<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN"
"http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head><meta http-equiv="content-type" content="text/html; charset=utf-8" />
<title>[181650] trunk/Source/JavaScriptCore</title>
</head>
<body>
<style type="text/css"><!--
#msg dl.meta { border: 1px #006 solid; background: #369; padding: 6px; color: #fff; }
#msg dl.meta dt { float: left; width: 6em; font-weight: bold; }
#msg dt:after { content:':';}
#msg dl, #msg dt, #msg ul, #msg li, #header, #footer, #logmsg { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; }
#msg dl a { font-weight: bold}
#msg dl a:link { color:#fc3; }
#msg dl a:active { color:#ff0; }
#msg dl a:visited { color:#cc6; }
h3 { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; font-weight: bold; }
#msg pre { overflow: auto; background: #ffc; border: 1px #fa0 solid; padding: 6px; }
#logmsg { background: #ffc; border: 1px #fa0 solid; padding: 1em 1em 0 1em; }
#logmsg p, #logmsg pre, #logmsg blockquote { margin: 0 0 1em 0; }
#logmsg p, #logmsg li, #logmsg dt, #logmsg dd { line-height: 14pt; }
#logmsg h1, #logmsg h2, #logmsg h3, #logmsg h4, #logmsg h5, #logmsg h6 { margin: .5em 0; }
#logmsg h1:first-child, #logmsg h2:first-child, #logmsg h3:first-child, #logmsg h4:first-child, #logmsg h5:first-child, #logmsg h6:first-child { margin-top: 0; }
#logmsg ul, #logmsg ol { padding: 0; list-style-position: inside; margin: 0 0 0 1em; }
#logmsg ul { text-indent: -1em; padding-left: 1em; }#logmsg ol { text-indent: -1.5em; padding-left: 1.5em; }
#logmsg > ul, #logmsg > ol { margin: 0 0 1em 0; }
#logmsg pre { background: #eee; padding: 1em; }
#logmsg blockquote { border: 1px solid #fa0; border-left-width: 10px; padding: 1em 1em 0 1em; background: white;}
#logmsg dl { margin: 0; }
#logmsg dt { font-weight: bold; }
#logmsg dd { margin: 0; padding: 0 0 0.5em 0; }
#logmsg dd:before { content:'\00bb';}
#logmsg table { border-spacing: 0px; border-collapse: collapse; border-top: 4px solid #fa0; border-bottom: 1px solid #fa0; background: #fff; }
#logmsg table th { text-align: left; font-weight: normal; padding: 0.2em 0.5em; border-top: 1px dotted #fa0; }
#logmsg table td { text-align: right; border-top: 1px dotted #fa0; padding: 0.2em 0.5em; }
#logmsg table thead th { text-align: center; border-bottom: 1px solid #fa0; }
#logmsg table th.Corner { text-align: left; }
#logmsg hr { border: none 0; border-top: 2px dashed #fa0; height: 1px; }
#header, #footer { color: #fff; background: #636; border: 1px #300 solid; padding: 6px; }
#patch { width: 100%; }
#patch h4 {font-family: verdana,arial,helvetica,sans-serif;font-size:10pt;padding:8px;background:#369;color:#fff;margin:0;}
#patch .propset h4, #patch .binary h4 {margin:0;}
#patch pre {padding:0;line-height:1.2em;margin:0;}
#patch .diff {width:100%;background:#eee;padding: 0 0 10px 0;overflow:auto;}
#patch .propset .diff, #patch .binary .diff {padding:10px 0;}
#patch span {display:block;padding:0 10px;}
#patch .modfile, #patch .addfile, #patch .delfile, #patch .propset, #patch .binary, #patch .copfile {border:1px solid #ccc;margin:10px 0;}
#patch ins {background:#dfd;text-decoration:none;display:block;padding:0 10px;}
#patch del {background:#fdd;text-decoration:none;display:block;padding:0 10px;}
#patch .lines, .info {color:#888;background:#fff;}
--></style>
<div id="msg">
<dl class="meta">
<dt>Revision</dt> <dd><a href="http://trac.webkit.org/projects/webkit/changeset/181650">181650</a></dd>
<dt>Author</dt> <dd>fpizlo@apple.com</dd>
<dt>Date</dt> <dd>2015-03-17 08:50:44 -0700 (Tue, 17 Mar 2015)</dd>
</dl>
<h3>Log Message</h3>
<pre>DFG IR shouldn't have a separate node for every kind of put hint that could be described using PromotedLocationDescriptor
https://bugs.webkit.org/show_bug.cgi?id=142769
Reviewed by Michael Saboff.
When we sink an object allocation, we need to have some way of tracking what stores would
have happened had the allocation not been sunk, so that we know how to rematerialize the
object on OSR exit. Prior to this change, trunk had two ways of describing such a "put
hint":
- The PutStrutureHint and PutByOffsetHint node types.
- The PromotedLocationDescriptor class, which has an enum with cases StructurePLoc and
NamedPropertyPLoc.
We also had ways of converting from a Node with those two node types to a
PromotedLocationDescriptor, and we had a way of converting a PromotedLocationDescriptor to
a Node.
This change removes the redundancy. We now have just one node type that corresponds to a
put hint, and it's called PutHint. It has a PromotedLocationDescriptor as metadata.
Converting between a PutHint node and a PromotedLocationDescriptor and vice-versa is now
trivial.
This means that if we add new kinds of sunken objects, we'll have less pro-forma to write
for the put hints to those objects. This is mainly to simplify the implementation of
arguments elimination in bug 141174.
