<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN"
"http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head><meta http-equiv="content-type" content="text/html; charset=utf-8" />
<title>[198212] trunk/Source/JavaScriptCore</title>
</head>
<body>
<style type="text/css"><!--
#msg dl.meta { border: 1px #006 solid; background: #369; padding: 6px; color: #fff; }
#msg dl.meta dt { float: left; width: 6em; font-weight: bold; }
#msg dt:after { content:':';}
#msg dl, #msg dt, #msg ul, #msg li, #header, #footer, #logmsg { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; }
#msg dl a { font-weight: bold}
#msg dl a:link { color:#fc3; }
#msg dl a:active { color:#ff0; }
#msg dl a:visited { color:#cc6; }
h3 { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; font-weight: bold; }
#msg pre { overflow: auto; background: #ffc; border: 1px #fa0 solid; padding: 6px; }
#logmsg { background: #ffc; border: 1px #fa0 solid; padding: 1em 1em 0 1em; }
#logmsg p, #logmsg pre, #logmsg blockquote { margin: 0 0 1em 0; }
#logmsg p, #logmsg li, #logmsg dt, #logmsg dd { line-height: 14pt; }
#logmsg h1, #logmsg h2, #logmsg h3, #logmsg h4, #logmsg h5, #logmsg h6 { margin: .5em 0; }
#logmsg h1:first-child, #logmsg h2:first-child, #logmsg h3:first-child, #logmsg h4:first-child, #logmsg h5:first-child, #logmsg h6:first-child { margin-top: 0; }
#logmsg ul, #logmsg ol { padding: 0; list-style-position: inside; margin: 0 0 0 1em; }
#logmsg ul { text-indent: -1em; padding-left: 1em; }#logmsg ol { text-indent: -1.5em; padding-left: 1.5em; }
#logmsg > ul, #logmsg > ol { margin: 0 0 1em 0; }
#logmsg pre { background: #eee; padding: 1em; }
#logmsg blockquote { border: 1px solid #fa0; border-left-width: 10px; padding: 1em 1em 0 1em; background: white;}
#logmsg dl { margin: 0; }
#logmsg dt { font-weight: bold; }
#logmsg dd { margin: 0; padding: 0 0 0.5em 0; }
#logmsg dd:before { content:'\00bb';}
#logmsg table { border-spacing: 0px; border-collapse: collapse; border-top: 4px solid #fa0; border-bottom: 1px solid #fa0; background: #fff; }
#logmsg table th { text-align: left; font-weight: normal; padding: 0.2em 0.5em; border-top: 1px dotted #fa0; }
#logmsg table td { text-align: right; border-top: 1px dotted #fa0; padding: 0.2em 0.5em; }
#logmsg table thead th { text-align: center; border-bottom: 1px solid #fa0; }
#logmsg table th.Corner { text-align: left; }
#logmsg hr { border: none 0; border-top: 2px dashed #fa0; height: 1px; }
#header, #footer { color: #fff; background: #636; border: 1px #300 solid; padding: 6px; }
#patch { width: 100%; }
#patch h4 {font-family: verdana,arial,helvetica,sans-serif;font-size:10pt;padding:8px;background:#369;color:#fff;margin:0;}
#patch .propset h4, #patch .binary h4 {margin:0;}
#patch pre {padding:0;line-height:1.2em;margin:0;}
#patch .diff {width:100%;background:#eee;padding: 0 0 10px 0;overflow:auto;}
#patch .propset .diff, #patch .binary .diff {padding:10px 0;}
#patch span {display:block;padding:0 10px;}
#patch .modfile, #patch .addfile, #patch .delfile, #patch .propset, #patch .binary, #patch .copfile {border:1px solid #ccc;margin:10px 0;}
#patch ins {background:#dfd;text-decoration:none;display:block;padding:0 10px;}
#patch del {background:#fdd;text-decoration:none;display:block;padding:0 10px;}
#patch .lines, .info {color:#888;background:#fff;}
--></style>
<div id="msg">
<dl class="meta">
<dt>Revision</dt> <dd><a href="http://trac.webkit.org/projects/webkit/changeset/198212">198212</a></dd>
<dt>Author</dt> <dd>fpizlo@apple.com</dd>
<dt>Date</dt> <dd>2016-03-15 08:26:36 -0700 (Tue, 15 Mar 2016)</dd>
</dl>
<h3>Log Message</h3>
<pre>Remove the Baker barrier from JSC
https://bugs.webkit.org/show_bug.cgi?id=155479
Reviewed by Saam Barati.
It's been a while since I added a Baker barrier, but I never followed it up with an actual
concurrent GC. While thinking about the GC, I became convinced that the right path forward
is to do a non-copying concurrent GC. That is, remove the copied space and just use the
marked space. The downside of using marked space cannot be more than the overhead of the
Baker barrier, so concurrent non-copying GC is definitely better than copying
non-concurrent GC. I also suspect that just plain non-copying non-concurrent GC is going to
be fine also, so the path forward will probably be to first just remove CopiedSpace.
Anyway, for now this patch just removes the Baker barrier. It was a cute implementation but
it just cost performance and I don't think we'll ever use it.
* CMakeLists.txt:
* JavaScriptCore.xcodeproj/project.pbxproj:
* bytecode/PolymorphicAccess.cpp:
(JSC::AccessCase::generate):
* dfg/DFGAbstractInterpreterInlines.h:
(JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
* dfg/DFGArgumentsEliminationPhase.cpp:
* dfg/DFGClobberize.h:
(JSC::DFG::clobberize):
* dfg/DFGCopyBarrierOptimizationPhase.cpp: Removed.
* dfg/DFGCopyBarrierOptimizationPhase.h: Removed.
* dfg/DFGDoesGC.cpp:
(JSC::DFG::doesGC):
* dfg/DFGFixupPhase.cpp:
(JSC::DFG::FixupPhase::fixupNode):
* dfg/DFGHeapLocation.cpp:
(WTF::printInternal):
* dfg/DFGHeapLocation.h:
* dfg/DFGNodeType.h:
* dfg/DFGOperations.cpp:
* dfg/DFGOperations.h:
* dfg/DFGPlan.cpp:
(JSC::DFG::Plan::compileInThreadImpl):
* dfg/DFGPredictionPropagationPhase.cpp:
(JSC::DFG::PredictionPropagationPhase::propagate):
* dfg/DFGSafeToExecute.h:
(JSC::DFG::safeToExecute):
* dfg/DFGSpeculativeJIT.cpp:
(JSC::DFG::SpeculativeJIT::compileGetIndexedPropertyStorage):
(JSC::DFG::SpeculativeJIT::compileGetTypedArrayByteOffset):
(JSC::DFG::SpeculativeJIT::compileGetButterfly):
* dfg/DFGSpeculativeJIT32_64.cpp:
(JSC::DFG::SpeculativeJIT::compile):
* dfg/DFGSpeculativeJIT64.cpp:
(JSC::DFG::SpeculativeJIT::compile):
* dfg/DFGTypeCheckHoistingPhase.cpp:
(JSC::DFG::TypeCheckHoistingPhase::identifyRedundantStructureChecks):
(JSC::DFG::TypeCheckHoistingPhase::identifyRedundantArrayChecks):
* ftl/FTLCapabilities.cpp:
(JSC::FTL::canCompile):
* ftl/FTLLowerDFGToB3.cpp:
(JSC::FTL::DFG::LowerDFGToB3::compileNode):
(JSC::FTL::DFG::LowerDFGToB3::compileGetButterfly):
(JSC::FTL::DFG::LowerDFGToB3::compileConstantStoragePointer):
(JSC::FTL::DFG::LowerDFGToB3::compileGetIndexedPropertyStorage):
(JSC::FTL::DFG::LowerDFGToB3::compileCheckArray):
(JSC::FTL::DFG::LowerDFGToB3::compileGetTypedArrayByteOffset):
(JSC::FTL::DFG::LowerDFGToB3::compileMultiGetByOffset):
(JSC::FTL::DFG::LowerDFGToB3::compileMultiPutByOffset):
(JSC::FTL::DFG::LowerDFGToB3::compileGetDirectPname):
(JSC::FTL::DFG::LowerDFGToB3::storageForTransition):
(JSC::FTL::DFG::LowerDFGToB3::getById):
(JSC::FTL::DFG::LowerDFGToB3::isFastTypedArray):
(JSC::FTL::DFG::LowerDFGToB3::compileGetButterflyReadOnly): Deleted.
