, PropertyName propertyName, JSValue value, unsigned attributes)
</span><span class="lines">@@ -1260,7 +1260,7 @@
</span><span class="cx"> if (attributes & ReadOnly)
</span><span class="cx"> structure->setContainsReadOnlyProperties();
</span><span class="cx">
</span><del>- structure->setHasGetterSetterProperties(propertyName == vm.propertyNames->underscoreProto);
</del><ins>+ structure->setHasGetterSetterPropertiesWithProtoCheck(propertyName == vm.propertyNames->underscoreProto);
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> bool JSObject::hasProperty(ExecState* exec, PropertyName propertyName) const
</span><span class="lines">@@ -1638,7 +1638,7 @@
</span><span class="cx"> // If this object's ClassInfo has no static properties, then nothing to reify!
</span><span class="cx"> // We can safely set the flag to avoid the expensive check again in the future.
</span><span class="cx"> if (!classInfo()->hasStaticProperties()) {
</span><del>- structure(vm)->setStaticFunctionsReified();
</del><ins>+ structure(vm)->setStaticFunctionsReified(true);
</ins><span class="cx"> return;
</span><span class="cx"> }
</span><span class="cx">
</span><span class="lines">@@ -1656,7 +1656,7 @@
</span><span class="cx"> }
</span><span class="cx"> }
</span><span class="cx">
</span><del>- structure(vm)->setStaticFunctionsReified();
</del><ins>+ structure(vm)->setStaticFunctionsReified(true);
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> bool JSObject::removeDirect(VM& vm, PropertyName propertyName)
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeJSPromiseDeferredh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/JSPromiseDeferred.h (171659 => 171660)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/JSPromiseDeferred.h 2014-07-27 21:07:24 UTC (rev 171659)
+++ trunk/Source/JavaScriptCore/runtime/JSPromiseDeferred.h 2014-07-27 23:14:40 UTC (rev 171660)
</span><span class="lines">@@ -42,7 +42,7 @@
</span><span class="cx">
</span><span class="cx"> static Structure* createStructure(VM& vm, JSGlobalObject* globalObject, JSValue prototype)
</span><span class="cx"> {
</span><del>- return Structure::create(vm, globalObject, prototype, TypeInfo(CompoundType, StructureFlags), info());
</del><ins>+ return Structure::create(vm, globalObject, prototype, TypeInfo(CellType, StructureFlags), info());
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> static const bool hasImmortalStructure = true;
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeJSPromiseReactionh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/JSPromiseReaction.h (171659 => 171660)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/JSPromiseReaction.h 2014-07-27 21:07:24 UTC (rev 171659)
+++ trunk/Source/JavaScriptCore/runtime/JSPromiseReaction.h 2014-07-27 23:14:40 UTC (rev 171660)
</span><span class="lines">@@ -43,7 +43,7 @@
</span><span class="cx"> static JSPromiseReaction* create(VM&, JSPromiseDeferred*, JSValue);
</span><span class="cx"> static Structure* createStructure(VM& vm, JSGlobalObject* globalObject, JSValue prototype)
</span><span class="cx"> {
</span><del>- return Structure::create(vm, globalObject, prototype, TypeInfo(CompoundType, StructureFlags), info());
</del><ins>+ return Structure::create(vm, globalObject, prototype, TypeInfo(CellType, StructureFlags), info());
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> static const bool hasImmortalStructure = true;
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeJSPropertyNameIteratorh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/JSPropertyNameIterator.h (171659 => 171660)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/JSPropertyNameIterator.h 2014-07-27 21:07:24 UTC (rev 171659)
+++ trunk/Source/JavaScriptCore/runtime/JSPropertyNameIterator.h 2014-07-27 23:14:40 UTC (rev 171660)
</span><span class="lines">@@ -54,7 +54,7 @@
</span><span class="cx">
</span><span class="cx"> static Structure* createStructure(VM& vm, JSGlobalObject* globalObject, JSValue prototype)
</span><span class="cx"> {
</span><del>- return Structure::create(vm, globalObject, prototype, TypeInfo(CompoundType, StructureFlags), info());
</del><ins>+ return Structure::create(vm, globalObject, prototype, TypeInfo(CellType, StructureFlags), info());
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> static void visitChildren(JSCell*, SlotVisitor&);
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeJSTypeh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/JSType.h (171659 => 171660)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/JSType.h 2014-07-27 21:07:24 UTC (rev 171659)
+++ trunk/Source/JavaScriptCore/runtime/JSType.h 2014-07-27 23:14:40 UTC (rev 171660)
</span><span class="lines">@@ -29,11 +29,11 @@
</span><span class="cx"> BooleanType,
</span><span class="cx"> NumberType,
</span><span class="cx"> NullType,
</span><ins>+
+ // The CellType value must come before any JSType that is a JSCell.
+ CellType,
</ins><span class="cx"> StringType,
</span><del>- LeafType,
</del><span class="cx">
</span><del>- // The CompoundType value must come before any JSType that may have children.
- CompoundType,
</del><span class="cx"> GetterSetterType,
</span><span class="cx"> CustomGetterSetterType,
</span><span class="cx"> APIValueWrapperType,
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeJSTypeInfoh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/JSTypeInfo.h (171659 => 171660)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/JSTypeInfo.h 2014-07-27 21:07:24 UTC (rev 171659)
+++ trunk/Source/JavaScriptCore/runtime/JSTypeInfo.h 2014-07-27 23:14:40 UTC (rev 171660)
</span><span class="lines">@@ -66,7 +66,6 @@
</span><span class="cx"> , m_flags(inlineTypeFlags)
</span><span class="cx"> , m_flags2(outOfLineTypeFlags)
</span><span class="cx"> {
</span><del>- ASSERT(m_type >= CompoundType || !(isSetOnFlags1(OverridesVisitChildren)));
</del><span class="cx"> // No object that doesn't ImplementsHasInstance should override it!
</span><span class="cx"> ASSERT((m_flags & (ImplementsHasInstance | OverridesHasInstance)) != OverridesHasInstance);
</span><span class="cx"> // ImplementsDefaultHasInstance means (ImplementsHasInstance & !OverridesHasInstance)
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeMapDatah"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/MapData.h (171659 => 171660)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/MapData.h 2014-07-27 21:07:24 UTC (rev 171659)
+++ trunk/Source/JavaScriptCore/runtime/MapData.h 2014-07-27 23:14:40 UTC (rev 171660)
</span><span class="lines">@@ -78,7 +78,7 @@
</span><span class="cx">
</span><span class="cx"> static Structure* createStructure(VM& vm, JSGlobalObject* globalObject, JSValue prototype)
</span><span class="cx"> {
</span><del>- return Structure::create(vm, globalObject, prototype, TypeInfo(CompoundType, StructureFlags), info());
</del><ins>+ return Structure::create(vm, globalObject, prototype, TypeInfo(CellType, StructureFlags), info());
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> static const bool needsDestruction = true;
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeOptionsh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/Options.h (171659 => 171660)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/Options.h 2014-07-27 21:07:24 UTC (rev 171659)
+++ trunk/Source/JavaScriptCore/runtime/Options.h 2014-07-27 23:14:40 UTC (rev 171660)
</span><span class="lines">@@ -274,6 +274,7 @@
</span><span class="cx"> v(unsigned, gcMaxHeapSize, 0) \
</span><span class="cx"> v(bool, recordGCPauseTimes, false) \
</span><span class="cx"> v(bool, logHeapStatisticsAtExit, false) \
</span><ins>+ v(bool, profileTypesWithHighFidelity, false) \
</ins><span class="cx"> \
</span><span class="cx"> v(bool, enableExceptionFuzz, false) \
</span><span class="cx"> v(unsigned, fireExceptionFuzzAt, 0)
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimePropertyMapHashTableh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/PropertyMapHashTable.h (171659 => 171660)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/PropertyMapHashTable.h 2014-07-27 21:07:24 UTC (rev 171659)
+++ trunk/Source/JavaScriptCore/runtime/PropertyMapHashTable.h 2014-07-27 23:14:40 UTC (rev 171660)
</span><span class="lines">@@ -144,7 +144,7 @@
</span><span class="cx">
</span><span class="cx"> static Structure* createStructure(VM& vm, JSGlobalObject* globalObject, JSValue prototype)
</span><span class="cx"> {
</span><del>- return Structure::create(vm, globalObject, prototype, TypeInfo(CompoundType, StructureFlags), info());
</del><ins>+ return Structure::create(vm, globalObject, prototype, TypeInfo(CellType, StructureFlags), info());
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> static void visitChildren(JSCell*, SlotVisitor&);
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeRegExph"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/RegExp.h (171659 => 171660)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/RegExp.h 2014-07-27 21:07:24 UTC (rev 171659)
+++ trunk/Source/JavaScriptCore/runtime/RegExp.h 2014-07-27 23:14:40 UTC (rev 171660)
</span><span class="lines">@@ -77,7 +77,7 @@
</span><span class="cx">
</span><span class="cx"> static Structure* createStructure(VM& vm, JSGlobalObject* globalObject, JSValue prototype)
</span><span class="cx"> {
</span><del>- return Structure::create(vm, globalObject, prototype, TypeInfo(LeafType, StructureFlags), info());
</del><ins>+ return Structure::create(vm, globalObject, prototype, TypeInfo(CellType, StructureFlags), info());
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> DECLARE_INFO;
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeSparseArrayValueMapcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/SparseArrayValueMap.cpp (171659 => 171660)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/SparseArrayValueMap.cpp 2014-07-27 21:07:24 UTC (rev 171659)
+++ trunk/Source/JavaScriptCore/runtime/SparseArrayValueMap.cpp 2014-07-27 23:14:40 UTC (rev 171660)
</span><span class="lines">@@ -69,7 +69,7 @@
</span><span class="cx">
</span><span class="cx"> Structure* SparseArrayValueMap::createStructure(VM& vm, JSGlobalObject* globalObject, JSValue prototype)
</span><span class="cx"> {
</span><del>- return Structure::create(vm, globalObject, prototype, TypeInfo(CompoundType, StructureFlags), info());
</del><ins>+ return Structure::create(vm, globalObject, prototype, TypeInfo(CellType, StructureFlags), info());
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> SparseArrayValueMap::AddResult SparseArrayValueMap::add(JSObject* array, unsigned i)
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeStructurecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/Structure.cpp (171659 => 171660)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/Structure.cpp 2014-07-27 21:07:24 UTC (rev 171659)
+++ trunk/Source/JavaScriptCore/runtime/Structure.cpp 2014-07-27 23:14:40 UTC (rev 171660)
</span><span class="lines">@@ -63,7 +63,7 @@
</span><span class="cx"> {
</span><span class="cx"> if (isUsingSingleSlot()) {
</span><span class="cx"> Structure* transition = singleTransition();
</span><del>- return transition && transition->m_nameInPrevious == rep && transition->m_attributesInPrevious == attributes;
</del><ins>+ return transition && transition->m_nameInPrevious == rep && transition->attributesInPrevious() == attributes;
</ins><span class="cx"> }
</span><span class="cx"> return map()->get(std::make_pair(rep, attributes));
</span><span class="cx"> }
</span><span class="lines">@@ -72,7 +72,7 @@
</span><span class="cx"> {
</span><span class="cx"> if (isUsingSingleSlot()) {
</span><span class="cx"> Structure* transition = singleTransition();
</span><del>- return (transition && transition->m_nameInPrevious == rep && transition->m_attributesInPrevious == attributes) ? transition : 0;
</del><ins>+ return (transition && transition->m_nameInPrevious == rep && transition->attributesInPrevious() == attributes) ? transition : 0;
</ins><span class="cx"> }
</span><span class="cx"> return map()->get(std::make_pair(rep, attributes));
</span><span class="cx"> }
</span><span class="lines">@@ -99,7 +99,7 @@
</span><span class="cx"> // Newer versions of the STL have an std::make_pair function that takes rvalue references.
</span><span class="cx"> // When either of the parameters are bitfields, the C++ compiler will try to bind them as lvalues, which is invalid. To work around this, use unary "+" to make the parameter an rvalue.