* dfg/DFGAbstractInterpreterInlines.h:
(JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
* dfg/DFGClobberize.h:
(JSC::DFG::clobberize):
* dfg/DFGDoesGC.cpp:
(JSC::DFG::doesGC):
* dfg/DFGFixupPhase.cpp:
(JSC::DFG::FixupPhase::fixupNode):
* dfg/DFGGraph.cpp:
(JSC::DFG::Graph::dump):
(JSC::DFG::Graph::mergeRelevantToOSR):
* dfg/DFGMayExit.cpp:
(JSC::DFG::mayExit):
* dfg/DFGNode.cpp:
(JSC::DFG::Node::convertToPutHint):
(JSC::DFG::Node::convertToPutStructureHint):
(JSC::DFG::Node::convertToPutByOffsetHint):
(JSC::DFG::Node::promotedLocationDescriptor):
* dfg/DFGNode.h:
(JSC::DFG::Node::hasIdentifier):
(JSC::DFG::Node::hasPromotedLocationDescriptor):
(JSC::DFG::Node::convertToPutByOffsetHint): Deleted.
(JSC::DFG::Node::convertToPutStructureHint): Deleted.
* dfg/DFGNodeType.h:
* dfg/DFGOSRAvailabilityAnalysisPhase.cpp:
(JSC::DFG::LocalOSRAvailabilityCalculator::executeNode):
* dfg/DFGObjectAllocationSinkingPhase.cpp:
(JSC::DFG::ObjectAllocationSinkingPhase::run):
(JSC::DFG::ObjectAllocationSinkingPhase::lowerNonReadingOperationsOnPhantomAllocations):
(JSC::DFG::ObjectAllocationSinkingPhase::handleNode):
* dfg/DFGPredictionPropagationPhase.cpp:
(JSC::DFG::PredictionPropagationPhase::propagate):
* dfg/DFGPromoteHeapAccess.h:
(JSC::DFG::promoteHeapAccess):
* dfg/DFGPromotedHeapLocation.cpp:
(JSC::DFG::PromotedHeapLocation::createHint):
* dfg/DFGPromotedHeapLocation.h:
(JSC::DFG::PromotedLocationDescriptor::imm1):
(JSC::DFG::PromotedLocationDescriptor::imm2):
* dfg/DFGSafeToExecute.h:
(JSC::DFG::safeToExecute):
* dfg/DFGSpeculativeJIT32_64.cpp:
(JSC::DFG::SpeculativeJIT::compile):
* dfg/DFGSpeculativeJIT64.cpp:
(JSC::DFG::SpeculativeJIT::compile):
* dfg/DFGValidate.cpp:
(JSC::DFG::Validate::validateCPS):
* ftl/FTLCapabilities.cpp:
(JSC::FTL::canCompile):
* ftl/FTLLowerDFGToLLVM.cpp:
(JSC::FTL::LowerDFGToLLVM::compileNode):</pre>
<h3>Modified Paths</h3>
<ul>
<li><a href="#trunkSourceJavaScriptCoreChangeLog">trunk/Source/JavaScriptCore/ChangeLog</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGAbstractInterpreterInlinesh">trunk/Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGClobberizeh">trunk/Source/JavaScriptCore/dfg/DFGClobberize.h</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGDoesGCcpp">trunk/Source/JavaScriptCore/dfg/DFGDoesGC.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGFixupPhasecpp">trunk/Source/JavaScriptCore/dfg/DFGFixupPhase.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGGraphcpp">trunk/Source/JavaScriptCore/dfg/DFGGraph.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGMayExitcpp">trunk/Source/JavaScriptCore/dfg/DFGMayExit.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGNodecpp">trunk/Source/JavaScriptCore/dfg/DFGNode.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGNodeh">trunk/Source/JavaScriptCore/dfg/DFGNode.h</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGNodeTypeh">trunk/Source/JavaScriptCore/dfg/DFGNodeType.h</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGOSRAvailabilityAnalysisPhasecpp">trunk/Source/JavaScriptCore/dfg/DFGOSRAvailabilityAnalysisPhase.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGObjectAllocationSinkingPhasecpp">trunk/Source/JavaScriptCore/dfg/DFGObjectAllocationSinkingPhase.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGPredictionPropagationPhasecpp">trunk/Source/JavaScriptCore/dfg/DFGPredictionPropagationPhase.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGPromoteHeapAccessh">trunk/Source/JavaScriptCore/dfg/DFGPromoteHeapAccess.h</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGPromotedHeapLocationcpp">trunk/Source/JavaScriptCore/dfg/DFGPromotedHeapLocation.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGPromotedHeapLocationh">trunk/Source/JavaScriptCore/dfg/DFGPromotedHeapLocation.h</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGSafeToExecuteh">trunk/Source/JavaScriptCore/dfg/DFGSafeToExecute.h</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGSpeculativeJIT32_64cpp">trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGSpeculativeJIT64cpp">trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGValidatecpp">trunk/Source/JavaScriptCore/dfg/DFGValidate.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreftlFTLCapabilitiescpp">trunk/Source/JavaScriptCore/ftl/FTLCapabilities.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreftlFTLLowerDFGToLLVMcpp">trunk/Source/JavaScriptCore/ftl/FTLLowerDFGToLLVM.cpp</a></li>
</ul>
</div>
<div id="patch">
<h3>Diff</h3>
<a id="trunkSourceJavaScriptCoreChangeLog"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/ChangeLog (181649 => 181650)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/ChangeLog 2015-03-17 15:48:32 UTC (rev 181649)
+++ trunk/Source/JavaScriptCore/ChangeLog 2015-03-17 15:50:44 UTC (rev 181650)
</span><span class="lines">@@ -1,3 +1,84 @@
</span><ins>+2015-03-16 Filip Pizlo <fpizlo@apple.com>
+
+ DFG IR shouldn't have a separate node for every kind of put hint that could be described using PromotedLocationDescriptor
+ https://bugs.webkit.org/show_bug.cgi?id=142769
+
+ Reviewed by Michael Saboff.
