<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN"
"http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head><meta http-equiv="content-type" content="text/html; charset=utf-8" />
<title>[188201] trunk</title>
</head>
<body>
<style type="text/css"><!--
#msg dl.meta { border: 1px #006 solid; background: #369; padding: 6px; color: #fff; }
#msg dl.meta dt { float: left; width: 6em; font-weight: bold; }
#msg dt:after { content:':';}
#msg dl, #msg dt, #msg ul, #msg li, #header, #footer, #logmsg { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; }
#msg dl a { font-weight: bold}
#msg dl a:link { color:#fc3; }
#msg dl a:active { color:#ff0; }
#msg dl a:visited { color:#cc6; }
h3 { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; font-weight: bold; }
#msg pre { overflow: auto; background: #ffc; border: 1px #fa0 solid; padding: 6px; }
#logmsg { background: #ffc; border: 1px #fa0 solid; padding: 1em 1em 0 1em; }
#logmsg p, #logmsg pre, #logmsg blockquote { margin: 0 0 1em 0; }
#logmsg p, #logmsg li, #logmsg dt, #logmsg dd { line-height: 14pt; }
#logmsg h1, #logmsg h2, #logmsg h3, #logmsg h4, #logmsg h5, #logmsg h6 { margin: .5em 0; }
#logmsg h1:first-child, #logmsg h2:first-child, #logmsg h3:first-child, #logmsg h4:first-child, #logmsg h5:first-child, #logmsg h6:first-child { margin-top: 0; }
#logmsg ul, #logmsg ol { padding: 0; list-style-position: inside; margin: 0 0 0 1em; }
#logmsg ul { text-indent: -1em; padding-left: 1em; }#logmsg ol { text-indent: -1.5em; padding-left: 1.5em; }
#logmsg > ul, #logmsg > ol { margin: 0 0 1em 0; }
#logmsg pre { background: #eee; padding: 1em; }
#logmsg blockquote { border: 1px solid #fa0; border-left-width: 10px; padding: 1em 1em 0 1em; background: white;}
#logmsg dl { margin: 0; }
#logmsg dt { font-weight: bold; }
#logmsg dd { margin: 0; padding: 0 0 0.5em 0; }
#logmsg dd:before { content:'\00bb';}
#logmsg table { border-spacing: 0px; border-collapse: collapse; border-top: 4px solid #fa0; border-bottom: 1px solid #fa0; background: #fff; }
#logmsg table th { text-align: left; font-weight: normal; padding: 0.2em 0.5em; border-top: 1px dotted #fa0; }
#logmsg table td { text-align: right; border-top: 1px dotted #fa0; padding: 0.2em 0.5em; }
#logmsg table thead th { text-align: center; border-bottom: 1px solid #fa0; }
#logmsg table th.Corner { text-align: left; }
#logmsg hr { border: none 0; border-top: 2px dashed #fa0; height: 1px; }
#header, #footer { color: #fff; background: #636; border: 1px #300 solid; padding: 6px; }
#patch { width: 100%; }
#patch h4 {font-family: verdana,arial,helvetica,sans-serif;font-size:10pt;padding:8px;background:#369;color:#fff;margin:0;}
#patch .propset h4, #patch .binary h4 {margin:0;}
#patch pre {padding:0;line-height:1.2em;margin:0;}
#patch .diff {width:100%;background:#eee;padding: 0 0 10px 0;overflow:auto;}
#patch .propset .diff, #patch .binary .diff {padding:10px 0;}
#patch span {display:block;padding:0 10px;}
#patch .modfile, #patch .addfile, #patch .delfile, #patch .propset, #patch .binary, #patch .copfile {border:1px solid #ccc;margin:10px 0;}
#patch ins {background:#dfd;text-decoration:none;display:block;padding:0 10px;}
#patch del {background:#fdd;text-decoration:none;display:block;padding:0 10px;}
#patch .lines, .info {color:#888;background:#fff;}
--></style>
<div id="msg">
<dl class="meta">
<dt>Revision</dt> <dd><a href="http://trac.webkit.org/projects/webkit/changeset/188201">188201</a></dd>
<dt>Author</dt> <dd>cdumez@apple.com</dd>
<dt>Date</dt> <dd>2015-08-09 15:55:54 -0700 (Sun, 09 Aug 2015)</dd>
</dl>
<h3>Log Message</h3>
<pre>Regression(<a href="http://trac.webkit.org/projects/webkit/changeset/188105">r188105</a>): Seems to have caused crashes during PLT on some iPads
https://bugs.webkit.org/show_bug.cgi?id=147818
Unreviewed, roll out <a href="http://trac.webkit.org/projects/webkit/changeset/188105">r188105</a>.
Source/JavaScriptCore:
* bytecode/ByValInfo.h:
(JSC::ByValInfo::ByValInfo):
* bytecode/CodeBlock.cpp:
(JSC::CodeBlock::getByValInfoMap): Deleted.
(JSC::CodeBlock::addByValInfo): Deleted.
* bytecode/CodeBlock.h:
(JSC::CodeBlock::getByValInfo):
(JSC::CodeBlock::setNumberOfByValInfos):
(JSC::CodeBlock::numberOfByValInfos):
(JSC::CodeBlock::byValInfo):
* bytecode/ExitKind.cpp:
(JSC::exitKindToString): Deleted.
* bytecode/ExitKind.h:
* bytecode/GetByIdStatus.cpp:
(JSC::GetByIdStatus::computeFor):
(JSC::GetByIdStatus::computeForStubInfo):
(JSC::GetByIdStatus::computeForStubInfoWithoutExitSiteFeedback): Deleted.
* bytecode/GetByIdStatus.h:
* dfg/DFGAbstractInterpreterInlines.h:
(JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects): Deleted.
* dfg/DFGByteCodeParser.cpp:
(JSC::DFG::ByteCodeParser::parseBlock):
(JSC::DFG::ByteCodeParser::InlineStackEntry::InlineStackEntry): Deleted.
* dfg/DFGClobberize.h:
(JSC::DFG::clobberize): Deleted.
* dfg/DFGConstantFoldingPhase.cpp:
(JSC::DFG::ConstantFoldingPhase::foldConstants): Deleted.
* dfg/DFGDoesGC.cpp:
(JSC::DFG::doesGC): Deleted.
* dfg/DFGFixupPhase.cpp:
(JSC::DFG::FixupPhase::fixupNode): Deleted.
(JSC::DFG::FixupPhase::observeUseKindOnNode): Deleted.
* dfg/DFGNode.h:
(JSC::DFG::Node::hasUidOperand): Deleted.
(JSC::DFG::Node::uidOperand): Deleted.
* dfg/DFGNodeType.h:
* dfg/DFGPredictionPropagationPhase.cpp:
(JSC::DFG::PredictionPropagationPhase::propagate): Deleted.
* dfg/DFGSafeToExecute.h:
(JSC::DFG::SafeToExecuteEdge::operator()): Deleted.
(JSC::DFG::safeToExecute): Deleted.
* dfg/DFGSpeculativeJIT.cpp:
(JSC::DFG::SpeculativeJIT::compileCheckIdent): Deleted.
(JSC::DFG::SpeculativeJIT::speculateSymbol): Deleted.
(JSC::DFG::SpeculativeJIT::speculate): Deleted.
* dfg/DFGSpeculativeJIT.h:
* dfg/DFGSpeculativeJIT32_64.cpp:
(JSC::DFG::SpeculativeJIT::compile): Deleted.
* dfg/DFGSpeculativeJIT64.cpp:
(JSC::DFG::SpeculativeJIT::compile): Deleted.
* dfg/DFGUseKind.cpp:
(WTF::printInternal): Deleted.
* dfg/DFGUseKind.h:
(JSC::DFG::typeFilterFor): Deleted.
(JSC::DFG::isCell): Deleted.
* ftl/FTLAbstractHeapRepository.h:
* ftl/FTLCapabilities.cpp:
(JSC::FTL::canCompile): Deleted.
* ftl/FTLLowerDFGToLLVM.cpp:
(JSC::FTL::DFG::LowerDFGToLLVM::compileNode): Deleted.
(JSC::FTL::DFG::LowerDFGToLLVM::compileCheckIdent): Deleted.
(JSC::FTL::DFG::LowerDFGToLLVM::lowSymbol): Deleted.
(JSC::FTL::DFG::LowerDFGToLLVM::speculate): Deleted.
(JSC::FTL::DFG::LowerDFGToLLVM::isNotSymbol): Deleted.
(JSC::FTL::DFG::LowerDFGToLLVM::speculateSymbol): Deleted.
* jit/JIT.cpp:
(JSC::JIT::privateCompile):
* jit/JIT.h:
(JSC::ByValCompilationInfo::ByValCompilationInfo):
(JSC::JIT::compileGetByValWithCachedId): Deleted.
* jit/JITInlines.h:
(JSC::JIT::callOperation): Deleted.
* jit/JITOpcodes.cpp:
(JSC::JIT::emit_op_has_indexed_property):
(JSC::JIT::emitSlow_op_has_indexed_property):
* jit/JITOpcodes32_64.cpp:
(JSC::JIT::emit_op_has_indexed_property):
(JSC::JIT::emitSlow_op_has_indexed_property):
* jit/JITOperations.cpp:
(JSC::getByVal):
* jit/JITOperations.h:
* jit/JITPropertyAccess.cpp:
(JSC::JIT::emit_op_get_by_val):
(JSC::JIT::emitSlow_op_get_by_val):
(JSC::JIT::emit_op_put_by_val):
(JSC::JIT::emitSlow_op_put_by_val):
(JSC::JIT::emitGetByValWithCachedId): Deleted.
(JSC::JIT::privateCompileGetByVal): Deleted.
(JSC::JIT::privateCompileGetByValWithCachedId): Deleted.
* jit/JITPropertyAccess32_64.cpp:
(JSC::JIT::emit_op_get_by_val):
(JSC::JIT::emitSlow_op_get_by_val):
(JSC::JIT::emit_op_put_by_val):
(JSC::JIT::emitSlow_op_put_by_val):
(JSC::JIT::emitGetByValWithCachedId): Deleted.
* runtime/Symbol.h:
* tests/stress/get-by-val-with-string-constructor.js: Removed.
* tests/stress/get-by-val-with-string-exit.js: Removed.
* tests/stress/get-by-val-with-string-generated.js: Removed.
* tests/stress/get-by-val-with-string-getter.js: Removed.
* tests/stress/get-by-val-with-string.js: Removed.
* tests/stress/get-by-val-with-symbol-constructor.js: Removed.
* tests/stress/get-by-val-with-symbol-exit.js: Removed.
* tests/stress/get-by-val-with-symbol-getter.js: Removed.
* tests/stress/get-by-val-with-symbol.js: Removed.
LayoutTests:
* js/regress/get-by-val-with-string-bimorphic-check-structure-elimination-expected.txt: Removed.
* js/regress/get-by-val-with-string-bimorphic-check-structure-elimination-simple-expected.txt: Removed.
* js/regress/get-by-val-with-string-bimorphic-check-structure-elimination-simple.html: Removed.
* js/regress/get-by-val-with-string-bimorphic-check-structure-elimination.html: Removed.
* js/regress/get-by-val-with-string-chain-from-try-block-expected.txt: Removed.
* js/regress/get-by-val-with-string-chain-from-try-block.html: Removed.
* js/regress/get-by-val-with-string-check-structure-elimination-expected.txt: Removed.
* js/regress/get-by-val-with-string-check-structure-elimination.html: Removed.
* js/regress/get-by-val-with-string-proto-or-self-expected.txt: Removed.
* js/regress/get-by-val-with-string-proto-or-self.html: Removed.
* js/regress/get-by-val-with-string-quadmorphic-check-structure-elimination-simple-expected.txt: Removed.
* js/regress/get-by-val-with-string-quadmorphic-check-structure-elimination-simple.html: Removed.
* js/regress/get-by-val-with-string-self-or-proto-expected.txt: Removed.
* js/regress/get-by-val-with-string-self-or-proto.html: Removed.
* js/regress/get-by-val-with-symbol-bimorphic-check-structure-elimination-expected.txt: Removed.
* js/regress/get-by-val-with-symbol-bimorphic-check-structure-elimination-simple-expected.txt: Removed.
* js/regress/get-by-val-with-symbol-bimorphic-check-structure-elimination-simple.html: Removed.
* js/regress/get-by-val-with-symbol-bimorphic-check-structure-elimination.html: Removed.
* js/regress/get-by-val-with-symbol-chain-from-try-block-expected.txt: Removed.
* js/regress/get-by-val-with-symbol-chain-from-try-block.html: Removed.
* js/regress/get-by-val-with-symbol-check-structure-elimination-expected.txt: Removed.
* js/regress/get-by-val-with-symbol-check-structure-elimination.html: Removed.
* js/regress/get-by-val-with-symbol-proto-or-self-expected.txt: Removed.
* js/regress/get-by-val-with-symbol-proto-or-self.html: Removed.
* js/regress/get-by-val-with-symbol-quadmorphic-check-structure-elimination-simple-expected.txt: Removed.
* js/regress/get-by-val-with-symbol-quadmorphic-check-structure-elimination-simple.html: Removed.
* js/regress/get-by-val-with-symbol-self-or-proto-expected.txt: Removed.
* js/regress/get-by-val-with-symbol-self-or-proto.html: Removed.
* js/regress/script-tests/get-by-val-with-string-bimorphic-check-structure-elimination-simple.js: Removed.
* js/regress/script-tests/get-by-val-with-string-bimorphic-check-structure-elimination.js: Removed.
* js/regress/script-tests/get-by-val-with-string-chain-from-try-block.js: Removed.
* js/regress/script-tests/get-by-val-with-string-check-structure-elimination.js: Removed.
* js/regress/script-tests/get-by-val-with-string-proto-or-self.js: Removed.
* js/regress/script-tests/get-by-val-with-string-quadmorphic-check-structure-elimination-simple.js: Removed.
* js/regress/script-tests/get-by-val-with-string-self-or-proto.js: Removed.
* js/regress/script-tests/get-by-val-with-symbol-bimorphic-check-structure-elimination-simple.js: Removed.
* js/regress/script-tests/get-by-val-with-symbol-bimorphic-check-structure-elimination.js: Removed.
* js/regress/script-tests/get-by-val-with-symbol-chain-from-try-block.js: Removed.
* js/regress/script-tests/get-by-val-with-symbol-check-structure-elimination.js: Removed.
* js/regress/script-tests/get-by-val-with-symbol-proto-or-self.js: Removed.
* js/regress/script-tests/get-by-val-with-symbol-quadmorphic-check-structure-elimination-simple.js: Removed.
* js/regress/script-tests/get-by-val-with-symbol-self-or-proto.js: Removed.</pre>
<h3>Modified Paths</h3>
<ul>
<li><a href="#trunkLayoutTestsChangeLog">trunk/LayoutTests/ChangeLog</a></li>
<li><a href="#trunkSourceJavaScriptCoreChangeLog">trunk/Source/JavaScriptCore/ChangeLog</a></li>
<li><a href="#trunkSourceJavaScriptCorebytecodeByValInfoh">trunk/Source/JavaScriptCore/bytecode/ByValInfo.h</a></li>
<li><a href="#trunkSourceJavaScriptCorebytecodeCodeBlockcpp">trunk/Source/JavaScriptCore/bytecode/CodeBlock.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCorebytecodeCodeBlockh">trunk/Source/JavaScriptCore/bytecode/CodeBlock.h</a></li>
<li><a href="#trunkSourceJavaScriptCorebytecodeExitKindcpp">trunk/Source/JavaScriptCore/bytecode/ExitKind.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCorebytecodeExitKindh">trunk/Source/JavaScriptCore/bytecode/ExitKind.h</a></li>
<li><a href="#trunkSourceJavaScriptCorebytecodeGetByIdStatuscpp">trunk/Source/JavaScriptCore/bytecode/GetByIdStatus.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCorebytecodeGetByIdStatush">trunk/Source/JavaScriptCore/bytecode/GetByIdStatus.h</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGAbstractInterpreterInlinesh">trunk/Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGByteCodeParsercpp">trunk/Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGClobberizeh">trunk/Source/JavaScriptCore/dfg/DFGClobberize.h</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGConstantFoldingPhasecpp">trunk/Source/JavaScriptCore/dfg/DFGConstantFoldingPhase.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGDoesGCcpp">trunk/Source/JavaScriptCore/dfg/DFGDoesGC.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGFixupPhasecpp">trunk/Source/JavaScriptCore/dfg/DFGFixupPhase.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGNodeh">trunk/Source/JavaScriptCore/dfg/DFGNode.h</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGNodeTypeh">trunk/Source/JavaScriptCore/dfg/DFGNodeType.h</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGPredictionPropagationPhasecpp">trunk/Source/JavaScriptCore/dfg/DFGPredictionPropagationPhase.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGSafeToExecuteh">trunk/Source/JavaScriptCore/dfg/DFGSafeToExecute.h</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGSpeculativeJITcpp">trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGSpeculativeJITh">trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGSpeculativeJIT32_64cpp">trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGSpeculativeJIT64cpp">trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGUseKindcpp">trunk/Source/JavaScriptCore/dfg/DFGUseKind.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGUseKindh">trunk/Source/JavaScriptCore/dfg/DFGUseKind.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreftlFTLAbstractHeapRepositoryh">trunk/Source/JavaScriptCore/ftl/FTLAbstractHeapRepository.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreftlFTLCapabilitiescpp">trunk/Source/JavaScriptCore/ftl/FTLCapabilities.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreftlFTLLowerDFGToLLVMcpp">trunk/Source/JavaScriptCore/ftl/FTLLowerDFGToLLVM.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCorejitJITcpp">trunk/Source/JavaScriptCore/jit/JIT.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCorejitJITh">trunk/Source/JavaScriptCore/jit/JIT.h</a></li>
<li><a href="#trunkSourceJavaScriptCorejitJITInlinesh">trunk/Source/JavaScriptCore/jit/JITInlines.h</a></li>
<li><a href="#trunkSourceJavaScriptCorejitJITOpcodescpp">trunk/Source/JavaScriptCore/jit/JITOpcodes.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCorejitJITOpcodes32_64cpp">trunk/Source/JavaScriptCore/jit/JITOpcodes32_64.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCorejitJITOperationscpp">trunk/Source/JavaScriptCore/jit/JITOperations.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCorejitJITOperationsh">trunk/Source/JavaScriptCore/jit/JITOperations.h</a></li>
<li><a href="#trunkSourceJavaScriptCorejitJITPropertyAccesscpp">trunk/Source/JavaScriptCore/jit/JITPropertyAccess.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCorejitJITPropertyAccess32_64cpp">trunk/Source/JavaScriptCore/jit/JITPropertyAccess32_64.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeSymbolh">trunk/Source/JavaScriptCore/runtime/Symbol.h</a></li>
</ul>
<h3>Removed Paths</h3>
<ul>
<li><a href="#trunkLayoutTestsjsregressgetbyvalwithstringbimorphiccheckstructureeliminationexpectedtxt">trunk/LayoutTests/js/regress/get-by-val-with-string-bimorphic-check-structure-elimination-expected.txt</a></li>
<li><a href="#trunkLayoutTestsjsregressgetbyvalwithstringbimorphiccheckstructureeliminationsimpleexpectedtxt">trunk/LayoutTests/js/regress/get-by-val-with-string-bimorphic-check-structure-elimination-simple-expected.txt</a></li>
<li><a href="#trunkLayoutTestsjsregressgetbyvalwithstringbimorphiccheckstructureeliminationsimplehtml">trunk/LayoutTests/js/regress/get-by-val-with-string-bimorphic-check-structure-elimination-simple.html</a></li>
<li><a href="#trunkLayoutTestsjsregressgetbyvalwithstringbimorphiccheckstructureeliminationhtml">trunk/LayoutTests/js/regress/get-by-val-with-string-bimorphic-check-structure-elimination.html</a></li>
<li><a href="#trunkLayoutTestsjsregressgetbyvalwithstringchainfromtryblockexpectedtxt">trunk/LayoutTests/js/regress/get-by-val-with-string-chain-from-try-block-expected.txt</a></li>
<li><a href="#trunkLayoutTestsjsregressgetbyvalwithstringchainfromtryblockhtml">trunk/LayoutTests/js/regress/get-by-val-with-string-chain-from-try-block.html</a></li>
<li><a href="#trunkLayoutTestsjsregressgetbyvalwithstringcheckstructureeliminationexpectedtxt">trunk/LayoutTests/js/regress/get-by-val-with-string-check-structure-elimination-expected.txt</a></li>
<li><a href="#trunkLayoutTestsjsregressgetbyvalwithstringcheckstructureeliminationhtml">trunk/LayoutTests/js/regress/get-by-val-with-string-check-structure-elimination.html</a></li>
<li><a href="#trunkLayoutTestsjsregressgetbyvalwithstringprotoorselfexpectedtxt">trunk/LayoutTests/js/regress/get-by-val-with-string-proto-or-self-expected.txt</a></li>
<li><a href="#trunkLayoutTestsjsregressgetbyvalwithstringprotoorselfhtml">trunk/LayoutTests/js/regress/get-by-val-with-string-proto-or-self.html</a></li>
<li><a href="#trunkLayoutTestsjsregressgetbyvalwithstringquadmorphiccheckstructureeliminationsimpleexpectedtxt">trunk/LayoutTests/js/regress/get-by-val-with-string-quadmorphic-check-structure-elimination-simple-expected.txt</a></li>
<li><a href="#trunkLayoutTestsjsregressgetbyvalwithstringquadmorphiccheckstructureeliminationsimplehtml">trunk/LayoutTests/js/regress/get-by-val-with-string-quadmorphic-check-structure-elimination-simple.html</a></li>
<li><a href="#trunkLayoutTestsjsregressgetbyvalwithstringselforprotoexpectedtxt">trunk/LayoutTests/js/regress/get-by-val-with-string-self-or-proto-expected.txt</a></li>
<li><a href="#trunkLayoutTestsjsregressgetbyvalwithstringselforprotohtml">trunk/LayoutTests/js/regress/get-by-val-with-string-self-or-proto.html</a></li>
<li><a href="#trunkLayoutTestsjsregressgetbyvalwithsymbolbimorphiccheckstructureeliminationexpectedtxt">trunk/LayoutTests/js/regress/get-by-val-with-symbol-bimorphic-check-structure-elimination-expected.txt</a></li>
<li><a href="#trunkLayoutTestsjsregressgetbyvalwithsymbolbimorphiccheckstructureeliminationsimpleexpectedtxt">trunk/LayoutTests/js/regress/get-by-val-with-symbol-bimorphic-check-structure-elimination-simple-expected.txt</a></li>
<li><a href="#trunkLayoutTestsjsregressgetbyvalwithsymbolbimorphiccheckstructureeliminationsimplehtml">trunk/LayoutTests/js/regress/get-by-val-with-symbol-bimorphic-check-structure-elimination-simple.html</a></li>
<li><a href="#trunkLayoutTestsjsregressgetbyvalwithsymbolbimorphiccheckstructureeliminationhtml">trunk/LayoutTests/js/regress/get-by-val-with-symbol-bimorphic-check-structure-elimination.html</a></li>
<li><a href="#trunkLayoutTestsjsregressgetbyvalwithsymbolchainfromtryblockexpectedtxt">trunk/LayoutTests/js/regress/get-by-val-with-symbol-chain-from-try-block-expected.txt</a></li>
<li><a href="#trunkLayoutTestsjsregressgetbyvalwithsymbolchainfromtryblockhtml">trunk/LayoutTests/js/regress/get-by-val-with-symbol-chain-from-try-block.html</a></li>
<li><a href="#trunkLayoutTestsjsregressgetbyvalwithsymbolcheckstructureeliminationexpectedtxt">trunk/LayoutTests/js/regress/get-by-val-with-symbol-check-structure-elimination-expected.txt</a></li>
<li><a href="#trunkLayoutTestsjsregressgetbyvalwithsymbolcheckstructureeliminationhtml">trunk/LayoutTests/js/regress/get-by-val-with-symbol-check-structure-elimination.html</a></li>
<li><a href="#trunkLayoutTestsjsregressgetbyvalwithsymbolprotoorselfexpectedtxt">trunk/LayoutTests/js/regress/get-by-val-with-symbol-proto-or-self-expected.txt</a></li>
<li><a href="#trunkLayoutTestsjsregressgetbyvalwithsymbolprotoorselfhtml">trunk/LayoutTests/js/regress/get-by-val-with-symbol-proto-or-self.html</a></li>
<li><a href="#trunkLayoutTestsjsregressgetbyvalwithsymbolquadmorphiccheckstructureeliminationsimpleexpectedtxt">trunk/LayoutTests/js/regress/get-by-val-with-symbol-quadmorphic-check-structure-elimination-simple-expected.txt</a></li>
<li><a href="#trunkLayoutTestsjsregressgetbyvalwithsymbolquadmorphiccheckstructureeliminationsimplehtml">trunk/LayoutTests/js/regress/get-by-val-with-symbol-quadmorphic-check-structure-elimination-simple.html</a></li>
<li><a href="#trunkLayoutTestsjsregressgetbyvalwithsymbolselforprotoexpectedtxt">trunk/LayoutTests/js/regress/get-by-val-with-symbol-self-or-proto-expected.txt</a></li>
<li><a href="#trunkLayoutTestsjsregressgetbyvalwithsymbolselforprotohtml">trunk/LayoutTests/js/regress/get-by-val-with-symbol-self-or-proto.html</a></li>
<li><a href="#trunkLayoutTestsjsregressscripttestsgetbyvalwithstringbimorphiccheckstructureeliminationsimplejs">trunk/LayoutTests/js/regress/script-tests/get-by-val-with-string-bimorphic-check-structure-elimination-simple.js</a></li>
<li><a href="#trunkLayoutTestsjsregressscripttestsgetbyvalwithstringbimorphiccheckstructureeliminationjs">trunk/LayoutTests/js/regress/script-tests/get-by-val-with-string-bimorphic-check-structure-elimination.js</a></li>
<li><a href="#trunkLayoutTestsjsregressscripttestsgetbyvalwithstringchainfromtryblockjs">trunk/LayoutTests/js/regress/script-tests/get-by-val-with-string-chain-from-try-block.js</a></li>
<li><a href="#trunkLayoutTestsjsregressscripttestsgetbyvalwithstringcheckstructureeliminationjs">trunk/LayoutTests/js/regress/script-tests/get-by-val-with-string-check-structure-elimination.js</a></li>
<li><a href="#trunkLayoutTestsjsregressscripttestsgetbyvalwithstringprotoorselfjs">trunk/LayoutTests/js/regress/script-tests/get-by-val-with-string-proto-or-self.js</a></li>
<li><a href="#trunkLayoutTestsjsregressscripttestsgetbyvalwithstringquadmorphiccheckstructureeliminationsimplejs">trunk/LayoutTests/js/regress/script-tests/get-by-val-with-string-quadmorphic-check-structure-elimination-simple.js</a></li>
<li><a href="#trunkLayoutTestsjsregressscripttestsgetbyvalwithstringselforprotojs">trunk/LayoutTests/js/regress/script-tests/get-by-val-with-string-self-or-proto.js</a></li>
<li><a href="#trunkLayoutTestsjsregressscripttestsgetbyvalwithsymbolbimorphiccheckstructureeliminationsimplejs">trunk/LayoutTests/js/regress/script-tests/get-by-val-with-symbol-bimorphic-check-structure-elimination-simple.js</a></li>
<li><a href="#trunkLayoutTestsjsregressscripttestsgetbyvalwithsymbolbimorphiccheckstructureeliminationjs">trunk/LayoutTests/js/regress/script-tests/get-by-val-with-symbol-bimorphic-check-structure-elimination.js</a></li>
<li><a href="#trunkLayoutTestsjsregressscripttestsgetbyvalwithsymbolchainfromtryblockjs">trunk/LayoutTests/js/regress/script-tests/get-by-val-with-symbol-chain-from-try-block.js</a></li>
<li><a href="#trunkLayoutTestsjsregressscripttestsgetbyvalwithsymbolcheckstructureeliminationjs">trunk/LayoutTests/js/regress/script-tests/get-by-val-with-symbol-check-structure-elimination.js</a></li>
<li><a href="#trunkLayoutTestsjsregressscripttestsgetbyvalwithsymbolprotoorselfjs">trunk/LayoutTests/js/regress/script-tests/get-by-val-with-symbol-proto-or-self.js</a></li>
<li><a href="#trunkLayoutTestsjsregressscripttestsgetbyvalwithsymbolquadmorphiccheckstructureeliminationsimplejs">trunk/LayoutTests/js/regress/script-tests/get-by-val-with-symbol-quadmorphic-check-structure-elimination-simple.js</a></li>
<li><a href="#trunkLayoutTestsjsregressscripttestsgetbyvalwithsymbolselforprotojs">trunk/LayoutTests/js/regress/script-tests/get-by-val-with-symbol-self-or-proto.js</a></li>
<li><a href="#trunkSourceJavaScriptCoretestsstressgetbyvalwithstringconstructorjs">trunk/Source/JavaScriptCore/tests/stress/get-by-val-with-string-constructor.js</a></li>
<li><a href="#trunkSourceJavaScriptCoretestsstressgetbyvalwithstringexitjs">trunk/Source/JavaScriptCore/tests/stress/get-by-val-with-string-exit.js</a></li>
<li><a href="#trunkSourceJavaScriptCoretestsstressgetbyvalwithstringgeneratedjs">trunk/Source/JavaScriptCore/tests/stress/get-by-val-with-string-generated.js</a></li>
<li><a href="#trunkSourceJavaScriptCoretestsstressgetbyvalwithstringgetterjs">trunk/Source/JavaScriptCore/tests/stress/get-by-val-with-string-getter.js</a></li>
<li><a href="#trunkSourceJavaScriptCoretestsstressgetbyvalwithstringjs">trunk/Source/JavaScriptCore/tests/stress/get-by-val-with-string.js</a></li>
<li><a href="#trunkSourceJavaScriptCoretestsstressgetbyvalwithsymbolconstructorjs">trunk/Source/JavaScriptCore/tests/stress/get-by-val-with-symbol-constructor.js</a></li>
<li><a href="#trunkSourceJavaScriptCoretestsstressgetbyvalwithsymbolexitjs">trunk/Source/JavaScriptCore/tests/stress/get-by-val-with-symbol-exit.js</a></li>
<li><a href="#trunkSourceJavaScriptCoretestsstressgetbyvalwithsymbolgetterjs">trunk/Source/JavaScriptCore/tests/stress/get-by-val-with-symbol-getter.js</a></li>
<li><a href="#trunkSourceJavaScriptCoretestsstressgetbyvalwithsymboljs">trunk/Source/JavaScriptCore/tests/stress/get-by-val-with-symbol.js</a></li>
</ul>
</div>
<div id="patch">
<h3>Diff</h3>
<a id="trunkLayoutTestsChangeLog"></a>
<div class="modfile"><h4>Modified: trunk/LayoutTests/ChangeLog (188200 => 188201)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/ChangeLog 2015-08-09 22:39:33 UTC (rev 188200)
+++ trunk/LayoutTests/ChangeLog 2015-08-09 22:55:54 UTC (rev 188201)
</span><span class="lines">@@ -1,3 +1,53 @@
</span><ins>+2015-08-09 Chris Dumez <cdumez@apple.com>
+
+ Regression(r188105): Seems to have caused crashes during PLT on some iPads
+ https://bugs.webkit.org/show_bug.cgi?id=147818
+
+ Unreviewed, roll out r188105.
