<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN"
"http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head><meta http-equiv="content-type" content="text/html; charset=utf-8" />
<title>[191150] tags/Safari-602.1.7/Source/JavaScriptCore</title>
</head>
<body>
<style type="text/css"><!--
#msg dl.meta { border: 1px #006 solid; background: #369; padding: 6px; color: #fff; }
#msg dl.meta dt { float: left; width: 6em; font-weight: bold; }
#msg dt:after { content:':';}
#msg dl, #msg dt, #msg ul, #msg li, #header, #footer, #logmsg { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; }
#msg dl a { font-weight: bold}
#msg dl a:link { color:#fc3; }
#msg dl a:active { color:#ff0; }
#msg dl a:visited { color:#cc6; }
h3 { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; font-weight: bold; }
#msg pre { overflow: auto; background: #ffc; border: 1px #fa0 solid; padding: 6px; }
#logmsg { background: #ffc; border: 1px #fa0 solid; padding: 1em 1em 0 1em; }
#logmsg p, #logmsg pre, #logmsg blockquote { margin: 0 0 1em 0; }
#logmsg p, #logmsg li, #logmsg dt, #logmsg dd { line-height: 14pt; }
#logmsg h1, #logmsg h2, #logmsg h3, #logmsg h4, #logmsg h5, #logmsg h6 { margin: .5em 0; }
#logmsg h1:first-child, #logmsg h2:first-child, #logmsg h3:first-child, #logmsg h4:first-child, #logmsg h5:first-child, #logmsg h6:first-child { margin-top: 0; }
#logmsg ul, #logmsg ol { padding: 0; list-style-position: inside; margin: 0 0 0 1em; }
#logmsg ul { text-indent: -1em; padding-left: 1em; }#logmsg ol { text-indent: -1.5em; padding-left: 1.5em; }
#logmsg > ul, #logmsg > ol { margin: 0 0 1em 0; }
#logmsg pre { background: #eee; padding: 1em; }
#logmsg blockquote { border: 1px solid #fa0; border-left-width: 10px; padding: 1em 1em 0 1em; background: white;}
#logmsg dl { margin: 0; }
#logmsg dt { font-weight: bold; }
#logmsg dd { margin: 0; padding: 0 0 0.5em 0; }
#logmsg dd:before { content:'\00bb';}
#logmsg table { border-spacing: 0px; border-collapse: collapse; border-top: 4px solid #fa0; border-bottom: 1px solid #fa0; background: #fff; }
#logmsg table th { text-align: left; font-weight: normal; padding: 0.2em 0.5em; border-top: 1px dotted #fa0; }
#logmsg table td { text-align: right; border-top: 1px dotted #fa0; padding: 0.2em 0.5em; }
#logmsg table thead th { text-align: center; border-bottom: 1px solid #fa0; }
#logmsg table th.Corner { text-align: left; }
#logmsg hr { border: none 0; border-top: 2px dashed #fa0; height: 1px; }
#header, #footer { color: #fff; background: #636; border: 1px #300 solid; padding: 6px; }
#patch { width: 100%; }
#patch h4 {font-family: verdana,arial,helvetica,sans-serif;font-size:10pt;padding:8px;background:#369;color:#fff;margin:0;}
#patch .propset h4, #patch .binary h4 {margin:0;}
#patch pre {padding:0;line-height:1.2em;margin:0;}
#patch .diff {width:100%;background:#eee;padding: 0 0 10px 0;overflow:auto;}
#patch .propset .diff, #patch .binary .diff {padding:10px 0;}
#patch span {display:block;padding:0 10px;}
#patch .modfile, #patch .addfile, #patch .delfile, #patch .propset, #patch .binary, #patch .copfile {border:1px solid #ccc;margin:10px 0;}
#patch ins {background:#dfd;text-decoration:none;display:block;padding:0 10px;}
#patch del {background:#fdd;text-decoration:none;display:block;padding:0 10px;}
#patch .lines, .info {color:#888;background:#fff;}
--></style>
<div id="msg">
<dl class="meta">
<dt>Revision</dt> <dd><a href="http://trac.webkit.org/projects/webkit/changeset/191150">191150</a></dd>
<dt>Author</dt> <dd>bshafiei@apple.com</dd>
<dt>Date</dt> <dd>2015-10-15 16:41:01 -0700 (Thu, 15 Oct 2015)</dd>
</dl>
<h3>Log Message</h3>
<pre>Roll out <a href="http://trac.webkit.org/projects/webkit/changeset/190896">r190896</a>. rdar://problem/23128791</pre>
<h3>Modified Paths</h3>
<ul>
<li><a href="#tagsSafari60217SourceJavaScriptCoreCMakeListstxt">tags/Safari-602.1.7/Source/JavaScriptCore/CMakeLists.txt</a></li>
<li><a href="#tagsSafari60217SourceJavaScriptCoreChangeLog">tags/Safari-602.1.7/Source/JavaScriptCore/ChangeLog</a></li>
<li><a href="#tagsSafari60217SourceJavaScriptCoreJavaScriptCorevcxprojJavaScriptCorevcxproj">tags/Safari-602.1.7/Source/JavaScriptCore/JavaScriptCore.vcxproj/JavaScriptCore.vcxproj</a></li>
<li><a href="#tagsSafari60217SourceJavaScriptCoreJavaScriptCorexcodeprojprojectpbxproj">tags/Safari-602.1.7/Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj</a></li>
<li><a href="#tagsSafari60217SourceJavaScriptCorebytecodePolymorphicAccesscpp">tags/Safari-602.1.7/Source/JavaScriptCore/bytecode/PolymorphicAccess.cpp</a></li>
<li><a href="#tagsSafari60217SourceJavaScriptCoredfgDFGAbstractInterpreterInlinesh">tags/Safari-602.1.7/Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h</a></li>
<li><a href="#tagsSafari60217SourceJavaScriptCoredfgDFGArgumentsEliminationPhasecpp">tags/Safari-602.1.7/Source/JavaScriptCore/dfg/DFGArgumentsEliminationPhase.cpp</a></li>
<li><a href="#tagsSafari60217SourceJavaScriptCoredfgDFGClobberizeh">tags/Safari-602.1.7/Source/JavaScriptCore/dfg/DFGClobberize.h</a></li>
<li><a href="#tagsSafari60217SourceJavaScriptCoredfgDFGDoesGCcpp">tags/Safari-602.1.7/Source/JavaScriptCore/dfg/DFGDoesGC.cpp</a></li>
<li><a href="#tagsSafari60217SourceJavaScriptCoredfgDFGFixupPhasecpp">tags/Safari-602.1.7/Source/JavaScriptCore/dfg/DFGFixupPhase.cpp</a></li>
<li><a href="#tagsSafari60217SourceJavaScriptCoredfgDFGHeapLocationcpp">tags/Safari-602.1.7/Source/JavaScriptCore/dfg/DFGHeapLocation.cpp</a></li>
<li><a href="#tagsSafari60217SourceJavaScriptCoredfgDFGHeapLocationh">tags/Safari-602.1.7/Source/JavaScriptCore/dfg/DFGHeapLocation.h</a></li>
<li><a href="#tagsSafari60217SourceJavaScriptCoredfgDFGLICMPhasecpp">tags/Safari-602.1.7/Source/JavaScriptCore/dfg/DFGLICMPhase.cpp</a></li>
<li><a href="#tagsSafari60217SourceJavaScriptCoredfgDFGNodeTypeh">tags/Safari-602.1.7/Source/JavaScriptCore/dfg/DFGNodeType.h</a></li>
<li><a href="#tagsSafari60217SourceJavaScriptCoredfgDFGOperationscpp">tags/Safari-602.1.7/Source/JavaScriptCore/dfg/DFGOperations.cpp</a></li>
<li><a href="#tagsSafari60217SourceJavaScriptCoredfgDFGOperationsh">tags/Safari-602.1.7/Source/JavaScriptCore/dfg/DFGOperations.h</a></li>
<li><a href="#tagsSafari60217SourceJavaScriptCoredfgDFGPlancpp">tags/Safari-602.1.7/Source/JavaScriptCore/dfg/DFGPlan.cpp</a></li>
<li><a href="#tagsSafari60217SourceJavaScriptCoredfgDFGPredictionPropagationPhasecpp">tags/Safari-602.1.7/Source/JavaScriptCore/dfg/DFGPredictionPropagationPhase.cpp</a></li>
<li><a href="#tagsSafari60217SourceJavaScriptCoredfgDFGSafeToExecuteh">tags/Safari-602.1.7/Source/JavaScriptCore/dfg/DFGSafeToExecute.h</a></li>
<li><a href="#tagsSafari60217SourceJavaScriptCoredfgDFGSpeculativeJITcpp">tags/Safari-602.1.7/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp</a></li>
<li><a href="#tagsSafari60217SourceJavaScriptCoredfgDFGSpeculativeJITh">tags/Safari-602.1.7/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h</a></li>
<li><a href="#tagsSafari60217SourceJavaScriptCoredfgDFGSpeculativeJIT32_64cpp">tags/Safari-602.1.7/Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp</a></li>
<li><a href="#tagsSafari60217SourceJavaScriptCoredfgDFGSpeculativeJIT64cpp">tags/Safari-602.1.7/Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp</a></li>
<li><a href="#tagsSafari60217SourceJavaScriptCoredfgDFGTypeCheckHoistingPhasecpp">tags/Safari-602.1.7/Source/JavaScriptCore/dfg/DFGTypeCheckHoistingPhase.cpp</a></li>
<li><a href="#tagsSafari60217SourceJavaScriptCoreftlFTLCapabilitiescpp">tags/Safari-602.1.7/Source/JavaScriptCore/ftl/FTLCapabilities.cpp</a></li>
<li><a href="#tagsSafari60217SourceJavaScriptCoreftlFTLLowerDFGToLLVMcpp">tags/Safari-602.1.7/Source/JavaScriptCore/ftl/FTLLowerDFGToLLVM.cpp</a></li>
<li><a href="#tagsSafari60217SourceJavaScriptCoreftlFTLOperationscpp">tags/Safari-602.1.7/Source/JavaScriptCore/ftl/FTLOperations.cpp</a></li>
<li><a href="#tagsSafari60217SourceJavaScriptCoreftlFTLOutputh">tags/Safari-602.1.7/Source/JavaScriptCore/ftl/FTLOutput.h</a></li>
<li><a href="#tagsSafari60217SourceJavaScriptCoreheapCopyVisitorInlinesh">tags/Safari-602.1.7/Source/JavaScriptCore/heap/CopyVisitorInlines.h</a></li>
<li><a href="#tagsSafari60217SourceJavaScriptCoreheapHeapcpp">tags/Safari-602.1.7/Source/JavaScriptCore/heap/Heap.cpp</a></li>
<li><a href="#tagsSafari60217SourceJavaScriptCoreheapHeaph">tags/Safari-602.1.7/Source/JavaScriptCore/heap/Heap.h</a></li>
<li><a href="#tagsSafari60217SourceJavaScriptCoreheapHeapInlinesh">tags/Safari-602.1.7/Source/JavaScriptCore/heap/HeapInlines.h</a></li>
<li><a href="#tagsSafari60217SourceJavaScriptCorejitAssemblyHelpersh">tags/Safari-602.1.7/Source/JavaScriptCore/jit/AssemblyHelpers.h</a></li>
<li><a href="#tagsSafari60217SourceJavaScriptCorejitJITcpp">tags/Safari-602.1.7/Source/JavaScriptCore/jit/JIT.cpp</a></li>
<li><a href="#tagsSafari60217SourceJavaScriptCorejitJITOpcodescpp">tags/Safari-602.1.7/Source/JavaScriptCore/jit/JITOpcodes.cpp</a></li>
<li><a href="#tagsSafari60217SourceJavaScriptCorejitJITOpcodes32_64cpp">tags/Safari-602.1.7/Source/JavaScriptCore/jit/JITOpcodes32_64.cpp</a></li>
<li><a href="#tagsSafari60217SourceJavaScriptCorejitJITPropertyAccesscpp">tags/Safari-602.1.7/Source/JavaScriptCore/jit/JITPropertyAccess.cpp</a></li>
<li><a href="#tagsSafari60217SourceJavaScriptCorellintLowLevelInterpreterasm">tags/Safari-602.1.7/Source/JavaScriptCore/llint/LowLevelInterpreter.asm</a></li>
<li><a href="#tagsSafari60217SourceJavaScriptCorellintLowLevelInterpreter64asm">tags/Safari-602.1.7/Source/JavaScriptCore/llint/LowLevelInterpreter64.asm</a></li>
<li><a href="#tagsSafari60217SourceJavaScriptCoreruntimeDirectArgumentscpp">tags/Safari-602.1.7/Source/JavaScriptCore/runtime/DirectArguments.cpp</a></li>
<li><a href="#tagsSafari60217SourceJavaScriptCoreruntimeDirectArgumentsh">tags/Safari-602.1.7/Source/JavaScriptCore/runtime/DirectArguments.h</a></li>
<li><a href="#tagsSafari60217SourceJavaScriptCoreruntimeJSArraycpp">tags/Safari-602.1.7/Source/JavaScriptCore/runtime/JSArray.cpp</a></li>
<li><a href="#tagsSafari60217SourceJavaScriptCoreruntimeJSArrayBufferViewcpp">tags/Safari-602.1.7/Source/JavaScriptCore/runtime/JSArrayBufferView.cpp</a></li>
<li><a href="#tagsSafari60217SourceJavaScriptCoreruntimeJSArrayBufferViewh">tags/Safari-602.1.7/Source/JavaScriptCore/runtime/JSArrayBufferView.h</a></li>
<li><a href="#tagsSafari60217SourceJavaScriptCoreruntimeJSArrayBufferViewInlinesh">tags/Safari-602.1.7/Source/JavaScriptCore/runtime/JSArrayBufferViewInlines.h</a></li>
<li><a href="#tagsSafari60217SourceJavaScriptCoreruntimeJSGenericTypedArrayViewh">tags/Safari-602.1.7/Source/JavaScriptCore/runtime/JSGenericTypedArrayView.h</a></li>
<li><a href="#tagsSafari60217SourceJavaScriptCoreruntimeJSGenericTypedArrayViewInlinesh">tags/Safari-602.1.7/Source/JavaScriptCore/runtime/JSGenericTypedArrayViewInlines.h</a></li>
<li><a href="#tagsSafari60217SourceJavaScriptCoreruntimeJSMaph">tags/Safari-602.1.7/Source/JavaScriptCore/runtime/JSMap.h</a></li>
<li><a href="#tagsSafari60217SourceJavaScriptCoreruntimeJSObjectcpp">tags/Safari-602.1.7/Source/JavaScriptCore/runtime/JSObject.cpp</a></li>
<li><a href="#tagsSafari60217SourceJavaScriptCoreruntimeJSObjecth">tags/Safari-602.1.7/Source/JavaScriptCore/runtime/JSObject.h</a></li>
<li><a href="#tagsSafari60217SourceJavaScriptCoreruntimeJSSeth">tags/Safari-602.1.7/Source/JavaScriptCore/runtime/JSSet.h</a></li>
<li><a href="#tagsSafari60217SourceJavaScriptCoreruntimeMapDatah">tags/Safari-602.1.7/Source/JavaScriptCore/runtime/MapData.h</a></li>
<li><a href="#tagsSafari60217SourceJavaScriptCoreruntimeMapDataInlinesh">tags/Safari-602.1.7/Source/JavaScriptCore/runtime/MapDataInlines.h</a></li>
<li><a href="#tagsSafari60217SourceJavaScriptCoreruntimeOptionsh">tags/Safari-602.1.7/Source/JavaScriptCore/runtime/Options.h</a></li>
</ul>
<h3>Added Paths</h3>
<ul>
<li><a href="#tagsSafari60217SourceJavaScriptCoreheapCopyWriteBarrierh">tags/Safari-602.1.7/Source/JavaScriptCore/heap/CopyWriteBarrier.h</a></li>
</ul>
<h3>Removed Paths</h3>
<ul>
<li><a href="#tagsSafari60217SourceJavaScriptCoredfgDFGCopyBarrierOptimizationPhasecpp">tags/Safari-602.1.7/Source/JavaScriptCore/dfg/DFGCopyBarrierOptimizationPhase.cpp</a></li>
<li><a href="#tagsSafari60217SourceJavaScriptCoredfgDFGCopyBarrierOptimizationPhaseh">tags/Safari-602.1.7/Source/JavaScriptCore/dfg/DFGCopyBarrierOptimizationPhase.h</a></li>
<li><a href="#tagsSafari60217SourceJavaScriptCoreheapCopyBarrierh">tags/Safari-602.1.7/Source/JavaScriptCore/heap/CopyBarrier.h</a></li>
</ul>
</div>
<div id="patch">
<h3>Diff</h3>
<a id="tagsSafari60217SourceJavaScriptCoreCMakeListstxt"></a>
<div class="modfile"><h4>Modified: tags/Safari-602.1.7/Source/JavaScriptCore/CMakeLists.txt (191149 => 191150)</h4>
<pre class="diff"><span>
<span class="info">--- tags/Safari-602.1.7/Source/JavaScriptCore/CMakeLists.txt 2015-10-15 23:38:21 UTC (rev 191149)
+++ tags/Safari-602.1.7/Source/JavaScriptCore/CMakeLists.txt 2015-10-15 23:41:01 UTC (rev 191150)
</span><span class="lines">@@ -168,7 +168,6 @@
</span><span class="cx"> dfg/DFGCompilationMode.cpp
</span><span class="cx"> dfg/DFGConstantFoldingPhase.cpp
</span><span class="cx"> dfg/DFGConstantHoistingPhase.cpp
</span><del>- dfg/DFGCopyBarrierOptimizationPhase.cpp
</del><span class="cx"> dfg/DFGCriticalEdgeBreakingPhase.cpp
</span><span class="cx"> dfg/DFGDCEPhase.cpp
</span><span class="cx"> dfg/DFGDesiredIdentifiers.cpp
</span></span></pre></div>
<a id="tagsSafari60217SourceJavaScriptCoreChangeLog"></a>
<div class="modfile"><h4>Modified: tags/Safari-602.1.7/Source/JavaScriptCore/ChangeLog (191149 => 191150)</h4>
<pre class="diff"><span>
<span class="info">--- tags/Safari-602.1.7/Source/JavaScriptCore/ChangeLog 2015-10-15 23:38:21 UTC (rev 191149)
+++ tags/Safari-602.1.7/Source/JavaScriptCore/ChangeLog 2015-10-15 23:41:01 UTC (rev 191150)
</span><span class="lines">@@ -1,5 +1,9 @@
</span><span class="cx"> 2015-10-15 Babak Shafiei <bshafiei@apple.com>
</span><span class="cx">
</span><ins>+ Roll out r190896.
+
+2015-10-15 Babak Shafiei <bshafiei@apple.com>
+
</ins><span class="cx"> Roll out r190904.
</span><span class="cx">
</span><span class="cx"> 2015-10-14 Mark Lam <mark.lam@apple.com>
</span></span></pre></div>
<a id="tagsSafari60217SourceJavaScriptCoreJavaScriptCorevcxprojJavaScriptCorevcxproj"></a>
<div class="modfile"><h4>Modified: tags/Safari-602.1.7/Source/JavaScriptCore/JavaScriptCore.vcxproj/JavaScriptCore.vcxproj (191149 => 191150)</h4>
<pre class="diff"><span>
<span class="info">--- tags/Safari-602.1.7/Source/JavaScriptCore/JavaScriptCore.vcxproj/JavaScriptCore.vcxproj 2015-10-15 23:38:21 UTC (rev 191149)
+++ tags/Safari-602.1.7/Source/JavaScriptCore/JavaScriptCore.vcxproj/JavaScriptCore.vcxproj 2015-10-15 23:41:01 UTC (rev 191150)
</span><span class="lines">@@ -402,7 +402,6 @@
</span><span class="cx"> <ClCompile Include="..\dfg\DFGCompilationMode.cpp" />
</span><span class="cx"> <ClCompile Include="..\dfg\DFGConstantFoldingPhase.cpp" />
</span><span class="cx"> <ClCompile Include="..\dfg\DFGConstantHoistingPhase.cpp" />
</span><del>- <ClCompile Include="..\dfg\DFGCopyBarrierOptimizationPhase.cpp" />
</del><span class="cx"> <ClCompile Include="..\dfg\DFGCPSRethreadingPhase.cpp" />
</span><span class="cx"> <ClCompile Include="..\dfg\DFGCriticalEdgeBreakingPhase.cpp" />
</span><span class="cx"> <ClCompile Include="..\dfg\DFGCSEPhase.cpp" />
</span><span class="lines">@@ -1139,7 +1138,6 @@
</span><span class="cx"> <ClInclude Include="..\dfg\DFGCompilationMode.h" />
</span><span class="cx"> <ClInclude Include="..\dfg\DFGConstantFoldingPhase.h" />
</span><span class="cx"> <ClInclude Include="..\dfg\DFGConstantHoistingPhase.h" />
</span><del>- <ClInclude Include="..\dfg\DFGCopyBarrierOptimizationPhase.h" />
</del><span class="cx"> <ClInclude Include="..\dfg\DFGCPSRethreadingPhase.h" />
</span><span class="cx"> <ClInclude Include="..\dfg\DFGCriticalEdgeBreakingPhase.h" />
</span><span class="cx"> <ClInclude Include="..\dfg\DFGCSEPhase.h" />
</span><span class="lines">@@ -1339,11 +1337,11 @@
</span><span class="cx"> <ClInclude Include="..\heap\CopiedBlockInlines.h" />
</span><span class="cx"> <ClInclude Include="..\heap\CopiedSpace.h" />
</span><span class="cx"> <ClInclude Include="..\heap\CopiedSpaceInlines.h" />
</span><del>- <ClInclude Include="..\heap\CopyBarrier.h" />
</del><span class="cx"> <ClInclude Include="..\heap\CopyToken.h" />
</span><span class="cx"> <ClInclude Include="..\heap\CopyVisitor.h" />
</span><span class="cx"> <ClInclude Include="..\heap\CopyVisitorInlines.h" />
</span><span class="cx"> <ClInclude Include="..\heap\CopyWorkList.h" />
</span><ins>+ <ClInclude Include="..\heap\CopyWriteBarrier.h" />
</ins><span class="cx"> <ClInclude Include="..\heap\DeferGC.h" />
</span><span class="cx"> <ClInclude Include="..\heap\EdenGCActivityCallback.h" />
</span><span class="cx"> <ClInclude Include="..\heap\FullGCActivityCallback.h" />
</span></span></pre></div>
<a id="tagsSafari60217SourceJavaScriptCoreJavaScriptCorexcodeprojprojectpbxproj"></a>
<div class="modfile"><h4>Modified: tags/Safari-602.1.7/Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj (191149 => 191150)</h4>
<pre class="diff"><span>
<span class="info">--- tags/Safari-602.1.7/Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj 2015-10-15 23:38:21 UTC (rev 191149)
+++ tags/Safari-602.1.7/Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj 2015-10-15 23:41:01 UTC (rev 191150)
</span><span class="lines">@@ -86,8 +86,6 @@
</span><span class="cx"> 0F04396E1B03DC0B009598B7 /* DFGCombinedLiveness.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F04396C1B03DC0B009598B7 /* DFGCombinedLiveness.h */; };
</span><span class="cx"> 0F05C3B41683CF9200BAF45B /* DFGArrayifySlowPathGenerator.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F05C3B21683CF8F00BAF45B /* DFGArrayifySlowPathGenerator.h */; };
</span><span class="cx"> 0F0776BF14FF002B00102332 /* JITCompilationEffort.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F0776BD14FF002800102332 /* JITCompilationEffort.h */; settings = {ATTRIBUTES = (Private, ); }; };
</span><del>- 0F0981F71BC5E565004814F8 /* DFGCopyBarrierOptimizationPhase.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F0981F51BC5E565004814F8 /* DFGCopyBarrierOptimizationPhase.cpp */; };
- 0F0981F81BC5E565004814F8 /* DFGCopyBarrierOptimizationPhase.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F0981F61BC5E565004814F8 /* DFGCopyBarrierOptimizationPhase.h */; };
</del><span class="cx"> 0F0A75221B94BFA900110660 /* InferredType.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F0A75201B94BFA900110660 /* InferredType.cpp */; };
</span><span class="cx"> 0F0A75231B94BFA900110660 /* InferredType.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F0A75211B94BFA900110660 /* InferredType.h */; settings = {ATTRIBUTES = (Private, ); }; };
</span><span class="cx"> 0F0B839C14BCF46300885B4F /* LLIntThunks.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F0B839714BCF45A00885B4F /* LLIntThunks.cpp */; };
</span><span class="lines">@@ -410,7 +408,6 @@
</span><span class="cx"> 0F79085619A290B200F6310C /* DFGStructureRegistrationPhase.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F79085419A290B200F6310C /* DFGStructureRegistrationPhase.h */; };
</span><span class="cx"> 0F7B294B14C3CD2F007C3DB1 /* DFGCapabilities.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FD82E1F14172C2F00179C94 /* DFGCapabilities.h */; };
</span><span class="cx"> 0F7B294D14C3CD4C007C3DB1 /* DFGCommon.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FC0977E1469EBC400CF2442 /* DFGCommon.h */; settings = {ATTRIBUTES = (Private, ); }; };
</span><del>- 0F7C11AD1BC3862C00C74CDB /* CopyBarrier.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F7C11AC1BC3862C00C74CDB /* CopyBarrier.h */; settings = {ATTRIBUTES = (Private, ); }; };
</del><span class="cx"> 0F8023EA1613832B00A0BA45 /* ByValInfo.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F8023E91613832300A0BA45 /* ByValInfo.h */; settings = {ATTRIBUTES = (Private, ); }; };
</span><span class="cx"> 0F8335B71639C1E6001443B5 /* ArrayAllocationProfile.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F8335B41639C1E3001443B5 /* ArrayAllocationProfile.cpp */; };
</span><span class="cx"> 0F8335B81639C1EA001443B5 /* ArrayAllocationProfile.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F8335B51639C1E3001443B5 /* ArrayAllocationProfile.h */; settings = {ATTRIBUTES = (Private, ); }; };
</span><span class="lines">@@ -937,6 +934,7 @@
</span><span class="cx"> 2A4BB7F318A41179008A0FCD /* JSManagedValueInternal.h in Headers */ = {isa = PBXBuildFile; fileRef = 2A4BB7F218A41179008A0FCD /* JSManagedValueInternal.h */; };
</span><span class="cx"> 2A4EC90B1860D6C20094F782 /* WriteBarrierBuffer.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 2A4EC9091860D6C20094F782 /* WriteBarrierBuffer.cpp */; };
</span><span class="cx"> 2A4EC90C1860D6C20094F782 /* WriteBarrierBuffer.h in Headers */ = {isa = PBXBuildFile; fileRef = 2A4EC90A1860D6C20094F782 /* WriteBarrierBuffer.h */; settings = {ATTRIBUTES = (Private, ); }; };
</span><ins>+ 2A68295B1875F80500B6C3E2 /* CopyWriteBarrier.h in Headers */ = {isa = PBXBuildFile; fileRef = 2A68295A1875F80500B6C3E2 /* CopyWriteBarrier.h */; settings = {ATTRIBUTES = (Private, ); }; };
</ins><span class="cx"> 2A6F462617E959CE00C45C98 /* HeapOperation.h in Headers */ = {isa = PBXBuildFile; fileRef = 2A6F462517E959CE00C45C98 /* HeapOperation.h */; settings = {ATTRIBUTES = (Private, ); }; };
</span><span class="cx"> 2A7A58EF1808A4C40020BDF7 /* DeferGC.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 2A7A58EE1808A4C40020BDF7 /* DeferGC.cpp */; };
</span><span class="cx"> 2A83638518D7D0EE0000EBCC /* EdenGCActivityCallback.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 2A83638318D7D0EE0000EBCC /* EdenGCActivityCallback.cpp */; };
</span><span class="lines">@@ -1941,8 +1939,6 @@
</span><span class="cx"> 0F04396C1B03DC0B009598B7 /* DFGCombinedLiveness.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGCombinedLiveness.h; path = dfg/DFGCombinedLiveness.h; sourceTree = "<group>"; };
</span><span class="cx"> 0F05C3B21683CF8F00BAF45B /* DFGArrayifySlowPathGenerator.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGArrayifySlowPathGenerator.h; path = dfg/DFGArrayifySlowPathGenerator.h; sourceTree = "<group>"; };
</span><span class="cx"> 0F0776BD14FF002800102332 /* JITCompilationEffort.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JITCompilationEffort.h; sourceTree = "<group>"; };
</span><del>- 0F0981F51BC5E565004814F8 /* DFGCopyBarrierOptimizationPhase.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGCopyBarrierOptimizationPhase.cpp; path = dfg/DFGCopyBarrierOptimizationPhase.cpp; sourceTree = "<group>"; };
- 0F0981F61BC5E565004814F8 /* DFGCopyBarrierOptimizationPhase.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGCopyBarrierOptimizationPhase.h; path = dfg/DFGCopyBarrierOptimizationPhase.h; sourceTree = "<group>"; };
</del><span class="cx"> 0F0A75201B94BFA900110660 /* InferredType.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = InferredType.cpp; sourceTree = "<group>"; };
</span><span class="cx"> 0F0A75211B94BFA900110660 /* InferredType.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = InferredType.h; sourceTree = "<group>"; };
</span><span class="cx"> 0F0B839714BCF45A00885B4F /* LLIntThunks.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = LLIntThunks.cpp; path = llint/LLIntThunks.cpp; sourceTree = "<group>"; };
</span><span class="lines">@@ -2263,7 +2259,6 @@
</span><span class="cx"> 0F7700911402FF280078EB39 /* SamplingCounter.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = SamplingCounter.cpp; sourceTree = "<group>"; };
</span><span class="cx"> 0F79085319A290B200F6310C /* DFGStructureRegistrationPhase.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGStructureRegistrationPhase.cpp; path = dfg/DFGStructureRegistrationPhase.cpp; sourceTree = "<group>"; };
</span><span class="cx"> 0F79085419A290B200F6310C /* DFGStructureRegistrationPhase.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGStructureRegistrationPhase.h; path = dfg/DFGStructureRegistrationPhase.h; sourceTree = "<group>"; };
</span><del>- 0F7C11AC1BC3862C00C74CDB /* CopyBarrier.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = CopyBarrier.h; sourceTree = "<group>"; };
</del><span class="cx"> 0F8023E91613832300A0BA45 /* ByValInfo.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ByValInfo.h; sourceTree = "<group>"; };
</span><span class="cx"> 0F8335B41639C1E3001443B5 /* ArrayAllocationProfile.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ArrayAllocationProfile.cpp; sourceTree = "<group>"; };
</span><span class="cx"> 0F8335B51639C1E3001443B5 /* ArrayAllocationProfile.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ArrayAllocationProfile.h; sourceTree = "<group>"; };
</span><span class="lines">@@ -2760,6 +2755,7 @@
</span><span class="cx"> 2A4BB7F218A41179008A0FCD /* JSManagedValueInternal.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSManagedValueInternal.h; sourceTree = "<group>"; };
</span><span class="cx"> 2A4EC9091860D6C20094F782 /* WriteBarrierBuffer.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = WriteBarrierBuffer.cpp; sourceTree = "<group>"; };
</span><span class="cx"> 2A4EC90A1860D6C20094F782 /* WriteBarrierBuffer.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WriteBarrierBuffer.h; sourceTree = "<group>"; };
</span><ins>+ 2A68295A1875F80500B6C3E2 /* CopyWriteBarrier.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = CopyWriteBarrier.h; sourceTree = "<group>"; };
</ins><span class="cx"> 2A6F462517E959CE00C45C98 /* HeapOperation.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = HeapOperation.h; sourceTree = "<group>"; };
</span><span class="cx"> 2A7A58EE1808A4C40020BDF7 /* DeferGC.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = DeferGC.cpp; sourceTree = "<group>"; };
</span><span class="cx"> 2A83638318D7D0EE0000EBCC /* EdenGCActivityCallback.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = EdenGCActivityCallback.cpp; sourceTree = "<group>"; };
</span><span class="lines">@@ -4254,12 +4250,12 @@
</span><span class="cx"> C240305314B404C90079EB64 /* CopiedSpace.cpp */,
</span><span class="cx"> C2EAA3F8149A830800FCE112 /* CopiedSpace.h */,
</span><span class="cx"> C2C8D02B14A3C6B200578E65 /* CopiedSpaceInlines.h */,
</span><del>- 0F7C11AC1BC3862C00C74CDB /* CopyBarrier.h */,
</del><span class="cx"> 0F5A52CF17ADD717008ECB2D /* CopyToken.h */,
</span><span class="cx"> C2239D1216262BDD005AC5FD /* CopyVisitor.cpp */,