</span><span class="cx"> // See https://bugs.webkit.org/show_bug.cgi?id=59261 for more details
</span><del>- map()->set(std::make_pair(structure->m_nameInPrevious.get(), +structure->m_attributesInPrevious), structure);
</del><ins>+ map()->set(std::make_pair(structure->m_nameInPrevious.get(), +structure->attributesInPrevious()), structure);
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> void Structure::dumpStatistics()
</span><span class="lines">@@ -157,23 +157,24 @@
</span><span class="cx"> , m_transitionWatchpointSet(IsWatched)
</span><span class="cx"> , m_offset(invalidOffset)
</span><span class="cx"> , m_inlineCapacity(inlineCapacity)
</span><del>- , m_dictionaryKind(NoneDictionaryKind)
- , m_hasBeenFlattenedBefore(false)
- , m_isPinnedPropertyTable(false)
- , m_hasGetterSetterProperties(classInfo->hasStaticSetterOrReadonlyProperties(vm))
- , m_hasCustomGetterSetterProperties(false)
- , m_hasReadOnlyOrGetterSetterPropertiesExcludingProto(classInfo->hasStaticSetterOrReadonlyProperties(vm))
- , m_hasNonEnumerableProperties(false)
- , m_attributesInPrevious(0)
- , m_specificFunctionThrashCount(0)
- , m_preventExtensions(false)
- , m_didTransition(false)
- , m_staticFunctionReified(false)
- , m_hasRareData(false)
</del><ins>+ , m_bitField(0)
</ins><span class="cx"> {
</span><ins>+ setDictionaryKind(NoneDictionaryKind);
+ setIsPinnedPropertyTable(false);
+ setHasGetterSetterProperties(classInfo->hasStaticSetterOrReadonlyProperties(vm));
+ setHasCustomGetterSetterProperties(false);
+ setHasReadOnlyOrGetterSetterPropertiesExcludingProto(classInfo->hasStaticSetterOrReadonlyProperties(vm));
+ setHasNonEnumerableProperties(false);
+ setAttributesInPrevious(0);
+ setSpecificFunctionThrashCount(0);
+ setPreventExtensions(false);
+ setDidTransition(false);
+ setStaticFunctionsReified(false);
+ setHasRareData(false);
+
</ins><span class="cx"> ASSERT(inlineCapacity <= JSFinalObject::maxInlineCapacity());
</span><span class="cx"> ASSERT(static_cast<PropertyOffset>(inlineCapacity) < firstOutOfLineOffset);
</span><del>- ASSERT(!m_hasRareData);
</del><ins>+ ASSERT(!hasRareData());
</ins><span class="cx"> ASSERT(hasReadOnlyOrGetterSetterPropertiesExcludingProto() || !m_classInfo->hasStaticSetterOrReadonlyProperties(vm));
</span><span class="cx"> ASSERT(hasGetterSetterProperties() || !m_classInfo->hasStaticSetterOrReadonlyProperties(vm));
</span><span class="cx"> }
</span><span class="lines">@@ -187,21 +188,22 @@
</span><span class="cx"> , m_transitionWatchpointSet(IsWatched)
</span><span class="cx"> , m_offset(invalidOffset)
</span><span class="cx"> , m_inlineCapacity(0)
</span><del>- , m_dictionaryKind(NoneDictionaryKind)
- , m_hasBeenFlattenedBefore(false)
- , m_isPinnedPropertyTable(false)
- , m_hasGetterSetterProperties(m_classInfo->hasStaticSetterOrReadonlyProperties(vm))
- , m_hasCustomGetterSetterProperties(false)
- , m_hasReadOnlyOrGetterSetterPropertiesExcludingProto(m_classInfo->hasStaticSetterOrReadonlyProperties(vm))
- , m_hasNonEnumerableProperties(false)
- , m_attributesInPrevious(0)
- , m_specificFunctionThrashCount(0)
- , m_preventExtensions(false)
- , m_didTransition(false)
- , m_staticFunctionReified(false)
- , m_hasRareData(false)
</del><ins>+ , m_bitField(0)
</ins><span class="cx"> {
</span><del>- TypeInfo typeInfo = TypeInfo(CompoundType, OverridesVisitChildren | StructureIsImmortal);
</del><ins>+ setDictionaryKind(NoneDictionaryKind);
+ setIsPinnedPropertyTable(false);
+ setHasGetterSetterProperties(m_classInfo->hasStaticSetterOrReadonlyProperties(vm));
+ setHasCustomGetterSetterProperties(false);
+ setHasReadOnlyOrGetterSetterPropertiesExcludingProto(m_classInfo->hasStaticSetterOrReadonlyProperties(vm));
+ setHasNonEnumerableProperties(false);
+ setAttributesInPrevious(0);
+ setSpecificFunctionThrashCount(0);
+ setPreventExtensions(false);
+ setDidTransition(false);
+ setStaticFunctionsReified(false);
+ setHasRareData(false);
+
+ TypeInfo typeInfo = TypeInfo(CellType, OverridesVisitChildren | StructureIsImmortal);
</ins><span class="cx"> m_blob = StructureIDBlob(vm.heap.structureIDTable().allocateID(this), 0, typeInfo);
</span><span class="cx"> m_outOfLineTypeFlags = typeInfo.outOfLineTypeFlags();
</span><span class="cx">
</span><span class="lines">@@ -216,26 +218,27 @@
</span><span class="cx"> , m_transitionWatchpointSet(IsWatched)
</span><span class="cx"> , m_offset(invalidOffset)
</span><span class="cx"> , m_inlineCapacity(previous->m_inlineCapacity)
</span><del>- , m_dictionaryKind(previous->m_dictionaryKind)
- , m_hasBeenFlattenedBefore(previous->m_hasBeenFlattenedBefore)
- , m_isPinnedPropertyTable(false)
- , m_hasGetterSetterProperties(previous->m_hasGetterSetterProperties)
- , m_hasCustomGetterSetterProperties(previous->m_hasCustomGetterSetterProperties)
- , m_hasReadOnlyOrGetterSetterPropertiesExcludingProto(previous->m_hasReadOnlyOrGetterSetterPropertiesExcludingProto)
- , m_hasNonEnumerableProperties(previous->m_hasNonEnumerableProperties)
- , m_attributesInPrevious(0)
- , m_specificFunctionThrashCount(previous->m_specificFunctionThrashCount)
- , m_preventExtensions(previous->m_preventExtensions)
- , m_didTransition(true)
- , m_staticFunctionReified(previous->m_staticFunctionReified)
- , m_hasRareData(false)
</del><ins>+ , m_bitField(0)
</ins><span class="cx"> {
</span><ins>+ setDictionaryKind(previous->dictionaryKind());
+ setIsPinnedPropertyTable(previous->hasBeenFlattenedBefore());
+ setHasGetterSetterProperties(previous->hasGetterSetterProperties());
+ setHasCustomGetterSetterProperties(previous->hasCustomGetterSetterProperties());
+ setHasReadOnlyOrGetterSetterPropertiesExcludingProto(previous->hasReadOnlyOrGetterSetterPropertiesExcludingProto());
+ setHasNonEnumerableProperties(previous->hasNonEnumerableProperties());
+ setAttributesInPrevious(0);
+ setSpecificFunctionThrashCount(previous->specificFunctionThrashCount());
+ setPreventExtensions(previous->preventExtensions());
+ setDidTransition(true);
+ setStaticFunctionsReified(previous->staticFunctionsReified());
+ setHasRareData(false);
+
</ins><span class="cx"> TypeInfo typeInfo = previous->typeInfo();
</span><span class="cx"> m_blob = StructureIDBlob(vm.heap.structureIDTable().allocateID(this), previous->indexingTypeIncludingHistory(), typeInfo);
</span><span class="cx"> m_outOfLineTypeFlags = typeInfo.outOfLineTypeFlags();
</span><span class="cx">
</span><span class="cx"> ASSERT(!previous->typeInfo().structureIsImmortal());
</span><del>- if (previous->m_hasRareData && previous->rareData()->needsCloning())
</del><ins>+ if (previous->hasRareData() && previous->rareData()->needsCloning())
</ins><span class="cx"> cloneRareDataFrom(vm, previous);
</span><span class="cx"> setPreviousID(vm, previous);
</span><span class="cx">
</span><span class="lines">@@ -310,7 +313,7 @@
</span><span class="cx"> structure = structures[i];
</span><span class="cx"> if (!structure->m_nameInPrevious)
</span><span class="cx"> continue;
</span><del>- PropertyMapEntry entry(vm, this, structure->m_nameInPrevious.get(), structure->m_offset, structure->m_attributesInPrevious, structure->m_specificValueInPrevious.get());
</del><ins>+ PropertyMapEntry entry(vm, this, structure->m_nameInPrevious.get(), structure->m_offset, structure->attributesInPrevious(), structure->m_specificValueInPrevious.get());
</ins><span class="cx"> propertyTable()->add(entry, m_offset, PropertyTable::PropertyOffsetMustNotChange);
</span><span class="cx"> }
</span><span class="cx">
</span><span class="lines">@@ -429,7 +432,7 @@
</span><span class="cx"> ASSERT(structure->isObject());
</span><span class="cx"> ASSERT(!Structure::addPropertyTransitionToExistingStructure(structure, propertyName, attributes, specificValue, offset));
</span><span class="cx">
</span><del>- if (structure->m_specificFunctionThrashCount == maxSpecificFunctionThrashCount)
</del><ins>+ if (structure->specificFunctionThrashCount() == maxSpecificFunctionThrashCount)
</ins><span class="cx"> specificValue = 0;
</span><span class="cx">
</span><span class="cx"> int maxTransitionLength;
</span><span class="lines">@@ -448,7 +451,7 @@
</span><span class="cx">
</span><span class="cx"> transition->m_cachedPrototypeChain.setMayBeNull(vm, transition, structure->m_cachedPrototypeChain.get());
</span><span class="cx"> transition->m_nameInPrevious = propertyName.uid();
</span><del>- transition->m_attributesInPrevious = attributes;
</del><ins>+ transition->setAttributesInPrevious(attributes);
</ins><span class="cx"> transition->m_specificValueInPrevious.setMayBeNull(vm, transition, specificValue);
</span><span class="cx"> transition->propertyTable().set(vm, transition, structure->takePropertyTableOrCloneIfPinned(vm));
</span><span class="cx"> transition->m_offset = structure->m_offset;
</span><span class="lines">@@ -495,10 +498,10 @@
</span><span class="cx">
</span><span class="cx"> Structure* Structure::despecifyFunctionTransition(VM& vm, Structure* structure, PropertyName replaceFunction)
</span><span class="cx"> {
</span><del>- ASSERT(structure->m_specificFunctionThrashCount < maxSpecificFunctionThrashCount);
</del><ins>+ ASSERT(structure->specificFunctionThrashCount() < maxSpecificFunctionThrashCount);
</ins><span class="cx"> Structure* transition = create(vm, structure);
</span><span class="cx">
</span><del>- ++transition->m_specificFunctionThrashCount;
</del><ins>+ transition->setSpecificFunctionThrashCount(transition->specificFunctionThrashCount() + 1);
</ins><span class="cx">
</span><span class="cx"> DeferGC deferGC(vm.heap);
</span><span class="cx"> structure->materializePropertyMapIfNecessary(vm, deferGC);
</span><span class="lines">@@ -506,7 +509,7 @@
</span><span class="cx"> transition->m_offset = structure->m_offset;
</span><span class="cx"> transition->pin();
</span><span class="cx">
</span><del>- if (transition->m_specificFunctionThrashCount == maxSpecificFunctionThrashCount)
</del><ins>+ if (transition->specificFunctionThrashCount() == maxSpecificFunctionThrashCount)
</ins><span class="cx"> transition->despecifyAllFunctions(vm);
</span><span class="cx"> else {
</span><span class="cx"> bool removed = transition->despecifyFunction(vm, replaceFunction);
</span><span class="lines">@@ -550,7 +553,7 @@
</span><span class="cx"> structure->materializePropertyMapIfNecessary(vm, deferGC);
</span><span class="cx"> transition->propertyTable().set(vm, transition, structure->copyPropertyTableForPinning(vm));
</span><span class="cx"> transition->m_offset = structure->m_offset;
</span><del>- transition->m_dictionaryKind = kind;
</del><ins>+ transition->setDictionaryKind(kind);
</ins><span class="cx"> transition->pin();
</span><span class="cx">
</span><span class="cx"> transition->checkOffsetConsistency();
</span><span class="lines">@@ -591,7 +594,7 @@
</span><span class="cx"> PropertyTable::iterator iter = transition->propertyTable()->begin();
</span><span class="cx"> PropertyTable::iterator end = transition->propertyTable()->end();