+
+ * js/regress/get-by-val-with-string-bimorphic-check-structure-elimination-expected.txt: Removed.
+ * js/regress/get-by-val-with-string-bimorphic-check-structure-elimination-simple-expected.txt: Removed.
+ * js/regress/get-by-val-with-string-bimorphic-check-structure-elimination-simple.html: Removed.
+ * js/regress/get-by-val-with-string-bimorphic-check-structure-elimination.html: Removed.
+ * js/regress/get-by-val-with-string-chain-from-try-block-expected.txt: Removed.
+ * js/regress/get-by-val-with-string-chain-from-try-block.html: Removed.
+ * js/regress/get-by-val-with-string-check-structure-elimination-expected.txt: Removed.
+ * js/regress/get-by-val-with-string-check-structure-elimination.html: Removed.
+ * js/regress/get-by-val-with-string-proto-or-self-expected.txt: Removed.
+ * js/regress/get-by-val-with-string-proto-or-self.html: Removed.
+ * js/regress/get-by-val-with-string-quadmorphic-check-structure-elimination-simple-expected.txt: Removed.
+ * js/regress/get-by-val-with-string-quadmorphic-check-structure-elimination-simple.html: Removed.
+ * js/regress/get-by-val-with-string-self-or-proto-expected.txt: Removed.
+ * js/regress/get-by-val-with-string-self-or-proto.html: Removed.
+ * js/regress/get-by-val-with-symbol-bimorphic-check-structure-elimination-expected.txt: Removed.
+ * js/regress/get-by-val-with-symbol-bimorphic-check-structure-elimination-simple-expected.txt: Removed.
+ * js/regress/get-by-val-with-symbol-bimorphic-check-structure-elimination-simple.html: Removed.
+ * js/regress/get-by-val-with-symbol-bimorphic-check-structure-elimination.html: Removed.
+ * js/regress/get-by-val-with-symbol-chain-from-try-block-expected.txt: Removed.
+ * js/regress/get-by-val-with-symbol-chain-from-try-block.html: Removed.
+ * js/regress/get-by-val-with-symbol-check-structure-elimination-expected.txt: Removed.
+ * js/regress/get-by-val-with-symbol-check-structure-elimination.html: Removed.
+ * js/regress/get-by-val-with-symbol-proto-or-self-expected.txt: Removed.
+ * js/regress/get-by-val-with-symbol-proto-or-self.html: Removed.
+ * js/regress/get-by-val-with-symbol-quadmorphic-check-structure-elimination-simple-expected.txt: Removed.
+ * js/regress/get-by-val-with-symbol-quadmorphic-check-structure-elimination-simple.html: Removed.
+ * js/regress/get-by-val-with-symbol-self-or-proto-expected.txt: Removed.
+ * js/regress/get-by-val-with-symbol-self-or-proto.html: Removed.
+ * js/regress/script-tests/get-by-val-with-string-bimorphic-check-structure-elimination-simple.js: Removed.
+ * js/regress/script-tests/get-by-val-with-string-bimorphic-check-structure-elimination.js: Removed.
+ * js/regress/script-tests/get-by-val-with-string-chain-from-try-block.js: Removed.
+ * js/regress/script-tests/get-by-val-with-string-check-structure-elimination.js: Removed.
+ * js/regress/script-tests/get-by-val-with-string-proto-or-self.js: Removed.
+ * js/regress/script-tests/get-by-val-with-string-quadmorphic-check-structure-elimination-simple.js: Removed.
+ * js/regress/script-tests/get-by-val-with-string-self-or-proto.js: Removed.
+ * js/regress/script-tests/get-by-val-with-symbol-bimorphic-check-structure-elimination-simple.js: Removed.
+ * js/regress/script-tests/get-by-val-with-symbol-bimorphic-check-structure-elimination.js: Removed.
+ * js/regress/script-tests/get-by-val-with-symbol-chain-from-try-block.js: Removed.
+ * js/regress/script-tests/get-by-val-with-symbol-check-structure-elimination.js: Removed.
+ * js/regress/script-tests/get-by-val-with-symbol-proto-or-self.js: Removed.
+ * js/regress/script-tests/get-by-val-with-symbol-quadmorphic-check-structure-elimination-simple.js: Removed.
+ * js/regress/script-tests/get-by-val-with-symbol-self-or-proto.js: Removed.
+
</ins><span class="cx"> 2015-08-09 Myles C. Maxfield <mmaxfield@apple.com>
</span><span class="cx">
</span><span class="cx"> Crash in ComplexTextController when laying out obscure text
</span></span></pre></div>
<a id="trunkLayoutTestsjsregressgetbyvalwithstringbimorphiccheckstructureeliminationexpectedtxt"></a>
<div class="delfile"><h4>Deleted: trunk/LayoutTests/js/regress/get-by-val-with-string-bimorphic-check-structure-elimination-expected.txt (188200 => 188201)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/regress/get-by-val-with-string-bimorphic-check-structure-elimination-expected.txt 2015-08-09 22:39:33 UTC (rev 188200)
+++ trunk/LayoutTests/js/regress/get-by-val-with-string-bimorphic-check-structure-elimination-expected.txt 2015-08-09 22:55:54 UTC (rev 188201)
</span><span class="lines">@@ -1,10 +0,0 @@
</span><del>-JSRegress/get-by-val-with-string-bimorphic-check-structure-elimination
-
-On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
-
-
-PASS no exception thrown
-PASS successfullyParsed is true
-
-TEST COMPLETE
-
</del></span></pre></div>
<a id="trunkLayoutTestsjsregressgetbyvalwithstringbimorphiccheckstructureeliminationsimpleexpectedtxt"></a>
<div class="delfile"><h4>Deleted: trunk/LayoutTests/js/regress/get-by-val-with-string-bimorphic-check-structure-elimination-simple-expected.txt (188200 => 188201)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/regress/get-by-val-with-string-bimorphic-check-structure-elimination-simple-expected.txt 2015-08-09 22:39:33 UTC (rev 188200)
+++ trunk/LayoutTests/js/regress/get-by-val-with-string-bimorphic-check-structure-elimination-simple-expected.txt 2015-08-09 22:55:54 UTC (rev 188201)
</span><span class="lines">@@ -1,10 +0,0 @@
</span><del>-JSRegress/get-by-val-with-string-bimorphic-check-structure-elimination-simple
-
-On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
-
-
-PASS no exception thrown
-PASS successfullyParsed is true
-
-TEST COMPLETE
-
</del></span></pre></div>
<a id="trunkLayoutTestsjsregressgetbyvalwithstringbimorphiccheckstructureeliminationsimplehtml"></a>
<div class="delfile"><h4>Deleted: trunk/LayoutTests/js/regress/get-by-val-with-string-bimorphic-check-structure-elimination-simple.html (188200 => 188201)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/regress/get-by-val-with-string-bimorphic-check-structure-elimination-simple.html 2015-08-09 22:39:33 UTC (rev 188200)
+++ trunk/LayoutTests/js/regress/get-by-val-with-string-bimorphic-check-structure-elimination-simple.html 2015-08-09 22:55:54 UTC (rev 188201)
</span><span class="lines">@@ -1,12 +0,0 @@
</span><del>-<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
-<html>
-<head>
-<script src="../../resources/js-test-pre.js"></script>
-</head>
-<body>
-<script src="../../resources/regress-pre.js"></script>
-<script src="script-tests/get-by-val-with-symbol-bimorphic-check-structure-elimination-simple.js"></script>
-<script src="../../resources/regress-post.js"></script>
-<script src="../../resources/js-test-post.js"></script>
-</body>
-</html>
</del></span></pre></div>
<a id="trunkLayoutTestsjsregressgetbyvalwithstringbimorphiccheckstructureeliminationhtml"></a>
<div class="delfile"><h4>Deleted: trunk/LayoutTests/js/regress/get-by-val-with-string-bimorphic-check-structure-elimination.html (188200 => 188201)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/regress/get-by-val-with-string-bimorphic-check-structure-elimination.html 2015-08-09 22:39:33 UTC (rev 188200)
+++ trunk/LayoutTests/js/regress/get-by-val-with-string-bimorphic-check-structure-elimination.html 2015-08-09 22:55:54 UTC (rev 188201)
</span><span class="lines">@@ -1,12 +0,0 @@
</span><del>-<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
-<html>
-<head>
-<script src="../../resources/js-test-pre.js"></script>
-</head>
-<body>
-<script src="../../resources/regress-pre.js"></script>
-<script src="script-tests/get-by-val-with-symbol-bimorphic-check-structure-elimination.js"></script>
-<script src="../../resources/regress-post.js"></script>
-<script src="../../resources/js-test-post.js"></script>
-</body>
-</html>
</del></span></pre></div>
<a id="trunkLayoutTestsjsregressgetbyvalwithstringchainfromtryblockexpectedtxt"></a>
<div class="delfile"><h4>Deleted: trunk/LayoutTests/js/regress/get-by-val-with-string-chain-from-try-block-expected.txt (188200 => 188201)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/regress/get-by-val-with-string-chain-from-try-block-expected.txt 2015-08-09 22:39:33 UTC (rev 188200)
+++ trunk/LayoutTests/js/regress/get-by-val-with-string-chain-from-try-block-expected.txt 2015-08-09 22:55:54 UTC (rev 188201)
</span><span class="lines">@@ -1,10 +0,0 @@
</span><del>-JSRegress/get-by-val-with-string-chain-from-try-block
-
-On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
-
-
-PASS no exception thrown
-PASS successfullyParsed is true
-
-TEST COMPLETE
-
</del></span></pre></div>
<a id="trunkLayoutTestsjsregressgetbyvalwithstringchainfromtryblockhtml"></a>
<div class="delfile"><h4>Deleted: trunk/LayoutTests/js/regress/get-by-val-with-string-chain-from-try-block.html (188200 => 188201)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/regress/get-by-val-with-string-chain-from-try-block.html 2015-08-09 22:39:33 UTC (rev 188200)
+++ trunk/LayoutTests/js/regress/get-by-val-with-string-chain-from-try-block.html 2015-08-09 22:55:54 UTC (rev 188201)
</span><span class="lines">@@ -1,12 +0,0 @@
</span><del>-<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
-<html>
-<head>
-<script src="../../resources/js-test-pre.js"></script>
-</head>
-<body>
-<script src="../../resources/regress-pre.js"></script>
-<script src="script-tests/get-by-val-with-string-chain-from-try-block.js"></script>
-<script src="../../resources/regress-post.js"></script>
-<script src="../../resources/js-test-post.js"></script>
-</body>
-</html>
</del></span></pre></div>
<a id="trunkLayoutTestsjsregressgetbyvalwithstringcheckstructureeliminationexpectedtxt"></a>
<div class="delfile"><h4>Deleted: trunk/LayoutTests/js/regress/get-by-val-with-string-check-structure-elimination-expected.txt (188200 => 188201)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/regress/get-by-val-with-string-check-structure-elimination-expected.txt 2015-08-09 22:39:33 UTC (rev 188200)
+++ trunk/LayoutTests/js/regress/get-by-val-with-string-check-structure-elimination-expected.txt 2015-08-09 22:55:54 UTC (rev 188201)
</span><span class="lines">@@ -1,10 +0,0 @@
</span><del>-JSRegress/get-by-val-with-string-check-structure-elimination
-
-On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
-
-
-PASS no exception thrown
-PASS successfullyParsed is true
-
-TEST COMPLETE
-
</del></span></pre></div>
<a id="trunkLayoutTestsjsregressgetbyvalwithstringcheckstructureeliminationhtml"></a>
<div class="delfile"><h4>Deleted: trunk/LayoutTests/js/regress/get-by-val-with-string-check-structure-elimination.html (188200 => 188201)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/regress/get-by-val-with-string-check-structure-elimination.html 2015-08-09 22:39:33 UTC (rev 188200)
+++ trunk/LayoutTests/js/regress/get-by-val-with-string-check-structure-elimination.html 2015-08-09 22:55:54 UTC (rev 188201)
</span><span class="lines">@@ -1,12 +0,0 @@
</span><del>-<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
-<html>
-<head>
-<script src="../../resources/js-test-pre.js"></script>
-</head>
-<body>
-<script src="../../resources/regress-pre.js"></script>
-<script src="script-tests/get-by-val-with-string-check-structure-elimination.js"></script>
-<script src="../../resources/regress-post.js"></script>
-<script src="../../resources/js-test-post.js"></script>
-</body>
-</html>
</del></span></pre></div>
<a id="trunkLayoutTestsjsregressgetbyvalwithstringprotoorselfexpectedtxt"></a>
<div class="delfile"><h4>Deleted: trunk/LayoutTests/js/regress/get-by-val-with-string-proto-or-self-expected.txt (188200 => 188201)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/regress/get-by-val-with-string-proto-or-self-expected.txt 2015-08-09 22:39:33 UTC (rev 188200)
+++ trunk/LayoutTests/js/regress/get-by-val-with-string-proto-or-self-expected.txt 2015-08-09 22:55:54 UTC (rev 188201)
</span><span class="lines">@@ -1,10 +0,0 @@
</span><del>-JSRegress/get-by-val-with-string-proto-or-self
-
-On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
-
-
-PASS no exception thrown
-PASS successfullyParsed is true
-
-TEST COMPLETE
-
</del></span></pre></div>
<a id="trunkLayoutTestsjsregressgetbyvalwithstringprotoorselfhtml"></a>
<div class="delfile"><h4>Deleted: trunk/LayoutTests/js/regress/get-by-val-with-string-proto-or-self.html (188200 => 188201)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/regress/get-by-val-with-string-proto-or-self.html 2015-08-09 22:39:33 UTC (rev 188200)
+++ trunk/LayoutTests/js/regress/get-by-val-with-string-proto-or-self.html 2015-08-09 22:55:54 UTC (rev 188201)
</span><span class="lines">@@ -1,12 +0,0 @@
</span><del>-<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
-<html>
-<head>
-<script src="../../resources/js-test-pre.js"></script>
-</head>
-<body>
-<script src="../../resources/regress-pre.js"></script>
-<script src="script-tests/get-by-val-with-string-proto-or-self.js"></script>
-<script src="../../resources/regress-post.js"></script>
-<script src="../../resources/js-test-post.js"></script>
-</body>
-</html>
</del></span></pre></div>
<a id="trunkLayoutTestsjsregressgetbyvalwithstringquadmorphiccheckstructureeliminationsimpleexpectedtxt"></a>
<div class="delfile"><h4>Deleted: trunk/LayoutTests/js/regress/get-by-val-with-string-quadmorphic-check-structure-elimination-simple-expected.txt (188200 => 188201)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/regress/get-by-val-with-string-quadmorphic-check-structure-elimination-simple-expected.txt 2015-08-09 22:39:33 UTC (rev 188200)
+++ trunk/LayoutTests/js/regress/get-by-val-with-string-quadmorphic-check-structure-elimination-simple-expected.txt 2015-08-09 22:55:54 UTC (rev 188201)
</span><span class="lines">@@ -1,10 +0,0 @@
</span><del>-JSRegress/get-by-val-with-string-quadmorphic-check-structure-elimination-simple
-
-On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
-
-
-PASS no exception thrown
-PASS successfullyParsed is true
-
-TEST COMPLETE
-
</del></span></pre></div>
<a id="trunkLayoutTestsjsregressgetbyvalwithstringquadmorphiccheckstructureeliminationsimplehtml"></a>
<div class="delfile"><h4>Deleted: trunk/LayoutTests/js/regress/get-by-val-with-string-quadmorphic-check-structure-elimination-simple.html (188200 => 188201)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/regress/get-by-val-with-string-quadmorphic-check-structure-elimination-simple.html 2015-08-09 22:39:33 UTC (rev 188200)
+++ trunk/LayoutTests/js/regress/get-by-val-with-string-quadmorphic-check-structure-elimination-simple.html 2015-08-09 22:55:54 UTC (rev 188201)
</span><span class="lines">@@ -1,12 +0,0 @@
</span><del>-<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
-<html>
-<head>
-<script src="../../resources/js-test-pre.js"></script>
-</head>
-<body>
-<script src="../../resources/regress-pre.js"></script>
-<script src="script-tests/get-by-val-with-string-quadmorphic-check-structure-elimination-simple.js"></script>
-<script src="../../resources/regress-post.js"></script>
-<script src="../../resources/js-test-post.js"></script>
-</body>
-</html>
</del></span></pre></div>
<a id="trunkLayoutTestsjsregressgetbyvalwithstringselforprotoexpectedtxt"></a>
<div class="delfile"><h4>Deleted: trunk/LayoutTests/js/regress/get-by-val-with-string-self-or-proto-expected.txt (188200 => 188201)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/regress/get-by-val-with-string-self-or-proto-expected.txt 2015-08-09 22:39:33 UTC (rev 188200)
+++ trunk/LayoutTests/js/regress/get-by-val-with-string-self-or-proto-expected.txt 2015-08-09 22:55:54 UTC (rev 188201)
</span><span class="lines">@@ -1,10 +0,0 @@
</span><del>-JSRegress/get-by-val-with-string-self-or-proto
-
-On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
-
-
-PASS no exception thrown
-PASS successfullyParsed is true
-
-TEST COMPLETE
-
</del></span></pre></div>
<a id="trunkLayoutTestsjsregressgetbyvalwithstringselforprotohtml"></a>
<div class="delfile"><h4>Deleted: trunk/LayoutTests/js/regress/get-by-val-with-string-self-or-proto.html (188200 => 188201)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/regress/get-by-val-with-string-self-or-proto.html 2015-08-09 22:39:33 UTC (rev 188200)
+++ trunk/LayoutTests/js/regress/get-by-val-with-string-self-or-proto.html 2015-08-09 22:55:54 UTC (rev 188201)
</span><span class="lines">@@ -1,12 +0,0 @@
</span><del>-<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
-<html>
-<head>
-<script src="../../resources/js-test-pre.js"></script>
-</head>
-<body>
-<script src="../../resources/regress-pre.js"></script>
-<script src="script-tests/get-by-val-with-string-self-or-proto.js"></script>
-<script src="../../resources/regress-post.js"></script>
-<script src="../../resources/js-test-post.js"></script>
-</body>
-</html>
</del></span></pre></div>
<a id="trunkLayoutTestsjsregressgetbyvalwithsymbolbimorphiccheckstructureeliminationexpectedtxt"></a>
<div class="delfile"><h4>Deleted: trunk/LayoutTests/js/regress/get-by-val-with-symbol-bimorphic-check-structure-elimination-expected.txt (188200 => 188201)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/regress/get-by-val-with-symbol-bimorphic-check-structure-elimination-expected.txt 2015-08-09 22:39:33 UTC (rev 188200)
+++ trunk/LayoutTests/js/regress/get-by-val-with-symbol-bimorphic-check-structure-elimination-expected.txt 2015-08-09 22:55:54 UTC (rev 188201)
</span><span class="lines">@@ -1,10 +0,0 @@
</span><del>-JSRegress/get-by-val-with-symbol-bimorphic-check-structure-elimination
-
-On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
-
-
-PASS no exception thrown
-PASS successfullyParsed is true
-
-TEST COMPLETE
-
</del></span></pre></div>
<a id="trunkLayoutTestsjsregressgetbyvalwithsymbolbimorphiccheckstructureeliminationsimpleexpectedtxt"></a>
<div class="delfile"><h4>Deleted: trunk/LayoutTests/js/regress/get-by-val-with-symbol-bimorphic-check-structure-elimination-simple-expected.txt (188200 => 188201)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/regress/get-by-val-with-symbol-bimorphic-check-structure-elimination-simple-expected.txt 2015-08-09 22:39:33 UTC (rev 188200)
+++ trunk/LayoutTests/js/regress/get-by-val-with-symbol-bimorphic-check-structure-elimination-simple-expected.txt 2015-08-09 22:55:54 UTC (rev 188201)
</span><span class="lines">@@ -1,10 +0,0 @@
</span><del>-JSRegress/get-by-val-with-symbol-bimorphic-check-structure-elimination-simple
-
-On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
-
-
-PASS no exception thrown
-PASS successfullyParsed is true
-
-TEST COMPLETE
-
</del></span></pre></div>
<a id="trunkLayoutTestsjsregressgetbyvalwithsymbolbimorphiccheckstructureeliminationsimplehtml"></a>
<div class="delfile"><h4>Deleted: trunk/LayoutTests/js/regress/get-by-val-with-symbol-bimorphic-check-structure-elimination-simple.html (188200 => 188201)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/regress/get-by-val-with-symbol-bimorphic-check-structure-elimination-simple.html 2015-08-09 22:39:33 UTC (rev 188200)
+++ trunk/LayoutTests/js/regress/get-by-val-with-symbol-bimorphic-check-structure-elimination-simple.html 2015-08-09 22:55:54 UTC (rev 188201)
</span><span class="lines">@@ -1,12 +0,0 @@
</span><del>-<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
-<html>
-<head>
-<script src="../../resources/js-test-pre.js"></script>
-</head>
-<body>
-<script src="../../resources/regress-pre.js"></script>
-<script src="script-tests/get-by-val-with-symbol-bimorphic-check-structure-elimination-simple.js"></script>
-<script src="../../resources/regress-post.js"></script>
-<script src="../../resources/js-test-post.js"></script>
-</body>
-</html>
</del></span></pre></div>
<a id="trunkLayoutTestsjsregressgetbyvalwithsymbolbimorphiccheckstructureeliminationhtml"></a>
<div class="delfile"><h4>Deleted: trunk/LayoutTests/js/regress/get-by-val-with-symbol-bimorphic-check-structure-elimination.html (188200 => 188201)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/regress/get-by-val-with-symbol-bimorphic-check-structure-elimination.html 2015-08-09 22:39:33 UTC (rev 188200)
+++ trunk/LayoutTests/js/regress/get-by-val-with-symbol-bimorphic-check-structure-elimination.html 2015-08-09 22:55:54 UTC (rev 188201)
</span><span class="lines">@@ -1,12 +0,0 @@
</span><del>-<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
-<html>
-<head>
-<script src="../../resources/js-test-pre.js"></script>
-</head>
-<body>
-<script src="../../resources/regress-pre.js"></script>
-<script src="script-tests/get-by-val-with-symbol-bimorphic-check-structure-elimination.js"></script>
-<script src="../../resources/regress-post.js"></script>
-<script src="../../resources/js-test-post.js"></script>
-</body>
-</html>
</del></span></pre></div>
<a id="trunkLayoutTestsjsregressgetbyvalwithsymbolchainfromtryblockexpectedtxt"></a>
<div class="delfile"><h4>Deleted: trunk/LayoutTests/js/regress/get-by-val-with-symbol-chain-from-try-block-expected.txt (188200 => 188201)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/regress/get-by-val-with-symbol-chain-from-try-block-expected.txt 2015-08-09 22:39:33 UTC (rev 188200)
+++ trunk/LayoutTests/js/regress/get-by-val-with-symbol-chain-from-try-block-expected.txt 2015-08-09 22:55:54 UTC (rev 188201)
</span><span class="lines">@@ -1,10 +0,0 @@
</span><del>-JSRegress/get-by-val-with-symbol-chain-from-try-block
-
-On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
-
-
-PASS no exception thrown
-PASS successfullyParsed is true
-
-TEST COMPLETE
-
</del></span></pre></div>
<a id="trunkLayoutTestsjsregressgetbyvalwithsymbolchainfromtryblockhtml"></a>
<div class="delfile"><h4>Deleted: trunk/LayoutTests/js/regress/get-by-val-with-symbol-chain-from-try-block.html (188200 => 188201)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/regress/get-by-val-with-symbol-chain-from-try-block.html 2015-08-09 22:39:33 UTC (rev 188200)
+++ trunk/LayoutTests/js/regress/get-by-val-with-symbol-chain-from-try-block.html 2015-08-09 22:55:54 UTC (rev 188201)
</span><span class="lines">@@ -1,12 +0,0 @@
</span><del>-<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
-<html>
-<head>
-<script src="../../resources/js-test-pre.js"></script>
-</head>
-<body>
-<script src="../../resources/regress-pre.js"></script>
-<script src="script-tests/get-by-val-with-symbol-chain-from-try-block.js"></script>
-<script src="../../resources/regress-post.js"></script>
-<script src="../../resources/js-test-post.js"></script>
-</body>
-</html>
</del></span></pre></div>
<a id="trunkLayoutTestsjsregressgetbyvalwithsymbolcheckstructureeliminationexpectedtxt"></a>
<div class="delfile"><h4>Deleted: trunk/LayoutTests/js/regress/get-by-val-with-symbol-check-structure-elimination-expected.txt (188200 => 188201)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/regress/get-by-val-with-symbol-check-structure-elimination-expected.txt 2015-08-09 22:39:33 UTC (rev 188200)
+++ trunk/LayoutTests/js/regress/get-by-val-with-symbol-check-structure-elimination-expected.txt 2015-08-09 22:55:54 UTC (rev 188201)
</span><span class="lines">@@ -1,10 +0,0 @@
</span><del>-JSRegress/get-by-val-with-symbol-check-structure-elimination
-
-On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
-
-
-PASS no exception thrown
-PASS successfullyParsed is true
-
-TEST COMPLETE
-
</del></span></pre></div>