(JSC::FTL::DFG::LowerDFGToB3::loadButterflyWithBarrier): Deleted.
(JSC::FTL::DFG::LowerDFGToB3::loadVectorWithBarrier): Deleted.
(JSC::FTL::DFG::LowerDFGToB3::copyBarrier): Deleted.
(JSC::FTL::DFG::LowerDFGToB3::isInToSpace): Deleted.
(JSC::FTL::DFG::LowerDFGToB3::loadButterflyReadOnly): Deleted.
(JSC::FTL::DFG::LowerDFGToB3::loadVectorReadOnly): Deleted.
(JSC::FTL::DFG::LowerDFGToB3::removeSpaceBits): Deleted.
* heap/CopyBarrier.h:
(JSC::CopyBarrierBase::CopyBarrierBase):
(JSC::CopyBarrierBase::operator bool):
(JSC::CopyBarrierBase::get):
(JSC::CopyBarrierBase::clear):
(JSC::CopyBarrierBase::setWithoutBarrier):
(JSC::CopyBarrier::CopyBarrier):
(JSC::CopyBarrier::get):
(JSC::CopyBarrier::set):
(JSC::CopyBarrier::setWithoutBarrier):
(JSC::CopyBarrierBase::operator!): Deleted.
(JSC::CopyBarrierBase::getWithoutBarrier): Deleted.
(JSC::CopyBarrierBase::getPredicated): Deleted.
(JSC::CopyBarrierBase::copyState): Deleted.
(JSC::CopyBarrierBase::setCopyState): Deleted.
(JSC::CopyBarrierBase::weakCASWithoutBarrier): Deleted.
(JSC::CopyBarrier::getWithoutBarrier): Deleted.
(JSC::CopyBarrier::getPredicated): Deleted.
(JSC::CopyBarrier::weakCASWithoutBarrier): Deleted.
* heap/Heap.cpp:
(JSC::Heap::addToRememberedSet):
(JSC::Heap::collectAndSweep):
(JSC::Heap::copyBarrier): Deleted.
* heap/Heap.h:
(JSC::Heap::writeBarrierBuffer):
* jit/AssemblyHelpers.cpp:
(JSC::AssemblyHelpers::branchIfNotFastTypedArray):
(JSC::AssemblyHelpers::purifyNaN):
(JSC::AssemblyHelpers::loadTypedArrayVector): Deleted.
* jit/AssemblyHelpers.h:
(JSC::AssemblyHelpers::branchStructure):
(JSC::AssemblyHelpers::addressForByteOffset):
(JSC::AssemblyHelpers::branchIfToSpace): Deleted.
(JSC::AssemblyHelpers::branchIfNotToSpace): Deleted.
(JSC::AssemblyHelpers::removeSpaceBits): Deleted.
* jit/JIT.cpp:
(JSC::JIT::privateCompileMainPass):
(JSC::JIT::privateCompile):
* jit/JITOpcodes.cpp:
(JSC::JIT::emitSlow_op_has_indexed_property):
(JSC::JIT::emit_op_get_direct_pname):
(JSC::JIT::emitSlow_op_get_direct_pname):
* jit/JITOpcodes32_64.cpp:
(JSC::JIT::emit_op_get_direct_pname):
(JSC::JIT::emitSlow_op_get_direct_pname):
* jit/JITPropertyAccess.cpp:
(JSC::JIT::emitDoubleLoad):
(JSC::JIT::emitContiguousLoad):
(JSC::JIT::emitArrayStorageLoad):
(JSC::JIT::emitSlow_op_get_by_val):
(JSC::JIT::emitGenericContiguousPutByVal):
(JSC::JIT::emitArrayStoragePutByVal):
(JSC::JIT::emitSlow_op_put_by_val):
(JSC::JIT::emit_op_get_from_scope):
(JSC::JIT::emitSlow_op_get_from_scope):
(JSC::JIT::emit_op_put_to_scope):
(JSC::JIT::emitSlow_op_put_to_scope):
(JSC::JIT::emitIntTypedArrayGetByVal):
(JSC::JIT::emitFloatTypedArrayGetByVal):
(JSC::JIT::emitIntTypedArrayPutByVal):
(JSC::JIT::emitFloatTypedArrayPutByVal):
* llint/LowLevelInterpreter.asm:
* llint/LowLevelInterpreter64.asm:
* runtime/DirectArguments.cpp:
(JSC::DirectArguments::visitChildren):
(JSC::DirectArguments::copyBackingStore):
(JSC::DirectArguments::overrideArgument):
(JSC::DirectArguments::copyToArguments):
* runtime/DirectArguments.h:
(JSC::DirectArguments::canAccessIndexQuickly):
(JSC::DirectArguments::canAccessArgumentIndexQuicklyInDFG):
* runtime/JSArray.cpp:
(JSC::JSArray::setLength):
(JSC::JSArray::pop):
(JSC::JSArray::push):
(JSC::JSArray::fastSlice):
(JSC::JSArray::fastConcatWith):
(JSC::JSArray::shiftCountWithArrayStorage):
(JSC::JSArray::shiftCountWithAnyIndexingType):
(JSC::JSArray::unshiftCountWithAnyIndexingType):
(JSC::JSArray::fillArgList):
(JSC::JSArray::copyToArguments):
* runtime/JSArrayBufferView.cpp:
(JSC::JSArrayBufferView::finalize):
* runtime/JSArrayBufferView.h:
(JSC::JSArrayBufferView::isNeutered):
(JSC::JSArrayBufferView::vector):
(JSC::JSArrayBufferView::length):
* runtime/JSGenericTypedArrayViewInlines.h:
(JSC::JSGenericTypedArrayView<Adaptor>::visitChildren):
(JSC::JSGenericTypedArrayView<Adaptor>::copyBackingStore):
* runtime/JSObject.cpp:
(JSC::JSObject::visitChildren):
(JSC::JSObject::copyBackingStore):
(JSC::JSObject::heapSnapshot):
(JSC::JSObject::getOwnPropertySlotByIndex):
(JSC::JSObject::putByIndex):
(JSC::JSObject::enterDictionaryIndexingMode):
(JSC::JSObject::createInitialIndexedStorage):
(JSC::JSObject::createArrayStorage):
(JSC::JSObject::convertUndecidedToInt32):
(JSC::JSObject::convertUndecidedToDouble):
(JSC::JSObject::convertUndecidedToContiguous):
(JSC::JSObject::constructConvertedArrayStorageWithoutCopyingElements):
(JSC::JSObject::convertUndecidedToArrayStorage):
(JSC::JSObject::convertInt32ToDouble):
(JSC::JSObject::convertInt32ToContiguous):
(JSC::JSObject::convertInt32ToArrayStorage):
(JSC::JSObject::convertDoubleToContiguous):
(JSC::JSObject::convertDoubleToArrayStorage):
(JSC::JSObject::convertContiguousToArrayStorage):
(JSC::JSObject::setIndexQuicklyToUndecided):
(JSC::JSObject::ensureArrayStorageExistsAndEnterDictionaryIndexingMode):
(JSC::JSObject::deletePropertyByIndex):
(JSC::JSObject::getOwnPropertyNames):
(JSC::JSObject::putIndexedDescriptor):
(JSC::JSObject::defineOwnIndexedProperty):
(JSC::JSObject::putByIndexBeyondVectorLengthWithoutAttributes):
(JSC::JSObject::putDirectIndexBeyondVectorLength):
(JSC::JSObject::getNewVectorLength):
(JSC::JSObject::ensureLengthSlow):
(JSC::JSObject::reallocateAndShrinkButterfly):
(JSC::JSObject::growOutOfLineStorage):
(JSC::getBoundSlotBaseFunctionForGetterSetter):
(JSC::JSObject::getEnumerableLength):
* runtime/JSObject.h:
(JSC::JSObject::getArrayLength):
(JSC::JSObject::getVectorLength):
(JSC::JSObject::canGetIndexQuickly):
(JSC::JSObject::getIndexQuickly):
(JSC::JSObject::tryGetIndexQuickly):
(JSC::JSObject::canSetIndexQuickly):
(JSC::JSObject::canSetIndexQuicklyForPutDirect):
(JSC::JSObject::setIndexQuickly):
(JSC::JSObject::initializeIndex):
