<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN"
"http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head><meta http-equiv="content-type" content="text/html; charset=utf-8" />
<title>[190809] trunk/Source/JavaScriptCore</title>
</head>
<body>

<style type="text/css"><!--
#msg dl.meta { border: 1px #006 solid; background: #369; padding: 6px; color: #fff; }
#msg dl.meta dt { float: left; width: 6em; font-weight: bold; }
#msg dt:after { content:':';}
#msg dl, #msg dt, #msg ul, #msg li, #header, #footer, #logmsg { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt;  }
#msg dl a { font-weight: bold}
#msg dl a:link    { color:#fc3; }
#msg dl a:active  { color:#ff0; }
#msg dl a:visited { color:#cc6; }
h3 { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; font-weight: bold; }
#msg pre { overflow: auto; background: #ffc; border: 1px #fa0 solid; padding: 6px; }
#logmsg { background: #ffc; border: 1px #fa0 solid; padding: 1em 1em 0 1em; }
#logmsg p, #logmsg pre, #logmsg blockquote { margin: 0 0 1em 0; }
#logmsg p, #logmsg li, #logmsg dt, #logmsg dd { line-height: 14pt; }
#logmsg h1, #logmsg h2, #logmsg h3, #logmsg h4, #logmsg h5, #logmsg h6 { margin: .5em 0; }
#logmsg h1:first-child, #logmsg h2:first-child, #logmsg h3:first-child, #logmsg h4:first-child, #logmsg h5:first-child, #logmsg h6:first-child { margin-top: 0; }
#logmsg ul, #logmsg ol { padding: 0; list-style-position: inside; margin: 0 0 0 1em; }
#logmsg ul { text-indent: -1em; padding-left: 1em; }#logmsg ol { text-indent: -1.5em; padding-left: 1.5em; }
#logmsg > ul, #logmsg > ol { margin: 0 0 1em 0; }
#logmsg pre { background: #eee; padding: 1em; }
#logmsg blockquote { border: 1px solid #fa0; border-left-width: 10px; padding: 1em 1em 0 1em; background: white;}
#logmsg dl { margin: 0; }
#logmsg dt { font-weight: bold; }
#logmsg dd { margin: 0; padding: 0 0 0.5em 0; }
#logmsg dd:before { content:'\00bb';}
#logmsg table { border-spacing: 0px; border-collapse: collapse; border-top: 4px solid #fa0; border-bottom: 1px solid #fa0; background: #fff; }
#logmsg table th { text-align: left; font-weight: normal; padding: 0.2em 0.5em; border-top: 1px dotted #fa0; }
#logmsg table td { text-align: right; border-top: 1px dotted #fa0; padding: 0.2em 0.5em; }
#logmsg table thead th { text-align: center; border-bottom: 1px solid #fa0; }
#logmsg table th.Corner { text-align: left; }
#logmsg hr { border: none 0; border-top: 2px dashed #fa0; height: 1px; }
#header, #footer { color: #fff; background: #636; border: 1px #300 solid; padding: 6px; }
#patch { width: 100%; }
#patch h4 {font-family: verdana,arial,helvetica,sans-serif;font-size:10pt;padding:8px;background:#369;color:#fff;margin:0;}
#patch .propset h4, #patch .binary h4 {margin:0;}
#patch pre {padding:0;line-height:1.2em;margin:0;}
#patch .diff {width:100%;background:#eee;padding: 0 0 10px 0;overflow:auto;}
#patch .propset .diff, #patch .binary .diff  {padding:10px 0;}
#patch span {display:block;padding:0 10px;}
#patch .modfile, #patch .addfile, #patch .delfile, #patch .propset, #patch .binary, #patch .copfile {border:1px solid #ccc;margin:10px 0;}
#patch ins {background:#dfd;text-decoration:none;display:block;padding:0 10px;}
#patch del {background:#fdd;text-decoration:none;display:block;padding:0 10px;}
#patch .lines, .info {color:#888;background:#fff;}
--></style>
<div id="msg">
<dl class="meta">
<dt>Revision</dt> <dd><a href="http://trac.webkit.org/projects/webkit/changeset/190809">190809</a></dd>
<dt>Author</dt> <dd>ggaren@apple.com</dd>
<dt>Date</dt> <dd>2015-10-09 10:54:16 -0700 (Fri, 09 Oct 2015)</dd>
</dl>

<h3>Log Message</h3>
<pre>2015-10-09  Geoffrey Garen  &lt;ggaren@apple.com&gt;

        Unreviewed, rolling out <a href="http://trac.webkit.org/projects/webkit/changeset/190694">r190694</a>
        https://bugs.webkit.org/show_bug.cgi?id=148560

        Crashes seen on PLT bots and facebook.com.

        Reverted changesets:

        &quot;CodeBlock should be a GC object&quot;
        https://bugs.webkit.org/show_bug.cgi?id=149727
        http://trac.webkit.org/changeset/190694</pre>

<h3>Modified Paths</h3>
<ul>
<li><a href="#trunkSourceJavaScriptCoreChangeLog">trunk/Source/JavaScriptCore/ChangeLog</a></li>
<li><a href="#trunkSourceJavaScriptCorebytecodeCodeBlockcpp">trunk/Source/JavaScriptCore/bytecode/CodeBlock.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCorebytecodeCodeBlockh">trunk/Source/JavaScriptCore/bytecode/CodeBlock.h</a></li>
<li><a href="#trunkSourceJavaScriptCorebytecodeCodeOrigincpp">trunk/Source/JavaScriptCore/bytecode/CodeOrigin.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCorebytecodeCodeOriginh">trunk/Source/JavaScriptCore/bytecode/CodeOrigin.h</a></li>
<li><a href="#trunkSourceJavaScriptCorebytecodeDeferredCompilationCallbackcpp">trunk/Source/JavaScriptCore/bytecode/DeferredCompilationCallback.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCorebytecodeDeferredCompilationCallbackh">trunk/Source/JavaScriptCore/bytecode/DeferredCompilationCallback.h</a></li>
<li><a href="#trunkSourceJavaScriptCorebytecodeEvalCodeCacheh">trunk/Source/JavaScriptCore/bytecode/EvalCodeCache.h</a></li>
<li><a href="#trunkSourceJavaScriptCorebytecodeInlineCallFramecpp">trunk/Source/JavaScriptCore/bytecode/InlineCallFrame.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCorebytecodeInlineCallFrameh">trunk/Source/JavaScriptCore/bytecode/InlineCallFrame.h</a></li>
<li><a href="#trunkSourceJavaScriptCorebytecodePolymorphicAccesscpp">trunk/Source/JavaScriptCore/bytecode/PolymorphicAccess.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCorebytecodeStructureStubInfocpp">trunk/Source/JavaScriptCore/bytecode/StructureStubInfo.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGByteCodeParsercpp">trunk/Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGCommonDatacpp">trunk/Source/JavaScriptCore/dfg/DFGCommonData.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGDesiredTransitionscpp">trunk/Source/JavaScriptCore/dfg/DFGDesiredTransitions.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGDesiredTransitionsh">trunk/Source/JavaScriptCore/dfg/DFGDesiredTransitions.h</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGDesiredWeakReferencescpp">trunk/Source/JavaScriptCore/dfg/DFGDesiredWeakReferences.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGDrivercpp">trunk/Source/JavaScriptCore/dfg/DFGDriver.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGGraphcpp">trunk/Source/JavaScriptCore/dfg/DFGGraph.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGGraphh">trunk/Source/JavaScriptCore/dfg/DFGGraph.h</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGJITCodeh">trunk/Source/JavaScriptCore/dfg/DFGJITCode.h</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGJITFinalizercpp">trunk/Source/JavaScriptCore/dfg/DFGJITFinalizer.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGOSRExitCompilerCommoncpp">trunk/Source/JavaScriptCore/dfg/DFGOSRExitCompilerCommon.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGOSRExitPreparationcpp">trunk/Source/JavaScriptCore/dfg/DFGOSRExitPreparation.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGOperationscpp">trunk/Source/JavaScriptCore/dfg/DFGOperations.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGPlancpp">trunk/Source/JavaScriptCore/dfg/DFGPlan.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGPlanh">trunk/Source/JavaScriptCore/dfg/DFGPlan.h</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGToFTLDeferredCompilationCallbackcpp">trunk/Source/JavaScriptCore/dfg/DFGToFTLDeferredCompilationCallback.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGToFTLDeferredCompilationCallbackh">trunk/Source/JavaScriptCore/dfg/DFGToFTLDeferredCompilationCallback.h</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGToFTLForOSREntryDeferredCompilationCallbackcpp">trunk/Source/JavaScriptCore/dfg/DFGToFTLForOSREntryDeferredCompilationCallback.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGToFTLForOSREntryDeferredCompilationCallbackh">trunk/Source/JavaScriptCore/dfg/DFGToFTLForOSREntryDeferredCompilationCallback.h</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGWorklistcpp">trunk/Source/JavaScriptCore/dfg/DFGWorklist.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGWorklisth">trunk/Source/JavaScriptCore/dfg/DFGWorklist.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreftlFTLJITFinalizercpp">trunk/Source/JavaScriptCore/ftl/FTLJITFinalizer.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreheapCodeBlockSetcpp">trunk/Source/JavaScriptCore/heap/CodeBlockSet.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreheapCodeBlockSeth">trunk/Source/JavaScriptCore/heap/CodeBlockSet.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreheapHeapcpp">trunk/Source/JavaScriptCore/heap/Heap.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreheapHeaph">trunk/Source/JavaScriptCore/heap/Heap.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreinterpreterInterpretercpp">trunk/Source/JavaScriptCore/interpreter/Interpreter.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreinterpreterStackVisitorcpp">trunk/Source/JavaScriptCore/interpreter/StackVisitor.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCorejitAssemblyHelperscpp">trunk/Source/JavaScriptCore/jit/AssemblyHelpers.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCorejitAssemblyHelpersh">trunk/Source/JavaScriptCore/jit/AssemblyHelpers.h</a></li>
<li><a href="#trunkSourceJavaScriptCorejitGCAwareJITStubRoutineh">trunk/Source/JavaScriptCore/jit/GCAwareJITStubRoutine.h</a></li>
<li><a href="#trunkSourceJavaScriptCorejitJITCodeh">trunk/Source/JavaScriptCore/jit/JITCode.h</a></li>
<li><a href="#trunkSourceJavaScriptCorejitJITOpcodescpp">trunk/Source/JavaScriptCore/jit/JITOpcodes.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCorejitJITOperationscpp">trunk/Source/JavaScriptCore/jit/JITOperations.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCorejitJITToDFGDeferredCompilationCallbackcpp">trunk/Source/JavaScriptCore/jit/JITToDFGDeferredCompilationCallback.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCorejitJITToDFGDeferredCompilationCallbackh">trunk/Source/JavaScriptCore/jit/JITToDFGDeferredCompilationCallback.h</a></li>
<li><a href="#trunkSourceJavaScriptCorejitRepatchcpp">trunk/Source/JavaScriptCore/jit/Repatch.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCorellintLLIntSlowPathscpp">trunk/Source/JavaScriptCore/llint/LLIntSlowPaths.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreprofilerProfilerOriginStackcpp">trunk/Source/JavaScriptCore/profiler/ProfilerOriginStack.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeCommonSlowPathscpp">trunk/Source/JavaScriptCore/runtime/CommonSlowPaths.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeCommonSlowPathsh">trunk/Source/JavaScriptCore/runtime/CommonSlowPaths.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeExecutablecpp">trunk/Source/JavaScriptCore/runtime/Executable.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeExecutableh">trunk/Source/JavaScriptCore/runtime/Executable.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeVMcpp">trunk/Source/JavaScriptCore/runtime/VM.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeVMh">trunk/Source/JavaScriptCore/runtime/VM.h</a></li>
</ul>

</div>
<div id="patch">
<h3>Diff</h3>
<a id="trunkSourceJavaScriptCoreChangeLog"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/ChangeLog (190808 => 190809)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/ChangeLog        2015-10-09 17:53:28 UTC (rev 190808)
+++ trunk/Source/JavaScriptCore/ChangeLog        2015-10-09 17:54:16 UTC (rev 190809)
</span><span class="lines">@@ -1,3 +1,16 @@
</span><ins>+2015-10-09  Geoffrey Garen  &lt;ggaren@apple.com&gt;
+
+        Unreviewed, rolling out r190694
+        https://bugs.webkit.org/show_bug.cgi?id=148560
+
+        Crashes seen on PLT bots and facebook.com.
+
+        Reverted changesets:
+
+        &quot;CodeBlock should be a GC object&quot;
+        https://bugs.webkit.org/show_bug.cgi?id=149727
+        http://trac.webkit.org/changeset/190694
+
</ins><span class="cx"> 2015-10-09  Xabier Rodriguez Calvar  &lt;calvaris@igalia.com&gt; and Youenn Fablet  &lt;youenn.fablet@crf.canon.fr&gt;
</span><span class="cx"> 
</span><span class="cx">         Automate WebCore JS builtins generation and build system
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorebytecodeCodeBlockcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/bytecode/CodeBlock.cpp (190808 => 190809)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/bytecode/CodeBlock.cpp        2015-10-09 17:53:28 UTC (rev 190808)
+++ trunk/Source/JavaScriptCore/bytecode/CodeBlock.cpp        2015-10-09 17:54:16 UTC (rev 190809)
</span><span class="lines">@@ -82,70 +82,6 @@
</span><span class="cx"> 
</span><span class="cx"> namespace JSC {
</span><span class="cx"> 
</span><del>-const ClassInfo CodeBlock::s_info = {
-    &quot;CodeBlock&quot;, 0, 0,
-    CREATE_METHOD_TABLE(CodeBlock)
-};
-
-const ClassInfo FunctionCodeBlock::s_info = {
-    &quot;FunctionCodeBlock&quot;, &amp;Base::s_info, 0,
-    CREATE_METHOD_TABLE(FunctionCodeBlock)
-};
-
-#if ENABLE(WEBASSEMBLY)
-const ClassInfo WebAssemblyCodeBlock::s_info = {
-    &quot;WebAssemblyCodeBlock&quot;, &amp;Base::s_info, 0,
-    CREATE_METHOD_TABLE(WebAssemblyCodeBlock)
-};
-#endif
-
-const ClassInfo GlobalCodeBlock::s_info = {
-    &quot;GlobalCodeBlock&quot;, &amp;Base::s_info, 0,
-    CREATE_METHOD_TABLE(GlobalCodeBlock)
-};
-
-const ClassInfo ProgramCodeBlock::s_info = {
-    &quot;ProgramCodeBlock&quot;, &amp;Base::s_info, 0,
-    CREATE_METHOD_TABLE(ProgramCodeBlock)
-};
-
-const ClassInfo ModuleProgramCodeBlock::s_info = {
-    &quot;ModuleProgramCodeBlock&quot;, &amp;Base::s_info, 0,
-    CREATE_METHOD_TABLE(ModuleProgramCodeBlock)
-};
-
-const ClassInfo EvalCodeBlock::s_info = {
-    &quot;EvalCodeBlock&quot;, &amp;Base::s_info, 0,
-    CREATE_METHOD_TABLE(EvalCodeBlock)
-};
-
-void FunctionCodeBlock::destroy(JSCell* cell)
-{
-    jsCast&lt;FunctionCodeBlock*&gt;(cell)-&gt;~FunctionCodeBlock();
-}
-
-#if ENABLE(WEBASSEMBLY)
-void WebAssemblyCodeBlock::destroy(JSCell* cell)
-{
-    jsCast&lt;WebAssemblyCodeBlock*&gt;(cell)-&gt;~WebAssemblyCodeBlock();
-}
-#endif
-
-void ProgramCodeBlock::destroy(JSCell* cell)
-{
-    jsCast&lt;ProgramCodeBlock*&gt;(cell)-&gt;~ProgramCodeBlock();
-}
-
-void ModuleProgramCodeBlock::destroy(JSCell* cell)
-{
-    jsCast&lt;ModuleProgramCodeBlock*&gt;(cell)-&gt;~ModuleProgramCodeBlock();
-}
-
-void EvalCodeBlock::destroy(JSCell* cell)
-{
-    jsCast&lt;EvalCodeBlock*&gt;(cell)-&gt;~EvalCodeBlock();
-}
-
</del><span class="cx"> CString CodeBlock::inferredName() const
</span><span class="cx"> {
</span><span class="cx">     switch (codeType()) {
</span><span class="lines">@@ -217,7 +153,7 @@
</span><span class="cx">     out.print(inferredName(), &quot;#&quot;, hashAsStringIfPossible());
</span><span class="cx">     out.print(&quot;:[&quot;, RawPointer(this), &quot;-&gt;&quot;);
</span><span class="cx">     if (!!m_alternative)
</span><del>-        out.print(RawPointer(alternative()), &quot;-&gt;&quot;);
</del><ins>+        out.print(RawPointer(m_alternative.get()), &quot;-&gt;&quot;);
</ins><span class="cx">     out.print(RawPointer(ownerExecutable()), &quot;, &quot;, jitType, codeType());
</span><span class="cx"> 
</span><span class="cx">     if (codeType() == FunctionCode)
</span><span class="lines">@@ -1645,9 +1581,8 @@
</span><span class="cx"> 
</span><span class="cx"> } // anonymous namespace
</span><span class="cx"> 
</span><del>-CodeBlock::CodeBlock(VM* vm, Structure* structure, CopyParsedBlockTag, CodeBlock&amp; other)
-    : JSCell(*vm, structure)
-    , m_globalObject(other.m_globalObject)
</del><ins>+CodeBlock::CodeBlock(CopyParsedBlockTag, CodeBlock&amp; other)
+    : m_globalObject(other.m_globalObject)
</ins><span class="cx">     , m_heap(other.m_heap)
</span><span class="cx">     , m_numCalleeRegisters(other.m_numCalleeRegisters)
</span><span class="cx">     , m_numVars(other.m_numVars)
</span><span class="lines">@@ -1655,11 +1590,11 @@
</span><span class="cx">     , m_shouldAlwaysBeInlined(true)
</span><span class="cx">     , m_didFailFTLCompilation(false)
</span><span class="cx">     , m_hasBeenCompiledWithFTL(false)
</span><del>-    , m_unlinkedCode(*other.m_vm, this, other.m_unlinkedCode.get())
</del><ins>+    , m_unlinkedCode(*other.m_vm, other.m_ownerExecutable.get(), other.m_unlinkedCode.get())
</ins><span class="cx">     , m_hasDebuggerStatement(false)
</span><span class="cx">     , m_steppingMode(SteppingModeDisabled)
</span><span class="cx">     , m_numBreakpoints(0)
</span><del>-    , m_ownerExecutable(*other.m_vm, this, other.m_ownerExecutable.get())
</del><ins>+    , m_ownerExecutable(*other.m_vm, other.m_ownerExecutable.get(), other.m_ownerExecutable.get())
</ins><span class="cx">     , m_vm(other.m_vm)
</span><span class="cx">     , m_instructions(other.m_instructions)
</span><span class="cx">     , m_thisRegister(other.m_thisRegister)
</span><span class="lines">@@ -1684,18 +1619,13 @@
</span><span class="cx">     , m_capabilityLevelState(DFG::CapabilityLevelNotSet)
</span><span class="cx"> #endif
</span><span class="cx"> {
</span><del>-    m_visitWeaklyHasBeenCalled.store(false, std::memory_order_relaxed);
</del><ins>+    m_visitStronglyHasBeenCalled.store(false, std::memory_order_relaxed);
+    m_visitAggregateHasBeenCalled.store(false, std::memory_order_relaxed);
</ins><span class="cx"> 
</span><span class="cx">     ASSERT(m_heap-&gt;isDeferred());
</span><span class="cx">     ASSERT(m_scopeRegister.isLocal());
</span><span class="cx"> 
</span><span class="cx">     setNumParameters(other.numParameters());
</span><del>-}
-
-void CodeBlock::finishCreation(VM&amp; vm, CopyParsedBlockTag, CodeBlock&amp; other)
-{
-    Base::finishCreation(vm);
-
</del><span class="cx">     optimizeAfterWarmUp();
</span><span class="cx">     jitAfterWarmUp();
</span><span class="cx"> 
</span><span class="lines">@@ -1709,12 +1639,11 @@
</span><span class="cx">     }
</span><span class="cx">     
</span><span class="cx">     m_heap-&gt;m_codeBlocks.add(this);
</span><ins>+    m_heap-&gt;reportExtraMemoryAllocated(sizeof(CodeBlock));
</ins><span class="cx"> }
</span><span class="cx"> 
</span><del>-CodeBlock::CodeBlock(VM* vm, Structure* structure, ScriptExecutable* ownerExecutable, UnlinkedCodeBlock* unlinkedCodeBlock,
-    JSScope* scope, PassRefPtr&lt;SourceProvider&gt; sourceProvider, unsigned sourceOffset, unsigned firstLineColumnOffset)
-    : JSCell(*vm, structure)
-    , m_globalObject(scope-&gt;globalObject()-&gt;vm(), this, scope-&gt;globalObject())
</del><ins>+CodeBlock::CodeBlock(ScriptExecutable* ownerExecutable, UnlinkedCodeBlock* unlinkedCodeBlock, JSScope* scope, PassRefPtr&lt;SourceProvider&gt; sourceProvider, unsigned sourceOffset, unsigned firstLineColumnOffset)
+    : m_globalObject(scope-&gt;globalObject()-&gt;vm(), ownerExecutable, scope-&gt;globalObject())
</ins><span class="cx">     , m_heap(&amp;m_globalObject-&gt;vm().heap)
</span><span class="cx">     , m_numCalleeRegisters(unlinkedCodeBlock-&gt;m_numCalleeRegisters)
</span><span class="cx">     , m_numVars(unlinkedCodeBlock-&gt;m_numVars)
</span><span class="lines">@@ -1722,11 +1651,11 @@
</span><span class="cx">     , m_shouldAlwaysBeInlined(true)
</span><span class="cx">     , m_didFailFTLCompilation(false)
</span><span class="cx">     , m_hasBeenCompiledWithFTL(false)
</span><del>-    , m_unlinkedCode(m_globalObject-&gt;vm(), this, unlinkedCodeBlock)
</del><ins>+    , m_unlinkedCode(m_globalObject-&gt;vm(), ownerExecutable, unlinkedCodeBlock)
</ins><span class="cx">     , m_hasDebuggerStatement(false)
</span><span class="cx">     , m_steppingMode(SteppingModeDisabled)
</span><span class="cx">     , m_numBreakpoints(0)
</span><del>-    , m_ownerExecutable(m_globalObject-&gt;vm(), this, ownerExecutable)
</del><ins>+    , m_ownerExecutable(m_globalObject-&gt;vm(), ownerExecutable, ownerExecutable)
</ins><span class="cx">     , m_vm(unlinkedCodeBlock-&gt;vm())
</span><span class="cx">     , m_thisRegister(unlinkedCodeBlock-&gt;thisRegister())
</span><span class="cx">     , m_scopeRegister(unlinkedCodeBlock-&gt;scopeRegister())
</span><span class="lines">@@ -1745,31 +1674,26 @@
</span><span class="cx">     , m_capabilityLevelState(DFG::CapabilityLevelNotSet)
</span><span class="cx"> #endif
</span><span class="cx"> {
</span><del>-    m_visitWeaklyHasBeenCalled.store(false, std::memory_order_relaxed);
</del><ins>+    m_visitStronglyHasBeenCalled.store(false, std::memory_order_relaxed);
+    m_visitAggregateHasBeenCalled.store(false, std::memory_order_relaxed);
</ins><span class="cx"> 
</span><span class="cx">     ASSERT(m_heap-&gt;isDeferred());
</span><span class="cx">     ASSERT(m_scopeRegister.isLocal());
</span><span class="cx"> 
</span><span class="cx">     ASSERT(m_source);
</span><span class="cx">     setNumParameters(unlinkedCodeBlock-&gt;numParameters());
</span><del>-}
</del><span class="cx"> 
</span><del>-void CodeBlock::finishCreation(VM&amp; vm, ScriptExecutable* ownerExecutable, UnlinkedCodeBlock* unlinkedCodeBlock,
-    JSScope* scope)
-{
-    Base::finishCreation(vm);
</del><ins>+    if (vm()-&gt;typeProfiler() || vm()-&gt;controlFlowProfiler())
+        vm()-&gt;functionHasExecutedCache()-&gt;removeUnexecutedRange(ownerExecutable-&gt;sourceID(), ownerExecutable-&gt;typeProfilingStartOffset(), ownerExecutable-&gt;typeProfilingEndOffset());
</ins><span class="cx"> 
</span><del>-    if (vm.typeProfiler() || vm.controlFlowProfiler())
-        vm.functionHasExecutedCache()-&gt;removeUnexecutedRange(ownerExecutable-&gt;sourceID(), ownerExecutable-&gt;typeProfilingStartOffset(), ownerExecutable-&gt;typeProfilingEndOffset());
-
</del><span class="cx">     setConstantRegisters(unlinkedCodeBlock-&gt;constantRegisters(), unlinkedCodeBlock-&gt;constantsSourceCodeRepresentation());
</span><span class="cx">     if (unlinkedCodeBlock-&gt;usesGlobalObject())
</span><del>-        m_constantRegisters[unlinkedCodeBlock-&gt;globalObjectRegister().toConstantIndex()].set(*m_vm, this, m_globalObject.get());
</del><ins>+        m_constantRegisters[unlinkedCodeBlock-&gt;globalObjectRegister().toConstantIndex()].set(*m_vm, ownerExecutable, m_globalObject.get());
</ins><span class="cx"> 
</span><span class="cx">     for (unsigned i = 0; i &lt; LinkTimeConstantCount; i++) {
</span><span class="cx">         LinkTimeConstant type = static_cast&lt;LinkTimeConstant&gt;(i);
</span><span class="cx">         if (unsigned registerIndex = unlinkedCodeBlock-&gt;registerIndexForLinkTimeConstant(type))
</span><del>-            m_constantRegisters[registerIndex].set(*m_vm, this, m_globalObject-&gt;jsCellForLinkTimeConstant(type));
</del><ins>+            m_constantRegisters[registerIndex].set(*m_vm, ownerExecutable, m_globalObject-&gt;jsCellForLinkTimeConstant(type));
</ins><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     HashSet&lt;int, WTF::IntHash&lt;int&gt;, WTF::UnsignedWithZeroKeyHashTraits&lt;int&gt;&gt; clonedConstantSymbolTables;
</span><span class="lines">@@ -1784,7 +1708,7 @@
</span><span class="cx">                     ConcurrentJITLocker locker(symbolTable-&gt;m_lock);
</span><span class="cx">                     symbolTable-&gt;prepareForTypeProfiling(locker);
</span><span class="cx">                 }
</span><del>-                m_constantRegisters[i].set(*m_vm, this, symbolTable-&gt;cloneScopePart(*m_vm));
</del><ins>+                m_constantRegisters[i].set(*m_vm, ownerExecutable, symbolTable-&gt;cloneScopePart(*m_vm));
</ins><span class="cx">                 clonedConstantSymbolTables.add(i + FirstConstantRegisterIndex);
</span><span class="cx">             }
</span><span class="cx">         }
</span><span class="lines">@@ -1804,17 +1728,17 @@
</span><span class="cx">     m_functionDecls.resizeToFit(unlinkedCodeBlock-&gt;numberOfFunctionDecls());
</span><span class="cx">     for (size_t count = unlinkedCodeBlock-&gt;numberOfFunctionDecls(), i = 0; i &lt; count; ++i) {
</span><span class="cx">         UnlinkedFunctionExecutable* unlinkedExecutable = unlinkedCodeBlock-&gt;functionDecl(i);
</span><del>-        if (vm.typeProfiler() || vm.controlFlowProfiler())
-            vm.functionHasExecutedCache()-&gt;insertUnexecutedRange(ownerExecutable-&gt;sourceID(), unlinkedExecutable-&gt;typeProfilingStartOffset(), unlinkedExecutable-&gt;typeProfilingEndOffset());
-        m_functionDecls[i].set(*m_vm, this, unlinkedExecutable-&gt;link(*m_vm, ownerExecutable-&gt;source()));
</del><ins>+        if (vm()-&gt;typeProfiler() || vm()-&gt;controlFlowProfiler())
+            vm()-&gt;functionHasExecutedCache()-&gt;insertUnexecutedRange(ownerExecutable-&gt;sourceID(), unlinkedExecutable-&gt;typeProfilingStartOffset(), unlinkedExecutable-&gt;typeProfilingEndOffset());
+        m_functionDecls[i].set(*m_vm, ownerExecutable, unlinkedExecutable-&gt;link(*m_vm, ownerExecutable-&gt;source()));
</ins><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     m_functionExprs.resizeToFit(unlinkedCodeBlock-&gt;numberOfFunctionExprs());
</span><span class="cx">     for (size_t count = unlinkedCodeBlock-&gt;numberOfFunctionExprs(), i = 0; i &lt; count; ++i) {
</span><span class="cx">         UnlinkedFunctionExecutable* unlinkedExecutable = unlinkedCodeBlock-&gt;functionExpr(i);
</span><del>-        if (vm.typeProfiler() || vm.controlFlowProfiler())
-            vm.functionHasExecutedCache()-&gt;insertUnexecutedRange(ownerExecutable-&gt;sourceID(), unlinkedExecutable-&gt;typeProfilingStartOffset(), unlinkedExecutable-&gt;typeProfilingEndOffset());
-        m_functionExprs[i].set(*m_vm, this, unlinkedExecutable-&gt;link(*m_vm, ownerExecutable-&gt;source()));
</del><ins>+        if (vm()-&gt;typeProfiler() || vm()-&gt;controlFlowProfiler())
+            vm()-&gt;functionHasExecutedCache()-&gt;insertUnexecutedRange(ownerExecutable-&gt;sourceID(), unlinkedExecutable-&gt;typeProfilingStartOffset(), unlinkedExecutable-&gt;typeProfilingEndOffset());
+        m_functionExprs[i].set(*m_vm, ownerExecutable, unlinkedExecutable-&gt;link(*m_vm, ownerExecutable-&gt;source()));
</ins><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     if (unlinkedCodeBlock-&gt;hasRareData()) {
</span><span class="lines">@@ -1893,7 +1817,7 @@
</span><span class="cx"> 
</span><span class="cx">         unsigned opLength = opcodeLength(pc[0].u.opcode);
</span><span class="cx"> 
</span><del>-        instructions[i] = vm.interpreter-&gt;getOpcode(pc[0].u.opcode);
</del><ins>+        instructions[i] = vm()-&gt;interpreter-&gt;getOpcode(pc[0].u.opcode);
</ins><span class="cx">         for (size_t j = 1; j &lt; opLength; ++j) {
</span><span class="cx">             if (sizeof(int32_t) != sizeof(intptr_t))
</span><span class="cx">                 instructions[i + j].u.pointer = 0;
</span><span class="lines">@@ -1952,8 +1876,8 @@
</span><span class="cx">             int inferredInlineCapacity = pc[opLength - 2].u.operand;
</span><span class="cx"> 
</span><span class="cx">             instructions[i + opLength - 1] = objectAllocationProfile;
</span><del>-            objectAllocationProfile-&gt;initialize(vm,
-                this, m_globalObject-&gt;objectPrototype(), inferredInlineCapacity);
</del><ins>+            objectAllocationProfile-&gt;initialize(*vm(),
+                ownerExecutable, m_globalObject-&gt;objectPrototype(), inferredInlineCapacity);
</ins><span class="cx">             break;
</span><span class="cx">         }
</span><span class="cx"> 
</span><span class="lines">@@ -2001,11 +1925,11 @@
</span><span class="cx">                     // Keep the linked module environment strongly referenced.
</span><span class="cx">                     if (stronglyReferencedModuleEnvironments.add(jsCast&lt;JSModuleEnvironment*&gt;(op.lexicalEnvironment)).isNewEntry)
</span><span class="cx">                         addConstant(op.lexicalEnvironment);
</span><del>-                    instructions[i + 6].u.jsCell.set(vm, this, op.lexicalEnvironment);
</del><ins>+                    instructions[i + 6].u.jsCell.set(*vm(), ownerExecutable, op.lexicalEnvironment);
</ins><span class="cx">                 } else
</span><del>-                    instructions[i + 6].u.symbolTable.set(vm, this, op.lexicalEnvironment-&gt;symbolTable());
</del><ins>+                    instructions[i + 6].u.symbolTable.set(*vm(), ownerExecutable, op.lexicalEnvironment-&gt;symbolTable());
</ins><span class="cx">             } else if (JSScope* constantScope = JSScope::constantScopeForCodeBlock(op.type, this))
</span><del>-                instructions[i + 6].u.jsCell.set(vm, this, constantScope);
</del><ins>+                instructions[i + 6].u.jsCell.set(*vm(), ownerExecutable, constantScope);
</ins><span class="cx">             else
</span><span class="cx">                 instructions[i + 6].u.pointer = nullptr;
</span><span class="cx">             break;
</span><span class="lines">@@ -2038,7 +1962,7 @@
</span><span class="cx">             if (op.type == GlobalVar || op.type == GlobalVarWithVarInjectionChecks || op.type == GlobalLexicalVar || op.type == GlobalLexicalVarWithVarInjectionChecks)
</span><span class="cx">                 instructions[i + 5].u.watchpointSet = op.watchpointSet;
</span><span class="cx">             else if (op.structure)
</span><del>-                instructions[i + 5].u.structure.set(vm, this, op.structure);
</del><ins>+                instructions[i + 5].u.structure.set(*vm(), ownerExecutable, op.structure);
</ins><span class="cx">             instructions[i + 6].u.pointer = reinterpret_cast&lt;void*&gt;(op.operand);
</span><span class="cx">             break;
</span><span class="cx">         }
</span><span class="lines">@@ -2075,14 +1999,14 @@
</span><span class="cx">                 if (op.watchpointSet)
</span><span class="cx">                     op.watchpointSet-&gt;invalidate(PutToScopeFireDetail(this, ident));
</span><span class="cx">             } else if (op.structure)
</span><del>-                instructions[i + 5].u.structure.set(vm, this, op.structure);
</del><ins>+                instructions[i + 5].u.structure.set(*vm(), ownerExecutable, op.structure);
</ins><span class="cx">             instructions[i + 6].u.pointer = reinterpret_cast&lt;void*&gt;(op.operand);
</span><span class="cx"> 
</span><span class="cx">             break;
</span><span class="cx">         }
</span><span class="cx"> 
</span><span class="cx">         case op_profile_type: {
</span><del>-            RELEASE_ASSERT(vm.typeProfiler());
</del><ins>+            RELEASE_ASSERT(vm()-&gt;typeProfiler());
</ins><span class="cx">             // The format of this instruction is: op_profile_type regToProfile, TypeLocation*, flag, identifier?, resolveType?