+
+ When we sink an object allocation, we need to have some way of tracking what stores would
+ have happened had the allocation not been sunk, so that we know how to rematerialize the
+ object on OSR exit. Prior to this change, trunk had two ways of describing such a "put
+ hint":
+
+ - The PutStrutureHint and PutByOffsetHint node types.
+ - The PromotedLocationDescriptor class, which has an enum with cases StructurePLoc and
+ NamedPropertyPLoc.
+
+ We also had ways of converting from a Node with those two node types to a
+ PromotedLocationDescriptor, and we had a way of converting a PromotedLocationDescriptor to
+ a Node.
+
+ This change removes the redundancy. We now have just one node type that corresponds to a
+ put hint, and it's called PutHint. It has a PromotedLocationDescriptor as metadata.
+ Converting between a PutHint node and a PromotedLocationDescriptor and vice-versa is now
+ trivial.
+
+ This means that if we add new kinds of sunken objects, we'll have less pro-forma to write
+ for the put hints to those objects. This is mainly to simplify the implementation of
+ arguments elimination in bug 141174.
+
+ * dfg/DFGAbstractInterpreterInlines.h:
+ (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+ * dfg/DFGClobberize.h:
+ (JSC::DFG::clobberize):
+ * dfg/DFGDoesGC.cpp:
+ (JSC::DFG::doesGC):
+ * dfg/DFGFixupPhase.cpp:
+ (JSC::DFG::FixupPhase::fixupNode):
+ * dfg/DFGGraph.cpp:
+ (JSC::DFG::Graph::dump):
+ (JSC::DFG::Graph::mergeRelevantToOSR):
+ * dfg/DFGMayExit.cpp:
+ (JSC::DFG::mayExit):
+ * dfg/DFGNode.cpp:
+ (JSC::DFG::Node::convertToPutHint):
+ (JSC::DFG::Node::convertToPutStructureHint):
+ (JSC::DFG::Node::convertToPutByOffsetHint):
+ (JSC::DFG::Node::promotedLocationDescriptor):
+ * dfg/DFGNode.h:
+ (JSC::DFG::Node::hasIdentifier):
+ (JSC::DFG::Node::hasPromotedLocationDescriptor):
+ (JSC::DFG::Node::convertToPutByOffsetHint): Deleted.
+ (JSC::DFG::Node::convertToPutStructureHint): Deleted.
+ * dfg/DFGNodeType.h:
+ * dfg/DFGOSRAvailabilityAnalysisPhase.cpp:
+ (JSC::DFG::LocalOSRAvailabilityCalculator::executeNode):
+ * dfg/DFGObjectAllocationSinkingPhase.cpp:
+ (JSC::DFG::ObjectAllocationSinkingPhase::run):
+ (JSC::DFG::ObjectAllocationSinkingPhase::lowerNonReadingOperationsOnPhantomAllocations):
+ (JSC::DFG::ObjectAllocationSinkingPhase::handleNode):
+ * dfg/DFGPredictionPropagationPhase.cpp:
+ (JSC::DFG::PredictionPropagationPhase::propagate):
+ * dfg/DFGPromoteHeapAccess.h:
+ (JSC::DFG::promoteHeapAccess):
+ * dfg/DFGPromotedHeapLocation.cpp:
+ (JSC::DFG::PromotedHeapLocation::createHint):
+ * dfg/DFGPromotedHeapLocation.h:
+ (JSC::DFG::PromotedLocationDescriptor::imm1):
+ (JSC::DFG::PromotedLocationDescriptor::imm2):
+ * dfg/DFGSafeToExecute.h:
+ (JSC::DFG::safeToExecute):
+ * dfg/DFGSpeculativeJIT32_64.cpp:
+ (JSC::DFG::SpeculativeJIT::compile):
+ * dfg/DFGSpeculativeJIT64.cpp:
+ (JSC::DFG::SpeculativeJIT::compile):
+ * dfg/DFGValidate.cpp:
+ (JSC::DFG::Validate::validateCPS):
+ * ftl/FTLCapabilities.cpp:
+ (JSC::FTL::canCompile):
+ * ftl/FTLLowerDFGToLLVM.cpp:
+ (JSC::FTL::LowerDFGToLLVM::compileNode):
+
</ins><span class="cx"> 2015-03-17 Michael Saboff <msaboff@apple.com>
</span><span class="cx">
</span><span class="cx"> Windows X86-64 should use the fixed executable allocator
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGAbstractInterpreterInlinesh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h (181649 => 181650)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h 2015-03-17 15:48:32 UTC (rev 181649)
+++ trunk/Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h 2015-03-17 15:50:44 UTC (rev 181650)
</span><span class="lines">@@ -1308,8 +1308,7 @@
</span><span class="cx"> // This claims to return bottom.