(JSC::JSObject::hasSparseMap):
(JSC::JSObject::inSparseIndexingMode):
(JSC::JSObject::inlineStorage):
(JSC::JSObject::butterfly):
(JSC::JSObject::outOfLineStorage):
(JSC::JSObject::locationForOffset):
(JSC::JSObject::ensureInt32):
(JSC::JSObject::ensureDouble):
(JSC::JSObject::ensureContiguous):
(JSC::JSObject::ensureArrayStorage):
(JSC::JSObject::arrayStorage):
(JSC::JSObject::arrayStorageOrNull):
(JSC::JSObject::ensureLength):
(JSC::JSObject::putDirectWithoutTransition):
* runtime/MapData.h:
(JSC::JSIterator>::IteratorData::next):
(JSC::JSIterator>::IteratorData::refreshCursor):
* runtime/MapDataInlines.h:
(JSC::JSIterator>::find):
(JSC::JSIterator>::add):
(JSC::JSIterator>::remove):
(JSC::JSIterator>::replaceAndPackBackingStore):
(JSC::JSIterator>::replaceBackingStore):
(JSC::JSIterator>::ensureSpaceForAppend):
(JSC::JSIterator>::visitChildren):
(JSC::JSIterator>::copyBackingStore):
* runtime/Options.h:</pre>
<h3>Modified Paths</h3>
<ul>
<li><a href="#trunkSourceJavaScriptCoreCMakeListstxt">trunk/Source/JavaScriptCore/CMakeLists.txt</a></li>
<li><a href="#trunkSourceJavaScriptCoreChangeLog">trunk/Source/JavaScriptCore/ChangeLog</a></li>
<li><a href="#trunkSourceJavaScriptCoreJavaScriptCorexcodeprojprojectpbxproj">trunk/Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj</a></li>
<li><a href="#trunkSourceJavaScriptCorebytecodePolymorphicAccesscpp">trunk/Source/JavaScriptCore/bytecode/PolymorphicAccess.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGAbstractInterpreterInlinesh">trunk/Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGArgumentsEliminationPhasecpp">trunk/Source/JavaScriptCore/dfg/DFGArgumentsEliminationPhase.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGClobberizeh">trunk/Source/JavaScriptCore/dfg/DFGClobberize.h</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGDoesGCcpp">trunk/Source/JavaScriptCore/dfg/DFGDoesGC.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGFixupPhasecpp">trunk/Source/JavaScriptCore/dfg/DFGFixupPhase.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGHeapLocationcpp">trunk/Source/JavaScriptCore/dfg/DFGHeapLocation.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGHeapLocationh">trunk/Source/JavaScriptCore/dfg/DFGHeapLocation.h</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGNodeTypeh">trunk/Source/JavaScriptCore/dfg/DFGNodeType.h</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGOperationscpp">trunk/Source/JavaScriptCore/dfg/DFGOperations.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGOperationsh">trunk/Source/JavaScriptCore/dfg/DFGOperations.h</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGPlancpp">trunk/Source/JavaScriptCore/dfg/DFGPlan.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGPredictionPropagationPhasecpp">trunk/Source/JavaScriptCore/dfg/DFGPredictionPropagationPhase.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGSafeToExecuteh">trunk/Source/JavaScriptCore/dfg/DFGSafeToExecute.h</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGSpeculativeJITcpp">trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGSpeculativeJIT32_64cpp">trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGSpeculativeJIT64cpp">trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGTypeCheckHoistingPhasecpp">trunk/Source/JavaScriptCore/dfg/DFGTypeCheckHoistingPhase.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreftlFTLCapabilitiescpp">trunk/Source/JavaScriptCore/ftl/FTLCapabilities.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreftlFTLLowerDFGToB3cpp">trunk/Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreheapCopyBarrierh">trunk/Source/JavaScriptCore/heap/CopyBarrier.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreheapHeapcpp">trunk/Source/JavaScriptCore/heap/Heap.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreheapHeaph">trunk/Source/JavaScriptCore/heap/Heap.h</a></li>
<li><a href="#trunkSourceJavaScriptCorejitAssemblyHelperscpp">trunk/Source/JavaScriptCore/jit/AssemblyHelpers.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCorejitAssemblyHelpersh">trunk/Source/JavaScriptCore/jit/AssemblyHelpers.h</a></li>
<li><a href="#trunkSourceJavaScriptCorejitJITcpp">trunk/Source/JavaScriptCore/jit/JIT.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCorejitJITOpcodescpp">trunk/Source/JavaScriptCore/jit/JITOpcodes.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCorejitJITOpcodes32_64cpp">trunk/Source/JavaScriptCore/jit/JITOpcodes32_64.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCorejitJITPropertyAccesscpp">trunk/Source/JavaScriptCore/jit/JITPropertyAccess.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCorellintLowLevelInterpreterasm">trunk/Source/JavaScriptCore/llint/LowLevelInterpreter.asm</a></li>
<li><a href="#trunkSourceJavaScriptCorellintLowLevelInterpreter64asm">trunk/Source/JavaScriptCore/llint/LowLevelInterpreter64.asm</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeDirectArgumentscpp">trunk/Source/JavaScriptCore/runtime/DirectArguments.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeDirectArgumentsh">trunk/Source/JavaScriptCore/runtime/DirectArguments.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeJSArraycpp">trunk/Source/JavaScriptCore/runtime/JSArray.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeJSArrayBufferViewcpp">trunk/Source/JavaScriptCore/runtime/JSArrayBufferView.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeJSArrayBufferViewh">trunk/Source/JavaScriptCore/runtime/JSArrayBufferView.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeJSGenericTypedArrayViewInlinesh">trunk/Source/JavaScriptCore/runtime/JSGenericTypedArrayViewInlines.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeJSObjectcpp">trunk/Source/JavaScriptCore/runtime/JSObject.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeJSObjecth">trunk/Source/JavaScriptCore/runtime/JSObject.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeMapDatah">trunk/Source/JavaScriptCore/runtime/MapData.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeMapDataInlinesh">trunk/Source/JavaScriptCore/runtime/MapDataInlines.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeOptionsh">trunk/Source/JavaScriptCore/runtime/Options.h</a></li>