</span><span class="cx">             size_t instructionOffset = i + opLength - 1;
</span><span class="cx">             unsigned divotStart, divotEnd;
</span><span class="lines">@@ -2112,8 +2036,8 @@
</span><span class="cx">                     ConcurrentJITLocker locker(symbolTable-&gt;m_lock);
</span><span class="cx">                     // If our parent scope was created while profiling was disabled, it will not have prepared for profiling yet.
</span><span class="cx">                     symbolTable-&gt;prepareForTypeProfiling(locker);
</span><del>-                    globalVariableID = symbolTable-&gt;uniqueIDForVariable(locker, impl, vm);
-                    globalTypeSet = symbolTable-&gt;globalTypeSetForVariable(locker, impl, vm);
</del><ins>+                    globalVariableID = symbolTable-&gt;uniqueIDForVariable(locker, impl, *vm());
+                    globalTypeSet = symbolTable-&gt;globalTypeSetForVariable(locker, impl, *vm());
</ins><span class="cx">                 } else
</span><span class="cx">                     globalVariableID = TypeProfilerNoGlobalIDExists;
</span><span class="cx"> 
</span><span class="lines">@@ -2126,8 +2050,8 @@
</span><span class="cx">                 const Identifier&amp; ident = identifier(pc[4].u.operand);
</span><span class="cx">                 ConcurrentJITLocker locker(symbolTable-&gt;m_lock);
</span><span class="cx">                 // If our parent scope was created while profiling was disabled, it will not have prepared for profiling yet.
</span><del>-                globalVariableID = symbolTable-&gt;uniqueIDForVariable(locker, ident.impl(), vm);
-                globalTypeSet = symbolTable-&gt;globalTypeSetForVariable(locker, ident.impl(), vm);
</del><ins>+                globalVariableID = symbolTable-&gt;uniqueIDForVariable(locker, ident.impl(), *vm());
+                globalTypeSet = symbolTable-&gt;globalTypeSetForVariable(locker, ident.impl(), *vm());
</ins><span class="cx"> 
</span><span class="cx">                 break;
</span><span class="cx">             }
</span><span class="lines">@@ -2153,8 +2077,8 @@
</span><span class="cx">             }
</span><span class="cx">             }
</span><span class="cx"> 
</span><del>-            std::pair&lt;TypeLocation*, bool&gt; locationPair = vm.typeProfiler()-&gt;typeLocationCache()-&gt;getTypeLocation(globalVariableID,
-                ownerExecutable-&gt;sourceID(), divotStart, divotEnd, globalTypeSet, &amp;vm);
</del><ins>+            std::pair&lt;TypeLocation*, bool&gt; locationPair = vm()-&gt;typeProfiler()-&gt;typeLocationCache()-&gt;getTypeLocation(globalVariableID,
+                ownerExecutable-&gt;sourceID(), divotStart, divotEnd, globalTypeSet, vm());
</ins><span class="cx">             TypeLocation* location = locationPair.first;
</span><span class="cx">             bool isNewLocation = locationPair.second;
</span><span class="cx"> 
</span><span class="lines">@@ -2162,7 +2086,7 @@
</span><span class="cx">                 location-&gt;m_divotForFunctionOffsetIfReturnStatement = ownerExecutable-&gt;typeProfilingStartOffset();
</span><span class="cx"> 
</span><span class="cx">             if (shouldAnalyze &amp;&amp; isNewLocation)
</span><del>-                vm.typeProfiler()-&gt;insertNewLocation(location);
</del><ins>+                vm()-&gt;typeProfiler()-&gt;insertNewLocation(location);
</ins><span class="cx"> 
</span><span class="cx">             instructions[i + 2].u.location = location;
</span><span class="cx">             break;
</span><span class="lines">@@ -2180,7 +2104,7 @@
</span><span class="cx">         i += opLength;
</span><span class="cx">     }
</span><span class="cx"> 
</span><del>-    if (vm.controlFlowProfiler())
</del><ins>+    if (vm()-&gt;controlFlowProfiler())
</ins><span class="cx">         insertBasicBlockBoundariesForControlFlowProfiler(instructions);
</span><span class="cx"> 
</span><span class="cx">     m_instructions = WTF::RefCountedArray&lt;Instruction&gt;(instructions);
</span><span class="lines">@@ -2200,13 +2124,12 @@
</span><span class="cx">         dumpBytecode();
</span><span class="cx">     
</span><span class="cx">     m_heap-&gt;m_codeBlocks.add(this);
</span><del>-    m_heap-&gt;reportExtraMemoryAllocated(m_instructions.size() * sizeof(Instruction));
</del><ins>+    m_heap-&gt;reportExtraMemoryAllocated(sizeof(CodeBlock) + m_instructions.size() * sizeof(Instruction));
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> #if ENABLE(WEBASSEMBLY)
</span><del>-CodeBlock::CodeBlock(VM* vm, Structure* structure, WebAssemblyExecutable* ownerExecutable, VM&amp; vm, JSGlobalObject* globalObject)
-    : JSCell(vm, structure)
-    , m_globalObject(globalObject-&gt;vm(), this, globalObject)
</del><ins>+CodeBlock::CodeBlock(WebAssemblyExecutable* ownerExecutable, VM&amp; vm, JSGlobalObject* globalObject)
+    : m_globalObject(globalObject-&gt;vm(), ownerExecutable, globalObject)
</ins><span class="cx">     , m_heap(&amp;m_globalObject-&gt;vm().heap)
</span><span class="cx">     , m_numCalleeRegisters(0)
</span><span class="cx">     , m_numVars(0)
</span><span class="lines">@@ -2217,7 +2140,7 @@
</span><span class="cx">     , m_hasDebuggerStatement(false)
</span><span class="cx">     , m_steppingMode(SteppingModeDisabled)
</span><span class="cx">     , m_numBreakpoints(0)
</span><del>-    , m_ownerExecutable(m_globalObject-&gt;vm(), this, ownerExecutable)
</del><ins>+    , m_ownerExecutable(m_globalObject-&gt;vm(), ownerExecutable, ownerExecutable)
</ins><span class="cx">     , m_vm(&amp;vm)
</span><span class="cx">     , m_isStrictMode(false)
</span><span class="cx">     , m_needsActivation(false)
</span><span class="lines">@@ -2231,13 +2154,9 @@
</span><span class="cx"> #endif
</span><span class="cx"> {
</span><span class="cx">     ASSERT(m_heap-&gt;isDeferred());
</span><del>-}
</del><span class="cx"> 
</span><del>-void CodeBlock::finishCreation(VM&amp; vm, WebAssemblyExecutable*, JSGlobalObject*)
-{
-    Base::finishCreation(vm);
-
</del><span class="cx">     m_heap-&gt;m_codeBlocks.add(this);
</span><ins>+    m_heap-&gt;reportExtraMemoryAllocated(sizeof(CodeBlock));
</ins><span class="cx"> }
</span><span class="cx"> #endif
</span><span class="cx"> 
</span><span class="lines">@@ -2249,20 +2168,24 @@
</span><span class="cx"> #if ENABLE(VERBOSE_VALUE_PROFILE)
</span><span class="cx">     dumpValueProfiles();
</span><span class="cx"> #endif
</span><del>-
</del><ins>+    while (m_incomingLLIntCalls.begin() != m_incomingLLIntCalls.end())
+        m_incomingLLIntCalls.begin()-&gt;remove();
+#if ENABLE(JIT)
</ins><span class="cx">     // We may be destroyed before any CodeBlocks that refer to us are destroyed.
</span><span class="cx">     // Consider that two CodeBlocks become unreachable at the same time. There
</span><span class="cx">     // is no guarantee about the order in which the CodeBlocks are destroyed.
</span><span class="cx">     // So, if we don't remove incoming calls, and get destroyed before the
</span><span class="cx">     // CodeBlock(s) that have calls into us, then the CallLinkInfo vector's
</span><span class="cx">     // destructor will try to remove nodes from our (no longer valid) linked list.
</span><del>-    unlinkIncomingCalls();
</del><ins>+    while (m_incomingCalls.begin() != m_incomingCalls.end())
+        m_incomingCalls.begin()-&gt;remove();
+    while (m_incomingPolymorphicCalls.begin() != m_incomingPolymorphicCalls.end())
+        m_incomingPolymorphicCalls.begin()-&gt;remove();
</ins><span class="cx">     
</span><span class="cx">     // Note that our outgoing calls will be removed from other CodeBlocks'
</span><span class="cx">     // m_incomingCalls linked lists through the execution of the ~CallLinkInfo
</span><span class="cx">     // destructors.
</span><span class="cx"> 
</span><del>-#if ENABLE(JIT)
</del><span class="cx">     for (Bag&lt;StructureStubInfo&gt;::iterator iter = m_stubInfos.begin(); !!iter; ++iter) {
</span><span class="cx">         StructureStubInfo* stub = *iter;
</span><span class="cx">         stub-&gt;aboutToDie();
</span><span class="lines">@@ -2271,11 +2194,6 @@
</span><span class="cx"> #endif // ENABLE(JIT)
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-void CodeBlock::setAlternative(VM&amp; vm, CodeBlock* alternative)
-{
-    m_alternative.set(vm, this, alternative);
-}
-
</del><span class="cx"> void CodeBlock::setNumParameters(int newValue)
</span><span class="cx"> {
</span><span class="cx">     m_numParameters = newValue;
</span><span class="lines">@@ -2296,43 +2214,73 @@
</span><span class="cx">     if (jitType() != JITCode::DFGJIT)
</span><span class="cx">         return 0;
</span><span class="cx">     DFG::JITCode* jitCode = m_jitCode-&gt;dfg();
</span><del>-    return jitCode-&gt;osrEntryBlock();
</del><ins>+    return jitCode-&gt;osrEntryBlock.get();
</ins><span class="cx"> #else // ENABLE(FTL_JIT)
</span><span class="cx">     return 0;
</span><span class="cx"> #endif // ENABLE(FTL_JIT)
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-void CodeBlock::visitWeakly(SlotVisitor&amp; visitor)
</del><ins>+void CodeBlock::visitStrongly(SlotVisitor&amp; visitor)
</ins><span class="cx"> {
</span><del>-    bool setByMe = m_visitWeaklyHasBeenCalled.compareExchangeStrong(false, true);
</del><ins>+    bool setByMe = m_visitStronglyHasBeenCalled.compareExchangeStrong(false, true);
</ins><span class="cx">     if (!setByMe)
</span><span class="cx">         return;
</span><span class="cx"> 
</span><del>-    if (Heap::isMarked(this))
-        return;
</del><ins>+    visitAggregate(visitor);
</ins><span class="cx"> 
</span><del>-    if (shouldVisitStrongly()) {
-        visitor.appendUnbarrieredReadOnlyPointer(this);
</del><ins>+    stronglyVisitStrongReferences(visitor);
+    stronglyVisitWeakReferences(visitor);
+    propagateTransitions(visitor);
+}
+
+void CodeBlock::visitAggregate(SlotVisitor&amp; visitor)
+{
+    // I may be asked to scan myself more than once, and it may even happen concurrently.
+    // To this end, use an atomic operation to check (and set) if I've been called already.
+    // Only one thread may proceed past this point - whichever one wins the atomic set race.
+    bool setByMe = m_visitAggregateHasBeenCalled.compareExchangeStrong(false, true);
+    if (!setByMe)
</ins><span class="cx">         return;
</span><ins>+    
+    if (!!m_alternative)
+        m_alternative-&gt;visitAggregate(visitor);
+    
+    if (CodeBlock* otherBlock = specialOSREntryBlockOrNull())
+        otherBlock-&gt;visitAggregate(visitor);
+
+    visitor.reportExtraMemoryVisited(sizeof(CodeBlock));
+    if (m_jitCode)
+        visitor.reportExtraMemoryVisited(m_jitCode-&gt;size());
+    if (m_instructions.size()) {
+        // Divide by refCount() because m_instructions points to something that is shared
+        // by multiple CodeBlocks, and we only want to count it towards the heap size once.
+        // Having each CodeBlock report only its proportional share of the size is one way
+        // of accomplishing this.
+        visitor.reportExtraMemoryVisited(m_instructions.size() * sizeof(Instruction) / m_instructions.refCount());
</ins><span class="cx">     }
</span><span class="cx"> 
</span><ins>+    visitor.append(&amp;m_unlinkedCode);
+
</ins><span class="cx">     // There are two things that may use unconditional finalizers: inline cache clearing
</span><span class="cx">     // and jettisoning. The probability of us wanting to do at least one of those things
</span><span class="cx">     // is probably quite close to 1. So we add one no matter what and when it runs, it
</span><span class="cx">     // figures out whether it has any work to do.
</span><del>-    visitor.addUnconditionalFinalizer(&amp;m_unconditionalFinalizer);
-
</del><ins>+    visitor.addUnconditionalFinalizer(this);
+    
+    m_allTransitionsHaveBeenMarked = false;
+    
+    if (shouldVisitStrongly()) {
+        visitStrongly(visitor);
+        return;
+    }
+    
</ins><span class="cx">     if (!JITCode::isOptimizingJIT(jitType()))
</span><span class="cx">         return;
</span><span class="cx"> 
</span><del>-    // If we jettison ourselves we'll install our alternative, so make sure that it
-    // survives GC even if we don't.
-    visitor.append(&amp;m_alternative);
-    
</del><span class="cx">     // There are two things that we use weak reference harvesters for: DFG fixpoint for
</span><span class="cx">     // jettisoning, and trying to find structures that would be live based on some
</span><span class="cx">     // inline cache. So it makes sense to register them regardless.
</span><del>-    visitor.addWeakReferenceHarvester(&amp;m_weakReferenceHarvester);
</del><ins>+    visitor.addWeakReferenceHarvester(this);
</ins><span class="cx"> 
</span><span class="cx"> #if ENABLE(DFG_JIT)
</span><span class="cx">     // We get here if we're live in the sense that our owner executable is live,
</span><span class="lines">@@ -2343,48 +2291,14 @@
</span><span class="cx">     // either us marking additional objects, or by other objects being marked for
</span><span class="cx">     // other reasons, that this iteration should run again; it will notify us of this
</span><span class="cx">     // decision by calling harvestWeakReferences().
</span><del>-
-    m_allTransitionsHaveBeenMarked = false;
-    propagateTransitions(visitor);
-
</del><ins>+    
</ins><span class="cx">     m_jitCode-&gt;dfgCommon()-&gt;livenessHasBeenProved = false;
</span><ins>+    
+    propagateTransitions(visitor);
</ins><span class="cx">     determineLiveness(visitor);
</span><span class="cx"> #endif // ENABLE(DFG_JIT)
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-void CodeBlock::visitChildren(JSCell* cell, SlotVisitor&amp; visitor)
-{
-    CodeBlock* thisObject = jsCast&lt;CodeBlock*&gt;(cell);
-    ASSERT_GC_OBJECT_INHERITS(thisObject, info());
-    JSCell::visitChildren(thisObject, visitor);
-    thisObject-&gt;visitChildren(visitor);
-}
-
-void CodeBlock::visitChildren(SlotVisitor&amp; visitor)
-{
-    // There are two things that may use unconditional finalizers: inline cache clearing
-    // and jettisoning. The probability of us wanting to do at least one of those things
-    // is probably quite close to 1. So we add one no matter what and when it runs, it
-    // figures out whether it has any work to do.
-    visitor.addUnconditionalFinalizer(&amp;m_unconditionalFinalizer);
-
-    if (CodeBlock* otherBlock = specialOSREntryBlockOrNull())
-        visitor.appendUnbarrieredReadOnlyPointer(otherBlock);
-
-    if (m_jitCode)
-        visitor.reportExtraMemoryVisited(m_jitCode-&gt;size());
-    if (m_instructions.size())
-        visitor.reportExtraMemoryVisited(m_instructions.size() * sizeof(Instruction) / m_instructions.refCount());
-
-    visitor.append(&amp;m_unlinkedCode);
-
-    stronglyVisitStrongReferences(visitor);
-    stronglyVisitWeakReferences(visitor);
-
-    m_allTransitionsHaveBeenMarked = false;
-    propagateTransitions(visitor);
-}
-
</del><span class="cx"> bool CodeBlock::shouldVisitStrongly()
</span><span class="cx"> {
</span><span class="cx">     if (Options::forceCodeBlockLiveness())
</span><span class="lines">@@ -2412,7 +2326,17 @@
</span><span class="cx">     //   because livenessHasBeenProved would have survived as true.
</span><span class="cx">     // - Code blocks that don't have any dead weak references.
</span><span class="cx"> 
</span><del>-    return Heap::isMarked(this);
</del><ins>+    if (m_visitStronglyHasBeenCalled.load(std::memory_order_relaxed))
+        return true;
+
+#if ENABLE(DFG_JIT)
+    if (JITCode::isOptimizingJIT(jitType())) {
+        if (m_jitCode-&gt;dfgCommon()-&gt;livenessHasBeenProved)
+            return true;
+    }
+#endif
+
+    return false;
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> bool CodeBlock::shouldJettisonDueToWeakReference()
</span><span class="lines">@@ -2422,34 +2346,12 @@
</span><span class="cx">     return !isKnownToBeLiveDuringGC();
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-static std::chrono::milliseconds timeToLive(JITCode::JITType jitType)
-{
-    switch (jitType) {
-    case JITCode::InterpreterThunk:
-        return std::chrono::duration_cast&lt;std::chrono::milliseconds&gt;(
-            std::chrono::seconds(5));
-    case JITCode::BaselineJIT:
-        // Effectively 10 additional seconds, since BaselineJIT and
-        // InterpreterThunk share a CodeBlock.
-        return std::chrono::duration_cast&lt;std::chrono::milliseconds&gt;(
-            std::chrono::seconds(15));
-    case JITCode::DFGJIT:
-        return std::chrono::duration_cast&lt;std::chrono::milliseconds&gt;(
-            std::chrono::seconds(20));
-    case JITCode::FTLJIT:
-        return std::chrono::duration_cast&lt;std::chrono::milliseconds&gt;(
-            std::chrono::seconds(60));
-    default:
-        return std::chrono::milliseconds::max();
-    }
-}
-
</del><span class="cx"> bool CodeBlock::shouldJettisonDueToOldAge()
</span><span class="cx"> {
</span><del>-    if (Heap::isMarked(this))
</del><ins>+    if (m_visitStronglyHasBeenCalled.load(std::memory_order_relaxed))
</ins><span class="cx">         return false;
</span><span class="cx"> 
</span><del>-    if (timeSinceCreation() &lt; timeToLive(jitType()))
</del><ins>+    if (timeSinceCreation() &lt; JITCode::timeToLive(jitType()))
</ins><span class="cx">         return false;
</span><span class="cx"> 
</span><span class="cx">     return true;
</span><span class="lines">@@ -2602,18 +2504,14 @@
</span><span class="cx">     // All weak references are live. Record this information so we don't
</span><span class="cx">     // come back here again, and scan the strong references.
</span><span class="cx">     dfgCommon-&gt;livenessHasBeenProved = true;
</span><del>-    visitor.appendUnbarrieredReadOnlyPointer(this);
</del><ins>+    stronglyVisitStrongReferences(visitor);
</ins><span class="cx"> #endif // ENABLE(DFG_JIT)
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-void CodeBlock::WeakReferenceHarvester::visitWeakReferences(SlotVisitor&amp; visitor)
</del><ins>+void CodeBlock::visitWeakReferences(SlotVisitor&amp; visitor)
</ins><span class="cx"> {
</span><del>-    CodeBlock* codeBlock =
-        bitwise_cast&lt;CodeBlock*&gt;(
-            bitwise_cast&lt;char*&gt;(this) - OBJECT_OFFSETOF(CodeBlock, m_weakReferenceHarvester));
-
-    codeBlock-&gt;propagateTransitions(visitor);
-    codeBlock-&gt;determineLiveness(visitor);
</del><ins>+    propagateTransitions(visitor);
+    determineLiveness(visitor);
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> void CodeBlock::finalizeLLIntInlineCaches()
</span><span class="lines">@@ -2733,29 +2631,26 @@
</span><span class="cx"> #endif
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-void CodeBlock::UnconditionalFinalizer::finalizeUnconditionally()
</del><ins>+void CodeBlock::finalizeUnconditionally()
</ins><span class="cx"> {
</span><del>-    CodeBlock* codeBlock = bitwise_cast&lt;CodeBlock*&gt;(
-        bitwise_cast&lt;char*&gt;(this) - OBJECT_OFFSETOF(CodeBlock, m_unconditionalFinalizer));
-
</del><span class="cx"> #if ENABLE(DFG_JIT)
</span><del>-    if (codeBlock-&gt;shouldJettisonDueToWeakReference()) {
-        codeBlock-&gt;jettison(Profiler::JettisonDueToWeakReference);
</del><ins>+    if (shouldJettisonDueToWeakReference()) {
+        jettison(Profiler::JettisonDueToWeakReference);
</ins><span class="cx">         return;
</span><span class="cx">     }
</span><span class="cx"> #endif // ENABLE(DFG_JIT)
</span><span class="cx"> 
</span><del>-    if (codeBlock-&gt;shouldJettisonDueToOldAge()) {
-        codeBlock-&gt;jettison(Profiler::JettisonDueToOldAge);
</del><ins>+    if (shouldJettisonDueToOldAge()) {
+        jettison(Profiler::JettisonDueToOldAge);
</ins><span class="cx">         return;
</span><span class="cx">     }
</span><span class="cx"> 
</span><del>-    if (JITCode::couldBeInterpreted(codeBlock-&gt;jitType()))
-        codeBlock-&gt;finalizeLLIntInlineCaches();
</del><ins>+    if (JITCode::couldBeInterpreted(jitType()))
+        finalizeLLIntInlineCaches();
</ins><span class="cx"> 
</span><span class="cx"> #if ENABLE(JIT)
</span><del>-    if (!!codeBlock-&gt;jitCode())
-        codeBlock-&gt;finalizeBaselineJITInlineCaches();
</del><ins>+    if (!!jitCode())
+        finalizeBaselineJITInlineCaches();
</ins><span class="cx"> #endif
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="lines">@@ -2850,14 +2745,14 @@
</span><span class="cx">     // guaranteeing that it matches the details of the CodeBlock we compiled
</span><span class="cx">     // the OSR exit against.
</span><span class="cx"> 
</span><del>-    visitor.append(&amp;m_alternative);
</del><ins>+    alternative()-&gt;visitStrongly(visitor);
</ins><span class="cx"> 
</span><span class="cx"> #if ENABLE(DFG_JIT)
</span><span class="cx">     DFG::CommonData* dfgCommon = m_jitCode-&gt;dfgCommon();
</span><span class="cx">     if (dfgCommon-&gt;inlineCallFrames) {
</span><span class="cx">         for (auto* inlineCallFrame : *dfgCommon-&gt;inlineCallFrames) {
</span><del>-            ASSERT(inlineCallFrame-&gt;baselineCodeBlock);
-            visitor.append(&amp;inlineCallFrame-&gt;baselineCodeBlock);
</del><ins>+            ASSERT(inlineCallFrame-&gt;baselineCodeBlock());
+            inlineCallFrame-&gt;baselineCodeBlock()-&gt;visitStrongly(visitor);
</ins><span class="cx">         }
</span><span class="cx">     }
</span><span class="cx"> #endif
</span><span class="lines">@@ -3099,6 +2994,8 @@
</span><span class="cx">     while (m_incomingLLIntCalls.begin() != m_incomingLLIntCalls.end())
</span><span class="cx">         m_incomingLLIntCalls.begin()-&gt;unlink();
</span><span class="cx"> #if ENABLE(JIT)
</span><ins>+    if (m_incomingCalls.isEmpty() &amp;&amp; m_incomingPolymorphicCalls.isEmpty())
+        return;
</ins><span class="cx">     while (m_incomingCalls.begin() != m_incomingCalls.end())
</span><span class="cx">         m_incomingCalls.begin()-&gt;unlink(*vm());
</span><span class="cx">     while (m_incomingPolymorphicCalls.begin() != m_incomingPolymorphicCalls.end())
</span><span class="lines">@@ -3112,67 +3009,67 @@
</span><span class="cx">     m_incomingLLIntCalls.push(incoming);
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-CodeBlock* CodeBlock::newReplacement()
</del><ins>+PassRefPtr&lt;CodeBlock&gt; CodeBlock::newReplacement()
</ins><span class="cx"> {
</span><span class="cx">     return ownerScriptExecutable()-&gt;newReplacementCodeBlockFor(specializationKind());
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> #if ENABLE(JIT)
</span><del>-CodeBlock* CodeBlock::replacement()
</del><ins>+CodeBlock* ProgramCodeBlock::replacement()
</ins><span class="cx"> {
</span><del>-    const ClassInfo* classInfo = this-&gt;classInfo();
</del><ins>+    return jsCast&lt;ProgramExecutable*&gt;(ownerExecutable())-&gt;codeBlock();
+}
</ins><span class="cx"> 
</span><del>-    if (classInfo == FunctionCodeBlock::info())
-        return jsCast&lt;FunctionExecutable*&gt;(ownerExecutable())-&gt;codeBlockFor(m_isConstructor ? CodeForConstruct : CodeForCall);
</del><ins>+CodeBlock* ModuleProgramCodeBlock::replacement()
+{
+    return jsCast&lt;ModuleProgramExecutable*&gt;(ownerExecutable())-&gt;codeBlock();
+}
</ins><span class="cx"> 
</span><del>-    if (classInfo == EvalCodeBlock::info())
-        return jsCast&lt;EvalExecutable*&gt;(ownerExecutable())-&gt;codeBlock();
</del><ins>+CodeBlock* EvalCodeBlock::replacement()
+{
+    return jsCast&lt;EvalExecutable*&gt;(ownerExecutable())-&gt;codeBlock();
+}
</ins><span class="cx"> 
</span><del>-    if (classInfo == ProgramCodeBlock::info())
-        return jsCast&lt;ProgramExecutable*&gt;(ownerExecutable())-&gt;codeBlock();
</del><ins>+CodeBlock* FunctionCodeBlock::replacement()
+{
+    return jsCast&lt;FunctionExecutable*&gt;(ownerExecutable())-&gt;codeBlockFor(m_isConstructor ? CodeForConstruct : CodeForCall);
+}
</ins><span class="cx"> 
</span><del>-    if (classInfo == ModuleProgramCodeBlock::info())
-        return jsCast&lt;ModuleProgramExecutable*&gt;(ownerExecutable())-&gt;codeBlock();
</del><ins>+DFG::CapabilityLevel ProgramCodeBlock::capabilityLevelInternal()
+{
+    return DFG::programCapabilityLevel(this);
+}
</ins><span class="cx"> 
</span><del>-#if ENABLE(WEBASSEMBLY)
-    if (classInfo == WebAssemblyCodeBlock::info())
-        return nullptr;
-#endif
</del><ins>+DFG::CapabilityLevel ModuleProgramCodeBlock::capabilityLevelInternal()
+{
+    return DFG::programCapabilityLevel(this);
+}
</ins><span class="cx"> 
</span><del>-    RELEASE_ASSERT_NOT_REACHED();
-    return nullptr;
</del><ins>+DFG::CapabilityLevel EvalCodeBlock::capabilityLevelInternal()
+{
+    return DFG::evalCapabilityLevel(this);
</ins><span class="cx"> }
</span><span class="cx"> 
</span><del>-DFG::CapabilityLevel CodeBlock::computeCapabilityLevel()
</del><ins>+DFG::CapabilityLevel FunctionCodeBlock::capabilityLevelInternal()
</ins><span class="cx"> {
</span><del>-    const ClassInfo* classInfo = this-&gt;classInfo();
</del><ins>+    if (m_isConstructor)
+        return DFG::functionForConstructCapabilityLevel(this);
+    return DFG::functionForCallCapabilityLevel(this);
+}
</ins><span class="cx"> 
</span><del>-    if (classInfo == FunctionCodeBlock::info()) {
-        if (m_isConstructor)
-            return DFG::functionForConstructCapabilityLevel(this);
-        return DFG::functionForCallCapabilityLevel(this);
-    }
-
-    if (classInfo == EvalCodeBlock::info())
-        return DFG::evalCapabilityLevel(this);
-
-    if (classInfo == ProgramCodeBlock::info())
-        return DFG::programCapabilityLevel(this);
-
-    if (classInfo == ModuleProgramCodeBlock::info())
-        return DFG::programCapabilityLevel(this);
-
</del><span class="cx"> #if ENABLE(WEBASSEMBLY)
</span><del>-    if (classInfo == WebAssemblyCodeBlock::info())
-        return DFG::CannotCompile;
-#endif
</del><ins>+CodeBlock* WebAssemblyCodeBlock::replacement()
+{
+    return nullptr;
+}
</ins><span class="cx"> 
</span><del>-    RELEASE_ASSERT_NOT_REACHED();
</del><ins>+DFG::CapabilityLevel WebAssemblyCodeBlock::capabilityLevelInternal()
+{
</ins><span class="cx">     return DFG::CannotCompile;
</span><span class="cx"> }
</span><ins>+#endif
+#endif
</ins><span class="cx"> 
</span><del>-#endif // ENABLE(JIT)
-
</del><span class="cx"> void CodeBlock::jettison(Profiler::JettisonReason reason, ReoptimizationMode mode, const FireDetail* detail)
</span><span class="cx"> {
</span><span class="cx"> #if !ENABLE(DFG_JIT)
</span><span class="lines">@@ -3275,7 +3172,7 @@
</span><span class="cx"> {
</span><span class="cx">     if (!codeOrigin.inlineCallFrame)
</span><span class="cx">         return globalObject();
</span><del>-    return codeOrigin.inlineCallFrame-&gt;baselineCodeBlock-&gt;globalObject();
</del><ins>+    return jsCast&lt;FunctionExecutable*&gt;(codeOrigin.inlineCallFrame-&gt;executable.get())-&gt;eitherCodeBlock()-&gt;globalObject();
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> class RecursionCheckFunctor {
</span><span class="lines">@@ -4115,7 +4012,7 @@
</span><span class="cx"> #if ENABLE(JIT)
</span><span class="cx"> DFG::CapabilityLevel CodeBlock::capabilityLevel()
</span><span class="cx"> {
</span><del>-    DFG::CapabilityLevel result = computeCapabilityLevel();
</del><ins>+    DFG::CapabilityLevel result = capabilityLevelInternal();
</ins><span class="cx">     m_capabilityLevelState = result;
</span><span class="cx">     return result;
</span><span class="cx"> }
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorebytecodeCodeBlockh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/bytecode/CodeBlock.h (190808 => 190809)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/bytecode/CodeBlock.h        2015-10-09 17:53:28 UTC (rev 190808)
+++ trunk/Source/JavaScriptCore/bytecode/CodeBlock.h        2015-10-09 17:54:16 UTC (rev 190809)
</span><span class="lines">@@ -38,10 +38,10 @@
</span><span class="cx"> #include &quot;CallReturnOffsetToBytecodeOffset.h&quot;
</span><span class="cx"> #include &quot;CodeBlockHash.h&quot;
</span><span class="cx"> #include &quot;CodeBlockSet.h&quot;
</span><ins>+#include &quot;ConcurrentJITLock.h&quot;
</ins><span class="cx"> #include &quot;CodeOrigin.h&quot;
</span><span class="cx"> #include &quot;CodeType.h&quot;
</span><span class="cx"> #include &quot;CompactJITCodeMap.h&quot;
</span><del>-#include &quot;ConcurrentJITLock.h&quot;
</del><span class="cx"> #include &quot;DFGCommon.h&quot;
</span><span class="cx"> #include &quot;DFGExitProfile.h&quot;
</span><span class="cx"> #include &quot;DeferredCompilationCallback.h&quot;
</span><span class="lines">@@ -49,19 +49,18 @@
</span><span class="cx"> #include &quot;ExecutionCounter.h&quot;
</span><span class="cx"> #include &quot;ExpressionRangeInfo.h&quot;
</span><span class="cx"> #include &quot;HandlerInfo.h&quot;
</span><ins>+#include &quot;ObjectAllocationProfile.h&quot;
+#include &quot;Options.h&quot;
+#include &quot;PutPropertySlot.h&quot;
</ins><span class="cx"> #include &quot;Instruction.h&quot;
</span><span class="cx"> #include &quot;JITCode.h&quot;
</span><span class="cx"> #include &quot;JITWriteBarrier.h&quot;
</span><del>-#include &quot;JSCell.h&quot;
</del><span class="cx"> #include &quot;JSGlobalObject.h&quot;
</span><span class="cx"> #include &quot;JumpTable.h&quot;
</span><span class="cx"> #include &quot;LLIntCallLinkInfo.h&quot;
</span><span class="cx"> #include &quot;LazyOperandValueProfile.h&quot;
</span><del>-#include &quot;ObjectAllocationProfile.h&quot;
-#include &quot;Options.h&quot;
</del><span class="cx"> #include &quot;ProfilerCompilation.h&quot;
</span><span class="cx"> #include &quot;ProfilerJettisonReason.h&quot;
</span><del>-#include &quot;PutPropertySlot.h&quot;
</del><span class="cx"> #include &quot;RegExpObject.h&quot;
</span><span class="cx"> #include &quot;StructureStubInfo.h&quot;
</span><span class="cx"> #include &quot;UnconditionalFinalizer.h&quot;
</span><span class="lines">@@ -86,45 +85,26 @@
</span><span class="cx"> 
</span><span class="cx"> enum ReoptimizationMode { DontCountReoptimization, CountReoptimization };
</span><span class="cx"> 
</span><del>-class CodeBlock : public JSCell {
-    typedef JSCell Base;
</del><ins>+class CodeBlock : public ThreadSafeRefCounted&lt;CodeBlock&gt;, public UnconditionalFinalizer, public WeakReferenceHarvester {
+    WTF_MAKE_FAST_ALLOCATED;
</ins><span class="cx">     friend class BytecodeLivenessAnalysis;
</span><span class="cx">     friend class JIT;
</span><span class="cx">     friend class LLIntOffsetsExtractor;
</span><del>-
-    class UnconditionalFinalizer : public JSC::UnconditionalFinalizer { 
-        virtual void finalizeUnconditionally() override;
-    };
-
-    class WeakReferenceHarvester : public JSC::WeakReferenceHarvester {
-        virtual void visitWeakReferences(SlotVisitor&amp;) override;
-    };
-
</del><span class="cx"> public:
</span><span class="cx">     enum CopyParsedBlockTag { CopyParsedBlock };
</span><del>-
-    static const unsigned StructureFlags = Base::StructureFlags | StructureIsImmortal;
-
-    DECLARE_INFO;
-
</del><span class="cx"> protected:
</span><del>-    CodeBlock(VM*, Structure*, CopyParsedBlockTag, CodeBlock&amp; other);
-    CodeBlock(VM*, Structure*, ScriptExecutable* ownerExecutable, UnlinkedCodeBlock*, JSScope*, PassRefPtr&lt;SourceProvider&gt;, unsigned sourceOffset, unsigned firstLineColumnOffset);
</del><ins>+    CodeBlock(CopyParsedBlockTag, CodeBlock&amp; other);
+        
+    CodeBlock(ScriptExecutable* ownerExecutable, UnlinkedCodeBlock*, JSScope*, PassRefPtr&lt;SourceProvider&gt;, unsigned sourceOffset, unsigned firstLineColumnOffset);
</ins><span class="cx"> #if ENABLE(WEBASSEMBLY)
</span><del>-    CodeBlock(VM*, Structure*, WebAssemblyExecutable* ownerExecutable, VM&amp;, JSGlobalObject*);
</del><ins>+    CodeBlock(WebAssemblyExecutable* ownerExecutable, VM&amp;, JSGlobalObject*);
</ins><span class="cx"> #endif
</span><span class="cx"> 
</span><del>-    void finishCreation(VM&amp;, CopyParsedBlockTag, CodeBlock&amp; other);
-    void finishCreation(VM&amp;, ScriptExecutable* ownerExecutable, UnlinkedCodeBlock*, JSScope*);
-#if ENABLE(WEBASSEMBLY)
-    void finishCreation(VM&amp;, WebAssemblyExecutable* ownerExecutable, JSGlobalObject*);
-#endif
-
</del><span class="cx">     WriteBarrier&lt;JSGlobalObject&gt; m_globalObject;
</span><span class="cx">     Heap* m_heap;
</span><span class="cx"> 
</span><span class="cx"> public:
</span><del>-    JS_EXPORT_PRIVATE ~CodeBlock();
</del><ins>+    JS_EXPORT_PRIVATE virtual ~CodeBlock();
</ins><span class="cx"> 
</span><span class="cx">     UnlinkedCodeBlock* unlinkedCodeBlock() const { return m_unlinkedCode.get(); }
</span><span class="cx"> 
</span><span class="lines">@@ -144,8 +124,8 @@
</span><span class="cx">     int* addressOfNumParameters() { return &amp;m_numParameters; }
</span><span class="cx">     static ptrdiff_t offsetOfNumParameters() { return OBJECT_OFFSETOF(CodeBlock, m_numParameters); }
</span><span class="cx"> 
</span><del>-    CodeBlock* alternative() const { return static_cast&lt;CodeBlock*&gt;(m_alternative.get()); }
-    void setAlternative(VM&amp;, CodeBlock*);
</del><ins>+    CodeBlock* alternative() { return m_alternative.get(); }
+    void setAlternative(PassRefPtr&lt;CodeBlock&gt; alternative) { m_alternative = alternative; }
</ins><span class="cx"> 
</span><span class="cx">     template &lt;typename Functor&gt; void forEachRelatedCodeBlock(Functor&amp;&amp; functor)
</span><span class="cx">     {
</span><span class="lines">@@ -168,18 +148,16 @@
</span><span class="cx">     {
</span><span class="cx">         return specializationFromIsConstruct(m_isConstructor);
</span><span class="cx">     }
</span><del>-
-    CodeBlock* alternativeForJettison();    
</del><ins>+    
</ins><span class="cx">     CodeBlock* baselineAlternative();
</span><span class="cx">     
</span><span class="cx">     // FIXME: Get rid of this.