</span><span class="cx"> if (iter != end)
</span><del>- transition->m_hasReadOnlyOrGetterSetterPropertiesExcludingProto = true;
</del><ins>+ transition->setHasReadOnlyOrGetterSetterPropertiesExcludingProto(true);
</ins><span class="cx"> for (; iter != end; ++iter)
</span><span class="cx"> iter->attributes |= iter->attributes & Accessor ? DontDelete : (DontDelete | ReadOnly);
</span><span class="cx"> }
</span><span class="lines">@@ -613,7 +616,7 @@
</span><span class="cx"> structure->materializePropertyMapIfNecessary(vm, deferGC);
</span><span class="cx"> transition->propertyTable().set(vm, transition, structure->copyPropertyTableForPinning(vm));
</span><span class="cx"> transition->m_offset = structure->m_offset;
</span><del>- transition->m_preventExtensions = true;
</del><ins>+ transition->setPreventExtensions(true);
</ins><span class="cx"> transition->pin();
</span><span class="cx">
</span><span class="cx"> transition->checkOffsetConsistency();
</span><span class="lines">@@ -625,7 +628,7 @@
</span><span class="cx"> DeferGC deferGC(vm.heap);
</span><span class="cx"> materializePropertyMapIfNecessaryForPinning(vm, deferGC);
</span><span class="cx">
</span><del>- if (m_isPinnedPropertyTable)
</del><ins>+ if (isPinnedPropertyTable())
</ins><span class="cx"> return propertyTable()->copy(vm, propertyTable()->size() + 1);
</span><span class="cx">
</span><span class="cx"> // Hold the lock while stealing the table - so that getConcurrently() on another thread
</span><span class="lines">@@ -654,13 +657,13 @@
</span><span class="cx">
</span><span class="cx"> Structure* existingTransition;
</span><span class="cx"> if (!structure->isDictionary() && (existingTransition = structure->m_transitionTable.get(0, attributes))) {
</span><del>- ASSERT(existingTransition->m_attributesInPrevious == attributes);
</del><ins>+ ASSERT(existingTransition->attributesInPrevious() == attributes);
</ins><span class="cx"> ASSERT(existingTransition->indexingTypeIncludingHistory() == indexingType);
</span><span class="cx"> return existingTransition;
</span><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> Structure* transition = create(vm, structure);
</span><del>- transition->m_attributesInPrevious = attributes;
</del><ins>+ transition->setAttributesInPrevious(attributes);
</ins><span class="cx"> transition->m_blob.setIndexingType(indexingType);
</span><span class="cx"> transition->propertyTable().set(vm, transition, structure->takePropertyTableOrCloneIfPinned(vm));
</span><span class="cx"> transition->m_offset = structure->m_offset;
</span><span class="lines">@@ -747,8 +750,8 @@
</span><span class="cx"> checkOffsetConsistency();
</span><span class="cx"> }
</span><span class="cx">
</span><del>- m_dictionaryKind = NoneDictionaryKind;
- m_hasBeenFlattenedBefore = true;
</del><ins>+ setDictionaryKind(NoneDictionaryKind);
+ setHasBeenFlattenedBefore(true);
</ins><span class="cx">
</span><span class="cx"> size_t afterOutOfLineCapacity = this->outOfLineCapacity();
</span><span class="cx">
</span><span class="lines">@@ -772,7 +775,7 @@
</span><span class="cx"> {
</span><span class="cx"> ASSERT(!enumerationCache());
</span><span class="cx">
</span><del>- if (m_specificFunctionThrashCount == maxSpecificFunctionThrashCount)
</del><ins>+ if (specificFunctionThrashCount() == maxSpecificFunctionThrashCount)
</ins><span class="cx"> specificValue = 0;
</span><span class="cx">
</span><span class="cx"> DeferGC deferGC(vm.heap);
</span><span class="lines">@@ -798,28 +801,28 @@
</span><span class="cx"> void Structure::pin()
</span><span class="cx"> {
</span><span class="cx"> ASSERT(propertyTable());
</span><del>- m_isPinnedPropertyTable = true;
</del><ins>+ setIsPinnedPropertyTable(true);
</ins><span class="cx"> clearPreviousID();
</span><span class="cx"> m_nameInPrevious.clear();
</span><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> void Structure::allocateRareData(VM& vm)
</span><span class="cx"> {
</span><del>- ASSERT(!m_hasRareData);
</del><ins>+ ASSERT(!hasRareData());
</ins><span class="cx"> StructureRareData* rareData = StructureRareData::create(vm, previous());
</span><span class="cx"> m_previousOrRareData.set(vm, this, rareData);
</span><del>- m_hasRareData = true;
- ASSERT(m_hasRareData);
</del><ins>+ setHasRareData(true);
+ ASSERT(hasRareData());
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> void Structure::cloneRareDataFrom(VM& vm, const Structure* other)
</span><span class="cx"> {
</span><del>- ASSERT(!m_hasRareData);
- ASSERT(other->m_hasRareData);
</del><ins>+ ASSERT(!hasRareData());
+ ASSERT(other->hasRareData());
</ins><span class="cx"> StructureRareData* newRareData = StructureRareData::clone(vm, other->rareData());
</span><span class="cx"> m_previousOrRareData.set(vm, this, newRareData);
</span><del>- m_hasRareData = true;
- ASSERT(m_hasRareData);
</del><ins>+ setHasRareData(true);
+ ASSERT(hasRareData());
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> #if DUMP_PROPERTYMAP_STATS
</span><span class="lines">@@ -903,7 +906,7 @@
</span><span class="cx"> if (structure->m_nameInPrevious.get() != uid)
</span><span class="cx"> continue;
</span><span class="cx">
</span><del>- attributes = structure->m_attributesInPrevious;
</del><ins>+ attributes = structure->attributesInPrevious();
</ins><span class="cx"> specificValue = structure->m_specificValueInPrevious.get();
</span><span class="cx"> return structure->m_offset;
</span><span class="cx"> }
</span><span class="lines">@@ -947,7 +950,7 @@
</span><span class="cx">
</span><span class="cx"> checkConsistency();
</span><span class="cx"> if (attributes & DontEnum)
</span><del>- m_hasNonEnumerableProperties = true;
</del><ins>+ setHasNonEnumerableProperties(true);
</ins><span class="cx">
</span><span class="cx"> StringImpl* rep = propertyName.uid();
</span><span class="cx">
</span><span class="lines">@@ -1005,7 +1008,7 @@
</span><span class="cx">
</span><span class="cx"> PropertyTable::iterator end = propertyTable()->end();
</span><span class="cx"> for (PropertyTable::iterator iter = propertyTable()->begin(); iter != end; ++iter) {
</span><del>- ASSERT(m_hasNonEnumerableProperties || !(iter->attributes & DontEnum));
</del><ins>+ ASSERT(hasNonEnumerableProperties() || !(iter->attributes & DontEnum));
</ins><span class="cx"> if (!iter->key->isEmptyUnique() && (!(iter->attributes & DontEnum) || mode == IncludeDontEnumProperties)) {
</span><span class="cx"> if (knownUnique)
</span><span class="cx"> propertyNames.addKnownUnique(iter->key);
</span><span class="lines">@@ -1037,7 +1040,7 @@
</span><span class="cx"> visitor.append(&thisObject->m_previousOrRareData);
</span><span class="cx"> visitor.append(&thisObject->m_specificValueInPrevious);
</span><span class="cx">
</span><del>- if (thisObject->m_isPinnedPropertyTable) {
</del><ins>+ if (thisObject->isPinnedPropertyTable()) {
</ins><span class="cx"> ASSERT(thisObject->m_propertyTableUnsafe);
</span><span class="cx"> visitor.append(&thisObject->m_propertyTableUnsafe);
</span><span class="cx"> } else if (thisObject->m_propertyTableUnsafe)
</span><span class="lines">@@ -1070,6 +1073,39 @@
</span><span class="cx"> }
</span><span class="cx"> }
</span><span class="cx">
</span><ins>+
+PassRefPtr<StructureShape> Structure::toStructureShape()
+{
+ Vector<Structure*, 8> structures;
+ Structure* structure;
+ PropertyTable* table;
+ RefPtr<StructureShape> shape = StructureShape::create();
+
+ findStructuresAndMapForMaterialization(structures, structure, table);
+
+ if (table) {
+ PropertyTable::iterator iter = table->begin();
+ PropertyTable::iterator end = table->end();
+
+ for (; iter != end; ++iter)
+ shape->addProperty(iter->key);
+
+ structure->m_lock.unlock();
+ }
+
+ for (unsigned i = structures.size(); i--;) {
+ Structure* structure = structures[i];
+ if (!structure->m_nameInPrevious)
+ continue;
+
+ shape->addProperty(structure->m_nameInPrevious.get());
+ }
+
+ shape->markAsFinal();
+
+ return shape.release();
+}
+
</ins><span class="cx"> void Structure::dump(PrintStream& out) const
</span><span class="cx"> {
</span><span class="cx"> out.print(RawPointer(this), ":[", classInfo()->className, ", {");
</span><span class="lines">@@ -1199,7 +1235,7 @@
</span><span class="cx"> if (!propertyTable())
</span><span class="cx"> return;
</span><span class="cx">
</span><del>- if (!m_hasNonEnumerableProperties) {
</del><ins>+ if (!hasNonEnumerableProperties()) {
</ins><span class="cx"> PropertyTable::iterator end = propertyTable()->end();
</span><span class="cx"> for (PropertyTable::iterator iter = propertyTable()->begin(); iter != end; ++iter) {
</span><span class="cx"> ASSERT(!(iter->attributes & DontEnum));
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeStructureh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/Structure.h (171659 => 171660)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/Structure.h 2014-07-27 21:07:24 UTC (rev 171659)
+++ trunk/Source/JavaScriptCore/runtime/Structure.h 2014-07-27 23:14:40 UTC (rev 171660)
</span><span class="lines">@@ -127,8 +127,7 @@
</span><span class="cx">
</span><span class="cx"> JS_EXPORT_PRIVATE bool isSealed(VM&);
</span><span class="cx"> JS_EXPORT_PRIVATE bool isFrozen(VM&);
</span><del>- bool isExtensible() const { return !m_preventExtensions; }
- bool didTransition() const { return m_didTransition; }
</del><ins>+ bool isExtensible() const { return !preventExtensions(); }
</ins><span class="cx"> bool putWillGrowOutOfLineStorage();
</span><span class="cx"> size_t suggestedNewOutOfLineStorageCapacity();
</span><span class="cx">
</span><span class="lines">@@ -143,13 +142,11 @@
</span><span class="cx"> PropertyOffset removePropertyWithoutTransition(VM&, PropertyName);
</span><span class="cx"> void setPrototypeWithoutTransition(VM& vm, JSValue prototype) { m_prototype.set(vm, this, prototype); }
</span><span class="cx">
</span><del>- bool isDictionary() const { return m_dictionaryKind != NoneDictionaryKind; }
- bool isUncacheableDictionary() const { return m_dictionaryKind == UncachedDictionaryKind; }
</del><ins>+ bool isDictionary() const { return dictionaryKind() != NoneDictionaryKind; }
+ bool isUncacheableDictionary() const { return dictionaryKind() == UncachedDictionaryKind; }
+
+ bool propertyAccessesAreCacheable() { return dictionaryKind() != UncachedDictionaryKind && !typeInfo().prohibitsPropertyCaching(); }
</ins><span class="cx">
</span><del>- bool hasBeenFlattenedBefore() const { return m_hasBeenFlattenedBefore; }
-
- bool propertyAccessesAreCacheable() { return m_dictionaryKind != UncachedDictionaryKind && !typeInfo().prohibitsPropertyCaching(); }
-
</del><span class="cx"> // We use SlowPath in GetByIdStatus for structures that may get new impure properties later to prevent
</span><span class="cx"> // DFG from inlining property accesses since structures don't transition when a new impure property appears.