</span><span class="cx"> C2239D1316262BDD005AC5FD /* CopyVisitor.h */,
</span><span class="cx"> C2239D1416262BDD005AC5FD /* CopyVisitorInlines.h */,
</span><span class="cx"> C218D13F1655CFD50062BB81 /* CopyWorkList.h */,
</span><ins>+ 2A68295A1875F80500B6C3E2 /* CopyWriteBarrier.h */,
</ins><span class="cx"> 2A7A58EE1808A4C40020BDF7 /* DeferGC.cpp */,
</span><span class="cx"> 0F136D4B174AD69B0075B354 /* DeferGC.h */,
</span><span class="cx"> 2A83638318D7D0EE0000EBCC /* EdenGCActivityCallback.cpp */,
</span><span class="lines">@@ -5251,8 +5247,6 @@
</span><span class="cx"> 0F3B3A18153E68EF003ED0FF /* DFGConstantFoldingPhase.h */,
</span><span class="cx"> 0FED67B71B26256D0066CE15 /* DFGConstantHoistingPhase.cpp */,
</span><span class="cx"> 0FED67B81B26256D0066CE15 /* DFGConstantHoistingPhase.h */,
</span><del>- 0F0981F51BC5E565004814F8 /* DFGCopyBarrierOptimizationPhase.cpp */,
- 0F0981F61BC5E565004814F8 /* DFGCopyBarrierOptimizationPhase.h */,
</del><span class="cx"> 0FBE0F6B16C1DB010082C5E8 /* DFGCPSRethreadingPhase.cpp */,
</span><span class="cx"> 0FBE0F6C16C1DB010082C5E8 /* DFGCPSRethreadingPhase.h */,
</span><span class="cx"> A7D89CE617A0B8CC00773AD8 /* DFGCriticalEdgeBreakingPhase.cpp */,
</span><span class="lines">@@ -6094,6 +6088,7 @@
</span><span class="cx"> C2239D1816262BDD005AC5FD /* CopyVisitor.h in Headers */,
</span><span class="cx"> C2239D1916262BDD005AC5FD /* CopyVisitorInlines.h in Headers */,
</span><span class="cx"> C218D1401655CFD50062BB81 /* CopyWorkList.h in Headers */,
</span><ins>+ 2A68295B1875F80500B6C3E2 /* CopyWriteBarrier.h in Headers */,
</ins><span class="cx"> C4F4B6F41A05C944005CAB76 /* cpp_generator.py in Headers */,
</span><span class="cx"> C4F4B6F31A05C944005CAB76 /* cpp_generator_templates.py in Headers */,
</span><span class="cx"> 5DE6E5B30E1728EC00180407 /* create_hash_table in Headers */,
</span><span class="lines">@@ -6533,7 +6528,6 @@
</span><span class="cx"> A7A4AE1017973B4D005612B1 /* JITStubsX86Common.h in Headers */,
</span><span class="cx"> 0F5EF91F16878F7D003E5C25 /* JITThunks.h in Headers */,
</span><span class="cx"> 0FC712E317CD8793008CC93C /* JITToDFGDeferredCompilationCallback.h in Headers */,
</span><del>- 0F0981F81BC5E565004814F8 /* DFGCopyBarrierOptimizationPhase.h in Headers */,
</del><span class="cx"> A76F54A313B28AAB00EF2BCE /* JITWriteBarrier.h in Headers */,
</span><span class="cx"> 840480131021A1D9008E7F01 /* JSAPIValueWrapper.h in Headers */,
</span><span class="cx"> C2CF39C216E15A8100DD69BE /* JSAPIWrapperObject.h in Headers */,
</span><span class="lines">@@ -6780,7 +6774,6 @@
</span><span class="cx"> 868916B0155F286300CB2B9A /* PrivateName.h in Headers */,
</span><span class="cx"> BC18C4500E16F5CD00B34460 /* Profile.h in Headers */,
</span><span class="cx"> 95CD45770E1C4FDD0085358E /* ProfileGenerator.h in Headers */,
</span><del>- 0F7C11AD1BC3862C00C74CDB /* CopyBarrier.h in Headers */,
</del><span class="cx"> BC18C4510E16F5CD00B34460 /* ProfileNode.h in Headers */,
</span><span class="cx"> 0FF729A5166AD351000F5BA3 /* ProfilerBytecode.h in Headers */,
</span><span class="cx"> 0FF729B9166AD360000F5BA3 /* ProfilerBytecodes.h in Headers */,
</span><span class="lines">@@ -8131,7 +8124,6 @@
</span><span class="cx"> 709FB86B1AE335C60039D069 /* WeakSetPrototype.cpp in Sources */,
</span><span class="cx"> 2A4EC90B1860D6C20094F782 /* WriteBarrierBuffer.cpp in Sources */,
</span><span class="cx"> 0FC8150B14043C0E00CFA603 /* WriteBarrierSupport.cpp in Sources */,
</span><del>- 0F0981F71BC5E565004814F8 /* DFGCopyBarrierOptimizationPhase.cpp in Sources */,
</del><span class="cx"> A7E5AB3A1799E4B200D2833D /* X86Disassembler.cpp in Sources */,
</span><span class="cx"> 863C6D9C1521111A00585E4E /* YarrCanonicalizeUCS2.cpp in Sources */,
</span><span class="cx"> 86704B8412DBA33700A9FE7B /* YarrInterpreter.cpp in Sources */,
</span></span></pre></div>
<a id="tagsSafari60217SourceJavaScriptCorebytecodePolymorphicAccesscpp"></a>
<div class="modfile"><h4>Modified: tags/Safari-602.1.7/Source/JavaScriptCore/bytecode/PolymorphicAccess.cpp (191149 => 191150)</h4>
<pre class="diff"><span>
<span class="info">--- tags/Safari-602.1.7/Source/JavaScriptCore/bytecode/PolymorphicAccess.cpp 2015-10-15 23:38:21 UTC (rev 191149)
+++ tags/Safari-602.1.7/Source/JavaScriptCore/bytecode/PolymorphicAccess.cpp 2015-10-15 23:41:01 UTC (rev 191150)
</span><span class="lines">@@ -607,7 +607,6 @@
</span><span class="cx"> jit.loadPtr(
</span><span class="cx"> CCallHelpers::Address(baseForAccessGPR, JSObject::butterflyOffset()),
</span><span class="cx"> loadedValueGPR);
</span><del>- jit.removeSpaceBits(loadedValueGPR);
</del><span class="cx"> storageGPR = loadedValueGPR;
</span><span class="cx"> }
</span><span class="cx">
</span><span class="lines">@@ -894,7 +893,6 @@
</span><span class="cx"> offsetInInlineStorage(m_offset) * sizeof(JSValue)));
</span><span class="cx"> } else {
</span><span class="cx"> jit.loadPtr(CCallHelpers::Address(baseGPR, JSObject::butterflyOffset()), scratchGPR);
</span><del>- state.failAndIgnore.append(jit.branchIfNotToSpace(scratchGPR));
</del><span class="cx"> jit.storeValue(
</span><span class="cx"> valueRegs,
</span><span class="cx"> CCallHelpers::Address(
</span><span class="lines">@@ -958,7 +956,6 @@
</span><span class="cx"> ASSERT(newSize > oldSize);
</span><span class="cx">
</span><span class="cx"> jit.loadPtr(CCallHelpers::Address(baseGPR, JSObject::butterflyOffset()), scratchGPR3);
</span><del>- slowPath.append(jit.branchIfNotToSpace(scratchGPR3));
</del><span class="cx"> jit.loadPtr(&copiedAllocator->m_currentRemaining, scratchGPR);
</span><span class="cx"> slowPath.append(
</span><span class="cx"> jit.branchSubPtr(
</span><span class="lines">@@ -1002,10 +999,8 @@
</span><span class="cx"> JSObject::offsetOfInlineStorage() +
</span><span class="cx"> offsetInInlineStorage(m_offset) * sizeof(JSValue)));
</span><span class="cx"> } else {
</span><del>- if (!scratchGPRHasStorage) {
</del><ins>+ if (!scratchGPRHasStorage)
</ins><span class="cx"> jit.loadPtr(CCallHelpers::Address(baseGPR, JSObject::butterflyOffset()), scratchGPR);
</span><del>- state.failAndIgnore.append(jit.branchIfNotToSpace(scratchGPR));
- }
</del><span class="cx"> jit.storeValue(
</span><span class="cx"> valueRegs,
</span><span class="cx"> CCallHelpers::Address(scratchGPR, offsetInButterfly(m_offset) * sizeof(JSValue)));
</span><span class="lines">@@ -1092,7 +1087,6 @@
</span><span class="cx">
</span><span class="cx"> case ArrayLength: {
</span><span class="cx"> jit.loadPtr(CCallHelpers::Address(baseGPR, JSObject::butterflyOffset()), scratchGPR);
</span><del>- jit.removeSpaceBits(scratchGPR);
</del><span class="cx"> jit.load32(CCallHelpers::Address(scratchGPR, ArrayStorage::lengthOffset()), scratchGPR);
</span><span class="cx"> state.failAndIgnore.append(
</span><span class="cx"> jit.branch32(CCallHelpers::LessThan, scratchGPR, CCallHelpers::TrustedImm32(0)));
</span></span></pre></div>
<a id="tagsSafari60217SourceJavaScriptCoredfgDFGAbstractInterpreterInlinesh"></a>
<div class="modfile"><h4>Modified: tags/Safari-602.1.7/Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h (191149 => 191150)</h4>
<pre class="diff"><span>
<span class="info">--- tags/Safari-602.1.7/Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h 2015-10-15 23:38:21 UTC (rev 191149)
+++ tags/Safari-602.1.7/Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h 2015-10-15 23:41:01 UTC (rev 191150)
</span><span class="lines">@@ -1968,7 +1968,6 @@
</span><span class="cx"> }
</span><span class="cx"> break;
</span><span class="cx"> case GetButterfly:
</span><del>- case GetButterflyReadOnly:
</del><span class="cx"> case AllocatePropertyStorage:
</span><span class="cx"> case ReallocatePropertyStorage:
</span><span class="cx"> forNode(node).clear(); // The result is not a JS value.
</span></span></pre></div>
<a id="tagsSafari60217SourceJavaScriptCoredfgDFGArgumentsEliminationPhasecpp"></a>
<div class="modfile"><h4>Modified: tags/Safari-602.1.7/Source/JavaScriptCore/dfg/DFGArgumentsEliminationPhase.cpp (191149 => 191150)</h4>
<pre class="diff"><span>
<span class="info">--- tags/Safari-602.1.7/Source/JavaScriptCore/dfg/DFGArgumentsEliminationPhase.cpp 2015-10-15 23:38:21 UTC (rev 191149)
+++ tags/Safari-602.1.7/Source/JavaScriptCore/dfg/DFGArgumentsEliminationPhase.cpp 2015-10-15 23:41:01 UTC (rev 191150)
</span><span class="lines">@@ -192,7 +192,6 @@
</span><span class="cx"> break;
</span><span class="cx">
</span><span class="cx"> case GetButterfly:
</span><del>- case GetButterflyReadOnly:
</del><span class="cx"> // This barely works. The danger is that the GetButterfly is used by something that
</span><span class="cx"> // does something escaping to a candidate. Fortunately, the only butterfly-using ops
</span><span class="cx"> // that we exempt here also use the candidate directly. If there ever was a
</span></span></pre></div>
<a id="tagsSafari60217SourceJavaScriptCoredfgDFGClobberizeh"></a>
<div class="modfile"><h4>Modified: tags/Safari-602.1.7/Source/JavaScriptCore/dfg/DFGClobberize.h (191149 => 191150)</h4>
<pre class="diff"><span>
<span class="info">--- tags/Safari-602.1.7/Source/JavaScriptCore/dfg/DFGClobberize.h 2015-10-15 23:38:21 UTC (rev 191149)
+++ tags/Safari-602.1.7/Source/JavaScriptCore/dfg/DFGClobberize.h 2015-10-15 23:41:01 UTC (rev 191150)
</span><span class="lines">@@ -731,13 +731,6 @@
</span><span class="cx"> read(JSObject_butterfly);
</span><span class="cx"> def(HeapLocation(ButterflyLoc, JSObject_butterfly, node->child1()), LazyNode(node));
</span><span class="cx"> return;
</span><del>-
- case GetButterflyReadOnly:
- // This rule is separate to prevent CSE of GetButterfly with GetButterflyReadOnly. But in reality,
- // this works because we don't introduce GetButterflyReadOnly until the bitter end of compilation.
- read(JSObject_butterfly);
- def(HeapLocation(ButterflyReadOnlyLoc, JSObject_butterfly, node->child1()), LazyNode(node));
- return;
</del><span class="cx">
</span><span class="cx"> case Arrayify:
</span><span class="cx"> case ArrayifyToStructure:
</span></span></pre></div>
<a id="tagsSafari60217SourceJavaScriptCoredfgDFGCopyBarrierOptimizationPhasecpp"></a>
<div class="delfile"><h4>Deleted: tags/Safari-602.1.7/Source/JavaScriptCore/dfg/DFGCopyBarrierOptimizationPhase.cpp (191149 => 191150)</h4>
<pre class="diff"><span>
<span class="info">--- tags/Safari-602.1.7/Source/JavaScriptCore/dfg/DFGCopyBarrierOptimizationPhase.cpp 2015-10-15 23:38:21 UTC (rev 191149)
+++ tags/Safari-602.1.7/Source/JavaScriptCore/dfg/DFGCopyBarrierOptimizationPhase.cpp 2015-10-15 23:41:01 UTC (rev 191150)
</span><span class="lines">@@ -1,133 +0,0 @@
</span><del>-/*
- * Copyright (C) 2015 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- * notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- * notice, this list of conditions and the following disclaimer in the
- * documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
- * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
- * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
- * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
- * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
- * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
- * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
- * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
- * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
- * THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include "config.h"
-#include "DFGCopyBarrierOptimizationPhase.h"
-
-#if ENABLE(DFG_JIT)
-
-#include "DFGClobberize.h"
-#include "DFGDoesGC.h"
-#include "DFGGraph.h"
-#include "DFGPhase.h"
-#include "JSCInlines.h"
-
-namespace JSC { namespace DFG {
-
-namespace {
-
-bool verbose = false;
-
-class CopyBarrierOptimizationPhase : public Phase {
-public:
- CopyBarrierOptimizationPhase(Graph& graph)
- : Phase(graph, "copy barrier optimization")
- {
- }
-
- bool run()
- {
- if (verbose) {
- dataLog("Starting copy barrier optimization:\n");
- m_graph.dump();
- }
-
- // First convert all GetButterfly nodes into GetButterflyReadOnly.
- for (BasicBlock* block : m_graph.blocksInNaturalOrder()) {
- for (Node* node : *block) {
- if (node->op() == GetButterfly)
- node->setOp(GetButterflyReadOnly);
- }
- }
-
- // Anytime we use a GetButterflyReadOnly in a setting that may write to the heap, or if we're in a
- // new epoch, convert it to a GetButterfly. The epoch gets incremented at basic block boundaries,
- // anytime we GC, and anytime a barrier on the butterfly may be executed. We traverse the program
- // in pre-order so that we always see uses after defs. Note that this is a fixpoint because if we
- // turn a GetButterflyReadOnly into a GetButterfly, then we've introduced a butterfly reallocation.
- bool changed = true;
- Epoch currentEpoch = Epoch::first();
- m_graph.clearEpochs();
- while (changed) {
- changed = false;
- for (BasicBlock* block : m_graph.blocksInPreOrder()) {
- currentEpoch.bump();
- for (Node* node : *block) {
- bool writesToHeap = writesOverlap(m_graph, node, Heap);
-
- bool reallocatesButterfly = false;
- if (doesGC(m_graph, node) || writesOverlap(m_graph, node, JSObject_butterfly))
- reallocatesButterfly = true;
- else {
- // This is not an exhaustive list of things that will execute copy barriers. Most
- // things that execute copy barriers also do GC or have writes that overlap the
- // butterfly heap, and we catch that above.
- switch (node->op()) {
- case GetButterfly:
- case MultiPutByOffset:
- reallocatesButterfly = true;
- break;
- default:
- break;
- }
- }
-
- m_graph.doToChildren(
- node,
- [&] (Edge edge) {
- if (edge->op() != GetButterflyReadOnly)
- return;
-
- if (writesToHeap || currentEpoch != edge->epoch()) {
- changed = true;
- edge->setOp(GetButterfly);
- }
- });
-
- if (reallocatesButterfly)
- currentEpoch.bump();
-
- node->setEpoch(currentEpoch);
- }
- }
- }
-
- // This phase always thinks that it changes the graph. That's OK, because it's a late phase.
- return true;
- }
-};
-
-} // anonymous namespace
-
-bool performCopyBarrierOptimization(Graph& graph)
-{
- SamplingRegion samplingRegion("DFG Copy Barrier Optimization Phase");
- return runPhase<CopyBarrierOptimizationPhase>(graph);
-}
-
-} } // namespace JSC::DFG
-
-#endif // ENABLE(DFG_JIT)
-
</del></span></pre></div>
<a id="tagsSafari60217SourceJavaScriptCoredfgDFGCopyBarrierOptimizationPhaseh"></a>
<div class="delfile"><h4>Deleted: tags/Safari-602.1.7/Source/JavaScriptCore/dfg/DFGCopyBarrierOptimizationPhase.h (191149 => 191150)</h4>
<pre class="diff"><span>
<span class="info">--- tags/Safari-602.1.7/Source/JavaScriptCore/dfg/DFGCopyBarrierOptimizationPhase.h 2015-10-15 23:38:21 UTC (rev 191149)
+++ tags/Safari-602.1.7/Source/JavaScriptCore/dfg/DFGCopyBarrierOptimizationPhase.h 2015-10-15 23:41:01 UTC (rev 191150)
</span><span class="lines">@@ -1,44 +0,0 @@
</span><del>-/*
- * Copyright (C) 2015 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- * notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- * notice, this list of conditions and the following disclaimer in the
- * documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
- * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
- * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
- * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
- * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
- * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
- * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
- * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
- * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
- * THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#ifndef DFGCopyBarrierOptimizationPhase_h
-#define DFGCopyBarrierOptimizationPhase_h
-
-#if ENABLE(DFG_JIT)
-
-namespace JSC { namespace DFG {
-
-class Graph;
-
-// Converts GetButterfly nodes into GetButterflyReadOnly nodes whenever the butterfly is only used for
-// read-only operations.
-bool performCopyBarrierOptimization(Graph&);
-
-} } // namespace JSC::DFG
-
-#endif // ENABLE(DFG_JIT)
-
-#endif // DFGCopyBarrierOptimizationPhase_h
-
</del></span></pre></div>
<a id="tagsSafari60217SourceJavaScriptCoredfgDFGDoesGCcpp"></a>
<div class="modfile"><h4>Modified: tags/Safari-602.1.7/Source/JavaScriptCore/dfg/DFGDoesGC.cpp (191149 => 191150)</h4>
<pre class="diff"><span>
<span class="info">--- tags/Safari-602.1.7/Source/JavaScriptCore/dfg/DFGDoesGC.cpp 2015-10-15 23:38:21 UTC (rev 191149)
+++ tags/Safari-602.1.7/Source/JavaScriptCore/dfg/DFGDoesGC.cpp 2015-10-15 23:41:01 UTC (rev 191150)
</span><span class="lines">@@ -98,7 +98,6 @@
</span><span class="cx"> case CheckStructure:
</span><span class="cx"> case GetExecutable:
</span><span class="cx"> case GetButterfly:
</span><del>- case GetButterflyReadOnly:
</del><span class="cx"> case CheckArray:
</span><span class="cx"> case GetScope:
</span><span class="cx"> case LoadArrowFunctionThis:
</span></span></pre></div>
<a id="tagsSafari60217SourceJavaScriptCoredfgDFGFixupPhasecpp"></a>
<div class="modfile"><h4>Modified: tags/Safari-602.1.7/Source/JavaScriptCore/dfg/DFGFixupPhase.cpp (191149 => 191150)</h4>
<pre class="diff"><span>
<span class="info">--- tags/Safari-602.1.7/Source/JavaScriptCore/dfg/DFGFixupPhase.cpp 2015-10-15 23:38:21 UTC (rev 191149)
+++ tags/Safari-602.1.7/Source/JavaScriptCore/dfg/DFGFixupPhase.cpp 2015-10-15 23:41:01 UTC (rev 191150)
</span><span class="lines">@@ -1065,8 +1065,7 @@
</span><span class="cx"> case CheckCell:
</span><span class="cx"> case CheckHasInstance:
</span><span class="cx"> case CreateThis:
</span><del>- case GetButterfly:
- case GetButterflyReadOnly: {
</del><ins>+ case GetButterfly: {
</ins><span class="cx"> fixEdge<CellUse>(node->child1());
</span><span class="cx"> break;
</span><span class="cx"> }
</span></span></pre></div>
<a id="tagsSafari60217SourceJavaScriptCoredfgDFGHeapLocationcpp"></a>
<div class="modfile"><h4>Modified: tags/Safari-602.1.7/Source/JavaScriptCore/dfg/DFGHeapLocation.cpp (191149 => 191150)</h4>
<pre class="diff"><span>
<span class="info">--- tags/Safari-602.1.7/Source/JavaScriptCore/dfg/DFGHeapLocation.cpp 2015-10-15 23:38:21 UTC (rev 191149)
+++ tags/Safari-602.1.7/Source/JavaScriptCore/dfg/DFGHeapLocation.cpp 2015-10-15 23:41:01 UTC (rev 191150)
</span><span class="lines">@@ -92,10 +92,6 @@
</span><span class="cx"> out.print("ButterflyLoc");
</span><span class="cx"> return;
</span><span class="cx">
</span><del>- case ButterflyReadOnlyLoc:
- out.print("ButterflyReadOnlyLoc");
- return;
-
</del><span class="cx"> case CheckHasInstanceLoc:
</span><span class="cx"> out.print("CheckHasInstanceLoc");
</span><span class="cx"> return;
</span></span></pre></div>
<a id="tagsSafari60217SourceJavaScriptCoredfgDFGHeapLocationh"></a>
<div class="modfile"><h4>Modified: tags/Safari-602.1.7/Source/JavaScriptCore/dfg/DFGHeapLocation.h (191149 => 191150)</h4>
<pre class="diff"><span>
<span class="info">--- tags/Safari-602.1.7/Source/JavaScriptCore/dfg/DFGHeapLocation.h 2015-10-15 23:38:21 UTC (rev 191149)
+++ tags/Safari-602.1.7/Source/JavaScriptCore/dfg/DFGHeapLocation.h 2015-10-15 23:41:01 UTC (rev 191150)
</span><span class="lines">@@ -39,7 +39,6 @@
</span><span class="cx">
</span><span class="cx"> ArrayLengthLoc,
</span><span class="cx"> ButterflyLoc,
</span><del>- ButterflyReadOnlyLoc,
</del><span class="cx"> CheckHasInstanceLoc,
</span><span class="cx"> ClosureVariableLoc,
</span><span class="cx"> DirectArgumentsLoc,
</span></span></pre></div>
<a id="tagsSafari60217SourceJavaScriptCoredfgDFGLICMPhasecpp"></a>
<div class="modfile"><h4>Modified: tags/Safari-602.1.7/Source/JavaScriptCore/dfg/DFGLICMPhase.cpp (191149 => 191150)</h4>
<pre class="diff"><span>
<span class="info">--- tags/Safari-602.1.7/Source/JavaScriptCore/dfg/DFGLICMPhase.cpp 2015-10-15 23:38:21 UTC (rev 191149)
+++ tags/Safari-602.1.7/Source/JavaScriptCore/dfg/DFGLICMPhase.cpp 2015-10-15 23:41:01 UTC (rev 191150)
</span><span class="lines">@@ -73,11 +73,6 @@
</span><span class="cx">
</span><span class="cx"> m_graph.m_dominators.computeIfNecessary(m_graph);
</span><span class="cx"> m_graph.m_naturalLoops.computeIfNecessary(m_graph);
</span><del>-
- if (verbose) {
- dataLog("Graph before LICM:\n");
- m_graph.dump();
- }
</del><span class="cx">
</span><span class="cx"> m_data.resize(m_graph.m_naturalLoops.numLoops());
</span><span class="cx">
</span></span></pre></div>
<a id="tagsSafari60217SourceJavaScriptCoredfgDFGNodeTypeh"></a>
<div class="modfile"><h4>Modified: tags/Safari-602.1.7/Source/JavaScriptCore/dfg/DFGNodeType.h (191149 => 191150)</h4>
<pre class="diff"><span>
<span class="info">--- tags/Safari-602.1.7/Source/JavaScriptCore/dfg/DFGNodeType.h 2015-10-15 23:38:21 UTC (rev 191149)
+++ tags/Safari-602.1.7/Source/JavaScriptCore/dfg/DFGNodeType.h 2015-10-15 23:41:01 UTC (rev 191150)
</span><span class="lines">@@ -187,7 +187,6 @@
</span><span class="cx"> macro(AllocatePropertyStorage, NodeMustGenerate | NodeResultStorage) \
</span><span class="cx"> macro(ReallocatePropertyStorage, NodeMustGenerate | NodeResultStorage) \
</span><span class="cx"> macro(GetButterfly, NodeResultStorage) \
</span><del>- macro(GetButterflyReadOnly, NodeResultStorage) /* A node used to replace GetButterfly at the bitter end of compilation. */\
</del><span class="cx"> macro(CheckArray, NodeMustGenerate) \
</span><span class="cx"> macro(Arrayify, NodeMustGenerate) \
</span><span class="cx"> macro(ArrayifyToStructure, NodeMustGenerate) \
</span></span></pre></div>
<a id="tagsSafari60217SourceJavaScriptCoredfgDFGOperationscpp"></a>
<div class="modfile"><h4>Modified: tags/Safari-602.1.7/Source/JavaScriptCore/dfg/DFGOperations.cpp (191149 => 191150)</h4>
<pre class="diff"><span>
<span class="info">--- tags/Safari-602.1.7/Source/JavaScriptCore/dfg/DFGOperations.cpp 2015-10-15 23:38:21 UTC (rev 191149)
+++ tags/Safari-602.1.7/Source/JavaScriptCore/dfg/DFGOperations.cpp 2015-10-15 23:41:01 UTC (rev 191150)
</span><span class="lines">@@ -643,9 +643,7 @@
</span><span class="cx"> if (UNLIKELY(size < 0))
</span><span class="cx"> return bitwise_cast<char*>(exec->vm().throwException(exec, createRangeError(exec, ASCIILiteral("Array size is not a small enough positive integer."))));
</span><span class="cx">
</span><del>- JSArray* result = JSArray::create(*vm, arrayStructure, size);
- result->butterfly(); // Ensure that the backing store is in to-space.
- return bitwise_cast<char*>(result);
</del><ins>+ return bitwise_cast<char*>(JSArray::create(*vm, arrayStructure, size));
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> char* JIT_OPERATION operationNewArrayBuffer(ExecState* exec, Structure* arrayStructure, size_t start, size_t size)
</span><span class="lines">@@ -1178,24 +1176,6 @@
</span><span class="cx"> return exec->codeBlock()->stringSwitchJumpTable(tableIndex).offsetForValue(string->value(exec).impl(), std::numeric_limits<int32_t>::min());
</span><span class="cx"> }
</span><span class="cx">
</span><del>-char* JIT_OPERATION operationGetButterfly(ExecState* exec, JSCell* cell)
-{
- VM& vm = exec->vm();
- NativeCallFrameTracer tracer(&vm, exec);
-
- dataLog("Ran the barrier.\n");
-
- return bitwise_cast<char*>(jsCast<JSObject*>(cell)->butterfly());
-}
-
-char* JIT_OPERATION operationGetArrayBufferVector(ExecState* exec, JSCell* cell)
-{
- VM& vm = exec->vm();
- NativeCallFrameTracer tracer(&vm, exec);
-
- return bitwise_cast<char*>(jsCast<JSArrayBufferView*>(cell)->vector());
-}
-
</del><span class="cx"> void JIT_OPERATION operationNotifyWrite(ExecState* exec, WatchpointSet* set)
</span><span class="cx"> {
</span><span class="cx"> VM& vm = exec->vm();
</span></span></pre></div>
<a id="tagsSafari60217SourceJavaScriptCoredfgDFGOperationsh"></a>
<div class="modfile"><h4>Modified: tags/Safari-602.1.7/Source/JavaScriptCore/dfg/DFGOperations.h (191149 => 191150)</h4>
<pre class="diff"><span>
<span class="info">--- tags/Safari-602.1.7/Source/JavaScriptCore/dfg/DFGOperations.h 2015-10-15 23:38:21 UTC (rev 191149)
+++ tags/Safari-602.1.7/Source/JavaScriptCore/dfg/DFGOperations.h 2015-10-15 23:41:01 UTC (rev 191150)
</span><span class="lines">@@ -130,8 +130,6 @@
</span><span class="cx"> char* JIT_OPERATION operationFindSwitchImmTargetForDouble(ExecState*, EncodedJSValue, size_t tableIndex);
</span><span class="cx"> char* JIT_OPERATION operationSwitchString(ExecState*, size_t tableIndex, JSString*);
</span><span class="cx"> int32_t JIT_OPERATION operationSwitchStringAndGetBranchOffset(ExecState*, size_t tableIndex, JSString*);
</span><del>-char* JIT_OPERATION operationGetButterfly(ExecState*, JSCell*);
-char* JIT_OPERATION operationGetArrayBufferVector(ExecState*, JSCell*);
</del><span class="cx"> void JIT_OPERATION operationNotifyWrite(ExecState*, WatchpointSet*);
</span><span class="cx"> void JIT_OPERATION operationThrowStackOverflowForVarargs(ExecState*) WTF_INTERNAL;
</span><span class="cx"> int32_t JIT_OPERATION operationSizeOfVarargs(ExecState*, EncodedJSValue arguments, int32_t firstVarArgOffset);
</span></span></pre></div>
<a id="tagsSafari60217SourceJavaScriptCoredfgDFGPlancpp"></a>
<div class="modfile"><h4>Modified: tags/Safari-602.1.7/Source/JavaScriptCore/dfg/DFGPlan.cpp (191149 => 191150)</h4>
<pre class="diff"><span>
<span class="info">--- tags/Safari-602.1.7/Source/JavaScriptCore/dfg/DFGPlan.cpp 2015-10-15 23:38:21 UTC (rev 191149)
+++ tags/Safari-602.1.7/Source/JavaScriptCore/dfg/DFGPlan.cpp 2015-10-15 23:41:01 UTC (rev 191150)
</span><span class="lines">@@ -38,7 +38,6 @@
</span><span class="cx"> #include "DFGCleanUpPhase.h"
</span><span class="cx"> #include "DFGConstantFoldingPhase.h"
</span><span class="cx"> #include "DFGConstantHoistingPhase.h"
</span><del>-#include "DFGCopyBarrierOptimizationPhase.h"
</del><span class="cx"> #include "DFGCriticalEdgeBreakingPhase.h"
</span><span class="cx"> #include "DFGDCEPhase.h"
</span><span class="cx"> #include "DFGFailedFinalizer.h"
</span><span class="lines">@@ -359,8 +358,6 @@
</span><span class="cx"> performCleanUp(dfg);
</span><span class="cx"> performCPSRethreading(dfg);
</span><span class="cx"> performDCE(dfg);
</span><del>- if (Options::enableCopyBarrierOptimization())
- performCopyBarrierOptimization(dfg);
</del><span class="cx"> performPhantomInsertion(dfg);
</span><span class="cx"> performStackLayout(dfg);
</span><span class="cx"> performVirtualRegisterAllocation(dfg);
</span><span class="lines">@@ -440,8 +437,6 @@
</span><span class="cx"> performMovHintRemoval(dfg);
</span><span class="cx"> performCleanUp(dfg);
</span><span class="cx"> performDCE(dfg); // We rely on this to kill dead code that won't be recognized as dead by LLVM.