</span><span class="cx">     // https://bugs.webkit.org/show_bug.cgi?id=123677
</span><span class="cx">     CodeBlock* baselineVersion();
</span><span class="cx"> 
</span><del>-    static void visitChildren(JSCell*, SlotVisitor&amp;);
-    void visitChildren(SlotVisitor&amp;);
-    void visitWeakly(SlotVisitor&amp;);
-    void clearVisitWeaklyHasBeenCalled();
</del><ins>+    void clearMarks();
+    void visitAggregate(SlotVisitor&amp;);
+    void visitStrongly(SlotVisitor&amp;);
</ins><span class="cx"> 
</span><span class="cx">     void dumpSource();
</span><span class="cx">     void dumpSource(PrintStream&amp;);
</span><span class="lines">@@ -288,7 +266,7 @@
</span><span class="cx">     unsigned instructionCount() const { return m_instructions.size(); }
</span><span class="cx"> 
</span><span class="cx">     // Exactly equivalent to codeBlock-&gt;ownerExecutable()-&gt;newReplacementCodeBlockFor(codeBlock-&gt;specializationKind())
</span><del>-    CodeBlock* newReplacement();
</del><ins>+    PassRefPtr&lt;CodeBlock&gt; newReplacement();
</ins><span class="cx">     
</span><span class="cx">     void setJITCode(PassRefPtr&lt;JITCode&gt; code)
</span><span class="cx">     {
</span><span class="lines">@@ -314,9 +292,9 @@
</span><span class="cx">     }
</span><span class="cx">     
</span><span class="cx"> #if ENABLE(JIT)
</span><del>-    CodeBlock* replacement();
</del><ins>+    virtual CodeBlock* replacement() = 0;
</ins><span class="cx"> 
</span><del>-    DFG::CapabilityLevel computeCapabilityLevel();
</del><ins>+    virtual DFG::CapabilityLevel capabilityLevelInternal() = 0;
</ins><span class="cx">     DFG::CapabilityLevel capabilityLevel();
</span><span class="cx">     DFG::CapabilityLevel capabilityLevelState() { return m_capabilityLevelState; }
</span><span class="cx"> 
</span><span class="lines">@@ -566,7 +544,7 @@
</span><span class="cx">     {
</span><span class="cx">         unsigned result = m_constantRegisters.size();
</span><span class="cx">         m_constantRegisters.append(WriteBarrier&lt;Unknown&gt;());
</span><del>-        m_constantRegisters.last().set(m_globalObject-&gt;vm(), this, v);
</del><ins>+        m_constantRegisters.last().set(m_globalObject-&gt;vm(), m_ownerExecutable.get(), v);
</ins><span class="cx">         m_constantsSourceCodeRepresentation.append(SourceCodeRepresentation::Other);
</span><span class="cx">         return result;
</span><span class="cx">     }
</span><span class="lines">@@ -920,6 +898,8 @@
</span><span class="cx">     CallSiteIndex newExceptionHandlingCallSiteIndex(CallSiteIndex originalCallSite);
</span><span class="cx"> 
</span><span class="cx"> protected:
</span><ins>+    virtual void visitWeakReferences(SlotVisitor&amp;) override;
+    virtual void finalizeUnconditionally() override;
</ins><span class="cx">     void finalizeLLIntInlineCaches();
</span><span class="cx">     void finalizeBaselineJITInlineCaches();
</span><span class="cx"> 
</span><span class="lines">@@ -946,14 +926,14 @@
</span><span class="cx">         size_t count = constants.size();
</span><span class="cx">         m_constantRegisters.resizeToFit(count);
</span><span class="cx">         for (size_t i = 0; i &lt; count; i++)
</span><del>-            m_constantRegisters[i].set(*m_vm, this, constants[i].get());
</del><ins>+            m_constantRegisters[i].set(*m_vm, ownerExecutable(), constants[i].get());
</ins><span class="cx">         m_constantsSourceCodeRepresentation = constantsSourceCodeRepresentation;
</span><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     void replaceConstant(int index, JSValue value)
</span><span class="cx">     {
</span><span class="cx">         ASSERT(isConstantRegisterIndex(index) &amp;&amp; static_cast&lt;size_t&gt;(index - FirstConstantRegisterIndex) &lt; m_constantRegisters.size());
</span><del>-        m_constantRegisters[index - FirstConstantRegisterIndex].set(m_globalObject-&gt;vm(), this, value);
</del><ins>+        m_constantRegisters[index - FirstConstantRegisterIndex].set(m_globalObject-&gt;vm(), m_ownerExecutable.get(), value);
</ins><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     void dumpBytecode(
</span><span class="lines">@@ -1025,7 +1005,8 @@
</span><span class="cx">     bool m_isStrictMode;
</span><span class="cx">     bool m_needsActivation;
</span><span class="cx"> 
</span><del>-    Atomic&lt;bool&gt; m_visitWeaklyHasBeenCalled;
</del><ins>+    Atomic&lt;bool&gt; m_visitAggregateHasBeenCalled;
+    Atomic&lt;bool&gt; m_visitStronglyHasBeenCalled;
</ins><span class="cx"> 
</span><span class="cx">     RefPtr&lt;SourceProvider&gt; m_source;
</span><span class="cx">     unsigned m_sourceOffset;
</span><span class="lines">@@ -1067,7 +1048,7 @@
</span><span class="cx">     Vector&lt;WriteBarrier&lt;FunctionExecutable&gt;&gt; m_functionDecls;
</span><span class="cx">     Vector&lt;WriteBarrier&lt;FunctionExecutable&gt;&gt; m_functionExprs;
</span><span class="cx"> 
</span><del>-    WriteBarrier&lt;CodeBlock&gt; m_alternative;
</del><ins>+    RefPtr&lt;CodeBlock&gt; m_alternative;
</ins><span class="cx">     
</span><span class="cx">     BaselineExecutionCounter m_llintExecuteCounter;
</span><span class="cx"> 
</span><span class="lines">@@ -1087,242 +1068,124 @@
</span><span class="cx"> #if ENABLE(JIT)
</span><span class="cx">     DFG::CapabilityLevel m_capabilityLevelState;
</span><span class="cx"> #endif
</span><del>-
-    UnconditionalFinalizer m_unconditionalFinalizer;
-    WeakReferenceHarvester m_weakReferenceHarvester;
</del><span class="cx"> };
</span><span class="cx"> 
</span><span class="cx"> // Program code is not marked by any function, so we make the global object
</span><span class="cx"> // responsible for marking it.
</span><span class="cx"> 
</span><span class="cx"> class GlobalCodeBlock : public CodeBlock {
</span><del>-    typedef CodeBlock Base;
-    DECLARE_INFO;
-
</del><span class="cx"> protected:
</span><del>-    GlobalCodeBlock(VM* vm, Structure* structure, CopyParsedBlockTag, GlobalCodeBlock&amp; other)
-        : CodeBlock(vm, structure, CopyParsedBlock, other)
</del><ins>+    GlobalCodeBlock(CopyParsedBlockTag, GlobalCodeBlock&amp; other)
+    : CodeBlock(CopyParsedBlock, other)
</ins><span class="cx">     {
</span><span class="cx">     }
</span><del>-
-    GlobalCodeBlock(VM* vm, Structure* structure, ScriptExecutable* ownerExecutable, UnlinkedCodeBlock* unlinkedCodeBlock, JSScope* scope, PassRefPtr&lt;SourceProvider&gt; sourceProvider, unsigned sourceOffset, unsigned firstLineColumnOffset)
-        : CodeBlock(vm, structure, ownerExecutable, unlinkedCodeBlock, scope, sourceProvider, sourceOffset, firstLineColumnOffset)
</del><ins>+        
+    GlobalCodeBlock(ScriptExecutable* ownerExecutable, UnlinkedCodeBlock* unlinkedCodeBlock, JSScope* scope, PassRefPtr&lt;SourceProvider&gt; sourceProvider, unsigned sourceOffset, unsigned firstLineColumnOffset)
+        : CodeBlock(ownerExecutable, unlinkedCodeBlock, scope, sourceProvider, sourceOffset, firstLineColumnOffset)
</ins><span class="cx">     {
</span><span class="cx">     }
</span><span class="cx"> };
</span><span class="cx"> 
</span><span class="cx"> class ProgramCodeBlock : public GlobalCodeBlock {
</span><span class="cx"> public:
</span><del>-    typedef GlobalCodeBlock Base;
-    DECLARE_INFO;
-
-    static ProgramCodeBlock* create(VM* vm, CopyParsedBlockTag, ProgramCodeBlock&amp; other)
</del><ins>+    ProgramCodeBlock(CopyParsedBlockTag, ProgramCodeBlock&amp; other)
+    : GlobalCodeBlock(CopyParsedBlock, other)
</ins><span class="cx">     {
</span><del>-        ProgramCodeBlock* instance = new (NotNull, allocateCell&lt;ProgramCodeBlock&gt;(vm-&gt;heap))
-            ProgramCodeBlock(vm, vm-&gt;programCodeBlockStructure.get(), CopyParsedBlock, other);
-        instance-&gt;finishCreation(*vm, CopyParsedBlock, other);
-        return instance;
</del><span class="cx">     }
</span><span class="cx"> 
</span><del>-    static ProgramCodeBlock* create(VM* vm, ProgramExecutable* ownerExecutable, UnlinkedProgramCodeBlock* unlinkedCodeBlock,
-        JSScope* scope, PassRefPtr&lt;SourceProvider&gt; sourceProvider, unsigned firstLineColumnOffset)
</del><ins>+    ProgramCodeBlock(ProgramExecutable* ownerExecutable, UnlinkedProgramCodeBlock* unlinkedCodeBlock, JSScope* scope, PassRefPtr&lt;SourceProvider&gt; sourceProvider, unsigned firstLineColumnOffset)
+        : GlobalCodeBlock(ownerExecutable, unlinkedCodeBlock, scope, sourceProvider, 0, firstLineColumnOffset)
</ins><span class="cx">     {
</span><del>-        ProgramCodeBlock* instance = new (NotNull, allocateCell&lt;ProgramCodeBlock&gt;(vm-&gt;heap))
-            ProgramCodeBlock(vm, vm-&gt;programCodeBlockStructure.get(), ownerExecutable, unlinkedCodeBlock, scope, sourceProvider, firstLineColumnOffset);
-        instance-&gt;finishCreation(*vm, ownerExecutable, unlinkedCodeBlock, scope);
-        return instance;
</del><span class="cx">     }
</span><span class="cx"> 
</span><del>-    static Structure* createStructure(VM&amp; vm, JSGlobalObject* globalObject, JSValue prototype)
-    {
-        return Structure::create(vm, globalObject, prototype, TypeInfo(CellType, StructureFlags), info());
-    }
-
-private:
-    ProgramCodeBlock(VM* vm, Structure* structure, CopyParsedBlockTag, ProgramCodeBlock&amp; other)
-        : GlobalCodeBlock(vm, structure, CopyParsedBlock, other)
-    {
-    }
-
-    ProgramCodeBlock(VM* vm, Structure* structure, ProgramExecutable* ownerExecutable, UnlinkedProgramCodeBlock* unlinkedCodeBlock,
-        JSScope* scope, PassRefPtr&lt;SourceProvider&gt; sourceProvider, unsigned firstLineColumnOffset)
-        : GlobalCodeBlock(vm, structure, ownerExecutable, unlinkedCodeBlock, scope, sourceProvider, 0, firstLineColumnOffset)
-    {
-    }
-
-    static void destroy(JSCell*);
</del><ins>+#if ENABLE(JIT)
+protected:
+    virtual CodeBlock* replacement() override;
+    virtual DFG::CapabilityLevel capabilityLevelInternal() override;
+#endif
</ins><span class="cx"> };
</span><span class="cx"> 
</span><span class="cx"> class ModuleProgramCodeBlock : public GlobalCodeBlock {
</span><span class="cx"> public:
</span><del>-    typedef GlobalCodeBlock Base;
-    DECLARE_INFO;
-
-    static ModuleProgramCodeBlock* create(VM* vm, CopyParsedBlockTag, ModuleProgramCodeBlock&amp; other)
</del><ins>+    ModuleProgramCodeBlock(CopyParsedBlockTag, ModuleProgramCodeBlock&amp; other)
+        : GlobalCodeBlock(CopyParsedBlock, other)
</ins><span class="cx">     {
</span><del>-        ModuleProgramCodeBlock* instance = new (NotNull, allocateCell&lt;ModuleProgramCodeBlock&gt;(vm-&gt;heap))
-            ModuleProgramCodeBlock(vm, vm-&gt;moduleProgramCodeBlockStructure.get(), CopyParsedBlock, other);
-        instance-&gt;finishCreation(*vm, CopyParsedBlock, other);
-        return instance;
</del><span class="cx">     }
</span><span class="cx"> 
</span><del>-    static ModuleProgramCodeBlock* create(VM* vm, ModuleProgramExecutable* ownerExecutable, UnlinkedModuleProgramCodeBlock* unlinkedCodeBlock,
-        JSScope* scope, PassRefPtr&lt;SourceProvider&gt; sourceProvider, unsigned firstLineColumnOffset)
</del><ins>+    ModuleProgramCodeBlock(ModuleProgramExecutable* ownerExecutable, UnlinkedModuleProgramCodeBlock* unlinkedCodeBlock, JSScope* scope, PassRefPtr&lt;SourceProvider&gt; sourceProvider, unsigned firstLineColumnOffset)
+        : GlobalCodeBlock(ownerExecutable, unlinkedCodeBlock, scope, sourceProvider, 0, firstLineColumnOffset)
</ins><span class="cx">     {
</span><del>-        ModuleProgramCodeBlock* instance = new (NotNull, allocateCell&lt;ModuleProgramCodeBlock&gt;(vm-&gt;heap))
-            ModuleProgramCodeBlock(vm, vm-&gt;moduleProgramCodeBlockStructure.get(), ownerExecutable, unlinkedCodeBlock, scope, sourceProvider, firstLineColumnOffset);
-        instance-&gt;finishCreation(*vm, ownerExecutable, unlinkedCodeBlock, scope);
-        return instance;
</del><span class="cx">     }
</span><span class="cx"> 
</span><del>-    static Structure* createStructure(VM&amp; vm, JSGlobalObject* globalObject, JSValue prototype)
-    {
-        return Structure::create(vm, globalObject, prototype, TypeInfo(CellType, StructureFlags), info());
-    }
-
-private:
-    ModuleProgramCodeBlock(VM* vm, Structure* structure, CopyParsedBlockTag, ModuleProgramCodeBlock&amp; other)
-        : GlobalCodeBlock(vm, structure, CopyParsedBlock, other)
-    {
-    }
-
-    ModuleProgramCodeBlock(VM* vm, Structure* structure, ModuleProgramExecutable* ownerExecutable, UnlinkedModuleProgramCodeBlock* unlinkedCodeBlock,
-        JSScope* scope, PassRefPtr&lt;SourceProvider&gt; sourceProvider, unsigned firstLineColumnOffset)
-        : GlobalCodeBlock(vm, structure, ownerExecutable, unlinkedCodeBlock, scope, sourceProvider, 0, firstLineColumnOffset)
-    {
-    }
-
-    static void destroy(JSCell*);
</del><ins>+#if ENABLE(JIT)
+protected:
+    virtual CodeBlock* replacement() override;
+    virtual DFG::CapabilityLevel capabilityLevelInternal() override;
+#endif
</ins><span class="cx"> };
</span><span class="cx"> 
</span><span class="cx"> class EvalCodeBlock : public GlobalCodeBlock {
</span><span class="cx"> public:
</span><del>-    typedef GlobalCodeBlock Base;
-    DECLARE_INFO;
-
-    static EvalCodeBlock* create(VM* vm, CopyParsedBlockTag, EvalCodeBlock&amp; other)
</del><ins>+    EvalCodeBlock(CopyParsedBlockTag, EvalCodeBlock&amp; other)
+        : GlobalCodeBlock(CopyParsedBlock, other)
</ins><span class="cx">     {
</span><del>-        EvalCodeBlock* instance = new (NotNull, allocateCell&lt;EvalCodeBlock&gt;(vm-&gt;heap))
-            EvalCodeBlock(vm, vm-&gt;evalCodeBlockStructure.get(), CopyParsedBlock, other);
-        instance-&gt;finishCreation(*vm, CopyParsedBlock, other);
-        return instance;
</del><span class="cx">     }
</span><del>-
-    static EvalCodeBlock* create(VM* vm, EvalExecutable* ownerExecutable, UnlinkedEvalCodeBlock* unlinkedCodeBlock,
-        JSScope* scope, PassRefPtr&lt;SourceProvider&gt; sourceProvider)
</del><ins>+        
+    EvalCodeBlock(EvalExecutable* ownerExecutable, UnlinkedEvalCodeBlock* unlinkedCodeBlock, JSScope* scope, PassRefPtr&lt;SourceProvider&gt; sourceProvider)
+        : GlobalCodeBlock(ownerExecutable, unlinkedCodeBlock, scope, sourceProvider, 0, 1)
</ins><span class="cx">     {
</span><del>-        EvalCodeBlock* instance = new (NotNull, allocateCell&lt;EvalCodeBlock&gt;(vm-&gt;heap))
-            EvalCodeBlock(vm, vm-&gt;evalCodeBlockStructure.get(), ownerExecutable, unlinkedCodeBlock, scope, sourceProvider);
-        instance-&gt;finishCreation(*vm, ownerExecutable, unlinkedCodeBlock, scope);
-        return instance;
</del><span class="cx">     }
</span><del>-
-    static Structure* createStructure(VM&amp; vm, JSGlobalObject* globalObject, JSValue prototype)
-    {
-        return Structure::create(vm, globalObject, prototype, TypeInfo(CellType, StructureFlags), info());
-    }
-
</del><ins>+    
</ins><span class="cx">     const Identifier&amp; variable(unsigned index) { return unlinkedEvalCodeBlock()-&gt;variable(index); }
</span><span class="cx">     unsigned numVariables() { return unlinkedEvalCodeBlock()-&gt;numVariables(); }
</span><span class="cx">     
</span><del>-private:
-    EvalCodeBlock(VM* vm, Structure* structure, CopyParsedBlockTag, EvalCodeBlock&amp; other)
-        : GlobalCodeBlock(vm, structure, CopyParsedBlock, other)
-    {
-    }
-        
-    EvalCodeBlock(VM* vm, Structure* structure, EvalExecutable* ownerExecutable, UnlinkedEvalCodeBlock* unlinkedCodeBlock,
-        JSScope* scope, PassRefPtr&lt;SourceProvider&gt; sourceProvider)
-        : GlobalCodeBlock(vm, structure, ownerExecutable, unlinkedCodeBlock, scope, sourceProvider, 0, 1)
-    {
-    }
</del><ins>+#if ENABLE(JIT)
+protected:
+    virtual CodeBlock* replacement() override;
+    virtual DFG::CapabilityLevel capabilityLevelInternal() override;
+#endif
</ins><span class="cx">     
</span><del>-    static void destroy(JSCell*);
-
</del><span class="cx"> private:
</span><span class="cx">     UnlinkedEvalCodeBlock* unlinkedEvalCodeBlock() const { return jsCast&lt;UnlinkedEvalCodeBlock*&gt;(unlinkedCodeBlock()); }
</span><span class="cx"> };
</span><span class="cx"> 
</span><span class="cx"> class FunctionCodeBlock : public CodeBlock {
</span><span class="cx"> public:
</span><del>-    typedef CodeBlock Base;
-    DECLARE_INFO;
-
-    static FunctionCodeBlock* create(VM* vm, CopyParsedBlockTag, FunctionCodeBlock&amp; other)
</del><ins>+    FunctionCodeBlock(CopyParsedBlockTag, FunctionCodeBlock&amp; other)
+        : CodeBlock(CopyParsedBlock, other)
</ins><span class="cx">     {
</span><del>-        FunctionCodeBlock* instance = new (NotNull, allocateCell&lt;FunctionCodeBlock&gt;(vm-&gt;heap))
-            FunctionCodeBlock(vm, vm-&gt;functionCodeBlockStructure.get(), CopyParsedBlock, other);
-        instance-&gt;finishCreation(*vm, CopyParsedBlock, other);
-        return instance;
</del><span class="cx">     }
</span><span class="cx"> 
</span><del>-    static FunctionCodeBlock* create(VM* vm, FunctionExecutable* ownerExecutable, UnlinkedFunctionCodeBlock* unlinkedCodeBlock, JSScope* scope,
-        PassRefPtr&lt;SourceProvider&gt; sourceProvider, unsigned sourceOffset, unsigned firstLineColumnOffset)
</del><ins>+    FunctionCodeBlock(FunctionExecutable* ownerExecutable, UnlinkedFunctionCodeBlock* unlinkedCodeBlock, JSScope* scope, PassRefPtr&lt;SourceProvider&gt; sourceProvider, unsigned sourceOffset, unsigned firstLineColumnOffset)
+        : CodeBlock(ownerExecutable, unlinkedCodeBlock, scope, sourceProvider, sourceOffset, firstLineColumnOffset)
</ins><span class="cx">     {
</span><del>-        FunctionCodeBlock* instance = new (NotNull, allocateCell&lt;FunctionCodeBlock&gt;(vm-&gt;heap))
-            FunctionCodeBlock(vm, vm-&gt;functionCodeBlockStructure.get(), ownerExecutable, unlinkedCodeBlock, scope, sourceProvider, sourceOffset, firstLineColumnOffset);
-        instance-&gt;finishCreation(*vm, ownerExecutable, unlinkedCodeBlock, scope);
-        return instance;
</del><span class="cx">     }
</span><del>-
-    static Structure* createStructure(VM&amp; vm, JSGlobalObject* globalObject, JSValue prototype)
-    {
-        return Structure::create(vm, globalObject, prototype, TypeInfo(CellType, StructureFlags), info());
-    }
-
-private:
-    FunctionCodeBlock(VM* vm, Structure* structure, CopyParsedBlockTag, FunctionCodeBlock&amp; other)
-        : CodeBlock(vm, structure, CopyParsedBlock, other)
-    {
-    }
-
-    FunctionCodeBlock(VM* vm, Structure* structure, FunctionExecutable* ownerExecutable, UnlinkedFunctionCodeBlock* unlinkedCodeBlock, JSScope* scope,
-        PassRefPtr&lt;SourceProvider&gt; sourceProvider, unsigned sourceOffset, unsigned firstLineColumnOffset)
-        : CodeBlock(vm, structure, ownerExecutable, unlinkedCodeBlock, scope, sourceProvider, sourceOffset, firstLineColumnOffset)
-    {
-    }
</del><span class="cx">     
</span><del>-    static void destroy(JSCell*);
</del><ins>+#if ENABLE(JIT)
+protected:
+    virtual CodeBlock* replacement() override;
+    virtual DFG::CapabilityLevel capabilityLevelInternal() override;
+#endif
</ins><span class="cx"> };
</span><span class="cx"> 
</span><span class="cx"> #if ENABLE(WEBASSEMBLY)
</span><span class="cx"> class WebAssemblyCodeBlock : public CodeBlock {
</span><span class="cx"> public:
</span><del>-    DECLARE_INFO;
-
-    static WebAssemblyCodeBlock* create(VM* vm, CopyParsedBlockTag, WebAssemblyCodeBlock&amp; other)
</del><ins>+    WebAssemblyCodeBlock(CopyParsedBlockTag, WebAssemblyCodeBlock&amp; other)
+        : CodeBlock(CopyParsedBlock, other)
</ins><span class="cx">     {
</span><del>-        WebAssemblyCodeBlock* instance = new (NotNull, allocateCell&lt;WebAssemblyCodeBlock&gt;(vm-&gt;heap))
-            WebAssemblyCodeBlock(vm, vm-&gt;webAssemblyCodeBlockStructure.get(), CopyParsedBlock, other);
-        instance-&gt;finishCreation(*vm);
-        return instance;
</del><span class="cx">     }
</span><span class="cx"> 
</span><del>-    static WebAssemblyCodeBlock* create(VM* vm, WebAssemblyExecutable* ownerExecutable, JSGlobalObject* globalObject)
</del><ins>+    WebAssemblyCodeBlock(WebAssemblyExecutable* ownerExecutable, VM&amp; vm, JSGlobalObject* globalObject)
+        : CodeBlock(ownerExecutable, vm, globalObject)
</ins><span class="cx">     {
</span><del>-        WebAssemblyCodeBlock* instance = new (NotNull, allocateCell&lt;WebAssemblyCodeBlock&gt;(vm-&gt;heap))
-            WebAssemblyCodeBlock(vm, vm-&gt;webAssemblyCodeBlockStructure.get(), ownerExecutable, globalObject);
-        instance-&gt;finishCreation(*vm);
-        return instance;
</del><span class="cx">     }
</span><span class="cx"> 
</span><del>-    static Structure* createStructure(VM&amp; vm, JSGlobalObject* globalObject, JSValue prototype)
-    {
-        return Structure::create(vm, globalObject, prototype, TypeInfo(CellType, StructureFlags), info());
-    }
-
-private:
-    WebAssemblyCodeBlock(VM&amp; vm, Structure* structure, CopyParsedBlockTag, WebAssemblyCodeBlock&amp; other)
-        : CodeBlock(vm, structure, CopyParsedBlock, other)
-    {
-    }
-
-    WebAssemblyCodeBlock(VM&amp; vm, Structure* structure, WebAssemblyExecutable* ownerExecutable, JSGlobalObject* globalObject)
-        : CodeBlock(vm, structure, ownerExecutable, vm, globalObject)
-    {
-    }
-
-    static void destroy(JSCell*);
</del><ins>+#if ENABLE(JIT)
+protected:
+    virtual CodeBlock* replacement() override;
+    virtual DFG::CapabilityLevel capabilityLevelInternal() override;
+#endif
</ins><span class="cx"> };
</span><span class="cx"> #endif
</span><span class="cx"> 
</span><span class="lines">@@ -1350,9 +1213,10 @@
</span><span class="cx">     return uncheckedR(reg.offset());
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-inline void CodeBlock::clearVisitWeaklyHasBeenCalled()
</del><ins>+inline void CodeBlock::clearMarks()
</ins><span class="cx"> {
</span><del>-    m_visitWeaklyHasBeenCalled.store(false, std::memory_order_relaxed);
</del><ins>+    m_visitStronglyHasBeenCalled.store(false, std::memory_order_relaxed);
+    m_visitAggregateHasBeenCalled.store(false, std::memory_order_relaxed);
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> inline void CodeBlockSet::mark(void* candidateCodeBlock)
</span><span class="lines">@@ -1377,12 +1241,13 @@
</span><span class="cx"> {
</span><span class="cx">     if (!codeBlock)
</span><span class="cx">         return;
</span><ins>+    
+    // Force GC to visit all CodeBlocks on the stack, including old CodeBlocks
+    // that have not executed a barrier. This is overkill, but we have always
+    // done this, and it might help us recover gracefully if we forget to execute
+    // a barrier when a CodeBlock needs it.
+    codeBlock-&gt;clearMarks();
</ins><span class="cx"> 
</span><del>-    // Try to recover gracefully if we forget to execute a barrier for a
-    // CodeBlock that does value profiling. This is probably overkill, but we
-    // have always done it.