</span><span class="cx"> break;
</span><span class="cx">
</span><del>- case PutByOffsetHint:
- case PutStructureHint:
</del><ins>+ case PutHint:
</ins><span class="cx"> break;
</span><span class="cx">
</span><span class="cx"> case MaterializeNewObject: {
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGClobberizeh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGClobberize.h (181649 => 181650)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGClobberize.h 2015-03-17 15:48:32 UTC (rev 181649)
+++ trunk/Source/JavaScriptCore/dfg/DFGClobberize.h 2015-03-17 15:50:44 UTC (rev 181650)
</span><span class="lines">@@ -290,8 +290,7 @@
</span><span class="cx"> case ProfileControlFlow:
</span><span class="cx"> case StoreBarrier:
</span><span class="cx"> case StoreBarrierWithNullCheck:
</span><del>- case PutByOffsetHint:
- case PutStructureHint:
</del><ins>+ case PutHint:
</ins><span class="cx"> write(SideState);
</span><span class="cx"> return;
</span><span class="cx">
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGDoesGCcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGDoesGC.cpp (181649 => 181650)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGDoesGC.cpp 2015-03-17 15:48:32 UTC (rev 181649)
+++ trunk/Source/JavaScriptCore/dfg/DFGDoesGC.cpp 2015-03-17 15:50:44 UTC (rev 181650)
</span><span class="lines">@@ -204,9 +204,8 @@
</span><span class="cx"> case CheckBadCell:
</span><span class="cx"> case BottomValue:
</span><span class="cx"> case PhantomNewObject:
</span><del>- case PutByOffsetHint:
</del><ins>+ case PutHint:
</ins><span class="cx"> case CheckStructureImmediate:
</span><del>- case PutStructureHint:
</del><span class="cx"> case PutStack:
</span><span class="cx"> case KillStack:
</span><span class="cx"> case GetStack:
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGFixupPhasecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGFixupPhase.cpp (181649 => 181650)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGFixupPhase.cpp 2015-03-17 15:48:32 UTC (rev 181649)
+++ trunk/Source/JavaScriptCore/dfg/DFGFixupPhase.cpp 2015-03-17 15:50:44 UTC (rev 181650)
</span><span class="lines">@@ -1068,9 +1068,8 @@
</span><span class="cx"> case Identity: // This should have been cleaned up.
</span><span class="cx"> case BooleanToNumber:
</span><span class="cx"> case PhantomNewObject:
</span><del>- case PutByOffsetHint:
</del><ins>+ case PutHint:
</ins><span class="cx"> case CheckStructureImmediate:
</span><del>- case PutStructureHint:
</del><span class="cx"> case MaterializeNewObject:
</span><span class="cx"> case PutStack:
</span><span class="cx"> case KillStack:
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGGraphcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGGraph.cpp (181649 => 181650)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGGraph.cpp 2015-03-17 15:48:32 UTC (rev 181649)
+++ trunk/Source/JavaScriptCore/dfg/DFGGraph.cpp 2015-03-17 15:50:44 UTC (rev 181650)
</span><span class="lines">@@ -222,6 +222,8 @@
</span><span class="cx"> out.print(comma, "global", globalObjectFor(node->origin.semantic)->findRegisterIndex(node->registerPointer()), "(", RawPointer(node->registerPointer()), ")");
</span><span class="cx"> if (node->hasIdentifier())
</span><span class="cx"> out.print(comma, "id", node->identifierNumber(), "{", identifiers()[node->identifierNumber()], "}");
</span><ins>+ if (node->hasPromotedLocationDescriptor())
+ out.print(comma, node->promotedLocationDescriptor());
</ins><span class="cx"> if (node->hasStructureSet())
</span><span class="cx"> out.print(comma, inContext(node->structureSet(), context));
</span><span class="cx"> if (node->hasStructure())
</span><span class="lines">@@ -585,8 +587,7 @@
</span><span class="cx"> node->child1()->mergeFlags(NodeRelevantToOSR);
</span><span class="cx"> break;
</span><span class="cx">
</span><del>- case PutStructureHint:
- case PutByOffsetHint:
</del><ins>+ case PutHint:
</ins><span class="cx"> node->child2()->mergeFlags(NodeRelevantToOSR);
</span><span class="cx"> break;
</span><span class="cx">
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGMayExitcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGMayExit.cpp (181649 => 181650)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGMayExit.cpp 2015-03-17 15:48:32 UTC (rev 181649)
+++ trunk/Source/JavaScriptCore/dfg/DFGMayExit.cpp 2015-03-17 15:50:44 UTC (rev 181650)
</span><span class="lines">@@ -76,8 +76,7 @@
</span><span class="cx"> case Upsilon:
</span><span class="cx"> case ZombieHint:
</span><span class="cx"> case BottomValue:
</span><del>- case PutStructureHint:
- case PutByOffsetHint:
</del><ins>+ case PutHint:
</ins><span class="cx"> case PhantomNewObject:
</span><span class="cx"> case PutStack:
</span><span class="cx"> case KillStack:
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGNodecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGNode.cpp (181649 => 181650)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGNode.cpp 2015-03-17 15:48:32 UTC (rev 181649)
+++ trunk/Source/JavaScriptCore/dfg/DFGNode.cpp 2015-03-17 15:50:44 UTC (rev 181650)
</span><span class="lines">@@ -30,6 +30,7 @@
</span><span class="cx">
</span><span class="cx"> #include "DFGGraph.h"
</span><span class="cx"> #include "DFGNodeAllocator.h"
</span><ins>+#include "DFGPromotedHeapLocation.h"
</ins><span class="cx"> #include "JSCInlines.h"
</span><span class="cx">
</span><span class="cx"> namespace JSC { namespace DFG {
</span><span class="lines">@@ -93,6 +94,36 @@
</span><span class="cx"> setResult(result);
</span><span class="cx"> }
</span><span class="cx">
</span><ins>+void Node::convertToPutHint(const PromotedLocationDescriptor& descriptor, Node* base, Node* value)
+{
+ m_op = PutHint;
+ m_opInfo = descriptor.imm1().m_value;
+ m_opInfo2 = descriptor.imm2().m_value;
+ child1() = base->defaultEdge();
+ child2() = value->defaultEdge();
+ child3() = Edge();
+}
+
+void Node::convertToPutStructureHint(Node* structure)
+{
+ ASSERT(m_op == PutStructure);
+ ASSERT(structure->castConstant<Structure*>() == transition()->next);
+ convertToPutHint(StructurePLoc, child1().node(), structure);
+}
+
+void Node::convertToPutByOffsetHint()
+{
+ ASSERT(m_op == PutByOffset);
+ convertToPutHint(
+ PromotedLocationDescriptor(NamedPropertyPLoc, storageAccessData().identifierNumber),
+ child2().node(), child3().node());
+}
+
+PromotedLocationDescriptor Node::promotedLocationDescriptor()
+{
+ return PromotedLocationDescriptor(static_cast<PromotedLocationKind>(m_opInfo), m_opInfo2);
+}
+
</ins><span class="cx"> } } // namespace JSC::DFG
</span><span class="cx">
</span><span class="cx"> namespace WTF {
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGNodeh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGNode.h (181649 => 181650)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGNode.h 2015-03-17 15:48:32 UTC (rev 181649)
+++ trunk/Source/JavaScriptCore/dfg/DFGNode.h 2015-03-17 15:50:44 UTC (rev 181650)
</span><span class="lines">@@ -56,6 +56,7 @@
</span><span class="cx"> namespace JSC { namespace DFG {
</span><span class="cx">
</span><span class="cx"> class Graph;
</span><ins>+class PromotedLocationDescriptor;
</ins><span class="cx"> struct BasicBlock;
</span><span class="cx">
</span><span class="cx"> struct StorageAccessData {
</span><span class="lines">@@ -557,24 +558,10 @@
</span><span class="cx"> m_op = MultiPutByOffset;
</span><span class="cx"> }
</span><span class="cx">
</span><del>- void convertToPutByOffsetHint()
- {
- ASSERT(m_op == PutByOffset);
- m_opInfo = storageAccessData().identifierNumber;
- m_op = PutByOffsetHint;
- child1() = child2();
- child2() = child3();
- child3() = Edge();
- }
</del><ins>+ void convertToPutHint(const PromotedLocationDescriptor&, Node* base, Node* value);
</ins><span class="cx">
</span><del>- void convertToPutStructureHint(Node* structure)
- {
- ASSERT(m_op == PutStructure);
- ASSERT(structure->castConstant<Structure*>() == transition()->next);
- m_op = PutStructureHint;
- m_opInfo = 0;
- child2() = Edge(structure, KnownCellUse);
- }
</del><ins>+ void convertToPutByOffsetHint();
+ void convertToPutStructureHint(Node* structure);
</ins><span class="cx">
</span><span class="cx"> void convertToPhantomNewObject()
</span><span class="cx"> {
</span><span class="lines">@@ -830,7 +817,6 @@
</span><span class="cx"> case PutById:
</span><span class="cx"> case PutByIdFlush:
</span><span class="cx"> case PutByIdDirect:
</span><del>- case PutByOffsetHint:
</del><span class="cx"> return true;
</span><span class="cx"> default:
</span><span class="cx"> return false;
</span><span class="lines">@@ -843,6 +829,13 @@
</span><span class="cx"> return m_opInfo;
</span><span class="cx"> }
</span><span class="cx">
</span><ins>+ bool hasPromotedLocationDescriptor()
+ {
+ return op() == PutHint;
+ }
+
+ PromotedLocationDescriptor promotedLocationDescriptor();
+
</ins><span class="cx"> // This corrects the arithmetic node flags, so that irrelevant bits are
</span><span class="cx"> // ignored. In particular, anything other than ArithMul does not need
</span><span class="cx"> // to know if it can speculate on negative zero.