</span><del>- if (Options::enableCopyBarrierOptimization())
- performCopyBarrierOptimization(dfg);
</del><span class="cx"> performStackLayout(dfg);
</span><span class="cx"> performLivenessAnalysis(dfg);
</span><span class="cx"> performOSRAvailabilityAnalysis(dfg);
</span></span></pre></div>
<a id="tagsSafari60217SourceJavaScriptCoredfgDFGPredictionPropagationPhasecpp"></a>
<div class="modfile"><h4>Modified: tags/Safari-602.1.7/Source/JavaScriptCore/dfg/DFGPredictionPropagationPhase.cpp (191149 => 191150)</h4>
<pre class="diff"><span>
<span class="info">--- tags/Safari-602.1.7/Source/JavaScriptCore/dfg/DFGPredictionPropagationPhase.cpp 2015-10-15 23:38:21 UTC (rev 191149)
+++ tags/Safari-602.1.7/Source/JavaScriptCore/dfg/DFGPredictionPropagationPhase.cpp 2015-10-15 23:41:01 UTC (rev 191150)
</span><span class="lines">@@ -442,8 +442,7 @@
</span><span class="cx"> break;
</span><span class="cx"> }
</span><span class="cx">
</span><del>- case GetButterfly:
- case GetButterflyReadOnly:
</del><ins>+ case GetButterfly:
</ins><span class="cx"> case GetIndexedPropertyStorage:
</span><span class="cx"> case AllocatePropertyStorage:
</span><span class="cx"> case ReallocatePropertyStorage: {
</span></span></pre></div>
<a id="tagsSafari60217SourceJavaScriptCoredfgDFGSafeToExecuteh"></a>
<div class="modfile"><h4>Modified: tags/Safari-602.1.7/Source/JavaScriptCore/dfg/DFGSafeToExecute.h (191149 => 191150)</h4>
<pre class="diff"><span>
<span class="info">--- tags/Safari-602.1.7/Source/JavaScriptCore/dfg/DFGSafeToExecute.h 2015-10-15 23:38:21 UTC (rev 191149)
+++ tags/Safari-602.1.7/Source/JavaScriptCore/dfg/DFGSafeToExecute.h 2015-10-15 23:41:01 UTC (rev 191150)
</span><span class="lines">@@ -191,7 +191,6 @@
</span><span class="cx"> case CheckStructure:
</span><span class="cx"> case GetExecutable:
</span><span class="cx"> case GetButterfly:
</span><del>- case GetButterflyReadOnly:
</del><span class="cx"> case CheckArray:
</span><span class="cx"> case Arrayify:
</span><span class="cx"> case ArrayifyToStructure:
</span></span></pre></div>
<a id="tagsSafari60217SourceJavaScriptCoredfgDFGSpeculativeJITcpp"></a>
<div class="modfile"><h4>Modified: tags/Safari-602.1.7/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp (191149 => 191150)</h4>
<pre class="diff"><span>
<span class="info">--- tags/Safari-602.1.7/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp 2015-10-15 23:38:21 UTC (rev 191149)
+++ tags/Safari-602.1.7/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp 2015-10-15 23:41:01 UTC (rev 191150)
</span><span class="lines">@@ -4388,11 +4388,6 @@
</span><span class="cx"> m_jit.loadPtr(
</span><span class="cx"> MacroAssembler::Address(baseReg, JSArrayBufferView::offsetOfVector()),
</span><span class="cx"> storageReg);
</span><del>-
- addSlowPathGenerator(
- slowPathCall(
- m_jit.branchIfNotToSpace(storageReg),
- this, operationGetArrayBufferVector, storageReg, baseReg));
</del><span class="cx"> break;
</span><span class="cx"> }
</span><span class="cx">
</span><span class="lines">@@ -4413,11 +4408,9 @@
</span><span class="cx"> MacroAssembler::NotEqual,
</span><span class="cx"> MacroAssembler::Address(baseGPR, JSArrayBufferView::offsetOfMode()),
</span><span class="cx"> TrustedImm32(WastefulTypedArray));
</span><del>-
</del><ins>+
</ins><span class="cx"> m_jit.loadPtr(MacroAssembler::Address(baseGPR, JSObject::butterflyOffset()), dataGPR);
</span><del>- m_jit.removeSpaceBits(dataGPR);
</del><span class="cx"> m_jit.loadPtr(MacroAssembler::Address(baseGPR, JSArrayBufferView::offsetOfVector()), vectorGPR);
</span><del>- m_jit.removeSpaceBits(vectorGPR);
</del><span class="cx"> m_jit.loadPtr(MacroAssembler::Address(dataGPR, Butterfly::offsetOfArrayBuffer()), dataGPR);
</span><span class="cx"> m_jit.loadPtr(MacroAssembler::Address(dataGPR, ArrayBuffer::offsetOfData()), dataGPR);
</span><span class="cx"> m_jit.subPtr(dataGPR, vectorGPR);
</span><span class="lines">@@ -4428,7 +4421,7 @@
</span><span class="cx"> m_jit.move(TrustedImmPtr(0), vectorGPR);
</span><span class="cx">
</span><span class="cx"> done.link(&m_jit);
</span><del>-
</del><ins>+
</ins><span class="cx"> int32Result(vectorGPR, node);
</span><span class="cx"> }
</span><span class="cx">
</span><span class="lines">@@ -5496,36 +5489,6 @@
</span><span class="cx"> storageResult(scratchGPR1, node);
</span><span class="cx"> }
</span><span class="cx">
</span><del>-void SpeculativeJIT::compileGetButterfly(Node* node)
-{
- SpeculateCellOperand base(this, node->child1());
- GPRTemporary result(this, Reuse, base);
-
- GPRReg baseGPR = base.gpr();
- GPRReg resultGPR = result.gpr();
-
- m_jit.loadPtr(JITCompiler::Address(baseGPR, JSObject::butterflyOffset()), resultGPR);
-
- switch (node->op()) {
- case GetButterfly:
- addSlowPathGenerator(
- slowPathCall(
- m_jit.branchIfNotToSpace(resultGPR),
- this, operationGetButterfly, resultGPR, baseGPR));
- break;
-
- case GetButterflyReadOnly:
- m_jit.removeSpaceBits(resultGPR);
- break;
-
- default:
- DFG_CRASH(m_jit.graph(), node, "Bad node type");
- break;
- }
-
- storageResult(resultGPR, node);
-}
-
</del><span class="cx"> GPRReg SpeculativeJIT::temporaryRegisterForPutByVal(GPRTemporary& temporary, ArrayMode arrayMode)
</span><span class="cx"> {
</span><span class="cx"> if (!putByValWillNeedExtraRegister(arrayMode))
</span></span></pre></div>
<a id="tagsSafari60217SourceJavaScriptCoredfgDFGSpeculativeJITh"></a>
<div class="modfile"><h4>Modified: tags/Safari-602.1.7/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h (191149 => 191150)</h4>
<pre class="diff"><span>
<span class="info">--- tags/Safari-602.1.7/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h 2015-10-15 23:38:21 UTC (rev 191149)
+++ tags/Safari-602.1.7/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h 2015-10-15 23:41:01 UTC (rev 191150)
</span><span class="lines">@@ -2147,7 +2147,6 @@
</span><span class="cx">
</span><span class="cx"> void compileAllocatePropertyStorage(Node*);
</span><span class="cx"> void compileReallocatePropertyStorage(Node*);
</span><del>- void compileGetButterfly(Node*);
</del><span class="cx">
</span><span class="cx"> #if USE(JSVALUE32_64)
</span><span class="cx"> template<typename BaseOperandType, typename PropertyOperandType, typename ValueOperandType, typename TagType>
</span></span></pre></div>
<a id="tagsSafari60217SourceJavaScriptCoredfgDFGSpeculativeJIT32_64cpp"></a>
<div class="modfile"><h4>Modified: tags/Safari-602.1.7/Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp (191149 => 191150)</h4>
<pre class="diff"><span>
<span class="info">--- tags/Safari-602.1.7/Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp 2015-10-15 23:38:21 UTC (rev 191149)
+++ tags/Safari-602.1.7/Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp 2015-10-15 23:41:01 UTC (rev 191150)
</span><span class="lines">@@ -4023,10 +4023,18 @@
</span><span class="cx"> compileReallocatePropertyStorage(node);
</span><span class="cx"> break;
</span><span class="cx">
</span><del>- case GetButterfly:
- case GetButterflyReadOnly:
- compileGetButterfly(node);
</del><ins>+ case GetButterfly: {
+ SpeculateCellOperand base(this, node->child1());
+ GPRTemporary result(this, Reuse, base);
+
+ GPRReg baseGPR = base.gpr();
+ GPRReg resultGPR = result.gpr();
+
+ m_jit.loadPtr(JITCompiler::Address(baseGPR, JSObject::butterflyOffset()), resultGPR);
+
+ storageResult(resultGPR, node);
</ins><span class="cx"> break;
</span><ins>+ }
</ins><span class="cx">
</span><span class="cx"> case GetIndexedPropertyStorage: {
</span><span class="cx"> compileGetIndexedPropertyStorage(node);
</span><span class="lines">@@ -4615,16 +4623,10 @@
</span><span class="cx"> GPRReg indexGPR = index.gpr();
</span><span class="cx"> GPRReg enumeratorGPR = enumerator.gpr();
</span><span class="cx">
</span><del>- MacroAssembler::JumpList slowPath;
-
</del><span class="cx"> // Check the structure
</span><span class="cx"> m_jit.load32(MacroAssembler::Address(baseGPR, JSCell::structureIDOffset()), scratchGPR);
</span><del>- slowPath.append(
- m_jit.branch32(
- MacroAssembler::NotEqual,
- scratchGPR,
- MacroAssembler::Address(
- enumeratorGPR, JSPropertyNameEnumerator::cachedStructureIDOffset())));
</del><ins>+ MacroAssembler::Jump wrongStructure = m_jit.branch32(MacroAssembler::NotEqual,
+ scratchGPR, MacroAssembler::Address(enumeratorGPR, JSPropertyNameEnumerator::cachedStructureIDOffset()));
</ins><span class="cx">
</span><span class="cx"> // Compute the offset
</span><span class="cx"> // If index is less than the enumerator's cached inline storage, then it's an inline access
</span><span class="lines">@@ -4646,15 +4648,14 @@
</span><span class="cx"> m_jit.signExtend32ToPtr(scratchGPR, scratchGPR);
</span><span class="cx"> // We use resultPayloadGPR as a temporary here. We have to make sure clobber it after getting the
</span><span class="cx"> // value out of indexGPR and enumeratorGPR because resultPayloadGPR could reuse either of those registers.
</span><del>- m_jit.loadPtr(MacroAssembler::Address(baseGPR, JSObject::butterflyOffset()), resultPayloadGPR);
- slowPath.append(m_jit.branchIfNotToSpace(resultPayloadGPR));
</del><ins>+ m_jit.loadPtr(MacroAssembler::Address(baseGPR, JSObject::butterflyOffset()), resultPayloadGPR);
</ins><span class="cx"> int32_t offsetOfFirstProperty = static_cast<int32_t>(offsetInButterfly(firstOutOfLineOffset)) * sizeof(EncodedJSValue);
</span><span class="cx"> m_jit.load32(MacroAssembler::BaseIndex(resultPayloadGPR, scratchGPR, MacroAssembler::TimesEight, offsetOfFirstProperty + OBJECT_OFFSETOF(JSValue, u.asBits.tag)), resultTagGPR);
</span><span class="cx"> m_jit.load32(MacroAssembler::BaseIndex(resultPayloadGPR, scratchGPR, MacroAssembler::TimesEight, offsetOfFirstProperty + OBJECT_OFFSETOF(JSValue, u.asBits.payload)), resultPayloadGPR);
</span><span class="cx">
</span><span class="cx"> done.link(&m_jit);
</span><span class="cx">
</span><del>- addSlowPathGenerator(slowPathCall(slowPath, this, operationGetByValCell, resultTagGPR, resultPayloadGPR, baseGPR, propertyGPR));
</del><ins>+ addSlowPathGenerator(slowPathCall(wrongStructure, this, operationGetByValCell, resultTagGPR, resultPayloadGPR, baseGPR, propertyGPR));
</ins><span class="cx"> #endif
</span><span class="cx">
</span><span class="cx"> jsValueResult(resultTagGPR, resultPayloadGPR, node);
</span></span></pre></div>
<a id="tagsSafari60217SourceJavaScriptCoredfgDFGSpeculativeJIT64cpp"></a>
<div class="modfile"><h4>Modified: tags/Safari-602.1.7/Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp (191149 => 191150)</h4>
<pre class="diff"><span>
<span class="info">--- tags/Safari-602.1.7/Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp 2015-10-15 23:38:21 UTC (rev 191149)
+++ tags/Safari-602.1.7/Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp 2015-10-15 23:41:01 UTC (rev 191150)
</span><span class="lines">@@ -4037,10 +4037,18 @@
</span><span class="cx"> compileReallocatePropertyStorage(node);
</span><span class="cx"> break;
</span><span class="cx">
</span><del>- case GetButterfly:
- case GetButterflyReadOnly:
- compileGetButterfly(node);
</del><ins>+ case GetButterfly: {
+ SpeculateCellOperand base(this, node->child1());
+ GPRTemporary result(this, Reuse, base);
+
+ GPRReg baseGPR = base.gpr();
+ GPRReg resultGPR = result.gpr();
+
+ m_jit.loadPtr(JITCompiler::Address(baseGPR, JSObject::butterflyOffset()), resultGPR);
+
+ storageResult(resultGPR, node);
</ins><span class="cx"> break;
</span><ins>+ }
</ins><span class="cx">
</span><span class="cx"> case GetIndexedPropertyStorage: {
</span><span class="cx"> compileGetIndexedPropertyStorage(node);
</span><span class="lines">@@ -4636,16 +4644,10 @@
</span><span class="cx"> GPRReg scratch1GPR = scratch1.gpr();
</span><span class="cx"> GPRReg scratch2GPR = scratch2.gpr();
</span><span class="cx">
</span><del>- MacroAssembler::JumpList slowPath;
-
</del><span class="cx"> // Check the structure
</span><span class="cx"> m_jit.load32(MacroAssembler::Address(baseGPR, JSCell::structureIDOffset()), scratch1GPR);
</span><del>- slowPath.append(
- m_jit.branch32(
- MacroAssembler::NotEqual,
- scratch1GPR,
- MacroAssembler::Address(
- enumeratorGPR, JSPropertyNameEnumerator::cachedStructureIDOffset())));
</del><ins>+ MacroAssembler::Jump wrongStructure = m_jit.branch32(MacroAssembler::NotEqual,
+ scratch1GPR, MacroAssembler::Address(enumeratorGPR, JSPropertyNameEnumerator::cachedStructureIDOffset()));
</ins><span class="cx">
</span><span class="cx"> // Compute the offset
</span><span class="cx"> // If index is less than the enumerator's cached inline storage, then it's an inline access
</span><span class="lines">@@ -4659,7 +4661,6 @@
</span><span class="cx"> // Otherwise it's out of line
</span><span class="cx"> outOfLineAccess.link(&m_jit);
</span><span class="cx"> m_jit.loadPtr(MacroAssembler::Address(baseGPR, JSObject::butterflyOffset()), scratch2GPR);
</span><del>- slowPath.append(m_jit.branchIfNotToSpace(scratch2GPR));
</del><span class="cx"> m_jit.move(indexGPR, scratch1GPR);
</span><span class="cx"> m_jit.sub32(MacroAssembler::Address(enumeratorGPR, JSPropertyNameEnumerator::cachedInlineCapacityOffset()), scratch1GPR);
</span><span class="cx"> m_jit.neg32(scratch1GPR);
</span><span class="lines">@@ -4669,7 +4670,7 @@
</span><span class="cx">
</span><span class="cx"> done.link(&m_jit);
</span><span class="cx">
</span><del>- addSlowPathGenerator(slowPathCall(slowPath, this, operationGetByVal, resultGPR, baseGPR, propertyGPR));
</del><ins>+ addSlowPathGenerator(slowPathCall(wrongStructure, this, operationGetByVal, resultGPR, baseGPR, propertyGPR));
</ins><span class="cx">
</span><span class="cx"> jsValueResult(resultGPR, node);
</span><span class="cx"> break;
</span></span></pre></div>
<a id="tagsSafari60217SourceJavaScriptCoredfgDFGTypeCheckHoistingPhasecpp"></a>
<div class="modfile"><h4>Modified: tags/Safari-602.1.7/Source/JavaScriptCore/dfg/DFGTypeCheckHoistingPhase.cpp (191149 => 191150)</h4>
<pre class="diff"><span>
<span class="info">--- tags/Safari-602.1.7/Source/JavaScriptCore/dfg/DFGTypeCheckHoistingPhase.cpp 2015-10-15 23:38:21 UTC (rev 191149)
+++ tags/Safari-602.1.7/Source/JavaScriptCore/dfg/DFGTypeCheckHoistingPhase.cpp 2015-10-15 23:41:01 UTC (rev 191150)
</span><span class="lines">@@ -247,7 +247,6 @@
</span><span class="cx"> case AllocatePropertyStorage:
</span><span class="cx"> case ReallocatePropertyStorage:
</span><span class="cx"> case GetButterfly:
</span><del>- case GetButterflyReadOnly:
</del><span class="cx"> case GetByVal:
</span><span class="cx"> case PutByValDirect:
</span><span class="cx"> case PutByVal:
</span><span class="lines">@@ -326,7 +325,6 @@
</span><span class="cx"> case PutStructure:
</span><span class="cx"> case ReallocatePropertyStorage:
</span><span class="cx"> case GetButterfly:
</span><del>- case GetButterflyReadOnly:
</del><span class="cx"> case GetByVal:
</span><span class="cx"> case PutByValDirect:
</span><span class="cx"> case PutByVal:
</span></span></pre></div>
<a id="tagsSafari60217SourceJavaScriptCoreftlFTLCapabilitiescpp"></a>
<div class="modfile"><h4>Modified: tags/Safari-602.1.7/Source/JavaScriptCore/ftl/FTLCapabilities.cpp (191149 => 191150)</h4>
<pre class="diff"><span>
<span class="info">--- tags/Safari-602.1.7/Source/JavaScriptCore/ftl/FTLCapabilities.cpp 2015-10-15 23:38:21 UTC (rev 191149)
+++ tags/Safari-602.1.7/Source/JavaScriptCore/ftl/FTLCapabilities.cpp 2015-10-15 23:41:01 UTC (rev 191150)
</span><span class="lines">@@ -68,7 +68,6 @@
</span><span class="cx"> case ArrayifyToStructure:
</span><span class="cx"> case PutStructure:
</span><span class="cx"> case GetButterfly:
</span><del>- case GetButterflyReadOnly:
</del><span class="cx"> case NewObject:
</span><span class="cx"> case NewArray:
</span><span class="cx"> case NewArrayBuffer:
</span></span></pre></div>
<a id="tagsSafari60217SourceJavaScriptCoreftlFTLLowerDFGToLLVMcpp"></a>
<div class="modfile"><h4>Modified: tags/Safari-602.1.7/Source/JavaScriptCore/ftl/FTLLowerDFGToLLVM.cpp (191149 => 191150)</h4>
<pre class="diff"><span>
<span class="info">--- tags/Safari-602.1.7/Source/JavaScriptCore/ftl/FTLLowerDFGToLLVM.cpp 2015-10-15 23:38:21 UTC (rev 191149)
+++ tags/Safari-602.1.7/Source/JavaScriptCore/ftl/FTLLowerDFGToLLVM.cpp 2015-10-15 23:41:01 UTC (rev 191150)
</span><span class="lines">@@ -566,9 +566,6 @@
</span><span class="cx"> case GetButterfly:
</span><span class="cx"> compileGetButterfly();
</span><span class="cx"> break;
</span><del>- case GetButterflyReadOnly:
- compileGetButterflyReadOnly();
- break;
</del><span class="cx"> case ConstantStoragePointer:
</span><span class="cx"> compileConstantStoragePointer();
</span><span class="cx"> break;
</span><span class="lines">@@ -2285,13 +2282,8 @@
</span><span class="cx">
</span><span class="cx"> void compileGetButterfly()
</span><span class="cx"> {
</span><del>- setStorage(loadButterflyWithBarrier(lowCell(m_node->child1())));
</del><ins>+ setStorage(m_out.loadPtr(lowCell(m_node->child1()), m_heaps.JSObject_butterfly));
</ins><span class="cx"> }
</span><del>-
- void compileGetButterflyReadOnly()
- {
- setStorage(loadButterflyReadOnly(lowCell(m_node->child1())));
- }
</del><span class="cx">
</span><span class="cx"> void compileConstantStoragePointer()
</span><span class="cx"> {
</span><span class="lines">@@ -2325,7 +2317,7 @@
</span><span class="cx"> return;
</span><span class="cx"> }
</span><span class="cx">
</span><del>- setStorage(loadVectorWithBarrier(cell));
</del><ins>+ setStorage(m_out.loadPtr(cell, m_heaps.JSArrayBufferView_vector));
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> void compileCheckArray()
</span><span class="lines">@@ -2345,25 +2337,27 @@
</span><span class="cx"> {
</span><span class="cx"> LValue basePtr = lowCell(m_node->child1());
</span><span class="cx">
</span><del>- LBasicBlock simpleCase = FTL_NEW_BLOCK(m_out, ("GetTypedArrayByteOffset wasteless typed array"));
- LBasicBlock wastefulCase = FTL_NEW_BLOCK(m_out, ("GetTypedArrayByteOffset wasteful typed array"));
- LBasicBlock continuation = FTL_NEW_BLOCK(m_out, ("GetTypedArrayByteOffset continuation"));
</del><ins>+ LBasicBlock simpleCase = FTL_NEW_BLOCK(m_out, ("wasteless typed array"));
+ LBasicBlock wastefulCase = FTL_NEW_BLOCK(m_out, ("wasteful typed array"));
+ LBasicBlock continuation = FTL_NEW_BLOCK(m_out, ("continuation branch"));
</ins><span class="cx">
</span><span class="cx"> LValue mode = m_out.load32(basePtr, m_heaps.JSArrayBufferView_mode);
</span><span class="cx"> m_out.branch(
</span><span class="cx"> m_out.notEqual(mode, m_out.constInt32(WastefulTypedArray)),
</span><span class="cx"> unsure(simpleCase), unsure(wastefulCase));
</span><span class="cx">
</span><ins>+ // begin simple case
</ins><span class="cx"> LBasicBlock lastNext = m_out.appendTo(simpleCase, wastefulCase);
</span><span class="cx">
</span><span class="cx"> ValueFromBlock simpleOut = m_out.anchor(m_out.constIntPtr(0));
</span><span class="cx">
</span><span class="cx"> m_out.jump(continuation);
</span><span class="cx">
</span><ins>+ // begin wasteful case
</ins><span class="cx"> m_out.appendTo(wastefulCase, continuation);
</span><span class="cx">
</span><del>- LValue vectorPtr = loadVectorReadOnly(basePtr);
- LValue butterflyPtr = loadButterflyReadOnly(basePtr);
</del><ins>+ LValue vectorPtr = m_out.loadPtr(basePtr, m_heaps.JSArrayBufferView_vector);
+ LValue butterflyPtr = m_out.loadPtr(basePtr, m_heaps.JSObject_butterfly);
</ins><span class="cx"> LValue arrayBufferPtr = m_out.loadPtr(butterflyPtr, m_heaps.Butterfly_arrayBuffer);
</span><span class="cx"> LValue dataPtr = m_out.loadPtr(arrayBufferPtr, m_heaps.ArrayBuffer_data);
</span><span class="cx">
</span><span class="lines">@@ -2372,6 +2366,7 @@
</span><span class="cx"> m_out.jump(continuation);
</span><span class="cx"> m_out.appendTo(continuation, lastNext);
</span><span class="cx">
</span><ins>+ // output
</ins><span class="cx"> setInt32(m_out.castToInt32(m_out.phi(m_out.intPtr, simpleOut, wastefulOut)));
</span><span class="cx"> }
</span><span class="cx">
</span><span class="lines">@@ -4055,7 +4050,7 @@
</span><span class="cx"> else
</span><span class="cx"> propertyBase = weakPointer(method.prototype()->value().asCell());
</span><span class="cx"> if (!isInlineOffset(method.offset()))
</span><del>- propertyBase = loadButterflyReadOnly(propertyBase);
</del><ins>+ propertyBase = m_out.loadPtr(propertyBase, m_heaps.JSObject_butterfly);
</ins><span class="cx"> result = loadProperty(
</span><span class="cx"> propertyBase, data.identifierNumber, method.offset());
</span><span class="cx"> break;
</span><span class="lines">@@ -4123,7 +4118,7 @@
</span><span class="cx"> if (isInlineOffset(variant.offset()))
</span><span class="cx"> storage = base;
</span><span class="cx"> else
</span><del>- storage = loadButterflyWithBarrier(base);
</del><ins>+ storage = m_out.loadPtr(base, m_heaps.JSObject_butterfly);
</ins><span class="cx"> } else {
</span><span class="cx"> m_graph.m_plan.transitions.addLazily(
</span><span class="cx"> codeBlock(), m_node->origin.semantic.codeOriginOwner(),
</span><span class="lines">@@ -5357,7 +5352,7 @@
</span><span class="cx"> m_out.jump(continuation);
</span><span class="cx">
</span><span class="cx"> m_out.appendTo(outOfLineLoad, slowCase);
</span><del>- LValue storage = loadButterflyReadOnly(base);
</del><ins>+ LValue storage = m_out.loadPtr(base, m_heaps.JSObject_butterfly);
</ins><span class="cx"> LValue realIndex = m_out.signExt(
</span><span class="cx"> m_out.neg(m_out.sub(index, m_out.load32(enumerator, m_heaps.JSPropertyNameEnumerator_cachedInlineCapacity))),
</span><span class="cx"> m_out.int64);
</span><span class="lines">@@ -6009,14 +6004,14 @@
</span><span class="cx"> return object;
</span><span class="cx">
</span><span class="cx"> if (previousStructure->outOfLineCapacity() == nextStructure->outOfLineCapacity())
</span><del>- return loadButterflyWithBarrier(object);
</del><ins>+ return m_out.loadPtr(object, m_heaps.JSObject_butterfly);
</ins><span class="cx">
</span><span class="cx"> LValue result;
</span><span class="cx"> if (!previousStructure->outOfLineCapacity())
</span><span class="cx"> result = allocatePropertyStorage(object, previousStructure);
</span><span class="cx"> else {
</span><span class="cx"> result = reallocatePropertyStorage(
</span><del>- object, loadButterflyWithBarrier(object),
</del><ins>+ object, m_out.loadPtr(object, m_heaps.JSObject_butterfly),
</ins><span class="cx"> previousStructure, nextStructure);
</span><span class="cx"> }
</span><span class="cx">
</span><span class="lines">@@ -6130,60 +6125,7 @@
</span><span class="cx">
</span><span class="cx"> return call;
</span><span class="cx"> }
</span><del>-
- LValue loadButterflyWithBarrier(LValue object)
- {
- return copyBarrier(
- object, m_out.loadPtr(object, m_heaps.JSObject_butterfly), operationGetButterfly);
- }
</del><span class="cx">
</span><del>- LValue loadVectorWithBarrier(LValue object)
- {
- return copyBarrier(
- object, m_out.loadPtr(object, m_heaps.JSArrayBufferView_vector),
- operationGetArrayBufferVector);
- }
-
- LValue copyBarrier(LValue object, LValue pointer, P_JITOperation_EC slowPathFunction)
- {
- LBasicBlock slowPath = FTL_NEW_BLOCK(m_out, ("loadButterflyWithBarrier slow path"));
- LBasicBlock continuation = FTL_NEW_BLOCK(m_out, ("loadButterflyWithBarrier continuation"));
-
- ValueFromBlock fastResult = m_out.anchor(pointer);
- m_out.branch(
- m_out.testIsZeroPtr(pointer, m_out.constIntPtr(CopyBarrierBase::spaceBits)),
- usually(continuation), rarely(slowPath));
-
- LBasicBlock lastNext = m_out.appendTo(slowPath, continuation);
-
- LValue call = lazySlowPath(
- [=] (const Vector<Location>& locations) -> RefPtr<LazySlowPath::Generator> {
- return createLazyCallGenerator(
- slowPathFunction, locations[0].directGPR(), locations[1].directGPR());
- }, object);
- ValueFromBlock slowResult = m_out.anchor(call);
- m_out.jump(continuation);
-
- m_out.appendTo(continuation, lastNext);
- return m_out.phi(m_out.intPtr, fastResult, slowResult);
- }
-
- LValue loadButterflyReadOnly(LValue object)
- {
- return removeSpaceBits(m_out.loadPtr(object, m_heaps.JSObject_butterfly));
- }
-
- LValue loadVectorReadOnly(LValue object)
- {
- return removeSpaceBits(m_out.loadPtr(object, m_heaps.JSArrayBufferView_vector));
- }
-
- LValue removeSpaceBits(LValue storage)
- {
- return m_out.bitAnd(
- storage, m_out.constIntPtr(~static_cast<intptr_t>(CopyBarrierBase::spaceBits)));
- }
-
</del><span class="cx"> TypedPointer baseIndex(IndexedAbstractHeap& heap, LValue storage, LValue index, Edge edge, ptrdiff_t offset = 0)
</span><span class="cx"> {
</span><span class="cx"> return m_out.baseIndex(
</span></span></pre></div>
<a id="tagsSafari60217SourceJavaScriptCoreftlFTLOperationscpp"></a>
<div class="modfile"><h4>Modified: tags/Safari-602.1.7/Source/JavaScriptCore/ftl/FTLOperations.cpp (191149 => 191150)</h4>
<pre class="diff"><span>
<span class="info">--- tags/Safari-602.1.7/Source/JavaScriptCore/ftl/FTLOperations.cpp 2015-10-15 23:38:21 UTC (rev 191149)
+++ tags/Safari-602.1.7/Source/JavaScriptCore/ftl/FTLOperations.cpp 2015-10-15 23:41:01 UTC (rev 191150)
</span><span class="lines">@@ -48,9 +48,7 @@
</span><span class="cx"> Butterfly* butterfly = Butterfly::create(
</span><span class="cx"> vm, nullptr, 0, structure->outOfLineCapacity(), false, IndexingHeader(), 0);
</span><span class="cx">
</span><del>- JSObject* result = JSFinalObject::create(exec, structure, butterfly);
- result->butterfly(); // Ensure that the butterfly is in to-space.
- return result;
</del><ins>+ return JSFinalObject::create(exec, structure, butterfly);
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> extern "C" void JIT_OPERATION operationPopulateObjectInOSR(
</span></span></pre></div>
<a id="tagsSafari60217SourceJavaScriptCoreftlFTLOutputh"></a>
<div class="modfile"><h4>Modified: tags/Safari-602.1.7/Source/JavaScriptCore/ftl/FTLOutput.h (191149 => 191150)</h4>
<pre class="diff"><span>
<span class="info">--- tags/Safari-602.1.7/Source/JavaScriptCore/ftl/FTLOutput.h 2015-10-15 23:38:21 UTC (rev 191149)
+++ tags/Safari-602.1.7/Source/JavaScriptCore/ftl/FTLOutput.h 2015-10-15 23:41:01 UTC (rev 191150)
</span><span class="lines">@@ -362,8 +362,6 @@
</span><span class="cx"> LValue testNonZero32(LValue value, LValue mask) { return notZero32(bitAnd(value, mask)); }
</span><span class="cx"> LValue testIsZero64(LValue value, LValue mask) { return isZero64(bitAnd(value, mask)); }
</span><span class="cx"> LValue testNonZero64(LValue value, LValue mask) { return notZero64(bitAnd(value, mask)); }
</span><del>- LValue testIsZeroPtr(LValue value, LValue mask) { return isNull(bitAnd(value, mask)); }
- LValue testNonZeroPtr(LValue value, LValue mask) { return notNull(bitAnd(value, mask)); }
</del><span class="cx">
</span><span class="cx"> LValue select(LValue value, LValue taken, LValue notTaken) { return buildSelect(m_builder, value, taken, notTaken); }
</span><span class="cx"> LValue extractValue(LValue aggVal, unsigned index) { return buildExtractValue(m_builder, aggVal, index); }
</span></span></pre></div>
<a id="tagsSafari60217SourceJavaScriptCoreheapCopyBarrierh"></a>
<div class="delfile"><h4>Deleted: tags/Safari-602.1.7/Source/JavaScriptCore/heap/CopyBarrier.h (191149 => 191150)</h4>
<pre class="diff"><span>
<span class="info">--- tags/Safari-602.1.7/Source/JavaScriptCore/heap/CopyBarrier.h 2015-10-15 23:38:21 UTC (rev 191149)
+++ tags/Safari-602.1.7/Source/JavaScriptCore/heap/CopyBarrier.h 2015-10-15 23:41:01 UTC (rev 191150)
</span><span class="lines">@@ -1,181 +0,0 @@
</span><del>-/*
- * Copyright (C) 2014 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- * notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- * notice, this list of conditions and the following disclaimer in the
- * documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
- * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
- * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
- * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
- * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
- * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
- * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
- * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
- * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
- * THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#ifndef CopyBarrier_h
-#define CopyBarrier_h
-
-#include "Heap.h"
-
-namespace JSC {
-
-enum class CopyState {
- // The backing store is not planned to get copied in this epoch. If you keep a pointer to the backing
- // store on the stack, it will not get copied. If you don't keep it on the stack, it may get copied
- // starting at the next handshake (that is, it may transition from ToSpace to CopyPlanned, but
- // CopyPlanned means ToSpace prior to the handshake that starts the copy phase).