-    Heap::heap(codeBlock)-&gt;writeBarrier(codeBlock);
-
</del><span class="cx">     m_currentlyExecuting.add(codeBlock);
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="lines">@@ -1390,13 +1255,13 @@
</span><span class="cx"> {
</span><span class="cx">     switch (type()) {
</span><span class="cx">     case ProgramExecutableType: {
</span><del>-        if (CodeBlock* codeBlock = static_cast&lt;CodeBlock*&gt;(jsCast&lt;ProgramExecutable*&gt;(this)-&gt;m_programCodeBlock.get()))
</del><ins>+        if (CodeBlock* codeBlock = jsCast&lt;ProgramExecutable*&gt;(this)-&gt;m_programCodeBlock.get())
</ins><span class="cx">             codeBlock-&gt;forEachRelatedCodeBlock(std::forward&lt;Functor&gt;(functor));
</span><span class="cx">         break;
</span><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     case EvalExecutableType: {
</span><del>-        if (CodeBlock* codeBlock = static_cast&lt;CodeBlock*&gt;(jsCast&lt;EvalExecutable*&gt;(this)-&gt;m_evalCodeBlock.get()))
</del><ins>+        if (CodeBlock* codeBlock = jsCast&lt;EvalExecutable*&gt;(this)-&gt;m_evalCodeBlock.get())
</ins><span class="cx">             codeBlock-&gt;forEachRelatedCodeBlock(std::forward&lt;Functor&gt;(functor));
</span><span class="cx">         break;
</span><span class="cx">     }
</span><span class="lines">@@ -1404,15 +1269,15 @@
</span><span class="cx">     case FunctionExecutableType: {
</span><span class="cx">         Functor f(std::forward&lt;Functor&gt;(functor));
</span><span class="cx">         FunctionExecutable* executable = jsCast&lt;FunctionExecutable*&gt;(this);
</span><del>-        if (CodeBlock* codeBlock = static_cast&lt;CodeBlock*&gt;(executable-&gt;m_codeBlockForCall.get()))
</del><ins>+        if (CodeBlock* codeBlock = executable-&gt;m_codeBlockForCall.get())
</ins><span class="cx">             codeBlock-&gt;forEachRelatedCodeBlock(f);
</span><del>-        if (CodeBlock* codeBlock = static_cast&lt;CodeBlock*&gt;(executable-&gt;m_codeBlockForConstruct.get()))
</del><ins>+        if (CodeBlock* codeBlock = executable-&gt;m_codeBlockForConstruct.get())
</ins><span class="cx">             codeBlock-&gt;forEachRelatedCodeBlock(f);
</span><span class="cx">         break;
</span><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     case ModuleProgramExecutableType: {
</span><del>-        if (CodeBlock* codeBlock = static_cast&lt;CodeBlock*&gt;(jsCast&lt;ModuleProgramExecutable*&gt;(this)-&gt;m_moduleProgramCodeBlock.get()))
</del><ins>+        if (CodeBlock* codeBlock = jsCast&lt;ModuleProgramExecutable*&gt;(this)-&gt;m_moduleProgramCodeBlock.get())
</ins><span class="cx">             codeBlock-&gt;forEachRelatedCodeBlock(std::forward&lt;Functor&gt;(functor));
</span><span class="cx">         break;
</span><span class="cx">     }
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorebytecodeCodeOrigincpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/bytecode/CodeOrigin.cpp (190808 => 190809)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/bytecode/CodeOrigin.cpp        2015-10-09 17:53:28 UTC (rev 190808)
+++ trunk/Source/JavaScriptCore/bytecode/CodeOrigin.cpp        2015-10-09 17:54:16 UTC (rev 190809)
</span><span class="lines">@@ -75,7 +75,7 @@
</span><span class="cx">         if (!a.inlineCallFrame)
</span><span class="cx">             return true;
</span><span class="cx">         
</span><del>-        if (a.inlineCallFrame-&gt;baselineCodeBlock.get() != b.inlineCallFrame-&gt;baselineCodeBlock.get())
</del><ins>+        if (a.inlineCallFrame-&gt;executable.get() != b.inlineCallFrame-&gt;executable.get())
</ins><span class="cx">             return false;
</span><span class="cx">         
</span><span class="cx">         a = a.inlineCallFrame-&gt;directCaller;
</span><span class="lines">@@ -98,7 +98,7 @@
</span><span class="cx">         if (!codeOrigin.inlineCallFrame)
</span><span class="cx">             return result;
</span><span class="cx">         
</span><del>-        result += WTF::PtrHash&lt;JSCell*&gt;::hash(codeOrigin.inlineCallFrame-&gt;baselineCodeBlock.get());
</del><ins>+        result += WTF::PtrHash&lt;JSCell*&gt;::hash(codeOrigin.inlineCallFrame-&gt;executable.get());
</ins><span class="cx">         
</span><span class="cx">         codeOrigin = codeOrigin.inlineCallFrame-&gt;directCaller;
</span><span class="cx">     }
</span><span class="lines">@@ -115,11 +115,11 @@
</span><span class="cx">     return result;
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-CodeBlock* CodeOrigin::codeOriginOwner() const
</del><ins>+ScriptExecutable* CodeOrigin::codeOriginOwner() const
</ins><span class="cx"> {
</span><span class="cx">     if (!inlineCallFrame)
</span><span class="cx">         return 0;
</span><del>-    return inlineCallFrame-&gt;baselineCodeBlock.get();
</del><ins>+    return inlineCallFrame-&gt;executable.get();
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> int CodeOrigin::stackOffset() const
</span><span class="lines">@@ -143,7 +143,7 @@
</span><span class="cx">             out.print(&quot; --&gt; &quot;);
</span><span class="cx">         
</span><span class="cx">         if (InlineCallFrame* frame = stack[i].inlineCallFrame) {
</span><del>-            out.print(frame-&gt;briefFunctionInformation(), &quot;:&lt;&quot;, RawPointer(frame-&gt;baselineCodeBlock.get()), &quot;&gt; &quot;);
</del><ins>+            out.print(frame-&gt;briefFunctionInformation(), &quot;:&lt;&quot;, RawPointer(frame-&gt;executable.get()), &quot;&gt; &quot;);
</ins><span class="cx">             if (frame-&gt;isClosureCall)
</span><span class="cx">                 out.print(&quot;(closure) &quot;);
</span><span class="cx">         }
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorebytecodeCodeOriginh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/bytecode/CodeOrigin.h (190808 => 190809)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/bytecode/CodeOrigin.h        2015-10-09 17:53:28 UTC (rev 190808)
+++ trunk/Source/JavaScriptCore/bytecode/CodeOrigin.h        2015-10-09 17:54:16 UTC (rev 190809)
</span><span class="lines">@@ -87,7 +87,7 @@
</span><span class="cx">     
</span><span class="cx">     // If the code origin corresponds to inlined code, gives you the heap object that
</span><span class="cx">     // would have owned the code if it had not been inlined. Otherwise returns 0.
</span><del>-    CodeBlock* codeOriginOwner() const;
</del><ins>+    ScriptExecutable* codeOriginOwner() const;
</ins><span class="cx">     
</span><span class="cx">     int stackOffset() const;
</span><span class="cx">     
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorebytecodeDeferredCompilationCallbackcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/bytecode/DeferredCompilationCallback.cpp (190808 => 190809)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/bytecode/DeferredCompilationCallback.cpp        2015-10-09 17:53:28 UTC (rev 190808)
+++ trunk/Source/JavaScriptCore/bytecode/DeferredCompilationCallback.cpp        2015-10-09 17:54:16 UTC (rev 190809)
</span><span class="lines">@@ -33,13 +33,15 @@
</span><span class="cx"> DeferredCompilationCallback::DeferredCompilationCallback() { }
</span><span class="cx"> DeferredCompilationCallback::~DeferredCompilationCallback() { }
</span><span class="cx"> 
</span><del>-void DeferredCompilationCallback::compilationDidComplete(CodeBlock*, CodeBlock*, CompilationResult result)
</del><ins>+void DeferredCompilationCallback::compilationDidComplete(CodeBlock* codeBlock, CompilationResult result)
</ins><span class="cx"> {
</span><span class="cx">     dumpCompiledSourcesIfNeeded();
</span><span class="cx"> 
</span><span class="cx">     switch (result) {
</span><span class="cx">     case CompilationFailed:
</span><span class="cx">     case CompilationInvalidated:
</span><ins>+        codeBlock-&gt;heap()-&gt;removeCodeBlock(codeBlock);
+        break;
</ins><span class="cx">     case CompilationSuccessful:
</span><span class="cx">         break;
</span><span class="cx">     case CompilationDeferred:
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorebytecodeDeferredCompilationCallbackh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/bytecode/DeferredCompilationCallback.h (190808 => 190809)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/bytecode/DeferredCompilationCallback.h        2015-10-09 17:53:28 UTC (rev 190808)
+++ trunk/Source/JavaScriptCore/bytecode/DeferredCompilationCallback.h        2015-10-09 17:54:16 UTC (rev 190809)
</span><span class="lines">@@ -42,8 +42,8 @@
</span><span class="cx"> public:
</span><span class="cx">     virtual ~DeferredCompilationCallback();
</span><span class="cx"> 
</span><del>-    virtual void compilationDidBecomeReadyAsynchronously(CodeBlock*, CodeBlock* profiledDFGCodeBlock) = 0;
-    virtual void compilationDidComplete(CodeBlock*, CodeBlock* profiledDFGCodeBlock, CompilationResult);
</del><ins>+    virtual void compilationDidBecomeReadyAsynchronously(CodeBlock*) = 0;
+    virtual void compilationDidComplete(CodeBlock*, CompilationResult);
</ins><span class="cx"> 
</span><span class="cx">     Vector&lt;DeferredSourceDump&gt;&amp; ensureDeferredSourceDump();
</span><span class="cx"> 
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorebytecodeEvalCodeCacheh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/bytecode/EvalCodeCache.h (190808 => 190809)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/bytecode/EvalCodeCache.h        2015-10-09 17:53:28 UTC (rev 190808)
+++ trunk/Source/JavaScriptCore/bytecode/EvalCodeCache.h        2015-10-09 17:54:16 UTC (rev 190809)
</span><span class="lines">@@ -51,7 +51,7 @@
</span><span class="cx">             return 0;
</span><span class="cx">         }
</span><span class="cx">         
</span><del>-        EvalExecutable* getSlow(ExecState* exec, JSCell* owner, bool inStrictContext, ThisTDZMode thisTDZMode, const String&amp; evalSource, JSScope* scope)
</del><ins>+        EvalExecutable* getSlow(ExecState* exec, ScriptExecutable* owner, bool inStrictContext, ThisTDZMode thisTDZMode, const String&amp; evalSource, JSScope* scope)
</ins><span class="cx">         {
</span><span class="cx">             VariableEnvironment variablesUnderTDZ;
</span><span class="cx">             JSScope::collectVariablesUnderTDZ(scope, variablesUnderTDZ);
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorebytecodeInlineCallFramecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/bytecode/InlineCallFrame.cpp (190808 => 190809)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/bytecode/InlineCallFrame.cpp        2015-10-09 17:53:28 UTC (rev 190808)
+++ trunk/Source/JavaScriptCore/bytecode/InlineCallFrame.cpp        2015-10-09 17:54:16 UTC (rev 190809)
</span><span class="lines">@@ -47,19 +47,26 @@
</span><span class="cx"> 
</span><span class="cx"> CodeBlockHash InlineCallFrame::hash() const
</span><span class="cx"> {
</span><del>-    return baselineCodeBlock-&gt;hash();
</del><ins>+    return jsCast&lt;FunctionExecutable*&gt;(executable.get())-&gt;codeBlockFor(
+        specializationKind())-&gt;hash();
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> CString InlineCallFrame::hashAsStringIfPossible() const
</span><span class="cx"> {
</span><del>-    return baselineCodeBlock-&gt;hashAsStringIfPossible();
</del><ins>+    return jsCast&lt;FunctionExecutable*&gt;(executable.get())-&gt;codeBlockFor(
+        specializationKind())-&gt;hashAsStringIfPossible();
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> CString InlineCallFrame::inferredName() const
</span><span class="cx"> {
</span><del>-    return jsCast&lt;FunctionExecutable*&gt;(baselineCodeBlock-&gt;ownerExecutable())-&gt;inferredName().utf8();
</del><ins>+    return jsCast&lt;FunctionExecutable*&gt;(executable.get())-&gt;inferredName().utf8();
</ins><span class="cx"> }
</span><span class="cx"> 
</span><ins>+CodeBlock* InlineCallFrame::baselineCodeBlock() const
+{
+    return jsCast&lt;FunctionExecutable*&gt;(executable.get())-&gt;baselineCodeBlockFor(specializationKind());
+}
+
</ins><span class="cx"> void InlineCallFrame::dumpBriefFunctionInformation(PrintStream&amp; out) const
</span><span class="cx"> {
</span><span class="cx">     out.print(inferredName(), &quot;#&quot;, hashAsStringIfPossible());
</span><span class="lines">@@ -67,8 +74,8 @@
</span><span class="cx"> 
</span><span class="cx"> void InlineCallFrame::dumpInContext(PrintStream&amp; out, DumpContext* context) const
</span><span class="cx"> {
</span><del>-    out.print(briefFunctionInformation(), &quot;:&lt;&quot;, RawPointer(baselineCodeBlock.get()));
-    if (isStrictMode())
</del><ins>+    out.print(briefFunctionInformation(), &quot;:&lt;&quot;, RawPointer(executable.get()));
+    if (executable-&gt;isStrictMode())
</ins><span class="cx">         out.print(&quot; (StrictMode)&quot;);
</span><span class="cx">     out.print(&quot;, bc#&quot;, directCaller.bytecodeIndex, &quot;, &quot;, static_cast&lt;Kind&gt;(kind));
</span><span class="cx">     if (isClosureCall)
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorebytecodeInlineCallFrameh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/bytecode/InlineCallFrame.h (190808 => 190809)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/bytecode/InlineCallFrame.h        2015-10-09 17:53:28 UTC (rev 190808)
+++ trunk/Source/JavaScriptCore/bytecode/InlineCallFrame.h        2015-10-09 17:54:16 UTC (rev 190809)
</span><span class="lines">@@ -29,6 +29,7 @@
</span><span class="cx"> #include &quot;CodeBlock.h&quot;
</span><span class="cx"> #include &quot;CodeBlockHash.h&quot;
</span><span class="cx"> #include &quot;CodeOrigin.h&quot;
</span><ins>+#include &quot;Executable.h&quot;
</ins><span class="cx"> #include &quot;ValueRecovery.h&quot;
</span><span class="cx"> #include &quot;WriteBarrier.h&quot;
</span><span class="cx"> #include &lt;wtf/BitVector.h&gt;
</span><span class="lines">@@ -41,6 +42,7 @@
</span><span class="cx"> 
</span><span class="cx"> struct InlineCallFrame;
</span><span class="cx"> class ExecState;
</span><ins>+class ScriptExecutable;
</ins><span class="cx"> class JSFunction;
</span><span class="cx"> 
</span><span class="cx"> struct InlineCallFrame {
</span><span class="lines">@@ -172,7 +174,7 @@
</span><span class="cx">     }
</span><span class="cx">     
</span><span class="cx">     Vector&lt;ValueRecovery&gt; arguments; // Includes 'this'.
</span><del>-    WriteBarrier&lt;CodeBlock&gt; baselineCodeBlock;
</del><ins>+    WriteBarrier&lt;ScriptExecutable&gt; executable;
</ins><span class="cx">     ValueRecovery calleeRecovery;
</span><span class="cx">     CodeOrigin directCaller;
</span><span class="cx"> 
</span><span class="lines">@@ -207,6 +209,8 @@
</span><span class="cx">     CodeBlockHash hash() const;
</span><span class="cx">     CString hashAsStringIfPossible() const;
</span><span class="cx">     
</span><ins>+    CodeBlock* baselineCodeBlock() const;
+    
</ins><span class="cx">     void setStackOffset(signed offset)
</span><span class="cx">     {
</span><span class="cx">         stackOffset = offset;
</span><span class="lines">@@ -216,8 +220,6 @@
</span><span class="cx">     ptrdiff_t callerFrameOffset() const { return stackOffset * sizeof(Register) + CallFrame::callerFrameOffset(); }
</span><span class="cx">     ptrdiff_t returnPCOffset() const { return stackOffset * sizeof(Register) + CallFrame::returnPCOffset(); }
</span><span class="cx"> 
</span><del>-    bool isStrictMode() const { return baselineCodeBlock-&gt;isStrictMode(); }
-
</del><span class="cx">     void dumpBriefFunctionInformation(PrintStream&amp;) const;
</span><span class="cx">     void dump(PrintStream&amp;) const;
</span><span class="cx">     void dumpInContext(PrintStream&amp;, DumpContext*) const;
</span><span class="lines">@@ -229,7 +231,9 @@
</span><span class="cx"> inline CodeBlock* baselineCodeBlockForInlineCallFrame(InlineCallFrame* inlineCallFrame)
</span><span class="cx"> {
</span><span class="cx">     RELEASE_ASSERT(inlineCallFrame);
</span><del>-    return inlineCallFrame-&gt;baselineCodeBlock.get();
</del><ins>+    ScriptExecutable* executable = inlineCallFrame-&gt;executable.get();
+    RELEASE_ASSERT(executable-&gt;structure()-&gt;classInfo() == FunctionExecutable::info());
+    return static_cast&lt;FunctionExecutable*&gt;(executable)-&gt;baselineCodeBlockFor(inlineCallFrame-&gt;specializationKind());
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> inline CodeBlock* baselineCodeBlockForOriginAndBaselineCodeBlock(const CodeOrigin&amp; codeOrigin, CodeBlock* baselineCodeBlock)
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorebytecodePolymorphicAccesscpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/bytecode/PolymorphicAccess.cpp (190808 => 190809)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/bytecode/PolymorphicAccess.cpp        2015-10-09 17:53:28 UTC (rev 190808)
+++ trunk/Source/JavaScriptCore/bytecode/PolymorphicAccess.cpp        2015-10-09 17:54:16 UTC (rev 190809)
</span><span class="lines">@@ -539,7 +539,7 @@
</span><span class="cx">         }
</span><span class="cx"> 
</span><span class="cx">         // We will emit code that has a weak reference that isn't otherwise listed anywhere.
</span><del>-        state.weakReferences.append(WriteBarrier&lt;JSCell&gt;(vm, codeBlock, structure));
</del><ins>+        state.weakReferences.append(WriteBarrier&lt;JSCell&gt;(vm, codeBlock-&gt;ownerExecutable(), structure));
</ins><span class="cx">         
</span><span class="cx">         jit.move(CCallHelpers::TrustedImmPtr(condition.object()), scratchGPR);
</span><span class="cx">         state.failAndRepatch.append(
</span><span class="lines">@@ -1379,7 +1379,7 @@
</span><span class="cx">     bool doesCalls = false;
</span><span class="cx">     for (auto&amp; entry : cases)
</span><span class="cx">         doesCalls |= entry-&gt;doesCalls();
</span><del>-    
</del><ins>+
</ins><span class="cx">     CodeBlock* codeBlockThatOwnsExceptionHandlers = nullptr;
</span><span class="cx">     CallSiteIndex callSiteIndexForExceptionHandling = state.originalCallSiteIndex();
</span><span class="cx">     if (state.needsToRestoreRegistersIfException()) {
</span><span class="lines">@@ -1388,7 +1388,7 @@
</span><span class="cx">         callSiteIndexForExceptionHandling = state.callSiteIndexForExceptionHandling();
</span><span class="cx">     }
</span><span class="cx"> 
</span><del>-    m_stubRoutine = createJITStubRoutine(code, vm, codeBlock, doesCalls, nullptr, codeBlockThatOwnsExceptionHandlers, callSiteIndexForExceptionHandling);
</del><ins>+    m_stubRoutine = createJITStubRoutine(code, vm, codeBlock-&gt;ownerExecutable(), doesCalls, nullptr, codeBlockThatOwnsExceptionHandlers, callSiteIndexForExceptionHandling);
</ins><span class="cx">     m_watchpoints = WTF::move(state.watchpoints);
</span><span class="cx">     if (!state.weakReferences.isEmpty())
</span><span class="cx">         m_weakReferences = std::make_unique&lt;Vector&lt;WriteBarrier&lt;JSCell&gt;&gt;&gt;(WTF::move(state.weakReferences));
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorebytecodeStructureStubInfocpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/bytecode/StructureStubInfo.cpp (190808 => 190809)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/bytecode/StructureStubInfo.cpp        2015-10-09 17:53:28 UTC (rev 190808)
+++ trunk/Source/JavaScriptCore/bytecode/StructureStubInfo.cpp        2015-10-09 17:54:16 UTC (rev 190809)
</span><span class="lines">@@ -55,7 +55,7 @@
</span><span class="cx">     cacheType = CacheType::GetByIdSelf;
</span><span class="cx">     
</span><span class="cx">     u.byIdSelf.baseObjectStructure.set(
</span><del>-        *codeBlock-&gt;vm(), codeBlock, baseObjectStructure);
</del><ins>+        *codeBlock-&gt;vm(), codeBlock-&gt;ownerExecutable(), baseObjectStructure);
</ins><span class="cx">     u.byIdSelf.offset = offset;
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="lines">@@ -64,7 +64,7 @@
</span><span class="cx">     cacheType = CacheType::PutByIdReplace;
</span><span class="cx">     
</span><span class="cx">     u.byIdSelf.baseObjectStructure.set(
</span><del>-        *codeBlock-&gt;vm(), codeBlock, baseObjectStructure);
</del><ins>+        *codeBlock-&gt;vm(), codeBlock-&gt;ownerExecutable(), baseObjectStructure);
</ins><span class="cx">     u.byIdSelf.offset = offset;
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="lines">@@ -120,7 +120,7 @@
</span><span class="cx">     Vector&lt;std::unique_ptr&lt;AccessCase&gt;&gt; accessCases;
</span><span class="cx">     
</span><span class="cx">     std::unique_ptr&lt;AccessCase&gt; previousCase =
</span><del>-        AccessCase::fromStructureStubInfo(vm, codeBlock, *this);
</del><ins>+        AccessCase::fromStructureStubInfo(vm, codeBlock-&gt;ownerExecutable(), *this);
</ins><span class="cx">     if (previousCase)
</span><span class="cx">         accessCases.append(WTF::move(previousCase));
</span><span class="cx"> 
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGByteCodeParsercpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp (190808 => 190809)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp        2015-10-09 17:53:28 UTC (rev 190808)
+++ trunk/Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp        2015-10-09 17:54:16 UTC (rev 190809)
</span><span class="lines">@@ -4633,10 +4633,10 @@
</span><span class="cx">         ASSERT(callsiteBlockHead);
</span><span class="cx">         
</span><span class="cx">         m_inlineCallFrame = byteCodeParser-&gt;m_graph.m_plan.inlineCallFrames-&gt;add();
</span><del>-        byteCodeParser-&gt;m_graph.freeze(codeBlock-&gt;baselineVersion());
</del><ins>+        byteCodeParser-&gt;m_graph.freeze(codeBlock-&gt;ownerExecutable());
</ins><span class="cx">         // The owner is the machine code block, and we already have a barrier on that when the
</span><span class="cx">         // plan finishes.
</span><del>-        m_inlineCallFrame-&gt;baselineCodeBlock.setWithoutWriteBarrier(codeBlock-&gt;baselineVersion());
</del><ins>+        m_inlineCallFrame-&gt;executable.setWithoutWriteBarrier(codeBlock-&gt;ownerScriptExecutable());
</ins><span class="cx">         m_inlineCallFrame-&gt;setStackOffset(inlineCallFrameStart.offset() - JSStack::CallFrameHeaderSize);
</span><span class="cx">         if (callee) {
</span><span class="cx">             m_inlineCallFrame-&gt;calleeRecovery = ValueRecovery::constant(callee);
</span><span class="lines">@@ -4828,7 +4828,7 @@
</span><span class="cx">     if (Options::verboseDFGByteCodeParsing())
</span><span class="cx">         dataLog(&quot;Parsing &quot;, *m_codeBlock, &quot;\n&quot;);
</span><span class="cx">     
</span><del>-    m_dfgCodeBlock = m_graph.m_plan.profiledDFGCodeBlock;
</del><ins>+    m_dfgCodeBlock = m_graph.m_plan.profiledDFGCodeBlock.get();
</ins><span class="cx">     if (isFTL(m_graph.m_plan.mode) &amp;&amp; m_dfgCodeBlock
</span><span class="cx">         &amp;&amp; Options::enablePolyvariantDevirtualization()) {
</span><span class="cx">         if (Options::enablePolyvariantCallInlining())
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGCommonDatacpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGCommonData.cpp (190808 => 190809)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGCommonData.cpp        2015-10-09 17:53:28 UTC (rev 190808)
+++ trunk/Source/JavaScriptCore/dfg/DFGCommonData.cpp        2015-10-09 17:54:16 UTC (rev 190809)
</span><span class="lines">@@ -106,8 +106,8 @@
</span><span class="cx">                     trackedReferences.check(recovery.constant());
</span><span class="cx">             }
</span><span class="cx">             
</span><del>-            if (CodeBlock* baselineCodeBlock = inlineCallFrame-&gt;baselineCodeBlock.get())
-                trackedReferences.check(baselineCodeBlock);
</del><ins>+            if (ScriptExecutable* executable = inlineCallFrame-&gt;executable.get())
+                trackedReferences.check(executable);
</ins><span class="cx">             
</span><span class="cx">             if (inlineCallFrame-&gt;calleeRecovery.isConstant())
</span><span class="cx">                 trackedReferences.check(inlineCallFrame-&gt;calleeRecovery.constant());
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGDesiredTransitionscpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGDesiredTransitions.cpp (190808 => 190809)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGDesiredTransitions.cpp        2015-10-09 17:53:28 UTC (rev 190808)
+++ trunk/Source/JavaScriptCore/dfg/DFGDesiredTransitions.cpp        2015-10-09 17:54:16 UTC (rev 190809)
</span><span class="lines">@@ -34,7 +34,7 @@
</span><span class="cx"> 
</span><span class="cx"> namespace JSC { namespace DFG {
</span><span class="cx"> 
</span><del>-DesiredTransition::DesiredTransition(CodeBlock* codeBlock, CodeBlock* codeOriginOwner, Structure* oldStructure, Structure* newStructure)
</del><ins>+DesiredTransition::DesiredTransition(CodeBlock* codeBlock, ScriptExecutable* codeOriginOwner, Structure* oldStructure, Structure* newStructure)
</ins><span class="cx">     : m_codeBlock(codeBlock)
</span><span class="cx">     , m_codeOriginOwner(codeOriginOwner)
</span><span class="cx">     , m_oldStructure(oldStructure)
</span><span class="lines">@@ -46,7 +46,7 @@
</span><span class="cx"> {
</span><span class="cx">     common-&gt;transitions.append(
</span><span class="cx">         WeakReferenceTransition(
</span><del>-            vm, m_codeBlock,
</del><ins>+            vm, m_codeBlock-&gt;ownerExecutable(),
</ins><span class="cx">             m_codeOriginOwner,
</span><span class="cx">             m_oldStructure, m_newStructure));
</span><span class="cx"> }
</span><span class="lines">@@ -66,7 +66,7 @@
</span><span class="cx"> {
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-void DesiredTransitions::addLazily(CodeBlock* codeBlock, CodeBlock* codeOriginOwner, Structure* oldStructure, Structure* newStructure)
</del><ins>+void DesiredTransitions::addLazily(CodeBlock* codeBlock, ScriptExecutable* codeOriginOwner, Structure* oldStructure, Structure* newStructure)
</ins><span class="cx"> {
</span><span class="cx">     m_transitions.append(DesiredTransition(codeBlock, codeOriginOwner, oldStructure, newStructure));
</span><span class="cx"> }
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGDesiredTransitionsh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGDesiredTransitions.h (190808 => 190809)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGDesiredTransitions.h        2015-10-09 17:53:28 UTC (rev 190808)
+++ trunk/Source/JavaScriptCore/dfg/DFGDesiredTransitions.h        2015-10-09 17:54:16 UTC (rev 190809)
</span><span class="lines">@@ -44,7 +44,7 @@
</span><span class="cx"> 
</span><span class="cx"> class DesiredTransition {
</span><span class="cx"> public:
</span><del>-    DesiredTransition(CodeBlock*, CodeBlock* codeOriginOwner, Structure*, Structure*);
</del><ins>+    DesiredTransition(CodeBlock*, ScriptExecutable*, Structure*, Structure*);
</ins><span class="cx"> 
</span><span class="cx">     void reallyAdd(VM&amp;, CommonData*);
</span><span class="cx">     
</span><span class="lines">@@ -52,7 +52,7 @@
</span><span class="cx"> 
</span><span class="cx"> private:
</span><span class="cx">     CodeBlock* m_codeBlock;
</span><del>-    CodeBlock* m_codeOriginOwner;
</del><ins>+    ScriptExecutable* m_codeOriginOwner;
</ins><span class="cx">     Structure* m_oldStructure;
</span><span class="cx">     Structure* m_newStructure;
</span><span class="cx"> };
</span><span class="lines">@@ -62,7 +62,7 @@
</span><span class="cx">     DesiredTransitions();
</span><span class="cx">     ~DesiredTransitions();
</span><span class="cx"> 
</span><del>-    void addLazily(CodeBlock*, CodeBlock* codeOriginOwner, Structure*, Structure*);
</del><ins>+    void addLazily(CodeBlock*, ScriptExecutable*, Structure*, Structure*);
</ins><span class="cx">     void reallyAdd(VM&amp;, CommonData*);
</span><span class="cx">     void visitChildren(SlotVisitor&amp;);
</span><span class="cx"> 
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGDesiredWeakReferencescpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGDesiredWeakReferences.cpp (190808 => 190809)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGDesiredWeakReferences.cpp        2015-10-09 17:53:28 UTC (rev 190808)
+++ trunk/Source/JavaScriptCore/dfg/DFGDesiredWeakReferences.cpp        2015-10-09 17:54:16 UTC (rev 190809)
</span><span class="lines">@@ -70,10 +70,10 @@
</span><span class="cx">     for (JSCell* target : m_references) {
</span><span class="cx">         if (Structure* structure = jsDynamicCast&lt;Structure*&gt;(target)) {
</span><span class="cx">             common-&gt;weakStructureReferences.append(
</span><del>-                WriteBarrier&lt;Structure&gt;(vm, m_codeBlock, structure));
</del><ins>+                WriteBarrier&lt;Structure&gt;(vm, m_codeBlock-&gt;ownerExecutable(), structure));
</ins><span class="cx">         } else {
</span><span class="cx">             common-&gt;weakReferences.append(
</span><del>-                WriteBarrier&lt;JSCell&gt;(vm, m_codeBlock, target));
</del><ins>+                WriteBarrier&lt;JSCell&gt;(vm, m_codeBlock-&gt;ownerExecutable(), target));
</ins><span class="cx">         }
</span><span class="cx">     }
</span><span class="cx"> }
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGDrivercpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGDriver.cpp (190808 => 190809)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGDriver.cpp        2015-10-09 17:53:28 UTC (rev 190808)
+++ trunk/Source/JavaScriptCore/dfg/DFGDriver.cpp        2015-10-09 17:54:16 UTC (rev 190809)
</span><span class="lines">@@ -121,7 +121,7 @@
</span><span class="cx">         vm, codeBlock, profiledDFGCodeBlock, mode, osrEntryBytecodeIndex, mustHandleValues,
</span><span class="cx">         callback);
</span><span class="cx">     if (result != CompilationDeferred)
</span><del>-        callback-&gt;compilationDidComplete(codeBlock, profiledDFGCodeBlock, result);
</del><ins>+        callback-&gt;compilationDidComplete(codeBlock, result);
</ins><span class="cx">     return result;
</span><span class="cx"> }
</span><span class="cx"> 
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGGraphcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGGraph.cpp (190808 => 190809)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGGraph.cpp        2015-10-09 17:53:28 UTC (rev 190808)
+++ trunk/Source/JavaScriptCore/dfg/DFGGraph.cpp        2015-10-09 17:54:16 UTC (rev 190809)
</span><span class="lines">@@ -61,7 +61,7 @@
</span><span class="cx"> Graph::Graph(VM&amp; vm, Plan&amp; plan, LongLivedState&amp; longLivedState)
</span><span class="cx">     : m_vm(vm)
</span><span class="cx">     , m_plan(plan)
</span><del>-    , m_codeBlock(m_plan.codeBlock)
</del><ins>+    , m_codeBlock(m_plan.codeBlock.get())
</ins><span class="cx">     , m_profiledBlock(m_codeBlock-&gt;alternative())
</span><span class="cx">     , m_allocator(longLivedState.m_allocator)
</span><span class="cx">     , m_nextMachineLocal(0)
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGGraphh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGGraph.h (190808 => 190809)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGGraph.h        2015-10-09 17:53:28 UTC (rev 190808)
+++ trunk/Source/JavaScriptCore/dfg/DFGGraph.h        2015-10-09 17:54:16 UTC (rev 190809)
</span><span class="lines">@@ -348,7 +348,7 @@
</span><span class="cx">         if (!inlineCallFrame)
</span><span class="cx">             return m_codeBlock-&gt;ownerScriptExecutable();
</span><span class="cx">         
</span><del>-        return inlineCallFrame-&gt;baselineCodeBlock-&gt;ownerScriptExecutable();
</del><ins>+        return inlineCallFrame-&gt;executable.get();
</ins><span class="cx">     }
</span><span class="cx">     
</span><span class="cx">     ScriptExecutable* executableFor(const CodeOrigin&amp; codeOrigin)
</span><span class="lines">@@ -372,7 +372,7 @@
</span><span class="cx">     {
</span><span class="cx">         if (!codeOrigin.inlineCallFrame)
</span><span class="cx">             return m_codeBlock-&gt;isStrictMode();
</span><del>-        return codeOrigin.inlineCallFrame-&gt;isStrictMode();
</del><ins>+        return jsCast&lt;FunctionExecutable*&gt;(codeOrigin.inlineCallFrame-&gt;executable.get())-&gt;isStrictMode();
</ins><span class="cx">     }
</span><span class="cx">     
</span><span class="cx">     ECMAMode ecmaModeFor(CodeOrigin codeOrigin)
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGJITCodeh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGJITCode.h (190808 => 190809)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGJITCode.h        2015-10-09 17:53:28 UTC (rev 190808)
+++ trunk/Source/JavaScriptCore/dfg/DFGJITCode.h        2015-10-09 17:54:16 UTC (rev 190809)
</span><span class="lines">@@ -28,7 +28,6 @@
</span><span class="cx"> 
</span><span class="cx"> #if ENABLE(DFG_JIT)
</span><span class="cx"> 
</span><del>-#include &quot;CodeBlock.h&quot;
</del><span class="cx"> #include &quot;CompilationResult.h&quot;
</span><span class="cx"> #include &quot;DFGCommonData.h&quot;
</span><span class="cx"> #include &quot;DFGMinifiedGraph.h&quot;
</span><span class="lines">@@ -117,12 +116,7 @@
</span><span class="cx">     void shrinkToFit();
</span><span class="cx"> 
</span><span class="cx">     RegisterSet liveRegistersToPreserveAtExceptionHandlingCallSite(CodeBlock*, CallSiteIndex) override;
</span><del>-#if ENABLE(FTL_JIT)
-    CodeBlock* osrEntryBlock() { return m_osrEntryBlock.get(); }
-    void setOSREntryBlock(VM&amp; vm, const JSCell* owner, CodeBlock* osrEntryBlock) { m_osrEntryBlock.set(vm, owner, osrEntryBlock); }
-    void clearOSREntryBlock() { m_osrEntryBlock.clear(); }
-#endif
-    
</del><ins>+
</ins><span class="cx"> private:
</span><span class="cx">     friend class JITCompiler; // Allow JITCompiler to call setCodeRef().