<a id="trunkLayoutTestsjsregressgetbyvalwithsymbolcheckstructureeliminationhtml"></a>
<div class="delfile"><h4>Deleted: trunk/LayoutTests/js/regress/get-by-val-with-symbol-check-structure-elimination.html (188200 => 188201)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/regress/get-by-val-with-symbol-check-structure-elimination.html 2015-08-09 22:39:33 UTC (rev 188200)
+++ trunk/LayoutTests/js/regress/get-by-val-with-symbol-check-structure-elimination.html 2015-08-09 22:55:54 UTC (rev 188201)
</span><span class="lines">@@ -1,12 +0,0 @@
</span><del>-<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
-<html>
-<head>
-<script src="../../resources/js-test-pre.js"></script>
-</head>
-<body>
-<script src="../../resources/regress-pre.js"></script>
-<script src="script-tests/get-by-val-with-symbol-check-structure-elimination.js"></script>
-<script src="../../resources/regress-post.js"></script>
-<script src="../../resources/js-test-post.js"></script>
-</body>
-</html>
</del></span></pre></div>
<a id="trunkLayoutTestsjsregressgetbyvalwithsymbolprotoorselfexpectedtxt"></a>
<div class="delfile"><h4>Deleted: trunk/LayoutTests/js/regress/get-by-val-with-symbol-proto-or-self-expected.txt (188200 => 188201)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/regress/get-by-val-with-symbol-proto-or-self-expected.txt 2015-08-09 22:39:33 UTC (rev 188200)
+++ trunk/LayoutTests/js/regress/get-by-val-with-symbol-proto-or-self-expected.txt 2015-08-09 22:55:54 UTC (rev 188201)
</span><span class="lines">@@ -1,10 +0,0 @@
</span><del>-JSRegress/get-by-val-with-symbol-proto-or-self
-
-On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
-
-
-PASS no exception thrown
-PASS successfullyParsed is true
-
-TEST COMPLETE
-
</del></span></pre></div>
<a id="trunkLayoutTestsjsregressgetbyvalwithsymbolprotoorselfhtml"></a>
<div class="delfile"><h4>Deleted: trunk/LayoutTests/js/regress/get-by-val-with-symbol-proto-or-self.html (188200 => 188201)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/regress/get-by-val-with-symbol-proto-or-self.html 2015-08-09 22:39:33 UTC (rev 188200)
+++ trunk/LayoutTests/js/regress/get-by-val-with-symbol-proto-or-self.html 2015-08-09 22:55:54 UTC (rev 188201)
</span><span class="lines">@@ -1,12 +0,0 @@
</span><del>-<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
-<html>
-<head>
-<script src="../../resources/js-test-pre.js"></script>
-</head>
-<body>
-<script src="../../resources/regress-pre.js"></script>
-<script src="script-tests/get-by-val-with-symbol-proto-or-self.js"></script>
-<script src="../../resources/regress-post.js"></script>
-<script src="../../resources/js-test-post.js"></script>
-</body>
-</html>
</del></span></pre></div>
<a id="trunkLayoutTestsjsregressgetbyvalwithsymbolquadmorphiccheckstructureeliminationsimpleexpectedtxt"></a>
<div class="delfile"><h4>Deleted: trunk/LayoutTests/js/regress/get-by-val-with-symbol-quadmorphic-check-structure-elimination-simple-expected.txt (188200 => 188201)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/regress/get-by-val-with-symbol-quadmorphic-check-structure-elimination-simple-expected.txt 2015-08-09 22:39:33 UTC (rev 188200)
+++ trunk/LayoutTests/js/regress/get-by-val-with-symbol-quadmorphic-check-structure-elimination-simple-expected.txt 2015-08-09 22:55:54 UTC (rev 188201)
</span><span class="lines">@@ -1,10 +0,0 @@
</span><del>-JSRegress/get-by-val-with-symbol-quadmorphic-check-structure-elimination-simple
-
-On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
-
-
-PASS no exception thrown
-PASS successfullyParsed is true
-
-TEST COMPLETE
-
</del></span></pre></div>
<a id="trunkLayoutTestsjsregressgetbyvalwithsymbolquadmorphiccheckstructureeliminationsimplehtml"></a>
<div class="delfile"><h4>Deleted: trunk/LayoutTests/js/regress/get-by-val-with-symbol-quadmorphic-check-structure-elimination-simple.html (188200 => 188201)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/regress/get-by-val-with-symbol-quadmorphic-check-structure-elimination-simple.html 2015-08-09 22:39:33 UTC (rev 188200)
+++ trunk/LayoutTests/js/regress/get-by-val-with-symbol-quadmorphic-check-structure-elimination-simple.html 2015-08-09 22:55:54 UTC (rev 188201)
</span><span class="lines">@@ -1,12 +0,0 @@
</span><del>-<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
-<html>
-<head>
-<script src="../../resources/js-test-pre.js"></script>
-</head>
-<body>
-<script src="../../resources/regress-pre.js"></script>
-<script src="script-tests/get-by-val-with-symbol-quadmorphic-check-structure-elimination-simple.js"></script>
-<script src="../../resources/regress-post.js"></script>
-<script src="../../resources/js-test-post.js"></script>
-</body>
-</html>
</del></span></pre></div>
<a id="trunkLayoutTestsjsregressgetbyvalwithsymbolselforprotoexpectedtxt"></a>
<div class="delfile"><h4>Deleted: trunk/LayoutTests/js/regress/get-by-val-with-symbol-self-or-proto-expected.txt (188200 => 188201)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/regress/get-by-val-with-symbol-self-or-proto-expected.txt 2015-08-09 22:39:33 UTC (rev 188200)
+++ trunk/LayoutTests/js/regress/get-by-val-with-symbol-self-or-proto-expected.txt 2015-08-09 22:55:54 UTC (rev 188201)
</span><span class="lines">@@ -1,10 +0,0 @@
</span><del>-JSRegress/get-by-val-with-symbol-self-or-proto
-
-On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
-
-
-PASS no exception thrown
-PASS successfullyParsed is true
-
-TEST COMPLETE
-
</del></span></pre></div>
<a id="trunkLayoutTestsjsregressgetbyvalwithsymbolselforprotohtml"></a>
<div class="delfile"><h4>Deleted: trunk/LayoutTests/js/regress/get-by-val-with-symbol-self-or-proto.html (188200 => 188201)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/regress/get-by-val-with-symbol-self-or-proto.html 2015-08-09 22:39:33 UTC (rev 188200)
+++ trunk/LayoutTests/js/regress/get-by-val-with-symbol-self-or-proto.html 2015-08-09 22:55:54 UTC (rev 188201)
</span><span class="lines">@@ -1,12 +0,0 @@
</span><del>-<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
-<html>
-<head>
-<script src="../../resources/js-test-pre.js"></script>
-</head>
-<body>
-<script src="../../resources/regress-pre.js"></script>
-<script src="script-tests/get-by-val-with-symbol-self-or-proto.js"></script>
-<script src="../../resources/regress-post.js"></script>
-<script src="../../resources/js-test-post.js"></script>
-</body>
-</html>
</del></span></pre></div>
<a id="trunkLayoutTestsjsregressscripttestsgetbyvalwithstringbimorphiccheckstructureeliminationsimplejs"></a>
<div class="delfile"><h4>Deleted: trunk/LayoutTests/js/regress/script-tests/get-by-val-with-string-bimorphic-check-structure-elimination-simple.js (188200 => 188201)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/regress/script-tests/get-by-val-with-string-bimorphic-check-structure-elimination-simple.js 2015-08-09 22:39:33 UTC (rev 188200)
+++ trunk/LayoutTests/js/regress/script-tests/get-by-val-with-string-bimorphic-check-structure-elimination-simple.js 2015-08-09 22:55:54 UTC (rev 188201)
</span><span class="lines">@@ -1,14 +0,0 @@
</span><del>-(function() {
- var a = 'a', l = 'l';
- var o = {[a]:1};
- var p = {[a]:2, [l]:13};
- var result = 0;
- for (var i = 0; i < 1000000; ++i) {
- result ^= o[a];
- var tmp = o;
- o = p;
- p = tmp;
- }
- if (result != 0)
- throw "Error: bad result: " + result;
-})();
</del></span></pre></div>
<a id="trunkLayoutTestsjsregressscripttestsgetbyvalwithstringbimorphiccheckstructureeliminationjs"></a>
<div class="delfile"><h4>Deleted: trunk/LayoutTests/js/regress/script-tests/get-by-val-with-string-bimorphic-check-structure-elimination.js (188200 => 188201)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/regress/script-tests/get-by-val-with-string-bimorphic-check-structure-elimination.js 2015-08-09 22:39:33 UTC (rev 188200)
+++ trunk/LayoutTests/js/regress/script-tests/get-by-val-with-string-bimorphic-check-structure-elimination.js 2015-08-09 22:55:54 UTC (rev 188201)
</span><span class="lines">@@ -1,14 +0,0 @@
</span><del>-(function() {
- var a = 'a', b = 'b', c = 'c', d = 'd', e = 'e', f = 'f', g = 'g', h = 'h', i = 'i', j = 'j', k = 'k', l = 'l';
- var o = {[a]:1, [b]:2, [c]:3, [d]:4, [e]:5, [f]:6, [g]:7, [h]:8, [i]:9, [j]:10, [k]:11};
- var p = {[a]:2, [b]:3, [c]:4, [d]:5, [e]:6, [f]:7, [g]:8, [h]:9, [i]:10, [j]:11, [k]:12, [l]:13};
- var result = 0;
- for (var index = 0; index < 1000000; ++index) {
- result += o[a] ^ o[b] ^ o[c] ^ o[d] ^ o[e] ^ o[f] ^ o[g] ^ o[h] ^ o[i] ^ o[j] ^ o[k];
- var tmp = o;
- o = p;
- p = tmp;
- }
- if (result != 6500000)
- throw "Error: bad result: " + result;
-})();
</del></span></pre></div>
<a id="trunkLayoutTestsjsregressscripttestsgetbyvalwithstringchainfromtryblockjs"></a>
<div class="delfile"><h4>Deleted: trunk/LayoutTests/js/regress/script-tests/get-by-val-with-string-chain-from-try-block.js (188200 => 188201)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/regress/script-tests/get-by-val-with-string-chain-from-try-block.js 2015-08-09 22:39:33 UTC (rev 188200)
+++ trunk/LayoutTests/js/regress/script-tests/get-by-val-with-string-chain-from-try-block.js 2015-08-09 22:55:54 UTC (rev 188201)
</span><span class="lines">@@ -1,49 +0,0 @@
</span><del>-var f = 'f';
-
-function A() { }
-
-A.prototype = {[f]:42};
-
-function B() { }
-
-B.prototype = new A();
-
-function C() { }
-
-C.prototype = new B();
-
-function D() { }
-
-D.prototype = new C();
-
-function E() { }
-
-E.prototype = new D();
-
-function F() { }
-
-F.prototype = new E();
-
-function G() { }
-
-G.prototype = new F();
-
-function foo(o) {
- try {
- var result = 0;
- for (var i = 0; i < 1000; ++i)
- result += o[f];
- return result;
- } catch (e) {
- return 52;
- }
-}
-
-var result = 0;
-
-for (var i = 0; i < 1000; ++i)
- result += foo(new G());
-
-if (result != 42000000)
- throw "Error: bad result: " + result;
-
</del></span></pre></div>
<a id="trunkLayoutTestsjsregressscripttestsgetbyvalwithstringcheckstructureeliminationjs"></a>
<div class="delfile"><h4>Deleted: trunk/LayoutTests/js/regress/script-tests/get-by-val-with-string-check-structure-elimination.js (188200 => 188201)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/regress/script-tests/get-by-val-with-string-check-structure-elimination.js 2015-08-09 22:39:33 UTC (rev 188200)
+++ trunk/LayoutTests/js/regress/script-tests/get-by-val-with-string-check-structure-elimination.js 2015-08-09 22:55:54 UTC (rev 188201)
</span><span class="lines">@@ -1,9 +0,0 @@
</span><del>-(function() {
- var a = 'a', b = 'b', c = 'c', d = 'd', e = 'e', f = 'f', g = 'g', h = 'h', i = 'i', j = 'j', k = 'k';
- var o = {[a]:1, [b]:2, [c]:3, [d]:4, [e]:5, [f]:6, [g]:7, [h]:8, [i]:9, [j]:10, [k]:11};
- var result = 0;
- for (var index = 0; index < 1000000; ++index)
- result += o[a] ^ o[b] | o[c] ^ o[d] & o[e] ^ o[f] | o[g] ^ o[h] & o[i] ^ o[j] | o[k];
- if (result != 15000000)
- throw "Error: bad result: " + result;
-})();
</del></span></pre></div>
<a id="trunkLayoutTestsjsregressscripttestsgetbyvalwithstringprotoorselfjs"></a>
<div class="delfile"><h4>Deleted: trunk/LayoutTests/js/regress/script-tests/get-by-val-with-string-proto-or-self.js (188200 => 188201)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/regress/script-tests/get-by-val-with-string-proto-or-self.js 2015-08-09 22:39:33 UTC (rev 188200)
+++ trunk/LayoutTests/js/regress/script-tests/get-by-val-with-string-proto-or-self.js 2015-08-09 22:55:54 UTC (rev 188201)
</span><span class="lines">@@ -1,24 +0,0 @@
</span><del>-var f = 'f';
-
-function foo(o) {
- return o[f];
-}
-
-function bar(a) {
- var result = 0;
- for (var i = 0; i < 2000000; ++i) {
- for (var j = 0; j < a.length; ++j)
- result += foo(a[j]);
- }
- return result;
-}
-
-function Foo() {
-}
-
-Foo.prototype[f] = 42;
-
-var result = bar([new Foo(), {[f]:24}]);
-
-if (result != 132000000)
- throw "Error bad result: " + result;
</del></span></pre></div>
<a id="trunkLayoutTestsjsregressscripttestsgetbyvalwithstringquadmorphiccheckstructureeliminationsimplejs"></a>
<div class="delfile"><h4>Deleted: trunk/LayoutTests/js/regress/script-tests/get-by-val-with-string-quadmorphic-check-structure-elimination-simple.js (188200 => 188201)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/regress/script-tests/get-by-val-with-string-quadmorphic-check-structure-elimination-simple.js 2015-08-09 22:39:33 UTC (rev 188200)
+++ trunk/LayoutTests/js/regress/script-tests/get-by-val-with-string-quadmorphic-check-structure-elimination-simple.js 2015-08-09 22:55:54 UTC (rev 188201)
</span><span class="lines">@@ -1,22 +0,0 @@
</span><del>-(function() {
- var a = 'a';
- var l = 'l';
- var b = 'b';
- var c = 'c';
-
- var o = {[a]:1};
- var p = {[a]:2, [l]:13};
- var q = {[a]:3, [b]:3};
- var r = {[a]:4, [c]:5};
- var result = 0;
- for (var i = 0; i < 1000000; ++i) {
- result ^= o[a];
- var tmp = o;
- o = p;
- p = q;
- q = r;
- r = tmp;
- }
- if (result != 0)
- throw "Error: bad result: " + result;
-})();
</del></span></pre></div>
<a id="trunkLayoutTestsjsregressscripttestsgetbyvalwithstringselforprotojs"></a>
<div class="delfile"><h4>Deleted: trunk/LayoutTests/js/regress/script-tests/get-by-val-with-string-self-or-proto.js (188200 => 188201)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/regress/script-tests/get-by-val-with-string-self-or-proto.js 2015-08-09 22:39:33 UTC (rev 188200)
+++ trunk/LayoutTests/js/regress/script-tests/get-by-val-with-string-self-or-proto.js 2015-08-09 22:55:54 UTC (rev 188201)
</span><span class="lines">@@ -1,24 +0,0 @@
</span><del>-var f = 'f';
-
-function foo(o) {
- return o[f];
-}
-
-function bar(a) {
- var result = 0;
- for (var i = 0; i < 2000000; ++i) {
- for (var j = 0; j < a.length; ++j)
- result += foo(a[j]);
- }
- return result;
-}
-
-function Foo() {
-}
-
-Foo.prototype[f] = 42;
-
-var result = bar([{[f]:24}, new Foo()]);
-
-if (result != 132000000)
- throw "Error bad result: " + result;
</del></span></pre></div>
<a id="trunkLayoutTestsjsregressscripttestsgetbyvalwithsymbolbimorphiccheckstructureeliminationsimplejs"></a>
<div class="delfile"><h4>Deleted: trunk/LayoutTests/js/regress/script-tests/get-by-val-with-symbol-bimorphic-check-structure-elimination-simple.js (188200 => 188201)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/regress/script-tests/get-by-val-with-symbol-bimorphic-check-structure-elimination-simple.js 2015-08-09 22:39:33 UTC (rev 188200)
+++ trunk/LayoutTests/js/regress/script-tests/get-by-val-with-symbol-bimorphic-check-structure-elimination-simple.js 2015-08-09 22:55:54 UTC (rev 188201)
</span><span class="lines">@@ -1,14 +0,0 @@
</span><del>-(function() {
- var a = Symbol(), l = Symbol();
- var o = {[a]:1};
- var p = {[a]:2, [l]:13};
- var result = 0;
- for (var i = 0; i < 1000000; ++i) {
- result ^= o[a];
- var tmp = o;
- o = p;
- p = tmp;
- }
- if (result != 0)
- throw "Error: bad result: " + result;
-})();
</del></span></pre></div>
<a id="trunkLayoutTestsjsregressscripttestsgetbyvalwithsymbolbimorphiccheckstructureeliminationjs"></a>
<div class="delfile"><h4>Deleted: trunk/LayoutTests/js/regress/script-tests/get-by-val-with-symbol-bimorphic-check-structure-elimination.js (188200 => 188201)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/regress/script-tests/get-by-val-with-symbol-bimorphic-check-structure-elimination.js 2015-08-09 22:39:33 UTC (rev 188200)
+++ trunk/LayoutTests/js/regress/script-tests/get-by-val-with-symbol-bimorphic-check-structure-elimination.js 2015-08-09 22:55:54 UTC (rev 188201)
</span><span class="lines">@@ -1,14 +0,0 @@
</span><del>-(function() {
- var a = Symbol(), b = Symbol(), c = Symbol(), d = Symbol(), e = Symbol(), f = Symbol(), g = Symbol(), h = Symbol(), i = Symbol(), j = Symbol(), k = Symbol(), l = Symbol();
- var o = {[a]:1, [b]:2, [c]:3, [d]:4, [e]:5, [f]:6, [g]:7, [h]:8, [i]:9, [j]:10, [k]:11};
- var p = {[a]:2, [b]:3, [c]:4, [d]:5, [e]:6, [f]:7, [g]:8, [h]:9, [i]:10, [j]:11, [k]:12, [l]: 13};
- var result = 0;
- for (var index = 0; index < 1000000; ++index) {
- result += o[a] ^ o[b] ^ o[c] ^ o[d] ^ o[e] ^ o[f] ^ o[g] ^ o[h] ^ o[i] ^ o[j] ^ o[k];
- var tmp = o;
- o = p;
- p = tmp;
- }
- if (result != 6500000)
- throw "Error: bad result: " + result;
-})();
</del></span></pre></div>
<a id="trunkLayoutTestsjsregressscripttestsgetbyvalwithsymbolchainfromtryblockjs"></a>
<div class="delfile"><h4>Deleted: trunk/LayoutTests/js/regress/script-tests/get-by-val-with-symbol-chain-from-try-block.js (188200 => 188201)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/regress/script-tests/get-by-val-with-symbol-chain-from-try-block.js 2015-08-09 22:39:33 UTC (rev 188200)
+++ trunk/LayoutTests/js/regress/script-tests/get-by-val-with-symbol-chain-from-try-block.js 2015-08-09 22:55:54 UTC (rev 188201)
</span><span class="lines">@@ -1,49 +0,0 @@
</span><del>-var f = Symbol("Cocoa");
-
-function A() { }
-
-A.prototype = {[f]:42};
-
-function B() { }
-
-B.prototype = new A();
-
-function C() { }
-
-C.prototype = new B();
-
-function D() { }
-
-D.prototype = new C();
-
-function E() { }
-
-E.prototype = new D();
-
-function F() { }
-
-F.prototype = new E();
-
-function G() { }
-
-G.prototype = new F();
-
-function foo(o) {
- try {
- var result = 0;
- for (var i = 0; i < 1000; ++i)
- result += o[f];
- return result;
- } catch (e) {
- return 52;
- }
-}
-
-var result = 0;
-
-for (var i = 0; i < 1000; ++i)
- result += foo(new G());
-
-if (result != 42000000)
- throw "Error: bad result: " + result;
-
</del></span></pre></div>
<a id="trunkLayoutTestsjsregressscripttestsgetbyvalwithsymbolcheckstructureeliminationjs"></a>
<div class="delfile"><h4>Deleted: trunk/LayoutTests/js/regress/script-tests/get-by-val-with-symbol-check-structure-elimination.js (188200 => 188201)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/regress/script-tests/get-by-val-with-symbol-check-structure-elimination.js 2015-08-09 22:39:33 UTC (rev 188200)
+++ trunk/LayoutTests/js/regress/script-tests/get-by-val-with-symbol-check-structure-elimination.js 2015-08-09 22:55:54 UTC (rev 188201)
</span><span class="lines">@@ -1,9 +0,0 @@
</span><del>-(function() {
- var a = Symbol(), b = Symbol(), c = Symbol(), d = Symbol(), e = Symbol(), f = Symbol(), g = Symbol(), h = Symbol(), i = Symbol(), j = Symbol(), k = Symbol();
- var o = {[a]:1, [b]:2, [c]:3, [d]:4, [e]:5, [f]:6, [g]:7, [h]:8, [i]:9, [j]:10, [k]:11};
- var result = 0;
- for (var index = 0; index < 1000000; ++index)
- result += o[a] ^ o[b] | o[c] ^ o[d] & o[e] ^ o[f] | o[g] ^ o[h] & o[i] ^ o[j] | o[k];
- if (result != 15000000)
- throw "Error: bad result: " + result;
-})();
</del></span></pre></div>
<a id="trunkLayoutTestsjsregressscripttestsgetbyvalwithsymbolprotoorselfjs"></a>
<div class="delfile"><h4>Deleted: trunk/LayoutTests/js/regress/script-tests/get-by-val-with-symbol-proto-or-self.js (188200 => 188201)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/regress/script-tests/get-by-val-with-symbol-proto-or-self.js 2015-08-09 22:39:33 UTC (rev 188200)
+++ trunk/LayoutTests/js/regress/script-tests/get-by-val-with-symbol-proto-or-self.js 2015-08-09 22:55:54 UTC (rev 188201)
</span><span class="lines">@@ -1,24 +0,0 @@
</span><del>-var f = Symbol("Cocoa");
-
-function foo(o) {
- return o[f];
-}
-
-function bar(a) {
- var result = 0;
- for (var i = 0; i < 2000000; ++i) {
- for (var j = 0; j < a.length; ++j)
- result += foo(a[j]);
- }
- return result;
-}
-
-function Foo() {
-}
-
-Foo.prototype[f] = 42;
-
-var result = bar([new Foo(), {[f]:24}]);
-
-if (result != 132000000)
- throw "Error bad result: " + result;
</del></span></pre></div>
<a id="trunkLayoutTestsjsregressscripttestsgetbyvalwithsymbolquadmorphiccheckstructureeliminationsimplejs"></a>
<div class="delfile"><h4>Deleted: trunk/LayoutTests/js/regress/script-tests/get-by-val-with-symbol-quadmorphic-check-structure-elimination-simple.js (188200 => 188201)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/regress/script-tests/get-by-val-with-symbol-quadmorphic-check-structure-elimination-simple.js 2015-08-09 22:39:33 UTC (rev 188200)
+++ trunk/LayoutTests/js/regress/script-tests/get-by-val-with-symbol-quadmorphic-check-structure-elimination-simple.js 2015-08-09 22:55:54 UTC (rev 188201)
</span><span class="lines">@@ -1,22 +0,0 @@
</span><del>-(function() {
- var a = Symbol("Cocoa");
- var l = Symbol();
- var b = Symbol();
- var c = Symbol();
-
- var o = {[a]:1};
- var p = {[a]:2, [l]:13};
- var q = {[a]:3, [b]:3};
- var r = {[a]:4, [c]:5};
- var result = 0;
- for (var i = 0; i < 1000000; ++i) {
- result ^= o[a];
- var tmp = o;
- o = p;
- p = q;
- q = r;
- r = tmp;
- }
- if (result != 0)
- throw "Error: bad result: " + result;
-})();
</del></span></pre></div>
<a id="trunkLayoutTestsjsregressscripttestsgetbyvalwithsymbolselforprotojs"></a>
<div class="delfile"><h4>Deleted: trunk/LayoutTests/js/regress/script-tests/get-by-val-with-symbol-self-or-proto.js (188200 => 188201)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/regress/script-tests/get-by-val-with-symbol-self-or-proto.js 2015-08-09 22:39:33 UTC (rev 188200)
+++ trunk/LayoutTests/js/regress/script-tests/get-by-val-with-symbol-self-or-proto.js 2015-08-09 22:55:54 UTC (rev 188201)
</span><span class="lines">@@ -1,24 +0,0 @@
</span><del>-var f = Symbol('Cocoa');
-
-function foo(o) {
- return o[f];
-}
-
-function bar(a) {
- var result = 0;
- for (var i = 0; i < 2000000; ++i) {
- for (var j = 0; j < a.length; ++j)
- result += foo(a[j]);
- }
- return result;
-}
-
-function Foo() {
-}
-
-Foo.prototype[f] = 42;
-
-var result = bar([{[f]:24}, new Foo()]);
-
-if (result != 132000000)
- throw "Error bad result: " + result;
</del></span></pre></div>
<a id="trunkSourceJavaScriptCoreChangeLog"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/ChangeLog (188200 => 188201)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/ChangeLog 2015-08-09 22:39:33 UTC (rev 188200)
+++ trunk/Source/JavaScriptCore/ChangeLog 2015-08-09 22:55:54 UTC (rev 188201)
</span><span class="lines">@@ -1,3 +1,116 @@
</span><ins>+2015-08-09 Chris Dumez <cdumez@apple.com>
+
+ Regression(r188105): Seems to have caused crashes during PLT on some iPads
+ https://bugs.webkit.org/show_bug.cgi?id=147818
+
+ Unreviewed, roll out r188105.
+
+ * bytecode/ByValInfo.h:
+ (JSC::ByValInfo::ByValInfo):
+ * bytecode/CodeBlock.cpp:
+ (JSC::CodeBlock::getByValInfoMap): Deleted.
+ (JSC::CodeBlock::addByValInfo): Deleted.
+ * bytecode/CodeBlock.h:
+ (JSC::CodeBlock::getByValInfo):
+ (JSC::CodeBlock::setNumberOfByValInfos):
+ (JSC::CodeBlock::numberOfByValInfos):
+ (JSC::CodeBlock::byValInfo):
+ * bytecode/ExitKind.cpp:
+ (JSC::exitKindToString): Deleted.
+ * bytecode/ExitKind.h:
+ * bytecode/GetByIdStatus.cpp:
+ (JSC::GetByIdStatus::computeFor):
+ (JSC::GetByIdStatus::computeForStubInfo):
+ (JSC::GetByIdStatus::computeForStubInfoWithoutExitSiteFeedback): Deleted.
+ * bytecode/GetByIdStatus.h:
+ * dfg/DFGAbstractInterpreterInlines.h:
+ (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects): Deleted.
+ * dfg/DFGByteCodeParser.cpp:
+ (JSC::DFG::ByteCodeParser::parseBlock):
+ (JSC::DFG::ByteCodeParser::InlineStackEntry::InlineStackEntry): Deleted.
+ * dfg/DFGClobberize.h:
+ (JSC::DFG::clobberize): Deleted.
+ * dfg/DFGConstantFoldingPhase.cpp:
+ (JSC::DFG::ConstantFoldingPhase::foldConstants): Deleted.
+ * dfg/DFGDoesGC.cpp:
+ (JSC::DFG::doesGC): Deleted.
+ * dfg/DFGFixupPhase.cpp:
+ (JSC::DFG::FixupPhase::fixupNode): Deleted.
+ (JSC::DFG::FixupPhase::observeUseKindOnNode): Deleted.
+ * dfg/DFGNode.h:
+ (JSC::DFG::Node::hasUidOperand): Deleted.