- ToSpace,
-
- // The marking phase has selected this backing store to be copied. If we are not yet in the copying
- // phase, this backing store is still in to-space. All that is needed in such a case is to mask off the
- // low bits. If we are in the copying phase, this means that the object points to from-space. The
- // barrier should first copy the object - or wait for copying to finish - before using the object.
- CopyPlanned,
-
- // The object is being copied right now. Anyone wanting to use the object must wait for the object to
- // finish being copied. Notifications about copying use the ParkingLot combined with these bits. If the
- // state is CopyingAndWaiting, then when the copying finishes, whatever thread was doing it will
- // unparkAll() on the address of the CopyBarrierBase. So, to wait for copying to finish, CAS this to
- // CopyingAndWaiting and then parkConditionally on the barrier address.
- Copying,
-
- // The object is being copied right now, and there are one or more threads parked. Those threads want
- // to be unparked when copying is done. So, whichever thread does the copying needs to call unparkAll()
- // on the barrier address after copying is done.
- CopyingAndWaiting
-};
-
-class CopyBarrierBase {
-public:
- static const unsigned spaceBits = 3;
-
- CopyBarrierBase()
- : m_value(nullptr)
- {
- }
-
- bool operator!() const { return !m_value; }
-
- explicit operator bool() const { return m_value; }
-
- void* getWithoutBarrier() const
- {
- return m_value;
- }
-
- // When we are in the concurrent copying phase, this method may lock the barrier object (i.e. the field
- // pointing to copied space) and call directly into the owning object's copyBackingStore() method.
- void* get(const JSCell* owner) const
- {
- void* result = m_value;
- if (UNLIKELY(bitwise_cast<uintptr_t>(result) & spaceBits))
- return Heap::copyBarrier(owner, m_value);
- return result;
- }
-
- CopyState copyState() const
- {
- return static_cast<CopyState>(bitwise_cast<uintptr_t>(m_value) & spaceBits);
- }
-
- // This only works when you know that there is nobody else concurrently messing with this CopyBarrier.
- // That's hard to guarantee, though there are a few unusual places where this ends up being safe.
- // Usually you want to use CopyBarrier::weakCAS().
- void setCopyState(CopyState copyState)
- {
- WTF::storeStoreFence();
- uintptr_t value = bitwise_cast<uintptr_t>(m_value);
- value &= ~static_cast<uintptr_t>(spaceBits);
- value |= static_cast<uintptr_t>(copyState);
- m_value = bitwise_cast<void*>(value);
- }
-
- void clear() { m_value = nullptr; }
-
-protected:
- CopyBarrierBase(VM& vm, const JSCell* owner, void* value)
- {
- this->set(vm, owner, value);
- }
-
- void set(VM& vm, const JSCell* owner, void* value)
- {
- this->m_value = value;
- vm.heap.writeBarrier(owner);
- }
-
- void setWithoutBarrier(void* value)
- {
- this->m_value = value;
- }
-
- bool weakCASWithoutBarrier(
- void* oldPointer, CopyState oldCopyState, void* newPointer, CopyState newCopyState)
- {
- uintptr_t oldValue = bitwise_cast<uintptr_t>(oldPointer) | static_cast<uintptr_t>(oldCopyState);
- uintptr_t newValue = bitwise_cast<uintptr_t>(newPointer) | static_cast<uintptr_t>(newCopyState);
- return WTF::weakCompareAndSwap(
- &m_value, bitwise_cast<void*>(oldValue), bitwise_cast<void*>(newValue));
- }
-
-private:
- mutable void* m_value;
-};
-
-template <typename T>
-class CopyBarrier : public CopyBarrierBase {
-public:
- CopyBarrier()
- {
- }
-
- CopyBarrier(VM& vm, const JSCell* owner, T& value)
- : CopyBarrierBase(vm, owner, &value)
- {
- }
-
- CopyBarrier(VM& vm, const JSCell* owner, T* value)
- : CopyBarrierBase(vm, owner, value)
- {
- }
-
- T* getWithoutBarrier() const
- {
- return bitwise_cast<T*>(CopyBarrierBase::getWithoutBarrier());
- }
-
- T* get(const JSCell* owner) const
- {
- return bitwise_cast<T*>(CopyBarrierBase::get(owner));
- }
-
- void set(VM& vm, const JSCell* owner, T* value)
- {
- CopyBarrierBase::set(vm, owner, value);
- }
-
- void setWithoutBarrier(T* value)
- {
- CopyBarrierBase::setWithoutBarrier(value);
- }
-
- bool weakCASWithoutBarrier(T* oldPointer, CopyState oldCopyState, T* newPointer, CopyState newCopyState)
- {
- return CopyBarrierBase::weakCASWithoutBarrier(oldPointer, oldCopyState, newPointer, newCopyState);
- }
-};
-
-} // namespace JSC
-
-#endif // CopyBarrier_h
</del></span></pre></div>
<a id="tagsSafari60217SourceJavaScriptCoreheapCopyVisitorInlinesh"></a>
<div class="modfile"><h4>Modified: tags/Safari-602.1.7/Source/JavaScriptCore/heap/CopyVisitorInlines.h (191149 => 191150)</h4>
<pre class="diff"><span>
<span class="info">--- tags/Safari-602.1.7/Source/JavaScriptCore/heap/CopyVisitorInlines.h 2015-10-15 23:38:21 UTC (rev 191149)
+++ tags/Safari-602.1.7/Source/JavaScriptCore/heap/CopyVisitorInlines.h 2015-10-15 23:41:01 UTC (rev 191150)
</span><span class="lines">@@ -33,8 +33,6 @@
</span><span class="cx">
</span><span class="cx"> inline bool CopyVisitor::checkIfShouldCopy(void* oldPtr)
</span><span class="cx"> {
</span><del>- if (!oldPtr)
- return false;
</del><span class="cx"> CopiedBlock* block = CopiedSpace::blockFor(oldPtr);
</span><span class="cx"> if (block->isOversize() || block->isPinned())
</span><span class="cx"> return false;
</span></span></pre></div>
<a id="tagsSafari60217SourceJavaScriptCoreheapCopyWriteBarrierhfromrev190895trunkSourceJavaScriptCoreheapCopyWriteBarrierh"></a>
<div class="copfile"><h4>Copied: tags/Safari-602.1.7/Source/JavaScriptCore/heap/CopyWriteBarrier.h (from rev 190895, trunk/Source/JavaScriptCore/heap/CopyWriteBarrier.h) (0 => 191150)</h4>
<pre class="diff"><span>
<span class="info">--- tags/Safari-602.1.7/Source/JavaScriptCore/heap/CopyWriteBarrier.h (rev 0)
+++ tags/Safari-602.1.7/Source/JavaScriptCore/heap/CopyWriteBarrier.h 2015-10-15 23:41:01 UTC (rev 191150)
</span><span class="lines">@@ -0,0 +1,89 @@
</span><ins>+/*
+ * Copyright (C) 2014 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ * notice, this list of conditions and the following disclaimer in the
+ * documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef CopyWriteBarrier_h
+#define CopyWriteBarrier_h
+
+#include "Heap.h"
+
+namespace JSC {
+
+template <typename T>
+class CopyWriteBarrier {
+public:
+ CopyWriteBarrier()
+ : m_value(0)
+ {
+ }
+
+ CopyWriteBarrier(VM& vm, const JSCell* owner, T& value)
+ {
+ this->set(vm, owner, &value);
+ }
+
+ CopyWriteBarrier(VM& vm, const JSCell* owner, T* value)
+ {
+ this->set(vm, owner, value);
+ }
+
+ bool operator!() const { return !m_value; }
+
+ explicit operator bool() const { return m_value; }
+
+ T* get() const
+ {
+ return m_value;
+ }
+
+ T* operator*() const
+ {
+ return get();
+ }
+
+ T* operator->() const
+ {
+ return get();
+ }
+
+ void set(VM& vm, const JSCell* owner, T* value)
+ {
+ this->m_value = value;
+ vm.heap.writeBarrier(owner);
+ }
+
+ void setWithoutWriteBarrier(T* value)
+ {
+ this->m_value = value;
+ }
+
+ void clear() { m_value = 0; }
+
+private:
+ T* m_value;
+};
+
+} // namespace JSC
+
+#endif // CopyWriteBarrier_h
</ins></span></pre></div>
<a id="tagsSafari60217SourceJavaScriptCoreheapHeapcpp"></a>
<div class="modfile"><h4>Modified: tags/Safari-602.1.7/Source/JavaScriptCore/heap/Heap.cpp (191149 => 191150)</h4>
<pre class="diff"><span>
<span class="info">--- tags/Safari-602.1.7/Source/JavaScriptCore/heap/Heap.cpp 2015-10-15 23:38:21 UTC (rev 191149)
+++ tags/Safari-602.1.7/Source/JavaScriptCore/heap/Heap.cpp 2015-10-15 23:41:01 UTC (rev 191150)
</span><span class="lines">@@ -1000,12 +1000,6 @@
</span><span class="cx"> m_slotVisitor.appendToMarkStack(const_cast<JSCell*>(cell));
</span><span class="cx"> }
</span><span class="cx">
</span><del>-void* Heap::copyBarrier(const JSCell*, void*& pointer)
-{
- // Do nothing for now.
- return pointer;
-}
-
</del><span class="cx"> void Heap::collectAndSweep(HeapOperation collectionType)
</span><span class="cx"> {
</span><span class="cx"> if (!m_isSafeToCollect)
</span></span></pre></div>
<a id="tagsSafari60217SourceJavaScriptCoreheapHeaph"></a>
<div class="modfile"><h4>Modified: tags/Safari-602.1.7/Source/JavaScriptCore/heap/Heap.h (191149 => 191150)</h4>
<pre class="diff"><span>
<span class="info">--- tags/Safari-602.1.7/Source/JavaScriptCore/heap/Heap.h 2015-10-15 23:38:21 UTC (rev 191149)
+++ tags/Safari-602.1.7/Source/JavaScriptCore/heap/Heap.h 2015-10-15 23:41:01 UTC (rev 191150)
</span><span class="lines">@@ -108,8 +108,6 @@
</span><span class="cx"> void writeBarrier(const JSCell*, JSValue);
</span><span class="cx"> void writeBarrier(const JSCell*, JSCell*);
</span><span class="cx">
</span><del>- JS_EXPORT_PRIVATE static void* copyBarrier(const JSCell* owner, void*& copiedSpacePointer);
-
</del><span class="cx"> WriteBarrierBuffer& writeBarrierBuffer() { return m_writeBarrierBuffer; }
</span><span class="cx"> void flushWriteBarrierBuffer(JSCell*);
</span><span class="cx">
</span></span></pre></div>
<a id="tagsSafari60217SourceJavaScriptCoreheapHeapInlinesh"></a>
<div class="modfile"><h4>Modified: tags/Safari-602.1.7/Source/JavaScriptCore/heap/HeapInlines.h (191149 => 191150)</h4>
<pre class="diff"><span>
<span class="info">--- tags/Safari-602.1.7/Source/JavaScriptCore/heap/HeapInlines.h 2015-10-15 23:38:21 UTC (rev 191149)
+++ tags/Safari-602.1.7/Source/JavaScriptCore/heap/HeapInlines.h 2015-10-15 23:41:01 UTC (rev 191150)
</span><span class="lines">@@ -26,7 +26,6 @@
</span><span class="cx"> #ifndef HeapInlines_h
</span><span class="cx"> #define HeapInlines_h
</span><span class="cx">
</span><del>-#include "CopyBarrier.h"
</del><span class="cx"> #include "Heap.h"
</span><span class="cx"> #include "JSCell.h"
</span><span class="cx"> #include "Structure.h"
</span></span></pre></div>
<a id="tagsSafari60217SourceJavaScriptCorejitAssemblyHelpersh"></a>
<div class="modfile"><h4>Modified: tags/Safari-602.1.7/Source/JavaScriptCore/jit/AssemblyHelpers.h (191149 => 191150)</h4>
<pre class="diff"><span>
<span class="info">--- tags/Safari-602.1.7/Source/JavaScriptCore/jit/AssemblyHelpers.h 2015-10-15 23:38:21 UTC (rev 191149)
+++ tags/Safari-602.1.7/Source/JavaScriptCore/jit/AssemblyHelpers.h 2015-10-15 23:41:01 UTC (rev 191150)
</span><span class="lines">@@ -29,7 +29,6 @@
</span><span class="cx"> #if ENABLE(JIT)
</span><span class="cx">
</span><span class="cx"> #include "CodeBlock.h"
</span><del>-#include "CopyBarrier.h"
</del><span class="cx"> #include "FPRInfo.h"
</span><span class="cx"> #include "GPRInfo.h"
</span><span class="cx"> #include "InlineCallFrame.h"
</span><span class="lines">@@ -755,16 +754,6 @@
</span><span class="cx"> return branchPtr(condition, leftHandSide, TrustedImmPtr(structure));
</span><span class="cx"> #endif
</span><span class="cx"> }
</span><del>-
- Jump branchIfNotToSpace(GPRReg storageGPR)
- {
- return branchTest32(NonZero, storageGPR, TrustedImm32(CopyBarrierBase::spaceBits));
- }
-
- void removeSpaceBits(GPRReg storageGPR)
- {
- andPtr(TrustedImmPtr(~static_cast<uintptr_t>(CopyBarrierBase::spaceBits)), storageGPR);
- }
</del><span class="cx">
</span><span class="cx"> static Address addressForByteOffset(ptrdiff_t byteOffset)
</span><span class="cx"> {
</span></span></pre></div>
<a id="tagsSafari60217SourceJavaScriptCorejitJITcpp"></a>
<div class="modfile"><h4>Modified: tags/Safari-602.1.7/Source/JavaScriptCore/jit/JIT.cpp (191149 => 191150)</h4>
<pre class="diff"><span>
<span class="info">--- tags/Safari-602.1.7/Source/JavaScriptCore/jit/JIT.cpp 2015-10-15 23:38:21 UTC (rev 191149)
+++ tags/Safari-602.1.7/Source/JavaScriptCore/jit/JIT.cpp 2015-10-15 23:41:01 UTC (rev 191150)
</span><span class="lines">@@ -180,8 +180,6 @@
</span><span class="cx">
</span><span class="cx"> if (Options::eagerlyUpdateTopCallFrame())
</span><span class="cx"> updateTopCallFrame();
</span><del>-
- unsigned bytecodeOffset = m_bytecodeOffset;
</del><span class="cx">
</span><span class="cx"> switch (opcodeID) {
</span><span class="cx"> DEFINE_SLOW_OP(del_by_val)
</span><span class="lines">@@ -316,9 +314,6 @@
</span><span class="cx"> default:
</span><span class="cx"> RELEASE_ASSERT_NOT_REACHED();
</span><span class="cx"> }
</span><del>-
- if (false)
- dataLog("At ", bytecodeOffset, ": ", m_slowCases.size(), "\n");
</del><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> RELEASE_ASSERT(m_callLinkInfoIndex == m_callCompilationInfo.size());
</span><span class="lines">@@ -438,9 +433,6 @@
</span><span class="cx"> RELEASE_ASSERT_NOT_REACHED();
</span><span class="cx"> }
</span><span class="cx">
</span><del>- if (false)
- dataLog("At ", firstTo, " slow: ", iter - m_slowCases.begin(), "\n");
-
</del><span class="cx"> RELEASE_ASSERT_WITH_MESSAGE(iter == m_slowCases.end() || firstTo != iter->to, "Not enough jumps linked in slow case codegen.");
</span><span class="cx"> RELEASE_ASSERT_WITH_MESSAGE(firstTo == (iter - 1)->to, "Too many jumps linked in slow case codegen.");
</span><span class="cx">
</span></span></pre></div>
<a id="tagsSafari60217SourceJavaScriptCorejitJITOpcodescpp"></a>
<div class="modfile"><h4>Modified: tags/Safari-602.1.7/Source/JavaScriptCore/jit/JITOpcodes.cpp (191149 => 191150)</h4>
<pre class="diff"><span>
<span class="info">--- tags/Safari-602.1.7/Source/JavaScriptCore/jit/JITOpcodes.cpp 2015-10-15 23:38:21 UTC (rev 191149)
+++ tags/Safari-602.1.7/Source/JavaScriptCore/jit/JITOpcodes.cpp 2015-10-15 23:41:01 UTC (rev 191150)
</span><span class="lines">@@ -1153,7 +1153,6 @@
</span><span class="cx">
</span><span class="cx"> linkSlowCaseIfNotJSCell(iter, base); // base cell check
</span><span class="cx"> linkSlowCase(iter); // base array check
</span><del>- linkSlowCase(iter); // read barrier
</del><span class="cx"> linkSlowCase(iter); // vector length check
</span><span class="cx"> linkSlowCase(iter); // empty value
</span><span class="cx">
</span><span class="lines">@@ -1197,7 +1196,6 @@
</span><span class="cx"> // Otherwise it's out of line
</span><span class="cx"> outOfLineAccess.link(this);
</span><span class="cx"> loadPtr(Address(regT0, JSObject::butterflyOffset()), regT0);
</span><del>- addSlowCase(branchIfNotToSpace(regT0));
</del><span class="cx"> sub32(Address(regT2, JSPropertyNameEnumerator::cachedInlineCapacityOffset()), regT1);
</span><span class="cx"> neg32(regT1);
</span><span class="cx"> signExtend32ToPtr(regT1, regT1);
</span><span class="lines">@@ -1214,7 +1212,6 @@
</span><span class="cx"> int base = currentInstruction[2].u.operand;
</span><span class="cx"> linkSlowCaseIfNotJSCell(iter, base);
</span><span class="cx"> linkSlowCase(iter);
</span><del>- linkSlowCase(iter);
</del><span class="cx">
</span><span class="cx"> JITSlowPathCall slowPathCall(this, currentInstruction, slow_path_get_direct_pname);
</span><span class="cx"> slowPathCall.call();
</span></span></pre></div>
<a id="tagsSafari60217SourceJavaScriptCorejitJITOpcodes32_64cpp"></a>
<div class="modfile"><h4>Modified: tags/Safari-602.1.7/Source/JavaScriptCore/jit/JITOpcodes32_64.cpp (191149 => 191150)</h4>
<pre class="diff"><span>
<span class="info">--- tags/Safari-602.1.7/Source/JavaScriptCore/jit/JITOpcodes32_64.cpp 2015-10-15 23:38:21 UTC (rev 191149)
+++ tags/Safari-602.1.7/Source/JavaScriptCore/jit/JITOpcodes32_64.cpp 2015-10-15 23:41:01 UTC (rev 191150)
</span><span class="lines">@@ -1174,7 +1174,6 @@
</span><span class="cx"> // Otherwise it's out of line
</span><span class="cx"> outOfLineAccess.link(this);
</span><span class="cx"> loadPtr(Address(regT0, JSObject::butterflyOffset()), regT0);
</span><del>- addSlowCase(branchIfNotToSpace(regT0));
</del><span class="cx"> sub32(Address(regT1, JSPropertyNameEnumerator::cachedInlineCapacityOffset()), regT2);
</span><span class="cx"> neg32(regT2);
</span><span class="cx"> int32_t offsetOfFirstProperty = static_cast<int32_t>(offsetInButterfly(firstOutOfLineOffset)) * sizeof(EncodedJSValue);
</span><span class="lines">@@ -1191,7 +1190,6 @@
</span><span class="cx"> int base = currentInstruction[2].u.operand;
</span><span class="cx"> linkSlowCaseIfNotJSCell(iter, base);
</span><span class="cx"> linkSlowCase(iter);
</span><del>- linkSlowCase(iter);
</del><span class="cx">
</span><span class="cx"> JITSlowPathCall slowPathCall(this, currentInstruction, slow_path_get_direct_pname);
</span><span class="cx"> slowPathCall.call();
</span></span></pre></div>
<a id="tagsSafari60217SourceJavaScriptCorejitJITPropertyAccesscpp"></a>
<div class="modfile"><h4>Modified: tags/Safari-602.1.7/Source/JavaScriptCore/jit/JITPropertyAccess.cpp (191149 => 191150)</h4>
<pre class="diff"><span>
<span class="info">--- tags/Safari-602.1.7/Source/JavaScriptCore/jit/JITPropertyAccess.cpp 2015-10-15 23:38:21 UTC (rev 191149)
+++ tags/Safari-602.1.7/Source/JavaScriptCore/jit/JITPropertyAccess.cpp 2015-10-15 23:41:01 UTC (rev 191150)
</span><span class="lines">@@ -165,7 +165,6 @@
</span><span class="cx">
</span><span class="cx"> badType = patchableBranch32(NotEqual, regT2, TrustedImm32(DoubleShape));
</span><span class="cx"> loadPtr(Address(regT0, JSObject::butterflyOffset()), regT2);
</span><del>- slowCases.append(branchIfNotToSpace(regT2));
</del><span class="cx"> slowCases.append(branch32(AboveOrEqual, regT1, Address(regT2, Butterfly::offsetOfPublicLength())));
</span><span class="cx"> loadDouble(BaseIndex(regT2, regT1, TimesEight), fpRegT0);
</span><span class="cx"> slowCases.append(branchDouble(DoubleNotEqualOrUnordered, fpRegT0, fpRegT0));
</span><span class="lines">@@ -179,7 +178,6 @@
</span><span class="cx">
</span><span class="cx"> badType = patchableBranch32(NotEqual, regT2, TrustedImm32(expectedShape));
</span><span class="cx"> loadPtr(Address(regT0, JSObject::butterflyOffset()), regT2);
</span><del>- slowCases.append(branchIfNotToSpace(regT2));
</del><span class="cx"> slowCases.append(branch32(AboveOrEqual, regT1, Address(regT2, Butterfly::offsetOfPublicLength())));
</span><span class="cx"> load64(BaseIndex(regT2, regT1, TimesEight), regT0);
</span><span class="cx"> slowCases.append(branchTest64(Zero, regT0));
</span><span class="lines">@@ -195,7 +193,6 @@
</span><span class="cx"> badType = patchableBranch32(Above, regT3, TrustedImm32(SlowPutArrayStorageShape - ArrayStorageShape));
</span><span class="cx">
</span><span class="cx"> loadPtr(Address(regT0, JSObject::butterflyOffset()), regT2);
</span><del>- slowCases.append(branchIfNotToSpace(regT2));
</del><span class="cx"> slowCases.append(branch32(AboveOrEqual, regT1, Address(regT2, ArrayStorage::vectorLengthOffset())));
</span><span class="cx">
</span><span class="cx"> load64(BaseIndex(regT2, regT1, TimesEight, ArrayStorage::vectorOffset()), regT0);
</span><span class="lines">@@ -254,7 +251,6 @@
</span><span class="cx"> notString.link(this);
</span><span class="cx"> nonCell.link(this);
</span><span class="cx">
</span><del>- linkSlowCase(iter); // read barrier
</del><span class="cx"> linkSlowCase(iter); // vector length check
</span><span class="cx"> linkSlowCase(iter); // empty value
</span><span class="cx">
</span><span class="lines">@@ -327,7 +323,6 @@
</span><span class="cx"> badType = patchableBranch32(NotEqual, regT2, TrustedImm32(indexingShape));
</span><span class="cx">
</span><span class="cx"> loadPtr(Address(regT0, JSObject::butterflyOffset()), regT2);
</span><del>- slowCases.append(branchIfNotToSpace(regT2));
</del><span class="cx"> Jump outOfBounds = branch32(AboveOrEqual, regT1, Address(regT2, Butterfly::offsetOfPublicLength()));
</span><span class="cx">
</span><span class="cx"> Label storeResult = label();
</span><span class="lines">@@ -383,7 +378,6 @@
</span><span class="cx">
</span><span class="cx"> badType = patchableBranch32(NotEqual, regT2, TrustedImm32(ArrayStorageShape));
</span><span class="cx"> loadPtr(Address(regT0, JSObject::butterflyOffset()), regT2);
</span><del>- slowCases.append(branchIfNotToSpace(regT2));
</del><span class="cx"> slowCases.append(branch32(AboveOrEqual, regT1, Address(regT2, ArrayStorage::vectorLengthOffset())));
</span><span class="cx">
</span><span class="cx"> Jump empty = branchTest64(Zero, BaseIndex(regT2, regT1, TimesEight, OBJECT_OFFSETOF(ArrayStorage, m_vector[0])));
</span><span class="lines">@@ -454,9 +448,8 @@
</span><span class="cx"> linkSlowCase(iter); // property int32 check
</span><span class="cx"> linkSlowCase(iter); // base not array check
</span><span class="cx">
</span><del>- linkSlowCase(iter); // read barrier
</del><span class="cx"> linkSlowCase(iter); // out of bounds
</span><del>-
</del><ins>+
</ins><span class="cx"> JITArrayMode mode = chooseArrayMode(profile);
</span><span class="cx"> switch (mode) {
</span><span class="cx"> case JITInt32:
</span><span class="lines">@@ -787,7 +780,6 @@
</span><span class="cx"> isOutOfLine.link(this);
</span><span class="cx"> }
</span><span class="cx"> loadPtr(Address(base, JSObject::butterflyOffset()), scratch);
</span><del>- addSlowCase(branchIfNotToSpace(scratch));
</del><span class="cx"> neg32(offset);
</span><span class="cx"> signExtend32ToPtr(offset, offset);
</span><span class="cx"> load64(BaseIndex(scratch, offset, TimesEight, (firstOutOfLineOffset - 2) * sizeof(EncodedJSValue)), result);
</span><span class="lines">@@ -867,10 +859,8 @@
</span><span class="cx"> if (resolveType == GlobalVar || resolveType == ClosureVar)
</span><span class="cx"> return;
</span><span class="cx">
</span><del>- if (resolveType == GlobalProperty || resolveType == GlobalPropertyWithVarInjectionChecks) {
- linkSlowCase(iter); // bad structure
- linkSlowCase(iter); // read barrier
- }
</del><ins>+ if (resolveType == GlobalProperty || resolveType == GlobalPropertyWithVarInjectionChecks)
+ linkSlowCase(iter);
</ins><span class="cx">
</span><span class="cx"> if (resolveType == GlobalLexicalVarWithVarInjectionChecks) // Var injections check.
</span><span class="cx"> linkSlowCase(iter);
</span><span class="lines">@@ -879,7 +869,6 @@
</span><span class="cx"> // GlobalProperty/GlobalPropertyWithVarInjectionChecks
</span><span class="cx"> linkSlowCase(iter); // emitLoadWithStructureCheck
</span><span class="cx"> linkSlowCase(iter); // emitLoadWithStructureCheck
</span><del>- linkSlowCase(iter); // read barrier
</del><span class="cx"> // GlobalLexicalVar
</span><span class="cx"> linkSlowCase(iter); // TDZ check.
</span><span class="cx"> // GlobalLexicalVarWithVarInjectionChecks.
</span><span class="lines">@@ -933,7 +922,6 @@
</span><span class="cx"> emitGetVirtualRegister(value, regT2);
</span><span class="cx">
</span><span class="cx"> loadPtr(Address(regT0, JSObject::butterflyOffset()), regT0);
</span><del>- addSlowCase(branchIfNotToSpace(regT0));
</del><span class="cx"> loadPtr(operandSlot, regT1);
</span><span class="cx"> negPtr(regT1);
</span><span class="cx"> storePtr(regT2, BaseIndex(regT0, regT1, TimesEight, (firstOutOfLineOffset - 2) * sizeof(EncodedJSValue)));
</span><span class="lines">@@ -1027,17 +1015,14 @@
</span><span class="cx"> || resolveType == LocalClosureVar)
</span><span class="cx"> && currentInstruction[5].u.watchpointSet->state() != IsInvalidated)
</span><span class="cx"> linkCount++;
</span><del>- if (resolveType == GlobalProperty || resolveType == GlobalPropertyWithVarInjectionChecks) {
- linkCount++; // bad structure
- linkCount++; // read barrier
- }
</del><ins>+ if (resolveType == GlobalProperty || resolveType == GlobalPropertyWithVarInjectionChecks)
+ linkCount++;
</ins><span class="cx"> if (getPutInfo.initializationMode() != Initialization && (resolveType == GlobalLexicalVar || resolveType == GlobalLexicalVarWithVarInjectionChecks)) // TDZ check.
</span><span class="cx"> linkCount++;
</span><span class="cx"> if (resolveType == UnresolvedProperty || resolveType == UnresolvedPropertyWithVarInjectionChecks) {
</span><span class="cx"> // GlobalProperty/GlobalPropertyWithVarInjectionsCheck
</span><span class="cx"> linkCount++; // emitLoadWithStructureCheck
</span><span class="cx"> linkCount++; // emitLoadWithStructureCheck
</span><del>- linkCount++; // read barrier
</del><span class="cx">
</span><span class="cx"> // GlobalLexicalVar
</span><span class="cx"> bool needsTDZCheck = getPutInfo.initializationMode() != Initialization;
</span><span class="lines">@@ -1455,24 +1440,23 @@
</span><span class="cx"> load8(Address(base, JSCell::typeInfoTypeOffset()), scratch);
</span><span class="cx"> badType = patchableBranch32(NotEqual, scratch, TrustedImm32(typeForTypedArrayType(type)));
</span><span class="cx"> slowCases.append(branch32(AboveOrEqual, property, Address(base, JSArrayBufferView::offsetOfLength())));
</span><del>- loadPtr(Address(base, JSArrayBufferView::offsetOfVector()), scratch);
- slowCases.append(branchIfNotToSpace(scratch));
</del><ins>+ loadPtr(Address(base, JSArrayBufferView::offsetOfVector()), base);
</ins><span class="cx">
</span><span class="cx"> switch (elementSize(type)) {
</span><span class="cx"> case 1:
</span><span class="cx"> if (isSigned(type))
</span><del>- load8SignedExtendTo32(BaseIndex(scratch, property, TimesOne), resultPayload);
</del><ins>+ load8SignedExtendTo32(BaseIndex(base, property, TimesOne), resultPayload);
</ins><span class="cx"> else
</span><del>- load8(BaseIndex(scratch, property, TimesOne), resultPayload);
</del><ins>+ load8(BaseIndex(base, property, TimesOne), resultPayload);
</ins><span class="cx"> break;
</span><span class="cx"> case 2:
</span><span class="cx"> if (isSigned(type))
</span><del>- load16SignedExtendTo32(BaseIndex(scratch, property, TimesTwo), resultPayload);
</del><ins>+ load16SignedExtendTo32(BaseIndex(base, property, TimesTwo), resultPayload);
</ins><span class="cx"> else
</span><del>- load16(BaseIndex(scratch, property, TimesTwo), resultPayload);
</del><ins>+ load16(BaseIndex(base, property, TimesTwo), resultPayload);
</ins><span class="cx"> break;
</span><span class="cx"> case 4:
</span><del>- load32(BaseIndex(scratch, property, TimesFour), resultPayload);
</del><ins>+ load32(BaseIndex(base, property, TimesFour), resultPayload);
</ins><span class="cx"> break;
</span><span class="cx"> default:
</span><span class="cx"> CRASH();
</span><span class="lines">@@ -1527,16 +1511,15 @@
</span><span class="cx"> load8(Address(base, JSCell::typeInfoTypeOffset()), scratch);
</span><span class="cx"> badType = patchableBranch32(NotEqual, scratch, TrustedImm32(typeForTypedArrayType(type)));
</span><span class="cx"> slowCases.append(branch32(AboveOrEqual, property, Address(base, JSArrayBufferView::offsetOfLength())));
</span><del>- loadPtr(Address(base, JSArrayBufferView::offsetOfVector()), scratch);
- slowCases.append(branchIfNotToSpace(scratch));
</del><ins>+ loadPtr(Address(base, JSArrayBufferView::offsetOfVector()), base);
</ins><span class="cx">
</span><span class="cx"> switch (elementSize(type)) {
</span><span class="cx"> case 4:
</span><del>- loadFloat(BaseIndex(scratch, property, TimesFour), fpRegT0);
</del><ins>+ loadFloat(BaseIndex(base, property, TimesFour), fpRegT0);
</ins><span class="cx"> convertFloatToDouble(fpRegT0, fpRegT0);
</span><span class="cx"> break;
</span><span class="cx"> case 8: {
</span><del>- loadDouble(BaseIndex(scratch, property, TimesEight), fpRegT0);
</del><ins>+ loadDouble(BaseIndex(base, property, TimesEight), fpRegT0);
</ins><span class="cx"> break;
</span><span class="cx"> }
</span><span class="cx"> default:
</span><span class="lines">@@ -1596,7 +1579,6 @@
</span><span class="cx"> // We would be loading this into base as in get_by_val, except that the slow
</span><span class="cx"> // path expects the base to be unclobbered.