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGNodeTypeh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGNodeType.h (181649 => 181650)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGNodeType.h 2015-03-17 15:48:32 UTC (rev 181649)
+++ trunk/Source/JavaScriptCore/dfg/DFGNodeType.h 2015-03-17 15:50:44 UTC (rev 181650)
</span><span class="lines">@@ -237,9 +237,8 @@
</span><span class="cx"> \
</span><span class="cx"> /* Support for allocation sinking. */\
</span><span class="cx"> macro(PhantomNewObject, NodeResultJS) \
</span><del>- macro(PutByOffsetHint, NodeMustGenerate) \
</del><ins>+ macro(PutHint, NodeMustGenerate) \
</ins><span class="cx"> macro(CheckStructureImmediate, NodeMustGenerate) \
</span><del>- macro(PutStructureHint, NodeMustGenerate) \
</del><span class="cx"> macro(MaterializeNewObject, NodeResultJS | NodeHasVarArgs) \
</span><span class="cx"> \
</span><span class="cx"> /* Nodes for misc operations. */\
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGOSRAvailabilityAnalysisPhasecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGOSRAvailabilityAnalysisPhase.cpp (181649 => 181650)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGOSRAvailabilityAnalysisPhase.cpp 2015-03-17 15:48:32 UTC (rev 181649)
+++ trunk/Source/JavaScriptCore/dfg/DFGOSRAvailabilityAnalysisPhase.cpp 2015-03-17 15:50:44 UTC (rev 181650)
</span><span class="lines">@@ -166,16 +166,16 @@
</span><span class="cx"> break;
</span><span class="cx"> }
</span><span class="cx">
</span><ins>+ case PutHint: {
+ m_availability.m_heap.set(
+ PromotedHeapLocation(node->child1().node(), node->promotedLocationDescriptor()),
+ Availability(node->child2().node()));
+ break;
+ }
+
</ins><span class="cx"> default:
</span><span class="cx"> break;
</span><span class="cx"> }
</span><del>-
- promoteHeapAccess(
- node,
- [&] (PromotedHeapLocation location, Edge value) {
- m_availability.m_heap.set(location, Availability(value.node()));
- },
- [&] (PromotedHeapLocation) { });
</del><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> } } // namespace JSC::DFG
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGObjectAllocationSinkingPhasecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGObjectAllocationSinkingPhase.cpp (181649 => 181650)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGObjectAllocationSinkingPhase.cpp 2015-03-17 15:48:32 UTC (rev 181649)
+++ trunk/Source/JavaScriptCore/dfg/DFGObjectAllocationSinkingPhase.cpp 2015-03-17 15:50:44 UTC (rev 181650)
</span><span class="lines">@@ -1,5 +1,5 @@
</span><span class="cx"> /*
</span><del>- * Copyright (C) 2014 Apple Inc. All rights reserved.
</del><ins>+ * Copyright (C) 2014, 2015 Apple Inc. All rights reserved.
</ins><span class="cx"> *
</span><span class="cx"> * Redistribution and use in source and binary forms, with or without
</span><span class="cx"> * modification, are permitted provided that the following conditions
</span><span class="lines">@@ -72,10 +72,10 @@
</span><span class="cx"> // that would see any other escape. Note that Upsilons constitute escaping sites. Then we
</span><span class="cx"> // insert additional MaterializeNewObject nodes on Upsilons that feed into Phis that mix
</span><span class="cx"> // materializations and the original PhantomNewObject. We then turn each PutByOffset over a
</span><del>- // PhantomNewObject into a PutByOffsetHint.
</del><ins>+ // PhantomNewObject into a PutHint.
</ins><span class="cx"> //
</span><span class="cx"> // - We perform the same optimization for MaterializeNewObject. This allows us to cover
</span><del>- // cases where we had MaterializeNewObject flowing into a PutByOffsetHint.
</del><ins>+ // cases where we had MaterializeNewObject flowing into a PutHint.
</ins><span class="cx"> //
</span><span class="cx"> // We could also add this rule:
</span><span class="cx"> //
</span><span class="lines">@@ -527,9 +527,10 @@
</span><span class="cx"> if (m_sinkCandidates.contains(node)) {
</span><span class="cx"> Node* structure = m_insertionSet.insertConstant(
</span><span class="cx"> nodeIndex + 1, node->origin, JSValue(node->structure()));
</span><del>- m_insertionSet.insertNode(
- nodeIndex + 1, SpecNone, PutStructureHint, node->origin,
- Edge(node, KnownCellUse), Edge(structure, KnownCellUse));
</del><ins>+ m_insertionSet.insert(
+ nodeIndex + 1,
+ PromotedHeapLocation(StructurePLoc, node).createHint(
+ m_graph, node->origin, structure));
</ins><span class="cx"> node->convertToPhantomNewObject();
</span><span class="cx"> }
</span><span class="cx"> break;
</span><span class="lines">@@ -537,13 +538,19 @@
</span><span class="cx">
</span><span class="cx"> case MaterializeNewObject: {
</span><span class="cx"> if (m_sinkCandidates.contains(node)) {
</span><del>- m_insertionSet.insertNode(
- nodeIndex + 1, SpecNone, PutStructureHint, node->origin,
- Edge(node, KnownCellUse), m_graph.varArgChild(node, 0));
</del><ins>+ m_insertionSet.insert(
+ nodeIndex + 1,
+ PromotedHeapLocation(StructurePLoc, node).createHint(
+ m_graph, node->origin, m_graph.varArgChild(node, 0).node()));
</ins><span class="cx"> for (unsigned i = 0; i < node->objectMaterializationData().m_properties.size(); ++i) {
</span><del>- m_insertionSet.insertNode(
- nodeIndex + 1, SpecNone, PutByOffsetHint, node->origin,
- Edge(node, KnownCellUse), m_graph.varArgChild(node, i + 1));
</del><ins>+ unsigned identifierNumber =