</span><span class="cx"> bool takesSlowPathInDFGForImpureProperty()
</span><span class="lines">@@ -196,7 +193,7 @@
</span><span class="cx"> Structure* previousID() const
</span><span class="cx"> {
</span><span class="cx"> ASSERT(structure()->classInfo() == info());
</span><del>- if (m_hasRareData)
</del><ins>+ if (hasRareData())
</ins><span class="cx"> return rareData()->previousID();
</span><span class="cx"> return previous();
</span><span class="cx"> }
</span><span class="lines">@@ -270,31 +267,23 @@
</span><span class="cx">
</span><span class="cx"> PropertyOffset getConcurrently(VM&, StringImpl* uid);
</span><span class="cx"> PropertyOffset getConcurrently(VM&, StringImpl* uid, unsigned& attributes, JSCell*& specificValue);
</span><del>-
- bool hasGetterSetterProperties() const { return m_hasGetterSetterProperties; }
- bool hasReadOnlyOrGetterSetterPropertiesExcludingProto() const { return m_hasReadOnlyOrGetterSetterPropertiesExcludingProto; }
- void setHasGetterSetterProperties(bool is__proto__)
</del><ins>+
+ void setHasGetterSetterPropertiesWithProtoCheck(bool is__proto__)
</ins><span class="cx"> {
</span><del>- m_hasGetterSetterProperties = true;
</del><ins>+ setHasGetterSetterProperties(true);
</ins><span class="cx"> if (!is__proto__)
</span><del>- m_hasReadOnlyOrGetterSetterPropertiesExcludingProto = true;
</del><ins>+ setHasReadOnlyOrGetterSetterPropertiesExcludingProto(true);
</ins><span class="cx"> }
</span><del>-
- bool hasCustomGetterSetterProperties() const { return m_hasCustomGetterSetterProperties; }
- void setHasCustomGetterSetterProperties(bool is__proto__)
</del><ins>+
+ void setContainsReadOnlyProperties() { setHasReadOnlyOrGetterSetterPropertiesExcludingProto(true); }
+
+ void setHasCustomGetterSetterPropertiesWithProtoCheck(bool is__proto__)
</ins><span class="cx"> {
</span><del>- m_hasCustomGetterSetterProperties = true;
</del><ins>+ setHasCustomGetterSetterProperties(true);
</ins><span class="cx"> if (!is__proto__)
</span><del>- m_hasReadOnlyOrGetterSetterPropertiesExcludingProto = true;
</del><ins>+ setHasReadOnlyOrGetterSetterPropertiesExcludingProto(true);
</ins><span class="cx"> }
</span><del>-
- void setContainsReadOnlyProperties()
- {
- m_hasReadOnlyOrGetterSetterPropertiesExcludingProto = true;
- }
-
- bool hasNonEnumerableProperties() const { return m_hasNonEnumerableProperties; }
-
</del><ins>+
</ins><span class="cx"> bool isEmpty() const
</span><span class="cx"> {
</span><span class="cx"> ASSERT(checkOffsetConsistency());
</span><span class="lines">@@ -302,7 +291,7 @@
</span><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> JS_EXPORT_PRIVATE void despecifyDictionaryFunction(VM&, PropertyName);
</span><del>- void disableSpecificFunctionTracking() { m_specificFunctionThrashCount = maxSpecificFunctionThrashCount; }
</del><ins>+ void disableSpecificFunctionTracking() { setSpecificFunctionThrashCount(maxSpecificFunctionThrashCount); }
</ins><span class="cx">
</span><span class="cx"> void setEnumerationCache(VM&, JSPropertyNameIterator* enumerationCache); // Defined in JSPropertyNameIterator.h.
</span><span class="cx"> JSPropertyNameIterator* enumerationCache(); // Defined in JSPropertyNameIterator.h.
</span><span class="lines">@@ -310,28 +299,18 @@
</span><span class="cx">
</span><span class="cx"> JSString* objectToStringValue()
</span><span class="cx"> {
</span><del>- if (!m_hasRareData)
</del><ins>+ if (!hasRareData())
</ins><span class="cx"> return 0;
</span><span class="cx"> return rareData()->objectToStringValue();
</span><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> void setObjectToStringValue(VM& vm, JSString* value)
</span><span class="cx"> {
</span><del>- if (!m_hasRareData)
</del><ins>+ if (!hasRareData())
</ins><span class="cx"> allocateRareData(vm);
</span><span class="cx"> rareData()->setObjectToStringValue(vm, value);
</span><span class="cx"> }
</span><span class="cx">
</span><del>- bool staticFunctionsReified()
- {
- return m_staticFunctionReified;
- }
-
- void setStaticFunctionsReified()
- {
- m_staticFunctionReified = true;
- }
-
</del><span class="cx"> const ClassInfo* classInfo() const { return m_classInfo; }
</span><span class="cx">
</span><span class="cx"> static ptrdiff_t structureIDOffset()
</span><span class="lines">@@ -402,6 +381,8 @@
</span><span class="cx"> {
</span><span class="cx"> return m_transitionWatchpointSet;
</span><span class="cx"> }
</span><ins>+
+ PassRefPtr<StructureShape> toStructureShape();
</ins><span class="cx">
</span><span class="cx"> void dump(PrintStream&) const;
</span><span class="cx"> void dumpInContext(PrintStream&, DumpContext*) const;
</span><span class="lines">@@ -412,6 +393,38 @@
</span><span class="cx"> DECLARE_EXPORT_INFO;
</span><span class="cx">
</span><span class="cx"> private:
</span><ins>+ typedef enum {
+ NoneDictionaryKind = 0,
+ CachedDictionaryKind = 1,
+ UncachedDictionaryKind = 2
+ } DictionaryKind;
+
+public:
+#define DEFINE_BITFIELD(type, lowerName, upperName, width, offset) \
+ static const uint32_t s_##lowerName##Shift = offset;\
+ static const uint32_t s_##lowerName##Mask = ((1 << (width - 1)) | ((1 << (width - 1)) - 1));\
+ type lowerName() const { return static_cast<type>((m_bitField >> offset) & s_##lowerName##Mask); }\
+ void set##upperName(type newValue) \
+ {\
+ m_bitField &= ~(s_##lowerName##Mask << offset);\
+ m_bitField |= (newValue & s_##lowerName##Mask) << offset;\
+ }
+
+ DEFINE_BITFIELD(DictionaryKind, dictionaryKind, DictionaryKind, 2, 0);
+ DEFINE_BITFIELD(bool, isPinnedPropertyTable, IsPinnedPropertyTable, 1, 2);
+ DEFINE_BITFIELD(bool, hasGetterSetterProperties, HasGetterSetterProperties, 1, 3);
+ DEFINE_BITFIELD(bool, hasReadOnlyOrGetterSetterPropertiesExcludingProto, HasReadOnlyOrGetterSetterPropertiesExcludingProto, 1, 4);
+ DEFINE_BITFIELD(bool, hasNonEnumerableProperties, HasNonEnumerableProperties, 1, 5);
+ DEFINE_BITFIELD(unsigned, attributesInPrevious, AttributesInPrevious, 14, 6);
+ DEFINE_BITFIELD(unsigned, specificFunctionThrashCount, SpecificFunctionThrashCount, 2, 20);
+ DEFINE_BITFIELD(bool, preventExtensions, PreventExtensions, 1, 22);
+ DEFINE_BITFIELD(bool, didTransition, DidTransition, 1, 23);
+ DEFINE_BITFIELD(bool, staticFunctionsReified, StaticFunctionsReified, 1, 24);
+ DEFINE_BITFIELD(bool, hasRareData, HasRareData, 1, 25);
+ DEFINE_BITFIELD(bool, hasBeenFlattenedBefore, HasBeenFlattenedBefore, 1, 26);
+ DEFINE_BITFIELD(bool, hasCustomGetterSetterProperties, HasCustomGetterSetterProperties, 1, 27);
+
+private:
</ins><span class="cx"> friend class LLIntOffsetsExtractor;
</span><span class="cx">
</span><span class="cx"> JS_EXPORT_PRIVATE Structure(VM&, JSGlobalObject*, JSValue prototype, const TypeInfo&, const ClassInfo*, IndexingType, unsigned inlineCapacity);
</span><span class="lines">@@ -428,11 +441,6 @@
</span><span class="cx"> // to unlock it.
</span><span class="cx"> void findStructuresAndMapForMaterialization(Vector<Structure*, 8>& structures, Structure*&, PropertyTable*&);
</span><span class="cx">
</span><del>- typedef enum {
- NoneDictionaryKind = 0,
- CachedDictionaryKind = 1,
- UncachedDictionaryKind = 2
- } DictionaryKind;
</del><span class="cx"> static Structure* toDictionaryTransition(VM&, Structure*, DictionaryKind);
</span><span class="cx">
</span><span class="cx"> PropertyOffset putSpecificValue(VM&, PropertyName, unsigned attributes, JSCell* specificValue);
</span><span class="lines">@@ -479,7 +487,7 @@
</span><span class="cx">
</span><span class="cx"> void setPreviousID(VM& vm, Structure* structure)
</span><span class="cx"> {
</span><del>- if (m_hasRareData)
</del><ins>+ if (hasRareData())
</ins><span class="cx"> rareData()->setPreviousID(vm, structure);
</span><span class="cx"> else
</span><span class="cx"> m_previousOrRareData.set(vm, this, structure);
</span><span class="lines">@@ -487,7 +495,7 @@
</span><span class="cx">
</span><span class="cx"> void clearPreviousID()
</span><span class="cx"> {
</span><del>- if (m_hasRareData)
</del><ins>+ if (hasRareData())
</ins><span class="cx"> rareData()->clearPreviousID();
</span><span class="cx"> else
</span><span class="cx"> m_previousOrRareData.clear();
</span><span class="lines">@@ -506,13 +514,13 @@
</span><span class="cx">
</span><span class="cx"> Structure* previous() const
</span><span class="cx"> {
</span><del>- ASSERT(!m_hasRareData);
</del><ins>+ ASSERT(!hasRareData());
</ins><span class="cx"> return static_cast<Structure*>(m_previousOrRareData.get());
</span><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> StructureRareData* rareData() const
</span><span class="cx"> {
</span><del>- ASSERT(m_hasRareData);
</del><ins>+ ASSERT(hasRareData());
</ins><span class="cx"> return static_cast<StructureRareData*>(m_previousOrRareData.get());
</span><span class="cx"> }
</span><span class="cx">
</span><span class="lines">@@ -558,19 +566,7 @@
</span><span class="cx">
</span><span class="cx"> ConcurrentJITLock m_lock;
</span><span class="cx">
</span><del>- unsigned m_dictionaryKind : 2;
- bool m_hasBeenFlattenedBefore : 1;
- bool m_isPinnedPropertyTable : 1;
- bool m_hasGetterSetterProperties : 1;
- bool m_hasCustomGetterSetterProperties : 1;
- bool m_hasReadOnlyOrGetterSetterPropertiesExcludingProto : 1;
- bool m_hasNonEnumerableProperties : 1;
- unsigned m_attributesInPrevious : 14;
- unsigned m_specificFunctionThrashCount : 2;
- unsigned m_preventExtensions : 1;
- unsigned m_didTransition : 1;
- unsigned m_staticFunctionReified : 1;
- bool m_hasRareData : 1;
</del><ins>+ uint32_t m_bitField;
</ins><span class="cx"> };
</span><span class="cx">
</span><span class="cx"> } // namespace JSC
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeStructureChainh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/StructureChain.h (171659 => 171660)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/StructureChain.h 2014-07-27 21:07:24 UTC (rev 171659)
+++ trunk/Source/JavaScriptCore/runtime/StructureChain.h 2014-07-27 23:14:40 UTC (rev 171660)
</span><span class="lines">@@ -57,7 +57,7 @@
</span><span class="cx">
</span><span class="cx"> static Structure* createStructure(VM& vm, JSGlobalObject* globalObject, JSValue prototype)
</span><span class="cx"> {
</span><del>- return Structure::create(vm, globalObject, prototype, TypeInfo(CompoundType, StructureFlags), info());
</del><ins>+ return Structure::create(vm, globalObject, prototype, TypeInfo(CellType, StructureFlags), info());
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> DECLARE_INFO;
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeStructureInlinesh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/StructureInlines.h (171659 => 171660)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/StructureInlines.h 2014-07-27 21:07:24 UTC (rev 171659)
+++ trunk/Source/JavaScriptCore/runtime/StructureInlines.h 2014-07-27 23:14:40 UTC (rev 171660)
</span><span class="lines">@@ -154,14 +154,14 @@
</span><span class="cx"> inline void Structure::setEnumerationCache(VM& vm, JSPropertyNameIterator* enumerationCache)
</span><span class="cx"> {
</span><span class="cx"> ASSERT(!isDictionary());
</span><del>- if (!m_hasRareData)
</del><ins>+ if (!hasRareData())
</ins><span class="cx"> allocateRareData(vm);
</span><span class="cx"> rareData()->setEnumerationCache(vm, enumerationCache);
</span><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> inline JSPropertyNameIterator* Structure::enumerationCache()
</span><span class="cx"> {
</span><del>- if (!m_hasRareData)
</del><ins>+ if (!hasRareData())
</ins><span class="cx"> return 0;
</span><span class="cx"> return rareData()->enumerationCache();
</span><span class="cx"> }
</span><span class="lines">@@ -247,7 +247,7 @@
</span><span class="cx"> PropertyTable* propertyTable = m_propertyTableUnsafe.get();
</span><span class="cx">
</span><span class="cx"> if (!propertyTable) {
</span><del>- ASSERT(!m_isPinnedPropertyTable);
</del><ins>+ ASSERT(!isPinnedPropertyTable());
</ins><span class="cx"> return true;
</span><span class="cx"> }
</span><span class="cx">
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeStructureRareDatacpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/StructureRareData.cpp (171659 => 171660)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/StructureRareData.cpp 2014-07-27 21:07:24 UTC (rev 171659)
+++ trunk/Source/JavaScriptCore/runtime/StructureRareData.cpp 2014-07-27 23:14:40 UTC (rev 171660)
</span><span class="lines">@@ -36,7 +36,7 @@
</span><span class="cx">