+ (JSC::DFG::Node::uidOperand): Deleted.
+ * dfg/DFGNodeType.h:
+ * dfg/DFGPredictionPropagationPhase.cpp:
+ (JSC::DFG::PredictionPropagationPhase::propagate): Deleted.
+ * dfg/DFGSafeToExecute.h:
+ (JSC::DFG::SafeToExecuteEdge::operator()): Deleted.
+ (JSC::DFG::safeToExecute): Deleted.
+ * dfg/DFGSpeculativeJIT.cpp:
+ (JSC::DFG::SpeculativeJIT::compileCheckIdent): Deleted.
+ (JSC::DFG::SpeculativeJIT::speculateSymbol): Deleted.
+ (JSC::DFG::SpeculativeJIT::speculate): Deleted.
+ * dfg/DFGSpeculativeJIT.h:
+ * dfg/DFGSpeculativeJIT32_64.cpp:
+ (JSC::DFG::SpeculativeJIT::compile): Deleted.
+ * dfg/DFGSpeculativeJIT64.cpp:
+ (JSC::DFG::SpeculativeJIT::compile): Deleted.
+ * dfg/DFGUseKind.cpp:
+ (WTF::printInternal): Deleted.
+ * dfg/DFGUseKind.h:
+ (JSC::DFG::typeFilterFor): Deleted.
+ (JSC::DFG::isCell): Deleted.
+ * ftl/FTLAbstractHeapRepository.h:
+ * ftl/FTLCapabilities.cpp:
+ (JSC::FTL::canCompile): Deleted.
+ * ftl/FTLLowerDFGToLLVM.cpp:
+ (JSC::FTL::DFG::LowerDFGToLLVM::compileNode): Deleted.
+ (JSC::FTL::DFG::LowerDFGToLLVM::compileCheckIdent): Deleted.
+ (JSC::FTL::DFG::LowerDFGToLLVM::lowSymbol): Deleted.
+ (JSC::FTL::DFG::LowerDFGToLLVM::speculate): Deleted.
+ (JSC::FTL::DFG::LowerDFGToLLVM::isNotSymbol): Deleted.
+ (JSC::FTL::DFG::LowerDFGToLLVM::speculateSymbol): Deleted.
+ * jit/JIT.cpp:
+ (JSC::JIT::privateCompile):
+ * jit/JIT.h:
+ (JSC::ByValCompilationInfo::ByValCompilationInfo):
+ (JSC::JIT::compileGetByValWithCachedId): Deleted.
+ * jit/JITInlines.h:
+ (JSC::JIT::callOperation): Deleted.
+ * jit/JITOpcodes.cpp:
+ (JSC::JIT::emit_op_has_indexed_property):
+ (JSC::JIT::emitSlow_op_has_indexed_property):
+ * jit/JITOpcodes32_64.cpp:
+ (JSC::JIT::emit_op_has_indexed_property):
+ (JSC::JIT::emitSlow_op_has_indexed_property):
+ * jit/JITOperations.cpp:
+ (JSC::getByVal):
+ * jit/JITOperations.h:
+ * jit/JITPropertyAccess.cpp:
+ (JSC::JIT::emit_op_get_by_val):
+ (JSC::JIT::emitSlow_op_get_by_val):
+ (JSC::JIT::emit_op_put_by_val):
+ (JSC::JIT::emitSlow_op_put_by_val):
+ (JSC::JIT::emitGetByValWithCachedId): Deleted.
+ (JSC::JIT::privateCompileGetByVal): Deleted.
+ (JSC::JIT::privateCompileGetByValWithCachedId): Deleted.
+ * jit/JITPropertyAccess32_64.cpp:
+ (JSC::JIT::emit_op_get_by_val):
+ (JSC::JIT::emitSlow_op_get_by_val):
+ (JSC::JIT::emit_op_put_by_val):
+ (JSC::JIT::emitSlow_op_put_by_val):
+ (JSC::JIT::emitGetByValWithCachedId): Deleted.
+ * runtime/Symbol.h:
+ * tests/stress/get-by-val-with-string-constructor.js: Removed.
+ * tests/stress/get-by-val-with-string-exit.js: Removed.
+ * tests/stress/get-by-val-with-string-generated.js: Removed.
+ * tests/stress/get-by-val-with-string-getter.js: Removed.
+ * tests/stress/get-by-val-with-string.js: Removed.
+ * tests/stress/get-by-val-with-symbol-constructor.js: Removed.
+ * tests/stress/get-by-val-with-symbol-exit.js: Removed.
+ * tests/stress/get-by-val-with-symbol-getter.js: Removed.
+ * tests/stress/get-by-val-with-symbol.js: Removed.
+
</ins><span class="cx"> 2015-08-07 Gyuyoung Kim <gyuyoung.kim@webkit.org>
</span><span class="cx">
</span><span class="cx"> Reduce uses of PassRefPtr in bindings
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorebytecodeByValInfoh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/bytecode/ByValInfo.h (188200 => 188201)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/bytecode/ByValInfo.h 2015-08-09 22:39:33 UTC (rev 188200)
+++ trunk/Source/JavaScriptCore/bytecode/ByValInfo.h 2015-08-09 22:55:54 UTC (rev 188201)
</span><span class="lines">@@ -26,18 +26,16 @@
</span><span class="cx"> #ifndef ByValInfo_h
</span><span class="cx"> #define ByValInfo_h
</span><span class="cx">
</span><ins>+#if ENABLE(JIT)
+
</ins><span class="cx"> #include "ClassInfo.h"
</span><span class="cx"> #include "CodeLocation.h"
</span><del>-#include "CodeOrigin.h"
</del><span class="cx"> #include "IndexingType.h"
</span><span class="cx"> #include "JITStubRoutine.h"
</span><span class="cx"> #include "Structure.h"
</span><del>-#include "StructureStubInfo.h"
</del><span class="cx">
</span><span class="cx"> namespace JSC {
</span><span class="cx">
</span><del>-#if ENABLE(JIT)
-
</del><span class="cx"> enum JITArrayMode {
</span><span class="cx"> JITInt32,
</span><span class="cx"> JITDouble,
</span><span class="lines">@@ -203,33 +201,24 @@
</span><span class="cx">
</span><span class="cx"> struct ByValInfo {
</span><span class="cx"> ByValInfo() { }
</span><del>-
- ByValInfo(unsigned bytecodeIndex, CodeLocationJump notIndexJump, CodeLocationJump badTypeJump, JITArrayMode arrayMode, ArrayProfile* arrayProfile, int16_t badTypeJumpToDone, int16_t returnAddressToSlowPath)
</del><ins>+
+ ByValInfo(unsigned bytecodeIndex, CodeLocationJump badTypeJump, JITArrayMode arrayMode, int16_t badTypeJumpToDone, int16_t returnAddressToSlowPath)
</ins><span class="cx"> : bytecodeIndex(bytecodeIndex)
</span><del>- , notIndexJump(notIndexJump)
</del><span class="cx"> , badTypeJump(badTypeJump)
</span><span class="cx"> , arrayMode(arrayMode)
</span><del>- , arrayProfile(arrayProfile)
</del><span class="cx"> , badTypeJumpToDone(badTypeJumpToDone)
</span><span class="cx"> , returnAddressToSlowPath(returnAddressToSlowPath)
</span><span class="cx"> , slowPathCount(0)
</span><del>- , stubInfo(nullptr)
- , tookSlowPath(false)
</del><span class="cx"> {
</span><span class="cx"> }
</span><del>-
</del><ins>+
</ins><span class="cx"> unsigned bytecodeIndex;
</span><del>- CodeLocationJump notIndexJump;
</del><span class="cx"> CodeLocationJump badTypeJump;
</span><span class="cx"> JITArrayMode arrayMode; // The array mode that was baked into the inline JIT code.
</span><del>- ArrayProfile* arrayProfile;
</del><span class="cx"> int16_t badTypeJumpToDone;
</span><span class="cx"> int16_t returnAddressToSlowPath;
</span><span class="cx"> unsigned slowPathCount;
</span><span class="cx"> RefPtr<JITStubRoutine> stubRoutine;
</span><del>- Identifier cachedId;
- StructureStubInfo* stubInfo;
- bool tookSlowPath;
</del><span class="cx"> };
</span><span class="cx">
</span><span class="cx"> inline unsigned getByValInfoBytecodeIndex(ByValInfo* info)
</span><span class="lines">@@ -237,15 +226,9 @@
</span><span class="cx"> return info->bytecodeIndex;
</span><span class="cx"> }
</span><span class="cx">
</span><del>-typedef HashMap<CodeOrigin, ByValInfo*, CodeOriginApproximateHash> ByValInfoMap;
</del><ins>+} // namespace JSC
</ins><span class="cx">
</span><del>-#else // ENABLE(JIT)
-
-typedef HashMap<int, void*> ByValInfoMap;
-
</del><span class="cx"> #endif // ENABLE(JIT)
</span><span class="cx">
</span><del>-} // namespace JSC
-
</del><span class="cx"> #endif // ByValInfo_h
</span><span class="cx">
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorebytecodeCodeBlockcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/bytecode/CodeBlock.cpp (188200 => 188201)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/bytecode/CodeBlock.cpp 2015-08-09 22:39:33 UTC (rev 188200)
+++ trunk/Source/JavaScriptCore/bytecode/CodeBlock.cpp 2015-08-09 22:55:54 UTC (rev 188201)
</span><span class="lines">@@ -2672,23 +2672,7 @@
</span><span class="cx"> getCallLinkInfoMap(locker, result);
</span><span class="cx"> }
</span><span class="cx">
</span><del>-void CodeBlock::getByValInfoMap(const ConcurrentJITLocker&, ByValInfoMap& result)
-{
</del><span class="cx"> #if ENABLE(JIT)
</span><del>- for (auto* byValInfo : m_byValInfos)
- result.add(CodeOrigin(byValInfo->bytecodeIndex), byValInfo);
-#else
- UNUSED_PARAM(result);
-#endif
-}
-
-void CodeBlock::getByValInfoMap(ByValInfoMap& result)
-{
- ConcurrentJITLocker locker(m_lock);
- getByValInfoMap(locker, result);
-}
-
-#if ENABLE(JIT)
</del><span class="cx"> StructureStubInfo* CodeBlock::addStubInfo()
</span><span class="cx"> {
</span><span class="cx"> ConcurrentJITLocker locker(m_lock);
</span><span class="lines">@@ -2704,12 +2688,6 @@
</span><span class="cx"> return nullptr;
</span><span class="cx"> }
</span><span class="cx">
</span><del>-ByValInfo* CodeBlock::addByValInfo()
-{
- ConcurrentJITLocker locker(m_lock);
- return m_byValInfos.add();
-}
-
</del><span class="cx"> CallLinkInfo* CodeBlock::addCallLinkInfo()
</span><span class="cx"> {
</span><span class="cx"> ConcurrentJITLocker locker(m_lock);
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorebytecodeCodeBlockh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/bytecode/CodeBlock.h (188200 => 188201)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/bytecode/CodeBlock.h 2015-08-09 22:39:33 UTC (rev 188200)
+++ trunk/Source/JavaScriptCore/bytecode/CodeBlock.h 2015-08-09 22:55:54 UTC (rev 188201)
</span><span class="lines">@@ -200,9 +200,6 @@
</span><span class="cx">
</span><span class="cx"> void getCallLinkInfoMap(const ConcurrentJITLocker&, CallLinkInfoMap& result);
</span><span class="cx"> void getCallLinkInfoMap(CallLinkInfoMap& result);
</span><del>-
- void getByValInfoMap(const ConcurrentJITLocker&, ByValInfoMap& result);
- void getByValInfoMap(ByValInfoMap& result);
</del><span class="cx">
</span><span class="cx"> #if ENABLE(JIT)
</span><span class="cx"> StructureStubInfo* addStubInfo();
</span><span class="lines">@@ -214,9 +211,12 @@
</span><span class="cx"> StructureStubInfo* findStubInfo(CodeOrigin);
</span><span class="cx">
</span><span class="cx"> void resetStub(StructureStubInfo&);
</span><ins>+
+ ByValInfo& getByValInfo(unsigned bytecodeIndex)
+ {
+ return *(binarySearch<ByValInfo, unsigned>(m_byValInfos, m_byValInfos.size(), bytecodeIndex, getByValInfoBytecodeIndex));
+ }
</ins><span class="cx">
</span><del>- ByValInfo* addByValInfo();
-
</del><span class="cx"> CallLinkInfo* addCallLinkInfo();
</span><span class="cx"> Bag<CallLinkInfo>::iterator callLinkInfosBegin() { return m_callLinkInfos.begin(); }
</span><span class="cx"> Bag<CallLinkInfo>::iterator callLinkInfosEnd() { return m_callLinkInfos.end(); }
</span><span class="lines">@@ -367,6 +367,12 @@
</span><span class="cx">
</span><span class="cx"> String nameForRegister(VirtualRegister);
</span><span class="cx">
</span><ins>+#if ENABLE(JIT)
+ void setNumberOfByValInfos(size_t size) { m_byValInfos.resizeToFit(size); }
+ size_t numberOfByValInfos() const { return m_byValInfos.size(); }
+ ByValInfo& byValInfo(size_t index) { return m_byValInfos[index]; }
+#endif
+
</ins><span class="cx"> unsigned numberOfArgumentValueProfiles()
</span><span class="cx"> {
</span><span class="cx"> ASSERT(m_numParameters >= 0);
</span><span class="lines">@@ -1010,7 +1016,7 @@
</span><span class="cx"> RefPtr<JITCode> m_jitCode;
</span><span class="cx"> #if ENABLE(JIT)
</span><span class="cx"> Bag<StructureStubInfo> m_stubInfos;
</span><del>- Bag<ByValInfo> m_byValInfos;
</del><ins>+ Vector<ByValInfo> m_byValInfos;
</ins><span class="cx"> Bag<CallLinkInfo> m_callLinkInfos;
</span><span class="cx"> SentinelLinkedList<CallLinkInfo, BasicRawSentinelNode<CallLinkInfo>> m_incomingCalls;
</span><span class="cx"> SentinelLinkedList<PolymorphicCallNode, BasicRawSentinelNode<PolymorphicCallNode>> m_incomingPolymorphicCalls;
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorebytecodeExitKindcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/bytecode/ExitKind.cpp (188200 => 188201)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/bytecode/ExitKind.cpp 2015-08-09 22:39:33 UTC (rev 188200)
+++ trunk/Source/JavaScriptCore/bytecode/ExitKind.cpp 2015-08-09 22:55:54 UTC (rev 188201)
</span><span class="lines">@@ -40,8 +40,6 @@
</span><span class="cx"> return "BadType";
</span><span class="cx"> case BadCell:
</span><span class="cx"> return "BadCell";
</span><del>- case BadIdent:
- return "BadIdent";
</del><span class="cx"> case BadExecutable:
</span><span class="cx"> return "BadExecutable";
</span><span class="cx"> case BadCache:
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorebytecodeExitKindh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/bytecode/ExitKind.h (188200 => 188201)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/bytecode/ExitKind.h 2015-08-09 22:39:33 UTC (rev 188200)
+++ trunk/Source/JavaScriptCore/bytecode/ExitKind.h 2015-08-09 22:55:54 UTC (rev 188201)
</span><span class="lines">@@ -32,7 +32,6 @@
</span><span class="cx"> ExitKindUnset,
</span><span class="cx"> BadType, // We exited because a type prediction was wrong.
</span><span class="cx"> BadCell, // We exited because we made an incorrect assumption about what cell we would see. Usually used for function checks.
</span><del>- BadIdent, // We exited because we made an incorrect assumption about what identifier we would see. Usually used for cached Id check in get_by_val.
</del><span class="cx"> BadExecutable, // We exited because we made an incorrect assumption about what executable we would see.
</span><span class="cx"> BadCache, // We exited because an inline cache was wrong.
</span><span class="cx"> BadConstantCache, // We exited because a cache on a weak constant (usually a prototype) was wrong.
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorebytecodeGetByIdStatuscpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/bytecode/GetByIdStatus.cpp (188200 => 188201)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/bytecode/GetByIdStatus.cpp 2015-08-09 22:39:33 UTC (rev 188200)
+++ trunk/Source/JavaScriptCore/bytecode/GetByIdStatus.cpp 2015-08-09 22:55:54 UTC (rev 188201)
</span><span class="lines">@@ -98,7 +98,7 @@
</span><span class="cx"> GetByIdStatus result;
</span><span class="cx">
</span><span class="cx"> #if ENABLE(DFG_JIT)
</span><del>- result = computeForStubInfoWithoutExitSiteFeedback(
</del><ins>+ result = computeForStubInfo(
</ins><span class="cx"> locker, profiledBlock, map.get(CodeOrigin(bytecodeIndex)), uid,
</span><span class="cx"> CallLinkStatus::computeExitSiteData(locker, profiledBlock, bytecodeIndex));
</span><span class="cx">
</span><span class="lines">@@ -116,20 +116,7 @@
</span><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> #if ENABLE(JIT)
</span><del>-GetByIdStatus GetByIdStatus::computeForStubInfo(const ConcurrentJITLocker& locker, CodeBlock* profiledBlock, StructureStubInfo* stubInfo, CodeOrigin codeOrigin, UniquedStringImpl* uid)
-{
- GetByIdStatus result = GetByIdStatus::computeForStubInfoWithoutExitSiteFeedback(
- locker, profiledBlock, stubInfo, uid,
- CallLinkStatus::computeExitSiteData(locker, profiledBlock, codeOrigin.bytecodeIndex));
-
- if (!result.takesSlowPath() && GetByIdStatus::hasExitSite(locker, profiledBlock, codeOrigin.bytecodeIndex))
- return GetByIdStatus(result.makesCalls() ? GetByIdStatus::MakesCalls : GetByIdStatus::TakesSlowPath, true);
- return result;
-}
-#endif // ENABLE(JIT)
-
-#if ENABLE(JIT)
-GetByIdStatus GetByIdStatus::computeForStubInfoWithoutExitSiteFeedback(
</del><ins>+GetByIdStatus GetByIdStatus::computeForStubInfo(
</ins><span class="cx"> const ConcurrentJITLocker& locker, CodeBlock* profiledBlock, StructureStubInfo* stubInfo, UniquedStringImpl* uid,
</span><span class="cx"> CallLinkStatus::ExitSiteData callExitSiteData)
</span><span class="cx"> {
</span><span class="lines">@@ -255,7 +242,7 @@
</span><span class="cx"> GetByIdStatus result;
</span><span class="cx"> {
</span><span class="cx"> ConcurrentJITLocker locker(dfgBlock->m_lock);
</span><del>- result = computeForStubInfoWithoutExitSiteFeedback(
</del><ins>+ result = computeForStubInfo(
</ins><span class="cx"> locker, dfgBlock, dfgMap.get(codeOrigin), uid, exitSiteData);
</span><span class="cx"> }
</span><span class="cx">
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorebytecodeGetByIdStatush"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/bytecode/GetByIdStatus.h (188200 => 188201)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/bytecode/GetByIdStatus.h 2015-08-09 22:39:33 UTC (rev 188200)
+++ trunk/Source/JavaScriptCore/bytecode/GetByIdStatus.h 2015-08-09 22:55:54 UTC (rev 188201)
</span><span class="lines">@@ -71,11 +71,7 @@
</span><span class="cx"> static GetByIdStatus computeFor(const StructureSet&, UniquedStringImpl* uid);
</span><span class="cx">
</span><span class="cx"> static GetByIdStatus computeFor(CodeBlock* baselineBlock, CodeBlock* dfgBlock, StubInfoMap& baselineMap, StubInfoMap& dfgMap, CodeOrigin, UniquedStringImpl* uid);
</span><del>-
-#if ENABLE(JIT)
- static GetByIdStatus computeForStubInfo(const ConcurrentJITLocker&, CodeBlock* baselineBlock, StructureStubInfo*, CodeOrigin, UniquedStringImpl* uid);
-#endif
-
</del><ins>+
</ins><span class="cx"> State state() const { return m_state; }
</span><span class="cx">
</span><span class="cx"> bool isSet() const { return m_state != NoInformation; }
</span><span class="lines">@@ -99,7 +95,7 @@
</span><span class="cx"> static bool hasExitSite(const ConcurrentJITLocker&, CodeBlock*, unsigned bytecodeIndex);
</span><span class="cx"> #endif
</span><span class="cx"> #if ENABLE(JIT)
</span><del>- static GetByIdStatus computeForStubInfoWithoutExitSiteFeedback(
</del><ins>+ static GetByIdStatus computeForStubInfo(
</ins><span class="cx"> const ConcurrentJITLocker&, CodeBlock* profiledBlock, StructureStubInfo*,
</span><span class="cx"> UniquedStringImpl* uid, CallLinkStatus::ExitSiteData);
</span><span class="cx"> #endif
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGAbstractInterpreterInlinesh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h (188200 => 188201)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h 2015-08-09 22:39:33 UTC (rev 188200)
+++ trunk/Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h 2015-08-09 22:55:54 UTC (rev 188201)
</span><span class="lines">@@ -2163,32 +2163,6 @@
</span><span class="cx"> break;
</span><span class="cx"> }
</span><span class="cx">
</span><del>- case CheckIdent: {
- AbstractValue& value = forNode(node->child1());
- UniquedStringImpl* uid = node->uidOperand();
- ASSERT(uid->isSymbol() ? !(value.m_type & ~SpecSymbol) : !(value.m_type & ~SpecStringIdent)); // Edge filtering should have already ensured this.
-
- JSValue childConstant = value.value();
- if (childConstant) {
- if (uid->isSymbol()) {
- ASSERT(childConstant.isSymbol());
- if (asSymbol(childConstant)->privateName().uid() == uid) {
- m_state.setFoundConstants(true);
- break;
- }
- } else {
- ASSERT(childConstant.isString());
- if (asString(childConstant)->tryGetValueImpl() == uid) {
- m_state.setFoundConstants(true);
- break;
- }
- }
- }
-
- filter(value, uid->isSymbol() ? SpecSymbol : SpecStringIdent);
- break;
- }
-
</del><span class="cx"> case CheckInBounds: {
</span><span class="cx"> JSValue left = forNode(node->child1()).value();
</span><span class="cx"> JSValue right = forNode(node->child2()).value();
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGByteCodeParsercpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp (188200 => 188201)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp 2015-08-09 22:39:33 UTC (rev 188200)
+++ trunk/Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp 2015-08-09 22:55:54 UTC (rev 188201)
</span><span class="lines">@@ -969,7 +969,6 @@
</span><span class="cx">
</span><span class="cx"> CallLinkInfoMap m_callLinkInfos;
</span><span class="cx"> StubInfoMap m_stubInfos;
</span><del>- ByValInfoMap m_byValInfos;
</del><span class="cx">
</span><span class="cx"> // Did we see any returns? We need to handle the (uncommon but necessary)
</span><span class="cx"> // case where a procedure that does not return was inlined.
</span><span class="lines">@@ -3398,36 +3397,13 @@
</span><span class="cx">
</span><span class="cx"> case op_get_by_val: {
</span><span class="cx"> SpeculatedType prediction = getPredictionWithoutOSRExit();
</span><del>-
</del><ins>+
</ins><span class="cx"> Node* base = get(VirtualRegister(currentInstruction[2].u.operand));
</span><ins>+ ArrayMode arrayMode = getArrayMode(currentInstruction[4].u.arrayProfile, Array::Read);
</ins><span class="cx"> Node* property = get(VirtualRegister(currentInstruction[3].u.operand));
</span><del>- bool compiledAsGetById = false;
- {
- ConcurrentJITLocker locker(m_inlineStackTop->m_profiledBlock->m_lock);
- ByValInfo* byValInfo = m_inlineStackTop->m_byValInfos.get(CodeOrigin(currentCodeOrigin().bytecodeIndex));
- // FIXME: When the bytecode is not compiled in the baseline JIT, byValInfo becomes null.
- // At that time, there is no information.
- if (byValInfo && byValInfo->stubInfo && !byValInfo->tookSlowPath && !m_inlineStackTop->m_exitProfile.hasExitSite(m_currentIndex, BadIdent)) {
- compiledAsGetById = true;
- unsigned identifierNumber = m_graph.identifiers().ensure(byValInfo->cachedId.impl());
- UniquedStringImpl* uid = m_graph.identifiers()[identifierNumber];
</del><ins>+ Node* getByVal = addToGraph(GetByVal, OpInfo(arrayMode.asWord()), OpInfo(prediction), base, property);
+ set(VirtualRegister(currentInstruction[1].u.operand), getByVal);
</ins><span class="cx">
</span><del>- addToGraph(CheckIdent, OpInfo(uid), property);
-
- GetByIdStatus getByIdStatus = GetByIdStatus::computeForStubInfo(
- locker, m_inlineStackTop->m_profiledBlock,
- byValInfo->stubInfo, currentCodeOrigin(), uid);
-
- handleGetById(currentInstruction[1].u.operand, prediction, base, identifierNumber, getByIdStatus);
- }
- }
-
- if (!compiledAsGetById) {
- ArrayMode arrayMode = getArrayMode(currentInstruction[4].u.arrayProfile, Array::Read);
- Node* getByVal = addToGraph(GetByVal, OpInfo(arrayMode.asWord()), OpInfo(prediction), base, property);
- set(VirtualRegister(currentInstruction[1].u.operand), getByVal);
- }
-
</del><span class="cx"> NEXT_OPCODE(op_get_by_val);
</span><span class="cx"> }
</span><span class="cx">
</span><span class="lines">@@ -4329,7 +4305,6 @@
</span><span class="cx"> if (m_profiledBlock->hasBaselineJITProfiling()) {
</span><span class="cx"> m_profiledBlock->getStubInfoMap(locker, m_stubInfos);
</span><span class="cx"> m_profiledBlock->getCallLinkInfoMap(locker, m_callLinkInfos);
</span><del>- m_profiledBlock->getByValInfoMap(locker, m_byValInfos);
</del><span class="cx"> }
</span><span class="cx"> }
</span><span class="cx">
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGClobberizeh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGClobberize.h (188200 => 188201)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGClobberize.h 2015-08-09 22:39:33 UTC (rev 188200)
+++ trunk/Source/JavaScriptCore/dfg/DFGClobberize.h 2015-08-09 22:55:54 UTC (rev 188201)
</span><span class="lines">@@ -268,10 +268,6 @@
</span><span class="cx"> def(PureValue(CheckNotEmpty, AdjacencyList(AdjacencyList::Fixed, node->child1())));
</span><span class="cx"> return;
</span><span class="cx">
</span><del>- case CheckIdent:
- def(PureValue(CheckIdent, AdjacencyList(AdjacencyList::Fixed, node->child1()), node->uidOperand()));
- return;
-
</del><span class="cx"> case ConstantStoragePointer:
</span><span class="cx"> def(PureValue(node, node->storagePointer()));
</span><span class="cx"> return;
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGConstantFoldingPhasecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGConstantFoldingPhase.cpp (188200 => 188201)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGConstantFoldingPhase.cpp 2015-08-09 22:39:33 UTC (rev 188200)
+++ trunk/Source/JavaScriptCore/dfg/DFGConstantFoldingPhase.cpp 2015-08-09 22:55:54 UTC (rev 188201)
</span><span class="lines">@@ -208,33 +208,6 @@
</span><span class="cx"> break;
</span><span class="cx"> }
</span><span class="cx">
</span><del>- case CheckIdent: {
- UniquedStringImpl* uid = node->uidOperand();
- JSValue childConstant = m_state.forNode(node->child1()).value();
- const UniquedStringImpl* constantUid = nullptr;
- if (childConstant) {
- if (uid->isSymbol()) {
- if (childConstant.isSymbol())
- constantUid = asSymbol(childConstant)->privateName().uid();
- } else {
- if (childConstant.isString()) {
- // Since we already filtered the value with StringIdentUse,
- // the held impl is always atomic.