</span><span class="cx"> 
</span><span class="lines">@@ -136,7 +130,7 @@
</span><span class="cx"> #if ENABLE(FTL_JIT)
</span><span class="cx">     uint8_t nestedTriggerIsSet { 0 };
</span><span class="cx">     UpperTierExecutionCounter tierUpCounter;
</span><del>-    WriteBarrier&lt;CodeBlock&gt; m_osrEntryBlock;
</del><ins>+    RefPtr&lt;CodeBlock&gt; osrEntryBlock;
</ins><span class="cx">     unsigned osrEntryRetry;
</span><span class="cx">     bool abandonOSREntry;
</span><span class="cx"> #endif // ENABLE(FTL_JIT)
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGJITFinalizercpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGJITFinalizer.cpp (190808 => 190809)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGJITFinalizer.cpp        2015-10-09 17:53:28 UTC (rev 190808)
+++ trunk/Source/JavaScriptCore/dfg/DFGJITFinalizer.cpp        2015-10-09 17:54:16 UTC (rev 190809)
</span><span class="lines">@@ -57,7 +57,7 @@
</span><span class="cx"> bool JITFinalizer::finalize()
</span><span class="cx"> {
</span><span class="cx">     m_jitCode-&gt;initializeCodeRef(
</span><del>-        FINALIZE_DFG_CODE(*m_linkBuffer, (&quot;DFG JIT code for %s&quot;, toCString(CodeBlockWithJITType(m_plan.codeBlock, JITCode::DFGJIT)).data())),
</del><ins>+        FINALIZE_DFG_CODE(*m_linkBuffer, (&quot;DFG JIT code for %s&quot;, toCString(CodeBlockWithJITType(m_plan.codeBlock.get(), JITCode::DFGJIT)).data())),
</ins><span class="cx">         MacroAssemblerCodePtr());
</span><span class="cx">     
</span><span class="cx">     m_plan.codeBlock-&gt;setJITCode(m_jitCode);
</span><span class="lines">@@ -71,7 +71,7 @@
</span><span class="cx"> {
</span><span class="cx">     RELEASE_ASSERT(!m_withArityCheck.isEmptyValue());
</span><span class="cx">     m_jitCode-&gt;initializeCodeRef(
</span><del>-        FINALIZE_DFG_CODE(*m_linkBuffer, (&quot;DFG JIT code for %s&quot;, toCString(CodeBlockWithJITType(m_plan.codeBlock, JITCode::DFGJIT)).data())),
</del><ins>+        FINALIZE_DFG_CODE(*m_linkBuffer, (&quot;DFG JIT code for %s&quot;, toCString(CodeBlockWithJITType(m_plan.codeBlock.get(), JITCode::DFGJIT)).data())),
</ins><span class="cx">         m_withArityCheck);
</span><span class="cx">     m_plan.codeBlock-&gt;setJITCode(m_jitCode);
</span><span class="cx">     
</span><span class="lines">@@ -83,7 +83,7 @@
</span><span class="cx"> void JITFinalizer::finalizeCommon()
</span><span class="cx"> {
</span><span class="cx"> #if ENABLE(FTL_JIT)
</span><del>-    m_jitCode-&gt;optimizeAfterWarmUp(m_plan.codeBlock);
</del><ins>+    m_jitCode-&gt;optimizeAfterWarmUp(m_plan.codeBlock.get());
</ins><span class="cx"> #endif // ENABLE(FTL_JIT)
</span><span class="cx">     
</span><span class="cx">     if (m_plan.compilation)
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGOSRExitCompilerCommoncpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGOSRExitCompilerCommon.cpp (190808 => 190809)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGOSRExitCompilerCommon.cpp        2015-10-09 17:53:28 UTC (rev 190808)
+++ trunk/Source/JavaScriptCore/dfg/DFGOSRExitCompilerCommon.cpp        2015-10-09 17:54:16 UTC (rev 190809)
</span><span class="lines">@@ -69,7 +69,7 @@
</span><span class="cx">             jit.branchTest8(
</span><span class="cx">                 AssemblyHelpers::NonZero,
</span><span class="cx">                 AssemblyHelpers::AbsoluteAddress(
</span><del>-                    inlineCallFrame-&gt;baselineCodeBlock-&gt;ownerScriptExecutable()-&gt;addressOfDidTryToEnterInLoop())));
</del><ins>+                    inlineCallFrame-&gt;executable-&gt;addressOfDidTryToEnterInLoop())));
</ins><span class="cx">     }
</span><span class="cx">     
</span><span class="cx">     jit.move(
</span><span class="lines">@@ -268,14 +268,13 @@
</span><span class="cx"> 
</span><span class="cx"> void adjustAndJumpToTarget(CCallHelpers&amp; jit, const OSRExitBase&amp; exit, bool isExitingToOpCatch)
</span><span class="cx"> {
</span><del>-    CodeBlock* baselineCodeBlock = jit.baselineCodeBlockFor(exit.m_codeOrigin);
-    jit.move(AssemblyHelpers::TrustedImmPtr(baselineCodeBlock), GPRInfo::argumentGPR1);
</del><ins>+    jit.move(AssemblyHelpers::TrustedImmPtr(jit.codeBlock()-&gt;ownerExecutable()), GPRInfo::argumentGPR1);
</ins><span class="cx">     osrWriteBarrier(jit, GPRInfo::argumentGPR1, GPRInfo::nonArgGPR0);
</span><span class="cx">     InlineCallFrameSet* inlineCallFrames = jit.codeBlock()-&gt;jitCode()-&gt;dfgCommon()-&gt;inlineCallFrames.get();
</span><span class="cx">     if (inlineCallFrames) {
</span><span class="cx">         for (InlineCallFrame* inlineCallFrame : *inlineCallFrames) {
</span><del>-            CodeBlock* baselineCodeBlock = inlineCallFrame-&gt;baselineCodeBlock.get();
-            jit.move(AssemblyHelpers::TrustedImmPtr(baselineCodeBlock), GPRInfo::argumentGPR1);
</del><ins>+            ScriptExecutable* ownerExecutable = inlineCallFrame-&gt;executable.get();
+            jit.move(AssemblyHelpers::TrustedImmPtr(ownerExecutable), GPRInfo::argumentGPR1);
</ins><span class="cx">             osrWriteBarrier(jit, GPRInfo::argumentGPR1, GPRInfo::nonArgGPR0);
</span><span class="cx">         }
</span><span class="cx">     }
</span><span class="lines">@@ -283,6 +282,7 @@
</span><span class="cx">     if (exit.m_codeOrigin.inlineCallFrame)
</span><span class="cx">         jit.addPtr(AssemblyHelpers::TrustedImm32(exit.m_codeOrigin.inlineCallFrame-&gt;stackOffset * sizeof(EncodedJSValue)), GPRInfo::callFrameRegister);
</span><span class="cx"> 
</span><ins>+    CodeBlock* baselineCodeBlock = jit.baselineCodeBlockFor(exit.m_codeOrigin);
</ins><span class="cx">     Vector&lt;BytecodeAndMachineOffset&gt;&amp; decodedCodeMap = jit.decodedCodeMapFor(baselineCodeBlock);
</span><span class="cx">     
</span><span class="cx">     BytecodeAndMachineOffset* mapping = binarySearch&lt;BytecodeAndMachineOffset, unsigned&gt;(decodedCodeMap, decodedCodeMap.size(), exit.m_codeOrigin.bytecodeIndex, BytecodeAndMachineOffset::getBytecodeIndex);
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGOSRExitPreparationcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGOSRExitPreparation.cpp (190808 => 190809)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGOSRExitPreparation.cpp        2015-10-09 17:53:28 UTC (rev 190808)
+++ trunk/Source/JavaScriptCore/dfg/DFGOSRExitPreparation.cpp        2015-10-09 17:54:16 UTC (rev 190809)
</span><span class="lines">@@ -42,7 +42,7 @@
</span><span class="cx">     DeferGC deferGC(vm.heap);
</span><span class="cx">     
</span><span class="cx">     for (; codeOrigin.inlineCallFrame; codeOrigin = codeOrigin.inlineCallFrame-&gt;directCaller) {
</span><del>-        CodeBlock* codeBlock = codeOrigin.inlineCallFrame-&gt;baselineCodeBlock.get();
</del><ins>+        CodeBlock* codeBlock = codeOrigin.inlineCallFrame-&gt;baselineCodeBlock();
</ins><span class="cx">         if (codeBlock-&gt;jitType() == JSC::JITCode::BaselineJIT)
</span><span class="cx">             continue;
</span><span class="cx"> 
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGOperationscpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGOperations.cpp (190808 => 190809)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGOperations.cpp        2015-10-09 17:53:28 UTC (rev 190808)
+++ trunk/Source/JavaScriptCore/dfg/DFGOperations.cpp        2015-10-09 17:54:16 UTC (rev 190809)
</span><span class="lines">@@ -1307,7 +1307,7 @@
</span><span class="cx">     
</span><span class="cx">     bool didTryToEnterIntoInlinedLoops = false;
</span><span class="cx">     for (InlineCallFrame* inlineCallFrame = exit-&gt;m_codeOrigin.inlineCallFrame; inlineCallFrame; inlineCallFrame = inlineCallFrame-&gt;directCaller.inlineCallFrame) {
</span><del>-        if (inlineCallFrame-&gt;baselineCodeBlock-&gt;ownerScriptExecutable()-&gt;didTryToEnterInLoop()) {
</del><ins>+        if (inlineCallFrame-&gt;executable-&gt;didTryToEnterInLoop()) {
</ins><span class="cx">             didTryToEnterIntoInlinedLoops = true;
</span><span class="cx">             break;
</span><span class="cx">         }
</span><span class="lines">@@ -1377,8 +1377,8 @@
</span><span class="cx"> 
</span><span class="cx">     // We need to compile the code.
</span><span class="cx">     compile(
</span><del>-        *vm, codeBlock-&gt;newReplacement(), codeBlock, FTLMode, UINT_MAX,
-        Operands&lt;JSValue&gt;(), ToFTLDeferredCompilationCallback::create());
</del><ins>+        *vm, codeBlock-&gt;newReplacement().get(), codeBlock, FTLMode, UINT_MAX,
+        Operands&lt;JSValue&gt;(), ToFTLDeferredCompilationCallback::create(codeBlock));
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> static void triggerTierUpNowCommon(ExecState* exec, bool inLoop)
</span><span class="lines">@@ -1463,7 +1463,7 @@
</span><span class="cx">     if (worklistState == Worklist::Compiling)
</span><span class="cx">         return 0;
</span><span class="cx">     
</span><del>-    if (CodeBlock* entryBlock = jitCode-&gt;osrEntryBlock()) {
</del><ins>+    if (CodeBlock* entryBlock = jitCode-&gt;osrEntryBlock.get()) {
</ins><span class="cx">         void* address = FTL::prepareOSREntry(
</span><span class="cx">             exec, codeBlock, entryBlock, bytecodeIndex, streamIndex);
</span><span class="cx">         if (address)
</span><span class="lines">@@ -1477,7 +1477,7 @@
</span><span class="cx">         
</span><span class="cx">         // OSR entry failed. Oh no! This implies that we need to retry. We retry
</span><span class="cx">         // without exponential backoff and we only do this for the entry code block.
</span><del>-        jitCode-&gt;clearOSREntryBlock();
</del><ins>+        jitCode-&gt;osrEntryBlock = nullptr;
</ins><span class="cx">         jitCode-&gt;osrEntryRetry = 0;
</span><span class="cx">         return 0;
</span><span class="cx">     }
</span><span class="lines">@@ -1494,19 +1494,21 @@
</span><span class="cx">     Operands&lt;JSValue&gt; mustHandleValues;
</span><span class="cx">     jitCode-&gt;reconstruct(
</span><span class="cx">         exec, codeBlock, CodeOrigin(bytecodeIndex), streamIndex, mustHandleValues);
</span><del>-    CodeBlock* replacementCodeBlock = codeBlock-&gt;newReplacement();
</del><ins>+    RefPtr&lt;CodeBlock&gt; replacementCodeBlock = codeBlock-&gt;newReplacement();
</ins><span class="cx">     CompilationResult forEntryResult = compile(
</span><del>-        *vm, replacementCodeBlock, codeBlock, FTLForOSREntryMode, bytecodeIndex,
-        mustHandleValues, ToFTLForOSREntryDeferredCompilationCallback::create());
</del><ins>+        *vm, replacementCodeBlock.get(), codeBlock, FTLForOSREntryMode, bytecodeIndex,
+        mustHandleValues, ToFTLForOSREntryDeferredCompilationCallback::create(codeBlock));
</ins><span class="cx">     
</span><del>-    if (forEntryResult != CompilationSuccessful)
</del><ins>+    if (forEntryResult != CompilationSuccessful) {
+        ASSERT(forEntryResult == CompilationDeferred || replacementCodeBlock-&gt;hasOneRef());
</ins><span class="cx">         return 0;
</span><ins>+    }
</ins><span class="cx"> 
</span><span class="cx">     // It's possible that the for-entry compile already succeeded. In that case OSR
</span><span class="cx">     // entry will succeed unless we ran out of stack. It's not clear what we should do.
</span><span class="cx">     // We signal to try again after a while if that happens.
</span><span class="cx">     void* address = FTL::prepareOSREntry(
</span><del>-        exec, codeBlock, jitCode-&gt;osrEntryBlock(), bytecodeIndex, streamIndex);
</del><ins>+        exec, codeBlock, jitCode-&gt;osrEntryBlock.get(), bytecodeIndex, streamIndex);
</ins><span class="cx">     return static_cast&lt;char*&gt;(address);
</span><span class="cx"> }
</span><span class="cx"> #endif // ENABLE(FTL_JIT)
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGPlancpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGPlan.cpp (190808 => 190809)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGPlan.cpp        2015-10-09 17:53:28 UTC (rev 190808)
+++ trunk/Source/JavaScriptCore/dfg/DFGPlan.cpp        2015-10-09 17:54:16 UTC (rev 190809)
</span><span class="lines">@@ -131,7 +131,7 @@
</span><span class="cx"> 
</span><span class="cx"> } // anonymous namespace
</span><span class="cx"> 
</span><del>-Plan::Plan(CodeBlock* passedCodeBlock, CodeBlock* profiledDFGCodeBlock,
</del><ins>+Plan::Plan(PassRefPtr&lt;CodeBlock&gt; passedCodeBlock, CodeBlock* profiledDFGCodeBlock,
</ins><span class="cx">     CompilationMode mode, unsigned osrEntryBytecodeIndex,
</span><span class="cx">     const Operands&lt;JSValue&gt;&amp; mustHandleValues)
</span><span class="cx">     : vm(*passedCodeBlock-&gt;vm())
</span><span class="lines">@@ -140,10 +140,10 @@
</span><span class="cx">     , mode(mode)
</span><span class="cx">     , osrEntryBytecodeIndex(osrEntryBytecodeIndex)
</span><span class="cx">     , mustHandleValues(mustHandleValues)
</span><del>-    , compilation(codeBlock-&gt;vm()-&gt;m_perBytecodeProfiler ? adoptRef(new Profiler::Compilation(codeBlock-&gt;vm()-&gt;m_perBytecodeProfiler-&gt;ensureBytecodesFor(codeBlock), profilerCompilationKindForMode(mode))) : 0)
</del><ins>+    , compilation(codeBlock-&gt;vm()-&gt;m_perBytecodeProfiler ? adoptRef(new Profiler::Compilation(codeBlock-&gt;vm()-&gt;m_perBytecodeProfiler-&gt;ensureBytecodesFor(codeBlock.get()), profilerCompilationKindForMode(mode))) : 0)
</ins><span class="cx">     , inlineCallFrames(adoptRef(new InlineCallFrameSet()))
</span><del>-    , identifiers(codeBlock)
-    , weakReferences(codeBlock)
</del><ins>+    , identifiers(codeBlock.get())
+    , weakReferences(codeBlock.get())
</ins><span class="cx">     , willTryToTierUp(false)
</span><span class="cx">     , stage(Preparing)
</span><span class="cx"> {
</span><span class="lines">@@ -535,7 +535,7 @@
</span><span class="cx"> 
</span><span class="cx"> void Plan::reallyAdd(CommonData* commonData)
</span><span class="cx"> {
</span><del>-    watchpoints.reallyAdd(codeBlock, *commonData);
</del><ins>+    watchpoints.reallyAdd(codeBlock.get(), *commonData);
</ins><span class="cx">     identifiers.reallyAdd(vm, commonData);
</span><span class="cx">     weakReferences.reallyAdd(vm, commonData);
</span><span class="cx">     transitions.reallyAdd(vm, commonData);
</span><span class="lines">@@ -553,14 +553,14 @@
</span><span class="cx"> 
</span><span class="cx"> void Plan::notifyReady()
</span><span class="cx"> {
</span><del>-    callback-&gt;compilationDidBecomeReadyAsynchronously(codeBlock, profiledDFGCodeBlock);
</del><ins>+    callback-&gt;compilationDidBecomeReadyAsynchronously(codeBlock.get());
</ins><span class="cx">     stage = Ready;
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> CompilationResult Plan::finalizeWithoutNotifyingCallback()
</span><span class="cx"> {
</span><span class="cx">     // We will establish new references from the code block to things. So, we need a barrier.
</span><del>-    vm.heap.writeBarrier(codeBlock);
</del><ins>+    vm.heap.writeBarrier(codeBlock-&gt;ownerExecutable());
</ins><span class="cx">     
</span><span class="cx">     if (!isStillValid())
</span><span class="cx">         return CompilationInvalidated;
</span><span class="lines">@@ -596,7 +596,7 @@
</span><span class="cx"> 
</span><span class="cx"> void Plan::finalizeAndNotifyCallback()
</span><span class="cx"> {
</span><del>-    callback-&gt;compilationDidComplete(codeBlock, profiledDFGCodeBlock, finalizeWithoutNotifyingCallback());
</del><ins>+    callback-&gt;compilationDidComplete(codeBlock.get(), finalizeWithoutNotifyingCallback());
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> CompilationKey Plan::key()
</span><span class="lines">@@ -604,15 +604,16 @@
</span><span class="cx">     return CompilationKey(codeBlock-&gt;alternative(), mode);
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-void Plan::rememberCodeBlocks()
</del><ins>+void Plan::clearCodeBlockMarks()
</ins><span class="cx"> {
</span><span class="cx">     // Compilation writes lots of values to a CodeBlock without performing
</span><span class="cx">     // an explicit barrier. So, we need to be pessimistic and assume that
</span><span class="cx">     // all our CodeBlocks must be visited during GC.
</span><span class="cx"> 
</span><del>-    Heap::heap(codeBlock)-&gt;writeBarrier(codeBlock);
</del><ins>+    codeBlock-&gt;clearMarks();
+    codeBlock-&gt;alternative()-&gt;clearMarks();
</ins><span class="cx">     if (profiledDFGCodeBlock)
</span><del>-        Heap::heap(profiledDFGCodeBlock)-&gt;writeBarrier(profiledDFGCodeBlock);
</del><ins>+        profiledDFGCodeBlock-&gt;clearMarks();
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> void Plan::checkLivenessAndVisitChildren(SlotVisitor&amp; visitor)
</span><span class="lines">@@ -623,13 +624,15 @@
</span><span class="cx">     for (unsigned i = mustHandleValues.size(); i--;)
</span><span class="cx">         visitor.appendUnbarrieredValue(&amp;mustHandleValues[i]);
</span><span class="cx"> 
</span><del>-    visitor.appendUnbarrieredReadOnlyPointer(codeBlock);
-    visitor.appendUnbarrieredReadOnlyPointer(profiledDFGCodeBlock);
</del><ins>+    codeBlock-&gt;visitStrongly(visitor);
+    codeBlock-&gt;alternative()-&gt;visitStrongly(visitor);
+    if (profiledDFGCodeBlock)
+        profiledDFGCodeBlock-&gt;visitStrongly(visitor);
</ins><span class="cx"> 
</span><span class="cx">     if (inlineCallFrames) {
</span><span class="cx">         for (auto* inlineCallFrame : *inlineCallFrames) {
</span><del>-            ASSERT(inlineCallFrame-&gt;baselineCodeBlock.get());
-            visitor.appendUnbarrieredReadOnlyPointer(inlineCallFrame-&gt;baselineCodeBlock.get());
</del><ins>+            ASSERT(inlineCallFrame-&gt;baselineCodeBlock());
+            inlineCallFrame-&gt;baselineCodeBlock()-&gt;visitStrongly(visitor);
</ins><span class="cx">         }
</span><span class="cx">     }
</span><span class="cx"> 
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGPlanh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGPlan.h (190808 => 190809)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGPlan.h        2015-10-09 17:53:28 UTC (rev 190808)
+++ trunk/Source/JavaScriptCore/dfg/DFGPlan.h        2015-10-09 17:54:16 UTC (rev 190809)
</span><span class="lines">@@ -55,7 +55,7 @@
</span><span class="cx"> 
</span><span class="cx"> struct Plan : public ThreadSafeRefCounted&lt;Plan&gt; {
</span><span class="cx">     Plan(
</span><del>-        CodeBlock* codeBlockToCompile, CodeBlock* profiledDFGCodeBlock,
</del><ins>+        PassRefPtr&lt;CodeBlock&gt; codeBlockToCompile, CodeBlock* profiledDFGCodeBlock,
</ins><span class="cx">         CompilationMode, unsigned osrEntryBytecodeIndex,
</span><span class="cx">         const Operands&lt;JSValue&gt;&amp; mustHandleValues);
</span><span class="cx">     ~Plan();
</span><span class="lines">@@ -71,17 +71,14 @@
</span><span class="cx">     
</span><span class="cx">     CompilationKey key();
</span><span class="cx">     
</span><del>-    void rememberCodeBlocks();
</del><ins>+    void clearCodeBlockMarks();
</ins><span class="cx">     void checkLivenessAndVisitChildren(SlotVisitor&amp;);
</span><span class="cx">     bool isKnownToBeLiveDuringGC();
</span><span class="cx">     void cancel();
</span><span class="cx">     
</span><span class="cx">     VM&amp; vm;
</span><del>-
-    // These can be raw pointers because we visit them during every GC in checkLivenessAndVisitChildren.
-    CodeBlock* codeBlock;
-    CodeBlock* profiledDFGCodeBlock;
-
</del><ins>+    RefPtr&lt;CodeBlock&gt; codeBlock;
+    RefPtr&lt;CodeBlock&gt; profiledDFGCodeBlock;
</ins><span class="cx">     CompilationMode mode;
</span><span class="cx">     const unsigned osrEntryBytecodeIndex;
</span><span class="cx">     Operands&lt;JSValue&gt; mustHandleValues;
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGToFTLDeferredCompilationCallbackcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGToFTLDeferredCompilationCallback.cpp (190808 => 190809)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGToFTLDeferredCompilationCallback.cpp        2015-10-09 17:53:28 UTC (rev 190808)
+++ trunk/Source/JavaScriptCore/dfg/DFGToFTLDeferredCompilationCallback.cpp        2015-10-09 17:54:16 UTC (rev 190809)
</span><span class="lines">@@ -35,44 +35,46 @@
</span><span class="cx"> 
</span><span class="cx"> namespace JSC { namespace DFG {
</span><span class="cx"> 
</span><del>-ToFTLDeferredCompilationCallback::ToFTLDeferredCompilationCallback()
</del><ins>+ToFTLDeferredCompilationCallback::ToFTLDeferredCompilationCallback(
+    PassRefPtr&lt;CodeBlock&gt; dfgCodeBlock)
+    : m_dfgCodeBlock(dfgCodeBlock)
</ins><span class="cx"> {
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> ToFTLDeferredCompilationCallback::~ToFTLDeferredCompilationCallback() { }
</span><span class="cx"> 
</span><del>-Ref&lt;ToFTLDeferredCompilationCallback&gt; ToFTLDeferredCompilationCallback::create()
</del><ins>+Ref&lt;ToFTLDeferredCompilationCallback&gt; ToFTLDeferredCompilationCallback::create(PassRefPtr&lt;CodeBlock&gt; dfgCodeBlock)
</ins><span class="cx"> {
</span><del>-    return adoptRef(*new ToFTLDeferredCompilationCallback());
</del><ins>+    return adoptRef(*new ToFTLDeferredCompilationCallback(dfgCodeBlock));
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> void ToFTLDeferredCompilationCallback::compilationDidBecomeReadyAsynchronously(
</span><del>-    CodeBlock* codeBlock, CodeBlock* profiledDFGCodeBlock)
</del><ins>+    CodeBlock* codeBlock)
</ins><span class="cx"> {
</span><span class="cx">     if (Options::verboseOSR()) {
</span><span class="cx">         dataLog(
</span><del>-            &quot;Optimizing compilation of &quot;, *codeBlock, &quot; (for &quot;, *profiledDFGCodeBlock,
</del><ins>+            &quot;Optimizing compilation of &quot;, *codeBlock, &quot; (for &quot;, *m_dfgCodeBlock,
</ins><span class="cx">             &quot;) did become ready.\n&quot;);
</span><span class="cx">     }
</span><span class="cx">     
</span><del>-    profiledDFGCodeBlock-&gt;jitCode()-&gt;dfg()-&gt;forceOptimizationSlowPathConcurrently(
-        profiledDFGCodeBlock);
</del><ins>+    m_dfgCodeBlock-&gt;jitCode()-&gt;dfg()-&gt;forceOptimizationSlowPathConcurrently(
+        m_dfgCodeBlock.get());
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> void ToFTLDeferredCompilationCallback::compilationDidComplete(
</span><del>-    CodeBlock* codeBlock, CodeBlock* profiledDFGCodeBlock, CompilationResult result)
</del><ins>+    CodeBlock* codeBlock, CompilationResult result)
</ins><span class="cx"> {
</span><span class="cx">     if (Options::verboseOSR()) {
</span><span class="cx">         dataLog(
</span><del>-            &quot;Optimizing compilation of &quot;, *codeBlock, &quot; (for &quot;, *profiledDFGCodeBlock,
</del><ins>+            &quot;Optimizing compilation of &quot;, *codeBlock, &quot; (for &quot;, *m_dfgCodeBlock,
</ins><span class="cx">             &quot;) result: &quot;, result, &quot;\n&quot;);
</span><span class="cx">     }
</span><span class="cx">     
</span><del>-    if (profiledDFGCodeBlock-&gt;replacement() != profiledDFGCodeBlock) {
</del><ins>+    if (m_dfgCodeBlock-&gt;replacement() != m_dfgCodeBlock) {
</ins><span class="cx">         if (Options::verboseOSR()) {
</span><span class="cx">             dataLog(
</span><span class="cx">                 &quot;Dropping FTL code block &quot;, *codeBlock, &quot; on the floor because the &quot;
</span><del>-                &quot;DFG code block &quot;, *profiledDFGCodeBlock, &quot; was jettisoned.\n&quot;);
</del><ins>+                &quot;DFG code block &quot;, *m_dfgCodeBlock, &quot; was jettisoned.\n&quot;);
</ins><span class="cx">         }
</span><span class="cx">         return;
</span><span class="cx">     }
</span><span class="lines">@@ -80,10 +82,10 @@
</span><span class="cx">     if (result == CompilationSuccessful)
</span><span class="cx">         codeBlock-&gt;ownerScriptExecutable()-&gt;installCode(codeBlock);
</span><span class="cx">     
</span><del>-    profiledDFGCodeBlock-&gt;jitCode()-&gt;dfg()-&gt;setOptimizationThresholdBasedOnCompilationResult(
-        profiledDFGCodeBlock, result);
</del><ins>+    m_dfgCodeBlock-&gt;jitCode()-&gt;dfg()-&gt;setOptimizationThresholdBasedOnCompilationResult(
+        m_dfgCodeBlock.get(), result);
</ins><span class="cx"> 
</span><del>-    DeferredCompilationCallback::compilationDidComplete(codeBlock, profiledDFGCodeBlock, result);
</del><ins>+    DeferredCompilationCallback::compilationDidComplete(codeBlock, result);
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> } } // JSC::DFG
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGToFTLDeferredCompilationCallbackh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGToFTLDeferredCompilationCallback.h (190808 => 190809)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGToFTLDeferredCompilationCallback.h        2015-10-09 17:53:28 UTC (rev 190808)
+++ trunk/Source/JavaScriptCore/dfg/DFGToFTLDeferredCompilationCallback.h        2015-10-09 17:54:16 UTC (rev 190809)
</span><span class="lines">@@ -40,15 +40,18 @@
</span><span class="cx"> 
</span><span class="cx"> class ToFTLDeferredCompilationCallback : public DeferredCompilationCallback {
</span><span class="cx"> protected:
</span><del>-    ToFTLDeferredCompilationCallback();
</del><ins>+    ToFTLDeferredCompilationCallback(PassRefPtr&lt;CodeBlock&gt; dfgCodeBlock);
</ins><span class="cx"> 
</span><span class="cx"> public:
</span><span class="cx">     virtual ~ToFTLDeferredCompilationCallback();
</span><span class="cx"> 
</span><del>-    static Ref&lt;ToFTLDeferredCompilationCallback&gt; create();
</del><ins>+    static Ref&lt;ToFTLDeferredCompilationCallback&gt; create(PassRefPtr&lt;CodeBlock&gt; dfgCodeBlock);
</ins><span class="cx">     
</span><del>-    virtual void compilationDidBecomeReadyAsynchronously(CodeBlock*, CodeBlock* profiledDFGCodeBlock);
-    virtual void compilationDidComplete(CodeBlock*, CodeBlock* profiledDFGCodeBlock, CompilationResult);
</del><ins>+    virtual void compilationDidBecomeReadyAsynchronously(CodeBlock*);
+    virtual void compilationDidComplete(CodeBlock*, CompilationResult);
+
+private:
+    RefPtr&lt;CodeBlock&gt; m_dfgCodeBlock;
</ins><span class="cx"> };
</span><span class="cx"> 
</span><span class="cx"> } } // namespace JSC::DFG
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGToFTLForOSREntryDeferredCompilationCallbackcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGToFTLForOSREntryDeferredCompilationCallback.cpp (190808 => 190809)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGToFTLForOSREntryDeferredCompilationCallback.cpp        2015-10-09 17:53:28 UTC (rev 190808)
+++ trunk/Source/JavaScriptCore/dfg/DFGToFTLForOSREntryDeferredCompilationCallback.cpp        2015-10-09 17:54:16 UTC (rev 190809)
</span><span class="lines">@@ -35,7 +35,9 @@
</span><span class="cx"> 
</span><span class="cx"> namespace JSC { namespace DFG {
</span><span class="cx"> 
</span><del>-ToFTLForOSREntryDeferredCompilationCallback::ToFTLForOSREntryDeferredCompilationCallback()
</del><ins>+ToFTLForOSREntryDeferredCompilationCallback::ToFTLForOSREntryDeferredCompilationCallback(
+    PassRefPtr&lt;CodeBlock&gt; dfgCodeBlock)
+    : m_dfgCodeBlock(dfgCodeBlock)
</ins><span class="cx"> {
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="lines">@@ -43,38 +45,39 @@
</span><span class="cx"> {
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-Ref&lt;ToFTLForOSREntryDeferredCompilationCallback&gt;ToFTLForOSREntryDeferredCompilationCallback::create()
</del><ins>+Ref&lt;ToFTLForOSREntryDeferredCompilationCallback&gt;ToFTLForOSREntryDeferredCompilationCallback::create(
+    PassRefPtr&lt;CodeBlock&gt; dfgCodeBlock)
</ins><span class="cx"> {
</span><del>-    return adoptRef(*new ToFTLForOSREntryDeferredCompilationCallback());
</del><ins>+    return adoptRef(*new ToFTLForOSREntryDeferredCompilationCallback(dfgCodeBlock));
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> void ToFTLForOSREntryDeferredCompilationCallback::compilationDidBecomeReadyAsynchronously(
</span><del>-    CodeBlock* codeBlock, CodeBlock* profiledDFGCodeBlock)
</del><ins>+    CodeBlock* codeBlock)
</ins><span class="cx"> {
</span><span class="cx">     if (Options::verboseOSR()) {
</span><span class="cx">         dataLog(
</span><del>-            &quot;Optimizing compilation of &quot;, *codeBlock, &quot; (for &quot;, *profiledDFGCodeBlock,
</del><ins>+            &quot;Optimizing compilation of &quot;, *codeBlock, &quot; (for &quot;, *m_dfgCodeBlock,
</ins><span class="cx">             &quot;) did become ready.\n&quot;);
</span><span class="cx">     }
</span><span class="cx">     
</span><del>-    profiledDFGCodeBlock-&gt;jitCode()-&gt;dfg()-&gt;forceOptimizationSlowPathConcurrently(
-        profiledDFGCodeBlock);
</del><ins>+    m_dfgCodeBlock-&gt;jitCode()-&gt;dfg()-&gt;forceOptimizationSlowPathConcurrently(
+        m_dfgCodeBlock.get());
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> void ToFTLForOSREntryDeferredCompilationCallback::compilationDidComplete(
</span><del>-    CodeBlock* codeBlock, CodeBlock* profiledDFGCodeBlock, CompilationResult result)
</del><ins>+    CodeBlock* codeBlock, CompilationResult result)
</ins><span class="cx"> {
</span><span class="cx">     if (Options::verboseOSR()) {
</span><span class="cx">         dataLog(
</span><del>-            &quot;Optimizing compilation of &quot;, *codeBlock, &quot; (for &quot;, *profiledDFGCodeBlock,
</del><ins>+            &quot;Optimizing compilation of &quot;, *codeBlock, &quot; (for &quot;, *m_dfgCodeBlock,
</ins><span class="cx">             &quot;) result: &quot;, result, &quot;\n&quot;);
</span><span class="cx">     }
</span><span class="cx">     
</span><del>-    JITCode* jitCode = profiledDFGCodeBlock-&gt;jitCode()-&gt;dfg();
</del><ins>+    JITCode* jitCode = m_dfgCodeBlock-&gt;jitCode()-&gt;dfg();
</ins><span class="cx">         
</span><span class="cx">     switch (result) {
</span><span class="cx">     case CompilationSuccessful:
</span><del>-        jitCode-&gt;setOSREntryBlock(*codeBlock-&gt;vm(), profiledDFGCodeBlock, codeBlock);
</del><ins>+        jitCode-&gt;osrEntryBlock = codeBlock;
</ins><span class="cx">         break;
</span><span class="cx">     case CompilationFailed:
</span><span class="cx">         jitCode-&gt;osrEntryRetry = 0;
</span><span class="lines">@@ -87,7 +90,7 @@
</span><span class="cx">         break;
</span><span class="cx">     }
</span><span class="cx">     
</span><del>-    DeferredCompilationCallback::compilationDidComplete(codeBlock, profiledDFGCodeBlock, result);
</del><ins>+    DeferredCompilationCallback::compilationDidComplete(codeBlock, result);
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> } } // JSC::DFG
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGToFTLForOSREntryDeferredCompilationCallbackh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGToFTLForOSREntryDeferredCompilationCallback.h (190808 => 190809)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGToFTLForOSREntryDeferredCompilationCallback.h        2015-10-09 17:53:28 UTC (rev 190808)
+++ trunk/Source/JavaScriptCore/dfg/DFGToFTLForOSREntryDeferredCompilationCallback.h        2015-10-09 17:54:16 UTC (rev 190809)
</span><span class="lines">@@ -40,15 +40,18 @@
</span><span class="cx"> 
</span><span class="cx"> class ToFTLForOSREntryDeferredCompilationCallback : public DeferredCompilationCallback {
</span><span class="cx"> protected:
</span><del>-    ToFTLForOSREntryDeferredCompilationCallback();
</del><ins>+    ToFTLForOSREntryDeferredCompilationCallback(PassRefPtr&lt;CodeBlock&gt; dfgCodeBlock);
</ins><span class="cx"> 
</span><span class="cx"> public:
</span><span class="cx">     virtual ~ToFTLForOSREntryDeferredCompilationCallback();
</span><span class="cx"> 
</span><del>-    static Ref&lt;ToFTLForOSREntryDeferredCompilationCallback&gt; create();
</del><ins>+    static Ref&lt;ToFTLForOSREntryDeferredCompilationCallback&gt; create(PassRefPtr&lt;CodeBlock&gt; dfgCodeBlock);
</ins><span class="cx">     
</span><del>-    virtual void compilationDidBecomeReadyAsynchronously(CodeBlock*, CodeBlock* profiledDFGCodeBlock);
-    virtual void compilationDidComplete(CodeBlock*, CodeBlock* profiledDFGCodeBlock, CompilationResult);
</del><ins>+    virtual void compilationDidBecomeReadyAsynchronously(CodeBlock*);
+    virtual void compilationDidComplete(CodeBlock*, CompilationResult);
+
+private:
+    RefPtr&lt;CodeBlock&gt; m_dfgCodeBlock;
</ins><span class="cx"> };
</span><span class="cx"> 
</span><span class="cx"> } } // namespace JSC::DFG
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGWorklistcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGWorklist.cpp (190808 => 190809)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGWorklist.cpp        2015-10-09 17:53:28 UTC (rev 190808)
+++ trunk/Source/JavaScriptCore/dfg/DFGWorklist.cpp        2015-10-09 17:54:16 UTC (rev 190809)
</span><span class="lines">@@ -207,14 +207,14 @@
</span><span class="cx">     completeAllReadyPlansForVM(vm);
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-void Worklist::rememberCodeBlocks(VM&amp; vm)
</del><ins>+void Worklist::clearCodeBlockMarks(VM&amp; vm)
</ins><span class="cx"> {
</span><span class="cx">     LockHolder locker(m_lock);
</span><span class="cx">     for (PlanMap::iterator iter = m_plans.begin(); iter != m_plans.end(); ++iter) {
</span><span class="cx">         Plan* plan = iter-&gt;value.get();
</span><span class="cx">         if (&amp;plan-&gt;vm != &amp;vm)
</span><span class="cx">             continue;
</span><del>-        plan-&gt;rememberCodeBlocks();
</del><ins>+        plan-&gt;clearCodeBlockMarks();
</ins><span class="cx">     }
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="lines">@@ -467,11 +467,11 @@
</span><span class="cx">     }
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-void rememberCodeBlocks(VM&amp; vm)
</del><ins>+void clearCodeBlockMarks(VM&amp; vm)
</ins><span class="cx"> {
</span><span class="cx">     for (unsigned i = DFG::numberOfWorklists(); i--;) {
</span><span class="cx">         if (DFG::Worklist* worklist = DFG::worklistForIndexOrNull(i))
</span><del>-            worklist-&gt;rememberCodeBlocks(vm);
</del><ins>+            worklist-&gt;clearCodeBlockMarks(vm);
</ins><span class="cx">     }
</span><span class="cx"> }
</span><span class="cx"> 
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGWorklisth"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGWorklist.h (190808 => 190809)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGWorklist.h        2015-10-09 17:53:28 UTC (rev 190808)
+++ trunk/Source/JavaScriptCore/dfg/DFGWorklist.h        2015-10-09 17:54:16 UTC (rev 190809)
</span><span class="lines">@@ -57,7 +57,7 @@
</span><span class="cx">     // worklist-&gt;completeAllReadyPlansForVM(vm);
</span><span class="cx">     void completeAllPlansForVM(VM&amp;);
</span><span class="cx"> 
</span><del>-    void rememberCodeBlocks(VM&amp;);
</del><ins>+    void clearCodeBlockMarks(VM&amp;);
</ins><span class="cx"> 
</span><span class="cx">     void waitUntilAllPlansForVMAreReady(VM&amp;);
</span><span class="cx">     State completeAllReadyPlansForVM(VM&amp;, CompilationKey = CompilationKey());
</span><span class="lines">@@ -141,7 +141,7 @@
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> void completeAllPlansForVM(VM&amp;);
</span><del>-void rememberCodeBlocks(VM&amp;);
</del><ins>+void clearCodeBlockMarks(VM&amp;);
</ins><span class="cx"> 
</span><span class="cx"> } } // namespace JSC::DFG
</span><span class="cx"> 
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreftlFTLJITFinalizercpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/ftl/FTLJITFinalizer.cpp (190808 => 190809)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/ftl/FTLJITFinalizer.cpp        2015-10-09 17:53:28 UTC (rev 190808)
+++ trunk/Source/JavaScriptCore/ftl/FTLJITFinalizer.cpp        2015-10-09 17:54:16 UTC (rev 190809)
</span><span class="lines">@@ -99,7 +99,7 @@
</span><span class="cx">         jitCode-&gt;initializeExitThunks(
</span><span class="cx">             FINALIZE_DFG_CODE(
</span><span class="cx">                 *exitThunksLinkBuffer,
</span><del>-                (&quot;FTL exit thunks for %s&quot;, toCString(CodeBlockWithJITType(m_plan.codeBlock, JITCode::FTLJIT)).data())));
</del><ins>+                (&quot;FTL exit thunks for %s&quot;, toCString(CodeBlockWithJITType(m_plan.codeBlock.get(), JITCode::FTLJIT)).data())));
</ins><span class="cx">     } // else this function had no OSR exits, so no exit thunks.