+ node->objectMaterializationData().m_properties[i].m_identifierNumber;
+ m_insertionSet.insert(
+ nodeIndex + 1,
+ PromotedHeapLocation(
+ NamedPropertyPLoc, node, identifierNumber).createHint(
+ m_graph, node->origin,
+ m_graph.varArgChild(node, i + 1).node()));
</ins><span class="cx"> }
</span><span class="cx"> node->convertToPhantomNewObject();
</span><span class="cx"> }
</span><span class="lines">@@ -762,7 +769,7 @@
</span><span class="cx"> case HardPhantom:
</span><span class="cx"> case StoreBarrier:
</span><span class="cx"> case StoreBarrierWithNullCheck:
</span><del>- case PutByOffsetHint:
</del><ins>+ case PutHint:
</ins><span class="cx"> break;
</span><span class="cx">
</span><span class="cx"> case PutByOffset:
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGPredictionPropagationPhasecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGPredictionPropagationPhase.cpp (181649 => 181650)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGPredictionPropagationPhase.cpp 2015-03-17 15:48:32 UTC (rev 181649)
+++ trunk/Source/JavaScriptCore/dfg/DFGPredictionPropagationPhase.cpp 2015-03-17 15:50:44 UTC (rev 181650)
</span><span class="lines">@@ -542,9 +542,8 @@
</span><span class="cx"> case Identity:
</span><span class="cx"> case BooleanToNumber:
</span><span class="cx"> case PhantomNewObject:
</span><del>- case PutByOffsetHint:
</del><ins>+ case PutHint:
</ins><span class="cx"> case CheckStructureImmediate:
</span><del>- case PutStructureHint:
</del><span class="cx"> case MaterializeNewObject:
</span><span class="cx"> case PutStack:
</span><span class="cx"> case KillStack:
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGPromoteHeapAccessh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGPromoteHeapAccess.h (181649 => 181650)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGPromoteHeapAccess.h 2015-03-17 15:48:32 UTC (rev 181649)
+++ trunk/Source/JavaScriptCore/dfg/DFGPromoteHeapAccess.h 2015-03-17 15:50:44 UTC (rev 181650)
</span><span class="lines">@@ -1,5 +1,5 @@
</span><span class="cx"> /*
</span><del>- * Copyright (C) 2014 Apple Inc. All rights reserved.
</del><ins>+ * Copyright (C) 2014, 2015 Apple Inc. All rights reserved.
</ins><span class="cx"> *
</span><span class="cx"> * Redistribution and use in source and binary forms, with or without
</span><span class="cx"> * modification, are permitted provided that the following conditions
</span><span class="lines">@@ -33,8 +33,6 @@
</span><span class="cx">
</span><span class="cx"> namespace JSC { namespace DFG {
</span><span class="cx">
</span><del>-// Note that the write functor is really the useful thing here. The read functor is only useful
-// for the object allocation sinking phase.
</del><span class="cx"> template<typename WriteFunctor, typename ReadFunctor>
</span><span class="cx"> void promoteHeapAccess(Node* node, const WriteFunctor& write, const ReadFunctor& read)
</span><span class="cx"> {
</span><span class="lines">@@ -61,18 +59,11 @@
</span><span class="cx"> }
</span><span class="cx"> break;
</span><span class="cx"> }
</span><del>-
- case PutStructureHint: {
</del><ins>+
+ case PutHint: {
</ins><span class="cx"> ASSERT(node->child1()->isPhantomObjectAllocation());
</span><del>- write(PromotedHeapLocation(StructurePLoc, node->child1()), node->child2());
- break;
- }
-
- case PutByOffsetHint: {
- ASSERT(node->child1()->isPhantomObjectAllocation());
- unsigned identifierNumber = node->identifierNumber();
</del><span class="cx"> write(
</span><del>- PromotedHeapLocation(NamedPropertyPLoc, node->child1(), identifierNumber),
</del><ins>+ PromotedHeapLocation(node->child1().node(), node->promotedLocationDescriptor()),
</ins><span class="cx"> node->child2());
</span><span class="cx"> break;
</span><span class="cx"> }
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGPromotedHeapLocationcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGPromotedHeapLocation.cpp (181649 => 181650)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGPromotedHeapLocation.cpp 2015-03-17 15:48:32 UTC (rev 181649)
+++ trunk/Source/JavaScriptCore/dfg/DFGPromotedHeapLocation.cpp 2015-03-17 15:50:44 UTC (rev 181650)
</span><span class="lines">@@ -40,23 +40,9 @@
</span><span class="cx">
</span><span class="cx"> Node* PromotedHeapLocation::createHint(Graph& graph, NodeOrigin origin, Node* value)
</span><span class="cx"> {
</span><del>- switch (kind()) {
- case StructurePLoc:
- return graph.addNode(
- SpecNone, PutStructureHint, origin,
- Edge(base(), KnownCellUse), Edge(value, KnownCellUse));
-
- case NamedPropertyPLoc:
- return graph.addNode(
- SpecNone, PutByOffsetHint, origin,
- OpInfo(info()), Edge(base(), KnownCellUse), Edge(value, UntypedUse));
-
- case InvalidPromotedLocationKind:
- return nullptr;
- }
-
- RELEASE_ASSERT_NOT_REACHED();
- return nullptr;
</del><ins>+ return graph.addNode(
+ SpecNone, PutHint, origin, OpInfo(descriptor().imm1()), OpInfo(descriptor().imm2()),
+ base()->defaultEdge(), value->defaultEdge());
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> void PromotedHeapLocation::dump(PrintStream& out) const
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGPromotedHeapLocationh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGPromotedHeapLocation.h (181649 => 181650)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGPromotedHeapLocation.h 2015-03-17 15:48:32 UTC (rev 181649)
+++ trunk/Source/JavaScriptCore/dfg/DFGPromotedHeapLocation.h 2015-03-17 15:50:44 UTC (rev 181650)