</span><span class="cx"> loadPtr(Address(base, JSArrayBufferView::offsetOfVector()), lateScratch);
</span><del>- slowCases.append(branchIfNotToSpace(lateScratch));
</del><span class="cx">
</span><span class="cx"> if (isClamped(type)) {
</span><span class="cx"> ASSERT(elementSize(type) == 1);
</span><span class="lines">@@ -1682,7 +1664,6 @@
</span><span class="cx"> // We would be loading this into base as in get_by_val, except that the slow
</span><span class="cx"> // path expects the base to be unclobbered.
</span><span class="cx"> loadPtr(Address(base, JSArrayBufferView::offsetOfVector()), lateScratch);
</span><del>- slowCases.append(branchIfNotToSpace(lateScratch));
</del><span class="cx">
</span><span class="cx"> switch (elementSize(type)) {
</span><span class="cx"> case 4:
</span></span></pre></div>
<a id="tagsSafari60217SourceJavaScriptCorellintLowLevelInterpreterasm"></a>
<div class="modfile"><h4>Modified: tags/Safari-602.1.7/Source/JavaScriptCore/llint/LowLevelInterpreter.asm (191149 => 191150)</h4>
<pre class="diff"><span>
<span class="info">--- tags/Safari-602.1.7/Source/JavaScriptCore/llint/LowLevelInterpreter.asm 2015-10-15 23:38:21 UTC (rev 191149)
+++ tags/Safari-602.1.7/Source/JavaScriptCore/llint/LowLevelInterpreter.asm 2015-10-15 23:41:01 UTC (rev 191150)
</span><span class="lines">@@ -221,8 +221,6 @@
</span><span class="cx"> const PutByIdSecondaryTypeObjectOrOther = 0x40
</span><span class="cx"> const PutByIdSecondaryTypeTop = 0x48
</span><span class="cx">
</span><del>-const CopyBarrierSpaceBits = 3
-
</del><span class="cx"> const CallOpCodeSize = 9
</span><span class="cx">
</span><span class="cx"> if X86_64 or ARM64 or C_LOOP
</span><span class="lines">@@ -665,10 +663,6 @@
</span><span class="cx"> end
</span><span class="cx"> end
</span><span class="cx">
</span><del>-macro copyBarrier(value, slow)
- btpnz value, CopyBarrierSpaceBits, slow
-end
-
</del><span class="cx"> macro functionPrologue()
</span><span class="cx"> if X86 or X86_WIN or X86_64 or X86_64_WIN
</span><span class="cx"> push cfr
</span></span></pre></div>
<a id="tagsSafari60217SourceJavaScriptCorellintLowLevelInterpreter64asm"></a>
<div class="modfile"><h4>Modified: tags/Safari-602.1.7/Source/JavaScriptCore/llint/LowLevelInterpreter64.asm (191149 => 191150)</h4>
<pre class="diff"><span>
<span class="info">--- tags/Safari-602.1.7/Source/JavaScriptCore/llint/LowLevelInterpreter64.asm 2015-10-15 23:38:21 UTC (rev 191149)
+++ tags/Safari-602.1.7/Source/JavaScriptCore/llint/LowLevelInterpreter64.asm 2015-10-15 23:41:01 UTC (rev 191150)
</span><span class="lines">@@ -1188,10 +1188,9 @@
</span><span class="cx"> dispatch(3)
</span><span class="cx">
</span><span class="cx">
</span><del>-macro loadPropertyAtVariableOffset(propertyOffsetAsInt, objectAndStorage, value, slow)
</del><ins>+macro loadPropertyAtVariableOffset(propertyOffsetAsInt, objectAndStorage, value)
</ins><span class="cx"> bilt propertyOffsetAsInt, firstOutOfLineOffset, .isInline
</span><span class="cx"> loadp JSObject::m_butterfly[objectAndStorage], objectAndStorage
</span><del>- copyBarrier(objectAndStorage, slow)
</del><span class="cx"> negi propertyOffsetAsInt
</span><span class="cx"> sxi2q propertyOffsetAsInt, propertyOffsetAsInt
</span><span class="cx"> jmp .ready
</span><span class="lines">@@ -1202,10 +1201,9 @@
</span><span class="cx"> end
</span><span class="cx">
</span><span class="cx">
</span><del>-macro storePropertyAtVariableOffset(propertyOffsetAsInt, objectAndStorage, value, slow)
</del><ins>+macro storePropertyAtVariableOffset(propertyOffsetAsInt, objectAndStorage, value)
</ins><span class="cx"> bilt propertyOffsetAsInt, firstOutOfLineOffset, .isInline
</span><span class="cx"> loadp JSObject::m_butterfly[objectAndStorage], objectAndStorage
</span><del>- copyBarrier(objectAndStorage, slow)
</del><span class="cx"> negi propertyOffsetAsInt
</span><span class="cx"> sxi2q propertyOffsetAsInt, propertyOffsetAsInt
</span><span class="cx"> jmp .ready
</span><span class="lines">@@ -1224,7 +1222,7 @@
</span><span class="cx"> bineq t2, t1, .opGetByIdSlow
</span><span class="cx"> loadisFromInstruction(5, t1)
</span><span class="cx"> loadisFromInstruction(1, t2)
</span><del>- loadPropertyAtVariableOffset(t1, t3, t0, .opGetByIdSlow)
</del><ins>+ loadPropertyAtVariableOffset(t1, t3, t0)
</ins><span class="cx"> storeq t0, [cfr, t2, 8]
</span><span class="cx"> valueProfile(t0, 8, t1)
</span><span class="cx"> dispatch(9)
</span><span class="lines">@@ -1245,7 +1243,6 @@
</span><span class="cx"> btiz t2, IndexingShapeMask, .opGetArrayLengthSlow
</span><span class="cx"> loadisFromInstruction(1, t1)
</span><span class="cx"> loadp JSObject::m_butterfly[t3], t0
</span><del>- copyBarrier(t0, .opGetArrayLengthSlow)
</del><span class="cx"> loadi -sizeof IndexingHeader + IndexingHeader::u.lengths.publicLength[t0], t0
</span><span class="cx"> bilt t0, 0, .opGetArrayLengthSlow
</span><span class="cx"> orq tagTypeNumber, t0
</span><span class="lines">@@ -1389,7 +1386,7 @@
</span><span class="cx"> loadisFromInstruction(3, t1)
</span><span class="cx"> loadConstantOrVariable(t1, t2)
</span><span class="cx"> loadisFromInstruction(5, t1)
</span><del>- storePropertyAtVariableOffset(t1, t0, t2, .opPutByIdSlow)
</del><ins>+ storePropertyAtVariableOffset(t1, t0, t2)
</ins><span class="cx"> dispatch(9)
</span><span class="cx">
</span><span class="cx"> .opPutByIdSlow:
</span><span class="lines">@@ -1408,7 +1405,6 @@
</span><span class="cx"> loadConstantOrVariableInt32(t3, t1, .opGetByValSlow)
</span><span class="cx"> sxi2q t1, t1
</span><span class="cx"> loadp JSObject::m_butterfly[t0], t3
</span><del>- copyBarrier(t3, .opGetByValSlow)
</del><span class="cx"> andi IndexingShapeMask, t2
</span><span class="cx"> bieq t2, Int32Shape, .opGetByValIsContiguous
</span><span class="cx"> bineq t2, ContiguousShape, .opGetByValNotContiguous
</span><span class="lines">@@ -1479,7 +1475,6 @@
</span><span class="cx"> loadConstantOrVariableInt32(t0, t3, .opPutByValSlow)
</span><span class="cx"> sxi2q t3, t3
</span><span class="cx"> loadp JSObject::m_butterfly[t1], t0
</span><del>- copyBarrier(t0, .opPutByValSlow)
</del><span class="cx"> andi IndexingShapeMask, t2
</span><span class="cx"> bineq t2, Int32Shape, .opPutByValNotInt32
</span><span class="cx"> contiguousPutByVal(
</span><span class="lines">@@ -2000,9 +1995,9 @@
</span><span class="cx"> bpneq t2, t1, slowPath
</span><span class="cx"> end
</span><span class="cx">
</span><del>-macro getProperty(slow)
</del><ins>+macro getProperty()
</ins><span class="cx"> loadisFromInstruction(6, t1)
</span><del>- loadPropertyAtVariableOffset(t1, t0, t2, slow)
</del><ins>+ loadPropertyAtVariableOffset(t1, t0, t2)
</ins><span class="cx"> valueProfile(t2, 7, t0)
</span><span class="cx"> loadisFromInstruction(1, t0)
</span><span class="cx"> storeq t2, [cfr, t0, 8]
</span><span class="lines">@@ -2033,7 +2028,7 @@
</span><span class="cx"> #gGlobalProperty:
</span><span class="cx"> bineq t0, GlobalProperty, .gGlobalVar
</span><span class="cx"> loadWithStructureCheck(2, .gDynamic)
</span><del>- getProperty(.gDynamic)
</del><ins>+ getProperty()
</ins><span class="cx"> dispatch(8)
</span><span class="cx">
</span><span class="cx"> .gGlobalVar:
</span><span class="lines">@@ -2058,7 +2053,7 @@
</span><span class="cx"> .gGlobalPropertyWithVarInjectionChecks:
</span><span class="cx"> bineq t0, GlobalPropertyWithVarInjectionChecks, .gGlobalVarWithVarInjectionChecks
</span><span class="cx"> loadWithStructureCheck(2, .gDynamic)
</span><del>- getProperty(.gDynamic)
</del><ins>+ getProperty()
</ins><span class="cx"> dispatch(8)
</span><span class="cx">
</span><span class="cx"> .gGlobalVarWithVarInjectionChecks:
</span><span class="lines">@@ -2088,11 +2083,11 @@
</span><span class="cx"> dispatch(8)
</span><span class="cx">
</span><span class="cx">
</span><del>-macro putProperty(slow)
</del><ins>+macro putProperty()
</ins><span class="cx"> loadisFromInstruction(3, t1)
</span><span class="cx"> loadConstantOrVariable(t1, t2)
</span><span class="cx"> loadisFromInstruction(6, t1)
</span><del>- storePropertyAtVariableOffset(t1, t0, t2, slow)
</del><ins>+ storePropertyAtVariableOffset(t1, t0, t2)
</ins><span class="cx"> end
</span><span class="cx">
</span><span class="cx"> macro putGlobalVariable()
</span><span class="lines">@@ -2150,7 +2145,7 @@
</span><span class="cx"> bineq t0, GlobalProperty, .pGlobalVar
</span><span class="cx"> writeBarrierOnOperands(1, 3)
</span><span class="cx"> loadWithStructureCheck(1, .pDynamic)
</span><del>- putProperty(.pDynamic)
</del><ins>+ putProperty()
</ins><span class="cx"> dispatch(7)
</span><span class="cx">
</span><span class="cx"> .pGlobalVar:
</span><span class="lines">@@ -2177,7 +2172,7 @@
</span><span class="cx"> bineq t0, GlobalPropertyWithVarInjectionChecks, .pGlobalVarWithVarInjectionChecks
</span><span class="cx"> writeBarrierOnOperands(1, 3)
</span><span class="cx"> loadWithStructureCheck(1, .pDynamic)
</span><del>- putProperty(.pDynamic)
</del><ins>+ putProperty()
</ins><span class="cx"> dispatch(7)
</span><span class="cx">
</span><span class="cx"> .pGlobalVarWithVarInjectionChecks:
</span></span></pre></div>
<a id="tagsSafari60217SourceJavaScriptCoreruntimeDirectArgumentscpp"></a>
<div class="modfile"><h4>Modified: tags/Safari-602.1.7/Source/JavaScriptCore/runtime/DirectArguments.cpp (191149 => 191150)</h4>
<pre class="diff"><span>
<span class="info">--- tags/Safari-602.1.7/Source/JavaScriptCore/runtime/DirectArguments.cpp 2015-10-15 23:38:21 UTC (rev 191149)
+++ tags/Safari-602.1.7/Source/JavaScriptCore/runtime/DirectArguments.cpp 2015-10-15 23:41:01 UTC (rev 191150)
</span><span class="lines">@@ -97,7 +97,7 @@
</span><span class="cx"> if (thisObject->m_overrides) {
</span><span class="cx"> visitor.copyLater(
</span><span class="cx"> thisObject, DirectArgumentsOverridesCopyToken,
</span><del>- thisObject->m_overrides.getWithoutBarrier(), thisObject->overridesSize());
</del><ins>+ thisObject->m_overrides.get(), thisObject->overridesSize());
</ins><span class="cx"> }
</span><span class="cx"> }
</span><span class="cx">
</span><span class="lines">@@ -108,11 +108,14 @@
</span><span class="cx">
</span><span class="cx"> RELEASE_ASSERT(token == DirectArgumentsOverridesCopyToken);
</span><span class="cx">
</span><del>- void* oldOverrides = thisObject->m_overrides.getWithoutBarrier();
</del><ins>+ bool* oldOverrides = thisObject->m_overrides.get();
+ if (!oldOverrides)
+ return;
+
</ins><span class="cx"> if (visitor.checkIfShouldCopy(oldOverrides)) {
</span><span class="cx"> bool* newOverrides = static_cast<bool*>(visitor.allocateNewSpace(thisObject->overridesSize()));
</span><span class="cx"> memcpy(newOverrides, oldOverrides, thisObject->m_length);
</span><del>- thisObject->m_overrides.setWithoutBarrier(newOverrides);
</del><ins>+ thisObject->m_overrides.setWithoutWriteBarrier(newOverrides);
</ins><span class="cx"> visitor.didCopy(oldOverrides, thisObject->overridesSize());
</span><span class="cx"> }
</span><span class="cx"> }
</span><span class="lines">@@ -132,10 +135,9 @@
</span><span class="cx">
</span><span class="cx"> void* backingStore;
</span><span class="cx"> RELEASE_ASSERT(vm.heap.tryAllocateStorage(this, overridesSize(), &backingStore));
</span><del>- bool* overrides = static_cast<bool*>(backingStore);
- m_overrides.set(vm, this, overrides);
</del><ins>+ m_overrides.set(vm, this, static_cast<bool*>(backingStore));
</ins><span class="cx"> for (unsigned i = m_length; i--;)
</span><del>- overrides[i] = false;
</del><ins>+ m_overrides.get()[i] = false;
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> void DirectArguments::overrideThingsIfNecessary(VM& vm)
</span><span class="lines">@@ -147,7 +149,7 @@
</span><span class="cx"> void DirectArguments::overrideArgument(VM& vm, unsigned index)
</span><span class="cx"> {
</span><span class="cx"> overrideThingsIfNecessary(vm);
</span><del>- m_overrides.get(this)[index] = true;
</del><ins>+ m_overrides.get()[index] = true;
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> void DirectArguments::copyToArguments(ExecState* exec, VirtualRegister firstElementDest, unsigned offset, unsigned length)
</span></span></pre></div>
<a id="tagsSafari60217SourceJavaScriptCoreruntimeDirectArgumentsh"></a>
<div class="modfile"><h4>Modified: tags/Safari-602.1.7/Source/JavaScriptCore/runtime/DirectArguments.h (191149 => 191150)</h4>
<pre class="diff"><span>
<span class="info">--- tags/Safari-602.1.7/Source/JavaScriptCore/runtime/DirectArguments.h 2015-10-15 23:38:21 UTC (rev 191149)
+++ tags/Safari-602.1.7/Source/JavaScriptCore/runtime/DirectArguments.h 2015-10-15 23:41:01 UTC (rev 191150)
</span><span class="lines">@@ -73,7 +73,7 @@
</span><span class="cx">
</span><span class="cx"> bool canAccessIndexQuickly(uint32_t i) const
</span><span class="cx"> {
</span><del>- return i < m_length && (!m_overrides || !m_overrides.get(this)[i]);
</del><ins>+ return i < m_length && (!m_overrides || !m_overrides.get()[i]);
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> bool canAccessArgumentIndexQuicklyInDFG(uint32_t i) const
</span><span class="lines">@@ -148,7 +148,7 @@
</span><span class="cx"> WriteBarrier<JSFunction> m_callee;
</span><span class="cx"> uint32_t m_length; // Always the actual length of captured arguments and never what was stored into the length property.
</span><span class="cx"> uint32_t m_minCapacity; // The max of this and length determines the capacity of this object. It may be the actual capacity, or maybe something smaller. We arrange it this way to be kind to the JITs.
</span><del>- CopyBarrier<bool> m_overrides; // If non-null, it means that length, callee, and caller are fully materialized properties.
</del><ins>+ CopyWriteBarrier<bool> m_overrides; // If non-null, it means that length, callee, and caller are fully materialized properties.
</ins><span class="cx"> };
</span><span class="cx">
</span><span class="cx"> } // namespace JSC
</span></span></pre></div>
<a id="tagsSafari60217SourceJavaScriptCoreruntimeJSArraycpp"></a>
<div class="modfile"><h4>Modified: tags/Safari-602.1.7/Source/JavaScriptCore/runtime/JSArray.cpp (191149 => 191150)</h4>
<pre class="diff"><span>
<span class="info">--- tags/Safari-602.1.7/Source/JavaScriptCore/runtime/JSArray.cpp 2015-10-15 23:38:21 UTC (rev 191149)
+++ tags/Safari-602.1.7/Source/JavaScriptCore/runtime/JSArray.cpp 2015-10-15 23:41:01 UTC (rev 191150)
</span><span class="lines">@@ -392,7 +392,6 @@
</span><span class="cx">
</span><span class="cx"> bool JSArray::setLength(ExecState* exec, unsigned newLength, bool throwException)
</span><span class="cx"> {
</span><del>- Butterfly* butterfly = m_butterfly.get(this);
</del><span class="cx"> switch (indexingType()) {
</span><span class="cx"> case ArrayClass:
</span><span class="cx"> if (!newLength)
</span><span class="lines">@@ -409,7 +408,7 @@
</span><span class="cx"> case ArrayWithInt32:
</span><span class="cx"> case ArrayWithDouble:
</span><span class="cx"> case ArrayWithContiguous: {
</span><del>- if (newLength == butterfly->publicLength())
</del><ins>+ if (newLength == m_butterfly->publicLength())
</ins><span class="cx"> return true;
</span><span class="cx"> if (newLength >= MAX_ARRAY_INDEX // This case ensures that we can do fast push.
</span><span class="cx"> || (newLength >= MIN_SPARSE_ARRAY_INDEX
</span><span class="lines">@@ -418,12 +417,12 @@
</span><span class="cx"> exec, newLength, throwException,
</span><span class="cx"> ensureArrayStorage(exec->vm()));
</span><span class="cx"> }
</span><del>- if (newLength > butterfly->publicLength()) {
</del><ins>+ if (newLength > m_butterfly->publicLength()) {
</ins><span class="cx"> ensureLength(exec->vm(), newLength);
</span><span class="cx"> return true;
</span><span class="cx"> }
</span><span class="cx">
</span><del>- unsigned lengthToClear = butterfly->publicLength() - newLength;
</del><ins>+ unsigned lengthToClear = m_butterfly->publicLength() - newLength;
</ins><span class="cx"> unsigned costToAllocateNewButterfly = 64; // a heuristic.
</span><span class="cx"> if (lengthToClear > newLength && lengthToClear > costToAllocateNewButterfly) {
</span><span class="cx"> reallocateAndShrinkButterfly(exec->vm(), newLength);
</span><span class="lines">@@ -431,13 +430,13 @@
</span><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> if (indexingType() == ArrayWithDouble) {
</span><del>- for (unsigned i = butterfly->publicLength(); i-- > newLength;)
- butterfly->contiguousDouble()[i] = PNaN;
</del><ins>+ for (unsigned i = m_butterfly->publicLength(); i-- > newLength;)
+ m_butterfly->contiguousDouble()[i] = PNaN;
</ins><span class="cx"> } else {
</span><del>- for (unsigned i = butterfly->publicLength(); i-- > newLength;)
- butterfly->contiguous()[i].clear();
</del><ins>+ for (unsigned i = m_butterfly->publicLength(); i-- > newLength;)
+ m_butterfly->contiguous()[i].clear();
</ins><span class="cx"> }
</span><del>- butterfly->setPublicLength(newLength);
</del><ins>+ m_butterfly->setPublicLength(newLength);
</ins><span class="cx"> return true;
</span><span class="cx"> }
</span><span class="cx">
</span><span class="lines">@@ -453,53 +452,51 @@
</span><span class="cx">
</span><span class="cx"> JSValue JSArray::pop(ExecState* exec)
</span><span class="cx"> {
</span><del>- Butterfly* butterfly = m_butterfly.get(this);
-
</del><span class="cx"> switch (indexingType()) {
</span><span class="cx"> case ArrayClass:
</span><span class="cx"> return jsUndefined();
</span><span class="cx">
</span><span class="cx"> case ArrayWithUndecided:
</span><del>- if (!butterfly->publicLength())
</del><ins>+ if (!m_butterfly->publicLength())
</ins><span class="cx"> return jsUndefined();
</span><span class="cx"> // We have nothing but holes. So, drop down to the slow version.
</span><span class="cx"> break;
</span><span class="cx">
</span><span class="cx"> case ArrayWithInt32:
</span><span class="cx"> case ArrayWithContiguous: {
</span><del>- unsigned length = butterfly->publicLength();
</del><ins>+ unsigned length = m_butterfly->publicLength();
</ins><span class="cx">
</span><span class="cx"> if (!length--)
</span><span class="cx"> return jsUndefined();
</span><span class="cx">
</span><del>- RELEASE_ASSERT(length < butterfly->vectorLength());
- JSValue value = butterfly->contiguous()[length].get();
</del><ins>+ RELEASE_ASSERT(length < m_butterfly->vectorLength());
+ JSValue value = m_butterfly->contiguous()[length].get();
</ins><span class="cx"> if (value) {
</span><del>- butterfly->contiguous()[length].clear();
- butterfly->setPublicLength(length);
</del><ins>+ m_butterfly->contiguous()[length].clear();
+ m_butterfly->setPublicLength(length);
</ins><span class="cx"> return value;
</span><span class="cx"> }
</span><span class="cx"> break;
</span><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> case ArrayWithDouble: {
</span><del>- unsigned length = butterfly->publicLength();
</del><ins>+ unsigned length = m_butterfly->publicLength();
</ins><span class="cx">
</span><span class="cx"> if (!length--)
</span><span class="cx"> return jsUndefined();
</span><span class="cx">
</span><del>- RELEASE_ASSERT(length < butterfly->vectorLength());
- double value = butterfly->contiguousDouble()[length];
</del><ins>+ RELEASE_ASSERT(length < m_butterfly->vectorLength());
+ double value = m_butterfly->contiguousDouble()[length];
</ins><span class="cx"> if (value == value) {
</span><del>- butterfly->contiguousDouble()[length] = PNaN;
- butterfly->setPublicLength(length);
</del><ins>+ m_butterfly->contiguousDouble()[length] = PNaN;
+ m_butterfly->setPublicLength(length);
</ins><span class="cx"> return JSValue(JSValue::EncodeAsDouble, value);
</span><span class="cx"> }
</span><span class="cx"> break;
</span><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> case ARRAY_WITH_ARRAY_STORAGE_INDEXING_TYPES: {
</span><del>- ArrayStorage* storage = butterfly->arrayStorage();
</del><ins>+ ArrayStorage* storage = m_butterfly->arrayStorage();
</ins><span class="cx">
</span><span class="cx"> unsigned length = storage->length();
</span><span class="cx"> if (!length) {
</span><span class="lines">@@ -550,8 +547,6 @@
</span><span class="cx"> // - pushing to an array of length 2^32-1 stores the property, but throws a range error.
</span><span class="cx"> void JSArray::push(ExecState* exec, JSValue value)
</span><span class="cx"> {
</span><del>- Butterfly* butterfly = m_butterfly.get(this);
-
</del><span class="cx"> switch (indexingType()) {
</span><span class="cx"> case ArrayClass: {
</span><span class="cx"> createInitialUndecided(exec->vm(), 0);
</span><span class="lines">@@ -571,11 +566,11 @@
</span><span class="cx"> return;
</span><span class="cx"> }
</span><span class="cx">
</span><del>- unsigned length = butterfly->publicLength();
- ASSERT(length <= butterfly->vectorLength());
- if (length < butterfly->vectorLength()) {
- butterfly->contiguousInt32()[length].setWithoutWriteBarrier(value);
- butterfly->setPublicLength(length + 1);
</del><ins>+ unsigned length = m_butterfly->publicLength();
+ ASSERT(length <= m_butterfly->vectorLength());
+ if (length < m_butterfly->vectorLength()) {
+ m_butterfly->contiguousInt32()[length].setWithoutWriteBarrier(value);
+ m_butterfly->setPublicLength(length + 1);
</ins><span class="cx"> return;
</span><span class="cx"> }
</span><span class="cx">
</span><span class="lines">@@ -591,11 +586,11 @@
</span><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> case ArrayWithContiguous: {
</span><del>- unsigned length = butterfly->publicLength();
- ASSERT(length <= butterfly->vectorLength());
- if (length < butterfly->vectorLength()) {
- butterfly->contiguous()[length].set(exec->vm(), this, value);
- butterfly->setPublicLength(length + 1);
</del><ins>+ unsigned length = m_butterfly->publicLength();
+ ASSERT(length <= m_butterfly->vectorLength());
+ if (length < m_butterfly->vectorLength()) {
+ m_butterfly->contiguous()[length].set(exec->vm(), this, value);
+ m_butterfly->setPublicLength(length + 1);
</ins><span class="cx"> return;
</span><span class="cx"> }
</span><span class="cx">
</span><span class="lines">@@ -623,11 +618,11 @@
</span><span class="cx"> return;
</span><span class="cx"> }
</span><span class="cx">
</span><del>- unsigned length = butterfly->publicLength();
- ASSERT(length <= butterfly->vectorLength());
- if (length < butterfly->vectorLength()) {
- butterfly->contiguousDouble()[length] = valueAsDouble;
- butterfly->setPublicLength(length + 1);
</del><ins>+ unsigned length = m_butterfly->publicLength();
+ ASSERT(length <= m_butterfly->vectorLength());
+ if (length < m_butterfly->vectorLength()) {
+ m_butterfly->contiguousDouble()[length] = valueAsDouble;
+ m_butterfly->setPublicLength(length + 1);
</ins><span class="cx"> return;
</span><span class="cx"> }
</span><span class="cx">
</span><span class="lines">@@ -653,7 +648,7 @@
</span><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> case ArrayWithArrayStorage: {
</span><del>- ArrayStorage* storage = butterfly->arrayStorage();
</del><ins>+ ArrayStorage* storage = m_butterfly->arrayStorage();
</ins><span class="cx">
</span><span class="cx"> // Fast case - push within vector, always update m_length & m_numValuesInVector.
</span><span class="cx"> unsigned length = storage->length();
</span><span class="lines">@@ -701,9 +696,9 @@
</span><span class="cx">
</span><span class="cx"> auto& resultButterfly = *resultArray->butterfly();
</span><span class="cx"> if (arrayType == ArrayWithDouble)
</span><del>- memcpy(resultButterfly.contiguousDouble().data(), m_butterfly.get(this)->contiguousDouble().data() + startIndex, sizeof(JSValue) * count);
</del><ins>+ memcpy(resultButterfly.contiguousDouble().data(), m_butterfly->contiguousDouble().data() + startIndex, sizeof(JSValue) * count);
</ins><span class="cx"> else
</span><del>- memcpy(resultButterfly.contiguous().data(), m_butterfly.get(this)->contiguous().data() + startIndex, sizeof(JSValue) * count);
</del><ins>+ memcpy(resultButterfly.contiguous().data(), m_butterfly->contiguous().data() + startIndex, sizeof(JSValue) * count);
</ins><span class="cx"> resultButterfly.setPublicLength(count);
</span><span class="cx">
</span><span class="cx"> return resultArray;
</span><span class="lines">@@ -720,8 +715,8 @@
</span><span class="cx"> VM& vm = exec.vm();
</span><span class="cx"> ASSERT(newArrayType == fastConcatType(vm, *this, otherArray));
</span><span class="cx">
</span><del>- unsigned thisArraySize = m_butterfly.get(this)->publicLength();
- unsigned otherArraySize = otherArray.m_butterfly.get(this)->publicLength();
</del><ins>+ unsigned thisArraySize = m_butterfly->publicLength();
+ unsigned otherArraySize = otherArray.m_butterfly->publicLength();
</ins><span class="cx"> ASSERT(thisArraySize + otherArraySize < MIN_SPARSE_ARRAY_INDEX);
</span><span class="cx">
</span><span class="cx"> Structure* resultStructure = exec.lexicalGlobalObject()->arrayStructureForIndexingTypeDuringAllocation(newArrayType);
</span><span class="lines">@@ -733,11 +728,11 @@
</span><span class="cx"> auto& otherButterfly = *otherArray.butterfly();
</span><span class="cx"> if (newArrayType == ArrayWithDouble) {
</span><span class="cx"> auto buffer = resultButterfly.contiguousDouble().data();
</span><del>- memcpy(buffer, m_butterfly.get(this)->contiguousDouble().data(), sizeof(JSValue) * thisArraySize);
</del><ins>+ memcpy(buffer, m_butterfly->contiguousDouble().data(), sizeof(JSValue) * thisArraySize);
</ins><span class="cx"> memcpy(buffer + thisArraySize, otherButterfly.contiguousDouble().data(), sizeof(JSValue) * otherArraySize);
</span><span class="cx"> } else {
</span><span class="cx"> auto buffer = resultButterfly.contiguous().data();
</span><del>- memcpy(buffer, m_butterfly.get(this)->contiguous().data(), sizeof(JSValue) * thisArraySize);
</del><ins>+ memcpy(buffer, m_butterfly->contiguous().data(), sizeof(JSValue) * thisArraySize);
</ins><span class="cx"> memcpy(buffer + thisArraySize, otherButterfly.contiguous().data(), sizeof(JSValue) * otherArraySize);
</span><span class="cx"> }
</span><span class="cx">
</span><span class="lines">@@ -810,9 +805,8 @@
</span><span class="cx"> // Adjust the Butterfly and the index bias. We only need to do this here because we're changing
</span><span class="cx"> // the start of the Butterfly, which needs to point at the first indexed property in the used
</span><span class="cx"> // portion of the vector.