- if (const auto* impl = asString(childConstant)->tryGetValueImpl()) {
- ASSERT(impl->isAtomic());
- constantUid = static_cast<const UniquedStringImpl*>(impl);
- }
- }
- }
- }
-
- if (constantUid == uid) {
- node->remove();
- eliminated = true;
- }
- break;
- }
-
</del><span class="cx"> case CheckInBounds: {
</span><span class="cx"> JSValue left = m_state.forNode(node->child1()).value();
</span><span class="cx"> JSValue right = m_state.forNode(node->child2()).value();
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGDoesGCcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGDoesGC.cpp (188200 => 188201)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGDoesGC.cpp 2015-08-09 22:39:33 UTC (rev 188200)
+++ trunk/Source/JavaScriptCore/dfg/DFGDoesGC.cpp 2015-08-09 22:55:54 UTC (rev 188201)
</span><span class="lines">@@ -107,7 +107,6 @@
</span><span class="cx"> case VarInjectionWatchpoint:
</span><span class="cx"> case CheckCell:
</span><span class="cx"> case CheckNotEmpty:
</span><del>- case CheckIdent:
</del><span class="cx"> case RegExpExec:
</span><span class="cx"> case RegExpTest:
</span><span class="cx"> case CompareLess:
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGFixupPhasecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGFixupPhase.cpp (188200 => 188201)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGFixupPhase.cpp 2015-08-09 22:39:33 UTC (rev 188200)
+++ trunk/Source/JavaScriptCore/dfg/DFGFixupPhase.cpp 2015-08-09 22:55:54 UTC (rev 188201)
</span><span class="lines">@@ -1012,15 +1012,6 @@
</span><span class="cx"> fixEdge<CellUse>(node->child1());
</span><span class="cx"> break;
</span><span class="cx"> }
</span><del>-
- case CheckIdent: {
- UniquedStringImpl* uid = node->uidOperand();
- if (uid->isSymbol())
- fixEdge<SymbolUse>(node->child1());
- else
- fixEdge<StringIdentUse>(node->child1());
- break;
- }
</del><span class="cx">
</span><span class="cx"> case Arrayify:
</span><span class="cx"> case ArrayifyToStructure: {
</span><span class="lines">@@ -1769,7 +1760,6 @@
</span><span class="cx"> case FunctionUse:
</span><span class="cx"> case StringUse:
</span><span class="cx"> case KnownStringUse:
</span><del>- case SymbolUse:
</del><span class="cx"> case StringObjectUse:
</span><span class="cx"> case StringOrStringObjectUse:
</span><span class="cx"> if (alwaysUnboxSimplePrimitives()
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGNodeh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGNode.h (188200 => 188201)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGNode.h 2015-08-09 22:39:33 UTC (rev 188200)
+++ trunk/Source/JavaScriptCore/dfg/DFGNode.h 2015-08-09 22:55:54 UTC (rev 188201)
</span><span class="lines">@@ -1328,17 +1328,6 @@
</span><span class="cx"> return reinterpret_cast<void*>(m_opInfo);
</span><span class="cx"> }
</span><span class="cx">
</span><del>- bool hasUidOperand()
- {
- return op() == CheckIdent;
- }
-
- UniquedStringImpl* uidOperand()
- {
- ASSERT(hasUidOperand());
- return reinterpret_cast<UniquedStringImpl*>(m_opInfo);
- }
-
</del><span class="cx"> bool hasTransition()
</span><span class="cx"> {
</span><span class="cx"> switch (op()) {
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGNodeTypeh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGNodeType.h (188200 => 188201)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGNodeType.h 2015-08-09 22:39:33 UTC (rev 188200)
+++ trunk/Source/JavaScriptCore/dfg/DFGNodeType.h 2015-08-09 22:55:54 UTC (rev 188201)
</span><span class="lines">@@ -209,7 +209,6 @@
</span><span class="cx"> macro(CheckNotEmpty, NodeMustGenerate) \
</span><span class="cx"> macro(CheckBadCell, NodeMustGenerate) \
</span><span class="cx"> macro(CheckInBounds, NodeMustGenerate) \
</span><del>- macro(CheckIdent, NodeMustGenerate) \
</del><span class="cx"> \
</span><span class="cx"> /* Optimizations for array mutation. */\
</span><span class="cx"> macro(ArrayPush, NodeResultJS | NodeMustGenerate) \
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGPredictionPropagationPhasecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGPredictionPropagationPhase.cpp (188200 => 188201)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGPredictionPropagationPhase.cpp 2015-08-09 22:39:33 UTC (rev 188200)
+++ trunk/Source/JavaScriptCore/dfg/DFGPredictionPropagationPhase.cpp 2015-08-09 22:55:54 UTC (rev 188201)
</span><span class="lines">@@ -649,7 +649,6 @@
</span><span class="cx"> case CheckStructure:
</span><span class="cx"> case CheckCell:
</span><span class="cx"> case CheckNotEmpty:
</span><del>- case CheckIdent:
</del><span class="cx"> case CheckBadCell:
</span><span class="cx"> case PutStructure:
</span><span class="cx"> case VarInjectionWatchpoint:
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGSafeToExecuteh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGSafeToExecute.h (188200 => 188201)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGSafeToExecute.h 2015-08-09 22:39:33 UTC (rev 188200)
+++ trunk/Source/JavaScriptCore/dfg/DFGSafeToExecute.h 2015-08-09 22:55:54 UTC (rev 188201)
</span><span class="lines">@@ -59,7 +59,6 @@
</span><span class="cx"> case ObjectOrOtherUse:
</span><span class="cx"> case StringIdentUse:
</span><span class="cx"> case StringUse:
</span><del>- case SymbolUse:
</del><span class="cx"> case StringObjectUse:
</span><span class="cx"> case StringOrStringObjectUse:
</span><span class="cx"> case NotStringVarUse:
</span><span class="lines">@@ -189,7 +188,6 @@
</span><span class="cx"> case CheckCell:
</span><span class="cx"> case CheckBadCell:
</span><span class="cx"> case CheckNotEmpty:
</span><del>- case CheckIdent:
</del><span class="cx"> case RegExpExec:
</span><span class="cx"> case RegExpTest:
</span><span class="cx"> case CompareLess:
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGSpeculativeJITcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp (188200 => 188201)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp 2015-08-09 22:39:33 UTC (rev 188200)
+++ trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp 2015-08-09 22:55:54 UTC (rev 188201)
</span><span class="lines">@@ -4576,31 +4576,6 @@
</span><span class="cx"> } }
</span><span class="cx"> }
</span><span class="cx">
</span><del>-void SpeculativeJIT::compileCheckIdent(Node* node)
-{
- SpeculateCellOperand operand(this, node->child1());
- UniquedStringImpl* uid = node->uidOperand();
- if (uid->isSymbol()) {
- speculateSymbol(node->child1(), operand.gpr());
- speculationCheck(
- BadIdent, JSValueSource(), nullptr,
- m_jit.branchPtr(
- JITCompiler::NotEqual,
- JITCompiler::Address(operand.gpr(), Symbol::offsetOfPrivateName()),
- TrustedImmPtr(uid)));
- } else {
- speculateString(node->child1(), operand.gpr());
- speculateStringIdent(node->child1(), operand.gpr());
- speculationCheck(
- BadIdent, JSValueSource(), nullptr,
- m_jit.branchPtr(
- JITCompiler::NotEqual,
- JITCompiler::Address(operand.gpr(), JSString::offsetOfValue()),
- TrustedImmPtr(uid)));
- }
- noResult(node);
-}
-
</del><span class="cx"> void SpeculativeJIT::compileNewFunction(Node* node)
</span><span class="cx"> {
</span><span class="cx"> SpeculateCellOperand scope(this, node->child1());
</span><span class="lines">@@ -5756,20 +5731,6 @@
</span><span class="cx"> notCell.link(&m_jit);
</span><span class="cx"> }
</span><span class="cx">
</span><del>-void SpeculativeJIT::speculateSymbol(Edge edge, GPRReg cell)
-{
- DFG_TYPE_CHECK(JSValueSource::unboxedCell(cell), edge, SpecSymbol, m_jit.branchIfNotSymbol(cell));
-}
-
-void SpeculativeJIT::speculateSymbol(Edge edge)
-{
- if (!needsTypeCheck(edge, SpecSymbol))
- return;
-
- SpeculateCellOperand operand(this, edge);
- speculateSymbol(edge, operand.gpr());
-}
-
</del><span class="cx"> void SpeculativeJIT::speculateNotCell(Edge edge)
</span><span class="cx"> {
</span><span class="cx"> if (!needsTypeCheck(edge, ~SpecCell))
</span><span class="lines">@@ -5881,9 +5842,6 @@
</span><span class="cx"> case StringUse:
</span><span class="cx"> speculateString(edge);
</span><span class="cx"> break;
</span><del>- case SymbolUse:
- speculateSymbol(edge);
- break;
</del><span class="cx"> case StringObjectUse:
</span><span class="cx"> speculateStringObject(edge);
</span><span class="cx"> break;
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGSpeculativeJITh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h (188200 => 188201)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h 2015-08-09 22:39:33 UTC (rev 188200)
+++ trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h 2015-08-09 22:55:54 UTC (rev 188201)
</span><span class="lines">@@ -2191,8 +2191,6 @@
</span><span class="cx"> void compileSkipScope(Node*);
</span><span class="cx">
</span><span class="cx"> void compileGetArrayLength(Node*);
</span><del>-
- void compileCheckIdent(Node*);
</del><span class="cx">
</span><span class="cx"> void compileValueRep(Node*);
</span><span class="cx"> void compileDoubleRep(Node*);
</span><span class="lines">@@ -2408,8 +2406,6 @@
</span><span class="cx"> void speculateStringObject(Edge, GPRReg);
</span><span class="cx"> void speculateStringObject(Edge);
</span><span class="cx"> void speculateStringOrStringObject(Edge);
</span><del>- void speculateSymbol(Edge, GPRReg cell);
- void speculateSymbol(Edge);
</del><span class="cx"> void speculateNotCell(Edge);
</span><span class="cx"> void speculateOther(Edge);
</span><span class="cx"> void speculateMisc(Edge, JSValueRegs);
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGSpeculativeJIT32_64cpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp (188200 => 188201)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp 2015-08-09 22:39:33 UTC (rev 188200)
+++ trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp 2015-08-09 22:55:54 UTC (rev 188201)
</span><span class="lines">@@ -3820,10 +3820,6 @@
</span><span class="cx"> break;
</span><span class="cx"> }
</span><span class="cx">
</span><del>- case CheckIdent:
- compileCheckIdent(node);
- break;
-
</del><span class="cx"> case GetExecutable: {
</span><span class="cx"> SpeculateCellOperand function(this, node->child1());
</span><span class="cx"> GPRTemporary result(this, Reuse, function);
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGSpeculativeJIT64cpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp (188200 => 188201)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp 2015-08-09 22:39:33 UTC (rev 188200)
+++ trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp 2015-08-09 22:55:54 UTC (rev 188201)
</span><span class="lines">@@ -3850,10 +3850,6 @@
</span><span class="cx"> break;
</span><span class="cx"> }
</span><span class="cx">
</span><del>- case CheckIdent:
- compileCheckIdent(node);
- break;
-
</del><span class="cx"> case GetExecutable: {
</span><span class="cx"> SpeculateCellOperand function(this, node->child1());
</span><span class="cx"> GPRTemporary result(this, Reuse, function);
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGUseKindcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGUseKind.cpp (188200 => 188201)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGUseKind.cpp 2015-08-09 22:39:33 UTC (rev 188200)
+++ trunk/Source/JavaScriptCore/dfg/DFGUseKind.cpp 2015-08-09 22:55:54 UTC (rev 188201)
</span><span class="lines">@@ -97,9 +97,6 @@
</span><span class="cx"> case KnownStringUse:
</span><span class="cx"> out.print("KnownString");
</span><span class="cx"> return;
</span><del>- case SymbolUse:
- out.print("Symbol");
- return;
</del><span class="cx"> case StringObjectUse:
</span><span class="cx"> out.print("StringObject");
</span><span class="cx"> return;
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGUseKindh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGUseKind.h (188200 => 188201)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGUseKind.h 2015-08-09 22:39:33 UTC (rev 188200)
+++ trunk/Source/JavaScriptCore/dfg/DFGUseKind.h 2015-08-09 22:55:54 UTC (rev 188201)
</span><span class="lines">@@ -57,7 +57,6 @@
</span><span class="cx"> StringIdentUse,
</span><span class="cx"> StringUse,
</span><span class="cx"> KnownStringUse,
</span><del>- SymbolUse,
</del><span class="cx"> StringObjectUse,
</span><span class="cx"> StringOrStringObjectUse,
</span><span class="cx"> NotStringVarUse,
</span><span class="lines">@@ -118,8 +117,6 @@
</span><span class="cx"> case StringUse:
</span><span class="cx"> case KnownStringUse:
</span><span class="cx"> return SpecString;
</span><del>- case SymbolUse:
- return SpecSymbol;
</del><span class="cx"> case StringObjectUse:
</span><span class="cx"> return SpecStringObject;
</span><span class="cx"> case StringOrStringObjectUse:
</span><span class="lines">@@ -199,7 +196,6 @@
</span><span class="cx"> case StringIdentUse:
</span><span class="cx"> case StringUse:
</span><span class="cx"> case KnownStringUse:
</span><del>- case SymbolUse:
</del><span class="cx"> case StringObjectUse:
</span><span class="cx"> case StringOrStringObjectUse:
</span><span class="cx"> return true;
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreftlFTLAbstractHeapRepositoryh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/ftl/FTLAbstractHeapRepository.h (188200 => 188201)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/ftl/FTLAbstractHeapRepository.h 2015-08-09 22:39:33 UTC (rev 188200)
+++ trunk/Source/JavaScriptCore/ftl/FTLAbstractHeapRepository.h 2015-08-09 22:55:54 UTC (rev 188201)
</span><span class="lines">@@ -87,8 +87,7 @@
</span><span class="cx"> macro(Structure_classInfo, Structure::classInfoOffset()) \
</span><span class="cx"> macro(Structure_globalObject, Structure::globalObjectOffset()) \
</span><span class="cx"> macro(Structure_prototype, Structure::prototypeOffset()) \
</span><del>- macro(Structure_structureID, Structure::structureIDOffset()) \
- macro(Symbol_privateName, Symbol::offsetOfPrivateName())
</del><ins>+ macro(Structure_structureID, Structure::structureIDOffset())
</ins><span class="cx">
</span><span class="cx"> #define FOR_EACH_INDEXED_ABSTRACT_HEAP(macro) \
</span><span class="cx"> macro(DirectArguments_storage, DirectArguments::storageOffset(), sizeof(EncodedJSValue)) \
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreftlFTLCapabilitiescpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/ftl/FTLCapabilities.cpp (188200 => 188201)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/ftl/FTLCapabilities.cpp 2015-08-09 22:39:33 UTC (rev 188200)
+++ trunk/Source/JavaScriptCore/ftl/FTLCapabilities.cpp 2015-08-09 22:55:54 UTC (rev 188201)
</span><span class="lines">@@ -118,7 +118,6 @@
</span><span class="cx"> case CheckCell:
</span><span class="cx"> case CheckBadCell:
</span><span class="cx"> case CheckNotEmpty:
</span><del>- case CheckIdent:
</del><span class="cx"> case StringCharCodeAt:
</span><span class="cx"> case AllocatePropertyStorage:
</span><span class="cx"> case ReallocatePropertyStorage:
</span><span class="lines">@@ -416,7 +415,6 @@
</span><span class="cx"> case KnownStringUse:
</span><span class="cx"> case StringObjectUse:
</span><span class="cx"> case StringOrStringObjectUse:
</span><del>- case SymbolUse:
</del><span class="cx"> case FinalObjectUse:
</span><span class="cx"> case NotCellUse:
</span><span class="cx"> case OtherUse:
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreftlFTLLowerDFGToLLVMcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/ftl/FTLLowerDFGToLLVM.cpp (188200 => 188201)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/ftl/FTLLowerDFGToLLVM.cpp 2015-08-09 22:39:33 UTC (rev 188200)
+++ trunk/Source/JavaScriptCore/ftl/FTLLowerDFGToLLVM.cpp 2015-08-09 22:55:54 UTC (rev 188201)
</span><span class="lines">@@ -532,9 +532,6 @@
</span><span class="cx"> case CheckBadCell:
</span><span class="cx"> compileCheckBadCell();
</span><span class="cx"> break;
</span><del>- case CheckIdent:
- compileCheckIdent();
- break;
</del><span class="cx"> case GetExecutable:
</span><span class="cx"> compileGetExecutable();
</span><span class="cx"> break;
</span><span class="lines">@@ -2032,20 +2029,6 @@
</span><span class="cx"> speculate(TDZFailure, noValue(), nullptr, m_out.isZero64(lowJSValue(m_node->child1())));
</span><span class="cx"> }
</span><span class="cx">
</span><del>- void compileCheckIdent()
- {
- UniquedStringImpl* uid = m_node->uidOperand();
- if (uid->isSymbol()) {
- LValue symbol = lowSymbol(m_node->child1());
- LValue stringImpl = m_out.loadPtr(symbol, m_heaps.Symbol_privateName);
- speculate(BadIdent, noValue(), nullptr, m_out.notEqual(stringImpl, m_out.constIntPtr(uid)));
- } else {
- LValue string = lowStringIdent(m_node->child1());
- LValue stringImpl = m_out.loadPtr(string, m_heaps.JSString_value);
- speculate(BadIdent, noValue(), nullptr, m_out.notEqual(stringImpl, m_out.constIntPtr(uid)));
- }
- }
-
</del><span class="cx"> void compileGetExecutable()
</span><span class="cx"> {
</span><span class="cx"> LValue cell = lowCell(m_node->child1());
</span><span class="lines">@@ -7037,16 +7020,7 @@
</span><span class="cx"> speculateStringIdent(edge, string, stringImpl);
</span><span class="cx"> return stringImpl;
</span><span class="cx"> }
</span><del>-
- LValue lowSymbol(Edge edge, OperandSpeculationMode mode = AutomaticOperandSpeculation)
- {
- ASSERT_UNUSED(mode, mode == ManualOperandSpeculation || edge.useKind() == SymbolUse);
-
- LValue result = lowCell(edge, mode);
- speculateSymbol(edge, result);
- return result;
- }
-
</del><ins>+
</ins><span class="cx"> LValue lowNonNullObject(Edge edge, OperandSpeculationMode mode = AutomaticOperandSpeculation)
</span><span class="cx"> {
</span><span class="cx"> ASSERT_UNUSED(mode, mode == ManualOperandSpeculation || edge.useKind() == ObjectUse);
</span><span class="lines">@@ -7443,9 +7417,6 @@
</span><span class="cx"> case StringIdentUse:
</span><span class="cx"> speculateStringIdent(edge);
</span><span class="cx"> break;
</span><del>- case SymbolUse:
- speculateSymbol(edge);
- break;
</del><span class="cx"> case StringObjectUse:
</span><span class="cx"> speculateStringObject(edge);
</span><span class="cx"> break;
</span><span class="lines">@@ -7542,16 +7513,7 @@
</span><span class="cx"> m_out.load32(cell, m_heaps.JSCell_structureID),
</span><span class="cx"> m_out.constInt32(vm().stringStructure->id()));
</span><span class="cx"> }
</span><del>-
- LValue isNotSymbol(LValue cell, SpeculatedType type = SpecFullTop)
- {
- if (LValue proven = isProvenValue(type & SpecCell, ~SpecSymbol))
- return proven;
- return m_out.notEqual(
- m_out.load32(cell, m_heaps.JSCell_structureID),
- m_out.constInt32(vm().symbolStructure->id()));
- }
-
</del><ins>+
</ins><span class="cx"> LValue isArrayType(LValue cell, ArrayMode arrayMode)
</span><span class="cx"> {
</span><span class="cx"> switch (arrayMode.type()) {
</span><span class="lines">@@ -7774,17 +7736,7 @@
</span><span class="cx"> NotStringObject, noValue(), 0,
</span><span class="cx"> m_out.notEqual(structureID, weakStructureID(stringObjectStructure)));
</span><span class="cx"> }
</span><del>-
- void speculateSymbol(Edge edge, LValue cell)
- {
- FTL_TYPE_CHECK(jsValueValue(cell), edge, SpecSymbol | ~SpecCell, isNotSymbol(cell));
- }
-
- void speculateSymbol(Edge edge)
- {
- speculateSymbol(edge, lowCell(edge));
- }
-
</del><ins>+
</ins><span class="cx"> void speculateNonNullObject(Edge edge, LValue cell)
</span><span class="cx"> {
</span><span class="cx"> FTL_TYPE_CHECK(jsValueValue(cell), edge, SpecObject, isNotObject(cell));
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorejitJITcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/jit/JIT.cpp (188200 => 188201)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/jit/JIT.cpp 2015-08-09 22:39:33 UTC (rev 188200)
+++ trunk/Source/JavaScriptCore/jit/JIT.cpp 2015-08-09 22:55:54 UTC (rev 188201)
</span><span class="lines">@@ -657,22 +657,17 @@
</span><span class="cx"> for (unsigned i = m_putByIds.size(); i--;)
</span><span class="cx"> m_putByIds[i].finalize(patchBuffer);
</span><span class="cx">
</span><del>- for (const auto& byValCompilationInfo : m_byValCompilationInfo) {
- PatchableJump patchableNotIndexJump = byValCompilationInfo.notIndexJump;
- CodeLocationJump notIndexJump = CodeLocationJump();
- if (Jump(patchableNotIndexJump).isSet())
- notIndexJump = CodeLocationJump(patchBuffer.locationOf(patchableNotIndexJump));
- CodeLocationJump badTypeJump = CodeLocationJump(patchBuffer.locationOf(byValCompilationInfo.badTypeJump));
- CodeLocationLabel doneTarget = patchBuffer.locationOf(byValCompilationInfo.doneTarget);
- CodeLocationLabel slowPathTarget = patchBuffer.locationOf(byValCompilationInfo.slowPathTarget);
- CodeLocationCall returnAddress = patchBuffer.locationOf(byValCompilationInfo.returnAddress);
-
- *byValCompilationInfo.byValInfo = ByValInfo(
- byValCompilationInfo.bytecodeIndex,
- notIndexJump,
</del><ins>+ m_codeBlock->setNumberOfByValInfos(m_byValCompilationInfo.size());
+ for (unsigned i = 0; i < m_byValCompilationInfo.size(); ++i) {
+ CodeLocationJump badTypeJump = CodeLocationJump(patchBuffer.locationOf(m_byValCompilationInfo[i].badTypeJump));
+ CodeLocationLabel doneTarget = patchBuffer.locationOf(m_byValCompilationInfo[i].doneTarget);
+ CodeLocationLabel slowPathTarget = patchBuffer.locationOf(m_byValCompilationInfo[i].slowPathTarget);
+ CodeLocationCall returnAddress = patchBuffer.locationOf(m_byValCompilationInfo[i].returnAddress);
+
+ m_codeBlock->byValInfo(i) = ByValInfo(
+ m_byValCompilationInfo[i].bytecodeIndex,
</ins><span class="cx"> badTypeJump,
</span><del>- byValCompilationInfo.arrayMode,
- byValCompilationInfo.arrayProfile,
</del><ins>+ m_byValCompilationInfo[i].arrayMode,
</ins><span class="cx"> differenceBetweenCodePtr(badTypeJump, doneTarget),
</span><span class="cx"> differenceBetweenCodePtr(returnAddress, slowPathTarget));
</span><span class="cx"> }
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorejitJITh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/jit/JIT.h (188200 => 188201)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/jit/JIT.h 2015-08-09 22:39:33 UTC (rev 188200)
+++ trunk/Source/JavaScriptCore/jit/JIT.h 2015-08-09 22:55:54 UTC (rev 188201)
</span><span class="lines">@@ -149,23 +149,17 @@
</span><span class="cx"> struct ByValCompilationInfo {
</span><span class="cx"> ByValCompilationInfo() { }
</span><span class="cx">
</span><del>- ByValCompilationInfo(ByValInfo* byValInfo, unsigned bytecodeIndex, MacroAssembler::PatchableJump notIndexJump, MacroAssembler::PatchableJump badTypeJump, JITArrayMode arrayMode, ArrayProfile* arrayProfile, MacroAssembler::Label doneTarget)
- : byValInfo(byValInfo)
- , bytecodeIndex(bytecodeIndex)
- , notIndexJump(notIndexJump)
</del><ins>+ ByValCompilationInfo(unsigned bytecodeIndex, MacroAssembler::PatchableJump badTypeJump, JITArrayMode arrayMode, MacroAssembler::Label doneTarget)
+ : bytecodeIndex(bytecodeIndex)
</ins><span class="cx"> , badTypeJump(badTypeJump)
</span><span class="cx"> , arrayMode(arrayMode)
</span><del>- , arrayProfile(arrayProfile)
</del><span class="cx"> , doneTarget(doneTarget)
</span><span class="cx"> {
</span><span class="cx"> }
</span><del>-
- ByValInfo* byValInfo;
</del><ins>+
</ins><span class="cx"> unsigned bytecodeIndex;
</span><del>- MacroAssembler::PatchableJump notIndexJump;
</del><span class="cx"> MacroAssembler::PatchableJump badTypeJump;
</span><span class="cx"> JITArrayMode arrayMode;
</span><del>- ArrayProfile* arrayProfile;
</del><span class="cx"> MacroAssembler::Label doneTarget;
</span><span class="cx"> MacroAssembler::Label slowPathTarget;