</ul>
<h3>Removed Paths</h3>
<ul>
<li><a href="#trunkSourceJavaScriptCoredfgDFGCopyBarrierOptimizationPhasecpp">trunk/Source/JavaScriptCore/dfg/DFGCopyBarrierOptimizationPhase.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGCopyBarrierOptimizationPhaseh">trunk/Source/JavaScriptCore/dfg/DFGCopyBarrierOptimizationPhase.h</a></li>
</ul>
</div>
<div id="patch">
<h3>Diff</h3>
<a id="trunkSourceJavaScriptCoreCMakeListstxt"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/CMakeLists.txt (198211 => 198212)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/CMakeLists.txt 2016-03-15 15:20:40 UTC (rev 198211)
+++ trunk/Source/JavaScriptCore/CMakeLists.txt 2016-03-15 15:26:36 UTC (rev 198212)
</span><span class="lines">@@ -269,7 +269,6 @@
</span><span class="cx"> dfg/DFGCompilationMode.cpp
</span><span class="cx"> dfg/DFGConstantFoldingPhase.cpp
</span><span class="cx"> dfg/DFGConstantHoistingPhase.cpp
</span><del>- dfg/DFGCopyBarrierOptimizationPhase.cpp
</del><span class="cx"> dfg/DFGCriticalEdgeBreakingPhase.cpp
</span><span class="cx"> dfg/DFGDCEPhase.cpp
</span><span class="cx"> dfg/DFGDesiredIdentifiers.cpp
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreChangeLog"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/ChangeLog (198211 => 198212)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/ChangeLog 2016-03-15 15:20:40 UTC (rev 198211)
+++ trunk/Source/JavaScriptCore/ChangeLog 2016-03-15 15:26:36 UTC (rev 198212)
</span><span class="lines">@@ -1,3 +1,245 @@
</span><ins>+2016-03-15 Filip Pizlo <fpizlo@apple.com>
+
+ Remove the Baker barrier from JSC
+ https://bugs.webkit.org/show_bug.cgi?id=155479
+
+ Reviewed by Saam Barati.
+
+ It's been a while since I added a Baker barrier, but I never followed it up with an actual
+ concurrent GC. While thinking about the GC, I became convinced that the right path forward
+ is to do a non-copying concurrent GC. That is, remove the copied space and just use the
+ marked space. The downside of using marked space cannot be more than the overhead of the
+ Baker barrier, so concurrent non-copying GC is definitely better than copying
+ non-concurrent GC. I also suspect that just plain non-copying non-concurrent GC is going to
+ be fine also, so the path forward will probably be to first just remove CopiedSpace.
+
+ Anyway, for now this patch just removes the Baker barrier. It was a cute implementation but
+ it just cost performance and I don't think we'll ever use it.
+
+ * CMakeLists.txt:
+ * JavaScriptCore.xcodeproj/project.pbxproj:
+ * bytecode/PolymorphicAccess.cpp:
+ (JSC::AccessCase::generate):
+ * dfg/DFGAbstractInterpreterInlines.h:
+ (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+ * dfg/DFGArgumentsEliminationPhase.cpp:
+ * dfg/DFGClobberize.h:
+ (JSC::DFG::clobberize):
+ * dfg/DFGCopyBarrierOptimizationPhase.cpp: Removed.
+ * dfg/DFGCopyBarrierOptimizationPhase.h: Removed.
+ * dfg/DFGDoesGC.cpp:
+ (JSC::DFG::doesGC):
+ * dfg/DFGFixupPhase.cpp:
+ (JSC::DFG::FixupPhase::fixupNode):
+ * dfg/DFGHeapLocation.cpp:
+ (WTF::printInternal):
+ * dfg/DFGHeapLocation.h:
+ * dfg/DFGNodeType.h:
+ * dfg/DFGOperations.cpp:
+ * dfg/DFGOperations.h:
+ * dfg/DFGPlan.cpp:
+ (JSC::DFG::Plan::compileInThreadImpl):
+ * dfg/DFGPredictionPropagationPhase.cpp:
+ (JSC::DFG::PredictionPropagationPhase::propagate):
+ * dfg/DFGSafeToExecute.h:
+ (JSC::DFG::safeToExecute):
+ * dfg/DFGSpeculativeJIT.cpp:
+ (JSC::DFG::SpeculativeJIT::compileGetIndexedPropertyStorage):
+ (JSC::DFG::SpeculativeJIT::compileGetTypedArrayByteOffset):
+ (JSC::DFG::SpeculativeJIT::compileGetButterfly):
+ * dfg/DFGSpeculativeJIT32_64.cpp:
+ (JSC::DFG::SpeculativeJIT::compile):
+ * dfg/DFGSpeculativeJIT64.cpp:
+ (JSC::DFG::SpeculativeJIT::compile):
+ * dfg/DFGTypeCheckHoistingPhase.cpp:
+ (JSC::DFG::TypeCheckHoistingPhase::identifyRedundantStructureChecks):
+ (JSC::DFG::TypeCheckHoistingPhase::identifyRedundantArrayChecks):
+ * ftl/FTLCapabilities.cpp:
+ (JSC::FTL::canCompile):
+ * ftl/FTLLowerDFGToB3.cpp:
+ (JSC::FTL::DFG::LowerDFGToB3::compileNode):
+ (JSC::FTL::DFG::LowerDFGToB3::compileGetButterfly):
+ (JSC::FTL::DFG::LowerDFGToB3::compileConstantStoragePointer):
+ (JSC::FTL::DFG::LowerDFGToB3::compileGetIndexedPropertyStorage):
+ (JSC::FTL::DFG::LowerDFGToB3::compileCheckArray):
+ (JSC::FTL::DFG::LowerDFGToB3::compileGetTypedArrayByteOffset):
+ (JSC::FTL::DFG::LowerDFGToB3::compileMultiGetByOffset):
+ (JSC::FTL::DFG::LowerDFGToB3::compileMultiPutByOffset):
+ (JSC::FTL::DFG::LowerDFGToB3::compileGetDirectPname):
+ (JSC::FTL::DFG::LowerDFGToB3::storageForTransition):
+ (JSC::FTL::DFG::LowerDFGToB3::getById):
+ (JSC::FTL::DFG::LowerDFGToB3::isFastTypedArray):
+ (JSC::FTL::DFG::LowerDFGToB3::compileGetButterflyReadOnly): Deleted.
+ (JSC::FTL::DFG::LowerDFGToB3::loadButterflyWithBarrier): Deleted.
+ (JSC::FTL::DFG::LowerDFGToB3::loadVectorWithBarrier): Deleted.
+ (JSC::FTL::DFG::LowerDFGToB3::copyBarrier): Deleted.
+ (JSC::FTL::DFG::LowerDFGToB3::isInToSpace): Deleted.
+ (JSC::FTL::DFG::LowerDFGToB3::loadButterflyReadOnly): Deleted.