</span><del>- Butterfly* butterfly = m_butterfly.get(this)->shift(structure(), count);
- m_butterfly.setWithoutBarrier(butterfly);
- storage = butterfly->arrayStorage();
</del><ins>+ m_butterfly.setWithoutWriteBarrier(m_butterfly->shift(structure(), count));
+ storage = m_butterfly->arrayStorage();
</ins><span class="cx"> storage->m_indexBias += count;
</span><span class="cx">
</span><span class="cx"> // Since we're consuming part of the vector by moving its beginning to the left,
</span><span class="lines">@@ -854,8 +848,6 @@
</span><span class="cx"> {
</span><span class="cx"> VM& vm = exec->vm();
</span><span class="cx"> RELEASE_ASSERT(count > 0);
</span><del>-
- Butterfly* butterfly = m_butterfly.get(this);
</del><span class="cx">
</span><span class="cx"> switch (indexingType()) {
</span><span class="cx"> case ArrayClass:
</span><span class="lines">@@ -867,7 +859,7 @@
</span><span class="cx">
</span><span class="cx"> case ArrayWithInt32:
</span><span class="cx"> case ArrayWithContiguous: {
</span><del>- unsigned oldLength = butterfly->publicLength();
</del><ins>+ unsigned oldLength = m_butterfly->publicLength();
</ins><span class="cx"> RELEASE_ASSERT(count <= oldLength);
</span><span class="cx">
</span><span class="cx"> // We may have to walk the entire array to do the shift. We're willing to do
</span><span class="lines">@@ -882,28 +874,28 @@
</span><span class="cx"> unsigned end = oldLength - count;
</span><span class="cx"> if (this->structure(vm)->holesMustForwardToPrototype(vm)) {
</span><span class="cx"> for (unsigned i = startIndex; i < end; ++i) {
</span><del>- JSValue v = butterfly->contiguous()[i + count].get();
</del><ins>+ JSValue v = m_butterfly->contiguous()[i + count].get();
</ins><span class="cx"> if (UNLIKELY(!v)) {
</span><span class="cx"> startIndex = i;
</span><span class="cx"> return shiftCountWithArrayStorage(vm, startIndex, count, ensureArrayStorage(vm));
</span><span class="cx"> }
</span><del>- butterfly->contiguous()[i].setWithoutWriteBarrier(v);
</del><ins>+ m_butterfly->contiguous()[i].setWithoutWriteBarrier(v);
</ins><span class="cx"> }
</span><span class="cx"> } else {
</span><del>- memmove(butterfly->contiguous().data() + startIndex,
- butterfly->contiguous().data() + startIndex + count,
</del><ins>+ memmove(m_butterfly->contiguous().data() + startIndex,
+ m_butterfly->contiguous().data() + startIndex + count,
</ins><span class="cx"> sizeof(JSValue) * (end - startIndex));
</span><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> for (unsigned i = end; i < oldLength; ++i)
</span><del>- butterfly->contiguous()[i].clear();
</del><ins>+ m_butterfly->contiguous()[i].clear();
</ins><span class="cx">
</span><del>- butterfly->setPublicLength(oldLength - count);
</del><ins>+ m_butterfly->setPublicLength(oldLength - count);
</ins><span class="cx"> return true;
</span><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> case ArrayWithDouble: {
</span><del>- unsigned oldLength = butterfly->publicLength();
</del><ins>+ unsigned oldLength = m_butterfly->publicLength();
</ins><span class="cx"> RELEASE_ASSERT(count <= oldLength);
</span><span class="cx">
</span><span class="cx"> // We may have to walk the entire array to do the shift. We're willing to do
</span><span class="lines">@@ -918,22 +910,22 @@
</span><span class="cx"> unsigned end = oldLength - count;
</span><span class="cx"> if (this->structure(vm)->holesMustForwardToPrototype(vm)) {
</span><span class="cx"> for (unsigned i = startIndex; i < end; ++i) {
</span><del>- double v = butterfly->contiguousDouble()[i + count];
</del><ins>+ double v = m_butterfly->contiguousDouble()[i + count];
</ins><span class="cx"> if (UNLIKELY(v != v)) {
</span><span class="cx"> startIndex = i;
</span><span class="cx"> return shiftCountWithArrayStorage(vm, startIndex, count, ensureArrayStorage(vm));
</span><span class="cx"> }
</span><del>- butterfly->contiguousDouble()[i] = v;
</del><ins>+ m_butterfly->contiguousDouble()[i] = v;
</ins><span class="cx"> }
</span><span class="cx"> } else {
</span><del>- memmove(butterfly->contiguousDouble().data() + startIndex,
- butterfly->contiguousDouble().data() + startIndex + count,
</del><ins>+ memmove(m_butterfly->contiguousDouble().data() + startIndex,
+ m_butterfly->contiguousDouble().data() + startIndex + count,
</ins><span class="cx"> sizeof(JSValue) * (end - startIndex));
</span><span class="cx"> }
</span><span class="cx"> for (unsigned i = end; i < oldLength; ++i)
</span><del>- butterfly->contiguousDouble()[i] = PNaN;
</del><ins>+ m_butterfly->contiguousDouble()[i] = PNaN;
</ins><span class="cx">
</span><del>- butterfly->setPublicLength(oldLength - count);
</del><ins>+ m_butterfly->setPublicLength(oldLength - count);
</ins><span class="cx"> return true;
</span><span class="cx"> }
</span><span class="cx">
</span><span class="lines">@@ -994,8 +986,6 @@
</span><span class="cx">
</span><span class="cx"> bool JSArray::unshiftCountWithAnyIndexingType(ExecState* exec, unsigned startIndex, unsigned count)
</span><span class="cx"> {
</span><del>- Butterfly* butterfly = m_butterfly.get(this);
-
</del><span class="cx"> switch (indexingType()) {
</span><span class="cx"> case ArrayClass:
</span><span class="cx"> case ArrayWithUndecided:
</span><span class="lines">@@ -1004,7 +994,7 @@
</span><span class="cx">
</span><span class="cx"> case ArrayWithInt32:
</span><span class="cx"> case ArrayWithContiguous: {
</span><del>- unsigned oldLength = butterfly->publicLength();
</del><ins>+ unsigned oldLength = m_butterfly->publicLength();
</ins><span class="cx">
</span><span class="cx"> // We may have to walk the entire array to do the unshift. We're willing to do so
</span><span class="cx"> // only if it's not horribly slow.
</span><span class="lines">@@ -1012,20 +1002,19 @@
</span><span class="cx"> return unshiftCountWithArrayStorage(exec, startIndex, count, ensureArrayStorage(exec->vm()));
</span><span class="cx">
</span><span class="cx"> ensureLength(exec->vm(), oldLength + count);
</span><del>- butterfly = m_butterfly.get(this);
</del><span class="cx">
</span><span class="cx"> // We have to check for holes before we start moving things around so that we don't get halfway
</span><span class="cx"> // through shifting and then realize we should have been in ArrayStorage mode.
</span><span class="cx"> for (unsigned i = oldLength; i-- > startIndex;) {
</span><del>- JSValue v = butterfly->contiguous()[i].get();
</del><ins>+ JSValue v = m_butterfly->contiguous()[i].get();
</ins><span class="cx"> if (UNLIKELY(!v))
</span><span class="cx"> return unshiftCountWithArrayStorage(exec, startIndex, count, ensureArrayStorage(exec->vm()));
</span><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> for (unsigned i = oldLength; i-- > startIndex;) {
</span><del>- JSValue v = butterfly->contiguous()[i].get();
</del><ins>+ JSValue v = m_butterfly->contiguous()[i].get();
</ins><span class="cx"> ASSERT(v);
</span><del>- butterfly->contiguous()[i + count].setWithoutWriteBarrier(v);
</del><ins>+ m_butterfly->contiguous()[i + count].setWithoutWriteBarrier(v);
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> // NOTE: we're leaving being garbage in the part of the array that we shifted out
</span><span class="lines">@@ -1037,7 +1026,7 @@
</span><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> case ArrayWithDouble: {
</span><del>- unsigned oldLength = butterfly->publicLength();
</del><ins>+ unsigned oldLength = m_butterfly->publicLength();
</ins><span class="cx">
</span><span class="cx"> // We may have to walk the entire array to do the unshift. We're willing to do so
</span><span class="cx"> // only if it's not horribly slow.
</span><span class="lines">@@ -1045,20 +1034,19 @@
</span><span class="cx"> return unshiftCountWithArrayStorage(exec, startIndex, count, ensureArrayStorage(exec->vm()));
</span><span class="cx">
</span><span class="cx"> ensureLength(exec->vm(), oldLength + count);
</span><del>- butterfly = m_butterfly.get(this);
</del><span class="cx">
</span><span class="cx"> // We have to check for holes before we start moving things around so that we don't get halfway
</span><span class="cx"> // through shifting and then realize we should have been in ArrayStorage mode.
</span><span class="cx"> for (unsigned i = oldLength; i-- > startIndex;) {
</span><del>- double v = butterfly->contiguousDouble()[i];
</del><ins>+ double v = m_butterfly->contiguousDouble()[i];
</ins><span class="cx"> if (UNLIKELY(v != v))
</span><span class="cx"> return unshiftCountWithArrayStorage(exec, startIndex, count, ensureArrayStorage(exec->vm()));
</span><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> for (unsigned i = oldLength; i-- > startIndex;) {
</span><del>- double v = butterfly->contiguousDouble()[i];
</del><ins>+ double v = m_butterfly->contiguousDouble()[i];
</ins><span class="cx"> ASSERT(v == v);
</span><del>- butterfly->contiguousDouble()[i + count] = v;
</del><ins>+ m_butterfly->contiguousDouble()[i + count] = v;
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> // NOTE: we're leaving being garbage in the part of the array that we shifted out
</span><span class="lines">@@ -1084,8 +1072,6 @@
</span><span class="cx"> unsigned i = 0;
</span><span class="cx"> unsigned vectorEnd;
</span><span class="cx"> WriteBarrier<Unknown>* vector;
</span><del>-
- Butterfly* butterfly = m_butterfly.get(this);
</del><span class="cx">
</span><span class="cx"> switch (indexingType()) {
</span><span class="cx"> case ArrayClass:
</span><span class="lines">@@ -1099,16 +1085,16 @@
</span><span class="cx">
</span><span class="cx"> case ArrayWithInt32:
</span><span class="cx"> case ArrayWithContiguous: {
</span><del>- vectorEnd = butterfly->publicLength();
- vector = butterfly->contiguous().data();
</del><ins>+ vectorEnd = m_butterfly->publicLength();
+ vector = m_butterfly->contiguous().data();
</ins><span class="cx"> break;
</span><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> case ArrayWithDouble: {
</span><span class="cx"> vector = 0;
</span><span class="cx"> vectorEnd = 0;
</span><del>- for (; i < butterfly->publicLength(); ++i) {
- double v = butterfly->contiguousDouble()[i];
</del><ins>+ for (; i < m_butterfly->publicLength(); ++i) {
+ double v = butterfly()->contiguousDouble()[i];
</ins><span class="cx"> if (v != v)
</span><span class="cx"> break;
</span><span class="cx"> args.append(JSValue(JSValue::EncodeAsDouble, v));
</span><span class="lines">@@ -1117,7 +1103,7 @@
</span><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> case ARRAY_WITH_ARRAY_STORAGE_INDEXING_TYPES: {
</span><del>- ArrayStorage* storage = butterfly->arrayStorage();
</del><ins>+ ArrayStorage* storage = m_butterfly->arrayStorage();
</ins><span class="cx">
</span><span class="cx"> vector = storage->m_vector;
</span><span class="cx"> vectorEnd = min(storage->length(), storage->vectorLength());
</span><span class="lines">@@ -1155,8 +1141,6 @@
</span><span class="cx"> // FIXME: What prevents this from being called with a RuntimeArray? The length function will always return 0 in that case.
</span><span class="cx"> ASSERT(length == this->length());
</span><span class="cx">
</span><del>- Butterfly* butterfly = m_butterfly.get(this);
-
</del><span class="cx"> switch (indexingType()) {
</span><span class="cx"> case ArrayClass:
</span><span class="cx"> return;
</span><span class="lines">@@ -1169,17 +1153,17 @@
</span><span class="cx">
</span><span class="cx"> case ArrayWithInt32:
</span><span class="cx"> case ArrayWithContiguous: {
</span><del>- vector = butterfly->contiguous().data();
- vectorEnd = butterfly->publicLength();
</del><ins>+ vector = m_butterfly->contiguous().data();
+ vectorEnd = m_butterfly->publicLength();
</ins><span class="cx"> break;
</span><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> case ArrayWithDouble: {
</span><span class="cx"> vector = 0;
</span><span class="cx"> vectorEnd = 0;
</span><del>- for (; i < butterfly->publicLength(); ++i) {
- ASSERT(i < butterfly->vectorLength());
- double v = butterfly->contiguousDouble()[i];
</del><ins>+ for (; i < m_butterfly->publicLength(); ++i) {
+ ASSERT(i < butterfly()->vectorLength());
+ double v = m_butterfly->contiguousDouble()[i];
</ins><span class="cx"> if (v != v)
</span><span class="cx"> break;
</span><span class="cx"> exec->r(firstElementDest + i - offset) = JSValue(JSValue::EncodeAsDouble, v);
</span><span class="lines">@@ -1188,7 +1172,7 @@
</span><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> case ARRAY_WITH_ARRAY_STORAGE_INDEXING_TYPES: {
</span><del>- ArrayStorage* storage = butterfly->arrayStorage();
</del><ins>+ ArrayStorage* storage = m_butterfly->arrayStorage();
</ins><span class="cx"> vector = storage->m_vector;
</span><span class="cx"> vectorEnd = min(length, storage->vectorLength());
</span><span class="cx"> break;
</span></span></pre></div>
<a id="tagsSafari60217SourceJavaScriptCoreruntimeJSArrayBufferViewcpp"></a>
<div class="modfile"><h4>Modified: tags/Safari-602.1.7/Source/JavaScriptCore/runtime/JSArrayBufferView.cpp (191149 => 191150)</h4>
<pre class="diff"><span>
<span class="info">--- tags/Safari-602.1.7/Source/JavaScriptCore/runtime/JSArrayBufferView.cpp 2015-10-15 23:38:21 UTC (rev 191149)
+++ tags/Safari-602.1.7/Source/JavaScriptCore/runtime/JSArrayBufferView.cpp 2015-10-15 23:41:01 UTC (rev 191150)
</span><span class="lines">@@ -88,10 +88,10 @@
</span><span class="cx"> VM& vm, Structure* structure, PassRefPtr<ArrayBuffer> arrayBuffer,
</span><span class="cx"> unsigned byteOffset, unsigned length)
</span><span class="cx"> : m_structure(structure)
</span><ins>+ , m_vector(static_cast<uint8_t*>(arrayBuffer->data()) + byteOffset)
</ins><span class="cx"> , m_length(length)
</span><span class="cx"> , m_mode(WastefulTypedArray)
</span><span class="cx"> {
</span><del>- m_vector = static_cast<uint8_t*>(arrayBuffer->data()) + byteOffset;
</del><span class="cx"> IndexingHeader indexingHeader;
</span><span class="cx"> indexingHeader.setArrayBuffer(arrayBuffer.get());
</span><span class="cx"> m_butterfly = Butterfly::create(vm, 0, 0, 0, true, indexingHeader, 0);
</span><span class="lines">@@ -101,19 +101,19 @@
</span><span class="cx"> Structure* structure, PassRefPtr<ArrayBuffer> arrayBuffer,
</span><span class="cx"> unsigned byteOffset, unsigned length, DataViewTag)
</span><span class="cx"> : m_structure(structure)
</span><ins>+ , m_vector(static_cast<uint8_t*>(arrayBuffer->data()) + byteOffset)
</ins><span class="cx"> , m_length(length)
</span><span class="cx"> , m_mode(DataViewMode)
</span><span class="cx"> , m_butterfly(0)
</span><span class="cx"> {
</span><del>- m_vector = static_cast<uint8_t*>(arrayBuffer->data()) + byteOffset;
</del><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> JSArrayBufferView::JSArrayBufferView(VM& vm, ConstructionContext& context)
</span><span class="cx"> : Base(vm, context.structure(), context.butterfly())
</span><ins>+ , m_vector(context.vector())
</ins><span class="cx"> , m_length(context.length())
</span><span class="cx"> , m_mode(context.mode())
</span><span class="cx"> {
</span><del>- m_vector.setWithoutBarrier(static_cast<char*>(context.vector()));
</del><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> void JSArrayBufferView::finishCreation(VM& vm)
</span><span class="lines">@@ -215,7 +215,7 @@
</span><span class="cx"> JSArrayBufferView* thisObject = static_cast<JSArrayBufferView*>(cell);
</span><span class="cx"> ASSERT(thisObject->m_mode == OversizeTypedArray || thisObject->m_mode == WastefulTypedArray);
</span><span class="cx"> if (thisObject->m_mode == OversizeTypedArray)
</span><del>- fastFree(thisObject->m_vector.getWithoutBarrier());
</del><ins>+ fastFree(thisObject->m_vector);
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> } // namespace JSC
</span></span></pre></div>
<a id="tagsSafari60217SourceJavaScriptCoreruntimeJSArrayBufferViewh"></a>
<div class="modfile"><h4>Modified: tags/Safari-602.1.7/Source/JavaScriptCore/runtime/JSArrayBufferView.h (191149 => 191150)</h4>
<pre class="diff"><span>
<span class="info">--- tags/Safari-602.1.7/Source/JavaScriptCore/runtime/JSArrayBufferView.h 2015-10-15 23:38:21 UTC (rev 191149)
+++ tags/Safari-602.1.7/Source/JavaScriptCore/runtime/JSArrayBufferView.h 2015-10-15 23:41:01 UTC (rev 191150)
</span><span class="lines">@@ -161,7 +161,7 @@
</span><span class="cx"> PassRefPtr<ArrayBufferView> impl();
</span><span class="cx"> void neuter();
</span><span class="cx">
</span><del>- void* vector() { return m_vector.get(this); }
</del><ins>+ void* vector() { return m_vector; }
</ins><span class="cx"> unsigned byteOffset();
</span><span class="cx"> unsigned length() const { return m_length; }
</span><span class="cx">
</span><span class="lines">@@ -177,7 +177,7 @@
</span><span class="cx"> protected:
</span><span class="cx"> ArrayBuffer* existingBufferInButterfly();
</span><span class="cx">
</span><del>- CopyBarrier<char> m_vector; // this is really a void*, but void would not work here.
</del><ins>+ void* m_vector;
</ins><span class="cx"> uint32_t m_length;
</span><span class="cx"> TypedArrayMode m_mode;
</span><span class="cx"> };
</span></span></pre></div>
<a id="tagsSafari60217SourceJavaScriptCoreruntimeJSArrayBufferViewInlinesh"></a>
<div class="modfile"><h4>Modified: tags/Safari-602.1.7/Source/JavaScriptCore/runtime/JSArrayBufferViewInlines.h (191149 => 191150)</h4>
<pre class="diff"><span>
<span class="info">--- tags/Safari-602.1.7/Source/JavaScriptCore/runtime/JSArrayBufferViewInlines.h 2015-10-15 23:38:21 UTC (rev 191149)
+++ tags/Safari-602.1.7/Source/JavaScriptCore/runtime/JSArrayBufferViewInlines.h 2015-10-15 23:41:01 UTC (rev 191150)
</span><span class="lines">@@ -59,7 +59,7 @@
</span><span class="cx"> {
</span><span class="cx"> ASSERT(hasArrayBuffer());
</span><span class="cx"> m_length = 0;
</span><del>- m_vector.clear();
</del><ins>+ m_vector = 0;
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> inline unsigned JSArrayBufferView::byteOffset()
</span><span class="lines">@@ -68,7 +68,7 @@
</span><span class="cx"> return 0;
</span><span class="cx">
</span><span class="cx"> ptrdiff_t delta =
</span><del>- bitwise_cast<uint8_t*>(m_vector.get(this)) - static_cast<uint8_t*>(buffer()->data());
</del><ins>+ static_cast<uint8_t*>(m_vector) - static_cast<uint8_t*>(buffer()->data());
</ins><span class="cx">
</span><span class="cx"> unsigned result = static_cast<unsigned>(delta);
</span><span class="cx"> ASSERT(static_cast<ptrdiff_t>(result) == delta);
</span></span></pre></div>
<a id="tagsSafari60217SourceJavaScriptCoreruntimeJSGenericTypedArrayViewh"></a>
<div class="modfile"><h4>Modified: tags/Safari-602.1.7/Source/JavaScriptCore/runtime/JSGenericTypedArrayView.h (191149 => 191150)</h4>
<pre class="diff"><span>
<span class="info">--- tags/Safari-602.1.7/Source/JavaScriptCore/runtime/JSGenericTypedArrayView.h 2015-10-15 23:38:21 UTC (rev 191149)
+++ tags/Safari-602.1.7/Source/JavaScriptCore/runtime/JSGenericTypedArrayView.h 2015-10-15 23:41:01 UTC (rev 191150)
</span><span class="lines">@@ -108,11 +108,11 @@
</span><span class="cx">
</span><span class="cx"> const typename Adaptor::Type* typedVector() const
</span><span class="cx"> {
</span><del>- return bitwise_cast<const typename Adaptor::Type*>(m_vector.get(this));
</del><ins>+ return static_cast<const typename Adaptor::Type*>(m_vector);
</ins><span class="cx"> }
</span><span class="cx"> typename Adaptor::Type* typedVector()
</span><span class="cx"> {
</span><del>- return bitwise_cast<typename Adaptor::Type*>(m_vector.get(this));
</del><ins>+ return static_cast<typename Adaptor::Type*>(m_vector);
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> // These methods are meant to match indexed access methods that JSObject
</span></span></pre></div>
<a id="tagsSafari60217SourceJavaScriptCoreruntimeJSGenericTypedArrayViewInlinesh"></a>
<div class="modfile"><h4>Modified: tags/Safari-602.1.7/Source/JavaScriptCore/runtime/JSGenericTypedArrayViewInlines.h (191149 => 191150)</h4>
<pre class="diff"><span>
<span class="info">--- tags/Safari-602.1.7/Source/JavaScriptCore/runtime/JSGenericTypedArrayViewInlines.h 2015-10-15 23:38:21 UTC (rev 191149)
+++ tags/Safari-602.1.7/Source/JavaScriptCore/runtime/JSGenericTypedArrayViewInlines.h 2015-10-15 23:41:01 UTC (rev 191150)
</span><span class="lines">@@ -441,7 +441,7 @@
</span><span class="cx"> switch (thisObject->m_mode) {
</span><span class="cx"> case FastTypedArray: {
</span><span class="cx"> if (thisObject->m_vector)
</span><del>- visitor.copyLater(thisObject, TypedArrayVectorCopyToken, thisObject->m_vector.getWithoutBarrier(), thisObject->byteSize());
</del><ins>+ visitor.copyLater(thisObject, TypedArrayVectorCopyToken, thisObject->m_vector, thisObject->byteSize());
</ins><span class="cx"> break;
</span><span class="cx"> }
</span><span class="cx">
</span><span class="lines">@@ -468,12 +468,12 @@
</span><span class="cx"> JSGenericTypedArrayView* thisObject = jsCast<JSGenericTypedArrayView*>(cell);
</span><span class="cx">
</span><span class="cx"> if (token == TypedArrayVectorCopyToken
</span><del>- && visitor.checkIfShouldCopy(thisObject->m_vector.getWithoutBarrier())) {
</del><ins>+ && visitor.checkIfShouldCopy(thisObject->m_vector)) {
</ins><span class="cx"> ASSERT(thisObject->m_vector);
</span><del>- void* oldVector = thisObject->m_vector.get(thisObject);
</del><ins>+ void* oldVector = thisObject->m_vector;
</ins><span class="cx"> void* newVector = visitor.allocateNewSpace(thisObject->byteSize());
</span><span class="cx"> memcpy(newVector, oldVector, thisObject->byteSize());
</span><del>- thisObject->m_vector.setWithoutBarrier(static_cast<char*>(newVector));
</del><ins>+ thisObject->m_vector = newVector;
</ins><span class="cx"> visitor.didCopy(oldVector, thisObject->byteSize());
</span><span class="cx"> }
</span><span class="cx">
</span><span class="lines">@@ -508,8 +508,8 @@
</span><span class="cx"> && !thisObject->butterfly() && size >= sizeof(IndexingHeader)) {
</span><span class="cx"> ASSERT(thisObject->m_vector);
</span><span class="cx"> // Reuse already allocated memory if at all possible.
</span><del>- thisObject->m_butterfly.setWithoutBarrier(
- bitwise_cast<IndexingHeader*>(thisObject->m_vector.get(thisObject))->butterfly());
</del><ins>+ thisObject->m_butterfly.setWithoutWriteBarrier(
+ static_cast<IndexingHeader*>(thisObject->m_vector)->butterfly());
</ins><span class="cx"> } else {
</span><span class="cx"> VM& vm = *heap->vm();
</span><span class="cx"> thisObject->m_butterfly.set(vm, thisObject, Butterfly::createOrGrowArrayRight(
</span><span class="lines">@@ -521,14 +521,14 @@
</span><span class="cx">
</span><span class="cx"> switch (thisObject->m_mode) {
</span><span class="cx"> case FastTypedArray:
</span><del>- buffer = ArrayBuffer::create(thisObject->m_vector.get(thisObject), thisObject->byteLength());
</del><ins>+ buffer = ArrayBuffer::create(thisObject->m_vector, thisObject->byteLength());
</ins><span class="cx"> break;
</span><span class="cx">
</span><span class="cx"> case OversizeTypedArray:
</span><span class="cx"> // FIXME: consider doing something like "subtracting" from extra memory
</span><span class="cx"> // cost, since right now this case will cause the GC to think that we reallocated
</span><span class="cx"> // the whole buffer.
</span><del>- buffer = ArrayBuffer::createAdopted(thisObject->m_vector.get(thisObject), thisObject->byteLength());
</del><ins>+ buffer = ArrayBuffer::createAdopted(thisObject->m_vector, thisObject->byteLength());
</ins><span class="cx"> break;
</span><span class="cx">
</span><span class="cx"> default:
</span><span class="lines">@@ -537,7 +537,7 @@
</span><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> thisObject->butterfly()->indexingHeader()->setArrayBuffer(buffer.get());
</span><del>- thisObject->m_vector.setWithoutBarrier(static_cast<char*>(buffer->data()));
</del><ins>+ thisObject->m_vector = buffer->data();
</ins><span class="cx"> thisObject->m_mode = WastefulTypedArray;
</span><span class="cx"> heap->addReference(thisObject, buffer.get());
</span><span class="cx">
</span></span></pre></div>
<a id="tagsSafari60217SourceJavaScriptCoreruntimeJSMaph"></a>
<div class="modfile"><h4>Modified: tags/Safari-602.1.7/Source/JavaScriptCore/runtime/JSMap.h (191149 => 191150)</h4>
<pre class="diff"><span>
<span class="info">--- tags/Safari-602.1.7/Source/JavaScriptCore/runtime/JSMap.h 2015-10-15 23:38:21 UTC (rev 191149)
+++ tags/Safari-602.1.7/Source/JavaScriptCore/runtime/JSMap.h 2015-10-15 23:41:01 UTC (rev 191150)
</span><span class="lines">@@ -117,7 +117,7 @@
</span><span class="cx"> private:
</span><span class="cx"> JSMap(VM& vm, Structure* structure)
</span><span class="cx"> : Base(vm, structure)
</span><del>- , m_mapData(vm, this)
</del><ins>+ , m_mapData(vm)
</ins><span class="cx"> {
</span><span class="cx"> }
</span><span class="cx">
</span></span></pre></div>
<a id="tagsSafari60217SourceJavaScriptCoreruntimeJSObjectcpp"></a>
<div class="modfile"><h4>Modified: tags/Safari-602.1.7/Source/JavaScriptCore/runtime/JSObject.cpp (191149 => 191150)</h4>
<pre class="diff"><span>
<span class="info">--- tags/Safari-602.1.7/Source/JavaScriptCore/runtime/JSObject.cpp 2015-10-15 23:38:21 UTC (rev 191149)
+++ tags/Safari-602.1.7/Source/JavaScriptCore/runtime/JSObject.cpp 2015-10-15 23:41:01 UTC (rev 191150)
</span><span class="lines">@@ -150,7 +150,7 @@
</span><span class="cx"> memcpy(currentTarget, currentSource, count * sizeof(EncodedJSValue));
</span><span class="cx"> }
</span><span class="cx">
</span><del>- m_butterfly.setWithoutBarrier(newButterfly);
</del><ins>+ m_butterfly.setWithoutWriteBarrier(newButterfly);
</ins><span class="cx"> visitor.didCopy(butterfly->base(preCapacity, propertyCapacity), capacityInBytes);
</span><span class="cx"> }
</span><span class="cx"> }
</span><span class="lines">@@ -206,7 +206,7 @@
</span><span class="cx">
</span><span class="cx"> JSCell::visitChildren(thisObject, visitor);
</span><span class="cx">
</span><del>- Butterfly* butterfly = thisObject->m_butterfly.getWithoutBarrier();
</del><ins>+ Butterfly* butterfly = thisObject->butterfly();
</ins><span class="cx"> if (butterfly)
</span><span class="cx"> thisObject->visitButterfly(visitor, butterfly, thisObject->structure(visitor.vm())->outOfLineSize());
</span><span class="cx">
</span><span class="lines">@@ -223,7 +223,7 @@
</span><span class="cx"> if (token != ButterflyCopyToken)
</span><span class="cx"> return;
</span><span class="cx">
</span><del>- Butterfly* butterfly = thisObject->m_butterfly.getWithoutBarrier();
</del><ins>+ Butterfly* butterfly = thisObject->butterfly();
</ins><span class="cx"> if (butterfly)
</span><span class="cx"> thisObject->copyButterfly(visitor, butterfly, thisObject->structure()->outOfLineSize());
</span><span class="cx"> }
</span><span class="lines">@@ -341,7 +341,7 @@
</span><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> case ALL_ARRAY_STORAGE_INDEXING_TYPES: {
</span><del>- ArrayStorage* storage = thisObject->m_butterfly.get(thisObject)->arrayStorage();
</del><ins>+ ArrayStorage* storage = thisObject->m_butterfly->arrayStorage();
</ins><span class="cx"> if (i >= storage->length())
</span><span class="cx"> return false;
</span><span class="cx">
</span><span class="lines">@@ -514,7 +514,7 @@
</span><span class="cx">
</span><span class="cx"> case NonArrayWithArrayStorage:
</span><span class="cx"> case ArrayWithArrayStorage: {
</span><del>- ArrayStorage* storage = thisObject->m_butterfly.get(thisObject)->arrayStorage();
</del><ins>+ ArrayStorage* storage = thisObject->m_butterfly->arrayStorage();
</ins><span class="cx">
</span><span class="cx"> if (propertyName >= storage->vectorLength())
</span><span class="cx"> break;
</span><span class="lines">@@ -536,7 +536,7 @@
</span><span class="cx">
</span><span class="cx"> case NonArrayWithSlowPutArrayStorage:
</span><span class="cx"> case ArrayWithSlowPutArrayStorage: {
</span><del>- ArrayStorage* storage = thisObject->m_butterfly.get(thisObject)->arrayStorage();
</del><ins>+ ArrayStorage* storage = thisObject->m_butterfly->arrayStorage();
</ins><span class="cx">
</span><span class="cx"> if (propertyName >= storage->vectorLength())
</span><span class="cx"> break;
</span><span class="lines">@@ -613,7 +613,7 @@
</span><span class="cx"> enterDictionaryIndexingModeWhenArrayStorageAlreadyExists(vm, ensureArrayStorageSlow(vm));
</span><span class="cx"> break;
</span><span class="cx"> case ALL_ARRAY_STORAGE_INDEXING_TYPES:
</span><del>- enterDictionaryIndexingModeWhenArrayStorageAlreadyExists(vm, m_butterfly.get(this)->arrayStorage());
</del><ins>+ enterDictionaryIndexingModeWhenArrayStorageAlreadyExists(vm, m_butterfly->arrayStorage());
</ins><span class="cx"> break;
</span><span class="cx">
</span><span class="cx"> default:
</span><span class="lines">@@ -643,7 +643,7 @@
</span><span class="cx"> ASSERT(!indexingShouldBeSparse());
</span><span class="cx"> unsigned vectorLength = std::max(length, BASE_VECTOR_LEN);
</span><span class="cx"> Butterfly* newButterfly = Butterfly::createOrGrowArrayRight(
</span><del>- m_butterfly.get(this), vm, this, structure(), structure()->outOfLineCapacity(), false, 0,
</del><ins>+ m_butterfly.get(), vm, this, structure(), structure()->outOfLineCapacity(), false, 0,
</ins><span class="cx"> elementSize * vectorLength);
</span><span class="cx"> newButterfly->setPublicLength(length);
</span><span class="cx"> newButterfly->setVectorLength(vectorLength);
</span><span class="lines">@@ -695,7 +695,7 @@
</span><span class="cx"> IndexingType oldType = indexingType();
</span><span class="cx"> ASSERT_UNUSED(oldType, !hasIndexedProperties(oldType));
</span><span class="cx"> Butterfly* newButterfly = Butterfly::createOrGrowArrayRight(
</span><del>- m_butterfly.get(this), vm, this, structure, structure->outOfLineCapacity(), false, 0,
</del><ins>+ m_butterfly.get(), vm, this, structure, structure->outOfLineCapacity(), false, 0,
</ins><span class="cx"> ArrayStorage::sizeFor(vectorLength));
</span><span class="cx"> RELEASE_ASSERT(newButterfly);
</span><span class="cx">
</span><span class="lines">@@ -719,32 +719,31 @@
</span><span class="cx"> {
</span><span class="cx"> ASSERT(hasUndecided(indexingType()));
</span><span class="cx"> setStructure(vm, Structure::nonPropertyTransition(vm, structure(vm), AllocateInt32));
</span><del>- return m_butterfly.get(this)->contiguousInt32();
</del><ins>+ return m_butterfly->contiguousInt32();
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> ContiguousDoubles JSObject::convertUndecidedToDouble(VM& vm)
</span><span class="cx"> {
</span><span class="cx"> ASSERT(hasUndecided(indexingType()));
</span><del>-
- Butterfly* butterfly = m_butterfly.get(this);
- for (unsigned i = butterfly->vectorLength(); i--;)
- butterfly->contiguousDouble()[i] = PNaN;
</del><span class="cx">
</span><ins>+ for (unsigned i = m_butterfly->vectorLength(); i--;)
+ m_butterfly->contiguousDouble()[i] = PNaN;
+
</ins><span class="cx"> setStructure(vm, Structure::nonPropertyTransition(vm, structure(vm), AllocateDouble));
</span><del>- return m_butterfly.get(this)->contiguousDouble();
</del><ins>+ return m_butterfly->contiguousDouble();
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> ContiguousJSValues JSObject::convertUndecidedToContiguous(VM& vm)
</span><span class="cx"> {
</span><span class="cx"> ASSERT(hasUndecided(indexingType()));
</span><span class="cx"> setStructure(vm, Structure::nonPropertyTransition(vm, structure(vm), AllocateContiguous));
</span><del>- return m_butterfly.get(this)->contiguous();
</del><ins>+ return m_butterfly->contiguous();
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> ArrayStorage* JSObject::constructConvertedArrayStorageWithoutCopyingElements(VM& vm, unsigned neededLength)
</span><span class="cx"> {
</span><span class="cx"> Structure* structure = this->structure(vm);
</span><del>- unsigned publicLength = m_butterfly.get(this)->publicLength();
</del><ins>+ unsigned publicLength = m_butterfly->publicLength();
</ins><span class="cx"> unsigned propertyCapacity = structure->outOfLineCapacity();
</span><span class="cx"> unsigned propertySize = structure->outOfLineSize();
</span><span class="cx">
</span><span class="lines">@@ -753,7 +752,7 @@
</span><span class="cx">
</span><span class="cx"> memcpy(
</span><span class="cx"> newButterfly->propertyStorage() - propertySize,
</span><del>- m_butterfly.get(this)->propertyStorage() - propertySize,
</del><ins>+ m_butterfly->propertyStorage() - propertySize,
</ins><span class="cx"> propertySize * sizeof(EncodedJSValue));
</span><span class="cx">
</span><span class="cx"> ArrayStorage* newStorage = newButterfly->arrayStorage();
</span><span class="lines">@@ -771,7 +770,7 @@
</span><span class="cx"> DeferGC deferGC(vm.heap);
</span><span class="cx"> ASSERT(hasUndecided(indexingType()));
</span><span class="cx">
</span><del>- unsigned vectorLength = m_butterfly.get(this)->vectorLength();
</del><ins>+ unsigned vectorLength = m_butterfly->vectorLength();
</ins><span class="cx"> ArrayStorage* storage = constructConvertedArrayStorageWithoutCopyingElements(vm, vectorLength);
</span><span class="cx"> // No need to copy elements.