</span><span class="cx"> MacroAssembler::Call returnAddress;
</span><span class="lines">@@ -210,13 +204,6 @@
</span><span class="cx"> jit.privateCompileGetByVal(byValInfo, returnAddress, arrayMode);
</span><span class="cx"> }
</span><span class="cx">
</span><del>- static void compileGetByValWithCachedId(VM* vm, CodeBlock* codeBlock, ByValInfo* byValInfo, ReturnAddressPtr returnAddress, const Identifier& propertyName)
- {
- JIT jit(vm, codeBlock);
- jit.m_bytecodeOffset = byValInfo->bytecodeIndex;
- jit.privateCompileGetByValWithCachedId(byValInfo, returnAddress, propertyName);
- }
-
</del><span class="cx"> static void compilePutByVal(VM* vm, CodeBlock* codeBlock, ByValInfo* byValInfo, ReturnAddressPtr returnAddress, JITArrayMode arrayMode)
</span><span class="cx"> {
</span><span class="cx"> JIT jit(vm, codeBlock);
</span><span class="lines">@@ -259,7 +246,6 @@
</span><span class="cx"> CompilationResult privateCompile(JITCompilationEffort);
</span><span class="cx">
</span><span class="cx"> void privateCompileGetByVal(ByValInfo*, ReturnAddressPtr, JITArrayMode);
</span><del>- void privateCompileGetByValWithCachedId(ByValInfo*, ReturnAddressPtr, const Identifier&);
</del><span class="cx"> void privateCompilePutByVal(ByValInfo*, ReturnAddressPtr, JITArrayMode);
</span><span class="cx">
</span><span class="cx"> void privateCompileHasIndexedProperty(ByValInfo*, ReturnAddressPtr, JITArrayMode);
</span><span class="lines">@@ -385,9 +371,7 @@
</span><span class="cx"> JumpList emitArrayStoragePutByVal(Instruction*, PatchableJump& badType);
</span><span class="cx"> JumpList emitIntTypedArrayPutByVal(Instruction*, PatchableJump& badType, TypedArrayType);
</span><span class="cx"> JumpList emitFloatTypedArrayPutByVal(Instruction*, PatchableJump& badType, TypedArrayType);
</span><del>-
- JITGetByIdGenerator emitGetByValWithCachedId(Instruction*, const Identifier&, JumpList& doneCases, JumpList& slowCases);
-
</del><ins>+
</ins><span class="cx"> enum FinalObjectMode { MayBeFinal, KnownNotFinal };
</span><span class="cx">
</span><span class="cx"> template <typename T> Jump branchStructure(RelationalCondition, T leftHandSide, Structure*);
</span><span class="lines">@@ -718,7 +702,6 @@
</span><span class="cx"> MacroAssembler::Call callOperation(J_JITOperation_EJIdc, int, GPRReg, const Identifier*);
</span><span class="cx"> MacroAssembler::Call callOperation(J_JITOperation_EJJ, int, GPRReg, GPRReg);
</span><span class="cx"> MacroAssembler::Call callOperation(J_JITOperation_EJJAp, int, GPRReg, GPRReg, ArrayProfile*);
</span><del>- MacroAssembler::Call callOperation(J_JITOperation_EJJBy, int, GPRReg, GPRReg, ByValInfo*);
</del><span class="cx"> MacroAssembler::Call callOperation(C_JITOperation_EJsc, GPRReg);
</span><span class="cx"> MacroAssembler::Call callOperation(J_JITOperation_EJscC, int, GPRReg, JSCell*);
</span><span class="cx"> MacroAssembler::Call callOperation(C_JITOperation_EJscZ, GPRReg, int32_t);
</span><span class="lines">@@ -763,7 +746,6 @@
</span><span class="cx"> #endif
</span><span class="cx"> MacroAssembler::Call callOperation(V_JITOperation_EJJJ, RegisterID, RegisterID, RegisterID);
</span><span class="cx"> MacroAssembler::Call callOperation(V_JITOperation_EJJJAp, RegisterID, RegisterID, RegisterID, ArrayProfile*);
</span><del>- MacroAssembler::Call callOperation(V_JITOperation_EJJJBy, RegisterID, RegisterID, RegisterID, ByValInfo*);
</del><span class="cx"> MacroAssembler::Call callOperation(V_JITOperation_EJZJ, RegisterID, int32_t, RegisterID);
</span><span class="cx"> MacroAssembler::Call callOperation(V_JITOperation_EJZ, RegisterID, int32_t);
</span><span class="cx"> MacroAssembler::Call callOperation(V_JITOperation_EPc, Instruction*);
</span><span class="lines">@@ -780,7 +762,6 @@
</span><span class="cx"> MacroAssembler::Call callOperation(J_JITOperation_EJIdc, int, GPRReg, GPRReg, const Identifier*);
</span><span class="cx"> MacroAssembler::Call callOperation(J_JITOperation_EJJ, int, GPRReg, GPRReg, GPRReg, GPRReg);
</span><span class="cx"> MacroAssembler::Call callOperation(J_JITOperation_EJJAp, int, GPRReg, GPRReg, GPRReg, GPRReg, ArrayProfile*);
</span><del>- MacroAssembler::Call callOperation(J_JITOperation_EJJBy, int, GPRReg, GPRReg, GPRReg, GPRReg, ByValInfo*);
</del><span class="cx"> MacroAssembler::Call callOperation(P_JITOperation_EJS, GPRReg, GPRReg, size_t);
</span><span class="cx"> MacroAssembler::Call callOperation(S_JITOperation_EJ, RegisterID, RegisterID);
</span><span class="cx"> MacroAssembler::Call callOperation(S_JITOperation_EJJ, RegisterID, RegisterID, RegisterID, RegisterID);
</span><span class="lines">@@ -788,7 +769,6 @@
</span><span class="cx"> MacroAssembler::Call callOperation(V_JITOperation_EJ, RegisterID, RegisterID);
</span><span class="cx"> MacroAssembler::Call callOperation(V_JITOperation_EJJJ, RegisterID, RegisterID, RegisterID, RegisterID, RegisterID, RegisterID);
</span><span class="cx"> MacroAssembler::Call callOperation(V_JITOperation_EJJJAp, RegisterID, RegisterID, RegisterID, RegisterID, RegisterID, RegisterID, ArrayProfile*);
</span><del>- MacroAssembler::Call callOperation(V_JITOperation_EJJJBy, RegisterID, RegisterID, RegisterID, RegisterID, RegisterID, RegisterID, ByValInfo*);
</del><span class="cx"> MacroAssembler::Call callOperation(V_JITOperation_EJZ, RegisterID, RegisterID, int32_t);
</span><span class="cx"> MacroAssembler::Call callOperation(V_JITOperation_EJZJ, RegisterID, RegisterID, int32_t, RegisterID, RegisterID);
</span><span class="cx"> MacroAssembler::Call callOperation(V_JITOperation_EZJ, int32_t, RegisterID, RegisterID);
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorejitJITInlinesh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/jit/JITInlines.h (188200 => 188201)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/jit/JITInlines.h 2015-08-09 22:39:33 UTC (rev 188200)
+++ trunk/Source/JavaScriptCore/jit/JITInlines.h 2015-08-09 22:55:54 UTC (rev 188201)
</span><span class="lines">@@ -411,12 +411,6 @@
</span><span class="cx"> return appendCallWithExceptionCheck(operation);
</span><span class="cx"> }
</span><span class="cx">
</span><del>-ALWAYS_INLINE MacroAssembler::Call JIT::callOperation(V_JITOperation_EJJJBy operation, RegisterID regOp1, RegisterID regOp2, RegisterID regOp3, ByValInfo* byValInfo)
-{
- setupArgumentsWithExecState(regOp1, regOp2, regOp3, TrustedImmPtr(byValInfo));
- return appendCallWithExceptionCheck(operation);
-}
-
</del><span class="cx"> ALWAYS_INLINE MacroAssembler::Call JIT::callOperation(V_JITOperation_EZJ operation, int dst, GPRReg arg)
</span><span class="cx"> {
</span><span class="cx"> setupArgumentsWithExecState(TrustedImm32(dst), arg);
</span><span class="lines">@@ -465,12 +459,6 @@
</span><span class="cx"> return appendCallWithExceptionCheckSetJSValueResult(operation, dst);
</span><span class="cx"> }
</span><span class="cx">
</span><del>-ALWAYS_INLINE MacroAssembler::Call JIT::callOperation(J_JITOperation_EJJBy operation, int dst, GPRReg arg1, GPRReg arg2, ByValInfo* byValInfo)
-{
- setupArgumentsWithExecState(arg1, arg2, TrustedImmPtr(byValInfo));
- return appendCallWithExceptionCheckSetJSValueResult(operation, dst);
-}
-
</del><span class="cx"> ALWAYS_INLINE MacroAssembler::Call JIT::callOperationNoExceptionCheck(V_JITOperation_EJ operation, GPRReg arg1)
</span><span class="cx"> {
</span><span class="cx"> setupArgumentsWithExecState(arg1);
</span><span class="lines">@@ -612,12 +600,6 @@
</span><span class="cx"> return appendCallWithExceptionCheckSetJSValueResult(operation, dst);
</span><span class="cx"> }
</span><span class="cx">
</span><del>-ALWAYS_INLINE MacroAssembler::Call JIT::callOperation(J_JITOperation_EJJBy operation, int dst, GPRReg arg1Tag, GPRReg arg1Payload, GPRReg arg2Tag, GPRReg arg2Payload, ByValInfo* byValInfo)
-{
- setupArgumentsWithExecState(EABI_32BIT_DUMMY_ARG arg1Payload, arg1Tag, SH4_32BIT_DUMMY_ARG arg2Payload, arg2Tag, TrustedImmPtr(byValInfo));
- return appendCallWithExceptionCheckSetJSValueResult(operation, dst);
-}
-
</del><span class="cx"> ALWAYS_INLINE MacroAssembler::Call JIT::callOperation(JIT::WithProfileTag, J_JITOperation_EJJ operation, int dst, GPRReg arg1Tag, GPRReg arg1Payload, GPRReg arg2Tag, GPRReg arg2Payload)
</span><span class="cx"> {
</span><span class="cx"> setupArgumentsWithExecState(EABI_32BIT_DUMMY_ARG arg1Payload, arg1Tag, SH4_32BIT_DUMMY_ARG arg2Payload, arg2Tag);
</span><span class="lines">@@ -684,12 +666,6 @@
</span><span class="cx"> return appendCallWithExceptionCheck(operation);
</span><span class="cx"> }
</span><span class="cx">
</span><del>-ALWAYS_INLINE MacroAssembler::Call JIT::callOperation(V_JITOperation_EJJJBy operation, RegisterID regOp1Tag, RegisterID regOp1Payload, RegisterID regOp2Tag, RegisterID regOp2Payload, RegisterID regOp3Tag, RegisterID regOp3Payload, ByValInfo* byValInfo)
-{
- setupArgumentsWithExecState(EABI_32BIT_DUMMY_ARG regOp1Payload, regOp1Tag, SH4_32BIT_DUMMY_ARG regOp2Payload, regOp2Tag, regOp3Payload, regOp3Tag, TrustedImmPtr(byValInfo));
- return appendCallWithExceptionCheck(operation);
-}
-
</del><span class="cx"> ALWAYS_INLINE MacroAssembler::Call JIT::callOperation(V_JITOperation_EZJ operation, int dst, RegisterID regOp1Tag, RegisterID regOp1Payload)
</span><span class="cx"> {
</span><span class="cx"> setupArgumentsWithExecState(TrustedImm32(dst), regOp1Payload, regOp1Tag);
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorejitJITOpcodescpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/jit/JITOpcodes.cpp (188200 => 188201)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/jit/JITOpcodes.cpp 2015-08-09 22:39:33 UTC (rev 188200)
+++ trunk/Source/JavaScriptCore/jit/JITOpcodes.cpp 2015-08-09 22:55:54 UTC (rev 188201)
</span><span class="lines">@@ -1067,7 +1067,6 @@
</span><span class="cx"> int base = currentInstruction[2].u.operand;
</span><span class="cx"> int property = currentInstruction[3].u.operand;
</span><span class="cx"> ArrayProfile* profile = currentInstruction[4].u.arrayProfile;
</span><del>- ByValInfo* byValInfo = m_codeBlock->addByValInfo();
</del><span class="cx">
</span><span class="cx"> emitGetVirtualRegisters(base, regT0, property, regT1);
</span><span class="cx">
</span><span class="lines">@@ -1099,7 +1098,7 @@
</span><span class="cx">
</span><span class="cx"> emitPutVirtualRegister(dst);
</span><span class="cx">
</span><del>- m_byValCompilationInfo.append(ByValCompilationInfo(byValInfo, m_bytecodeOffset, PatchableJump(), badType, mode, profile, done));
</del><ins>+ m_byValCompilationInfo.append(ByValCompilationInfo(m_bytecodeOffset, badType, mode, done));
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> void JIT::emitSlow_op_has_indexed_property(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
</span><span class="lines">@@ -1107,7 +1106,7 @@
</span><span class="cx"> int dst = currentInstruction[1].u.operand;
</span><span class="cx"> int base = currentInstruction[2].u.operand;
</span><span class="cx"> int property = currentInstruction[3].u.operand;
</span><del>- ByValInfo* byValInfo = m_byValCompilationInfo[m_byValInstructionIndex].byValInfo;
</del><ins>+ ArrayProfile* profile = currentInstruction[4].u.arrayProfile;
</ins><span class="cx">
</span><span class="cx"> linkSlowCaseIfNotJSCell(iter, base); // base cell check
</span><span class="cx"> linkSlowCase(iter); // base array check
</span><span class="lines">@@ -1118,7 +1117,7 @@
</span><span class="cx">
</span><span class="cx"> emitGetVirtualRegister(base, regT0);
</span><span class="cx"> emitGetVirtualRegister(property, regT1);
</span><del>- Call call = callOperation(operationHasIndexedPropertyDefault, dst, regT0, regT1, byValInfo);
</del><ins>+ Call call = callOperation(operationHasIndexedPropertyDefault, dst, regT0, regT1, profile);
</ins><span class="cx">
</span><span class="cx"> m_byValCompilationInfo[m_byValInstructionIndex].slowPathTarget = slowPath;
</span><span class="cx"> m_byValCompilationInfo[m_byValInstructionIndex].returnAddress = call;
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorejitJITOpcodes32_64cpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/jit/JITOpcodes32_64.cpp (188200 => 188201)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/jit/JITOpcodes32_64.cpp 2015-08-09 22:39:33 UTC (rev 188200)
+++ trunk/Source/JavaScriptCore/jit/JITOpcodes32_64.cpp 2015-08-09 22:55:54 UTC (rev 188201)
</span><span class="lines">@@ -1067,7 +1067,6 @@
</span><span class="cx"> int base = currentInstruction[2].u.operand;
</span><span class="cx"> int property = currentInstruction[3].u.operand;
</span><span class="cx"> ArrayProfile* profile = currentInstruction[4].u.arrayProfile;
</span><del>- ByValInfo* byValInfo = m_codeBlock->addByValInfo();
</del><span class="cx">
</span><span class="cx"> emitLoadPayload(base, regT0);
</span><span class="cx"> emitJumpSlowCaseIfNotJSCell(base);
</span><span class="lines">@@ -1100,7 +1099,7 @@
</span><span class="cx">
</span><span class="cx"> emitStoreBool(dst, regT0);
</span><span class="cx">
</span><del>- m_byValCompilationInfo.append(ByValCompilationInfo(byValInfo, m_bytecodeOffset, PatchableJump(), badType, mode, profile, done));
</del><ins>+ m_byValCompilationInfo.append(ByValCompilationInfo(m_bytecodeOffset, badType, mode, done));
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> void JIT::emitSlow_op_has_indexed_property(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
</span><span class="lines">@@ -1108,7 +1107,7 @@
</span><span class="cx"> int dst = currentInstruction[1].u.operand;
</span><span class="cx"> int base = currentInstruction[2].u.operand;
</span><span class="cx"> int property = currentInstruction[3].u.operand;
</span><del>- ByValInfo* byValInfo = m_byValCompilationInfo[m_byValInstructionIndex].byValInfo;
</del><ins>+ ArrayProfile* profile = currentInstruction[4].u.arrayProfile;
</ins><span class="cx">
</span><span class="cx"> linkSlowCaseIfNotJSCell(iter, base); // base cell check
</span><span class="cx"> linkSlowCase(iter); // base array check
</span><span class="lines">@@ -1119,7 +1118,7 @@
</span><span class="cx">
</span><span class="cx"> emitLoad(base, regT1, regT0);
</span><span class="cx"> emitLoad(property, regT3, regT2);
</span><del>- Call call = callOperation(operationHasIndexedPropertyDefault, dst, regT1, regT0, regT3, regT2, byValInfo);
</del><ins>+ Call call = callOperation(operationHasIndexedPropertyDefault, dst, regT1, regT0, regT3, regT2, profile);
</ins><span class="cx">
</span><span class="cx"> m_byValCompilationInfo[m_byValInstructionIndex].slowPathTarget = slowPath;
</span><span class="cx"> m_byValCompilationInfo[m_byValInstructionIndex].returnAddress = call;
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorejitJITOperationscpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/jit/JITOperations.cpp (188200 => 188201)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/jit/JITOperations.cpp 2015-08-09 22:39:33 UTC (rev 188200)
+++ trunk/Source/JavaScriptCore/jit/JITOperations.cpp 2015-08-09 22:55:54 UTC (rev 188201)
</span><span class="lines">@@ -478,7 +478,7 @@
</span><span class="cx"> base->putDirect(vm, offset, JSValue::decode(value));
</span><span class="cx"> }
</span><span class="cx">
</span><del>-static void putByVal(CallFrame* callFrame, JSValue baseValue, JSValue subscript, JSValue value, ByValInfo* byValInfo)
</del><ins>+static void putByVal(CallFrame* callFrame, JSValue baseValue, JSValue subscript, JSValue value, ArrayProfile* arrayProfile)
</ins><span class="cx"> {
</span><span class="cx"> VM& vm = callFrame->vm();
</span><span class="cx"> if (LIKELY(subscript.isUInt32())) {
</span><span class="lines">@@ -488,7 +488,7 @@
</span><span class="cx"> if (object->canSetIndexQuickly(i))
</span><span class="cx"> object->setIndexQuickly(callFrame->vm(), i, value);
</span><span class="cx"> else {
</span><del>- byValInfo->arrayProfile->setOutOfBounds();
</del><ins>+ arrayProfile->setOutOfBounds();
</ins><span class="cx"> object->methodTable(vm)->putByIndex(object, callFrame, i, value, callFrame->codeBlock()->isStrictMode());
</span><span class="cx"> }
</span><span class="cx"> } else
</span><span class="lines">@@ -502,7 +502,7 @@
</span><span class="cx"> }
</span><span class="cx"> }
</span><span class="cx">
</span><del>-static void directPutByVal(CallFrame* callFrame, JSObject* baseObject, JSValue subscript, JSValue value, ByValInfo* byValInfo)
</del><ins>+static void directPutByVal(CallFrame* callFrame, JSObject* baseObject, JSValue subscript, JSValue value, ArrayProfile* arrayProfile)
</ins><span class="cx"> {
</span><span class="cx"> bool isStrictMode = callFrame->codeBlock()->isStrictMode();
</span><span class="cx"> if (LIKELY(subscript.isUInt32())) {
</span><span class="lines">@@ -514,7 +514,7 @@
</span><span class="cx"> return;
</span><span class="cx"> }
</span><span class="cx">
</span><del>- byValInfo->arrayProfile->setOutOfBounds();
</del><ins>+ arrayProfile->setOutOfBounds();
</ins><span class="cx"> baseObject->putDirectIndex(callFrame, index, value, 0, isStrictMode ? PutDirectIndexShouldThrow : PutDirectIndexShouldNotThrow);
</span><span class="cx"> return;
</span><span class="cx"> }
</span><span class="lines">@@ -540,7 +540,7 @@
</span><span class="cx"> baseObject->putDirect(callFrame->vm(), property, value, slot);
</span><span class="cx"> }
</span><span class="cx"> }
</span><del>-void JIT_OPERATION operationPutByVal(ExecState* exec, EncodedJSValue encodedBaseValue, EncodedJSValue encodedSubscript, EncodedJSValue encodedValue, ByValInfo* byValInfo)
</del><ins>+void JIT_OPERATION operationPutByVal(ExecState* exec, EncodedJSValue encodedBaseValue, EncodedJSValue encodedSubscript, EncodedJSValue encodedValue, ArrayProfile* arrayProfile)
</ins><span class="cx"> {
</span><span class="cx"> VM& vm = exec->vm();
</span><span class="cx"> NativeCallFrameTracer tracer(&vm, exec);
</span><span class="lines">@@ -554,19 +554,21 @@
</span><span class="cx"> JSObject* object = asObject(baseValue);
</span><span class="cx"> bool didOptimize = false;
</span><span class="cx">
</span><del>- ASSERT(exec->locationAsBytecodeOffset());
- ASSERT(!byValInfo->stubRoutine);
</del><ins>+ unsigned bytecodeOffset = exec->locationAsBytecodeOffset();
+ ASSERT(bytecodeOffset);
+ ByValInfo& byValInfo = exec->codeBlock()->getByValInfo(bytecodeOffset - 1);
+ ASSERT(!byValInfo.stubRoutine);
</ins><span class="cx">
</span><span class="cx"> Structure* structure = object->structure(vm);
</span><span class="cx"> if (hasOptimizableIndexing(structure)) {
</span><span class="cx"> // Attempt to optimize.
</span><span class="cx"> JITArrayMode arrayMode = jitArrayModeForStructure(structure);
</span><del>- if (jitArrayModePermitsPut(arrayMode) && arrayMode != byValInfo->arrayMode) {
</del><ins>+ if (jitArrayModePermitsPut(arrayMode) && arrayMode != byValInfo.arrayMode) {
</ins><span class="cx"> CodeBlock* codeBlock = exec->codeBlock();
</span><span class="cx"> ConcurrentJITLocker locker(codeBlock->m_lock);
</span><del>- byValInfo->arrayProfile->computeUpdatedPrediction(locker, codeBlock, structure);
</del><ins>+ arrayProfile->computeUpdatedPrediction(locker, codeBlock, structure);
</ins><span class="cx">
</span><del>- JIT::compilePutByVal(&vm, exec->codeBlock(), byValInfo, ReturnAddressPtr(OUR_RETURN_ADDRESS), arrayMode);
</del><ins>+ JIT::compilePutByVal(&vm, exec->codeBlock(), &byValInfo, ReturnAddressPtr(OUR_RETURN_ADDRESS), arrayMode);
</ins><span class="cx"> didOptimize = true;
</span><span class="cx"> }
</span><span class="cx"> }
</span><span class="lines">@@ -577,7 +579,7 @@
</span><span class="cx"> // that intercepts indexed get, then don't even wait until 10 times. For cases
</span><span class="cx"> // where we see non-index-intercepting objects, this gives 10 iterations worth of
</span><span class="cx"> // opportunity for us to observe that the get_by_val may be polymorphic.
</span><del>- if (++byValInfo->slowPathCount >= 10
</del><ins>+ if (++byValInfo.slowPathCount >= 10
</ins><span class="cx"> || object->structure(vm)->typeInfo().interceptsGetOwnPropertySlotByIndexEvenWhenLengthIsNotZero()) {
</span><span class="cx"> // Don't ever try to optimize.
</span><span class="cx"> ctiPatchCallByReturnAddress(exec->codeBlock(), ReturnAddressPtr(OUR_RETURN_ADDRESS), FunctionPtr(operationPutByValGeneric));
</span><span class="lines">@@ -585,10 +587,10 @@
</span><span class="cx"> }
</span><span class="cx"> }
</span><span class="cx">
</span><del>- putByVal(exec, baseValue, subscript, value, byValInfo);
</del><ins>+ putByVal(exec, baseValue, subscript, value, arrayProfile);
</ins><span class="cx"> }
</span><span class="cx">
</span><del>-void JIT_OPERATION operationDirectPutByVal(ExecState* callFrame, EncodedJSValue encodedBaseValue, EncodedJSValue encodedSubscript, EncodedJSValue encodedValue, ByValInfo* byValInfo)
</del><ins>+void JIT_OPERATION operationDirectPutByVal(ExecState* callFrame, EncodedJSValue encodedBaseValue, EncodedJSValue encodedSubscript, EncodedJSValue encodedValue, ArrayProfile* arrayProfile)
</ins><span class="cx"> {
</span><span class="cx"> VM& vm = callFrame->vm();
</span><span class="cx"> NativeCallFrameTracer tracer(&vm, callFrame);
</span><span class="lines">@@ -601,20 +603,22 @@
</span><span class="cx"> if (subscript.isInt32()) {
</span><span class="cx"> // See if it's worth optimizing at all.
</span><span class="cx"> bool didOptimize = false;
</span><ins>+
+ unsigned bytecodeOffset = callFrame->locationAsBytecodeOffset();
+ ASSERT(bytecodeOffset);
+ ByValInfo& byValInfo = callFrame->codeBlock()->getByValInfo(bytecodeOffset - 1);
+ ASSERT(!byValInfo.stubRoutine);
</ins><span class="cx">
</span><del>- ASSERT(callFrame->locationAsBytecodeOffset());
- ASSERT(!byValInfo->stubRoutine);
-
</del><span class="cx"> Structure* structure = object->structure(vm);
</span><span class="cx"> if (hasOptimizableIndexing(structure)) {
</span><span class="cx"> // Attempt to optimize.
</span><span class="cx"> JITArrayMode arrayMode = jitArrayModeForStructure(structure);
</span><del>- if (jitArrayModePermitsPut(arrayMode) && arrayMode != byValInfo->arrayMode) {
</del><ins>+ if (jitArrayModePermitsPut(arrayMode) && arrayMode != byValInfo.arrayMode) {
</ins><span class="cx"> CodeBlock* codeBlock = callFrame->codeBlock();
</span><span class="cx"> ConcurrentJITLocker locker(codeBlock->m_lock);
</span><del>- byValInfo->arrayProfile->computeUpdatedPrediction(locker, codeBlock, structure);
</del><ins>+ arrayProfile->computeUpdatedPrediction(locker, codeBlock, structure);
</ins><span class="cx">
</span><del>- JIT::compileDirectPutByVal(&vm, callFrame->codeBlock(), byValInfo, ReturnAddressPtr(OUR_RETURN_ADDRESS), arrayMode);
</del><ins>+ JIT::compileDirectPutByVal(&vm, callFrame->codeBlock(), &byValInfo, ReturnAddressPtr(OUR_RETURN_ADDRESS), arrayMode);
</ins><span class="cx"> didOptimize = true;
</span><span class="cx"> }
</span><span class="cx"> }
</span><span class="lines">@@ -625,17 +629,17 @@
</span><span class="cx"> // that intercepts indexed get, then don't even wait until 10 times. For cases
</span><span class="cx"> // where we see non-index-intercepting objects, this gives 10 iterations worth of
</span><span class="cx"> // opportunity for us to observe that the get_by_val may be polymorphic.
</span><del>- if (++byValInfo->slowPathCount >= 10
</del><ins>+ if (++byValInfo.slowPathCount >= 10
</ins><span class="cx"> || object->structure(vm)->typeInfo().interceptsGetOwnPropertySlotByIndexEvenWhenLengthIsNotZero()) {
</span><span class="cx"> // Don't ever try to optimize.