</span><span class="cx">     
</span><span class="cx">     if (sideCodeLinkBuffer) {
</span><span class="lines">@@ -116,7 +116,7 @@
</span><span class="cx">         jitCode-&gt;addHandle(FINALIZE_DFG_CODE(
</span><span class="cx">             *sideCodeLinkBuffer,
</span><span class="cx">             (&quot;FTL side code for %s&quot;,
</span><del>-                toCString(CodeBlockWithJITType(m_plan.codeBlock, JITCode::FTLJIT)).data()))
</del><ins>+                toCString(CodeBlockWithJITType(m_plan.codeBlock.get(), JITCode::FTLJIT)).data()))
</ins><span class="cx">             .executableMemory());
</span><span class="cx">     }
</span><span class="cx">     
</span><span class="lines">@@ -124,7 +124,7 @@
</span><span class="cx">         jitCode-&gt;addHandle(FINALIZE_DFG_CODE(
</span><span class="cx">             *handleExceptionsLinkBuffer,
</span><span class="cx">             (&quot;FTL exception handler for %s&quot;,
</span><del>-                toCString(CodeBlockWithJITType(m_plan.codeBlock, JITCode::FTLJIT)).data()))
</del><ins>+                toCString(CodeBlockWithJITType(m_plan.codeBlock.get(), JITCode::FTLJIT)).data()))
</ins><span class="cx">             .executableMemory());
</span><span class="cx">     }
</span><span class="cx"> 
</span><span class="lines">@@ -137,7 +137,7 @@
</span><span class="cx">     jitCode-&gt;initializeArityCheckEntrypoint(
</span><span class="cx">         FINALIZE_DFG_CODE(
</span><span class="cx">             *entrypointLinkBuffer,
</span><del>-            (&quot;FTL entrypoint thunk for %s with LLVM generated code at %p&quot;, toCString(CodeBlockWithJITType(m_plan.codeBlock, JITCode::FTLJIT)).data(), function)));
</del><ins>+            (&quot;FTL entrypoint thunk for %s with LLVM generated code at %p&quot;, toCString(CodeBlockWithJITType(m_plan.codeBlock.get(), JITCode::FTLJIT)).data(), function)));
</ins><span class="cx">     
</span><span class="cx">     m_plan.codeBlock-&gt;setJITCode(jitCode);
</span><span class="cx"> 
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreheapCodeBlockSetcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/heap/CodeBlockSet.cpp (190808 => 190809)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/heap/CodeBlockSet.cpp        2015-10-09 17:53:28 UTC (rev 190808)
+++ trunk/Source/JavaScriptCore/heap/CodeBlockSet.cpp        2015-10-09 17:54:16 UTC (rev 190809)
</span><span class="lines">@@ -41,11 +41,17 @@
</span><span class="cx"> 
</span><span class="cx"> CodeBlockSet::~CodeBlockSet()
</span><span class="cx"> {
</span><ins>+    for (CodeBlock* codeBlock : m_oldCodeBlocks)
+        codeBlock-&gt;deref();
+
+    for (CodeBlock* codeBlock : m_newCodeBlocks)
+        codeBlock-&gt;deref();
</ins><span class="cx"> }
</span><span class="cx"> 
</span><del>-void CodeBlockSet::add(CodeBlock* codeBlock)
</del><ins>+void CodeBlockSet::add(PassRefPtr&lt;CodeBlock&gt; codeBlock)
</ins><span class="cx"> {
</span><del>-    bool isNewEntry = m_newCodeBlocks.add(codeBlock).isNewEntry;
</del><ins>+    CodeBlock* block = codeBlock.leakRef();
+    bool isNewEntry = m_newCodeBlocks.add(block).isNewEntry;
</ins><span class="cx">     ASSERT_UNUSED(isNewEntry, isNewEntry);
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="lines">@@ -58,35 +64,52 @@
</span><span class="cx"> void CodeBlockSet::clearMarksForFullCollection()
</span><span class="cx"> {
</span><span class="cx">     for (CodeBlock* codeBlock : m_oldCodeBlocks)
</span><del>-        codeBlock-&gt;clearVisitWeaklyHasBeenCalled();
</del><ins>+        codeBlock-&gt;clearMarks();
</ins><span class="cx"> 
</span><span class="cx">     // We promote after we clear marks on the old generation CodeBlocks because
</span><span class="cx">     // none of the young generations CodeBlocks need to be cleared.
</span><span class="cx">     promoteYoungCodeBlocks();
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-void CodeBlockSet::lastChanceToFinalize()
</del><ins>+void CodeBlockSet::clearMarksForEdenCollection(const Vector&lt;const JSCell*&gt;&amp; rememberedSet)
</ins><span class="cx"> {
</span><del>-    for (CodeBlock* codeBlock : m_newCodeBlocks)
-        codeBlock-&gt;classInfo()-&gt;methodTable.destroy(codeBlock);
-
-    for (CodeBlock* codeBlock : m_oldCodeBlocks)
-        codeBlock-&gt;classInfo()-&gt;methodTable.destroy(codeBlock);
</del><ins>+    // This ensures that we will revisit CodeBlocks in remembered Executables even if they were previously marked.
+    for (const JSCell* cell : rememberedSet) {
+        ScriptExecutable* executable = const_cast&lt;ScriptExecutable*&gt;(jsDynamicCast&lt;const ScriptExecutable*&gt;(cell));
+        if (!executable)
+            continue;
+        executable-&gt;forEachCodeBlock([this](CodeBlock* codeBlock) {
+            codeBlock-&gt;clearMarks();
+            m_remembered.add(codeBlock);
+        });
+    }
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> void CodeBlockSet::deleteUnmarkedAndUnreferenced(HeapOperation collectionType)
</span><span class="cx"> {
</span><span class="cx">     HashSet&lt;CodeBlock*&gt;&amp; set = collectionType == EdenCollection ? m_newCodeBlocks : m_oldCodeBlocks;
</span><del>-    Vector&lt;CodeBlock*&gt; unmarked;
-    for (CodeBlock* codeBlock : set) {
-        if (Heap::isMarked(codeBlock))
-            continue;
-        unmarked.append(codeBlock);
-    }
</del><span class="cx"> 
</span><del>-    for (CodeBlock* codeBlock : unmarked) {
-        codeBlock-&gt;classInfo()-&gt;methodTable.destroy(codeBlock);
-        set.remove(codeBlock);
</del><ins>+    // This needs to be a fixpoint because code blocks that are unmarked may
+    // refer to each other. For example, a DFG code block that is owned by
+    // the GC may refer to an FTL for-entry code block that is also owned by
+    // the GC.
+    Vector&lt;CodeBlock*, 16&gt; toRemove;
+    if (verbose)
+        dataLog(&quot;Fixpointing over unmarked, set size = &quot;, set.size(), &quot;...\n&quot;);
+    for (;;) {
+        for (CodeBlock* codeBlock : set) {
+            if (!codeBlock-&gt;hasOneRef())
+                continue;
+            codeBlock-&gt;deref();
+            toRemove.append(codeBlock);
+        }
+        if (verbose)
+            dataLog(&quot;    Removing &quot;, toRemove.size(), &quot; blocks.\n&quot;);
+        if (toRemove.isEmpty())
+            break;
+        for (CodeBlock* codeBlock : toRemove)
+            set.remove(codeBlock);
+        toRemove.resize(0);
</ins><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     // Any remaining young CodeBlocks are live and need to be promoted to the set of old CodeBlocks.
</span><span class="lines">@@ -96,6 +119,7 @@
</span><span class="cx"> 
</span><span class="cx"> void CodeBlockSet::remove(CodeBlock* codeBlock)
</span><span class="cx"> {
</span><ins>+    codeBlock-&gt;deref();
</ins><span class="cx">     if (m_oldCodeBlocks.contains(codeBlock)) {
</span><span class="cx">         m_oldCodeBlocks.remove(codeBlock);
</span><span class="cx">         return;
</span><span class="lines">@@ -104,16 +128,35 @@
</span><span class="cx">     m_newCodeBlocks.remove(codeBlock);
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-void CodeBlockSet::writeBarrierCurrentlyExecutingCodeBlocks(Heap* heap)
</del><ins>+void CodeBlockSet::traceMarked(SlotVisitor&amp; visitor)
</ins><span class="cx"> {
</span><span class="cx">     if (verbose)
</span><ins>+        dataLog(&quot;Tracing &quot;, m_currentlyExecuting.size(), &quot; code blocks.\n&quot;);
+
+    // We strongly visit the currently executing set because jettisoning code
+    // is not valuable once it's on the stack. We're past the point where
+    // jettisoning would avoid the cost of OSR exit.
+    for (const RefPtr&lt;CodeBlock&gt;&amp; codeBlock : m_currentlyExecuting)
+        codeBlock-&gt;visitStrongly(visitor);
+
+    // We strongly visit the remembered set because jettisoning old code during
+    // Eden GC is unsound. There might be an old object with a strong reference
+    // to the code.
+    for (const RefPtr&lt;CodeBlock&gt;&amp; codeBlock : m_remembered)
+        codeBlock-&gt;visitStrongly(visitor);
+}
+
+void CodeBlockSet::rememberCurrentlyExecutingCodeBlocks(Heap* heap)
+{
+    if (verbose)
</ins><span class="cx">         dataLog(&quot;Remembering &quot;, m_currentlyExecuting.size(), &quot; code blocks.\n&quot;);
</span><del>-    for (CodeBlock* codeBlock : m_currentlyExecuting)
-        heap-&gt;writeBarrier(codeBlock);
</del><ins>+    for (const RefPtr&lt;CodeBlock&gt;&amp; codeBlock : m_currentlyExecuting)
+        heap-&gt;writeBarrier(codeBlock-&gt;ownerExecutable());
</ins><span class="cx"> 
</span><del>-    // It's safe to clear this set because we won't delete the CodeBlocks
-    // in it until the next GC, and we'll recompute it at that time.
</del><ins>+    // It's safe to clear these RefPtr sets because we won't delete the CodeBlocks
+    // in them until the next GC, and we'll recompute them at that time.
</ins><span class="cx">     m_currentlyExecuting.clear();
</span><ins>+    m_remembered.clear();
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> void CodeBlockSet::dump(PrintStream&amp; out) const
</span><span class="lines">@@ -128,8 +171,8 @@
</span><span class="cx">         out.print(comma, pointerDump(codeBlock));
</span><span class="cx">     out.print(&quot;], currentlyExecuting = [&quot;);
</span><span class="cx">     comma = CommaPrinter();
</span><del>-    for (CodeBlock* codeBlock : m_currentlyExecuting)
-        out.print(comma, pointerDump(codeBlock));
</del><ins>+    for (const RefPtr&lt;CodeBlock&gt;&amp; codeBlock : m_currentlyExecuting)
+        out.print(comma, pointerDump(codeBlock.get()));
</ins><span class="cx">     out.print(&quot;]}&quot;);
</span><span class="cx"> }
</span><span class="cx"> 
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreheapCodeBlockSeth"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/heap/CodeBlockSet.h (190808 => 190809)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/heap/CodeBlockSet.h        2015-10-09 17:53:28 UTC (rev 190808)
+++ trunk/Source/JavaScriptCore/heap/CodeBlockSet.h        2015-10-09 17:54:16 UTC (rev 190809)
</span><span class="lines">@@ -51,12 +51,13 @@
</span><span class="cx"> public:
</span><span class="cx">     CodeBlockSet();
</span><span class="cx">     ~CodeBlockSet();
</span><del>-
-    void lastChanceToFinalize();
</del><span class="cx">     
</span><span class="cx">     // Add a CodeBlock. This is only called by CodeBlock constructors.
</span><del>-    void add(CodeBlock*);
</del><ins>+    void add(PassRefPtr&lt;CodeBlock&gt;);
</ins><span class="cx">     
</span><ins>+    // Clear mark bits for certain CodeBlocks depending on the type of collection.
+    void clearMarksForEdenCollection(const Vector&lt;const JSCell*&gt;&amp;);
+
</ins><span class="cx">     // Clear all mark bits for all CodeBlocks.
</span><span class="cx">     void clearMarksForFullCollection();
</span><span class="cx"> 
</span><span class="lines">@@ -71,9 +72,13 @@
</span><span class="cx">     
</span><span class="cx">     void remove(CodeBlock*);
</span><span class="cx">     
</span><ins>+    // Trace all marked code blocks. The CodeBlock is free to make use of
+    // mayBeExecuting.
+    void traceMarked(SlotVisitor&amp;);
+
</ins><span class="cx">     // Add all currently executing CodeBlocks to the remembered set to be 
</span><span class="cx">     // re-scanned during the next collection.
</span><del>-    void writeBarrierCurrentlyExecutingCodeBlocks(Heap*);
</del><ins>+    void rememberCurrentlyExecutingCodeBlocks(Heap*);
</ins><span class="cx"> 
</span><span class="cx">     // Visits each CodeBlock in the heap until the visitor function returns true
</span><span class="cx">     // to indicate that it is done iterating, or until every CodeBlock has been
</span><span class="lines">@@ -96,11 +101,16 @@
</span><span class="cx">     void dump(PrintStream&amp;) const;
</span><span class="cx"> 
</span><span class="cx"> private:
</span><ins>+    void clearMarksForCodeBlocksInRememberedExecutables(const Vector&lt;const JSCell*&gt;&amp;);
</ins><span class="cx">     void promoteYoungCodeBlocks();
</span><span class="cx"> 
</span><ins>+    // This is not a set of RefPtr&lt;CodeBlock&gt; because we need to be able to find
+    // arbitrary bogus pointers. I could have written a thingy that had peek types
+    // and all, but that seemed like overkill.
</ins><span class="cx">     HashSet&lt;CodeBlock*&gt; m_oldCodeBlocks;
</span><span class="cx">     HashSet&lt;CodeBlock*&gt; m_newCodeBlocks;
</span><del>-    HashSet&lt;CodeBlock*&gt; m_currentlyExecuting;
</del><ins>+    HashSet&lt;RefPtr&lt;CodeBlock&gt;&gt; m_currentlyExecuting;
+    HashSet&lt;RefPtr&lt;CodeBlock&gt;&gt; m_remembered;
</ins><span class="cx"> };
</span><span class="cx"> 
</span><span class="cx"> } // namespace JSC
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreheapHeapcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/heap/Heap.cpp (190808 => 190809)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/heap/Heap.cpp        2015-10-09 17:53:28 UTC (rev 190808)
+++ trunk/Source/JavaScriptCore/heap/Heap.cpp        2015-10-09 17:54:16 UTC (rev 190809)
</span><span class="lines">@@ -382,7 +382,6 @@
</span><span class="cx">     RELEASE_ASSERT(!m_vm-&gt;entryScope);
</span><span class="cx">     RELEASE_ASSERT(m_operationInProgress == NoOperation);
</span><span class="cx"> 
</span><del>-    m_codeBlocks.lastChanceToFinalize();
</del><span class="cx">     m_objectSpace.lastChanceToFinalize();
</span><span class="cx">     releaseDelayedReleasedObjects();
</span><span class="cx"> 
</span><span class="lines">@@ -521,6 +520,17 @@
</span><span class="cx">     GCPHASE(MarkRoots);
</span><span class="cx">     ASSERT(isValidThreadState(m_vm));
</span><span class="cx"> 
</span><ins>+    Vector&lt;const JSCell*&gt; rememberedSet(m_slotVisitor.markStack().size());
+    m_slotVisitor.markStack().fillVector(rememberedSet);
+
+#if ENABLE(DFG_JIT)
+    DFG::clearCodeBlockMarks(*m_vm);
+#endif
+    if (m_operationInProgress == EdenCollection)
+        m_codeBlocks.clearMarksForEdenCollection(rememberedSet);
+    else
+        m_codeBlocks.clearMarksForFullCollection();
+
</ins><span class="cx">     // We gather conservative roots before clearing mark bits because conservative
</span><span class="cx">     // gathering uses the mark bits to determine whether a reference is valid.
</span><span class="cx">     ConservativeRoots conservativeRoots(&amp;m_objectSpace.blocks(), &amp;m_storageSpace);
</span><span class="lines">@@ -528,17 +538,11 @@
</span><span class="cx">     gatherJSStackRoots(conservativeRoots);
</span><span class="cx">     gatherScratchBufferRoots(conservativeRoots);
</span><span class="cx"> 
</span><del>-#if ENABLE(DFG_JIT)
-    DFG::rememberCodeBlocks(*m_vm);
-#endif
</del><ins>+    clearLivenessData();
</ins><span class="cx"> 
</span><del>-    if (m_operationInProgress == FullCollection) {
</del><ins>+    if (m_operationInProgress == FullCollection)
</ins><span class="cx">         m_opaqueRoots.clear();
</span><del>-        m_slotVisitor.clearMarkStack();
-    }
</del><span class="cx"> 
</span><del>-    clearLivenessData();
-
</del><span class="cx">     m_parallelMarkersShouldExit = false;
</span><span class="cx"> 
</span><span class="cx">     m_helperClient.setFunction(
</span><span class="lines">@@ -576,7 +580,6 @@
</span><span class="cx">     {
</span><span class="cx">         ParallelModeEnabler enabler(m_slotVisitor);
</span><span class="cx"> 
</span><del>-        m_slotVisitor.donateAndDrain();
</del><span class="cx">         visitExternalRememberedSet();
</span><span class="cx">         visitSmallStrings();
</span><span class="cx">         visitConservativeRoots(conservativeRoots);
</span><span class="lines">@@ -691,9 +694,6 @@
</span><span class="cx"> void Heap::clearLivenessData()
</span><span class="cx"> {
</span><span class="cx">     GCPHASE(ClearLivenessData);
</span><del>-    if (m_operationInProgress == FullCollection)
-        m_codeBlocks.clearMarksForFullCollection();
-
</del><span class="cx">     m_objectSpace.clearNewlyAllocated();
</span><span class="cx">     m_objectSpace.clearMarks();
</span><span class="cx"> }
</span><span class="lines">@@ -815,6 +815,7 @@
</span><span class="cx"> void Heap::traceCodeBlocksAndJITStubRoutines()
</span><span class="cx"> {
</span><span class="cx">     GCPHASE(TraceCodeBlocksAndJITStubRoutines);
</span><ins>+    m_codeBlocks.traceMarked(m_slotVisitor);
</ins><span class="cx">     m_jitStubRoutines.traceMarkedStubRoutines(m_slotVisitor);
</span><span class="cx"> 
</span><span class="cx">     if (Options::logGC() == GCLogging::Verbose)
</span><span class="lines">@@ -948,12 +949,18 @@
</span><span class="cx">     // If JavaScript is running, it's not safe to delete all JavaScript code, since
</span><span class="cx">     // we'll end up returning to deleted code.
</span><span class="cx">     RELEASE_ASSERT(!m_vm-&gt;entryScope);
</span><del>-    ASSERT(m_operationInProgress == NoOperation);
</del><span class="cx"> 
</span><span class="cx">     completeAllDFGPlans();
</span><span class="cx"> 
</span><del>-    for (ExecutableBase* executable : m_executables)
-        executable-&gt;clearCode();
</del><ins>+    for (ExecutableBase* current : m_executables) {
+        if (!current-&gt;isFunctionExecutable())
+            continue;
+        static_cast&lt;FunctionExecutable*&gt;(current)-&gt;clearCode();
+    }
+
+    ASSERT(m_operationInProgress == FullCollection || m_operationInProgress == NoOperation);
+    m_codeBlocks.clearMarksForFullCollection();
+    m_codeBlocks.deleteUnmarkedAndUnreferenced(FullCollection);
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> void Heap::deleteAllUnlinkedCodeBlocks()
</span><span class="lines">@@ -973,9 +980,9 @@
</span><span class="cx">         if (isMarked(current))
</span><span class="cx">             continue;
</span><span class="cx"> 
</span><del>-        // Eagerly dereference the Executable's JITCode in order to run watchpoint
-        // destructors. Otherwise, watchpoints might fire for deleted CodeBlocks.
-        current-&gt;clearCode();
</del><ins>+        // We do this because executable memory is limited on some platforms and because
+        // CodeBlock requires eager finalization.
+        ExecutableBase::clearCodeVirtual(current);
</ins><span class="cx">         std::swap(m_executables[i], m_executables.last());
</span><span class="cx">         m_executables.removeLast();
</span><span class="cx">     }
</span><span class="lines">@@ -1096,7 +1103,7 @@
</span><span class="cx">     deleteUnmarkedCompiledCode();
</span><span class="cx">     deleteSourceProviderCaches();
</span><span class="cx">     notifyIncrementalSweeper();
</span><del>-    writeBarrierCurrentlyExecutingCodeBlocks();
</del><ins>+    rememberCurrentlyExecutingCodeBlocks();
</ins><span class="cx"> 
</span><span class="cx">     resetAllocators();
</span><span class="cx">     updateAllocationLimits();
</span><span class="lines">@@ -1133,6 +1140,7 @@
</span><span class="cx">     GCPHASE(StartingCollection);
</span><span class="cx">     if (shouldDoFullCollection(collectionType)) {
</span><span class="cx">         m_operationInProgress = FullCollection;
</span><ins>+        m_slotVisitor.clearMarkStack();
</ins><span class="cx">         m_shouldDoFullCollection = false;
</span><span class="cx">         if (Options::logGC())
</span><span class="cx">             dataLog(&quot;FullCollection, &quot;);
</span><span class="lines">@@ -1249,10 +1257,10 @@
</span><span class="cx">     m_sweeper-&gt;startSweeping();
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-void Heap::writeBarrierCurrentlyExecutingCodeBlocks()
</del><ins>+void Heap::rememberCurrentlyExecutingCodeBlocks()
</ins><span class="cx"> {
</span><del>-    GCPHASE(WriteBarrierCurrentlyExecutingCodeBlocks);
-    m_codeBlocks.writeBarrierCurrentlyExecutingCodeBlocks(this);
</del><ins>+    GCPHASE(RememberCurrentlyExecutingCodeBlocks);
+    m_codeBlocks.rememberCurrentlyExecutingCodeBlocks(this);
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> void Heap::resetAllocators()
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreheapHeaph"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/heap/Heap.h (190808 => 190809)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/heap/Heap.h        2015-10-09 17:53:28 UTC (rev 190808)
+++ trunk/Source/JavaScriptCore/heap/Heap.h        2015-10-09 17:54:16 UTC (rev 190809)
</span><span class="lines">@@ -227,6 +227,8 @@
</span><span class="cx">         template&lt;typename T&gt; void releaseSoon(RetainPtr&lt;T&gt;&amp;&amp;);
</span><span class="cx"> #endif
</span><span class="cx"> 
</span><ins>+    void removeCodeBlock(CodeBlock* cb) { m_codeBlocks.remove(cb); }
+
</ins><span class="cx">     static bool isZombified(JSCell* cell) { return *(void**)cell == zombifiedBits; }
</span><span class="cx"> 
</span><span class="cx">     void registerWeakGCMap(void* weakGCMap, std::function&lt;void()&gt; pruningCallback);
</span><span class="lines">@@ -312,7 +314,7 @@
</span><span class="cx">     void snapshotMarkedSpace();
</span><span class="cx">     void deleteSourceProviderCaches();
</span><span class="cx">     void notifyIncrementalSweeper();
</span><del>-    void writeBarrierCurrentlyExecutingCodeBlocks();
</del><ins>+    void rememberCurrentlyExecutingCodeBlocks();
</ins><span class="cx">     void resetAllocators();
</span><span class="cx">     void copyBackingStores();
</span><span class="cx">     void harvestWeakReferences();
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreinterpreterInterpretercpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/interpreter/Interpreter.cpp (190808 => 190809)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/interpreter/Interpreter.cpp        2015-10-09 17:53:28 UTC (rev 190808)
+++ trunk/Source/JavaScriptCore/interpreter/Interpreter.cpp        2015-10-09 17:54:16 UTC (rev 190809)
</span><span class="lines">@@ -172,7 +172,7 @@
</span><span class="cx">         ASSERT(!callFrame-&gt;vm().exception());
</span><span class="cx"> 
</span><span class="cx">         ThisTDZMode thisTDZMode = callerCodeBlock-&gt;unlinkedCodeBlock()-&gt;constructorKind() == ConstructorKind::Derived ? ThisTDZMode::AlwaysCheck : ThisTDZMode::CheckIfNeeded;
</span><del>-        eval = callerCodeBlock-&gt;evalCodeCache().getSlow(callFrame, callerCodeBlock, callerCodeBlock-&gt;isStrictMode(), thisTDZMode, programSource, callerScopeChain);
</del><ins>+        eval = callerCodeBlock-&gt;evalCodeCache().getSlow(callFrame, callerCodeBlock-&gt;ownerScriptExecutable(), callerCodeBlock-&gt;isStrictMode(), thisTDZMode, programSource, callerScopeChain);
</ins><span class="cx">         if (!eval)
</span><span class="cx">             return jsUndefined();
</span><span class="cx">     }
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreinterpreterStackVisitorcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/interpreter/StackVisitor.cpp (190808 => 190809)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/interpreter/StackVisitor.cpp        2015-10-09 17:53:28 UTC (rev 190808)
+++ trunk/Source/JavaScriptCore/interpreter/StackVisitor.cpp        2015-10-09 17:54:16 UTC (rev 190809)
</span><span class="lines">@@ -169,7 +169,7 @@
</span><span class="cx">             m_frame.m_argumentCountIncludingThis = callFrame-&gt;r(inlineCallFrame-&gt;argumentCountRegister.offset()).unboxedInt32();
</span><span class="cx">         else
</span><span class="cx">             m_frame.m_argumentCountIncludingThis = inlineCallFrame-&gt;arguments.size();
</span><del>-        m_frame.m_codeBlock = inlineCallFrame-&gt;baselineCodeBlock.get();
</del><ins>+        m_frame.m_codeBlock = inlineCallFrame-&gt;baselineCodeBlock();
</ins><span class="cx">         m_frame.m_bytecodeOffset = codeOrigin-&gt;bytecodeIndex;
</span><span class="cx"> 
</span><span class="cx">         JSFunction* callee = inlineCallFrame-&gt;calleeForCallFrame(callFrame);
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorejitAssemblyHelperscpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/jit/AssemblyHelpers.cpp (190808 => 190809)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/jit/AssemblyHelpers.cpp        2015-10-09 17:53:28 UTC (rev 190808)
+++ trunk/Source/JavaScriptCore/jit/AssemblyHelpers.cpp        2015-10-09 17:54:16 UTC (rev 190809)
</span><span class="lines">@@ -38,7 +38,7 @@
</span><span class="cx">     if (!codeOrigin.inlineCallFrame)
</span><span class="cx">         return m_codeBlock-&gt;ownerExecutable();
</span><span class="cx">     
</span><del>-    return codeOrigin.inlineCallFrame-&gt;baselineCodeBlock-&gt;ownerExecutable();
</del><ins>+    return codeOrigin.inlineCallFrame-&gt;executable.get();
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> Vector&lt;BytecodeAndMachineOffset&gt;&amp; AssemblyHelpers::decodedCodeMapFor(CodeBlock* codeBlock)
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorejitAssemblyHelpersh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/jit/AssemblyHelpers.h (190808 => 190809)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/jit/AssemblyHelpers.h        2015-10-09 17:53:28 UTC (rev 190808)
+++ trunk/Source/JavaScriptCore/jit/AssemblyHelpers.h        2015-10-09 17:54:16 UTC (rev 190809)
</span><span class="lines">@@ -1082,7 +1082,7 @@
</span><span class="cx">     {
</span><span class="cx">         if (!codeOrigin.inlineCallFrame)
</span><span class="cx">             return codeBlock()-&gt;isStrictMode();
</span><del>-        return codeOrigin.inlineCallFrame-&gt;isStrictMode();
</del><ins>+        return jsCast&lt;FunctionExecutable*&gt;(codeOrigin.inlineCallFrame-&gt;executable.get())-&gt;isStrictMode();
</ins><span class="cx">     }
</span><span class="cx">     
</span><span class="cx">     ECMAMode ecmaModeFor(CodeOrigin codeOrigin)
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorejitGCAwareJITStubRoutineh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/jit/GCAwareJITStubRoutine.h (190808 => 190809)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/jit/GCAwareJITStubRoutine.h        2015-10-09 17:53:28 UTC (rev 190808)
+++ trunk/Source/JavaScriptCore/jit/GCAwareJITStubRoutine.h        2015-10-09 17:54:16 UTC (rev 190809)
</span><span class="lines">@@ -132,7 +132,7 @@
</span><span class="cx"> // Helper for the creation of simple stub routines that need no help from the GC. Note
</span><span class="cx"> // that codeBlock gets &quot;executed&quot; more than once.