</span><span class="cx">
</span><span class="lines">@@ -788,10 +787,9 @@
</span><span class="cx"> ContiguousDoubles JSObject::convertInt32ToDouble(VM& vm)
</span><span class="cx"> {
</span><span class="cx"> ASSERT(hasInt32(indexingType()));
</span><del>-
- Butterfly* butterfly = m_butterfly.get(this);
- for (unsigned i = butterfly->vectorLength(); i--;) {
- WriteBarrier<Unknown>* current = &butterfly->contiguousInt32()[i];
</del><ins>+
+ for (unsigned i = m_butterfly->vectorLength(); i--;) {
+ WriteBarrier<Unknown>* current = &m_butterfly->contiguousInt32()[i];
</ins><span class="cx"> double* currentAsDouble = bitwise_cast<double*>(current);
</span><span class="cx"> JSValue v = current->get();
</span><span class="cx"> if (!v) {
</span><span class="lines">@@ -803,7 +801,7 @@
</span><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> setStructure(vm, Structure::nonPropertyTransition(vm, structure(vm), AllocateDouble));
</span><del>- return m_butterfly.get(this)->contiguousDouble();
</del><ins>+ return m_butterfly->contiguousDouble();
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> ContiguousJSValues JSObject::convertInt32ToContiguous(VM& vm)
</span><span class="lines">@@ -811,7 +809,7 @@
</span><span class="cx"> ASSERT(hasInt32(indexingType()));
</span><span class="cx">
</span><span class="cx"> setStructure(vm, Structure::nonPropertyTransition(vm, structure(vm), AllocateContiguous));
</span><del>- return m_butterfly.get(this)->contiguous();
</del><ins>+ return m_butterfly->contiguous();
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> ArrayStorage* JSObject::convertInt32ToArrayStorage(VM& vm, NonPropertyTransition transition)
</span><span class="lines">@@ -819,11 +817,10 @@
</span><span class="cx"> DeferGC deferGC(vm.heap);
</span><span class="cx"> ASSERT(hasInt32(indexingType()));
</span><span class="cx">
</span><del>- unsigned vectorLength = m_butterfly.get(this)->vectorLength();
</del><ins>+ unsigned vectorLength = m_butterfly->vectorLength();
</ins><span class="cx"> ArrayStorage* newStorage = constructConvertedArrayStorageWithoutCopyingElements(vm, vectorLength);
</span><del>- Butterfly* butterfly = m_butterfly.get(this);
- for (unsigned i = 0; i < butterfly->publicLength(); i++) {
- JSValue v = butterfly->contiguous()[i].get();
</del><ins>+ for (unsigned i = 0; i < m_butterfly->publicLength(); i++) {
+ JSValue v = m_butterfly->contiguous()[i].get();
</ins><span class="cx"> if (v) {
</span><span class="cx"> newStorage->m_vector[i].setWithoutWriteBarrier(v);
</span><span class="cx"> newStorage->m_numValuesInVector++;
</span><span class="lines">@@ -844,10 +841,9 @@
</span><span class="cx"> ContiguousJSValues JSObject::convertDoubleToContiguous(VM& vm)
</span><span class="cx"> {
</span><span class="cx"> ASSERT(hasDouble(indexingType()));
</span><del>-
- Butterfly* butterfly = m_butterfly.get(this);
- for (unsigned i = butterfly->vectorLength(); i--;) {
- double* current = &butterfly->contiguousDouble()[i];
</del><ins>+
+ for (unsigned i = m_butterfly->vectorLength(); i--;) {
+ double* current = &m_butterfly->contiguousDouble()[i];
</ins><span class="cx"> WriteBarrier<Unknown>* currentAsValue = bitwise_cast<WriteBarrier<Unknown>*>(current);
</span><span class="cx"> double value = *current;
</span><span class="cx"> if (value != value) {
</span><span class="lines">@@ -859,7 +855,7 @@
</span><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> setStructure(vm, Structure::nonPropertyTransition(vm, structure(vm), AllocateContiguous));
</span><del>- return m_butterfly.get(this)->contiguous();
</del><ins>+ return m_butterfly->contiguous();
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> ArrayStorage* JSObject::convertDoubleToArrayStorage(VM& vm, NonPropertyTransition transition)
</span><span class="lines">@@ -867,11 +863,10 @@
</span><span class="cx"> DeferGC deferGC(vm.heap);
</span><span class="cx"> ASSERT(hasDouble(indexingType()));
</span><span class="cx">
</span><del>- unsigned vectorLength = m_butterfly.get(this)->vectorLength();
</del><ins>+ unsigned vectorLength = m_butterfly->vectorLength();
</ins><span class="cx"> ArrayStorage* newStorage = constructConvertedArrayStorageWithoutCopyingElements(vm, vectorLength);
</span><del>- Butterfly* butterfly = m_butterfly.get(this);
- for (unsigned i = 0; i < butterfly->publicLength(); i++) {
- double value = butterfly->contiguousDouble()[i];
</del><ins>+ for (unsigned i = 0; i < m_butterfly->publicLength(); i++) {
+ double value = m_butterfly->contiguousDouble()[i];
</ins><span class="cx"> if (value == value) {
</span><span class="cx"> newStorage->m_vector[i].setWithoutWriteBarrier(JSValue(JSValue::EncodeAsDouble, value));
</span><span class="cx"> newStorage->m_numValuesInVector++;
</span><span class="lines">@@ -894,11 +889,10 @@
</span><span class="cx"> DeferGC deferGC(vm.heap);
</span><span class="cx"> ASSERT(hasContiguous(indexingType()));
</span><span class="cx">
</span><del>- unsigned vectorLength = m_butterfly.get(this)->vectorLength();
</del><ins>+ unsigned vectorLength = m_butterfly->vectorLength();
</ins><span class="cx"> ArrayStorage* newStorage = constructConvertedArrayStorageWithoutCopyingElements(vm, vectorLength);
</span><del>- Butterfly* butterfly = m_butterfly.get(this);
- for (unsigned i = 0; i < butterfly->publicLength(); i++) {
- JSValue v = butterfly->contiguous()[i].get();
</del><ins>+ for (unsigned i = 0; i < m_butterfly->publicLength(); i++) {
+ JSValue v = m_butterfly->contiguous()[i].get();
</ins><span class="cx"> if (v) {
</span><span class="cx"> newStorage->m_vector[i].setWithoutWriteBarrier(v);
</span><span class="cx"> newStorage->m_numValuesInVector++;
</span><span class="lines">@@ -963,8 +957,8 @@
</span><span class="cx">
</span><span class="cx"> void JSObject::setIndexQuicklyToUndecided(VM& vm, unsigned index, JSValue value)
</span><span class="cx"> {
</span><del>- ASSERT(index < m_butterfly.get(this)->publicLength());
- ASSERT(index < m_butterfly.get(this)->vectorLength());
</del><ins>+ ASSERT(index < m_butterfly->publicLength());
+ ASSERT(index < m_butterfly->vectorLength());
</ins><span class="cx"> convertUndecidedForValue(vm, value);
</span><span class="cx"> setIndexQuickly(vm, index, value);
</span><span class="cx"> }
</span><span class="lines">@@ -1120,7 +1114,7 @@
</span><span class="cx"> return enterDictionaryIndexingModeWhenArrayStorageAlreadyExists(vm, convertContiguousToArrayStorage(vm));
</span><span class="cx">
</span><span class="cx"> case ALL_ARRAY_STORAGE_INDEXING_TYPES:
</span><del>- return enterDictionaryIndexingModeWhenArrayStorageAlreadyExists(vm, m_butterfly.get(this)->arrayStorage());
</del><ins>+ return enterDictionaryIndexingModeWhenArrayStorageAlreadyExists(vm, m_butterfly->arrayStorage());
</ins><span class="cx">
</span><span class="cx"> default:
</span><span class="cx"> CRASH();
</span><span class="lines">@@ -1362,7 +1356,7 @@
</span><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> case ALL_ARRAY_STORAGE_INDEXING_TYPES: {
</span><del>- ArrayStorage* storage = thisObject->m_butterfly.get(thisObject)->arrayStorage();
</del><ins>+ ArrayStorage* storage = thisObject->m_butterfly->arrayStorage();
</ins><span class="cx">
</span><span class="cx"> if (i < storage->vectorLength()) {
</span><span class="cx"> WriteBarrier<Unknown>& valueSlot = storage->m_vector[i];
</span><span class="lines">@@ -1552,7 +1546,7 @@
</span><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> case ALL_ARRAY_STORAGE_INDEXING_TYPES: {
</span><del>- ArrayStorage* storage = object->m_butterfly.get(object)->arrayStorage();
</del><ins>+ ArrayStorage* storage = object->m_butterfly->arrayStorage();
</ins><span class="cx">
</span><span class="cx"> unsigned usedVectorLength = std::min(storage->length(), storage->vectorLength());
</span><span class="cx"> for (unsigned i = 0; i < usedVectorLength; ++i) {
</span><span class="lines">@@ -1705,7 +1699,7 @@
</span><span class="cx"> void JSObject::putIndexedDescriptor(ExecState* exec, SparseArrayEntry* entryInMap, const PropertyDescriptor& descriptor, PropertyDescriptor& oldDescriptor)
</span><span class="cx"> {
</span><span class="cx"> VM& vm = exec->vm();
</span><del>- auto map = m_butterfly.get(this)->arrayStorage()->m_sparseMap.get();
</del><ins>+ auto map = m_butterfly->arrayStorage()->m_sparseMap.get();
</ins><span class="cx">
</span><span class="cx"> if (descriptor.isDataDescriptor()) {
</span><span class="cx"> if (descriptor.value())
</span><span class="lines">@@ -1764,7 +1758,7 @@
</span><span class="cx"> if (descriptor.attributes() & (ReadOnly | Accessor))
</span><span class="cx"> notifyPresenceOfIndexedAccessors(exec->vm());
</span><span class="cx">
</span><del>- SparseArrayValueMap* map = m_butterfly.get(this)->arrayStorage()->m_sparseMap.get();
</del><ins>+ SparseArrayValueMap* map = m_butterfly->arrayStorage()->m_sparseMap.get();
</ins><span class="cx"> RELEASE_ASSERT(map);
</span><span class="cx">
</span><span class="cx"> // 1. Let current be the result of calling the [[GetOwnProperty]] internal method of O with property name P.
</span><span class="lines">@@ -1796,9 +1790,8 @@
</span><span class="cx"> entryInMap->get(defaults);
</span><span class="cx">
</span><span class="cx"> putIndexedDescriptor(exec, entryInMap, descriptor, defaults);
</span><del>- Butterfly* butterfly = m_butterfly.get(this);
- if (index >= butterfly->arrayStorage()->length())
- butterfly->arrayStorage()->setLength(index + 1);
</del><ins>+ if (index >= m_butterfly->arrayStorage()->length())
+ m_butterfly->arrayStorage()->setLength(index + 1);
</ins><span class="cx"> return true;
</span><span class="cx"> }
</span><span class="cx">
</span><span class="lines">@@ -1918,19 +1911,17 @@
</span><span class="cx"> {
</span><span class="cx"> ASSERT((indexingType() & IndexingShapeMask) == indexingShape);
</span><span class="cx"> ASSERT(!indexingShouldBeSparse());
</span><del>-
- Butterfly* butterfly = m_butterfly.get(this);
</del><span class="cx">
</span><span class="cx"> // For us to get here, the index is either greater than the public length, or greater than
</span><span class="cx"> // or equal to the vector length.
</span><del>- ASSERT(i >= butterfly->vectorLength());
</del><ins>+ ASSERT(i >= m_butterfly->vectorLength());
</ins><span class="cx">
</span><span class="cx"> VM& vm = exec->vm();
</span><span class="cx">
</span><span class="cx"> if (i >= MAX_ARRAY_INDEX - 1
</span><span class="cx"> || (i >= MIN_SPARSE_ARRAY_INDEX
</span><del>- && !isDenseEnoughForVector(i, countElements<indexingShape>(butterfly)))
- || indexIsSufficientlyBeyondLengthForSparseMap(i, butterfly->vectorLength())) {
</del><ins>+ && !isDenseEnoughForVector(i, countElements<indexingShape>(butterfly())))
+ || indexIsSufficientlyBeyondLengthForSparseMap(i, m_butterfly->vectorLength())) {
</ins><span class="cx"> ASSERT(i <= MAX_ARRAY_INDEX);
</span><span class="cx"> ensureArrayStorageSlow(vm);
</span><span class="cx"> SparseArrayValueMap* map = allocateSparseIndexMap(vm);
</span><span class="lines">@@ -1941,25 +1932,24 @@
</span><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> ensureLength(vm, i + 1);
</span><del>- butterfly = m_butterfly.get(this);
</del><span class="cx">
</span><del>- RELEASE_ASSERT(i < butterfly->vectorLength());
</del><ins>+ RELEASE_ASSERT(i < m_butterfly->vectorLength());
</ins><span class="cx"> switch (indexingShape) {
</span><span class="cx"> case Int32Shape:
</span><span class="cx"> ASSERT(value.isInt32());
</span><del>- butterfly->contiguousInt32()[i].setWithoutWriteBarrier(value);
</del><ins>+ m_butterfly->contiguousInt32()[i].setWithoutWriteBarrier(value);
</ins><span class="cx"> break;
</span><span class="cx">
</span><span class="cx"> case DoubleShape: {
</span><span class="cx"> ASSERT(value.isNumber());
</span><span class="cx"> double valueAsDouble = value.asNumber();
</span><span class="cx"> ASSERT(valueAsDouble == valueAsDouble);
</span><del>- butterfly->contiguousDouble()[i] = valueAsDouble;
</del><ins>+ m_butterfly->contiguousDouble()[i] = valueAsDouble;
</ins><span class="cx"> break;
</span><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> case ContiguousShape:
</span><del>- butterfly->contiguous()[i].set(vm, this, value);
</del><ins>+ m_butterfly->contiguous()[i].set(vm, this, value);
</ins><span class="cx"> break;
</span><span class="cx">
</span><span class="cx"> default:
</span><span class="lines">@@ -2233,7 +2223,7 @@
</span><span class="cx">
</span><span class="cx"> case ALL_INT32_INDEXING_TYPES: {
</span><span class="cx"> if (attributes) {
</span><del>- if (i < m_butterfly.get(this)->vectorLength())
</del><ins>+ if (i < m_butterfly->vectorLength())
</ins><span class="cx"> return putDirectIndexBeyondVectorLengthWithArrayStorage(exec, i, value, attributes, mode, ensureArrayStorageExistsAndEnterDictionaryIndexingMode(vm));
</span><span class="cx"> return putDirectIndexBeyondVectorLengthWithArrayStorage(exec, i, value, attributes, mode, convertInt32ToArrayStorage(vm));
</span><span class="cx"> }
</span><span class="lines">@@ -2247,7 +2237,7 @@
</span><span class="cx">
</span><span class="cx"> case ALL_DOUBLE_INDEXING_TYPES: {
</span><span class="cx"> if (attributes) {
</span><del>- if (i < m_butterfly.get(this)->vectorLength())
</del><ins>+ if (i < m_butterfly->vectorLength())
</ins><span class="cx"> return putDirectIndexBeyondVectorLengthWithArrayStorage(exec, i, value, attributes, mode, ensureArrayStorageExistsAndEnterDictionaryIndexingMode(vm));
</span><span class="cx"> return putDirectIndexBeyondVectorLengthWithArrayStorage(exec, i, value, attributes, mode, convertDoubleToArrayStorage(vm));
</span><span class="cx"> }
</span><span class="lines">@@ -2266,7 +2256,7 @@
</span><span class="cx">
</span><span class="cx"> case ALL_CONTIGUOUS_INDEXING_TYPES: {
</span><span class="cx"> if (attributes) {
</span><del>- if (i < m_butterfly.get(this)->vectorLength())
</del><ins>+ if (i < m_butterfly->vectorLength())
</ins><span class="cx"> return putDirectIndexBeyondVectorLengthWithArrayStorage(exec, i, value, attributes, mode, ensureArrayStorageExistsAndEnterDictionaryIndexingMode(vm));
</span><span class="cx"> return putDirectIndexBeyondVectorLengthWithArrayStorage(exec, i, value, attributes, mode, convertContiguousToArrayStorage(vm));
</span><span class="cx"> }
</span><span class="lines">@@ -2276,7 +2266,7 @@
</span><span class="cx">
</span><span class="cx"> case ALL_ARRAY_STORAGE_INDEXING_TYPES:
</span><span class="cx"> if (attributes) {
</span><del>- if (i < m_butterfly.get(this)->vectorLength())
</del><ins>+ if (i < m_butterfly->vectorLength())
</ins><span class="cx"> return putDirectIndexBeyondVectorLengthWithArrayStorage(exec, i, value, attributes, mode, ensureArrayStorageExistsAndEnterDictionaryIndexingMode(vm));
</span><span class="cx"> }
</span><span class="cx"> return putDirectIndexBeyondVectorLengthWithArrayStorage(exec, i, value, attributes, mode, arrayStorage());
</span><span class="lines">@@ -2357,8 +2347,8 @@
</span><span class="cx"> unsigned length;
</span><span class="cx">
</span><span class="cx"> if (hasIndexedProperties(indexingType())) {
</span><del>- vectorLength = m_butterfly.get(this)->vectorLength();
- length = m_butterfly.get(this)->publicLength();
</del><ins>+ vectorLength = m_butterfly->vectorLength();
+ length = m_butterfly->publicLength();
</ins><span class="cx"> } else {
</span><span class="cx"> vectorLength = 0;
</span><span class="cx"> length = 0;
</span><span class="lines">@@ -2464,28 +2454,25 @@
</span><span class="cx">
</span><span class="cx"> void JSObject::ensureLengthSlow(VM& vm, unsigned length)
</span><span class="cx"> {
</span><del>- Butterfly* butterfly = m_butterfly.get(this);
-
</del><span class="cx"> ASSERT(length < MAX_ARRAY_INDEX);
</span><span class="cx"> ASSERT(hasContiguous(indexingType()) || hasInt32(indexingType()) || hasDouble(indexingType()) || hasUndecided(indexingType()));
</span><del>- ASSERT(length > butterfly->vectorLength());
</del><ins>+ ASSERT(length > m_butterfly->vectorLength());
</ins><span class="cx">
</span><span class="cx"> unsigned newVectorLength = std::min(
</span><span class="cx"> length << 1,
</span><span class="cx"> MAX_STORAGE_VECTOR_LENGTH);
</span><del>- unsigned oldVectorLength = butterfly->vectorLength();
</del><ins>+ unsigned oldVectorLength = m_butterfly->vectorLength();
</ins><span class="cx"> DeferGC deferGC(vm.heap);
</span><del>- butterfly = butterfly->growArrayRight(
</del><ins>+ m_butterfly.set(vm, this, m_butterfly->growArrayRight(
</ins><span class="cx"> vm, this, structure(), structure()->outOfLineCapacity(), true,
</span><span class="cx"> oldVectorLength * sizeof(EncodedJSValue),
</span><del>- newVectorLength * sizeof(EncodedJSValue));
- m_butterfly.set(vm, this, butterfly);
</del><ins>+ newVectorLength * sizeof(EncodedJSValue)));
</ins><span class="cx">
</span><del>- butterfly->setVectorLength(newVectorLength);
</del><ins>+ m_butterfly->setVectorLength(newVectorLength);
</ins><span class="cx">
</span><span class="cx"> if (hasDouble(indexingType())) {
</span><span class="cx"> for (unsigned i = oldVectorLength; i < newVectorLength; ++i)
</span><del>- butterfly->contiguousDouble().data()[i] = PNaN;
</del><ins>+ m_butterfly->contiguousDouble().data()[i] = PNaN;
</ins><span class="cx"> }
</span><span class="cx"> }
</span><span class="cx">
</span><span class="lines">@@ -2498,10 +2485,10 @@
</span><span class="cx"> ASSERT(!m_butterfly->indexingHeader()->preCapacity(structure()));
</span><span class="cx">
</span><span class="cx"> DeferGC deferGC(vm.heap);
</span><del>- Butterfly* newButterfly = m_butterfly.get(this)->resizeArray(vm, this, structure(), 0, ArrayStorage::sizeFor(length));
</del><ins>+ Butterfly* newButterfly = m_butterfly->resizeArray(vm, this, structure(), 0, ArrayStorage::sizeFor(length));
</ins><span class="cx"> m_butterfly.set(vm, this, newButterfly);
</span><del>- newButterfly->setVectorLength(length);
- newButterfly->setPublicLength(length);
</del><ins>+ m_butterfly->setVectorLength(length);
+ m_butterfly->setPublicLength(length);
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> Butterfly* JSObject::growOutOfLineStorage(VM& vm, size_t oldSize, size_t newSize)
</span><span class="lines">@@ -2511,7 +2498,7 @@
</span><span class="cx"> // It's important that this function not rely on structure(), for the property
</span><span class="cx"> // capacity, since we might have already mutated the structure in-place.