</span><span class="cx"> Structure* StructureRareData::createStructure(VM& vm, JSGlobalObject* globalObject, JSValue prototype)
</span><span class="cx"> {
</span><del>- return Structure::create(vm, globalObject, prototype, TypeInfo(CompoundType, StructureFlags), info());
</del><ins>+ return Structure::create(vm, globalObject, prototype, TypeInfo(CellType, StructureFlags), info());
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> StructureRareData* StructureRareData::create(VM& vm, Structure* previous)
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeSymbolTablecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/SymbolTable.cpp (171659 => 171660)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/SymbolTable.cpp 2014-07-27 21:07:24 UTC (rev 171659)
+++ trunk/Source/JavaScriptCore/runtime/SymbolTable.cpp 2014-07-27 23:14:40 UTC (rev 171660)
</span><span class="lines">@@ -103,6 +103,11 @@
</span><span class="cx"> , m_captureEnd(0)
</span><span class="cx"> , m_functionEnteredOnce(ClearWatchpoint)
</span><span class="cx"> {
</span><ins>+ if (vm.isProfilingTypesWithHighFidelity()) {
+ m_uniqueIDMap = std::make_unique<UniqueIDMap>();
+ m_registerToVariableMap = std::make_unique<RegisterToVariableMap>();
+ m_uniqueTypeSetMap = std::make_unique<UniqueTypeSetMap>();
+ }
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> SymbolTable::~SymbolTable() { }
</span><span class="lines">@@ -157,9 +162,72 @@
</span><span class="cx"> for (unsigned i = parameterCount(); i--;)
</span><span class="cx"> result->m_slowArguments[i] = m_slowArguments[i];
</span><span class="cx"> }
</span><ins>+
+ if (m_uniqueIDMap && result->m_uniqueIDMap) {
+
+ {
+ auto iter = m_uniqueIDMap->begin();
+ auto end = m_uniqueIDMap->end();
+ for (; iter != end; ++iter)
+ result->m_uniqueIDMap->set(iter->key, iter->value);
+ }
+
+ {
+ auto iter = m_registerToVariableMap->begin();
+ auto end = m_registerToVariableMap->end();
+ for (; iter != end; ++iter)
+ result->m_registerToVariableMap->set(iter->key, iter->value);
+ }
+
+ {
+ auto iter = m_uniqueTypeSetMap->begin();
+ auto end = m_uniqueTypeSetMap->end();
+ for (; iter != end; ++iter)
+ result->m_uniqueTypeSetMap->set(iter->key, iter->value);
+ }
+ }
+
</ins><span class="cx">
</span><span class="cx"> return result;
</span><span class="cx"> }
</span><span class="cx">
</span><ins>+int64_t SymbolTable::uniqueIDForVariable(const ConcurrentJITLocker&, StringImpl* key, VM& vm)
+{
+ auto iter = m_uniqueIDMap->find(key);
+ auto end = m_uniqueIDMap->end();
+ ASSERT_UNUSED(end, iter != end);
+
+ int64_t& id = iter->value;
+ if (id == HighFidelityNeedsUniqueIDGeneration) {
+ id = vm.getNextUniqueVariableID();
+ m_uniqueTypeSetMap->set(key, TypeSet::create()); //make a new global typeset for the ID
+ }
+
+ return id;
+}
+
+int64_t SymbolTable::uniqueIDForRegister(const ConcurrentJITLocker& locker, int registerIndex, VM& vm)
+{
+ auto iter = m_registerToVariableMap->find(registerIndex);
+ auto end = m_registerToVariableMap->end();
+ ASSERT_UNUSED(end, iter != end);
+ return uniqueIDForVariable(locker, iter->value.get(), vm);
+}
+
+RefPtr<TypeSet> SymbolTable::globalTypeSetForRegister(const ConcurrentJITLocker& locker, int registerIndex, VM& vm)
+{
+ uniqueIDForRegister(locker, registerIndex, vm); //ensure it's created
+ auto iter = m_registerToVariableMap->find(registerIndex);
+ auto end = m_registerToVariableMap->end();
+ ASSERT_UNUSED(end, iter != end);
+ return globalTypeSetForVariable(locker, iter->value.get(), vm);
+}
+
+RefPtr<TypeSet> SymbolTable::globalTypeSetForVariable(const ConcurrentJITLocker& locker, StringImpl* key, VM& vm)
+{
+ uniqueIDForVariable(locker, key, vm);
+ return m_uniqueTypeSetMap->find(key)->value;
+}
+
</ins><span class="cx"> } // namespace JSC
</span><span class="cx">
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeSymbolTableh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/SymbolTable.h (171659 => 171660)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/SymbolTable.h 2014-07-27 21:07:24 UTC (rev 171659)
+++ trunk/Source/JavaScriptCore/runtime/SymbolTable.h 2014-07-27 23:14:40 UTC (rev 171660)
</span><span class="lines">@@ -31,6 +31,7 @@
</span><span class="cx">
</span><span class="cx"> #include "ConcurrentJITLock.h"
</span><span class="cx"> #include "JSObject.h"
</span><ins>+#include "TypeSet.h"
</ins><span class="cx"> #include "VariableWatchpointSet.h"
</span><span class="cx"> #include <memory>
</span><span class="cx"> #include <wtf/HashTraits.h>
</span><span class="lines">@@ -336,6 +337,9 @@
</span><span class="cx"> typedef JSCell Base;
</span><span class="cx">
</span><span class="cx"> typedef HashMap<RefPtr<StringImpl>, SymbolTableEntry, IdentifierRepHash, HashTraits<RefPtr<StringImpl>>, SymbolTableIndexHashTraits> Map;
</span><ins>+ typedef HashMap<RefPtr<StringImpl>, int64_t> UniqueIDMap;
+ typedef HashMap<RefPtr<StringImpl>, RefPtr<TypeSet>> UniqueTypeSetMap;
+ typedef HashMap<int, RefPtr<StringImpl>, WTF::IntHash<int>, WTF::UnsignedWithZeroKeyHashTraits<int>> RegisterToVariableMap;
</ins><span class="cx">
</span><span class="cx"> static SymbolTable* create(VM& vm)
</span><span class="cx"> {
</span><span class="lines">@@ -349,7 +353,7 @@
</span><span class="cx">
</span><span class="cx"> static Structure* createStructure(VM& vm, JSGlobalObject* globalObject, JSValue prototype)
</span><span class="cx"> {
</span><del>- return Structure::create(vm, globalObject, prototype, TypeInfo(LeafType, StructureFlags), info());
</del><ins>+ return Structure::create(vm, globalObject, prototype, TypeInfo(CellType, StructureFlags), info());
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> // You must hold the lock until after you're done with the iterator.
</span><span class="lines">@@ -413,6 +417,12 @@
</span><span class="cx">
</span><span class="cx"> Map::AddResult add(const ConcurrentJITLocker&, StringImpl* key, const SymbolTableEntry& entry)
</span><span class="cx"> {
</span><ins>+ if (m_uniqueIDMap) {
+ // Use a flag to indicate that we need to produce a unique ID. Because VM is in charge of creating uniqueIDs,
+ // when uniqueID() is called, we check this flag to see if uniqueID creation is necessary.
+ m_uniqueIDMap->set(key, HighFidelityNeedsUniqueIDGeneration);
+ m_registerToVariableMap->set(entry.getIndex(), key);
+ }
</ins><span class="cx"> return m_map.add(key, entry);
</span><span class="cx"> }
</span><span class="cx">
</span><span class="lines">@@ -424,6 +434,10 @@
</span><span class="cx">
</span><span class="cx"> Map::AddResult set(const ConcurrentJITLocker&, StringImpl* key, const SymbolTableEntry& entry)
</span><span class="cx"> {
</span><ins>+ if (m_uniqueIDMap) {
+ m_uniqueIDMap->set(key, HighFidelityNeedsUniqueIDGeneration);
+ m_registerToVariableMap->set(entry.getIndex(), key);
+ }
</ins><span class="cx"> return m_map.set(key, entry);
</span><span class="cx"> }
</span><span class="cx">
</span><span class="lines">@@ -444,6 +458,11 @@
</span><span class="cx"> return contains(locker, key);
</span><span class="cx"> }
</span><span class="cx">
</span><ins>+ int64_t uniqueIDForVariable(const ConcurrentJITLocker&, StringImpl* key, VM& vm);
+ int64_t uniqueIDForRegister(const ConcurrentJITLocker& locker, int registerIndex, VM& vm);
+ RefPtr<TypeSet> globalTypeSetForRegister(const ConcurrentJITLocker& locker, int registerIndex, VM& vm);
+ RefPtr<TypeSet> globalTypeSetForVariable(const ConcurrentJITLocker& locker, StringImpl* key, VM& vm);
+
</ins><span class="cx"> bool usesNonStrictEval() { return m_usesNonStrictEval; }
</span><span class="cx"> void setUsesNonStrictEval(bool usesNonStrictEval) { m_usesNonStrictEval = usesNonStrictEval; }
</span><span class="cx">
</span><span class="lines">@@ -494,7 +513,10 @@
</span><span class="cx"> ~SymbolTable();
</span><span class="cx">
</span><span class="cx"> Map m_map;
</span><del>-
</del><ins>+ std::unique_ptr<UniqueIDMap> m_uniqueIDMap;
+ std::unique_ptr<RegisterToVariableMap> m_registerToVariableMap;
+ std::unique_ptr<UniqueTypeSetMap> m_uniqueTypeSetMap;
+
</ins><span class="cx"> int m_parameterCountIncludingThis;
</span><span class="cx"> bool m_usesNonStrictEval;
</span><span class="cx">
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeTypeSetcpp"></a>
<div class="addfile"><h4>Added: trunk/Source/JavaScriptCore/runtime/TypeSet.cpp (0 => 171660)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/TypeSet.cpp (rev 0)
+++ trunk/Source/JavaScriptCore/runtime/TypeSet.cpp 2014-07-27 23:14:40 UTC (rev 171660)
</span><span class="lines">@@ -0,0 +1,236 @@
</span><ins>+/*
+ * Copyright (C) 2008, 2014 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ * notice, this list of conditions and the following disclaimer in the
+ * documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "TypeSet.h"
+
+#include "JSCJSValue.h"
+#include "JSCJSValueInlines.h"
+#include <wtf/text/CString.h>
+#include <wtf/text/WTFString.h>
+#include <wtf/text/StringBuilder.h>
+#include <wtf/Vector.h>
+
+namespace JSC {
+
+TypeSet::TypeSet()
+ : m_seenTypes(TypeNothing)
+ , m_structureHistory(new Vector<RefPtr<StructureShape>>)
+ , m_mightHaveDuplicatesInStructureHistory(false)
+{
+}
+
+RuntimeType TypeSet::getRuntimeTypeForValue(JSValue v)
+{
+ RuntimeType ret;
+ if (v.isFunction())
+ ret = TypeFunction;
+ else if (v.isUndefined())
+ ret = TypeUndefined;
+ else if (v.isNull())
+ ret = TypeNull;
+ else if (v.isBoolean())
+ ret = TypeBoolean;
+ else if (v.isMachineInt())
+ ret = TypeMachineInt;
+ else if (v.isNumber())
+ ret = TypeNumber;
+ else if (v.isString())
+ ret = TypeString;
+ else if (v.isPrimitive())
+ ret = TypePrimitive;
+ else if (v.isObject())
+ ret = TypeObject;
+ else
+ CRASH();
+
+ return ret;
+}
+
+void TypeSet::addTypeForValue(JSValue v, PassRefPtr<StructureShape> shape)
+{
+ RuntimeType t = getRuntimeTypeForValue(v);
+ m_seenTypes = m_seenTypes | t;
+
+ if (shape) {
+ m_structureHistory->append(shape);
+ m_mightHaveDuplicatesInStructureHistory = true;
+ }
+}
+
+void TypeSet::removeDuplicatesInStructureHistory()
+{
+ Vector<RefPtr<StructureShape>>* newHistory = new Vector<RefPtr<StructureShape>>;
+ HashMap<String, bool> container;
+ for (size_t i = 0; i < m_structureHistory->size(); i++) {
+ RefPtr<StructureShape> a = m_structureHistory->at(i);
+ String hash = a->propertyHash();
+ auto iter = container.find(hash);
+ if (iter == container.end()) {
+ container.add(hash, true);
+ newHistory->append(a);
+ }
+ }
+
+ delete m_structureHistory;
+ m_structureHistory = newHistory;
+ m_mightHaveDuplicatesInStructureHistory = false;
+}
+
+String TypeSet::seenTypes()
+{
+ if (m_seenTypes == TypeNothing)
+ return "(Unreached Statement)";
+
+ if (m_mightHaveDuplicatesInStructureHistory)
+ removeDuplicatesInStructureHistory();
+
+ StringBuilder seen;
+
+ if (m_seenTypes & TypeFunction)
+ seen.append("Function ");
+ if (m_seenTypes & TypeUndefined)
+ seen.append("Undefined ");
+ if (m_seenTypes & TypeNull)
+ seen.append("Null ");
+ if (m_seenTypes & TypeBoolean)
+ seen.append("Boolean ");
+ if (m_seenTypes & TypeMachineInt)
+ seen.append("MachineInt ");
+ if (m_seenTypes & TypeNumber)
+ seen.append("Number ");
+ if (m_seenTypes & TypeString)
+ seen.append("String ");
+ if (m_seenTypes & TypePrimitive)
+ seen.append("Primitive ");
+ if (m_seenTypes & TypeObject)
+ seen.append("Object ");
+
+ if (m_structureHistory->size())
+ seen.append("\nStructures:[ ");
+ for (size_t i = 0; i < m_structureHistory->size(); i++) {
+ seen.append(m_structureHistory->at(i)->stringRepresentation());
+ seen.append(" ");
+ }
+ if (m_structureHistory->size())
+ seen.append("]");
+
+ if (m_structureHistory->size()) {
+ seen.append("\nLUB: ");
+ seen.append(StructureShape::leastUpperBound(m_structureHistory));
+ }
+
+ return seen.toString();
+}
+
+void TypeSet::dumpSeenTypes()
+{
+ dataLog(seenTypes(), "\n");
+}
+
+StructureShape::StructureShape()
+ : m_propertyHash(nullptr)
+ , m_final(false)
+{
+}
+
+void StructureShape::markAsFinal()
+{
+ ASSERT(!m_final);
+ m_final = true;
+}
+
+void StructureShape::addProperty(RefPtr<StringImpl> impl)
+{
+ ASSERT(!m_final);
+ m_fields.set(impl, true);
+}
+
+String StructureShape::propertyHash()
+{
+ ASSERT(m_final);
+ if (m_propertyHash)
+ return *m_propertyHash;
+
+ StringBuilder builder;
+ builder.append(":");
+ for (auto iter = m_fields.begin(), end = m_fields.end(); iter != end; ++iter) {
+ String property = String(iter->key);
+ property.replace(":", "\\:"); // Ensure that hash({"foo:", "bar"}) != hash({"foo", ":bar"}) because we're using colons as a separator and colons are legal characters in field names in JS.