+ (JSC::FTL::DFG::LowerDFGToB3::loadVectorReadOnly): Deleted.
+ (JSC::FTL::DFG::LowerDFGToB3::removeSpaceBits): Deleted.
+ * heap/CopyBarrier.h:
+ (JSC::CopyBarrierBase::CopyBarrierBase):
+ (JSC::CopyBarrierBase::operator bool):
+ (JSC::CopyBarrierBase::get):
+ (JSC::CopyBarrierBase::clear):
+ (JSC::CopyBarrierBase::setWithoutBarrier):
+ (JSC::CopyBarrier::CopyBarrier):
+ (JSC::CopyBarrier::get):
+ (JSC::CopyBarrier::set):
+ (JSC::CopyBarrier::setWithoutBarrier):
+ (JSC::CopyBarrierBase::operator!): Deleted.
+ (JSC::CopyBarrierBase::getWithoutBarrier): Deleted.
+ (JSC::CopyBarrierBase::getPredicated): Deleted.
+ (JSC::CopyBarrierBase::copyState): Deleted.
+ (JSC::CopyBarrierBase::setCopyState): Deleted.
+ (JSC::CopyBarrierBase::weakCASWithoutBarrier): Deleted.
+ (JSC::CopyBarrier::getWithoutBarrier): Deleted.
+ (JSC::CopyBarrier::getPredicated): Deleted.
+ (JSC::CopyBarrier::weakCASWithoutBarrier): Deleted.
+ * heap/Heap.cpp:
+ (JSC::Heap::addToRememberedSet):
+ (JSC::Heap::collectAndSweep):
+ (JSC::Heap::copyBarrier): Deleted.
+ * heap/Heap.h:
+ (JSC::Heap::writeBarrierBuffer):
+ * jit/AssemblyHelpers.cpp:
+ (JSC::AssemblyHelpers::branchIfNotFastTypedArray):
+ (JSC::AssemblyHelpers::purifyNaN):
+ (JSC::AssemblyHelpers::loadTypedArrayVector): Deleted.
+ * jit/AssemblyHelpers.h:
+ (JSC::AssemblyHelpers::branchStructure):
+ (JSC::AssemblyHelpers::addressForByteOffset):
+ (JSC::AssemblyHelpers::branchIfToSpace): Deleted.
+ (JSC::AssemblyHelpers::branchIfNotToSpace): Deleted.
+ (JSC::AssemblyHelpers::removeSpaceBits): Deleted.
+ * jit/JIT.cpp:
+ (JSC::JIT::privateCompileMainPass):
+ (JSC::JIT::privateCompile):
+ * jit/JITOpcodes.cpp:
+ (JSC::JIT::emitSlow_op_has_indexed_property):
+ (JSC::JIT::emit_op_get_direct_pname):
+ (JSC::JIT::emitSlow_op_get_direct_pname):
+ * jit/JITOpcodes32_64.cpp:
+ (JSC::JIT::emit_op_get_direct_pname):
+ (JSC::JIT::emitSlow_op_get_direct_pname):
+ * jit/JITPropertyAccess.cpp:
+ (JSC::JIT::emitDoubleLoad):
+ (JSC::JIT::emitContiguousLoad):
+ (JSC::JIT::emitArrayStorageLoad):
+ (JSC::JIT::emitSlow_op_get_by_val):
+ (JSC::JIT::emitGenericContiguousPutByVal):
+ (JSC::JIT::emitArrayStoragePutByVal):
+ (JSC::JIT::emitSlow_op_put_by_val):
+ (JSC::JIT::emit_op_get_from_scope):
+ (JSC::JIT::emitSlow_op_get_from_scope):
+ (JSC::JIT::emit_op_put_to_scope):
+ (JSC::JIT::emitSlow_op_put_to_scope):
+ (JSC::JIT::emitIntTypedArrayGetByVal):
+ (JSC::JIT::emitFloatTypedArrayGetByVal):
+ (JSC::JIT::emitIntTypedArrayPutByVal):
+ (JSC::JIT::emitFloatTypedArrayPutByVal):
+ * llint/LowLevelInterpreter.asm:
+ * llint/LowLevelInterpreter64.asm:
+ * runtime/DirectArguments.cpp:
+ (JSC::DirectArguments::visitChildren):
+ (JSC::DirectArguments::copyBackingStore):
+ (JSC::DirectArguments::overrideArgument):
+ (JSC::DirectArguments::copyToArguments):
+ * runtime/DirectArguments.h:
+ (JSC::DirectArguments::canAccessIndexQuickly):
+ (JSC::DirectArguments::canAccessArgumentIndexQuicklyInDFG):
+ * runtime/JSArray.cpp:
+ (JSC::JSArray::setLength):
+ (JSC::JSArray::pop):
+ (JSC::JSArray::push):
+ (JSC::JSArray::fastSlice):
+ (JSC::JSArray::fastConcatWith):
+ (JSC::JSArray::shiftCountWithArrayStorage):
+ (JSC::JSArray::shiftCountWithAnyIndexingType):
+ (JSC::JSArray::unshiftCountWithAnyIndexingType):
+ (JSC::JSArray::fillArgList):
+ (JSC::JSArray::copyToArguments):
+ * runtime/JSArrayBufferView.cpp:
+ (JSC::JSArrayBufferView::finalize):
+ * runtime/JSArrayBufferView.h:
+ (JSC::JSArrayBufferView::isNeutered):
+ (JSC::JSArrayBufferView::vector):
+ (JSC::JSArrayBufferView::length):
+ * runtime/JSGenericTypedArrayViewInlines.h:
+ (JSC::JSGenericTypedArrayView<Adaptor>::visitChildren):
+ (JSC::JSGenericTypedArrayView<Adaptor>::copyBackingStore):
+ * runtime/JSObject.cpp:
+ (JSC::JSObject::visitChildren):
+ (JSC::JSObject::copyBackingStore):
+ (JSC::JSObject::heapSnapshot):
+ (JSC::JSObject::getOwnPropertySlotByIndex):
+ (JSC::JSObject::putByIndex):
+ (JSC::JSObject::enterDictionaryIndexingMode):
+ (JSC::JSObject::createInitialIndexedStorage):
+ (JSC::JSObject::createArrayStorage):
+ (JSC::JSObject::convertUndecidedToInt32):
+ (JSC::JSObject::convertUndecidedToDouble):
+ (JSC::JSObject::convertUndecidedToContiguous):
+ (JSC::JSObject::constructConvertedArrayStorageWithoutCopyingElements):
+ (JSC::JSObject::convertUndecidedToArrayStorage):
+ (JSC::JSObject::convertInt32ToDouble):
+ (JSC::JSObject::convertInt32ToContiguous):
+ (JSC::JSObject::convertInt32ToArrayStorage):
+ (JSC::JSObject::convertDoubleToContiguous):
+ (JSC::JSObject::convertDoubleToArrayStorage):
+ (JSC::JSObject::convertContiguousToArrayStorage):
+ (JSC::JSObject::setIndexQuicklyToUndecided):
+ (JSC::JSObject::ensureArrayStorageExistsAndEnterDictionaryIndexingMode):
+ (JSC::JSObject::deletePropertyByIndex):
+ (JSC::JSObject::getOwnPropertyNames):
+ (JSC::JSObject::putIndexedDescriptor):
+ (JSC::JSObject::defineOwnIndexedProperty):
+ (JSC::JSObject::putByIndexBeyondVectorLengthWithoutAttributes):
+ (JSC::JSObject::putDirectIndexBeyondVectorLength):
+ (JSC::JSObject::getNewVectorLength):
+ (JSC::JSObject::ensureLengthSlow):
+ (JSC::JSObject::reallocateAndShrinkButterfly):
+ (JSC::JSObject::growOutOfLineStorage):
+ (JSC::getBoundSlotBaseFunctionForGetterSetter):
+ (JSC::JSObject::getEnumerableLength):
+ * runtime/JSObject.h:
+ (JSC::JSObject::getArrayLength):
+ (JSC::JSObject::getVectorLength):
+ (JSC::JSObject::canGetIndexQuickly):
+ (JSC::JSObject::getIndexQuickly):
+ (JSC::JSObject::tryGetIndexQuickly):
+ (JSC::JSObject::canSetIndexQuickly):
+ (JSC::JSObject::canSetIndexQuicklyForPutDirect):
+ (JSC::JSObject::setIndexQuickly):
+ (JSC::JSObject::initializeIndex):
+ (JSC::JSObject::hasSparseMap):
+ (JSC::JSObject::inSparseIndexingMode):
+ (JSC::JSObject::inlineStorage):
+ (JSC::JSObject::butterfly):
+ (JSC::JSObject::outOfLineStorage):
+ (JSC::JSObject::locationForOffset):
+ (JSC::JSObject::ensureInt32):
+ (JSC::JSObject::ensureDouble):
+ (JSC::JSObject::ensureContiguous):
+ (JSC::JSObject::ensureArrayStorage):
+ (JSC::JSObject::arrayStorage):
+ (JSC::JSObject::arrayStorageOrNull):
+ (JSC::JSObject::ensureLength):
+ (JSC::JSObject::putDirectWithoutTransition):