</span><span class="cx"> ctiPatchCallByReturnAddress(callFrame->codeBlock(), ReturnAddressPtr(OUR_RETURN_ADDRESS), FunctionPtr(operationDirectPutByValGeneric));
</span><span class="cx"> }
</span><span class="cx"> }
</span><span class="cx"> }
</span><del>- directPutByVal(callFrame, object, subscript, value, byValInfo);
</del><ins>+ directPutByVal(callFrame, object, subscript, value, arrayProfile);
</ins><span class="cx"> }
</span><span class="cx">
</span><del>-void JIT_OPERATION operationPutByValGeneric(ExecState* exec, EncodedJSValue encodedBaseValue, EncodedJSValue encodedSubscript, EncodedJSValue encodedValue, ByValInfo* byValInfo)
</del><ins>+void JIT_OPERATION operationPutByValGeneric(ExecState* exec, EncodedJSValue encodedBaseValue, EncodedJSValue encodedSubscript, EncodedJSValue encodedValue, ArrayProfile* arrayProfile)
</ins><span class="cx"> {
</span><span class="cx"> VM& vm = exec->vm();
</span><span class="cx"> NativeCallFrameTracer tracer(&vm, exec);
</span><span class="lines">@@ -644,11 +648,11 @@
</span><span class="cx"> JSValue subscript = JSValue::decode(encodedSubscript);
</span><span class="cx"> JSValue value = JSValue::decode(encodedValue);
</span><span class="cx">
</span><del>- putByVal(exec, baseValue, subscript, value, byValInfo);
</del><ins>+ putByVal(exec, baseValue, subscript, value, arrayProfile);
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx">
</span><del>-void JIT_OPERATION operationDirectPutByValGeneric(ExecState* exec, EncodedJSValue encodedBaseValue, EncodedJSValue encodedSubscript, EncodedJSValue encodedValue, ByValInfo* byValInfo)
</del><ins>+void JIT_OPERATION operationDirectPutByValGeneric(ExecState* exec, EncodedJSValue encodedBaseValue, EncodedJSValue encodedSubscript, EncodedJSValue encodedValue, ArrayProfile* arrayProfile)
</ins><span class="cx"> {
</span><span class="cx"> VM& vm = exec->vm();
</span><span class="cx"> NativeCallFrameTracer tracer(&vm, exec);
</span><span class="lines">@@ -657,7 +661,7 @@
</span><span class="cx"> JSValue subscript = JSValue::decode(encodedSubscript);
</span><span class="cx"> JSValue value = JSValue::decode(encodedValue);
</span><span class="cx"> RELEASE_ASSERT(baseValue.isObject());
</span><del>- directPutByVal(exec, asObject(baseValue), subscript, value, byValInfo);
</del><ins>+ directPutByVal(exec, asObject(baseValue), subscript, value, arrayProfile);
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> EncodedJSValue JIT_OPERATION operationCallEval(ExecState* exec, ExecState* execCallee)
</span><span class="lines">@@ -1410,41 +1414,34 @@
</span><span class="cx"> return false;
</span><span class="cx"> }
</span><span class="cx">
</span><del>-static JSValue getByVal(ExecState* exec, JSValue baseValue, JSValue subscript, ByValInfo* byValInfo, ReturnAddressPtr returnAddress)
</del><ins>+static JSValue getByVal(ExecState* exec, JSValue baseValue, JSValue subscript, ArrayProfile* arrayProfile, ReturnAddressPtr returnAddress)
</ins><span class="cx"> {
</span><span class="cx"> if (LIKELY(baseValue.isCell() && subscript.isString())) {
</span><span class="cx"> VM& vm = exec->vm();
</span><span class="cx"> Structure& structure = *baseValue.asCell()->structure(vm);
</span><span class="cx"> if (JSCell::canUseFastGetOwnProperty(structure)) {
</span><span class="cx"> if (RefPtr<AtomicStringImpl> existingAtomicString = asString(subscript)->toExistingAtomicString(exec)) {
</span><del>- if (JSValue result = baseValue.asCell()->fastGetOwnProperty(vm, structure, existingAtomicString.get())) {
- ASSERT(exec->locationAsBytecodeOffset());
- if (byValInfo->stubInfo && byValInfo->cachedId.impl() != existingAtomicString)
- byValInfo->tookSlowPath = true;
</del><ins>+ if (JSValue result = baseValue.asCell()->fastGetOwnProperty(vm, structure, existingAtomicString.get()))
</ins><span class="cx"> return result;
</span><del>- }
</del><span class="cx"> }
</span><span class="cx"> }
</span><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> if (subscript.isUInt32()) {
</span><del>- ASSERT(exec->locationAsBytecodeOffset());
- byValInfo->tookSlowPath = true;
-
</del><span class="cx"> uint32_t i = subscript.asUInt32();
</span><span class="cx"> if (isJSString(baseValue)) {
</span><span class="cx"> if (asString(baseValue)->canGetIndex(i)) {
</span><span class="cx"> ctiPatchCallByReturnAddress(exec->codeBlock(), returnAddress, FunctionPtr(operationGetByValString));
</span><span class="cx"> return asString(baseValue)->getIndex(exec, i);
</span><span class="cx"> }
</span><del>- byValInfo->arrayProfile->setOutOfBounds();
</del><ins>+ arrayProfile->setOutOfBounds();
</ins><span class="cx"> } else if (baseValue.isObject()) {
</span><span class="cx"> JSObject* object = asObject(baseValue);
</span><span class="cx"> if (object->canGetIndexQuickly(i))
</span><span class="cx"> return object->getIndexQuickly(i);
</span><span class="cx">
</span><span class="cx"> if (!canAccessArgumentIndexQuickly(*object, i))
</span><del>- byValInfo->arrayProfile->setOutOfBounds();
</del><ins>+ arrayProfile->setOutOfBounds();
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> return baseValue.get(exec, i);
</span><span class="lines">@@ -1456,91 +1453,74 @@
</span><span class="cx"> auto property = subscript.toPropertyKey(exec);
</span><span class="cx"> if (exec->hadException())
</span><span class="cx"> return jsUndefined();
</span><del>-
- ASSERT(exec->locationAsBytecodeOffset());
- if (byValInfo->stubInfo && byValInfo->cachedId != property)
- byValInfo->tookSlowPath = true;
-
</del><span class="cx"> return baseValue.get(exec, property);
</span><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> extern "C" {
</span><span class="cx">
</span><del>-EncodedJSValue JIT_OPERATION operationGetByValGeneric(ExecState* exec, EncodedJSValue encodedBase, EncodedJSValue encodedSubscript, ByValInfo* byValInfo)
</del><ins>+EncodedJSValue JIT_OPERATION operationGetByValGeneric(ExecState* exec, EncodedJSValue encodedBase, EncodedJSValue encodedSubscript, ArrayProfile* arrayProfile)
</ins><span class="cx"> {
</span><span class="cx"> VM& vm = exec->vm();
</span><span class="cx"> NativeCallFrameTracer tracer(&vm, exec);
</span><span class="cx"> JSValue baseValue = JSValue::decode(encodedBase);
</span><span class="cx"> JSValue subscript = JSValue::decode(encodedSubscript);
</span><span class="cx">
</span><del>- JSValue result = getByVal(exec, baseValue, subscript, byValInfo, ReturnAddressPtr(OUR_RETURN_ADDRESS));
</del><ins>+ JSValue result = getByVal(exec, baseValue, subscript, arrayProfile, ReturnAddressPtr(OUR_RETURN_ADDRESS));
</ins><span class="cx"> return JSValue::encode(result);
</span><span class="cx"> }
</span><span class="cx">
</span><del>-EncodedJSValue JIT_OPERATION operationGetByValOptimize(ExecState* exec, EncodedJSValue encodedBase, EncodedJSValue encodedSubscript, ByValInfo* byValInfo)
</del><ins>+EncodedJSValue JIT_OPERATION operationGetByValOptimize(ExecState* exec, EncodedJSValue encodedBase, EncodedJSValue encodedSubscript, ArrayProfile* arrayProfile)
</ins><span class="cx"> {
</span><span class="cx"> VM& vm = exec->vm();
</span><span class="cx"> NativeCallFrameTracer tracer(&vm, exec);
</span><span class="cx"> JSValue baseValue = JSValue::decode(encodedBase);
</span><span class="cx"> JSValue subscript = JSValue::decode(encodedSubscript);
</span><del>-
</del><ins>+
</ins><span class="cx"> if (baseValue.isObject() && subscript.isInt32()) {
</span><span class="cx"> // See if it's worth optimizing this at all.
</span><span class="cx"> JSObject* object = asObject(baseValue);
</span><span class="cx"> bool didOptimize = false;
</span><span class="cx">
</span><del>- ASSERT(exec->locationAsBytecodeOffset());
- ASSERT(!byValInfo->stubRoutine);
-
</del><ins>+ unsigned bytecodeOffset = exec->locationAsBytecodeOffset();
+ ASSERT(bytecodeOffset);
+ ByValInfo& byValInfo = exec->codeBlock()->getByValInfo(bytecodeOffset - 1);
+ ASSERT(!byValInfo.stubRoutine);
+
</ins><span class="cx"> if (hasOptimizableIndexing(object->structure(vm))) {
</span><span class="cx"> // Attempt to optimize.
</span><span class="cx"> Structure* structure = object->structure(vm);
</span><span class="cx"> JITArrayMode arrayMode = jitArrayModeForStructure(structure);
</span><del>- if (arrayMode != byValInfo->arrayMode) {
</del><ins>+ if (arrayMode != byValInfo.arrayMode) {
</ins><span class="cx"> // If we reached this case, we got an interesting array mode we did not expect when we compiled.
</span><span class="cx"> // Let's update the profile to do better next time.
</span><span class="cx"> CodeBlock* codeBlock = exec->codeBlock();
</span><span class="cx"> ConcurrentJITLocker locker(codeBlock->m_lock);
</span><del>- byValInfo->arrayProfile->computeUpdatedPrediction(locker, codeBlock, structure);
</del><ins>+ arrayProfile->computeUpdatedPrediction(locker, codeBlock, structure);
</ins><span class="cx">
</span><del>- JIT::compileGetByVal(&vm, exec->codeBlock(), byValInfo, ReturnAddressPtr(OUR_RETURN_ADDRESS), arrayMode);
</del><ins>+ JIT::compileGetByVal(&vm, exec->codeBlock(), &byValInfo, ReturnAddressPtr(OUR_RETURN_ADDRESS), arrayMode);
</ins><span class="cx"> didOptimize = true;
</span><span class="cx"> }
</span><span class="cx"> }
</span><del>-
</del><ins>+
</ins><span class="cx"> if (!didOptimize) {
</span><span class="cx"> // If we take slow path more than 10 times without patching then make sure we
</span><span class="cx"> // never make that mistake again. Or, if we failed to patch and we have some object
</span><span class="cx"> // that intercepts indexed get, then don't even wait until 10 times. For cases
</span><span class="cx"> // where we see non-index-intercepting objects, this gives 10 iterations worth of
</span><span class="cx"> // opportunity for us to observe that the get_by_val may be polymorphic.
</span><del>- if (++byValInfo->slowPathCount >= 10
</del><ins>+ if (++byValInfo.slowPathCount >= 10
</ins><span class="cx"> || object->structure(vm)->typeInfo().interceptsGetOwnPropertySlotByIndexEvenWhenLengthIsNotZero()) {
</span><span class="cx"> // Don't ever try to optimize.
</span><span class="cx"> ctiPatchCallByReturnAddress(exec->codeBlock(), ReturnAddressPtr(OUR_RETURN_ADDRESS), FunctionPtr(operationGetByValGeneric));
</span><span class="cx"> }
</span><span class="cx"> }
</span><span class="cx"> }
</span><del>-
- if (baseValue.isObject() && (subscript.isSymbol() || subscript.isString())) {
- const Identifier propertyName = subscript.toPropertyKey(exec);
-
- if (!subscript.isString() || !parseIndex(propertyName)) {
- ASSERT(exec->locationAsBytecodeOffset());
- ASSERT(!byValInfo->stubRoutine);
- JIT::compileGetByValWithCachedId(&vm, exec->codeBlock(), byValInfo, ReturnAddressPtr(OUR_RETURN_ADDRESS), propertyName);
- }
-
- PropertySlot slot(baseValue);
- bool hasResult = baseValue.getPropertySlot(exec, propertyName, slot);
- return JSValue::encode(hasResult ? slot.getValue(exec, propertyName) : jsUndefined());
- }
-
- JSValue result = getByVal(exec, baseValue, subscript, byValInfo, ReturnAddressPtr(OUR_RETURN_ADDRESS));
</del><ins>+
+ JSValue result = getByVal(exec, baseValue, subscript, arrayProfile, ReturnAddressPtr(OUR_RETURN_ADDRESS));
</ins><span class="cx"> return JSValue::encode(result);
</span><span class="cx"> }
</span><del>-
-EncodedJSValue JIT_OPERATION operationHasIndexedPropertyDefault(ExecState* exec, EncodedJSValue encodedBase, EncodedJSValue encodedSubscript, ByValInfo* byValInfo)
</del><ins>+
+EncodedJSValue JIT_OPERATION operationHasIndexedPropertyDefault(ExecState* exec, EncodedJSValue encodedBase, EncodedJSValue encodedSubscript, ArrayProfile* arrayProfile)
</ins><span class="cx"> {
</span><span class="cx"> VM& vm = exec->vm();
</span><span class="cx"> NativeCallFrameTracer tracer(&vm, exec);
</span><span class="lines">@@ -1553,14 +1533,16 @@
</span><span class="cx"> JSObject* object = asObject(baseValue);
</span><span class="cx"> bool didOptimize = false;
</span><span class="cx">
</span><del>- ASSERT(exec->locationAsBytecodeOffset());
- ASSERT(!byValInfo->stubRoutine);
</del><ins>+ unsigned bytecodeOffset = exec->locationAsBytecodeOffset();
+ ASSERT(bytecodeOffset);
+ ByValInfo& byValInfo = exec->codeBlock()->getByValInfo(bytecodeOffset - 1);
+ ASSERT(!byValInfo.stubRoutine);
</ins><span class="cx">
</span><span class="cx"> if (hasOptimizableIndexing(object->structure(vm))) {
</span><span class="cx"> // Attempt to optimize.
</span><span class="cx"> JITArrayMode arrayMode = jitArrayModeForStructure(object->structure(vm));
</span><del>- if (arrayMode != byValInfo->arrayMode) {
- JIT::compileHasIndexedProperty(&vm, exec->codeBlock(), byValInfo, ReturnAddressPtr(OUR_RETURN_ADDRESS), arrayMode);
</del><ins>+ if (arrayMode != byValInfo.arrayMode) {
+ JIT::compileHasIndexedProperty(&vm, exec->codeBlock(), &byValInfo, ReturnAddressPtr(OUR_RETURN_ADDRESS), arrayMode);
</ins><span class="cx"> didOptimize = true;
</span><span class="cx"> }
</span><span class="cx"> }
</span><span class="lines">@@ -1571,10 +1553,10 @@
</span><span class="cx"> // that intercepts indexed get, then don't even wait until 10 times. For cases
</span><span class="cx"> // where we see non-index-intercepting objects, this gives 10 iterations worth of
</span><span class="cx"> // opportunity for us to observe that the get_by_val may be polymorphic.
</span><del>- if (++byValInfo->slowPathCount >= 10
</del><ins>+ if (++byValInfo.slowPathCount >= 10
</ins><span class="cx"> || object->structure(vm)->typeInfo().interceptsGetOwnPropertySlotByIndexEvenWhenLengthIsNotZero()) {
</span><span class="cx"> // Don't ever try to optimize.
</span><del>- ctiPatchCallByReturnAddress(exec->codeBlock(), ReturnAddressPtr(OUR_RETURN_ADDRESS), FunctionPtr(operationHasIndexedPropertyGeneric));
</del><ins>+ ctiPatchCallByReturnAddress(exec->codeBlock(), ReturnAddressPtr(OUR_RETURN_ADDRESS), FunctionPtr(operationHasIndexedPropertyGeneric));
</ins><span class="cx"> }
</span><span class="cx"> }
</span><span class="cx">
</span><span class="lines">@@ -1583,11 +1565,11 @@
</span><span class="cx"> return JSValue::encode(JSValue(JSValue::JSTrue));
</span><span class="cx">
</span><span class="cx"> if (!canAccessArgumentIndexQuickly(*object, index))
</span><del>- byValInfo->arrayProfile->setOutOfBounds();
</del><ins>+ arrayProfile->setOutOfBounds();
</ins><span class="cx"> return JSValue::encode(jsBoolean(object->hasProperty(exec, index)));
</span><span class="cx"> }
</span><span class="cx">
</span><del>-EncodedJSValue JIT_OPERATION operationHasIndexedPropertyGeneric(ExecState* exec, EncodedJSValue encodedBase, EncodedJSValue encodedSubscript, ByValInfo* byValInfo)
</del><ins>+EncodedJSValue JIT_OPERATION operationHasIndexedPropertyGeneric(ExecState* exec, EncodedJSValue encodedBase, EncodedJSValue encodedSubscript, ArrayProfile* arrayProfile)
</ins><span class="cx"> {
</span><span class="cx"> VM& vm = exec->vm();
</span><span class="cx"> NativeCallFrameTracer tracer(&vm, exec);
</span><span class="lines">@@ -1603,11 +1585,11 @@
</span><span class="cx"> return JSValue::encode(JSValue(JSValue::JSTrue));
</span><span class="cx">
</span><span class="cx"> if (!canAccessArgumentIndexQuickly(*object, index))
</span><del>- byValInfo->arrayProfile->setOutOfBounds();
</del><ins>+ arrayProfile->setOutOfBounds();
</ins><span class="cx"> return JSValue::encode(jsBoolean(object->hasProperty(exec, subscript.asUInt32())));
</span><span class="cx"> }
</span><span class="cx">
</span><del>-EncodedJSValue JIT_OPERATION operationGetByValString(ExecState* exec, EncodedJSValue encodedBase, EncodedJSValue encodedSubscript, ByValInfo* byValInfo)
</del><ins>+EncodedJSValue JIT_OPERATION operationGetByValString(ExecState* exec, EncodedJSValue encodedBase, EncodedJSValue encodedSubscript)
</ins><span class="cx"> {
</span><span class="cx"> VM& vm = exec->vm();
</span><span class="cx"> NativeCallFrameTracer tracer(&vm, exec);
</span><span class="lines">@@ -1622,8 +1604,10 @@
</span><span class="cx"> else {
</span><span class="cx"> result = baseValue.get(exec, i);
</span><span class="cx"> if (!isJSString(baseValue)) {
</span><del>- ASSERT(exec->locationAsBytecodeOffset());
- ctiPatchCallByReturnAddress(exec->codeBlock(), ReturnAddressPtr(OUR_RETURN_ADDRESS), FunctionPtr(byValInfo->stubRoutine ? operationGetByValGeneric : operationGetByValOptimize));
</del><ins>+ unsigned bytecodeOffset = exec->locationAsBytecodeOffset();
+ ASSERT(bytecodeOffset);
+ ByValInfo& byValInfo = exec->codeBlock()->getByValInfo(bytecodeOffset - 1);
+ ctiPatchCallByReturnAddress(exec->codeBlock(), ReturnAddressPtr(OUR_RETURN_ADDRESS), FunctionPtr(byValInfo.stubRoutine ? operationGetByValGeneric : operationGetByValOptimize));
</ins><span class="cx"> }
</span><span class="cx"> }
</span><span class="cx"> } else {
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorejitJITOperationsh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/jit/JITOperations.h (188200 => 188201)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/jit/JITOperations.h 2015-08-09 22:39:33 UTC (rev 188200)
+++ trunk/Source/JavaScriptCore/jit/JITOperations.h 2015-08-09 22:55:54 UTC (rev 188201)
</span><span class="lines">@@ -58,7 +58,6 @@
</span><span class="cx"> A: JSArray*
</span><span class="cx"> Aap: ArrayAllocationProfile*
</span><span class="cx"> Ap: ArrayProfile*
</span><del>- By: ByValInfo*
</del><span class="cx"> C: JSCell*
</span><span class="cx"> Cb: CodeBlock*
</span><span class="cx"> Cli: CallLinkInfo*
</span><span class="lines">@@ -114,7 +113,6 @@
</span><span class="cx"> typedef EncodedJSValue JIT_OPERATION (*J_JITOperation_EJIdc)(ExecState*, EncodedJSValue, const Identifier*);
</span><span class="cx"> typedef EncodedJSValue JIT_OPERATION (*J_JITOperation_EJJ)(ExecState*, EncodedJSValue, EncodedJSValue);
</span><span class="cx"> typedef EncodedJSValue JIT_OPERATION (*J_JITOperation_EJJAp)(ExecState*, EncodedJSValue, EncodedJSValue, ArrayProfile*);
</span><del>-typedef EncodedJSValue JIT_OPERATION (*J_JITOperation_EJJBy)(ExecState*, EncodedJSValue, EncodedJSValue, ByValInfo*);
</del><span class="cx"> typedef EncodedJSValue JIT_OPERATION (*J_JITOperation_EJssZ)(ExecState*, JSString*, int32_t);
</span><span class="cx"> typedef EncodedJSValue JIT_OPERATION (*J_JITOperation_EJP)(ExecState*, EncodedJSValue, void*);
</span><span class="cx"> typedef EncodedJSValue JIT_OPERATION (*J_JITOperation_EP)(ExecState*, void*);
</span><span class="lines">@@ -197,7 +195,6 @@
</span><span class="cx"> typedef void JIT_OPERATION (*V_JITOperation_EJIdJJ)(ExecState*, EncodedJSValue, Identifier*, EncodedJSValue, EncodedJSValue);
</span><span class="cx"> typedef void JIT_OPERATION (*V_JITOperation_EJJJ)(ExecState*, EncodedJSValue, EncodedJSValue, EncodedJSValue);
</span><span class="cx"> typedef void JIT_OPERATION (*V_JITOperation_EJJJAp)(ExecState*, EncodedJSValue, EncodedJSValue, EncodedJSValue, ArrayProfile*);
</span><del>-typedef void JIT_OPERATION (*V_JITOperation_EJJJBy)(ExecState*, EncodedJSValue, EncodedJSValue, EncodedJSValue, ByValInfo*);
</del><span class="cx"> typedef void JIT_OPERATION (*V_JITOperation_EJPP)(ExecState*, EncodedJSValue, void*, void*);
</span><span class="cx"> typedef void JIT_OPERATION (*V_JITOperation_EJZJ)(ExecState*, EncodedJSValue, int32_t, EncodedJSValue);
</span><span class="cx"> typedef void JIT_OPERATION (*V_JITOperation_EJZ)(ExecState*, EncodedJSValue, int32_t);
</span><span class="lines">@@ -262,10 +259,10 @@
</span><span class="cx"> void JIT_OPERATION operationPutByIdDirectStrictBuildList(ExecState*, StructureStubInfo*, EncodedJSValue encodedValue, EncodedJSValue encodedBase, UniquedStringImpl*) WTF_INTERNAL;
</span><span class="cx"> void JIT_OPERATION operationPutByIdDirectNonStrictBuildList(ExecState*, StructureStubInfo*, EncodedJSValue encodedValue, EncodedJSValue encodedBase, UniquedStringImpl*) WTF_INTERNAL;
</span><span class="cx"> void JIT_OPERATION operationReallocateStorageAndFinishPut(ExecState*, JSObject*, Structure*, PropertyOffset, EncodedJSValue) WTF_INTERNAL;
</span><del>-void JIT_OPERATION operationPutByVal(ExecState*, EncodedJSValue, EncodedJSValue, EncodedJSValue, ByValInfo*) WTF_INTERNAL;
-void JIT_OPERATION operationDirectPutByVal(ExecState*, EncodedJSValue, EncodedJSValue, EncodedJSValue, ByValInfo*) WTF_INTERNAL;
-void JIT_OPERATION operationPutByValGeneric(ExecState*, EncodedJSValue, EncodedJSValue, EncodedJSValue, ByValInfo*) WTF_INTERNAL;
-void JIT_OPERATION operationDirectPutByValGeneric(ExecState*, EncodedJSValue, EncodedJSValue, EncodedJSValue, ByValInfo*) WTF_INTERNAL;
</del><ins>+void JIT_OPERATION operationPutByVal(ExecState*, EncodedJSValue, EncodedJSValue, EncodedJSValue, ArrayProfile*) WTF_INTERNAL;
+void JIT_OPERATION operationDirectPutByVal(ExecState*, EncodedJSValue, EncodedJSValue, EncodedJSValue, ArrayProfile*) WTF_INTERNAL;
+void JIT_OPERATION operationPutByValGeneric(ExecState*, EncodedJSValue, EncodedJSValue, EncodedJSValue, ArrayProfile*) WTF_INTERNAL;
+void JIT_OPERATION operationDirectPutByValGeneric(ExecState*, EncodedJSValue, EncodedJSValue, EncodedJSValue, ArrayProfile*) WTF_INTERNAL;
</ins><span class="cx"> EncodedJSValue JIT_OPERATION operationCallEval(ExecState*, ExecState*) WTF_INTERNAL;
</span><span class="cx"> char* JIT_OPERATION operationLinkCall(ExecState*, CallLinkInfo*) WTF_INTERNAL;
</span><span class="cx"> char* JIT_OPERATION operationLinkPolymorphicCall(ExecState*, CallLinkInfo*) WTF_INTERNAL;
</span><span class="lines">@@ -312,11 +309,11 @@
</span><span class="cx"> void JIT_OPERATION operationProfileDidCall(ExecState*, EncodedJSValue) WTF_INTERNAL;
</span><span class="cx"> void JIT_OPERATION operationProfileWillCall(ExecState*, EncodedJSValue) WTF_INTERNAL;
</span><span class="cx"> EncodedJSValue JIT_OPERATION operationCheckHasInstance(ExecState*, EncodedJSValue, EncodedJSValue baseVal) WTF_INTERNAL;
</span><del>-EncodedJSValue JIT_OPERATION operationGetByValOptimize(ExecState*, EncodedJSValue encodedBase, EncodedJSValue encodedSubscript, ByValInfo*) WTF_INTERNAL;
-EncodedJSValue JIT_OPERATION operationGetByValGeneric(ExecState*, EncodedJSValue encodedBase, EncodedJSValue encodedSubscript, ByValInfo*) WTF_INTERNAL;
-EncodedJSValue JIT_OPERATION operationGetByValString(ExecState*, EncodedJSValue encodedBase, EncodedJSValue encodedSubscript, ByValInfo*) WTF_INTERNAL;
-EncodedJSValue JIT_OPERATION operationHasIndexedPropertyDefault(ExecState*, EncodedJSValue encodedBase, EncodedJSValue encodedSubscript, ByValInfo*) WTF_INTERNAL;
-EncodedJSValue JIT_OPERATION operationHasIndexedPropertyGeneric(ExecState*, EncodedJSValue encodedBase, EncodedJSValue encodedSubscript, ByValInfo*) WTF_INTERNAL;
</del><ins>+EncodedJSValue JIT_OPERATION operationGetByValOptimize(ExecState*, EncodedJSValue encodedBase, EncodedJSValue encodedSubscript, ArrayProfile*) WTF_INTERNAL;
+EncodedJSValue JIT_OPERATION operationGetByValGeneric(ExecState*, EncodedJSValue encodedBase, EncodedJSValue encodedSubscript, ArrayProfile*) WTF_INTERNAL;
+EncodedJSValue JIT_OPERATION operationGetByValString(ExecState*, EncodedJSValue encodedBase, EncodedJSValue encodedSubscript) WTF_INTERNAL;
+EncodedJSValue JIT_OPERATION operationHasIndexedPropertyDefault(ExecState*, EncodedJSValue encodedBase, EncodedJSValue encodedSubscript, ArrayProfile*) WTF_INTERNAL;
+EncodedJSValue JIT_OPERATION operationHasIndexedPropertyGeneric(ExecState*, EncodedJSValue encodedBase, EncodedJSValue encodedSubscript, ArrayProfile*) WTF_INTERNAL;
</ins><span class="cx"> EncodedJSValue JIT_OPERATION operationDeleteById(ExecState*, EncodedJSValue base, const Identifier*) WTF_INTERNAL;
</span><span class="cx"> JSCell* JIT_OPERATION operationGetPNames(ExecState*, JSObject*) WTF_INTERNAL;
</span><span class="cx"> EncodedJSValue JIT_OPERATION operationInstanceOf(ExecState*, EncodedJSValue, EncodedJSValue proto) WTF_INTERNAL;
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorejitJITPropertyAccesscpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/jit/JITPropertyAccess.cpp (188200 => 188201)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/jit/JITPropertyAccess.cpp 2015-08-09 22:39:33 UTC (rev 188200)
+++ trunk/Source/JavaScriptCore/jit/JITPropertyAccess.cpp 2015-08-09 22:55:54 UTC (rev 188201)
</span><span class="lines">@@ -98,15 +98,10 @@
</span><span class="cx"> int base = currentInstruction[2].u.operand;
</span><span class="cx"> int property = currentInstruction[3].u.operand;
</span><span class="cx"> ArrayProfile* profile = currentInstruction[4].u.arrayProfile;
</span><del>- ByValInfo* byValInfo = m_codeBlock->addByValInfo();
-
</del><ins>+
</ins><span class="cx"> emitGetVirtualRegisters(base, regT0, property, regT1);
</span><ins>+ emitJumpSlowCaseIfNotImmediateInteger(regT1);
</ins><span class="cx">
</span><del>- emitJumpSlowCaseIfNotJSCell(regT0, base);
-
- PatchableJump notIndex = emitPatchableJumpIfNotImmediateInteger(regT1);
- addSlowCase(notIndex);
-
</del><span class="cx"> // This is technically incorrect - we're zero-extending an int32. On the hot path this doesn't matter.
</span><span class="cx"> // We check the value as if it was a uint32 against the m_vectorLength - which will always fail if
</span><span class="cx"> // number was signed since m_vectorLength is always less than intmax (since the total allocation
</span><span class="lines">@@ -115,6 +110,7 @@
</span><span class="cx"> // extending since it makes it easier to re-tag the value in the slow case.