+ builder.append(property);
+ }
+
+ m_propertyHash = std::make_unique<String>(builder.toString());
+ return *m_propertyHash;
+}
+
+String StructureShape::leastUpperBound(Vector<RefPtr<StructureShape>>* shapes)
+{
+ if (!shapes->size())
+ return "";
+
+ StringBuilder lub;
+ RefPtr<StructureShape> origin = shapes->at(0);
+ lub.append("{");
+ for (auto iter = origin->m_fields.begin(), end = origin->m_fields.end(); iter != end; ++iter) {
+ bool shouldAdd = true;
+ for (size_t i = 1, size = shapes->size(); i < size; i++) {
+ // If all other Shapes have the same field as origin, add it to the least upper bound.
+ if (!shapes->at(i)->m_fields.contains(iter->key)) {
+ shouldAdd = false;
+ break;
+ }
+ }
+ if (shouldAdd)
+ lub.append(String(iter->key.get()) + String(", "));
+ }
+
+ if (lub.length() >= 3)
+ lub.resize(lub.length() - 2); // Remove the trailing ', '
+
+ lub.append("}");
+
+ return lub.toString();
+}
+
+String StructureShape::stringRepresentation()
+{
+ StringBuilder representation;
+ representation.append("{");
+ for (auto iter = m_fields.begin(), end = m_fields.end(); iter != end; ++iter) {
+ String prop(iter->key.get());
+ representation.append(prop);
+ representation.append(", ");
+ }
+
+ if (representation.length() >= 3)
+ representation.resize(representation.length() - 2);
+
+ representation.append("}");
+
+ return representation.toString();
+}
+
+} //namespace JSC
</ins></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeTypeSeth"></a>
<div class="addfile"><h4>Added: trunk/Source/JavaScriptCore/runtime/TypeSet.h (0 => 171660)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/TypeSet.h (rev 0)
+++ trunk/Source/JavaScriptCore/runtime/TypeSet.h 2014-07-27 23:14:40 UTC (rev 171660)
</span><span class="lines">@@ -0,0 +1,90 @@
</span><ins>+/*
+ * Copyright (C) 2008, 2014 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ * notice, this list of conditions and the following disclaimer in the
+ * documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef TypeSet_h
+#define TypeSet_h
+
+#include <wtf/HashMap.h>
+#include <wtf/RefCounted.h>
+#include <wtf/text/WTFString.h>
+#include <wtf/Vector.h>
+
+namespace JSC {
+
+class JSValue;
+
+enum RuntimeType {
+ TypeNothing = 0x0,
+ TypeFunction = 0x1,
+ TypeUndefined = 0x2,
+ TypeNull = 0x4,
+ TypeBoolean = 0x8,
+ TypeMachineInt = 0x10,
+ TypeNumber = 0x20,
+ TypeString = 0x40,
+ TypePrimitive = 0x80,
+ TypeObject = 0x100
+};
+
+class StructureShape : public RefCounted<StructureShape> {
+ friend class TypeSet;
+
+public:
+ StructureShape();
+
+ static PassRefPtr<StructureShape> create() { return adoptRef(new StructureShape); }
+ String propertyHash();
+ void markAsFinal();
+ void addProperty(RefPtr<StringImpl>);
+ static String leastUpperBound(Vector<RefPtr<StructureShape>>*);
+ String stringRepresentation();
+
+private:
+ HashMap<RefPtr<StringImpl>, bool> m_fields;
+ std::unique_ptr<String> m_propertyHash;
+ bool m_final;
+};
+
+class TypeSet : public RefCounted<TypeSet> {
+
+public:
+ static PassRefPtr<TypeSet> create() { return adoptRef(new TypeSet); }
+ TypeSet();
+ void addTypeForValue(JSValue v, PassRefPtr<StructureShape>);
+ static RuntimeType getRuntimeTypeForValue(JSValue);
+ JS_EXPORT_PRIVATE String seenTypes();
+
+private:
+ uint32_t m_seenTypes;
+ void dumpSeenTypes();
+ Vector<RefPtr<StructureShape>>* m_structureHistory;
+ bool m_mightHaveDuplicatesInStructureHistory;
+ void removeDuplicatesInStructureHistory();
+
+};
+
+} //namespace JSC
+
+#endif //TypeSet_h
</ins></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeVMcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/VM.cpp (171659 => 171660)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/VM.cpp 2014-07-27 21:07:24 UTC (rev 171659)
+++ trunk/Source/JavaScriptCore/runtime/VM.cpp 2014-07-27 23:14:40 UTC (rev 171660)
</span><span class="lines">@@ -40,7 +40,7 @@
</span><span class="cx"> #include "CustomGetterSetter.h"
</span><span class="cx"> #include "DFGLongLivedState.h"
</span><span class="cx"> #include "DFGWorklist.h"
</span><del>-#include "DebuggerActivation.h"
</del><ins>+#include "DebuggerScope.h"
</ins><span class="cx"> #include "ErrorInstance.h"
</span><span class="cx"> #include "FTLThunks.h"
</span><span class="cx"> #include "FunctionConstructor.h"
</span><span class="lines">@@ -48,6 +48,8 @@
</span><span class="cx"> #include "GetterSetter.h"
</span><span class="cx"> #include "Heap.h"
</span><span class="cx"> #include "HeapIterationScope.h"
</span><ins>+#include "HighFidelityTypeProfiler.h"
+#include "HighFidelityLog.h"
</ins><span class="cx"> #include "HostCallReturnValue.h"
</span><span class="cx"> #include "Identifier.h"
</span><span class="cx"> #include "IncrementalSweeper.h"
</span><span class="lines">@@ -89,6 +91,7 @@
</span><span class="cx"> #include <wtf/Threading.h>
</span><span class="cx"> #include <wtf/WTFThreadData.h>
</span><span class="cx"> #include <wtf/text/AtomicStringTable.h>
</span><ins>+#include <wtf/CurrentTime.h>
</ins><span class="cx">
</span><span class="cx"> #if ENABLE(DFG_JIT)
</span><span class="cx"> #include "ConservativeRoots.h"
</span><span class="lines">@@ -230,6 +233,7 @@
</span><span class="cx"> , m_codeCache(CodeCache::create())
</span><span class="cx"> , m_enabledProfiler(nullptr)
</span><span class="cx"> , m_builtinExecutables(BuiltinExecutables::create(*this))
</span><ins>+ , m_nextUniqueVariableID(1)
</ins><span class="cx"> {
</span><span class="cx"> interpreter = new Interpreter(*this);
</span><span class="cx"> StackBounds stack = wtfThreadData().stack();
</span><span class="lines">@@ -245,7 +249,7 @@
</span><span class="cx"> propertyNames = new CommonIdentifiers(this);
</span><span class="cx"> structureStructure.set(*this, Structure::createStructure(*this));
</span><span class="cx"> structureRareDataStructure.set(*this, StructureRareData::createStructure(*this, 0, jsNull()));
</span><del>- debuggerActivationStructure.set(*this, DebuggerActivation::createStructure(*this, 0, jsNull()));
</del><ins>+ debuggerScopeStructure.set(*this, DebuggerScope::createStructure(*this, 0, jsNull()));
</ins><span class="cx"> terminatedExecutionErrorStructure.set(*this, TerminatedExecutionError::createStructure(*this, 0, jsNull()));
</span><span class="cx"> stringStructure.set(*this, JSString::createStructure(*this, 0, jsNull()));
</span><span class="cx"> notAnObjectStructure.set(*this, JSNotAnObject::createStructure(*this, 0, jsNull()));
</span><span class="lines">@@ -264,7 +268,6 @@
</span><span class="cx"> structureChainStructure.set(*this, StructureChain::createStructure(*this, 0, jsNull()));
</span><span class="cx"> sparseArrayValueMapStructure.set(*this, SparseArrayValueMap::createStructure(*this, 0, jsNull()));
</span><span class="cx"> arrayBufferNeuteringWatchpointStructure.set(*this, ArrayBufferNeuteringWatchpoint::createStructure(*this));
</span><del>- withScopeStructure.set(*this, JSWithScope::createStructure(*this, 0, jsNull()));
</del><span class="cx"> unlinkedFunctionExecutableStructure.set(*this, UnlinkedFunctionExecutable::createStructure(*this, 0, jsNull()));
</span><span class="cx"> unlinkedProgramCodeBlockStructure.set(*this, UnlinkedProgramCodeBlock::createStructure(*this, 0, jsNull()));
</span><span class="cx"> unlinkedEvalCodeBlockStructure.set(*this, UnlinkedEvalCodeBlock::createStructure(*this, 0, jsNull()));
</span><span class="lines">@@ -322,6 +325,12 @@
</span><span class="cx"> // Initialize this last, as a free way of asserting that VM initialization itself
</span><span class="cx"> // won't use this.
</span><span class="cx"> m_typedArrayController = adoptRef(new SimpleTypedArrayController());
</span><ins>+
+ // FIXME: conditionally allocate this stuff based on whether or not the inspector is running OR this flag is enabled (not just if the flag is enabled).