</span><span class="cx">
</span><del>- return Butterfly::createOrGrowPropertyStorage(m_butterfly.get(this), vm, this, structure(vm), oldSize, newSize);
</del><ins>+ return Butterfly::createOrGrowPropertyStorage(m_butterfly.get(), vm, this, structure(vm), oldSize, newSize);
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> bool JSObject::getOwnPropertyDescriptor(ExecState* exec, PropertyName propertyName, PropertyDescriptor& descriptor)
</span><span class="lines">@@ -2798,7 +2785,7 @@
</span><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> case ALL_ARRAY_STORAGE_INDEXING_TYPES: {
</span><del>- ArrayStorage* storage = object->m_butterfly.get(object)->arrayStorage();
</del><ins>+ ArrayStorage* storage = object->m_butterfly->arrayStorage();
</ins><span class="cx"> if (storage->m_sparseMap.get())
</span><span class="cx"> return 0;
</span><span class="cx">
</span></span></pre></div>
<a id="tagsSafari60217SourceJavaScriptCoreruntimeJSObjecth"></a>
<div class="modfile"><h4>Modified: tags/Safari-602.1.7/Source/JavaScriptCore/runtime/JSObject.h (191149 => 191150)</h4>
<pre class="diff"><span>
<span class="info">--- tags/Safari-602.1.7/Source/JavaScriptCore/runtime/JSObject.h 2015-10-15 23:38:21 UTC (rev 191149)
+++ tags/Safari-602.1.7/Source/JavaScriptCore/runtime/JSObject.h 2015-10-15 23:41:01 UTC (rev 191150)
</span><span class="lines">@@ -30,7 +30,7 @@
</span><span class="cx"> #include "CallFrame.h"
</span><span class="cx"> #include "ClassInfo.h"
</span><span class="cx"> #include "CommonIdentifiers.h"
</span><del>-#include "CopyBarrier.h"
</del><ins>+#include "CopyWriteBarrier.h"
</ins><span class="cx"> #include "CustomGetterSetter.h"
</span><span class="cx"> #include "DeferGC.h"
</span><span class="cx"> #include "Heap.h"
</span><span class="lines">@@ -131,14 +131,14 @@
</span><span class="cx"> {
</span><span class="cx"> if (!hasIndexedProperties(indexingType()))
</span><span class="cx"> return 0;
</span><del>- return m_butterfly.get(this)->publicLength();
</del><ins>+ return m_butterfly->publicLength();
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> unsigned getVectorLength()
</span><span class="cx"> {
</span><span class="cx"> if (!hasIndexedProperties(indexingType()))
</span><span class="cx"> return 0;
</span><del>- return m_butterfly.get(this)->vectorLength();
</del><ins>+ return m_butterfly->vectorLength();
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> JS_EXPORT_PRIVATE static void put(JSCell*, ExecState*, PropertyName, JSValue, PutPropertySlot&);
</span><span class="lines">@@ -181,24 +181,23 @@
</span><span class="cx">
</span><span class="cx"> bool canGetIndexQuickly(unsigned i)
</span><span class="cx"> {
</span><del>- Butterfly* butterfly = m_butterfly.get(this);
</del><span class="cx"> switch (indexingType()) {
</span><span class="cx"> case ALL_BLANK_INDEXING_TYPES:
</span><span class="cx"> case ALL_UNDECIDED_INDEXING_TYPES:
</span><span class="cx"> return false;
</span><span class="cx"> case ALL_INT32_INDEXING_TYPES:
</span><span class="cx"> case ALL_CONTIGUOUS_INDEXING_TYPES:
</span><del>- return i < butterfly->vectorLength() && butterfly->contiguous()[i];
</del><ins>+ return i < m_butterfly->vectorLength() && m_butterfly->contiguous()[i];
</ins><span class="cx"> case ALL_DOUBLE_INDEXING_TYPES: {
</span><del>- if (i >= butterfly->vectorLength())
</del><ins>+ if (i >= m_butterfly->vectorLength())
</ins><span class="cx"> return false;
</span><del>- double value = butterfly->contiguousDouble()[i];
</del><ins>+ double value = m_butterfly->contiguousDouble()[i];
</ins><span class="cx"> if (value != value)
</span><span class="cx"> return false;
</span><span class="cx"> return true;
</span><span class="cx"> }
</span><span class="cx"> case ALL_ARRAY_STORAGE_INDEXING_TYPES:
</span><del>- return i < butterfly->arrayStorage()->vectorLength() && butterfly->arrayStorage()->m_vector[i];
</del><ins>+ return i < m_butterfly->arrayStorage()->vectorLength() && m_butterfly->arrayStorage()->m_vector[i];
</ins><span class="cx"> default:
</span><span class="cx"> RELEASE_ASSERT_NOT_REACHED();
</span><span class="cx"> return false;
</span><span class="lines">@@ -207,16 +206,15 @@
</span><span class="cx">
</span><span class="cx"> JSValue getIndexQuickly(unsigned i)
</span><span class="cx"> {
</span><del>- Butterfly* butterfly = m_butterfly.get(this);
</del><span class="cx"> switch (indexingType()) {
</span><span class="cx"> case ALL_INT32_INDEXING_TYPES:
</span><del>- return jsNumber(butterfly->contiguous()[i].get().asInt32());
</del><ins>+ return jsNumber(m_butterfly->contiguous()[i].get().asInt32());
</ins><span class="cx"> case ALL_CONTIGUOUS_INDEXING_TYPES:
</span><del>- return butterfly->contiguous()[i].get();
</del><ins>+ return m_butterfly->contiguous()[i].get();
</ins><span class="cx"> case ALL_DOUBLE_INDEXING_TYPES:
</span><del>- return JSValue(JSValue::EncodeAsDouble, butterfly->contiguousDouble()[i]);
</del><ins>+ return JSValue(JSValue::EncodeAsDouble, m_butterfly->contiguousDouble()[i]);
</ins><span class="cx"> case ALL_ARRAY_STORAGE_INDEXING_TYPES:
</span><del>- return butterfly->arrayStorage()->m_vector[i].get();
</del><ins>+ return m_butterfly->arrayStorage()->m_vector[i].get();
</ins><span class="cx"> default:
</span><span class="cx"> RELEASE_ASSERT_NOT_REACHED();
</span><span class="cx"> return JSValue();
</span><span class="lines">@@ -225,33 +223,32 @@
</span><span class="cx">
</span><span class="cx"> JSValue tryGetIndexQuickly(unsigned i) const
</span><span class="cx"> {
</span><del>- Butterfly* butterfly = m_butterfly.get(this);
</del><span class="cx"> switch (indexingType()) {
</span><span class="cx"> case ALL_BLANK_INDEXING_TYPES:
</span><span class="cx"> case ALL_UNDECIDED_INDEXING_TYPES:
</span><span class="cx"> break;
</span><span class="cx"> case ALL_INT32_INDEXING_TYPES:
</span><del>- if (i < butterfly->publicLength()) {
- JSValue result = butterfly->contiguous()[i].get();
</del><ins>+ if (i < m_butterfly->publicLength()) {
+ JSValue result = m_butterfly->contiguous()[i].get();
</ins><span class="cx"> ASSERT(result.isInt32() || !result);
</span><span class="cx"> return result;
</span><span class="cx"> }
</span><span class="cx"> break;
</span><span class="cx"> case ALL_CONTIGUOUS_INDEXING_TYPES:
</span><del>- if (i < butterfly->publicLength())
- return butterfly->contiguous()[i].get();
</del><ins>+ if (i < m_butterfly->publicLength())
+ return m_butterfly->contiguous()[i].get();
</ins><span class="cx"> break;
</span><span class="cx"> case ALL_DOUBLE_INDEXING_TYPES: {
</span><del>- if (i >= butterfly->publicLength())
</del><ins>+ if (i >= m_butterfly->publicLength())
</ins><span class="cx"> break;
</span><del>- double result = butterfly->contiguousDouble()[i];
</del><ins>+ double result = m_butterfly->contiguousDouble()[i];
</ins><span class="cx"> if (result != result)
</span><span class="cx"> break;
</span><span class="cx"> return JSValue(JSValue::EncodeAsDouble, result);
</span><span class="cx"> }
</span><span class="cx"> case ALL_ARRAY_STORAGE_INDEXING_TYPES:
</span><del>- if (i < butterfly->arrayStorage()->vectorLength())
- return butterfly->arrayStorage()->m_vector[i].get();
</del><ins>+ if (i < m_butterfly->arrayStorage()->vectorLength())
+ return m_butterfly->arrayStorage()->m_vector[i].get();
</ins><span class="cx"> break;
</span><span class="cx"> default:
</span><span class="cx"> RELEASE_ASSERT_NOT_REACHED();
</span><span class="lines">@@ -279,7 +276,6 @@
</span><span class="cx">
</span><span class="cx"> bool canSetIndexQuickly(unsigned i)
</span><span class="cx"> {
</span><del>- Butterfly* butterfly = m_butterfly.get(this);
</del><span class="cx"> switch (indexingType()) {
</span><span class="cx"> case ALL_BLANK_INDEXING_TYPES:
</span><span class="cx"> case ALL_UNDECIDED_INDEXING_TYPES:
</span><span class="lines">@@ -289,11 +285,11 @@
</span><span class="cx"> case ALL_CONTIGUOUS_INDEXING_TYPES:
</span><span class="cx"> case NonArrayWithArrayStorage:
</span><span class="cx"> case ArrayWithArrayStorage:
</span><del>- return i < butterfly->vectorLength();
</del><ins>+ return i < m_butterfly->vectorLength();
</ins><span class="cx"> case NonArrayWithSlowPutArrayStorage:
</span><span class="cx"> case ArrayWithSlowPutArrayStorage:
</span><del>- return i < butterfly->arrayStorage()->vectorLength()
- && !!butterfly->arrayStorage()->m_vector[i];
</del><ins>+ return i < m_butterfly->arrayStorage()->vectorLength()
+ && !!m_butterfly->arrayStorage()->m_vector[i];
</ins><span class="cx"> default:
</span><span class="cx"> RELEASE_ASSERT_NOT_REACHED();
</span><span class="cx"> return false;
</span><span class="lines">@@ -310,7 +306,7 @@
</span><span class="cx"> case ALL_DOUBLE_INDEXING_TYPES:
</span><span class="cx"> case ALL_CONTIGUOUS_INDEXING_TYPES:
</span><span class="cx"> case ALL_ARRAY_STORAGE_INDEXING_TYPES:
</span><del>- return i < m_butterfly.get(this)->vectorLength();
</del><ins>+ return i < m_butterfly->vectorLength();
</ins><span class="cx"> default:
</span><span class="cx"> RELEASE_ASSERT_NOT_REACHED();
</span><span class="cx"> return false;
</span><span class="lines">@@ -319,10 +315,9 @@
</span><span class="cx">
</span><span class="cx"> void setIndexQuickly(VM& vm, unsigned i, JSValue v)
</span><span class="cx"> {
</span><del>- Butterfly* butterfly = m_butterfly.get(this);
</del><span class="cx"> switch (indexingType()) {
</span><span class="cx"> case ALL_INT32_INDEXING_TYPES: {
</span><del>- ASSERT(i < butterfly->vectorLength());
</del><ins>+ ASSERT(i < m_butterfly->vectorLength());
</ins><span class="cx"> if (!v.isInt32()) {
</span><span class="cx"> convertInt32ToDoubleOrContiguousWhilePerformingSetIndex(vm, i, v);
</span><span class="cx"> return;
</span><span class="lines">@@ -330,14 +325,14 @@
</span><span class="cx"> FALLTHROUGH;
</span><span class="cx"> }
</span><span class="cx"> case ALL_CONTIGUOUS_INDEXING_TYPES: {
</span><del>- ASSERT(i < butterfly->vectorLength());
- butterfly->contiguous()[i].set(vm, this, v);
- if (i >= butterfly->publicLength())
- butterfly->setPublicLength(i + 1);
</del><ins>+ ASSERT(i < m_butterfly->vectorLength());
+ m_butterfly->contiguous()[i].set(vm, this, v);
+ if (i >= m_butterfly->publicLength())
+ m_butterfly->setPublicLength(i + 1);
</ins><span class="cx"> break;
</span><span class="cx"> }
</span><span class="cx"> case ALL_DOUBLE_INDEXING_TYPES: {
</span><del>- ASSERT(i < butterfly->vectorLength());
</del><ins>+ ASSERT(i < m_butterfly->vectorLength());
</ins><span class="cx"> if (!v.isNumber()) {
</span><span class="cx"> convertDoubleToContiguousWhilePerformingSetIndex(vm, i, v);
</span><span class="cx"> return;
</span><span class="lines">@@ -347,13 +342,13 @@
</span><span class="cx"> convertDoubleToContiguousWhilePerformingSetIndex(vm, i, v);
</span><span class="cx"> return;
</span><span class="cx"> }
</span><del>- butterfly->contiguousDouble()[i] = value;
- if (i >= butterfly->publicLength())
- butterfly->setPublicLength(i + 1);
</del><ins>+ m_butterfly->contiguousDouble()[i] = value;
+ if (i >= m_butterfly->publicLength())
+ m_butterfly->setPublicLength(i + 1);
</ins><span class="cx"> break;
</span><span class="cx"> }
</span><span class="cx"> case ALL_ARRAY_STORAGE_INDEXING_TYPES: {
</span><del>- ArrayStorage* storage = butterfly->arrayStorage();
</del><ins>+ ArrayStorage* storage = m_butterfly->arrayStorage();
</ins><span class="cx"> WriteBarrier<Unknown>& x = storage->m_vector[i];
</span><span class="cx"> JSValue old = x.get();
</span><span class="cx"> x.set(vm, this, v);
</span><span class="lines">@@ -376,15 +371,14 @@
</span><span class="cx">
</span><span class="cx"> void initializeIndex(VM& vm, unsigned i, JSValue v, IndexingType indexingType)
</span><span class="cx"> {
</span><del>- Butterfly* butterfly = m_butterfly.get(this);
</del><span class="cx"> switch (indexingType) {
</span><span class="cx"> case ALL_UNDECIDED_INDEXING_TYPES: {
</span><span class="cx"> setIndexQuicklyToUndecided(vm, i, v);
</span><span class="cx"> break;
</span><span class="cx"> }
</span><span class="cx"> case ALL_INT32_INDEXING_TYPES: {
</span><del>- ASSERT(i < butterfly->publicLength());
- ASSERT(i < butterfly->vectorLength());
</del><ins>+ ASSERT(i < m_butterfly->publicLength());
+ ASSERT(i < m_butterfly->vectorLength());
</ins><span class="cx"> if (!v.isInt32()) {
</span><span class="cx"> convertInt32ToDoubleOrContiguousWhilePerformingSetIndex(vm, i, v);
</span><span class="cx"> break;
</span><span class="lines">@@ -392,14 +386,14 @@
</span><span class="cx"> FALLTHROUGH;
</span><span class="cx"> }
</span><span class="cx"> case ALL_CONTIGUOUS_INDEXING_TYPES: {
</span><del>- ASSERT(i < butterfly->publicLength());
- ASSERT(i < butterfly->vectorLength());
- butterfly->contiguous()[i].set(vm, this, v);
</del><ins>+ ASSERT(i < m_butterfly->publicLength());
+ ASSERT(i < m_butterfly->vectorLength());
+ m_butterfly->contiguous()[i].set(vm, this, v);
</ins><span class="cx"> break;
</span><span class="cx"> }
</span><span class="cx"> case ALL_DOUBLE_INDEXING_TYPES: {
</span><del>- ASSERT(i < butterfly->publicLength());
- ASSERT(i < butterfly->vectorLength());
</del><ins>+ ASSERT(i < m_butterfly->publicLength());
+ ASSERT(i < m_butterfly->vectorLength());
</ins><span class="cx"> if (!v.isNumber()) {
</span><span class="cx"> convertDoubleToContiguousWhilePerformingSetIndex(vm, i, v);
</span><span class="cx"> return;
</span><span class="lines">@@ -409,11 +403,11 @@
</span><span class="cx"> convertDoubleToContiguousWhilePerformingSetIndex(vm, i, v);
</span><span class="cx"> return;
</span><span class="cx"> }
</span><del>- butterfly->contiguousDouble()[i] = value;
</del><ins>+ m_butterfly->contiguousDouble()[i] = value;
</ins><span class="cx"> break;
</span><span class="cx"> }
</span><span class="cx"> case ALL_ARRAY_STORAGE_INDEXING_TYPES: {
</span><del>- ArrayStorage* storage = butterfly->arrayStorage();
</del><ins>+ ArrayStorage* storage = m_butterfly->arrayStorage();
</ins><span class="cx"> ASSERT(i < storage->length());
</span><span class="cx"> ASSERT(i < storage->m_numValuesInVector);
</span><span class="cx"> storage->m_vector[i].set(vm, this, v);
</span><span class="lines">@@ -434,7 +428,7 @@
</span><span class="cx"> case ALL_CONTIGUOUS_INDEXING_TYPES:
</span><span class="cx"> return false;
</span><span class="cx"> case ALL_ARRAY_STORAGE_INDEXING_TYPES:
</span><del>- return !!m_butterfly.get(this)->arrayStorage()->m_sparseMap;
</del><ins>+ return !!m_butterfly->arrayStorage()->m_sparseMap;
</ins><span class="cx"> default:
</span><span class="cx"> RELEASE_ASSERT_NOT_REACHED();
</span><span class="cx"> return false;
</span><span class="lines">@@ -451,7 +445,7 @@
</span><span class="cx"> case ALL_CONTIGUOUS_INDEXING_TYPES:
</span><span class="cx"> return false;
</span><span class="cx"> case ALL_ARRAY_STORAGE_INDEXING_TYPES:
</span><del>- return m_butterfly.get(this)->arrayStorage()->inSparseMode();
</del><ins>+ return m_butterfly->arrayStorage()->inSparseMode();
</ins><span class="cx"> default:
</span><span class="cx"> RELEASE_ASSERT_NOT_REACHED();
</span><span class="cx"> return false;
</span><span class="lines">@@ -556,11 +550,11 @@
</span><span class="cx"> return inlineStorageUnsafe();
</span><span class="cx"> }
</span><span class="cx">
</span><del>- const Butterfly* butterfly() const { return m_butterfly.get(this); }
- Butterfly* butterfly() { return m_butterfly.get(this); }
</del><ins>+ const Butterfly* butterfly() const { return m_butterfly.get(); }
+ Butterfly* butterfly() { return m_butterfly.get(); }
</ins><span class="cx">
</span><del>- ConstPropertyStorage outOfLineStorage() const { return m_butterfly.get(this)->propertyStorage(); }
- PropertyStorage outOfLineStorage() { return m_butterfly.get(this)->propertyStorage(); }
</del><ins>+ ConstPropertyStorage outOfLineStorage() const { return m_butterfly->propertyStorage(); }
+ PropertyStorage outOfLineStorage() { return m_butterfly->propertyStorage(); }
</ins><span class="cx">
</span><span class="cx"> const WriteBarrierBase<Unknown>* locationForOffset(PropertyOffset offset) const
</span><span class="cx"> {
</span><span class="lines">@@ -662,7 +656,7 @@
</span><span class="cx"> ContiguousJSValues ensureInt32(VM& vm)
</span><span class="cx"> {
</span><span class="cx"> if (LIKELY(hasInt32(indexingType())))
</span><del>- return m_butterfly.get(this)->contiguousInt32();
</del><ins>+ return m_butterfly->contiguousInt32();
</ins><span class="cx">
</span><span class="cx"> return ensureInt32Slow(vm);
</span><span class="cx"> }
</span><span class="lines">@@ -674,7 +668,7 @@
</span><span class="cx"> ContiguousDoubles ensureDouble(VM& vm)
</span><span class="cx"> {
</span><span class="cx"> if (LIKELY(hasDouble(indexingType())))
</span><del>- return m_butterfly.get(this)->contiguousDouble();
</del><ins>+ return m_butterfly->contiguousDouble();
</ins><span class="cx">
</span><span class="cx"> return ensureDoubleSlow(vm);
</span><span class="cx"> }
</span><span class="lines">@@ -684,7 +678,7 @@
</span><span class="cx"> ContiguousJSValues ensureContiguous(VM& vm)
</span><span class="cx"> {
</span><span class="cx"> if (LIKELY(hasContiguous(indexingType())))
</span><del>- return m_butterfly.get(this)->contiguous();
</del><ins>+ return m_butterfly->contiguous();
</ins><span class="cx">
</span><span class="cx"> return ensureContiguousSlow(vm);
</span><span class="cx"> }
</span><span class="lines">@@ -696,7 +690,7 @@
</span><span class="cx"> ArrayStorage* ensureArrayStorage(VM& vm)
</span><span class="cx"> {
</span><span class="cx"> if (LIKELY(hasAnyArrayStorage(indexingType())))
</span><del>- return m_butterfly.get(this)->arrayStorage();
</del><ins>+ return m_butterfly->arrayStorage();
</ins><span class="cx">
</span><span class="cx"> return ensureArrayStorageSlow(vm);
</span><span class="cx"> }
</span><span class="lines">@@ -742,7 +736,7 @@
</span><span class="cx"> ArrayStorage* arrayStorage()
</span><span class="cx"> {
</span><span class="cx"> ASSERT(hasAnyArrayStorage(indexingType()));
</span><del>- return m_butterfly.get(this)->arrayStorage();
</del><ins>+ return m_butterfly->arrayStorage();
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> // Call this if you want to predicate some actions on whether or not the
</span><span class="lines">@@ -751,7 +745,7 @@
</span><span class="cx"> {
</span><span class="cx"> switch (indexingType()) {
</span><span class="cx"> case ALL_ARRAY_STORAGE_INDEXING_TYPES:
</span><del>- return m_butterfly.get(this)->arrayStorage();
</del><ins>+ return m_butterfly->arrayStorage();
</ins><span class="cx">
</span><span class="cx"> default:
</span><span class="cx"> return 0;
</span><span class="lines">@@ -815,12 +809,12 @@
</span><span class="cx"> {
</span><span class="cx"> ASSERT(length < MAX_ARRAY_INDEX);
</span><span class="cx"> ASSERT(hasContiguous(indexingType()) || hasInt32(indexingType()) || hasDouble(indexingType()) || hasUndecided(indexingType()));
</span><del>-
- if (m_butterfly.get(this)->vectorLength() < length)
</del><ins>+
+ if (m_butterfly->vectorLength() < length)
</ins><span class="cx"> ensureLengthSlow(vm, length);
</span><span class="cx">
</span><del>- if (m_butterfly.get(this)->publicLength() < length)
- m_butterfly.get(this)->setPublicLength(length);
</del><ins>+ if (m_butterfly->publicLength() < length)
+ m_butterfly->setPublicLength(length);
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> // Call this if you want to shrink the butterfly backing store, and you're
</span><span class="lines">@@ -880,7 +874,7 @@
</span><span class="cx"> JS_EXPORT_PRIVATE ArrayStorage* ensureArrayStorageSlow(VM&);
</span><span class="cx">
</span><span class="cx"> protected:
</span><del>- CopyBarrier<Butterfly> m_butterfly;
</del><ins>+ CopyWriteBarrier<Butterfly> m_butterfly;
</ins><span class="cx"> #if USE(JSVALUE32_64)
</span><span class="cx"> private:
</span><span class="cx"> uint32_t m_padding;
</span><span class="lines">@@ -1354,7 +1348,7 @@
</span><span class="cx"> DeferGC deferGC(vm.heap);
</span><span class="cx"> ASSERT(!value.isGetterSetter() && !(attributes & Accessor));
</span><span class="cx"> ASSERT(!value.isCustomGetterSetter());
</span><del>- Butterfly* newButterfly = m_butterfly.get(this);
</del><ins>+ Butterfly* newButterfly = m_butterfly.get();
</ins><span class="cx"> if (structure()->putWillGrowOutOfLineStorage())
</span><span class="cx"> newButterfly = growOutOfLineStorage(vm, structure()->outOfLineCapacity(), structure()->suggestedNewOutOfLineStorageCapacity());
</span><span class="cx"> Structure* structure = this->structure();
</span></span></pre></div>
<a id="tagsSafari60217SourceJavaScriptCoreruntimeJSSeth"></a>
<div class="modfile"><h4>Modified: tags/Safari-602.1.7/Source/JavaScriptCore/runtime/JSSet.h (191149 => 191150)</h4>
<pre class="diff"><span>
<span class="info">--- tags/Safari-602.1.7/Source/JavaScriptCore/runtime/JSSet.h 2015-10-15 23:38:21 UTC (rev 191149)
+++ tags/Safari-602.1.7/Source/JavaScriptCore/runtime/JSSet.h 2015-10-15 23:41:01 UTC (rev 191150)
</span><span class="lines">@@ -112,7 +112,7 @@
</span><span class="cx"> private:
</span><span class="cx"> JSSet(VM& vm, Structure* structure)
</span><span class="cx"> : Base(vm, structure)
</span><del>- , m_setData(vm, this)
</del><ins>+ , m_setData(vm)
</ins><span class="cx"> {
</span><span class="cx"> }
</span><span class="cx">
</span></span></pre></div>
<a id="tagsSafari60217SourceJavaScriptCoreruntimeMapDatah"></a>
<div class="modfile"><h4>Modified: tags/Safari-602.1.7/Source/JavaScriptCore/runtime/MapData.h (191149 => 191150)</h4>
<pre class="diff"><span>
<span class="info">--- tags/Safari-602.1.7/Source/JavaScriptCore/runtime/MapData.h 2015-10-15 23:38:21 UTC (rev 191149)
+++ tags/Safari-602.1.7/Source/JavaScriptCore/runtime/MapData.h 2015-10-15 23:41:01 UTC (rev 191150)
</span><span class="lines">@@ -1,5 +1,5 @@
</span><span class="cx"> /*
</span><del>- * Copyright (C) 2013, 2015 Apple Inc. All rights reserved.
</del><ins>+ * Copyright (C) 2013 Apple Inc. All rights reserved.
</ins><span class="cx"> *
</span><span class="cx"> * Redistribution and use in source and binary forms, with or without
</span><span class="cx"> * modification, are permitted provided that the following conditions
</span><span class="lines">@@ -26,7 +26,6 @@
</span><span class="cx"> #ifndef MapData_h
</span><span class="cx"> #define MapData_h
</span><span class="cx">
</span><del>-#include "CopyBarrier.h"
</del><span class="cx"> #include "JSCell.h"
</span><span class="cx"> #include "WeakGCMapInlines.h"
</span><span class="cx"> #include <wtf/HashFunctions.h>
</span><span class="lines">@@ -95,7 +94,7 @@
</span><span class="cx"> JSValue value;
</span><span class="cx"> };
</span><span class="cx">
</span><del>- MapDataImpl(VM&, JSCell* owner);
</del><ins>+ MapDataImpl(VM&);
</ins><span class="cx">
</span><span class="cx"> void set(ExecState*, JSCell* owner, KeyType, JSValue);
</span><span class="cx"> JSValue get(ExecState*, KeyType);
</span><span class="lines">@@ -137,17 +136,16 @@
</span><span class="cx"> int32_t m_capacity;
</span><span class="cx"> int32_t m_size;
</span><span class="cx"> int32_t m_deletedCount;
</span><del>- JSCell* m_owner;
- CopyBarrier<Entry> m_entries;
</del><ins>+ Entry* m_entries;
</ins><span class="cx"> WeakGCMap<JSIterator*, JSIterator> m_iterators;
</span><span class="cx"> };
</span><span class="cx">
</span><span class="cx"> template<typename Entry, typename JSIterator>
</span><del>-ALWAYS_INLINE MapDataImpl<Entry, JSIterator>::MapDataImpl(VM& vm, JSCell* owner)
</del><ins>+ALWAYS_INLINE MapDataImpl<Entry, JSIterator>::MapDataImpl(VM& vm)
</ins><span class="cx"> : m_capacity(0)
</span><span class="cx"> , m_size(0)
</span><span class="cx"> , m_deletedCount(0)
</span><del>- , m_owner(owner)
</del><ins>+ , m_entries(nullptr)
</ins><span class="cx"> , m_iterators(vm)
</span><span class="cx"> {
</span><span class="cx"> }
</span><span class="lines">@@ -184,7 +182,7 @@
</span><span class="cx"> {
</span><span class="cx"> if (!ensureSlot())
</span><span class="cx"> return false;
</span><del>- Entry* entry = &m_mapData->m_entries.get(m_mapData->m_owner)[m_index];
</del><ins>+ Entry* entry = &m_mapData->m_entries[m_index];
</ins><span class="cx"> pair = WTF::KeyValuePair<JSValue, JSValue>(entry->key().get(), entry->value().get());
</span><span class="cx"> m_index += 1;
</span><span class="cx"> return true;
</span><span class="lines">@@ -206,7 +204,7 @@
</span><span class="cx"> if (isFinished())
</span><span class="cx"> return m_index;
</span><span class="cx">
</span><del>- Entry* entries = m_mapData->m_entries.get(m_mapData->m_owner);
</del><ins>+ Entry* entries = m_mapData->m_entries;
</ins><span class="cx"> size_t end = m_mapData->m_size;
</span><span class="cx"> while (static_cast<size_t>(m_index) < end && !entries[m_index].key())
</span><span class="cx"> m_index++;
</span></span></pre></div>
<a id="tagsSafari60217SourceJavaScriptCoreruntimeMapDataInlinesh"></a>
<div class="modfile"><h4>Modified: tags/Safari-602.1.7/Source/JavaScriptCore/runtime/MapDataInlines.h (191149 => 191150)</h4>
<pre class="diff"><span>
<span class="info">--- tags/Safari-602.1.7/Source/JavaScriptCore/runtime/MapDataInlines.h 2015-10-15 23:38:21 UTC (rev 191149)
+++ tags/Safari-602.1.7/Source/JavaScriptCore/runtime/MapDataInlines.h 2015-10-15 23:41:01 UTC (rev 191150)
</span><span class="lines">@@ -47,7 +47,7 @@
</span><span class="cx"> m_capacity = 0;
</span><span class="cx"> m_size = 0;
</span><span class="cx"> m_deletedCount = 0;
</span><del>- m_entries.clear();
</del><ins>+ m_entries = nullptr;
</ins><span class="cx"> m_iterators.forEach([](JSIterator* iterator, JSIterator*) {
</span><span class="cx"> iterator->iteratorData()->didRemoveAllEntries();
</span><span class="cx"> });
</span><span class="lines">@@ -60,25 +60,25 @@
</span><span class="cx"> auto iter = m_stringKeyedTable.find(asString(key.value)->value(exec).impl());
</span><span class="cx"> if (iter == m_stringKeyedTable.end())
</span><span class="cx"> return 0;
</span><del>- return &m_entries.get(m_owner)[iter->value];
</del><ins>+ return &m_entries[iter->value];
</ins><span class="cx"> }
</span><span class="cx"> if (key.value.isSymbol()) {
</span><span class="cx"> auto iter = m_symbolKeyedTable.find(asSymbol(key.value)->privateName().uid());
</span><span class="cx"> if (iter == m_symbolKeyedTable.end())
</span><span class="cx"> return 0;
</span><del>- return &m_entries.get(m_owner)[iter->value];
</del><ins>+ return &m_entries[iter->value];
</ins><span class="cx"> }
</span><span class="cx"> if (key.value.isCell()) {
</span><span class="cx"> auto iter = m_cellKeyedTable.find(key.value.asCell());
</span><span class="cx"> if (iter == m_cellKeyedTable.end())
</span><span class="cx"> return 0;
</span><del>- return &m_entries.get(m_owner)[iter->value];
</del><ins>+ return &m_entries[iter->value];
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> auto iter = m_valueKeyedTable.find(JSValue::encode(key.value));
</span><span class="cx"> if (iter == m_valueKeyedTable.end())
</span><span class="cx"> return 0;
</span><del>- return &m_entries.get(m_owner)[iter->value];
</del><ins>+ return &m_entries[iter->value];
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> template<typename Entry, typename JSIterator>
</span><span class="lines">@@ -93,14 +93,14 @@
</span><span class="cx"> {
</span><span class="cx"> typename Map::iterator location = map.find(key);
</span><span class="cx"> if (location != map.end())
</span><del>- return &m_entries.get(m_owner)[location->value];
</del><ins>+ return &m_entries[location->value];
</ins><span class="cx">
</span><span class="cx"> if (!ensureSpaceForAppend(exec, owner))
</span><span class="cx"> return 0;
</span><span class="cx">
</span><span class="cx"> auto result = map.add(key, m_size);
</span><span class="cx"> RELEASE_ASSERT(result.isNewEntry);
</span><del>- Entry* entry = &m_entries.get(m_owner)[m_size++];
</del><ins>+ Entry* entry = &m_entries[m_size++];
</ins><span class="cx"> new (entry) Entry();
</span><span class="cx"> entry->setKey(exec->vm(), owner, keyValue.value);
</span><span class="cx"> return entry;
</span><span class="lines">@@ -164,7 +164,7 @@
</span><span class="cx"> location = iter->value;
</span><span class="cx"> m_valueKeyedTable.remove(iter);
</span><span class="cx"> }
</span><del>- m_entries.get(m_owner)[location].clear();
</del><ins>+ m_entries[location].clear();
</ins><span class="cx"> m_deletedCount++;
</span><span class="cx"> return true;
</span><span class="cx"> }
</span><span class="lines">@@ -176,7 +176,7 @@
</span><span class="cx"> int32_t newEnd = 0;
</span><span class="cx"> RELEASE_ASSERT(newCapacity > 0);
</span><span class="cx"> for (int32_t i = 0; i < m_size; i++) {
</span><del>- Entry& entry = m_entries.getWithoutBarrier()[i];
</del><ins>+ Entry& entry = m_entries[i];
</ins><span class="cx"> if (!entry.key()) {
</span><span class="cx"> m_iterators.forEach([newEnd](JSIterator* iterator, JSIterator*) {
</span><span class="cx"> iterator->iteratorData()->didRemoveEntry(newEnd);
</span><span class="lines">@@ -195,20 +195,20 @@
</span><span class="cx">
</span><span class="cx"> // Fixup for the hashmaps
</span><span class="cx"> for (auto ptr = m_valueKeyedTable.begin(); ptr != m_valueKeyedTable.end(); ++ptr)
</span><del>- ptr->value = m_entries.getWithoutBarrier()[ptr->value].key().get().asInt32();
</del><ins>+ ptr->value = m_entries[ptr->value].key().get().asInt32();
</ins><span class="cx"> for (auto ptr = m_cellKeyedTable.begin(); ptr != m_cellKeyedTable.end(); ++ptr)
</span><del>- ptr->value = m_entries.getWithoutBarrier()[ptr->value].key().get().asInt32();
</del><ins>+ ptr->value = m_entries[ptr->value].key().get().asInt32();
</ins><span class="cx"> for (auto ptr = m_stringKeyedTable.begin(); ptr != m_stringKeyedTable.end(); ++ptr)
</span><del>- ptr->value = m_entries.getWithoutBarrier()[ptr->value].key().get().asInt32();
</del><ins>+ ptr->value = m_entries[ptr->value].key().get().asInt32();
</ins><span class="cx"> for (auto ptr = m_symbolKeyedTable.begin(); ptr != m_symbolKeyedTable.end(); ++ptr)
</span><del>- ptr->value = m_entries.getWithoutBarrier()[ptr->value].key().get().asInt32();
</del><ins>+ ptr->value = m_entries[ptr->value].key().get().asInt32();
</ins><span class="cx">
</span><span class="cx"> ASSERT((m_size - newEnd) == m_deletedCount);
</span><span class="cx"> m_deletedCount = 0;
</span><span class="cx">
</span><span class="cx"> m_capacity = newCapacity;
</span><span class="cx"> m_size = newEnd;
</span><del>- m_entries.setWithoutBarrier(destination);
</del><ins>+ m_entries = destination;
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> template<typename Entry, typename JSIterator>
</span><span class="lines">@@ -217,9 +217,9 @@
</span><span class="cx"> ASSERT(!shouldPack());
</span><span class="cx"> RELEASE_ASSERT(newCapacity > 0);
</span><span class="cx"> ASSERT(newCapacity >= m_capacity);
</span><del>- memcpy(destination, m_entries.getWithoutBarrier(), sizeof(Entry) * m_size);
</del><ins>+ memcpy(destination, m_entries, sizeof(Entry) * m_size);
</ins><span class="cx"> m_capacity = newCapacity;
</span><del>- m_entries.setWithoutBarrier(destination);
</del><ins>+ m_entries = destination;
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> template<typename Entry, typename JSIterator>
</span><span class="lines">@@ -236,8 +236,6 @@
</span><span class="cx"> return false;
</span><span class="cx"> }
</span><span class="cx"> Entry* newEntries = static_cast<Entry*>(newStorage);
</span><del>- // Do a read barrier to ensure that m_entries points to to-space for the remainder of this GC epoch.
- m_entries.get(m_owner);
</del><span class="cx"> if (shouldPack())
</span><span class="cx"> replaceAndPackBackingStore(newEntries, requiredSize);
</span><span class="cx"> else
</span><span class="lines">@@ -249,7 +247,7 @@
</span><span class="cx"> template<typename Entry, typename JSIterator>
</span><span class="cx"> inline void MapDataImpl<Entry, JSIterator>::visitChildren(JSCell* owner, SlotVisitor& visitor)
</span><span class="cx"> {
</span><del>- Entry* entries = m_entries.getWithoutBarrier();
</del><ins>+ Entry* entries = m_entries;
</ins><span class="cx"> if (!entries)
</span><span class="cx"> return;
</span><span class="cx"> if (m_deletedCount) {
</span><span class="lines">@@ -263,14 +261,14 @@
</span><span class="cx"> visitor.appendValues(reinterpret_cast<WriteBarrier<Unknown>*>(&entries[0]), m_size * (sizeof(Entry) / sizeof(WriteBarrier<Unknown>)));
</span><span class="cx"> }
</span><span class="cx">
</span><del>- visitor.copyLater(owner, MapBackingStoreCopyToken, m_entries.getWithoutBarrier(), capacityInBytes());
</del><ins>+ visitor.copyLater(owner, MapBackingStoreCopyToken, entries, capacityInBytes());
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> template<typename Entry, typename JSIterator>
</span><span class="cx"> inline void MapDataImpl<Entry, JSIterator>::copyBackingStore(CopyVisitor& visitor, CopyToken token)
</span><span class="cx"> {
</span><del>- if (token == MapBackingStoreCopyToken && visitor.checkIfShouldCopy(m_entries.getWithoutBarrier())) {
- Entry* oldEntries = m_entries.getWithoutBarrier();
</del><ins>+ if (token == MapBackingStoreCopyToken && visitor.checkIfShouldCopy(m_entries)) {
+ Entry* oldEntries = m_entries;
</ins><span class="cx"> Entry* newEntries = static_cast<Entry*>(visitor.allocateNewSpace(capacityInBytes()));
</span><span class="cx"> if (shouldPack())
</span><span class="cx"> replaceAndPackBackingStore(newEntries, m_capacity);
</span></span></pre></div>
<a id="tagsSafari60217SourceJavaScriptCoreruntimeOptionsh"></a>
<div class="modfile"><h4>Modified: tags/Safari-602.1.7/Source/JavaScriptCore/runtime/Options.h (191149 => 191150)</h4>
<pre class="diff"><span>
<span class="info">--- tags/Safari-602.1.7/Source/JavaScriptCore/runtime/Options.h 2015-10-15 23:38:21 UTC (rev 191149)
+++ tags/Safari-602.1.7/Source/JavaScriptCore/runtime/Options.h 2015-10-15 23:41:01 UTC (rev 191150)
</span><span class="lines">@@ -203,7 +203,6 @@
</span><span class="cx"> v(bool, createPreHeaders, true, nullptr) \
</span><span class="cx"> v(bool, enableMovHintRemoval, true, nullptr) \
</span><span class="cx"> v(bool, enableObjectAllocationSinking, true, nullptr) \
</span><del>- v(bool, enableCopyBarrierOptimization, true, nullptr) \
</del><span class="cx"> \
</span><span class="cx"> v(bool, enableConcurrentJIT, true, "allows the DFG / FTL compilation in threads other than the executing JS thread") \
</span><span class="cx"> v(unsigned, numberOfDFGCompilerThreads, computeNumberOfWorkerThreads(2, 2) - 1, nullptr) \
</span></span></pre>
</div>
</div>
</body>
</html>