</span><span class="cx"> #define FINALIZE_CODE_FOR_GC_AWARE_STUB(codeBlock, patchBuffer, makesCalls, cell, dataLogFArguments) \
</span><del>-    (createJITStubRoutine(FINALIZE_CODE_FOR((codeBlock), (patchBuffer), dataLogFArguments), *(codeBlock)-&gt;vm(), (codeBlock), (makesCalls), (cell)))
</del><ins>+    (createJITStubRoutine(FINALIZE_CODE_FOR((codeBlock), (patchBuffer), dataLogFArguments), *(codeBlock)-&gt;vm(), (codeBlock)-&gt;ownerExecutable(), (makesCalls), (cell)))
</ins><span class="cx"> 
</span><span class="cx"> } // namespace JSC
</span><span class="cx"> 
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorejitJITCodeh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/jit/JITCode.h (190808 => 190809)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/jit/JITCode.h        2015-10-09 17:53:28 UTC (rev 190808)
+++ trunk/Source/JavaScriptCore/jit/JITCode.h        2015-10-09 17:54:16 UTC (rev 190809)
</span><span class="lines">@@ -122,6 +122,28 @@
</span><span class="cx">         }
</span><span class="cx">     }
</span><span class="cx"> 
</span><ins>+    static std::chrono::milliseconds timeToLive(JITType jitType)
+    {
+        switch (jitType) {
+        case InterpreterThunk:
+            return std::chrono::duration_cast&lt;std::chrono::milliseconds&gt;(
+                std::chrono::seconds(5));
+        case BaselineJIT:
+            // Effectively 10 additional seconds, since BaselineJIT and
+            // InterpreterThunk share a CodeBlock.
+            return std::chrono::duration_cast&lt;std::chrono::milliseconds&gt;(
+                std::chrono::seconds(15));
+        case DFGJIT:
+            return std::chrono::duration_cast&lt;std::chrono::milliseconds&gt;(
+                std::chrono::seconds(20));
+        case FTLJIT:
+            return std::chrono::duration_cast&lt;std::chrono::milliseconds&gt;(
+                std::chrono::seconds(60));
+        default:
+            return std::chrono::milliseconds::max();
+        }
+    }
+
</ins><span class="cx">     static bool isLowerTier(JITType expectedLower, JITType expectedHigher)
</span><span class="cx">     {
</span><span class="cx">         RELEASE_ASSERT(isExecutableScript(expectedLower));
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorejitJITOpcodescpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/jit/JITOpcodes.cpp (190808 => 190809)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/jit/JITOpcodes.cpp        2015-10-09 17:53:28 UTC (rev 190808)
+++ trunk/Source/JavaScriptCore/jit/JITOpcodes.cpp        2015-10-09 17:54:16 UTC (rev 190809)
</span><span class="lines">@@ -666,7 +666,7 @@
</span><span class="cx">     for (size_t j = CodeBlock::llintBaselineCalleeSaveSpaceAsVirtualRegisters(); j &lt; count; ++j)
</span><span class="cx">         emitInitRegister(virtualRegisterForLocal(j).offset());
</span><span class="cx"> 
</span><del>-    emitWriteBarrier(m_codeBlock);
</del><ins>+    emitWriteBarrier(m_codeBlock-&gt;ownerExecutable());
</ins><span class="cx"> 
</span><span class="cx">     emitEnterOptimizationCheck();
</span><span class="cx"> }
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorejitJITOperationscpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/jit/JITOperations.cpp (190808 => 190809)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/jit/JITOperations.cpp        2015-10-09 17:53:28 UTC (rev 190808)
+++ trunk/Source/JavaScriptCore/jit/JITOperations.cpp        2015-10-09 17:54:16 UTC (rev 190809)
</span><span class="lines">@@ -1267,13 +1267,15 @@
</span><span class="cx">             mustHandleValues[i] = exec-&gt;uncheckedR(operand).jsValue();
</span><span class="cx">         }
</span><span class="cx"> 
</span><del>-        CodeBlock* replacementCodeBlock = codeBlock-&gt;newReplacement();
</del><ins>+        RefPtr&lt;CodeBlock&gt; replacementCodeBlock = codeBlock-&gt;newReplacement();
</ins><span class="cx">         CompilationResult result = DFG::compile(
</span><del>-            vm, replacementCodeBlock, nullptr, DFG::DFGMode, bytecodeIndex,
</del><ins>+            vm, replacementCodeBlock.get(), 0, DFG::DFGMode, bytecodeIndex,
</ins><span class="cx">             mustHandleValues, JITToDFGDeferredCompilationCallback::create());
</span><span class="cx">         
</span><del>-        if (result != CompilationSuccessful)
</del><ins>+        if (result != CompilationSuccessful) {
+            ASSERT(result == CompilationDeferred || replacementCodeBlock-&gt;hasOneRef());
</ins><span class="cx">             return encodeResult(0, 0);
</span><ins>+        }
</ins><span class="cx">     }
</span><span class="cx">     
</span><span class="cx">     CodeBlock* optimizedCodeBlock = codeBlock-&gt;replacement();
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorejitJITToDFGDeferredCompilationCallbackcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/jit/JITToDFGDeferredCompilationCallback.cpp (190808 => 190809)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/jit/JITToDFGDeferredCompilationCallback.cpp        2015-10-09 17:53:28 UTC (rev 190808)
+++ trunk/Source/JavaScriptCore/jit/JITToDFGDeferredCompilationCallback.cpp        2015-10-09 17:54:16 UTC (rev 190809)
</span><span class="lines">@@ -43,9 +43,8 @@
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> void JITToDFGDeferredCompilationCallback::compilationDidBecomeReadyAsynchronously(
</span><del>-    CodeBlock* codeBlock, CodeBlock* profiledDFGCodeBlock)
</del><ins>+    CodeBlock* codeBlock)
</ins><span class="cx"> {
</span><del>-    ASSERT_UNUSED(profiledDFGCodeBlock, !profiledDFGCodeBlock);
</del><span class="cx">     ASSERT(codeBlock-&gt;alternative()-&gt;jitType() == JITCode::BaselineJIT);
</span><span class="cx">     
</span><span class="cx">     if (Options::verboseOSR())
</span><span class="lines">@@ -55,9 +54,8 @@
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> void JITToDFGDeferredCompilationCallback::compilationDidComplete(
</span><del>-    CodeBlock* codeBlock, CodeBlock* profiledDFGCodeBlock, CompilationResult result)
</del><ins>+    CodeBlock* codeBlock, CompilationResult result)
</ins><span class="cx"> {
</span><del>-    ASSERT(!profiledDFGCodeBlock);
</del><span class="cx">     ASSERT(codeBlock-&gt;alternative()-&gt;jitType() == JITCode::BaselineJIT);
</span><span class="cx">     
</span><span class="cx">     if (Options::verboseOSR())
</span><span class="lines">@@ -68,7 +66,7 @@
</span><span class="cx">     
</span><span class="cx">     codeBlock-&gt;alternative()-&gt;setOptimizationThresholdBasedOnCompilationResult(result);
</span><span class="cx"> 
</span><del>-    DeferredCompilationCallback::compilationDidComplete(codeBlock, profiledDFGCodeBlock, result);
</del><ins>+    DeferredCompilationCallback::compilationDidComplete(codeBlock, result);
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> } // JSC
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorejitJITToDFGDeferredCompilationCallbackh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/jit/JITToDFGDeferredCompilationCallback.h (190808 => 190809)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/jit/JITToDFGDeferredCompilationCallback.h        2015-10-09 17:53:28 UTC (rev 190808)
+++ trunk/Source/JavaScriptCore/jit/JITToDFGDeferredCompilationCallback.h        2015-10-09 17:54:16 UTC (rev 190809)
</span><span class="lines">@@ -44,8 +44,8 @@
</span><span class="cx"> 
</span><span class="cx">     static Ref&lt;JITToDFGDeferredCompilationCallback&gt; create();
</span><span class="cx">     
</span><del>-    virtual void compilationDidBecomeReadyAsynchronously(CodeBlock*, CodeBlock* profiledDFGCodeBlock) override;
-    virtual void compilationDidComplete(CodeBlock*, CodeBlock* profiledDFGCodeBlock, CompilationResult) override;
</del><ins>+    virtual void compilationDidBecomeReadyAsynchronously(CodeBlock*) override;
+    virtual void compilationDidComplete(CodeBlock*, CompilationResult) override;
</ins><span class="cx"> };
</span><span class="cx"> 
</span><span class="cx"> } // namespace JSC
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorejitRepatchcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/jit/Repatch.cpp (190808 => 190809)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/jit/Repatch.cpp        2015-10-09 17:53:28 UTC (rev 190808)
+++ trunk/Source/JavaScriptCore/jit/Repatch.cpp        2015-10-09 17:54:16 UTC (rev 190809)
</span><span class="lines">@@ -222,14 +222,15 @@
</span><span class="cx">         return GiveUpOnCache;
</span><span class="cx"> 
</span><span class="cx">     CodeBlock* codeBlock = exec-&gt;codeBlock();
</span><ins>+    ScriptExecutable* owner = codeBlock-&gt;ownerScriptExecutable();
</ins><span class="cx">     VM&amp; vm = exec-&gt;vm();
</span><span class="cx"> 
</span><span class="cx">     std::unique_ptr&lt;AccessCase&gt; newCase;
</span><span class="cx"> 
</span><span class="cx">     if (isJSArray(baseValue) &amp;&amp; propertyName == exec-&gt;propertyNames().length)
</span><del>-        newCase = AccessCase::getLength(vm, codeBlock, AccessCase::ArrayLength);
</del><ins>+        newCase = AccessCase::getLength(vm, owner, AccessCase::ArrayLength);
</ins><span class="cx">     else if (isJSString(baseValue) &amp;&amp; propertyName == exec-&gt;propertyNames().length)
</span><del>-        newCase = AccessCase::getLength(vm, codeBlock, AccessCase::StringLength);
</del><ins>+        newCase = AccessCase::getLength(vm, owner, AccessCase::StringLength);
</ins><span class="cx">     else {
</span><span class="cx">         if (!slot.isCacheable() &amp;&amp; !slot.isUnset())
</span><span class="cx">             return GiveUpOnCache;
</span><span class="lines">@@ -274,10 +275,10 @@
</span><span class="cx">             
</span><span class="cx">             if (slot.isUnset()) {
</span><span class="cx">                 conditionSet = generateConditionsForPropertyMiss(
</span><del>-                    vm, codeBlock, exec, structure, propertyName.impl());
</del><ins>+                    vm, codeBlock-&gt;ownerExecutable(), exec, structure, propertyName.impl());
</ins><span class="cx">             } else {
</span><span class="cx">                 conditionSet = generateConditionsForPrototypePropertyHit(
</span><del>-                    vm, codeBlock, exec, structure, slot.slotBase(),
</del><ins>+                    vm, codeBlock-&gt;ownerExecutable(), exec, structure, slot.slotBase(),
</ins><span class="cx">                     propertyName.impl());
</span><span class="cx">             }
</span><span class="cx">             
</span><span class="lines">@@ -298,7 +299,7 @@
</span><span class="cx">             type = AccessCase::CustomGetter;
</span><span class="cx"> 
</span><span class="cx">         newCase = AccessCase::get(
</span><del>-            vm, codeBlock, type, offset, structure, conditionSet, loadTargetFromProxy,
</del><ins>+            vm, owner, type, offset, structure, conditionSet, loadTargetFromProxy,
</ins><span class="cx">             slot.watchpointSet(), slot.isCacheableCustom() ? slot.customGetter() : nullptr,
</span><span class="cx">             slot.isCacheableCustom() ? slot.slotBase() : nullptr);
</span><span class="cx">     }
</span><span class="lines">@@ -352,6 +353,7 @@
</span><span class="cx">         return GiveUpOnCache;
</span><span class="cx">     
</span><span class="cx">     CodeBlock* codeBlock = exec-&gt;codeBlock();
</span><ins>+    ScriptExecutable* owner = codeBlock-&gt;ownerScriptExecutable();
</ins><span class="cx">     VM&amp; vm = exec-&gt;vm();
</span><span class="cx"> 
</span><span class="cx">     if (!baseValue.isCell())
</span><span class="lines">@@ -382,7 +384,7 @@
</span><span class="cx">                 return RetryCacheLater;
</span><span class="cx">             }
</span><span class="cx"> 
</span><del>-            newCase = AccessCase::replace(vm, codeBlock, structure, slot.cachedOffset());
</del><ins>+            newCase = AccessCase::replace(vm, owner, structure, slot.cachedOffset());
</ins><span class="cx">         } else {
</span><span class="cx">             ASSERT(slot.type() == PutPropertySlot::NewProperty);
</span><span class="cx"> 
</span><span class="lines">@@ -404,12 +406,12 @@
</span><span class="cx">             if (putKind == NotDirect) {
</span><span class="cx">                 conditionSet =
</span><span class="cx">                     generateConditionsForPropertySetterMiss(
</span><del>-                        vm, codeBlock, exec, newStructure, ident.impl());
</del><ins>+                        vm, owner, exec, newStructure, ident.impl());
</ins><span class="cx">                 if (!conditionSet.isValid())
</span><span class="cx">                     return GiveUpOnCache;
</span><span class="cx">             }
</span><span class="cx"> 
</span><del>-            newCase = AccessCase::transition(vm, codeBlock, structure, newStructure, offset, conditionSet);
</del><ins>+            newCase = AccessCase::transition(vm, owner, structure, newStructure, offset, conditionSet);
</ins><span class="cx">         }
</span><span class="cx">     } else if (slot.isCacheableCustom() || slot.isCacheableSetter()) {
</span><span class="cx">         if (slot.isCacheableCustom()) {
</span><span class="lines">@@ -418,13 +420,13 @@
</span><span class="cx">             if (slot.base() != baseValue) {
</span><span class="cx">                 conditionSet =
</span><span class="cx">                     generateConditionsForPrototypePropertyHitCustom(
</span><del>-                        vm, codeBlock, exec, structure, slot.base(), ident.impl());
</del><ins>+                        vm, owner, exec, structure, slot.base(), ident.impl());
</ins><span class="cx">                 if (!conditionSet.isValid())
</span><span class="cx">                     return GiveUpOnCache;
</span><span class="cx">             }
</span><span class="cx"> 
</span><span class="cx">             newCase = AccessCase::setter(
</span><del>-                vm, codeBlock, AccessCase::CustomSetter, structure, invalidOffset, conditionSet,
</del><ins>+                vm, owner, AccessCase::CustomSetter, structure, invalidOffset, conditionSet,
</ins><span class="cx">                 slot.customSetter(), slot.base());
</span><span class="cx">         } else {
</span><span class="cx">             ObjectPropertyConditionSet conditionSet;
</span><span class="lines">@@ -433,7 +435,7 @@
</span><span class="cx">             if (slot.base() != baseValue) {
</span><span class="cx">                 conditionSet =
</span><span class="cx">                     generateConditionsForPrototypePropertyHit(
</span><del>-                        vm, codeBlock, exec, structure, slot.base(), ident.impl());
</del><ins>+                        vm, owner, exec, structure, slot.base(), ident.impl());
</ins><span class="cx">                 if (!conditionSet.isValid())
</span><span class="cx">                     return GiveUpOnCache;
</span><span class="cx">                 offset = conditionSet.slotBaseCondition().offset();
</span><span class="lines">@@ -441,7 +443,7 @@
</span><span class="cx">                 offset = slot.cachedOffset();
</span><span class="cx"> 
</span><span class="cx">             newCase = AccessCase::setter(
</span><del>-                vm, codeBlock, AccessCase::Setter, structure, offset, conditionSet);
</del><ins>+                vm, owner, AccessCase::Setter, structure, offset, conditionSet);
</ins><span class="cx">         }
</span><span class="cx">     }
</span><span class="cx"> 
</span><span class="lines">@@ -483,6 +485,7 @@
</span><span class="cx">     }
</span><span class="cx">     
</span><span class="cx">     CodeBlock* codeBlock = exec-&gt;codeBlock();
</span><ins>+    ScriptExecutable* owner = codeBlock-&gt;ownerScriptExecutable();
</ins><span class="cx">     VM&amp; vm = exec-&gt;vm();
</span><span class="cx">     Structure* structure = base-&gt;structure(vm);
</span><span class="cx">     
</span><span class="lines">@@ -490,17 +493,17 @@
</span><span class="cx">     if (wasFound) {
</span><span class="cx">         if (slot.slotBase() != base) {
</span><span class="cx">             conditionSet = generateConditionsForPrototypePropertyHit(
</span><del>-                vm, codeBlock, exec, structure, slot.slotBase(), ident.impl());
</del><ins>+                vm, codeBlock-&gt;ownerExecutable(), exec, structure, slot.slotBase(), ident.impl());
</ins><span class="cx">         }
</span><span class="cx">     } else {
</span><span class="cx">         conditionSet = generateConditionsForPropertyMiss(
</span><del>-            vm, codeBlock, exec, structure, ident.impl());
</del><ins>+            vm, codeBlock-&gt;ownerExecutable(), exec, structure, ident.impl());
</ins><span class="cx">     }
</span><span class="cx">     if (!conditionSet.isValid())
</span><span class="cx">         return GiveUpOnCache;
</span><span class="cx"> 
</span><span class="cx">     std::unique_ptr&lt;AccessCase&gt; newCase = AccessCase::in(
</span><del>-        vm, codeBlock, wasFound ? AccessCase::InHit : AccessCase::InMiss, structure, conditionSet);
</del><ins>+        vm, owner, wasFound ? AccessCase::InHit : AccessCase::InMiss, structure, conditionSet);
</ins><span class="cx"> 
</span><span class="cx">     MacroAssemblerCodePtr codePtr = stubInfo.addAccessCase(codeBlock, ident, WTF::move(newCase));
</span><span class="cx">     if (!codePtr)
</span><span class="lines">@@ -549,8 +552,8 @@
</span><span class="cx">     VM* vm = callerCodeBlock-&gt;vm();
</span><span class="cx">     
</span><span class="cx">     ASSERT(!callLinkInfo.isLinked());
</span><del>-    callLinkInfo.setCallee(exec-&gt;callerFrame()-&gt;vm(), callLinkInfo.hotPathBegin(), callerCodeBlock, callee);
-    callLinkInfo.setLastSeenCallee(exec-&gt;callerFrame()-&gt;vm(), callerCodeBlock, callee);
</del><ins>+    callLinkInfo.setCallee(exec-&gt;callerFrame()-&gt;vm(), callLinkInfo.hotPathBegin(), callerCodeBlock-&gt;ownerExecutable(), callee);
+    callLinkInfo.setLastSeenCallee(exec-&gt;callerFrame()-&gt;vm(), callerCodeBlock-&gt;ownerExecutable(), callee);
</ins><span class="cx">     if (shouldShowDisassemblyFor(callerCodeBlock))
</span><span class="cx">         dataLog(&quot;Linking call in &quot;, *callerCodeBlock, &quot; at &quot;, callLinkInfo.codeOrigin(), &quot; to &quot;, pointerDump(calleeCodeBlock), &quot;, entrypoint at &quot;, codePtr, &quot;\n&quot;);
</span><span class="cx">     MacroAssembler::repatchNearCall(callLinkInfo.hotPathOther(), CodeLocationLabel(codePtr));
</span><span class="lines">@@ -867,7 +870,7 @@
</span><span class="cx">             (&quot;Polymorphic call stub for %s, return point %p, targets %s&quot;,
</span><span class="cx">                 toCString(*callerCodeBlock).data(), callLinkInfo.callReturnLocation().labelAtOffset(0).executableAddress(),
</span><span class="cx">                 toCString(listDump(callCases)).data())),
</span><del>-        *vm, callerCodeBlock, exec-&gt;callerFrame(), callLinkInfo, callCases,
</del><ins>+        *vm, callerCodeBlock-&gt;ownerExecutable(), exec-&gt;callerFrame(), callLinkInfo, callCases,
</ins><span class="cx">         WTF::move(fastCounts)));
</span><span class="cx">     
</span><span class="cx">     MacroAssembler::replaceWithJump(
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorellintLLIntSlowPathscpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/llint/LLIntSlowPaths.cpp (190808 => 190809)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/llint/LLIntSlowPaths.cpp        2015-10-09 17:53:28 UTC (rev 190808)
+++ trunk/Source/JavaScriptCore/llint/LLIntSlowPaths.cpp        2015-10-09 17:54:16 UTC (rev 190809)
</span><span class="lines">@@ -576,7 +576,7 @@
</span><span class="cx">         if (!structure-&gt;isUncacheableDictionary()
</span><span class="cx">             &amp;&amp; !structure-&gt;typeInfo().prohibitsPropertyCaching()
</span><span class="cx">             &amp;&amp; !structure-&gt;typeInfo().newImpurePropertyFiresWatchpoints()) {
</span><del>-            vm.heap.writeBarrier(codeBlock);
</del><ins>+            vm.heap.writeBarrier(codeBlock-&gt;ownerExecutable());
</ins><span class="cx">             
</span><span class="cx">             ConcurrentJITLocker locker(codeBlock-&gt;m_lock);
</span><span class="cx"> 
</span><span class="lines">@@ -641,7 +641,7 @@
</span><span class="cx">             &amp;&amp; !structure-&gt;typeInfo().prohibitsPropertyCaching()
</span><span class="cx">             &amp;&amp; baseCell == slot.base()) {
</span><span class="cx"> 
</span><del>-            vm.heap.writeBarrier(codeBlock);
</del><ins>+            vm.heap.writeBarrier(codeBlock-&gt;ownerExecutable());
</ins><span class="cx">             
</span><span class="cx">             if (slot.type() == PutPropertySlot::NewProperty) {
</span><span class="cx">                 GCSafeConcurrentJITLocker locker(codeBlock-&gt;m_lock, vm.heap);
</span><span class="lines">@@ -658,7 +658,7 @@
</span><span class="cx">                             StructureChain* chain = structure-&gt;prototypeChain(exec);
</span><span class="cx">                             ASSERT(chain);
</span><span class="cx">                             pc[7].u.structureChain.set(
</span><del>-                                vm, codeBlock, chain);
</del><ins>+                                vm, codeBlock-&gt;ownerExecutable(), chain);
</ins><span class="cx">                         }
</span><span class="cx">                         pc[8].u.putByIdFlags = static_cast&lt;PutByIdFlags&gt;(
</span><span class="cx">                             pc[8].u.putByIdFlags |
</span><span class="lines">@@ -1190,8 +1190,8 @@
</span><span class="cx">         
</span><span class="cx">         if (callLinkInfo-&gt;isOnList())
</span><span class="cx">             callLinkInfo-&gt;remove();
</span><del>-        callLinkInfo-&gt;callee.set(vm, callerCodeBlock, callee);
-        callLinkInfo-&gt;lastSeenCallee.set(vm, callerCodeBlock, callee);
</del><ins>+        callLinkInfo-&gt;callee.set(vm, callerCodeBlock-&gt;ownerExecutable(), callee);
+        callLinkInfo-&gt;lastSeenCallee.set(vm, callerCodeBlock-&gt;ownerExecutable(), callee);
</ins><span class="cx">         callLinkInfo-&gt;machineCodeTarget = codePtr;
</span><span class="cx">         if (codeBlock)
</span><span class="cx">             codeBlock-&gt;linkIncomingCall(exec, callLinkInfo);
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreprofilerProfilerOriginStackcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/profiler/ProfilerOriginStack.cpp (190808 => 190809)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/profiler/ProfilerOriginStack.cpp        2015-10-09 17:53:28 UTC (rev 190808)
+++ trunk/Source/JavaScriptCore/profiler/ProfilerOriginStack.cpp        2015-10-09 17:54:16 UTC (rev 190809)
</span><span class="lines">@@ -52,7 +52,7 @@
</span><span class="cx">     
</span><span class="cx">     for (unsigned i = 1; i &lt; stack.size(); ++i) {
</span><span class="cx">         append(Origin(
</span><del>-            database.ensureBytecodesFor(stack[i].inlineCallFrame-&gt;baselineCodeBlock.get()),
</del><ins>+            database.ensureBytecodesFor(stack[i].inlineCallFrame-&gt;baselineCodeBlock()),
</ins><span class="cx">             stack[i].bytecodeIndex));
</span><span class="cx">     }
</span><span class="cx"> }
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeCommonSlowPathscpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/CommonSlowPaths.cpp (190808 => 190809)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/CommonSlowPaths.cpp        2015-10-09 17:53:28 UTC (rev 190808)
+++ trunk/Source/JavaScriptCore/runtime/CommonSlowPaths.cpp        2015-10-09 17:54:16 UTC (rev 190809)
</span><span class="lines">@@ -231,7 +231,7 @@
</span><span class="cx"> 
</span><span class="cx">     auto&amp; cacheWriteBarrier = pc[4].u.jsCell;
</span><span class="cx">     if (!cacheWriteBarrier)
</span><del>-        cacheWriteBarrier.set(exec-&gt;vm(), exec-&gt;codeBlock(), constructor);
</del><ins>+        cacheWriteBarrier.set(exec-&gt;vm(), exec-&gt;codeBlock()-&gt;ownerExecutable(), constructor);
</ins><span class="cx">     else if (cacheWriteBarrier.unvalidatedGet() != JSCell::seenMultipleCalleeObjects() &amp;&amp; cacheWriteBarrier.get() != constructor)
</span><span class="cx">         cacheWriteBarrier.setWithoutWriteBarrier(JSCell::seenMultipleCalleeObjects());
</span><span class="cx"> 
</span><span class="lines">@@ -250,7 +250,7 @@
</span><span class="cx">         if (myStructure != otherStructure) {
</span><span class="cx">             if (otherStructure)
</span><span class="cx">                 pc[3].u.toThisStatus = ToThisConflicted;
</span><del>-            pc[2].u.structure.set(vm, exec-&gt;codeBlock(), myStructure);
</del><ins>+            pc[2].u.structure.set(vm, exec-&gt;codeBlock()-&gt;ownerExecutable(), myStructure);
</ins><span class="cx">         }
</span><span class="cx">     } else {
</span><span class="cx">         pc[3].u.toThisStatus = ToThisConflicted;
</span><span class="lines">@@ -526,8 +526,8 @@
</span><span class="cx"> SLOW_PATH_DECL(slow_path_enter)
</span><span class="cx"> {
</span><span class="cx">     BEGIN();
</span><del>-    CodeBlock* codeBlock = exec-&gt;codeBlock();
-    Heap::heap(codeBlock)-&gt;writeBarrier(codeBlock);
</del><ins>+    ExecutableBase* ownerExecutable = exec-&gt;codeBlock()-&gt;ownerExecutable();
+    Heap::heap(ownerExecutable)-&gt;writeBarrier(ownerExecutable);
</ins><span class="cx">     END();
</span><span class="cx"> }
</span><span class="cx"> 
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeCommonSlowPathsh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/CommonSlowPaths.h (190808 => 190809)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/CommonSlowPaths.h        2015-10-09 17:53:28 UTC (rev 190808)
+++ trunk/Source/JavaScriptCore/runtime/CommonSlowPaths.h        2015-10-09 17:54:16 UTC (rev 190809)
</span><span class="lines">@@ -129,7 +129,7 @@
</span><span class="cx">         scope-&gt;structure()-&gt;didCachePropertyReplacement(exec-&gt;vm(), slot.cachedOffset());
</span><span class="cx"> 
</span><span class="cx">         ConcurrentJITLocker locker(codeBlock-&gt;m_lock);
</span><del>-        pc[5].u.structure.set(exec-&gt;vm(), codeBlock, scope-&gt;structure());
</del><ins>+        pc[5].u.structure.set(exec-&gt;vm(), codeBlock-&gt;ownerExecutable(), scope-&gt;structure());
</ins><span class="cx">         pc[6].u.operand = slot.cachedOffset();
</span><span class="cx">     }
</span><span class="cx"> }
</span><span class="lines">@@ -162,7 +162,7 @@
</span><span class="cx">             Structure* structure = scope-&gt;structure(vm);
</span><span class="cx">             {
</span><span class="cx">                 ConcurrentJITLocker locker(codeBlock-&gt;m_lock);
</span><del>-                pc[5].u.structure.set(exec-&gt;vm(), codeBlock, structure);
</del><ins>+                pc[5].u.structure.set(exec-&gt;vm(), codeBlock-&gt;ownerExecutable(), structure);
</ins><span class="cx">                 pc[6].u.operand = slot.cachedOffset();
</span><span class="cx">             }
</span><span class="cx">             structure-&gt;startWatchingPropertyForReplacements(vm, slot.cachedOffset());
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeExecutablecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/Executable.cpp (190808 => 190809)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/Executable.cpp        2015-10-09 17:53:28 UTC (rev 190808)
+++ trunk/Source/JavaScriptCore/runtime/Executable.cpp        2015-10-09 17:54:16 UTC (rev 190809)
</span><span class="lines">@@ -60,45 +60,6 @@
</span><span class="cx"> #endif
</span><span class="cx">     m_numParametersForCall = NUM_PARAMETERS_NOT_COMPILED;
</span><span class="cx">     m_numParametersForConstruct = NUM_PARAMETERS_NOT_COMPILED;
</span><del>-
-    if (classInfo() == FunctionExecutable::info()) {
-        FunctionExecutable* executable = jsCast&lt;FunctionExecutable*&gt;(this);
-        executable-&gt;m_codeBlockForCall.clear();
-        executable-&gt;m_codeBlockForConstruct.clear();
-        return;
-    }
-
-    if (classInfo() == EvalExecutable::info()) {
-        EvalExecutable* executable = jsCast&lt;EvalExecutable*&gt;(this);
-        executable-&gt;m_evalCodeBlock.clear();
-        executable-&gt;m_unlinkedEvalCodeBlock.clear();
-        return;
-    }
-    
-    if (classInfo() == ProgramExecutable::info()) {
-        ProgramExecutable* executable = jsCast&lt;ProgramExecutable*&gt;(this);
-        executable-&gt;m_programCodeBlock.clear();
-        executable-&gt;m_unlinkedProgramCodeBlock.clear();
-        return;
-    }
-
-    if (classInfo() == ModuleProgramExecutable::info()) {
-        ModuleProgramExecutable* executable = jsCast&lt;ModuleProgramExecutable*&gt;(this);
-        executable-&gt;m_moduleProgramCodeBlock.clear();
-        executable-&gt;m_unlinkedModuleProgramCodeBlock.clear();
-        executable-&gt;m_moduleEnvironmentSymbolTable.clear();
-        return;
-    }
-    
-#if ENABLE(WEBASSEMBLY)
-    if (classInfo() == WebAssemblyExecutable::info()) {
-        WebAssemblyExecutable* executable = jsCast&lt;WebAssemblyExecutable*&gt;(this);
-        executable-&gt;m_codeBlockForCall.clear();
-        return;
-    }
-#endif
-
-    ASSERT(classInfo() == NativeExecutable::info());
</del><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> #if ENABLE(DFG_JIT)
</span><span class="lines">@@ -162,7 +123,7 @@
</span><span class="cx"> {
</span><span class="cx">     ASSERT(vm.heap.isDeferred());
</span><span class="cx">     
</span><del>-    CodeBlock* oldCodeBlock = nullptr;
</del><ins>+    RefPtr&lt;CodeBlock&gt; oldCodeBlock;
</ins><span class="cx">     
</span><span class="cx">     switch (codeType) {
</span><span class="cx">     case GlobalCode: {
</span><span class="lines">@@ -171,8 +132,8 @@
</span><span class="cx">         
</span><span class="cx">         ASSERT(kind == CodeForCall);
</span><span class="cx">         
</span><del>-        oldCodeBlock = executable-&gt;m_programCodeBlock.get();
-        executable-&gt;m_programCodeBlock.setMayBeNull(vm, this, codeBlock);
</del><ins>+        oldCodeBlock = executable-&gt;m_programCodeBlock;
+        executable-&gt;m_programCodeBlock = codeBlock;
</ins><span class="cx">         break;
</span><span class="cx">     }
</span><span class="cx"> 