+ * runtime/MapData.h:
+ (JSC::JSIterator>::IteratorData::next):
+ (JSC::JSIterator>::IteratorData::refreshCursor):
+ * runtime/MapDataInlines.h:
+ (JSC::JSIterator>::find):
+ (JSC::JSIterator>::add):
+ (JSC::JSIterator>::remove):
+ (JSC::JSIterator>::replaceAndPackBackingStore):
+ (JSC::JSIterator>::replaceBackingStore):
+ (JSC::JSIterator>::ensureSpaceForAppend):
+ (JSC::JSIterator>::visitChildren):
+ (JSC::JSIterator>::copyBackingStore):
+ * runtime/Options.h:
+
</ins><span class="cx"> 2016-03-15 Saam barati <sbarati@apple.com>
</span><span class="cx">
</span><span class="cx"> Destructuring parameters are evaluated in the wrong scope
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreJavaScriptCorexcodeprojprojectpbxproj"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj (198211 => 198212)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj 2016-03-15 15:20:40 UTC (rev 198211)
+++ trunk/Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj 2016-03-15 15:26:36 UTC (rev 198212)
</span><span class="lines">@@ -89,8 +89,6 @@
</span><span class="cx"> 0F04396E1B03DC0B009598B7 /* DFGCombinedLiveness.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F04396C1B03DC0B009598B7 /* DFGCombinedLiveness.h */; };
</span><span class="cx"> 0F05C3B41683CF9200BAF45B /* DFGArrayifySlowPathGenerator.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F05C3B21683CF8F00BAF45B /* DFGArrayifySlowPathGenerator.h */; };
</span><span class="cx"> 0F0776BF14FF002B00102332 /* JITCompilationEffort.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F0776BD14FF002800102332 /* JITCompilationEffort.h */; settings = {ATTRIBUTES = (Private, ); }; };
</span><del>- 0F0981F71BC5E565004814F8 /* DFGCopyBarrierOptimizationPhase.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F0981F51BC5E565004814F8 /* DFGCopyBarrierOptimizationPhase.cpp */; };
- 0F0981F81BC5E565004814F8 /* DFGCopyBarrierOptimizationPhase.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F0981F61BC5E565004814F8 /* DFGCopyBarrierOptimizationPhase.h */; };
</del><span class="cx"> 0F0A75221B94BFA900110660 /* InferredType.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F0A75201B94BFA900110660 /* InferredType.cpp */; };
</span><span class="cx"> 0F0A75231B94BFA900110660 /* InferredType.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F0A75211B94BFA900110660 /* InferredType.h */; settings = {ATTRIBUTES = (Private, ); }; };
</span><span class="cx"> 0F0B839C14BCF46300885B4F /* LLIntThunks.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F0B839714BCF45A00885B4F /* LLIntThunks.cpp */; };
</span><span class="lines">@@ -2248,8 +2246,6 @@
</span><span class="cx"> 0F04396C1B03DC0B009598B7 /* DFGCombinedLiveness.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGCombinedLiveness.h; path = dfg/DFGCombinedLiveness.h; sourceTree = "<group>"; };
</span><span class="cx"> 0F05C3B21683CF8F00BAF45B /* DFGArrayifySlowPathGenerator.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGArrayifySlowPathGenerator.h; path = dfg/DFGArrayifySlowPathGenerator.h; sourceTree = "<group>"; };
</span><span class="cx"> 0F0776BD14FF002800102332 /* JITCompilationEffort.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JITCompilationEffort.h; sourceTree = "<group>"; };
</span><del>- 0F0981F51BC5E565004814F8 /* DFGCopyBarrierOptimizationPhase.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGCopyBarrierOptimizationPhase.cpp; path = dfg/DFGCopyBarrierOptimizationPhase.cpp; sourceTree = "<group>"; };
- 0F0981F61BC5E565004814F8 /* DFGCopyBarrierOptimizationPhase.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGCopyBarrierOptimizationPhase.h; path = dfg/DFGCopyBarrierOptimizationPhase.h; sourceTree = "<group>"; };
</del><span class="cx"> 0F0A75201B94BFA900110660 /* InferredType.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = InferredType.cpp; sourceTree = "<group>"; };
</span><span class="cx"> 0F0A75211B94BFA900110660 /* InferredType.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = InferredType.h; sourceTree = "<group>"; };
</span><span class="cx"> 0F0B839714BCF45A00885B4F /* LLIntThunks.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = LLIntThunks.cpp; path = llint/LLIntThunks.cpp; sourceTree = "<group>"; };
</span><span class="lines">@@ -6138,8 +6134,6 @@
</span><span class="cx"> 0F3B3A18153E68EF003ED0FF /* DFGConstantFoldingPhase.h */,
</span><span class="cx"> 0FED67B71B26256D0066CE15 /* DFGConstantHoistingPhase.cpp */,
</span><span class="cx"> 0FED67B81B26256D0066CE15 /* DFGConstantHoistingPhase.h */,
</span><del>- 0F0981F51BC5E565004814F8 /* DFGCopyBarrierOptimizationPhase.cpp */,
- 0F0981F61BC5E565004814F8 /* DFGCopyBarrierOptimizationPhase.h */,
</del><span class="cx"> 0FBE0F6B16C1DB010082C5E8 /* DFGCPSRethreadingPhase.cpp */,
</span><span class="cx"> 0FBE0F6C16C1DB010082C5E8 /* DFGCPSRethreadingPhase.h */,
</span><span class="cx"> A7D89CE617A0B8CC00773AD8 /* DFGCriticalEdgeBreakingPhase.cpp */,
</span><span class="lines">@@ -7206,7 +7200,6 @@
</span><span class="cx"> 0F38B01A17CFE75500B144D3 /* DFGCompilationMode.h in Headers */,
</span><span class="cx"> 0F3B3A1B153E68F4003ED0FF /* DFGConstantFoldingPhase.h in Headers */,
</span><span class="cx"> 0FED67BA1B26256D0066CE15 /* DFGConstantHoistingPhase.h in Headers */,
</span><del>- 0F0981F81BC5E565004814F8 /* DFGCopyBarrierOptimizationPhase.h in Headers */,
</del><span class="cx"> 0FBE0F7316C1DB050082C5E8 /* DFGCPSRethreadingPhase.h in Headers */,
</span><span class="cx"> A7D89CF617A0B8CC00773AD8 /* DFGCriticalEdgeBreakingPhase.h in Headers */,
</span><span class="cx"> 0FFFC95A14EF90A900C72532 /* DFGCSEPhase.h in Headers */,
</span><span class="lines">@@ -8770,7 +8763,6 @@
</span><span class="cx"> 0F38B01917CFE75500B144D3 /* DFGCompilationMode.cpp in Sources */,
</span><span class="cx"> 0F3B3A1A153E68F2003ED0FF /* DFGConstantFoldingPhase.cpp in Sources */,
</span><span class="cx"> 0FED67B91B26256D0066CE15 /* DFGConstantHoistingPhase.cpp in Sources */,
</span><del>- 0F0981F71BC5E565004814F8 /* DFGCopyBarrierOptimizationPhase.cpp in Sources */,