</span><span class="lines">@@ -54,6 +54,9 @@
</span><span class="cx"> PromotedLocationKind kind() const { return m_kind; }
</span><span class="cx"> unsigned info() const { return m_info; }
</span><span class="cx">
</span><ins>+ OpInfo imm1() const { return OpInfo(static_cast<uint32_t>(m_kind)); }
+ OpInfo imm2() const { return OpInfo(static_cast<uint32_t>(m_info)); }
+
</ins><span class="cx"> unsigned hash() const
</span><span class="cx"> {
</span><span class="cx"> return m_kind + m_info;
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGSafeToExecuteh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGSafeToExecute.h (181649 => 181650)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGSafeToExecute.h 2015-03-17 15:48:32 UTC (rev 181649)
+++ trunk/Source/JavaScriptCore/dfg/DFGSafeToExecute.h 2015-03-17 15:50:44 UTC (rev 181650)
</span><span class="lines">@@ -277,9 +277,8 @@
</span><span class="cx"> case GetEnumeratorPname:
</span><span class="cx"> case ToIndexString:
</span><span class="cx"> case PhantomNewObject:
</span><del>- case PutByOffsetHint:
</del><ins>+ case PutHint:
</ins><span class="cx"> case CheckStructureImmediate:
</span><del>- case PutStructureHint:
</del><span class="cx"> case MaterializeNewObject:
</span><span class="cx"> return true;
</span><span class="cx">
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGSpeculativeJIT32_64cpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp (181649 => 181650)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp 2015-03-17 15:48:32 UTC (rev 181649)
+++ trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp 2015-03-17 15:50:44 UTC (rev 181650)
</span><span class="lines">@@ -5092,9 +5092,8 @@
</span><span class="cx"> case CheckBadCell:
</span><span class="cx"> case BottomValue:
</span><span class="cx"> case PhantomNewObject:
</span><del>- case PutByOffsetHint:
</del><ins>+ case PutHint:
</ins><span class="cx"> case CheckStructureImmediate:
</span><del>- case PutStructureHint:
</del><span class="cx"> case MaterializeNewObject:
</span><span class="cx"> case PutStack:
</span><span class="cx"> case KillStack:
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGSpeculativeJIT64cpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp (181649 => 181650)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp 2015-03-17 15:48:32 UTC (rev 181649)
+++ trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp 2015-03-17 15:50:44 UTC (rev 181650)
</span><span class="lines">@@ -5163,9 +5163,8 @@
</span><span class="cx"> case CheckBadCell:
</span><span class="cx"> case BottomValue:
</span><span class="cx"> case PhantomNewObject:
</span><del>- case PutByOffsetHint:
</del><ins>+ case PutHint:
</ins><span class="cx"> case CheckStructureImmediate:
</span><del>- case PutStructureHint:
</del><span class="cx"> case MaterializeNewObject:
</span><span class="cx"> case PutStack:
</span><span class="cx"> case KillStack:
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGValidatecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGValidate.cpp (181649 => 181650)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGValidate.cpp 2015-03-17 15:48:32 UTC (rev 181649)
+++ trunk/Source/JavaScriptCore/dfg/DFGValidate.cpp 2015-03-17 15:50:44 UTC (rev 181650)
</span><span class="lines">@@ -438,9 +438,8 @@
</span><span class="cx"> case Upsilon:
</span><span class="cx"> case CheckInBounds:
</span><span class="cx"> case PhantomNewObject:
</span><del>- case PutByOffsetHint:
</del><ins>+ case PutHint:
</ins><span class="cx"> case CheckStructureImmediate:
</span><del>- case PutStructureHint:
</del><span class="cx"> case MaterializeNewObject:
</span><span class="cx"> case PutStack:
</span><span class="cx"> case KillStack:
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreftlFTLCapabilitiescpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/ftl/FTLCapabilities.cpp (181649 => 181650)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/ftl/FTLCapabilities.cpp 2015-03-17 15:48:32 UTC (rev 181649)
+++ trunk/Source/JavaScriptCore/ftl/FTLCapabilities.cpp 2015-03-17 15:50:44 UTC (rev 181650)
</span><span class="lines">@@ -177,9 +177,8 @@
</span><span class="cx"> case ToIndexString:
</span><span class="cx"> case BottomValue:
</span><span class="cx"> case PhantomNewObject:
</span><del>- case PutByOffsetHint:
</del><ins>+ case PutHint:
</ins><span class="cx"> case CheckStructureImmediate:
</span><del>- case PutStructureHint:
</del><span class="cx"> case MaterializeNewObject:
</span><span class="cx"> // These are OK.
</span><span class="cx"> break;
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreftlFTLLowerDFGToLLVMcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/ftl/FTLLowerDFGToLLVM.cpp (181649 => 181650)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/ftl/FTLLowerDFGToLLVM.cpp 2015-03-17 15:48:32 UTC (rev 181649)
+++ trunk/Source/JavaScriptCore/ftl/FTLLowerDFGToLLVM.cpp 2015-03-17 15:50:44 UTC (rev 181650)
</span><span class="lines">@@ -829,8 +829,7 @@
</span><span class="cx"> case MovHint:
</span><span class="cx"> case ZombieHint:
</span><span class="cx"> case PhantomNewObject:
</span><del>- case PutByOffsetHint:
- case PutStructureHint:
</del><ins>+ case PutHint:
</ins><span class="cx"> case BottomValue:
</span><span class="cx"> case KillStack:
</span><span class="cx"> break;
</span></span></pre>
</div>
</div>
</body>
</html>