+ if (Options::profileTypesWithHighFidelity()) {
+ m_highFidelityTypeProfiler = std::make_unique<HighFidelityTypeProfiler>();
+ m_highFidelityLog = std::make_unique<HighFidelityLog>();
+ }
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> VM::~VM()
</span><span class="lines">@@ -914,6 +923,46 @@
</span><span class="cx"> }
</span><span class="cx"> }
</span><span class="cx">
</span><ins>+String VM::getTypesForVariableInRange(unsigned startLine, unsigned startColumn, unsigned endLine, unsigned endColumn, const String& variableName, const String& sourceIDAsString)
+{
+ if (!isProfilingTypesWithHighFidelity())
+ return "(Not Profiling)";
+
+ bool okay;
+ intptr_t sourceID = sourceIDAsString.toIntPtrStrict(&okay);
+ if (!okay)
+ CRASH();
+
+ updateHighFidelityTypeProfileState();
+ return m_highFidelityTypeProfiler->getTypesForVariableInRange(startLine, startColumn, endLine, endColumn, variableName, sourceID);
+}
+
+void VM::updateHighFidelityTypeProfileState()
+{
+ if (!isProfilingTypesWithHighFidelity())
+ return;
+
+ highFidelityLog()->processHighFidelityLog(false, "VM Update");
+}
+
+void VM::dumpHighFidelityProfilingTypes()
+{
+ if (!isProfilingTypesWithHighFidelity())
+ return;
+
+ updateHighFidelityTypeProfileState();
+ HighFidelityTypeProfiler* profiler = m_highFidelityTypeProfiler.get();
+ for (Bag<TypeLocation>::iterator iter = m_locationInfo.begin(); !!iter; ++iter) {
+ TypeLocation* location = *iter;
+ dataLogF("[Line, Column]::[%u, %u] ", location->m_line, location->m_column);
+ dataLog("\n\t\t#Local#\n\t\t",
+ profiler->getLocalTypesForVariableInRange(location->m_line, location->m_column, location->m_line, location->m_column, "", location->m_sourceID).replace("\n", "\n\t\t"),
+ "\n\t\t#Global#\n\t\t",
+ profiler->getGlobalTypesForVariableInRange(location->m_line, location->m_column, location->m_line, location->m_column, "", location->m_sourceID).replace("\n", "\n\t\t"),
+ "\n");
+ }
+}
+
</ins><span class="cx"> void sanitizeStackForVM(VM* vm)
</span><span class="cx"> {
</span><span class="cx"> logSanitizeStack(vm);
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeVMh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/VM.h (171659 => 171660)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/VM.h 2014-07-27 21:07:24 UTC (rev 171659)
+++ trunk/Source/JavaScriptCore/runtime/VM.h 2014-07-27 23:14:40 UTC (rev 171660)
</span><span class="lines">@@ -46,9 +46,11 @@
</span><span class="cx"> #include "Strong.h"
</span><span class="cx"> #include "ThunkGenerators.h"
</span><span class="cx"> #include "TypedArrayController.h"
</span><ins>+#include "TypeLocation.h"
</ins><span class="cx"> #include "Watchdog.h"
</span><span class="cx"> #include "Watchpoint.h"
</span><span class="cx"> #include "WeakRandom.h"
</span><ins>+#include <wtf/Bag.h>
</ins><span class="cx"> #include <wtf/BumpPointerAllocator.h>
</span><span class="cx"> #include <wtf/DateMath.h>
</span><span class="cx"> #include <wtf/Forward.h>
</span><span class="lines">@@ -74,6 +76,8 @@
</span><span class="cx"> class CommonIdentifiers;
</span><span class="cx"> class ExecState;
</span><span class="cx"> class HandleStack;
</span><ins>+ class HighFidelityTypeProfiler;
+ class HighFidelityLog;
</ins><span class="cx"> class Identifier;
</span><span class="cx"> class Interpreter;
</span><span class="cx"> class JSGlobalObject;
</span><span class="lines">@@ -84,6 +88,7 @@
</span><span class="cx"> class NativeExecutable;
</span><span class="cx"> class ParserArena;
</span><span class="cx"> class RegExpCache;
</span><ins>+ class ScriptExecutable;
</ins><span class="cx"> class SourceProvider;
</span><span class="cx"> class SourceProviderCache;
</span><span class="cx"> struct StackFrame;
</span><span class="lines">@@ -96,6 +101,7 @@
</span><span class="cx"> class UnlinkedEvalCodeBlock;
</span><span class="cx"> class UnlinkedFunctionExecutable;
</span><span class="cx"> class UnlinkedProgramCodeBlock;
</span><ins>+ class VirtualRegister;
</ins><span class="cx"> class VMEntryScope;
</span><span class="cx"> class Watchpoint;
</span><span class="cx"> class WatchpointSet;
</span><span class="lines">@@ -256,7 +262,7 @@
</span><span class="cx">
</span><span class="cx"> Strong<Structure> structureStructure;
</span><span class="cx"> Strong<Structure> structureRareDataStructure;
</span><del>- Strong<Structure> debuggerActivationStructure;
</del><ins>+ Strong<Structure> debuggerScopeStructure;
</ins><span class="cx"> Strong<Structure> terminatedExecutionErrorStructure;
</span><span class="cx"> Strong<Structure> stringStructure;
</span><span class="cx"> Strong<Structure> notAnObjectStructure;
</span><span class="lines">@@ -275,7 +281,6 @@
</span><span class="cx"> Strong<Structure> structureChainStructure;
</span><span class="cx"> Strong<Structure> sparseArrayValueMapStructure;
</span><span class="cx"> Strong<Structure> arrayBufferNeuteringWatchpointStructure;
</span><del>- Strong<Structure> withScopeStructure;
</del><span class="cx"> Strong<Structure> unlinkedFunctionExecutableStructure;
</span><span class="cx"> Strong<Structure> unlinkedProgramCodeBlockStructure;
</span><span class="cx"> Strong<Structure> unlinkedEvalCodeBlockStructure;
</span><span class="lines">@@ -510,6 +515,15 @@
</span><span class="cx">
</span><span class="cx"> BuiltinExecutables* builtinExecutables() { return m_builtinExecutables.get(); }
</span><span class="cx">
</span><ins>+ bool isProfilingTypesWithHighFidelity() { return !!m_highFidelityTypeProfiler; }
+ String getTypesForVariableInRange(unsigned startLine, unsigned startColumn, unsigned endLine, unsigned endColumn, const String& variableName, const String& sourceID);
+ HighFidelityLog* highFidelityLog() { return m_highFidelityLog.get(); }
+ HighFidelityTypeProfiler* highFidelityTypeProfiler() { return m_highFidelityTypeProfiler.get(); }
+ void updateHighFidelityTypeProfileState();
+ TypeLocation* nextLocation() { return m_locationInfo.add(); } //TODO: possible optmization: when codeblocks die, report which locations are no longer being changed so we don't walk over them
+ JS_EXPORT_PRIVATE void dumpHighFidelityProfilingTypes();
+ int64_t getNextUniqueVariableID() { return m_nextUniqueVariableID++; }
+
</ins><span class="cx"> private:
</span><span class="cx"> friend class LLIntOffsetsExtractor;
</span><span class="cx"> friend class ClearExceptionScope;
</span><span class="lines">@@ -558,6 +572,10 @@
</span><span class="cx"> OwnPtr<BuiltinExecutables> m_builtinExecutables;
</span><span class="cx"> RefCountedArray<StackFrame> m_exceptionStack;
</span><span class="cx"> HashMap<String, RefPtr<WatchpointSet>> m_impurePropertyWatchpointSets;
</span><ins>+ std::unique_ptr<HighFidelityTypeProfiler> m_highFidelityTypeProfiler;
+ std::unique_ptr<HighFidelityLog> m_highFidelityLog;
+ int64_t m_nextUniqueVariableID;
+ Bag<TypeLocation> m_locationInfo;
</ins><span class="cx"> };
</span><span class="cx">
</span><span class="cx"> #if ENABLE(GC_VALIDATION)
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeWeakMapDatah"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/WeakMapData.h (171659 => 171660)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/WeakMapData.h 2014-07-27 21:07:24 UTC (rev 171659)
+++ trunk/Source/JavaScriptCore/runtime/WeakMapData.h 2014-07-27 23:14:40 UTC (rev 171660)
</span><span class="lines">@@ -47,7 +47,7 @@
</span><span class="cx">
</span><span class="cx"> static Structure* createStructure(VM& vm, JSGlobalObject* globalObject, JSValue prototype)
</span><span class="cx"> {
</span><del>- return Structure::create(vm, globalObject, prototype, TypeInfo(CompoundType, StructureFlags), info());
</del><ins>+ return Structure::create(vm, globalObject, prototype, TypeInfo(CellType, StructureFlags), info());
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> static const bool needsDestruction = true;
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoretestsstressfoldmultigetbyoffsettogetbyoffsetwithoutfoldingthestructurecheckjs"></a>
<div class="addfile"><h4>Added: trunk/Source/JavaScriptCore/tests/stress/fold-multi-get-by-offset-to-get-by-offset-without-folding-the-structure-check.js (0 => 171660)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/tests/stress/fold-multi-get-by-offset-to-get-by-offset-without-folding-the-structure-check.js (rev 0)
+++ trunk/Source/JavaScriptCore/tests/stress/fold-multi-get-by-offset-to-get-by-offset-without-folding-the-structure-check.js 2014-07-27 23:14:40 UTC (rev 171660)
</span><span class="lines">@@ -0,0 +1,50 @@
</span><ins>+function foo(o) {
+ return o.f;
+}
+
+function fu(o) {
+ return o.e;
+}
+
+function bar(f, o) {
+ return f(o);
+}
+
+function baz(f, o) {
+ return f(o);
+}
+
+for (var i = 0; i < 100; ++i) {
+ foo({f:1, e:2});
+ foo({e:1, f:2});
+ foo({d:1, e:2, f:3});
+ fu({f:1, e:2});
+ fu({e:1, f:2, g:3});
+ fu({d:1, e:2, f:3, g:4});
+}
+
+for (var i = 0; i < 100; ++i) {
+ bar(foo, {f:1});
+ bar(function() { }, null);
+ bar(function() { return 42; }, null);
+ baz(fu, {e:1});
+ baz(function() { }, null);
+ baz(function() { return 42; }, null);
+}
+
+(function(f, g, o, p) {
+ var result = 0;
+ var n = 1000000;
+ for (var i = 0; i < n; ++i) {
+ var q;
+ if (i == n - 1)
+ q = p;
+ else
+ q = o;
+ result += baz(g, q);
+ result += bar(f, q);
+ }
+ if (result != (n - 1) * (o.f + o.e) + 12 + 13)
+ throw "Error: bad result: " + result;
+})(foo, fu, {f:42, e:2}, {e:12, f:13, g:14});
+
</ins></span></pre></div>
<a id="trunkSourceJavaScriptCoretestsstressfoldmultiputbyoffsettoputbyoffsetwithoutfoldingthestructurecheckjs"></a>
<div class="addfile"><h4>Added: trunk/Source/JavaScriptCore/tests/stress/fold-multi-put-by-offset-to-put-by-offset-without-folding-the-structure-check.js (0 => 171660)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/tests/stress/fold-multi-put-by-offset-to-put-by-offset-without-folding-the-structure-check.js (rev 0)
+++ trunk/Source/JavaScriptCore/tests/stress/fold-multi-put-by-offset-to-put-by-offset-without-folding-the-structure-check.js 2014-07-27 23:14:40 UTC (rev 171660)
</span><span class="lines">@@ -0,0 +1,56 @@
</span><ins>+function foo(o) {
+ o.f = 1;
+}
+
+function fu(o) {
+ o.e = 2;
+}
+
+function bar(f, o) {
+ f(o);
+}
+
+function baz(f, o) {
+ f(o);
+}
+
+for (var i = 0; i < 100; ++i) {
+ foo({f:1, e:2});
+ foo({e:1, f:2});
+ foo({d:1, e:2, f:3});
+ fu({f:1, e:2});
+ fu({e:1, f:2, g:3});
+ fu({d:1, e:2, f:3, g:4});
+}
+
+for (var i = 0; i < 100; ++i) {
+ bar(foo, {f:1});
+ bar(function() { }, null);
+ bar(function() { return 42; }, null);
+ baz(fu, {e:1});
+ baz(function() { }, null);
+ baz(function() { return 42; }, null);
+}
+
+(function(f, g, o, p) {
+ var result = 0;
+ var n = 1000000;
+ for (var i = 0; i < n; ++i) {
+ var q;
+ if (i == n - 1)
+ q = p;
+ else
+ q = o;
+ baz(g, q);
+ bar(f, q);
+ }
+ if (o.e != 2)
+ throw "Error: bad value in o.e: " + o.e;