</span><span class="cx"> zeroExtend32ToPtr(regT1, regT1);
</span><span class="cx">
</span><ins>+ emitJumpSlowCaseIfNotJSCell(regT0, base);
</ins><span class="cx"> emitArrayProfilingSiteWithCell(regT0, regT2, profile);
</span><span class="cx"> and32(TrustedImm32(IndexingShapeMask), regT2);
</span><span class="cx">
</span><span class="lines">@@ -153,8 +149,8 @@
</span><span class="cx">
</span><span class="cx"> emitValueProfilingSite();
</span><span class="cx"> emitPutVirtualRegister(dst);
</span><del>-
- m_byValCompilationInfo.append(ByValCompilationInfo(byValInfo, m_bytecodeOffset, notIndex, badType, mode, profile, done));
</del><ins>+
+ m_byValCompilationInfo.append(ByValCompilationInfo(m_bytecodeOffset, badType, mode, done));
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> JIT::JumpList JIT::emitDoubleLoad(Instruction*, PatchableJump& badType)
</span><span class="lines">@@ -199,52 +195,15 @@
</span><span class="cx"> return slowCases;
</span><span class="cx"> }
</span><span class="cx">
</span><del>-JITGetByIdGenerator JIT::emitGetByValWithCachedId(Instruction* currentInstruction, const Identifier& propertyName, JumpList& doneCases, JumpList& slowCases)
-{
- // base: regT0
- // property: regT1
- // scratch: regT3
-
- int dst = currentInstruction[1].u.operand;
-
- slowCases.append(emitJumpIfNotJSCell(regT1));
- if (propertyName.isSymbol()) {
- slowCases.append(branchStructure(NotEqual, Address(regT1, JSCell::structureIDOffset()), m_vm->symbolStructure.get()));
- loadPtr(Address(regT1, Symbol::offsetOfPrivateName()), regT3);
- } else {
- slowCases.append(branchStructure(NotEqual, Address(regT1, JSCell::structureIDOffset()), m_vm->stringStructure.get()));
- loadPtr(Address(regT1, JSString::offsetOfValue()), regT3);
- slowCases.append(branchTestPtr(Zero, regT3));
- slowCases.append(branchTest32(Zero, Address(regT3, StringImpl::flagsOffset()), TrustedImm32(StringImpl::flagIsAtomic())));
- }
- slowCases.append(branchPtr(NotEqual, regT3, TrustedImmPtr(propertyName.impl())));
-
- JITGetByIdGenerator gen(
- m_codeBlock, CodeOrigin(m_bytecodeOffset), RegisterSet::specialRegisters(),
- JSValueRegs(regT0), JSValueRegs(regT0), DontSpill);
- gen.generateFastPath(*this);
-
- doneCases.append(jump());
-
- Label coldPathBegin = label();
- gen.slowPathJump().link(this);
-
- Call call = callOperation(WithProfile, operationGetByIdOptimize, dst, gen.stubInfo(), regT0, propertyName.impl());
- gen.reportSlowPathCall(coldPathBegin, call);
- doneCases.append(jump());
-
- return gen;
-}
-
</del><span class="cx"> void JIT::emitSlow_op_get_by_val(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
</span><span class="cx"> {
</span><span class="cx"> int dst = currentInstruction[1].u.operand;
</span><span class="cx"> int base = currentInstruction[2].u.operand;
</span><span class="cx"> int property = currentInstruction[3].u.operand;
</span><del>- ByValInfo* byValInfo = m_byValCompilationInfo[m_byValInstructionIndex].byValInfo;
</del><ins>+ ArrayProfile* profile = currentInstruction[4].u.arrayProfile;
</ins><span class="cx">
</span><del>- linkSlowCaseIfNotJSCell(iter, base); // base cell check
</del><span class="cx"> linkSlowCase(iter); // property int32 check
</span><ins>+ linkSlowCaseIfNotJSCell(iter, base); // base cell check
</ins><span class="cx"> Jump nonCell = jump();
</span><span class="cx"> linkSlowCase(iter); // base array check
</span><span class="cx"> Jump notString = branchStructure(NotEqual,
</span><span class="lines">@@ -265,7 +224,7 @@
</span><span class="cx">
</span><span class="cx"> emitGetVirtualRegister(base, regT0);
</span><span class="cx"> emitGetVirtualRegister(property, regT1);
</span><del>- Call call = callOperation(operationGetByValOptimize, dst, regT0, regT1, byValInfo);
</del><ins>+ Call call = callOperation(operationGetByValOptimize, dst, regT0, regT1, profile);
</ins><span class="cx">
</span><span class="cx"> m_byValCompilationInfo[m_byValInstructionIndex].slowPathTarget = slowPath;
</span><span class="cx"> m_byValCompilationInfo[m_byValInstructionIndex].returnAddress = call;
</span><span class="lines">@@ -304,7 +263,6 @@
</span><span class="cx"> int base = currentInstruction[1].u.operand;
</span><span class="cx"> int property = currentInstruction[2].u.operand;
</span><span class="cx"> ArrayProfile* profile = currentInstruction[4].u.arrayProfile;
</span><del>- ByValInfo* byValInfo = m_codeBlock->addByValInfo();
</del><span class="cx">
</span><span class="cx"> emitGetVirtualRegisters(base, regT0, property, regT1);
</span><span class="cx"> emitJumpSlowCaseIfNotImmediateInteger(regT1);
</span><span class="lines">@@ -341,7 +299,8 @@
</span><span class="cx">
</span><span class="cx"> Label done = label();
</span><span class="cx">
</span><del>- m_byValCompilationInfo.append(ByValCompilationInfo(byValInfo, m_bytecodeOffset, PatchableJump(), badType, mode, profile, done));
</del><ins>+ m_byValCompilationInfo.append(ByValCompilationInfo(m_bytecodeOffset, badType, mode, done));
+
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> JIT::JumpList JIT::emitGenericContiguousPutByVal(Instruction* currentInstruction, PatchableJump& badType, IndexingType indexingShape)
</span><span class="lines">@@ -440,7 +399,6 @@
</span><span class="cx"> int property = currentInstruction[2].u.operand;
</span><span class="cx"> int value = currentInstruction[3].u.operand;
</span><span class="cx"> ArrayProfile* profile = currentInstruction[4].u.arrayProfile;
</span><del>- ByValInfo* byValInfo = m_byValCompilationInfo[m_byValInstructionIndex].byValInfo;
</del><span class="cx">
</span><span class="cx"> linkSlowCase(iter); // property int32 check
</span><span class="cx"> linkSlowCaseIfNotJSCell(iter, base); // base cell check
</span><span class="lines">@@ -466,7 +424,7 @@
</span><span class="cx"> emitGetVirtualRegister(property, regT1);
</span><span class="cx"> emitGetVirtualRegister(value, regT2);
</span><span class="cx"> bool isDirect = m_interpreter->getOpcodeID(currentInstruction->u.opcode) == op_put_by_val_direct;
</span><del>- Call call = callOperation(isDirect ? operationDirectPutByVal : operationPutByVal, regT0, regT1, regT2, byValInfo);
</del><ins>+ Call call = callOperation(isDirect ? operationDirectPutByVal : operationPutByVal, regT0, regT1, regT2, profile);
</ins><span class="cx">
</span><span class="cx"> m_byValCompilationInfo[m_byValInstructionIndex].slowPathTarget = slowPath;
</span><span class="cx"> m_byValCompilationInfo[m_byValInstructionIndex].returnAddress = call;
</span><span class="lines">@@ -1041,36 +999,6 @@
</span><span class="cx"> repatchBuffer.relinkCallerToFunction(returnAddress, FunctionPtr(operationGetByValGeneric));
</span><span class="cx"> }
</span><span class="cx">
</span><del>-void JIT::privateCompileGetByValWithCachedId(ByValInfo* byValInfo, ReturnAddressPtr returnAddress, const Identifier& propertyName)
-{
- Instruction* currentInstruction = m_codeBlock->instructions().begin() + byValInfo->bytecodeIndex;
-
- JumpList doneCases;
- JumpList slowCases;
-
- JITGetByIdGenerator gen = emitGetByValWithCachedId(currentInstruction, propertyName, doneCases, slowCases);
-
- ConcurrentJITLocker locker(m_codeBlock->m_lock);
- LinkBuffer patchBuffer(*m_vm, *this, m_codeBlock);
- patchBuffer.link(slowCases, CodeLocationLabel(MacroAssemblerCodePtr::createFromExecutableAddress(returnAddress.value())).labelAtOffset(byValInfo->returnAddressToSlowPath));
- patchBuffer.link(doneCases, byValInfo->badTypeJump.labelAtOffset(byValInfo->badTypeJumpToDone));
- for (const auto& callSite : m_calls) {
- if (callSite.to)
- patchBuffer.link(callSite.from, FunctionPtr(callSite.to));
- }
- gen.finalize(patchBuffer);
-
- byValInfo->stubRoutine = FINALIZE_CODE_FOR_STUB(
- m_codeBlock, patchBuffer,
- ("Baseline get_by_val with cached property name '%s' stub for %s, return point %p", propertyName.impl()->utf8().data(), toCString(*m_codeBlock).data(), returnAddress.value()));
- byValInfo->cachedId = propertyName;
- byValInfo->stubInfo = gen.stubInfo();
-
- RepatchBuffer repatchBuffer(m_codeBlock);
- repatchBuffer.relink(byValInfo->notIndexJump, CodeLocationLabel(byValInfo->stubRoutine->code().code()));
- repatchBuffer.relinkCallerToFunction(returnAddress, FunctionPtr(operationGetByValGeneric));
-}
-
</del><span class="cx"> void JIT::privateCompilePutByVal(ByValInfo* byValInfo, ReturnAddressPtr returnAddress, JITArrayMode arrayMode)
</span><span class="cx"> {
</span><span class="cx"> Instruction* currentInstruction = m_codeBlock->instructions().begin() + byValInfo->bytecodeIndex;
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorejitJITPropertyAccess32_64cpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/jit/JITPropertyAccess32_64.cpp (188200 => 188201)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/jit/JITPropertyAccess32_64.cpp 2015-08-09 22:39:33 UTC (rev 188200)
+++ trunk/Source/JavaScriptCore/jit/JITPropertyAccess32_64.cpp 2015-08-09 22:55:54 UTC (rev 188201)
</span><span class="lines">@@ -149,13 +149,11 @@
</span><span class="cx"> int base = currentInstruction[2].u.operand;
</span><span class="cx"> int property = currentInstruction[3].u.operand;
</span><span class="cx"> ArrayProfile* profile = currentInstruction[4].u.arrayProfile;
</span><del>- ByValInfo* byValInfo = m_codeBlock->addByValInfo();
</del><span class="cx">
</span><span class="cx"> emitLoad2(base, regT1, regT0, property, regT3, regT2);
</span><span class="cx">
</span><ins>+ addSlowCase(branch32(NotEqual, regT3, TrustedImm32(JSValue::Int32Tag)));
</ins><span class="cx"> emitJumpSlowCaseIfNotJSCell(base, regT1);
</span><del>- PatchableJump notIndex = patchableBranch32(NotEqual, regT3, TrustedImm32(JSValue::Int32Tag));
- addSlowCase(notIndex);
</del><span class="cx"> emitArrayProfilingSiteWithCell(regT0, regT1, profile);
</span><span class="cx"> and32(TrustedImm32(IndexingShapeMask), regT1);
</span><span class="cx">
</span><span class="lines">@@ -194,7 +192,7 @@
</span><span class="cx"> emitValueProfilingSite();
</span><span class="cx"> emitStore(dst, regT1, regT0);
</span><span class="cx">
</span><del>- m_byValCompilationInfo.append(ByValCompilationInfo(byValInfo, m_bytecodeOffset, notIndex, badType, mode, profile, done));
</del><ins>+ m_byValCompilationInfo.append(ByValCompilationInfo(m_bytecodeOffset, badType, mode, done));
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> JIT::JumpList JIT::emitContiguousLoad(Instruction*, PatchableJump& badType, IndexingType expectedShape)
</span><span class="lines">@@ -238,53 +236,16 @@
</span><span class="cx">
</span><span class="cx"> return slowCases;
</span><span class="cx"> }
</span><del>-
-JITGetByIdGenerator JIT::emitGetByValWithCachedId(Instruction* currentInstruction, const Identifier& propertyName, JumpList& doneCases, JumpList& slowCases)
-{
- int dst = currentInstruction[1].u.operand;
-
- // base: tag(regT1), payload(regT0)
- // property: tag(regT3), payload(regT2)
- // scratch: regT4
-
- slowCases.append(emitJumpIfNotJSCell(regT3));
- if (propertyName.isSymbol()) {
- slowCases.append(branchStructure(NotEqual, Address(regT2, JSCell::structureIDOffset()), m_vm->symbolStructure.get()));
- loadPtr(Address(regT2, Symbol::offsetOfPrivateName()), regT4);
- } else {
- slowCases.append(branchStructure(NotEqual, Address(regT2, JSCell::structureIDOffset()), m_vm->stringStructure.get()));
- loadPtr(Address(regT2, JSString::offsetOfValue()), regT4);
- slowCases.append(branchTestPtr(Zero, regT4));
- slowCases.append(branchTest32(Zero, Address(regT4, StringImpl::flagsOffset()), TrustedImm32(StringImpl::flagIsAtomic())));
- }
- slowCases.append(branchPtr(NotEqual, regT4, TrustedImmPtr(propertyName.impl())));
-
- JITGetByIdGenerator gen(
- m_codeBlock, CodeOrigin(m_bytecodeOffset), RegisterSet::specialRegisters(),
- JSValueRegs::payloadOnly(regT0), JSValueRegs(regT1, regT0), DontSpill);
- gen.generateFastPath(*this);
-
- doneCases.append(jump());
-
- Label coldPathBegin = label();
- gen.slowPathJump().link(this);
-
- Call call = callOperation(WithProfile, operationGetByIdOptimize, dst, gen.stubInfo(), regT1, regT0, propertyName.impl());
- gen.reportSlowPathCall(coldPathBegin, call);
- doneCases.append(jump());
-
- return gen;
-}
-
</del><ins>+
</ins><span class="cx"> void JIT::emitSlow_op_get_by_val(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
</span><span class="cx"> {
</span><span class="cx"> int dst = currentInstruction[1].u.operand;
</span><span class="cx"> int base = currentInstruction[2].u.operand;
</span><span class="cx"> int property = currentInstruction[3].u.operand;
</span><del>- ByValInfo* byValInfo = m_byValCompilationInfo[m_byValInstructionIndex].byValInfo;
-
- linkSlowCaseIfNotJSCell(iter, base); // base cell check
</del><ins>+ ArrayProfile* profile = currentInstruction[4].u.arrayProfile;
+
</ins><span class="cx"> linkSlowCase(iter); // property int32 check
</span><ins>+ linkSlowCaseIfNotJSCell(iter, base); // base cell check
</ins><span class="cx">
</span><span class="cx"> Jump nonCell = jump();
</span><span class="cx"> linkSlowCase(iter); // base array check
</span><span class="lines">@@ -304,7 +265,7 @@
</span><span class="cx">
</span><span class="cx"> emitLoad(base, regT1, regT0);
</span><span class="cx"> emitLoad(property, regT3, regT2);
</span><del>- Call call = callOperation(operationGetByValOptimize, dst, regT1, regT0, regT3, regT2, byValInfo);
</del><ins>+ Call call = callOperation(operationGetByValOptimize, dst, regT1, regT0, regT3, regT2, profile);
</ins><span class="cx">
</span><span class="cx"> m_byValCompilationInfo[m_byValInstructionIndex].slowPathTarget = slowPath;
</span><span class="cx"> m_byValCompilationInfo[m_byValInstructionIndex].returnAddress = call;
</span><span class="lines">@@ -318,7 +279,6 @@
</span><span class="cx"> int base = currentInstruction[1].u.operand;
</span><span class="cx"> int property = currentInstruction[2].u.operand;
</span><span class="cx"> ArrayProfile* profile = currentInstruction[4].u.arrayProfile;
</span><del>- ByValInfo* byValInfo = m_codeBlock->addByValInfo();
</del><span class="cx">
</span><span class="cx"> emitLoad2(base, regT1, regT0, property, regT3, regT2);
</span><span class="cx">
</span><span class="lines">@@ -354,7 +314,7 @@
</span><span class="cx">
</span><span class="cx"> Label done = label();
</span><span class="cx">
</span><del>- m_byValCompilationInfo.append(ByValCompilationInfo(byValInfo, m_bytecodeOffset, PatchableJump(), badType, mode, profile, done));
</del><ins>+ m_byValCompilationInfo.append(ByValCompilationInfo(m_bytecodeOffset, badType, mode, done));
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> JIT::JumpList JIT::emitGenericContiguousPutByVal(Instruction* currentInstruction, PatchableJump& badType, IndexingType indexingShape)
</span><span class="lines">@@ -459,7 +419,6 @@
</span><span class="cx"> int property = currentInstruction[2].u.operand;
</span><span class="cx"> int value = currentInstruction[3].u.operand;
</span><span class="cx"> ArrayProfile* profile = currentInstruction[4].u.arrayProfile;
</span><del>- ByValInfo* byValInfo = m_byValCompilationInfo[m_byValInstructionIndex].byValInfo;
</del><span class="cx">
</span><span class="cx"> linkSlowCase(iter); // property int32 check
</span><span class="cx"> linkSlowCaseIfNotJSCell(iter, base); // base cell check
</span><span class="lines">@@ -499,7 +458,7 @@
</span><span class="cx"> emitLoad(value, regT0, regT1);
</span><span class="cx"> addCallArgument(regT1);
</span><span class="cx"> addCallArgument(regT0);
</span><del>- addCallArgument(TrustedImmPtr(byValInfo));
</del><ins>+ addCallArgument(TrustedImmPtr(profile));
</ins><span class="cx"> Call call = appendCallWithExceptionCheck(isDirect ? operationDirectPutByVal : operationPutByVal);
</span><span class="cx"> #else
</span><span class="cx"> // The register selection below is chosen to reduce register swapping on ARM.
</span><span class="lines">@@ -507,7 +466,7 @@
</span><span class="cx"> emitLoad(base, regT2, regT1);
</span><span class="cx"> emitLoad(property, regT3, regT0);
</span><span class="cx"> emitLoad(value, regT5, regT4);
</span><del>- Call call = callOperation(isDirect ? operationDirectPutByVal : operationPutByVal, regT2, regT1, regT3, regT0, regT5, regT4, byValInfo);
</del><ins>+ Call call = callOperation(isDirect ? operationDirectPutByVal : operationPutByVal, regT2, regT1, regT3, regT0, regT5, regT4, profile);
</ins><span class="cx"> #endif
</span><span class="cx">
</span><span class="cx"> m_byValCompilationInfo[m_byValInstructionIndex].slowPathTarget = slowPath;
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeSymbolh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/Symbol.h (188200 => 188201)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/Symbol.h 2015-08-09 22:39:33 UTC (rev 188200)
+++ trunk/Source/JavaScriptCore/runtime/Symbol.h 2015-08-09 22:55:54 UTC (rev 188201)
</span><span class="lines">@@ -79,8 +79,6 @@
</span><span class="cx"> JSObject* toObject(ExecState*, JSGlobalObject*) const;
</span><span class="cx"> double toNumber(ExecState*) const;
</span><span class="cx">
</span><del>- static size_t offsetOfPrivateName() { return OBJECT_OFFSETOF(Symbol, m_privateName); }
-
</del><span class="cx"> protected:
</span><span class="cx"> static void destroy(JSCell*);
</span><span class="cx">
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoretestsstressgetbyvalwithstringconstructorjs"></a>
<div class="delfile"><h4>Deleted: trunk/Source/JavaScriptCore/tests/stress/get-by-val-with-string-constructor.js (188200 => 188201)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/tests/stress/get-by-val-with-string-constructor.js 2015-08-09 22:39:33 UTC (rev 188200)
+++ trunk/Source/JavaScriptCore/tests/stress/get-by-val-with-string-constructor.js 2015-08-09 22:55:54 UTC (rev 188201)
</span><span class="lines">@@ -1,23 +0,0 @@
</span><del>-var symbol = "@@species";
-function Hello() {
-}
-
-Object.defineProperty(Hello, symbol, {
- get: function () {
- return this;
- }
-});
-
-Hello.prototype.generate = function () {
- return new this.constructor[symbol]();
-};
-
-function ok() {
- var object = new Hello();
- if (!(object.generate() instanceof Hello))
- throw new Error("bad instance");
-}
-noInline(ok);
-
-for (var i = 0; i < 10000; ++i)
- ok();
</del></span></pre></div>
<a id="trunkSourceJavaScriptCoretestsstressgetbyvalwithstringexitjs"></a>
<div class="delfile"><h4>Deleted: trunk/Source/JavaScriptCore/tests/stress/get-by-val-with-string-exit.js (188200 => 188201)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/tests/stress/get-by-val-with-string-exit.js 2015-08-09 22:39:33 UTC (rev 188200)
+++ trunk/Source/JavaScriptCore/tests/stress/get-by-val-with-string-exit.js 2015-08-09 22:55:54 UTC (rev 188201)
</span><span class="lines">@@ -1,34 +0,0 @@
</span><del>-function shouldBe(actual, expected) {
- if (actual !== expected)
- throw new Error('bad value: ' + actual);
-}
-
-function getByVal(object, name)
-{
- return object[name];
-}
-noInline(getByVal);
-
-function getStr1()
-{
- return "hello";
-}
-noInline(getStr1);
-
-function getStr2()
-{
- return "hello";
-}
-noInline(getStr2);
-
-var object = {
- hello: 42
-};
-
-for (var i = 0; i < 100; ++i)
- shouldBe(getByVal(object, i % 2 === 0 ? getStr1() : getStr2()), 42);
-shouldBe(getByVal(object, { toString() { return 'hello'; } }), 42);
-
-for (var i = 0; i < 10000; ++i)
- shouldBe(getByVal(object, i % 2 === 0 ? getStr1() : getStr2()), 42);
-shouldBe(getByVal(object, { toString() { return 'hello'; } }), 42);
</del></span></pre></div>
<a id="trunkSourceJavaScriptCoretestsstressgetbyvalwithstringgeneratedjs"></a>
<div class="delfile"><h4>Deleted: trunk/Source/JavaScriptCore/tests/stress/get-by-val-with-string-generated.js (188200 => 188201)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/tests/stress/get-by-val-with-string-generated.js 2015-08-09 22:39:33 UTC (rev 188200)
+++ trunk/Source/JavaScriptCore/tests/stress/get-by-val-with-string-generated.js 2015-08-09 22:55:54 UTC (rev 188201)
</span><span class="lines">@@ -1,33 +0,0 @@
</span><del>-function shouldBe(actual, expected) {
- if (actual !== expected)
- throw new Error('bad value: ' + actual);
-}
-
-function getByVal(object, name)
-{
- return object[name];
-}
-noInline(getByVal);
-
-var value = 'lo';
-
-function getStr1()
-{
- return "hel" + value;
-}
-noInline(getStr1);
-
-function getStr2()
-{
- return "hello";
-}
-noInline(getStr2);
-
-var object = {
- hello: 42,
- world: 50
-};
-
-for (var i = 0; i < 10000; ++i)
- shouldBe(getByVal(object, i % 2 === 0 ? getStr1() : getStr2()), 42);
-shouldBe(getByVal(object, 'world'), 50);
</del></span></pre></div>
<a id="trunkSourceJavaScriptCoretestsstressgetbyvalwithstringgetterjs"></a>
<div class="delfile"><h4>Deleted: trunk/Source/JavaScriptCore/tests/stress/get-by-val-with-string-getter.js (188200 => 188201)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/tests/stress/get-by-val-with-string-getter.js 2015-08-09 22:39:33 UTC (rev 188200)
+++ trunk/Source/JavaScriptCore/tests/stress/get-by-val-with-string-getter.js 2015-08-09 22:55:54 UTC (rev 188201)
</span><span class="lines">@@ -1,16 +0,0 @@
</span><del>-
-var object = {
- get hello() {
- return 42;
- }
-};
-
-function ok() {
- var value = 'hello';
- if (object[value] + 20 !== 62)
- throw new Error();
-}
-noInline(ok);
-
-for (var i = 0; i < 10000; ++i)
- ok();
</del></span></pre></div>
<a id="trunkSourceJavaScriptCoretestsstressgetbyvalwithstringjs"></a>
<div class="delfile"><h4>Deleted: trunk/Source/JavaScriptCore/tests/stress/get-by-val-with-string.js (188200 => 188201)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/tests/stress/get-by-val-with-string.js 2015-08-09 22:39:33 UTC (rev 188200)
+++ trunk/Source/JavaScriptCore/tests/stress/get-by-val-with-string.js 2015-08-09 22:55:54 UTC (rev 188201)
</span><span class="lines">@@ -1,31 +0,0 @@
</span><del>-function shouldBe(actual, expected) {
- if (actual !== expected)
- throw new Error('bad value: ' + actual);
-}
-
-function getByVal(object, name)
-{
- return object[name];
-}
-noInline(getByVal);
-
-function getStr1()
-{
- return "hello";
-}
-noInline(getStr1);
-
-function getStr2()
-{
- return "hello";
-}
-noInline(getStr2);
-
-var object = {
- hello: 42,
- world: 50
-};
-
-for (var i = 0; i < 10000; ++i)
- shouldBe(getByVal(object, i % 2 === 0 ? getStr1() : getStr2()), 42);
-shouldBe(getByVal(object, 'world'), 50);
</del></span></pre></div>
<a id="trunkSourceJavaScriptCoretestsstressgetbyvalwithsymbolconstructorjs"></a>
<div class="delfile"><h4>Deleted: trunk/Source/JavaScriptCore/tests/stress/get-by-val-with-symbol-constructor.js (188200 => 188201)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/tests/stress/get-by-val-with-symbol-constructor.js 2015-08-09 22:39:33 UTC (rev 188200)
+++ trunk/Source/JavaScriptCore/tests/stress/get-by-val-with-symbol-constructor.js 2015-08-09 22:55:54 UTC (rev 188201)
</span><span class="lines">@@ -1,23 +0,0 @@
</span><del>-var symbol = Symbol();
-function Hello() {
-}
-
-Object.defineProperty(Hello, symbol, {
- get: function () {
- return this;
- }
-});
-
-Hello.prototype.generate = function () {
- return new this.constructor[symbol]();
-};
-
-function ok() {
- var object = new Hello();
- if (!(object.generate() instanceof Hello))
- throw new Error("bad instance");
-}
-noInline(ok);
-
-for (var i = 0; i < 10000; ++i)
- ok();
</del></span></pre></div>
<a id="trunkSourceJavaScriptCoretestsstressgetbyvalwithsymbolexitjs"></a>
<div class="delfile"><h4>Deleted: trunk/Source/JavaScriptCore/tests/stress/get-by-val-with-symbol-exit.js (188200 => 188201)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/tests/stress/get-by-val-with-symbol-exit.js 2015-08-09 22:39:33 UTC (rev 188200)
+++ trunk/Source/JavaScriptCore/tests/stress/get-by-val-with-symbol-exit.js 2015-08-09 22:55:54 UTC (rev 188201)
</span><span class="lines">@@ -1,38 +0,0 @@
</span><del>-var symbol1 = Symbol();
-var symbol2 = Object.getOwnPropertySymbols({ [symbol1]: 42 })[0];
-
-function shouldBe(actual, expected) {
- if (actual !== expected)
- throw new Error('bad value: ' + actual);
-}
-
-function getByVal(object, name)
-{
- return object[name];
-}
-noInline(getByVal);
-
-function getSym1()
-{
- return symbol1;
-}
-noInline(getSym1);
-
-function getSym2()
-{
- return symbol2;
-}
-noInline(getSym2);
-
-var object = {
- [symbol1]: 42,
- hello: 50
-};
-
-for (var i = 0; i < 100; ++i)
- shouldBe(getByVal(object, i % 2 === 0 ? getSym1() : getSym2()), 42);
-shouldBe(getByVal(object, 'hello'), 50);
-
-for (var i = 0; i < 10000; ++i)
- shouldBe(getByVal(object, i % 2 === 0 ? getSym1() : getSym2()), 42);
-shouldBe(getByVal(object, 'hello'), 50);
</del></span></pre></div>
<a id="trunkSourceJavaScriptCoretestsstressgetbyvalwithsymbolgetterjs"></a>
<div class="delfile"><h4>Deleted: trunk/Source/JavaScriptCore/tests/stress/get-by-val-with-symbol-getter.js (188200 => 188201)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/tests/stress/get-by-val-with-symbol-getter.js 2015-08-09 22:39:33 UTC (rev 188200)
+++ trunk/Source/JavaScriptCore/tests/stress/get-by-val-with-symbol-getter.js 2015-08-09 22:55:54 UTC (rev 188201)
</span><span class="lines">@@ -1,23 +0,0 @@
</span><del>-
-var object = {
- get hello() {
- return 42;
- }
-};
-
-var symbol = Symbol();
-
-Object.defineProperty(object, symbol, {
- get: function () {
- return 42;
- }
-});
-
-function ok() {
- if (object[symbol] + 20 !== 62)
- throw new Error();
-}
-noInline(ok);
-
-for (var i = 0; i < 10000; ++i)
- ok();
</del></span></pre></div>
<a id="trunkSourceJavaScriptCoretestsstressgetbyvalwithsymboljs"></a>
<div class="delfile"><h4>Deleted: trunk/Source/JavaScriptCore/tests/stress/get-by-val-with-symbol.js (188200 => 188201)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/tests/stress/get-by-val-with-symbol.js 2015-08-09 22:39:33 UTC (rev 188200)
+++ trunk/Source/JavaScriptCore/tests/stress/get-by-val-with-symbol.js 2015-08-09 22:55:54 UTC (rev 188201)
</span><span class="lines">@@ -1,33 +0,0 @@
</span><del>-var symbol1 = Symbol();
-var symbol2 = Object.getOwnPropertySymbols({ [symbol1]: 42 })[0];
-
-function shouldBe(actual, expected) {
- if (actual !== expected)
- throw new Error('bad value: ' + actual);
-}
-
-function getByVal(object, name)
-{
- return object[name];
-}
-noInline(getByVal);
-
-function getSym1()
-{
- return symbol1;
-}
-noInline(getSym1);
-
-function getSym2()
-{
- return symbol2;
-}
-noInline(getSym2);
-
-var object = {
- [symbol1]: 42,
- hello: 50
-};
-
-for (var i = 0; i < 10000; ++i)
- shouldBe(getByVal(object, i % 2 === 0 ? getSym1() : getSym2()), 42);
</del></span></pre>
</div>
</div>
</body>
</html>