</del><span class="cx"> 0FBE0F7216C1DB030082C5E8 /* DFGCPSRethreadingPhase.cpp in Sources */,
</span><span class="cx"> A7D89CF517A0B8CC00773AD8 /* DFGCriticalEdgeBreakingPhase.cpp in Sources */,
</span><span class="cx"> 0F6183291C45BF070072450B /* AirCCallingConvention.cpp in Sources */,
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorebytecodePolymorphicAccesscpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/bytecode/PolymorphicAccess.cpp (198211 => 198212)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/bytecode/PolymorphicAccess.cpp 2016-03-15 15:20:40 UTC (rev 198211)
+++ trunk/Source/JavaScriptCore/bytecode/PolymorphicAccess.cpp 2016-03-15 15:26:36 UTC (rev 198212)
</span><span class="lines">@@ -576,7 +576,6 @@
</span><span class="cx"> jit.loadPtr(
</span><span class="cx"> CCallHelpers::Address(baseForAccessGPR, JSObject::butterflyOffset()),
</span><span class="cx"> loadedValueGPR);
</span><del>- jit.removeSpaceBits(loadedValueGPR);
</del><span class="cx"> storageGPR = loadedValueGPR;
</span><span class="cx"> }
</span><span class="cx">
</span><span class="lines">@@ -856,7 +855,6 @@
</span><span class="cx"> offsetInInlineStorage(m_offset) * sizeof(JSValue)));
</span><span class="cx"> } else {
</span><span class="cx"> jit.loadPtr(CCallHelpers::Address(baseGPR, JSObject::butterflyOffset()), scratchGPR);
</span><del>- state.failAndIgnore.append(jit.branchIfNotToSpace(scratchGPR));
</del><span class="cx"> jit.storeValue(
</span><span class="cx"> valueRegs,
</span><span class="cx"> CCallHelpers::Address(
</span><span class="lines">@@ -925,7 +923,6 @@
</span><span class="cx"> ASSERT(newSize > oldSize);
</span><span class="cx">
</span><span class="cx"> jit.loadPtr(CCallHelpers::Address(baseGPR, JSObject::butterflyOffset()), scratchGPR3);
</span><del>- slowPath.append(jit.branchIfNotToSpace(scratchGPR3));
</del><span class="cx"> jit.loadPtr(&copiedAllocator->m_currentRemaining, scratchGPR);
</span><span class="cx"> slowPath.append(
</span><span class="cx"> jit.branchSubPtr(
</span><span class="lines">@@ -969,10 +966,8 @@
</span><span class="cx"> JSObject::offsetOfInlineStorage() +
</span><span class="cx"> offsetInInlineStorage(m_offset) * sizeof(JSValue)));
</span><span class="cx"> } else {
</span><del>- if (!scratchGPRHasStorage) {
</del><ins>+ if (!scratchGPRHasStorage)
</ins><span class="cx"> jit.loadPtr(CCallHelpers::Address(baseGPR, JSObject::butterflyOffset()), scratchGPR);
</span><del>- state.failAndIgnore.append(jit.branchIfNotToSpace(scratchGPR));
- }
</del><span class="cx"> jit.storeValue(
</span><span class="cx"> valueRegs,
</span><span class="cx"> CCallHelpers::Address(scratchGPR, offsetInButterfly(m_offset) * sizeof(JSValue)));
</span><span class="lines">@@ -1067,7 +1062,6 @@
</span><span class="cx">
</span><span class="cx"> case ArrayLength: {
</span><span class="cx"> jit.loadPtr(CCallHelpers::Address(baseGPR, JSObject::butterflyOffset()), scratchGPR);
</span><del>- jit.removeSpaceBits(scratchGPR);
</del><span class="cx"> jit.load32(CCallHelpers::Address(scratchGPR, ArrayStorage::lengthOffset()), scratchGPR);
</span><span class="cx"> state.failAndIgnore.append(
</span><span class="cx"> jit.branch32(CCallHelpers::LessThan, scratchGPR, CCallHelpers::TrustedImm32(0)));
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGAbstractInterpreterInlinesh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h (198211 => 198212)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h 2016-03-15 15:20:40 UTC (rev 198211)
+++ trunk/Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h 2016-03-15 15:26:36 UTC (rev 198212)
</span><span class="lines">@@ -2094,7 +2094,6 @@
</span><span class="cx"> }
</span><span class="cx"> break;
</span><span class="cx"> case GetButterfly:
</span><del>- case GetButterflyReadOnly:
</del><span class="cx"> case AllocatePropertyStorage:
</span><span class="cx"> case ReallocatePropertyStorage:
</span><span class="cx"> forNode(node).clear(); // The result is not a JS value.
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGArgumentsEliminationPhasecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGArgumentsEliminationPhase.cpp (198211 => 198212)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGArgumentsEliminationPhase.cpp 2016-03-15 15:20:40 UTC (rev 198211)
+++ trunk/Source/JavaScriptCore/dfg/DFGArgumentsEliminationPhase.cpp 2016-03-15 15:26:36 UTC (rev 198212)
</span><span class="lines">@@ -1,5 +1,5 @@
</span><span class="cx"> /*
</span><del>- * Copyright (C) 2015 Apple Inc. All rights reserved.
</del><ins>+ * Copyright (C) 2015-2016 Apple Inc. All rights reserved.
</ins><span class="cx"> *
</span><span class="cx"> * Redistribution and use in source and binary forms, with or without
</span><span class="cx"> * modification, are permitted provided that the following conditions
</span><span class="lines">@@ -195,7 +195,6 @@
</span><span class="cx"> break;
</span><span class="cx">
</span><span class="cx"> case GetButterfly:
</span><del>- case GetButterflyReadOnly:
</del><span class="cx"> // This barely works. The danger is that the GetButterfly is used by something that
</span><span class="cx"> // does something escaping to a candidate. Fortunately, the only butterfly-using ops
</span><span class="cx"> // that we exempt here also use the candidate directly. If there ever was a
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGClobberizeh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGClobberize.h (198211 => 198212)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGClobberize.h 2016-03-15 15:20:40 UTC (rev 198211)
+++ trunk/Source/JavaScriptCore/dfg/DFGClobberize.h 2016-03-15 15:26:36 UTC (rev 198212)
</span><span class="lines">@@ -803,13 +803,6 @@
</span><span class="cx"> def(HeapLocation(ButterflyLoc, JSObject_butterfly, node->child1()), LazyNode(node));
</span><span class="cx"> return;
</span><span class="cx">
</span><del>- case GetButterflyReadOnly:
- // This rule is separate to prevent CSE of GetButterfly with GetButterflyReadOnly. But in reality,
- // this works because we don't introduce GetButterflyReadOnly until the bitter end of compilation.