+ if (o.f != 1)
+ throw "Error: bad value in o.f: " + o.f;
+ if (p.e != 2)
+ throw "Error: bad value in p.e: " + p.e;
+ if (p.f != 1)
+ throw "Error: bad value in p.f: " + p.f;
+})(foo, fu, {f:42, e:2}, {e:12, f:13, g:14});
+
</ins></span></pre></div>
<a id="trunkSourceJavaScriptCoretestsstresshascustompropertiesjs"></a>
<div class="addfile"><h4>Added: trunk/Source/JavaScriptCore/tests/stress/has-custom-properties.js (0 => 171660)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/tests/stress/has-custom-properties.js (rev 0)
+++ trunk/Source/JavaScriptCore/tests/stress/has-custom-properties.js 2014-07-27 23:14:40 UTC (rev 171660)
</span><span class="lines">@@ -0,0 +1,13 @@
</span><ins>+(function() {
+ for (var i = 0; i < 10000; ++i) {
+ var o = {};
+
+ if (hasCustomProperties(o))
+ throw "Error: object shouldn't have custom properties yet.";
+
+ o.f = 42;
+
+ if (!hasCustomProperties(o))
+ throw "Error: object should have custom properties already.";
+ }
+})();
</ins></span></pre></div>
<a id="trunkSourceJavaScriptCoretestsstressprunemultiputbyoffsetreplaceortransitionvariantjs"></a>
<div class="addfile"><h4>Added: trunk/Source/JavaScriptCore/tests/stress/prune-multi-put-by-offset-replace-or-transition-variant.js (0 => 171660)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/tests/stress/prune-multi-put-by-offset-replace-or-transition-variant.js (rev 0)
+++ trunk/Source/JavaScriptCore/tests/stress/prune-multi-put-by-offset-replace-or-transition-variant.js 2014-07-27 23:14:40 UTC (rev 171660)
</span><span class="lines">@@ -0,0 +1,58 @@
</span><ins>+function foo(o) {
+ o.f = 1;
+}
+
+function fu(o) {
+ o.e = 2;
+}
+
+function bar(f, o) {
+ f(o);
+}
+
+function baz(f, o) {
+ f(o);
+}
+
+for (var i = 0; i < 100; ++i) {
+ foo({f:1, e:2});
+ foo({e:1, f:2});
+ foo({e:1});
+ foo({d:1, e:2, f:3});
+ fu({f:1, e:2});
+ fu({e:1, f:2});
+ fu({e:1, f:2, g:3});
+ fu({d:1, e:2, f:3, g:4});
+}
+
+for (var i = 0; i < 100; ++i) {
+ bar(foo, {f:1});
+ bar(function() { }, null);
+ bar(function() { return 42; }, null);
+ baz(fu, {e:1});
+ baz(function() { }, null);
+ baz(function() { return 42; }, null);
+}
+
+(function(f, g, o, p) {
+ var result = 0;
+ var n = 1000000;
+ for (var i = 0; i < n; ++i) {
+ var q;
+ if (i == n - 1)
+ q = p;
+ else
+ q = o;
+ baz(g, q);
+ bar(f, q);
+ }
+ if (o.e != 2)
+ throw "Error: bad value in o.e: " + o.e;
+ if (o.f != 1)
+ throw "Error: bad value in o.f: " + o.f;
+ if (p.e != 2)
+ throw "Error: bad value in p.e: " + p.e;
+ if (p.f != 1)
+ throw "Error: bad value in p.f: " + p.f;
+})(foo, fu, {e:42, f:2}, {e:12, f:13, g:14});
+
</ins></span></pre></div>
<a id="trunkSourceWTFChangeLog"></a>
<div class="modfile"><h4>Modified: trunk/Source/WTF/ChangeLog (171659 => 171660)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WTF/ChangeLog 2014-07-27 21:07:24 UTC (rev 171659)
+++ trunk/Source/WTF/ChangeLog 2014-07-27 23:14:40 UTC (rev 171660)
</span><span class="lines">@@ -1,3 +1,9 @@
</span><ins>+2014-07-27 Filip Pizlo <fpizlo@apple.com>
+
+ Merge r170090, r170092, r170129, r170141, r170161, r170215, r170275, r170375, r170376, r170382, r170383, r170399, r170436, r170489, r170490, r170556 from ftlopt.
+
+ * wtf/text/WTFString.h:
+
</ins><span class="cx"> 2014-07-26 Filip Pizlo <fpizlo@apple.com>
</span><span class="cx">
</span><span class="cx"> Unreviewed, roll out r171641-r171644. It broke some tests; will investigate and
</span></span></pre></div>
<a id="trunkSourceWTFwtftextWTFStringh"></a>
<div class="modfile"><h4>Modified: trunk/Source/WTF/wtf/text/WTFString.h (171659 => 171660)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WTF/wtf/text/WTFString.h 2014-07-27 21:07:24 UTC (rev 171659)
+++ trunk/Source/WTF/wtf/text/WTFString.h 2014-07-27 23:14:40 UTC (rev 171660)
</span><span class="lines">@@ -355,7 +355,7 @@
</span><span class="cx"> WTF_EXPORT_STRING_API unsigned toUIntStrict(bool* ok = 0, int base = 10) const;
</span><span class="cx"> WTF_EXPORT_STRING_API int64_t toInt64Strict(bool* ok = 0, int base = 10) const;
</span><span class="cx"> WTF_EXPORT_STRING_API uint64_t toUInt64Strict(bool* ok = 0, int base = 10) const;
</span><del>- intptr_t toIntPtrStrict(bool* ok = 0, int base = 10) const;
</del><ins>+ WTF_EXPORT_STRING_API intptr_t toIntPtrStrict(bool* ok = 0, int base = 10) const;
</ins><span class="cx">
</span><span class="cx"> WTF_EXPORT_STRING_API int toInt(bool* ok = 0) const;
</span><span class="cx"> WTF_EXPORT_STRING_API unsigned toUInt(bool* ok = 0) const;
</span></span></pre></div>
<a id="trunkSourceWebCoreChangeLog"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/ChangeLog (171659 => 171660)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/ChangeLog 2014-07-27 21:07:24 UTC (rev 171659)
+++ trunk/Source/WebCore/ChangeLog 2014-07-27 23:14:40 UTC (rev 171660)
</span><span class="lines">@@ -1,3 +1,27 @@
</span><ins>+2014-07-27 Filip Pizlo <fpizlo@apple.com>
+
+ Merge r170090, r170092, r170129, r170141, r170161, r170215, r170275, r170375, r170376, r170382, r170383, r170399, r170436, r170489, r170490, r170556 from ftlopt.
+
+ This fixes the previous mismerge and adds test coverage for the thing that went wrong.
+ Also, this adds some helpers for making it easier to inspect JavaScript values.
+
+ * testing/Internals.cpp:
+ (WebCore::Internals::description):
+ * testing/Internals.h:
+ * testing/Internals.idl:
+
+ 2014-07-25 Mark Lam <mark.lam@apple.com>
+
+ [ftlopt] Renamed DebuggerActivation to DebuggerScope.
+ <https://webkit.org/b/134273>
+
+ Reviewed by Michael Saboff.
+
+ No new tests.
+
+ * ForwardingHeaders/debugger/DebuggerActivation.h: Removed.
+ - Removed because this is not used.
+
</ins><span class="cx"> 2014-07-26 Brian J. Burg <burg@cs.washington.edu>
</span><span class="cx">
</span><span class="cx"> Web Replay: log and enforce session/segment state machine transitions
</span></span></pre></div>
<a id="trunkSourceWebCoreForwardingHeadersdebuggerDebuggerActivationh"></a>
<div class="delfile"><h4>Deleted: trunk/Source/WebCore/ForwardingHeaders/debugger/DebuggerActivation.h (171659 => 171660)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/ForwardingHeaders/debugger/DebuggerActivation.h 2014-07-27 21:07:24 UTC (rev 171659)
+++ trunk/Source/WebCore/ForwardingHeaders/debugger/DebuggerActivation.h 2014-07-27 23:14:40 UTC (rev 171660)
</span><span class="lines">@@ -1,4 +0,0 @@
</span><del>-#ifndef WebCore_FWD_DebuggerActivation_h
-#define WebCore_FWD_DebuggerActivation_h
-#include <JavaScriptCore/DebuggerActivation.h>
-#endif
</del></span></pre></div>
<a id="trunkSourceWebCoretestingInternalscpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/testing/Internals.cpp (171659 => 171660)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/testing/Internals.cpp 2014-07-27 21:07:24 UTC (rev 171659)
+++ trunk/Source/WebCore/testing/Internals.cpp 2014-07-27 23:14:40 UTC (rev 171660)
</span><span class="lines">@@ -352,6 +352,11 @@
</span><span class="cx"> return String(buf);
</span><span class="cx"> }
</span><span class="cx">
</span><ins>+String Internals::description(Deprecated::ScriptValue value)
+{
+ return toString(value.jsValue());
+}
+
</ins><span class="cx"> bool Internals::isPreloaded(const String& url)
</span><span class="cx"> {
</span><span class="cx"> Document* document = contextDocument();
</span></span></pre></div>
<a id="trunkSourceWebCoretestingInternalsh"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/testing/Internals.h (171659 => 171660)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/testing/Internals.h 2014-07-27 21:07:24 UTC (rev 171659)
+++ trunk/Source/WebCore/testing/Internals.h 2014-07-27 23:14:40 UTC (rev 171660)
</span><span class="lines">@@ -75,6 +75,7 @@
</span><span class="cx"> String elementRenderTreeAsText(Element*, ExceptionCode&);
</span><span class="cx">
</span><span class="cx"> String address(Node*);
</span><ins>+ String description(Deprecated::ScriptValue);
</ins><span class="cx">
</span><span class="cx"> bool isPreloaded(const String& url);
</span><span class="cx"> bool isLoadingFromMemoryCache(const String& url);
</span></span></pre></div>
<a id="trunkSourceWebCoretestingInternalsidl"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/testing/Internals.idl (171659 => 171660)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/testing/Internals.idl 2014-07-27 21:07:24 UTC (rev 171659)
+++ trunk/Source/WebCore/testing/Internals.idl 2014-07-27 23:14:40 UTC (rev 171660)
</span><span class="lines">@@ -28,6 +28,7 @@
</span><span class="cx"> NoInterfaceObject,
</span><span class="cx"> ] interface Internals {
</span><span class="cx"> DOMString address(Node node);
</span><ins>+ DOMString description(any value);
</ins><span class="cx">
</span><span class="cx"> [RaisesException] DOMString elementRenderTreeAsText(Element element);
</span><span class="cx"> boolean isPreloaded(DOMString url);
</span></span></pre></div>
<a id="trunkSourceWebKitmacChangeLog"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebKit/mac/ChangeLog (171659 => 171660)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebKit/mac/ChangeLog 2014-07-27 21:07:24 UTC (rev 171659)
+++ trunk/Source/WebKit/mac/ChangeLog 2014-07-27 23:14:40 UTC (rev 171660)
</span><span class="lines">@@ -1,3 +1,17 @@
</span><ins>+2014-07-27 Filip Pizlo <fpizlo@apple.com>
+
+ Merge r170090, r170092, r170129, r170141, r170161, r170215, r170275, r170375, r170376, r170382, r170383, r170399, r170436, r170489, r170490, r170556 from ftlopt.
+
+ 2014-07-25 Mark Lam <mark.lam@apple.com>
+
+ [ftlopt] Renamed DebuggerActivation to DebuggerScope.
+ <https://webkit.org/b/134273>
+
+ Reviewed by Michael Saboff.
+
+ * WebView/WebScriptDebugDelegate.mm:
+ - Removed unneeded #include.
+
</ins><span class="cx"> 2014-07-26 Filip Pizlo <fpizlo@apple.com>
</span><span class="cx">
</span><span class="cx"> Unreviewed, roll out r171641-r171644. It broke some tests; will investigate and
</span></span></pre></div>
<a id="trunkSourceWebKitmacWebViewWebScriptDebugDelegatemm"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebKit/mac/WebView/WebScriptDebugDelegate.mm (171659 => 171660)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebKit/mac/WebView/WebScriptDebugDelegate.mm 2014-07-27 21:07:24 UTC (rev 171659)
+++ trunk/Source/WebKit/mac/WebView/WebScriptDebugDelegate.mm 2014-07-27 23:14:40 UTC (rev 171660)
</span><span class="lines">@@ -37,7 +37,6 @@
</span><span class="cx"> #import <WebCore/WebScriptObjectPrivate.h>
</span><span class="cx"> #import <WebCore/runtime_root.h>
</span><span class="cx"> #import <debugger/Debugger.h>
</span><del>-#import <debugger/DebuggerActivation.h>
</del><span class="cx"> #import <interpreter/CallFrame.h>
</span><span class="cx"> #import <runtime/Completion.h>
</span><span class="cx"> #import <runtime/JSFunction.h>
</span></span></pre>
</div>
</div>
</body>
</html>