</span><span class="lines">@@ -182,8 +143,8 @@
</span><span class="cx"> 
</span><span class="cx">         ASSERT(kind == CodeForCall);
</span><span class="cx"> 
</span><del>-        oldCodeBlock = executable-&gt;m_moduleProgramCodeBlock.get();
-        executable-&gt;m_moduleProgramCodeBlock.setMayBeNull(vm, this, codeBlock);
</del><ins>+        oldCodeBlock = executable-&gt;m_moduleProgramCodeBlock;
+        executable-&gt;m_moduleProgramCodeBlock = codeBlock;
</ins><span class="cx">         break;
</span><span class="cx">     }
</span><span class="cx"> 
</span><span class="lines">@@ -193,8 +154,8 @@
</span><span class="cx">         
</span><span class="cx">         ASSERT(kind == CodeForCall);
</span><span class="cx">         
</span><del>-        oldCodeBlock = executable-&gt;m_evalCodeBlock.get();
-        executable-&gt;m_evalCodeBlock.setMayBeNull(vm, this, codeBlock);
</del><ins>+        oldCodeBlock = executable-&gt;m_evalCodeBlock;
+        executable-&gt;m_evalCodeBlock = codeBlock;
</ins><span class="cx">         break;
</span><span class="cx">     }
</span><span class="cx">         
</span><span class="lines">@@ -204,12 +165,12 @@
</span><span class="cx">         
</span><span class="cx">         switch (kind) {
</span><span class="cx">         case CodeForCall:
</span><del>-            oldCodeBlock = executable-&gt;m_codeBlockForCall.get();
-            executable-&gt;m_codeBlockForCall.setMayBeNull(vm, this, codeBlock);
</del><ins>+            oldCodeBlock = executable-&gt;m_codeBlockForCall;
+            executable-&gt;m_codeBlockForCall = codeBlock;
</ins><span class="cx">             break;
</span><span class="cx">         case CodeForConstruct:
</span><del>-            oldCodeBlock = executable-&gt;m_codeBlockForConstruct.get();
-            executable-&gt;m_codeBlockForConstruct.setMayBeNull(vm, this, codeBlock);
</del><ins>+            oldCodeBlock = executable-&gt;m_codeBlockForConstruct;
+            executable-&gt;m_codeBlockForConstruct = codeBlock;
</ins><span class="cx">             break;
</span><span class="cx">         }
</span><span class="cx">         break;
</span><span class="lines">@@ -249,7 +210,7 @@
</span><span class="cx">     vm.heap.writeBarrier(this);
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-CodeBlock* ScriptExecutable::newCodeBlockFor(
</del><ins>+RefPtr&lt;CodeBlock&gt; ScriptExecutable::newCodeBlockFor(
</ins><span class="cx">     CodeSpecializationKind kind, JSFunction* function, JSScope* scope, JSObject*&amp; exception)
</span><span class="cx"> {
</span><span class="cx">     VM* vm = scope-&gt;vm();
</span><span class="lines">@@ -263,9 +224,9 @@
</span><span class="cx">         RELEASE_ASSERT(kind == CodeForCall);
</span><span class="cx">         RELEASE_ASSERT(!executable-&gt;m_evalCodeBlock);
</span><span class="cx">         RELEASE_ASSERT(!function);
</span><del>-        return EvalCodeBlock::create(vm,
</del><ins>+        return adoptRef(new EvalCodeBlock(
</ins><span class="cx">             executable, executable-&gt;m_unlinkedEvalCodeBlock.get(), scope,
</span><del>-            executable-&gt;source().provider());
</del><ins>+            executable-&gt;source().provider()));
</ins><span class="cx">     }
</span><span class="cx">     
</span><span class="cx">     if (classInfo() == ProgramExecutable::info()) {
</span><span class="lines">@@ -273,9 +234,9 @@
</span><span class="cx">         RELEASE_ASSERT(kind == CodeForCall);
</span><span class="cx">         RELEASE_ASSERT(!executable-&gt;m_programCodeBlock);
</span><span class="cx">         RELEASE_ASSERT(!function);
</span><del>-        return ProgramCodeBlock::create(vm,
</del><ins>+        return adoptRef(new ProgramCodeBlock(
</ins><span class="cx">             executable, executable-&gt;m_unlinkedProgramCodeBlock.get(), scope,
</span><del>-            executable-&gt;source().provider(), executable-&gt;source().startColumn());
</del><ins>+            executable-&gt;source().provider(), executable-&gt;source().startColumn()));
</ins><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     if (classInfo() == ModuleProgramExecutable::info()) {
</span><span class="lines">@@ -283,9 +244,9 @@
</span><span class="cx">         RELEASE_ASSERT(kind == CodeForCall);
</span><span class="cx">         RELEASE_ASSERT(!executable-&gt;m_moduleProgramCodeBlock);
</span><span class="cx">         RELEASE_ASSERT(!function);
</span><del>-        return ModuleProgramCodeBlock::create(vm,
</del><ins>+        return adoptRef(new ModuleProgramCodeBlock(
</ins><span class="cx">             executable, executable-&gt;m_unlinkedModuleProgramCodeBlock.get(), scope,
</span><del>-            executable-&gt;source().provider(), executable-&gt;source().startColumn());
</del><ins>+            executable-&gt;source().provider(), executable-&gt;source().startColumn()));
</ins><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     RELEASE_ASSERT(classInfo() == FunctionExecutable::info());
</span><span class="lines">@@ -315,11 +276,11 @@
</span><span class="cx">     unsigned sourceOffset = executable-&gt;source().startOffset();
</span><span class="cx">     unsigned startColumn = executable-&gt;source().startColumn();
</span><span class="cx"> 
</span><del>-    return FunctionCodeBlock::create(vm,
-        executable, unlinkedCodeBlock, scope, provider, sourceOffset, startColumn);
</del><ins>+    return adoptRef(new FunctionCodeBlock(
+        executable, unlinkedCodeBlock, scope, provider, sourceOffset, startColumn));
</ins><span class="cx"> }
</span><span class="cx"> 
</span><del>-CodeBlock* ScriptExecutable::newReplacementCodeBlockFor(
</del><ins>+PassRefPtr&lt;CodeBlock&gt; ScriptExecutable::newReplacementCodeBlockFor(
</ins><span class="cx">     CodeSpecializationKind kind)
</span><span class="cx"> {
</span><span class="cx">     if (classInfo() == EvalExecutable::info()) {
</span><span class="lines">@@ -327,9 +288,9 @@
</span><span class="cx">         EvalExecutable* executable = jsCast&lt;EvalExecutable*&gt;(this);
</span><span class="cx">         EvalCodeBlock* baseline = static_cast&lt;EvalCodeBlock*&gt;(
</span><span class="cx">             executable-&gt;m_evalCodeBlock-&gt;baselineVersion());
</span><del>-        EvalCodeBlock* result = EvalCodeBlock::create(vm(),
-            CodeBlock::CopyParsedBlock, *baseline);
-        result-&gt;setAlternative(*vm(), baseline);
</del><ins>+        RefPtr&lt;EvalCodeBlock&gt; result = adoptRef(new EvalCodeBlock(
+            CodeBlock::CopyParsedBlock, *baseline));
+        result-&gt;setAlternative(baseline);
</ins><span class="cx">         return result;
</span><span class="cx">     }
</span><span class="cx">     
</span><span class="lines">@@ -338,9 +299,9 @@
</span><span class="cx">         ProgramExecutable* executable = jsCast&lt;ProgramExecutable*&gt;(this);
</span><span class="cx">         ProgramCodeBlock* baseline = static_cast&lt;ProgramCodeBlock*&gt;(
</span><span class="cx">             executable-&gt;m_programCodeBlock-&gt;baselineVersion());
</span><del>-        ProgramCodeBlock* result = ProgramCodeBlock::create(vm(),
-            CodeBlock::CopyParsedBlock, *baseline);
-        result-&gt;setAlternative(*vm(), baseline);
</del><ins>+        RefPtr&lt;ProgramCodeBlock&gt; result = adoptRef(new ProgramCodeBlock(
+            CodeBlock::CopyParsedBlock, *baseline));
+        result-&gt;setAlternative(baseline);
</ins><span class="cx">         return result;
</span><span class="cx">     }
</span><span class="cx"> 
</span><span class="lines">@@ -349,9 +310,9 @@
</span><span class="cx">         ModuleProgramExecutable* executable = jsCast&lt;ModuleProgramExecutable*&gt;(this);
</span><span class="cx">         ModuleProgramCodeBlock* baseline = static_cast&lt;ModuleProgramCodeBlock*&gt;(
</span><span class="cx">             executable-&gt;m_moduleProgramCodeBlock-&gt;baselineVersion());
</span><del>-        ModuleProgramCodeBlock* result = ModuleProgramCodeBlock::create(vm(),
-            CodeBlock::CopyParsedBlock, *baseline);
-        result-&gt;setAlternative(*vm(), baseline);
</del><ins>+        RefPtr&lt;ModuleProgramCodeBlock&gt; result = adoptRef(new ModuleProgramCodeBlock(
+            CodeBlock::CopyParsedBlock, *baseline));
+        result-&gt;setAlternative(baseline);
</ins><span class="cx">         return result;
</span><span class="cx">     }
</span><span class="cx"> 
</span><span class="lines">@@ -359,9 +320,9 @@
</span><span class="cx">     FunctionExecutable* executable = jsCast&lt;FunctionExecutable*&gt;(this);
</span><span class="cx">     FunctionCodeBlock* baseline = static_cast&lt;FunctionCodeBlock*&gt;(
</span><span class="cx">         executable-&gt;codeBlockFor(kind)-&gt;baselineVersion());
</span><del>-    FunctionCodeBlock* result = FunctionCodeBlock::create(vm(),
-        CodeBlock::CopyParsedBlock, *baseline);
-    result-&gt;setAlternative(*vm(), baseline);
</del><ins>+    RefPtr&lt;FunctionCodeBlock&gt; result = adoptRef(new FunctionCodeBlock(
+        CodeBlock::CopyParsedBlock, *baseline));
+    result-&gt;setAlternative(baseline);
</ins><span class="cx">     return result;
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="lines">@@ -389,7 +350,7 @@
</span><span class="cx">     DeferGC deferGC(vm.heap);
</span><span class="cx">     
</span><span class="cx">     JSObject* exception = 0;
</span><del>-    CodeBlock* codeBlock = newCodeBlockFor(kind, function, scope, exception);
</del><ins>+    RefPtr&lt;CodeBlock&gt; codeBlock = newCodeBlockFor(kind, function, scope, exception);
</ins><span class="cx">     if (!codeBlock) {
</span><span class="cx">         RELEASE_ASSERT(exception);
</span><span class="cx">         return exception;
</span><span class="lines">@@ -399,11 +360,11 @@
</span><span class="cx">         codeBlock-&gt;validate();
</span><span class="cx">     
</span><span class="cx">     if (Options::useLLInt())
</span><del>-        setupLLInt(vm, codeBlock);
</del><ins>+        setupLLInt(vm, codeBlock.get());
</ins><span class="cx">     else
</span><del>-        setupJIT(vm, codeBlock);
</del><ins>+        setupJIT(vm, codeBlock.get());
</ins><span class="cx">     
</span><del>-    installCode(*codeBlock-&gt;vm(), codeBlock, codeBlock-&gt;codeType(), codeBlock-&gt;specializationKind());
</del><ins>+    installCode(*codeBlock-&gt;vm(), codeBlock.get(), codeBlock-&gt;codeType(), codeBlock-&gt;specializationKind());
</ins><span class="cx">     return 0;
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="lines">@@ -541,11 +502,18 @@
</span><span class="cx">     EvalExecutable* thisObject = jsCast&lt;EvalExecutable*&gt;(cell);
</span><span class="cx">     ASSERT_GC_OBJECT_INHERITS(thisObject, info());
</span><span class="cx">     ScriptExecutable::visitChildren(thisObject, visitor);
</span><del>-    visitor.append(&amp;thisObject-&gt;m_unlinkedEvalCodeBlock);
</del><span class="cx">     if (thisObject-&gt;m_evalCodeBlock)
</span><del>-        thisObject-&gt;m_evalCodeBlock-&gt;visitWeakly(visitor);
</del><ins>+        thisObject-&gt;m_evalCodeBlock-&gt;visitAggregate(visitor);
+    visitor.append(&amp;thisObject-&gt;m_unlinkedEvalCodeBlock);
</ins><span class="cx"> }
</span><span class="cx"> 
</span><ins>+void EvalExecutable::clearCode()
+{
+    m_evalCodeBlock = nullptr;
+    m_unlinkedEvalCodeBlock.clear();
+    Base::clearCode();
+}
+
</ins><span class="cx"> JSObject* ProgramExecutable::checkSyntax(ExecState* exec)
</span><span class="cx"> {
</span><span class="cx">     ParserError error;
</span><span class="lines">@@ -650,9 +618,16 @@
</span><span class="cx">     ScriptExecutable::visitChildren(thisObject, visitor);
</span><span class="cx">     visitor.append(&amp;thisObject-&gt;m_unlinkedProgramCodeBlock);
</span><span class="cx">     if (thisObject-&gt;m_programCodeBlock)
</span><del>-        thisObject-&gt;m_programCodeBlock-&gt;visitWeakly(visitor);
</del><ins>+        thisObject-&gt;m_programCodeBlock-&gt;visitAggregate(visitor);
</ins><span class="cx"> }
</span><span class="cx"> 
</span><ins>+void ProgramExecutable::clearCode()
+{
+    m_programCodeBlock = nullptr;
+    m_unlinkedProgramCodeBlock.clear();
+    Base::clearCode();
+}
+
</ins><span class="cx"> void ModuleProgramExecutable::visitChildren(JSCell* cell, SlotVisitor&amp; visitor)
</span><span class="cx"> {
</span><span class="cx">     ModuleProgramExecutable* thisObject = jsCast&lt;ModuleProgramExecutable*&gt;(cell);
</span><span class="lines">@@ -661,9 +636,17 @@
</span><span class="cx">     visitor.append(&amp;thisObject-&gt;m_unlinkedModuleProgramCodeBlock);
</span><span class="cx">     visitor.append(&amp;thisObject-&gt;m_moduleEnvironmentSymbolTable);
</span><span class="cx">     if (thisObject-&gt;m_moduleProgramCodeBlock)
</span><del>-        thisObject-&gt;m_moduleProgramCodeBlock-&gt;visitWeakly(visitor);
</del><ins>+        thisObject-&gt;m_moduleProgramCodeBlock-&gt;visitAggregate(visitor);
</ins><span class="cx"> }
</span><span class="cx"> 
</span><ins>+void ModuleProgramExecutable::clearCode()
+{
+    m_moduleProgramCodeBlock = nullptr;
+    m_unlinkedModuleProgramCodeBlock.clear();
+    m_moduleEnvironmentSymbolTable.clear();
+    Base::clearCode();
+}
+
</ins><span class="cx"> FunctionCodeBlock* FunctionExecutable::baselineCodeBlockFor(CodeSpecializationKind kind)
</span><span class="cx"> {
</span><span class="cx">     FunctionCodeBlock* result;
</span><span class="lines">@@ -684,13 +667,20 @@
</span><span class="cx">     ASSERT_GC_OBJECT_INHERITS(thisObject, info());
</span><span class="cx">     ScriptExecutable::visitChildren(thisObject, visitor);
</span><span class="cx">     if (thisObject-&gt;m_codeBlockForCall)
</span><del>-        thisObject-&gt;m_codeBlockForCall-&gt;visitWeakly(visitor);
</del><ins>+        thisObject-&gt;m_codeBlockForCall-&gt;visitAggregate(visitor);
</ins><span class="cx">     if (thisObject-&gt;m_codeBlockForConstruct)
</span><del>-        thisObject-&gt;m_codeBlockForConstruct-&gt;visitWeakly(visitor);
</del><ins>+        thisObject-&gt;m_codeBlockForConstruct-&gt;visitAggregate(visitor);
</ins><span class="cx">     visitor.append(&amp;thisObject-&gt;m_unlinkedExecutable);
</span><span class="cx">     visitor.append(&amp;thisObject-&gt;m_singletonFunction);
</span><span class="cx"> }
</span><span class="cx"> 
</span><ins>+void FunctionExecutable::clearCode()
+{
+    m_codeBlockForCall = nullptr;
+    m_codeBlockForConstruct = nullptr;
+    Base::clearCode();
+}
+
</ins><span class="cx"> FunctionExecutable* FunctionExecutable::fromGlobalCode(
</span><span class="cx">     const Identifier&amp; name, ExecState&amp; exec, const SourceCode&amp; source, 
</span><span class="cx">     JSObject*&amp; exception, int overrideLineNumber)
</span><span class="lines">@@ -726,10 +716,16 @@
</span><span class="cx">     ASSERT_GC_OBJECT_INHERITS(thisObject, info());
</span><span class="cx">     ExecutableBase::visitChildren(thisObject, visitor);
</span><span class="cx">     if (thisObject-&gt;m_codeBlockForCall)
</span><del>-        thisObject-&gt;m_codeBlockForCall-&gt;visitWeakly(visitor);
</del><ins>+        thisObject-&gt;m_codeBlockForCall-&gt;visitAggregate(visitor);
</ins><span class="cx">     visitor.append(&amp;thisObject-&gt;m_module);
</span><span class="cx"> }
</span><span class="cx"> 
</span><ins>+void WebAssemblyExecutable::clearCode()
+{
+    m_codeBlockForCall = nullptr;
+    Base::clearCode();
+}
+
</ins><span class="cx"> void WebAssemblyExecutable::prepareForExecution(ExecState* exec)
</span><span class="cx"> {
</span><span class="cx">     if (hasJITCodeForCall())
</span><span class="lines">@@ -738,16 +734,16 @@
</span><span class="cx">     VM&amp; vm = exec-&gt;vm();
</span><span class="cx">     DeferGC deferGC(vm.heap);
</span><span class="cx"> 
</span><del>-    WebAssemblyCodeBlock* codeBlock = WebAssemblyCodeBlock::create(vm,
-        this, exec-&gt;lexicalGlobalObject()));
</del><ins>+    RefPtr&lt;WebAssemblyCodeBlock&gt; codeBlock = adoptRef(new WebAssemblyCodeBlock(
+        this, vm, exec-&gt;lexicalGlobalObject()));
</ins><span class="cx"> 
</span><del>-    WASMFunctionParser::compile(vm, codeBlock, m_module.get(), m_source, m_functionIndex);
</del><ins>+    WASMFunctionParser::compile(vm, codeBlock.get(), m_module.get(), m_source, m_functionIndex);
</ins><span class="cx"> 
</span><span class="cx">     m_jitCodeForCall = codeBlock-&gt;jitCode();
</span><span class="cx">     m_jitCodeForCallWithArityCheck = MacroAssemblerCodePtr();
</span><span class="cx">     m_numParametersForCall = codeBlock-&gt;numParameters();
</span><span class="cx"> 
</span><del>-    m_codeBlockForCall.set(vm, this, codeBlock);
</del><ins>+    m_codeBlockForCall = codeBlock;
</ins><span class="cx"> 
</span><span class="cx">     Heap::heap(this)-&gt;writeBarrier(this);
</span><span class="cx"> }
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeExecutableh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/Executable.h (190808 => 190809)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/Executable.h        2015-10-09 17:53:28 UTC (rev 190808)
+++ trunk/Source/JavaScriptCore/runtime/Executable.h        2015-10-09 17:54:16 UTC (rev 190809)
</span><span class="lines">@@ -139,6 +139,8 @@
</span><span class="cx">     int m_numParametersForConstruct;
</span><span class="cx"> 
</span><span class="cx"> public:
</span><ins>+    static void clearCodeVirtual(ExecutableBase*);
+
</ins><span class="cx">     PassRefPtr&lt;JITCode&gt; generatedJITCodeForCall()
</span><span class="cx">     {
</span><span class="cx">         ASSERT(m_jitCodeForCall);
</span><span class="lines">@@ -304,8 +306,6 @@
</span><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx"> private:
</span><del>-    friend class ExecutableBase;
-
</del><span class="cx">     NativeExecutable(VM&amp; vm, NativeFunction function, NativeFunction constructor)
</span><span class="cx">         : ExecutableBase(vm, vm.nativeExecutableStructure.get(), NUM_PARAMETERS_IS_HOST)
</span><span class="cx">         , m_function(function)
</span><span class="lines">@@ -376,8 +376,8 @@
</span><span class="cx"> 
</span><span class="cx">     void installCode(CodeBlock*);
</span><span class="cx">     void installCode(VM&amp;, CodeBlock*, CodeType, CodeSpecializationKind);
</span><del>-    CodeBlock* newCodeBlockFor(CodeSpecializationKind, JSFunction*, JSScope*, JSObject*&amp; exception);
-    CodeBlock* newReplacementCodeBlockFor(CodeSpecializationKind);
</del><ins>+    RefPtr&lt;CodeBlock&gt; newCodeBlockFor(CodeSpecializationKind, JSFunction*, JSScope*, JSObject*&amp; exception);
+    PassRefPtr&lt;CodeBlock&gt; newReplacementCodeBlockFor(CodeSpecializationKind);
</ins><span class="cx">     
</span><span class="cx">     JSObject* prepareForExecution(ExecState* exec, JSFunction* function, JSScope* scope, CodeSpecializationKind kind)
</span><span class="cx">     {
</span><span class="lines">@@ -389,7 +389,6 @@
</span><span class="cx">     template &lt;typename Functor&gt; void forEachCodeBlock(Functor&amp;&amp;);
</span><span class="cx"> 
</span><span class="cx"> private:
</span><del>-    friend class ExecutableBase;
</del><span class="cx">     JSObject* prepareForExecutionImpl(ExecState*, JSFunction*, JSScope*, CodeSpecializationKind);
</span><span class="cx"> 
</span><span class="cx"> protected:
</span><span class="lines">@@ -448,19 +447,20 @@
</span><span class="cx">         
</span><span class="cx">     DECLARE_INFO;
</span><span class="cx"> 
</span><ins>+    void clearCode();
+
</ins><span class="cx">     ExecutableInfo executableInfo() const { return ExecutableInfo(needsActivation(), usesEval(), isStrictMode(), false, false, ConstructorKind::None, false); }
</span><span class="cx"> 
</span><span class="cx">     unsigned numVariables() { return m_unlinkedEvalCodeBlock-&gt;numVariables(); }
</span><span class="cx">     unsigned numberOfFunctionDecls() { return m_unlinkedEvalCodeBlock-&gt;numberOfFunctionDecls(); }
</span><span class="cx"> 
</span><span class="cx"> private:
</span><del>-    friend class ExecutableBase;
</del><span class="cx">     friend class ScriptExecutable;
</span><span class="cx">     EvalExecutable(ExecState*, const SourceCode&amp;, bool);
</span><span class="cx"> 
</span><span class="cx">     static void visitChildren(JSCell*, SlotVisitor&amp;);
</span><span class="cx"> 
</span><del>-    WriteBarrier&lt;EvalCodeBlock&gt; m_evalCodeBlock;
</del><ins>+    RefPtr&lt;EvalCodeBlock&gt; m_evalCodeBlock;
</ins><span class="cx">     WriteBarrier&lt;UnlinkedEvalCodeBlock&gt; m_unlinkedEvalCodeBlock;
</span><span class="cx"> };
</span><span class="cx"> 
</span><span class="lines">@@ -501,10 +501,11 @@
</span><span class="cx">         
</span><span class="cx">     DECLARE_INFO;
</span><span class="cx"> 
</span><ins>+    void clearCode();
+
</ins><span class="cx">     ExecutableInfo executableInfo() const { return ExecutableInfo(needsActivation(), usesEval(), isStrictMode(), false, false, ConstructorKind::None, false); }
</span><span class="cx"> 
</span><span class="cx"> private:
</span><del>-    friend class ExecutableBase;
</del><span class="cx">     friend class ScriptExecutable;
</span><span class="cx"> 
</span><span class="cx">     ProgramExecutable(ExecState*, const SourceCode&amp;);
</span><span class="lines">@@ -512,7 +513,7 @@
</span><span class="cx">     static void visitChildren(JSCell*, SlotVisitor&amp;);
</span><span class="cx"> 
</span><span class="cx">     WriteBarrier&lt;UnlinkedProgramCodeBlock&gt; m_unlinkedProgramCodeBlock;
</span><del>-    WriteBarrier&lt;ProgramCodeBlock&gt; m_programCodeBlock;
</del><ins>+    RefPtr&lt;ProgramCodeBlock&gt; m_programCodeBlock;
</ins><span class="cx"> };
</span><span class="cx"> 
</span><span class="cx"> class ModuleProgramExecutable final : public ScriptExecutable {
</span><span class="lines">@@ -542,13 +543,14 @@
</span><span class="cx"> 
</span><span class="cx">     DECLARE_INFO;
</span><span class="cx"> 
</span><ins>+    void clearCode();
+
</ins><span class="cx">     ExecutableInfo executableInfo() const { return ExecutableInfo(needsActivation(), usesEval(), isStrictMode(), false, false, ConstructorKind::None, false); }
</span><span class="cx">     UnlinkedModuleProgramCodeBlock* unlinkedModuleProgramCodeBlock() { return m_unlinkedModuleProgramCodeBlock.get(); }
</span><span class="cx"> 
</span><span class="cx">     SymbolTable* moduleEnvironmentSymbolTable() { return m_moduleEnvironmentSymbolTable.get(); }
</span><span class="cx"> 
</span><span class="cx"> private:
</span><del>-    friend class ExecutableBase;
</del><span class="cx">     friend class ScriptExecutable;
</span><span class="cx"> 
</span><span class="cx">     ModuleProgramExecutable(ExecState*, const SourceCode&amp;);
</span><span class="lines">@@ -557,7 +559,7 @@
</span><span class="cx"> 
</span><span class="cx">     WriteBarrier&lt;UnlinkedModuleProgramCodeBlock&gt; m_unlinkedModuleProgramCodeBlock;
</span><span class="cx">     WriteBarrier&lt;SymbolTable&gt; m_moduleEnvironmentSymbolTable;
</span><del>-    WriteBarrier&lt;ModuleProgramCodeBlock&gt; m_moduleProgramCodeBlock;
</del><ins>+    RefPtr&lt;ModuleProgramCodeBlock&gt; m_moduleProgramCodeBlock;
</ins><span class="cx"> };
</span><span class="cx"> 
</span><span class="cx"> class FunctionExecutable final : public ScriptExecutable {
</span><span class="lines">@@ -598,7 +600,7 @@
</span><span class="cx">         
</span><span class="cx">     bool isGeneratedForCall() const
</span><span class="cx">     {
</span><del>-        return !!m_codeBlockForCall;
</del><ins>+        return m_codeBlockForCall;
</ins><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     FunctionCodeBlock* codeBlockForCall()
</span><span class="lines">@@ -608,7 +610,7 @@
</span><span class="cx"> 
</span><span class="cx">     bool isGeneratedForConstruct() const
</span><span class="cx">     {
</span><del>-        return m_codeBlockForConstruct.get();
</del><ins>+        return m_codeBlockForConstruct;
</ins><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     FunctionCodeBlock* codeBlockForConstruct()
</span><span class="lines">@@ -674,10 +676,11 @@
</span><span class="cx"> 
</span><span class="cx">     DECLARE_INFO;
</span><span class="cx"> 
</span><ins>+    void clearCode();
+    
</ins><span class="cx">     InferredValue* singletonFunction() { return m_singletonFunction.get(); }
</span><span class="cx"> 
</span><span class="cx"> private:
</span><del>-    friend class ExecutableBase;
</del><span class="cx">     FunctionExecutable(
</span><span class="cx">         VM&amp;, const SourceCode&amp;, UnlinkedFunctionExecutable*, unsigned firstLine, 
</span><span class="cx">         unsigned lastLine, unsigned startColumn, unsigned endColumn);
</span><span class="lines">@@ -687,8 +690,8 @@
</span><span class="cx">     friend class ScriptExecutable;
</span><span class="cx">     
</span><span class="cx">     WriteBarrier&lt;UnlinkedFunctionExecutable&gt; m_unlinkedExecutable;
</span><del>-    WriteBarrier&lt;FunctionCodeBlock&gt; m_codeBlockForCall;
-    WriteBarrier&lt;FunctionCodeBlock&gt; m_codeBlockForConstruct;
</del><ins>+    RefPtr&lt;FunctionCodeBlock&gt; m_codeBlockForCall;
+    RefPtr&lt;FunctionCodeBlock&gt; m_codeBlockForConstruct;
</ins><span class="cx">     RefPtr&lt;TypeSet&gt; m_returnStatementTypeSet;
</span><span class="cx">     unsigned m_parametersStartOffset;
</span><span class="cx">     WriteBarrier&lt;InferredValue&gt; m_singletonFunction;
</span><span class="lines">@@ -716,6 +719,8 @@
</span><span class="cx"> 
</span><span class="cx">     DECLARE_INFO;
</span><span class="cx"> 
</span><ins>+    void clearCode();
+
</ins><span class="cx">     void prepareForExecution(ExecState*);
</span><span class="cx"> 
</span><span class="cx">     WebAssemblyCodeBlock* codeBlockForCall()
</span><span class="lines">@@ -724,7 +729,6 @@
</span><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx"> private:
</span><del>-    friend class ExecutableBase;
</del><span class="cx">     WebAssemblyExecutable(VM&amp;, const SourceCode&amp;, JSWASMModule*, unsigned functionIndex);
</span><span class="cx"> 
</span><span class="cx">     static void visitChildren(JSCell*, SlotVisitor&amp;);
</span><span class="lines">@@ -733,10 +737,30 @@
</span><span class="cx">     WriteBarrier&lt;JSWASMModule&gt; m_module;
</span><span class="cx">     unsigned m_functionIndex;
</span><span class="cx"> 
</span><del>-    WriteBarrier&lt;WebAssemblyCodeBlock&gt; m_codeBlockForCall;
</del><ins>+    RefPtr&lt;WebAssemblyCodeBlock&gt; m_codeBlockForCall;
</ins><span class="cx"> };
</span><span class="cx"> #endif
</span><span class="cx"> 
</span><del>-} // namespace JSC
</del><ins>+inline void ExecutableBase::clearCodeVirtual(ExecutableBase* executable)
+{
+    switch (executable-&gt;type()) {
+    case EvalExecutableType:
+        return jsCast&lt;EvalExecutable*&gt;(executable)-&gt;clearCode();
+    case ProgramExecutableType:
+        return jsCast&lt;ProgramExecutable*&gt;(executable)-&gt;clearCode();
+    case FunctionExecutableType:
+        return jsCast&lt;FunctionExecutable*&gt;(executable)-&gt;clearCode();
+#if ENABLE(WEBASSEMBLY)
+    case WebAssemblyExecutableType:
+        return jsCast&lt;WebAssemblyExecutable*&gt;(executable)-&gt;clearCode();
+#endif
+    case ModuleProgramExecutableType:
+        return jsCast&lt;ModuleProgramExecutable*&gt;(executable)-&gt;clearCode();
+    default:
+        return jsCast&lt;NativeExecutable*&gt;(executable)-&gt;clearCode();
+    }
+}
</ins><span class="cx"> 
</span><del>-#endif // Executable_h
</del><ins>+}
+
+#endif
</ins></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeVMcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/VM.cpp (190808 => 190809)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/VM.cpp        2015-10-09 17:53:28 UTC (rev 190808)
+++ trunk/Source/JavaScriptCore/runtime/VM.cpp        2015-10-09 17:54:16 UTC (rev 190809)
</span><span class="lines">@@ -247,14 +247,6 @@
</span><span class="cx">     exceptionStructure.set(*this, Exception::createStructure(*this, 0, jsNull()));
</span><span class="cx">     promiseDeferredStructure.set(*this, JSPromiseDeferred::createStructure(*this, 0, jsNull()));
</span><span class="cx">     internalPromiseDeferredStructure.set(*this, JSInternalPromiseDeferred::createStructure(*this, 0, jsNull()));
</span><del>-    programCodeBlockStructure.set(*this, ProgramCodeBlock::createStructure(*this, 0, jsNull()));
-    moduleProgramCodeBlockStructure.set(*this, ModuleProgramCodeBlock::createStructure(*this, 0, jsNull()));
-    evalCodeBlockStructure.set(*this, EvalCodeBlock::createStructure(*this, 0, jsNull()));
-    functionCodeBlockStructure.set(*this, FunctionCodeBlock::createStructure(*this, 0, jsNull()));
-#if ENABLE(WEBASSEMBLY)
-    webAssemblyCodeBlockStructure.set(*this, WebAssemblyCodeBlock::createStructure(*this, 0, jsNull()));
-#endif
-
</del><span class="cx">     iterationTerminator.set(*this, JSFinalObject::create(*this, JSFinalObject::createStructure(*this, 0, jsNull(), 1)));
</span><span class="cx">     nativeStdFunctionCellStructure.set(*this, NativeStdFunctionCell::createStructure(*this, 0, jsNull()));
</span><span class="cx">     smallStrings.initializeCommonStrings(*this);
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeVMh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/VM.h (190808 => 190809)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/VM.h        2015-10-09 17:53:28 UTC (rev 190808)
+++ trunk/Source/JavaScriptCore/runtime/VM.h        2015-10-09 17:54:16 UTC (rev 190809)
</span><span class="lines">@@ -309,12 +309,6 @@
</span><span class="cx">     Strong&lt;Structure&gt; promiseDeferredStructure;
</span><span class="cx">     Strong&lt;Structure&gt; internalPromiseDeferredStructure;
</span><span class="cx">     Strong&lt;Structure&gt; nativeStdFunctionCellStructure;
</span><del>-    Strong&lt;Structure&gt; programCodeBlockStructure;
-    Strong&lt;Structure&gt; moduleProgramCodeBlockStructure;
-    Strong&lt;Structure&gt; evalCodeBlockStructure;
-    Strong&lt;Structure&gt; functionCodeBlockStructure;
-    Strong&lt;Structure&gt; webAssemblyCodeBlockStructure;
-
</del><span class="cx">     Strong&lt;JSCell&gt; iterationTerminator;
</span><span class="cx">     Strong&lt;JSCell&gt; emptyPropertyNameEnumerator;
</span><span class="cx"> 
</span></span></pre>
</div>
</div>

</body>
</html>