- read(JSObject_butterfly);
- def(HeapLocation(ButterflyReadOnlyLoc, JSObject_butterfly, node->child1()), LazyNode(node));
- return;
-
</del><span class="cx"> case Arrayify:
</span><span class="cx"> case ArrayifyToStructure:
</span><span class="cx"> read(JSCell_structureID);
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGCopyBarrierOptimizationPhasecpp"></a>
<div class="delfile"><h4>Deleted: trunk/Source/JavaScriptCore/dfg/DFGCopyBarrierOptimizationPhase.cpp (198211 => 198212)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGCopyBarrierOptimizationPhase.cpp 2016-03-15 15:20:40 UTC (rev 198211)
+++ trunk/Source/JavaScriptCore/dfg/DFGCopyBarrierOptimizationPhase.cpp 2016-03-15 15:26:36 UTC (rev 198212)
</span><span class="lines">@@ -1,133 +0,0 @@
</span><del>-/*
- * Copyright (C) 2015 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- * notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- * notice, this list of conditions and the following disclaimer in the
- * documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
- * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
- * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
- * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
- * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
- * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
- * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
- * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
- * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
- * THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include "config.h"
-#include "DFGCopyBarrierOptimizationPhase.h"
-
-#if ENABLE(DFG_JIT)
-
-#include "DFGClobberize.h"
-#include "DFGDoesGC.h"
-#include "DFGGraph.h"
-#include "DFGPhase.h"
-#include "JSCInlines.h"
-
-namespace JSC { namespace DFG {
-
-namespace {
-
-bool verbose = false;
-
-class CopyBarrierOptimizationPhase : public Phase {
-public:
- CopyBarrierOptimizationPhase(Graph& graph)
- : Phase(graph, "copy barrier optimization")
- {
- }
-
- bool run()
- {
- if (verbose) {
- dataLog("Starting copy barrier optimization:\n");
- m_graph.dump();
- }
-
- // First convert all GetButterfly nodes into GetButterflyReadOnly.
- for (BasicBlock* block : m_graph.blocksInNaturalOrder()) {
- for (Node* node : *block) {
- if (node->op() == GetButterfly)
- node->setOp(GetButterflyReadOnly);
- }
- }
-
- // Anytime we use a GetButterflyReadOnly in a setting that may write to the heap, or if we're in a
- // new epoch, convert it to a GetButterfly. The epoch gets incremented at basic block boundaries,
- // anytime we GC, and anytime a barrier on the butterfly may be executed. We traverse the program
- // in pre-order so that we always see uses after defs. Note that this is a fixpoint because if we
- // turn a GetButterflyReadOnly into a GetButterfly, then we've introduced a butterfly reallocation.
- bool changed = true;
- Epoch currentEpoch = Epoch::first();
- m_graph.clearEpochs();
- while (changed) {
- changed = false;
- for (BasicBlock* block : m_graph.blocksInPreOrder()) {
- currentEpoch.bump();
- for (Node* node : *block) {
- bool writesToHeap = writesOverlap(m_graph, node, Heap);
-
- bool reallocatesButterfly = false;
- if (doesGC(m_graph, node) || writesOverlap(m_graph, node, JSObject_butterfly))
- reallocatesButterfly = true;
- else {
- // This is not an exhaustive list of things that will execute copy barriers. Most
- // things that execute copy barriers also do GC or have writes that overlap the
- // butterfly heap, and we catch that above.
- switch (node->op()) {
- case GetButterfly:
- case MultiPutByOffset:
- reallocatesButterfly = true;
- break;
- default:
- break;
- }
- }
-
- m_graph.doToChildren(
- node,
- [&] (Edge edge) {
- if (edge->op() != GetButterflyReadOnly)
- return;
-
- if (writesToHeap || currentEpoch != edge->epoch()) {
- changed = true;
- edge->setOp(GetButterfly);
- }
- });
-
- if (reallocatesButterfly)
- currentEpoch.bump();
-
- node->setEpoch(currentEpoch);
- }
- }
- }
-
- // This phase always thinks that it changes the graph. That's OK, because it's a late phase.
- return true;
- }
-};
-
-} // anonymous namespace
-
-bool performCopyBarrierOptimization(Graph& graph)
-{
- SamplingRegion samplingRegion("DFG Copy Barrier Optimization Phase");
- return runPhase<CopyBarrierOptimizationPhase>(graph);
-}
-
-} } // namespace JSC::DFG
-
-#endif // ENABLE(DFG_JIT)
-
</del></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGCopyBarrierOptimizationPhaseh"></a>
<div class="delfile"><h4>Deleted: trunk/Source/JavaScriptCore/dfg/DFGCopyBarrierOptimizationPhase.h (198211 => 198212)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGCopyBarrierOptimizationPhase.h 2016-03-15 15:20:40 UTC (rev 198211)
+++ trunk/Source/JavaScriptCore/dfg/DFGCopyBarrierOptimizationPhase.h 2016-03-15 15:26:36 UTC (rev 198212)
</span><span class="lines">@@ -1,44 +0,0 @@
</span><del>-/*
- * Copyright (C) 2015 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- * notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- * notice, this list of conditions and the following disclaimer in the
- * documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
- * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
- * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
- * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
- * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
- * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
- * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
- * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
- * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
- * THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#ifndef DFGCopyBarrierOptimizationPhase_h
-#define DFGCopyBarrierOptimizationPhase_h
-
-#if ENABLE(DFG_JIT)
-
-namespace JSC { namespace DFG {
-
-class Graph;
-
-// Converts GetButterfly nodes into GetButterflyReadOnly nodes whenever the butterfly is only used for
-// read-only operations.
-bool performCopyBarrierOptimization(Graph&);
-
-} } // namespace JSC::DFG
-
-#endif // ENABLE(DFG_JIT)
-
-#endif // DFGCopyBarrierOptimizationPhase_h
-
</del></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGDoesGCcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGDoesGC.cpp (198211 => 198212)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGDoesGC.cpp 2016-03-15 15:20:40 UTC (rev 198211)
+++ trunk/Source/JavaScriptCore/dfg/DFGDoesGC.cpp 2016-03-15 15:26:36 UTC (rev 198212)
</span><span class="lines">@@ -108,7 +108,6 @@
</span><span class="cx"> case CheckStructure:
</span><span class="cx"> case GetExecutable:
</span><span class="cx"> case GetButterfly:
</span><del>- case GetButterflyReadOnly:
</del><span class="cx"> case CheckArray:
</span><span class="cx"> case GetScope:
</span><span class="cx"> case SkipScope:
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGFixupPhasecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGFixupPhase.cpp (198211 => 198212)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGFixupPhase.cpp 2016-03-15 15:20:40 UTC (rev 198211)
+++ trunk/Source/JavaScriptCore/dfg/DFGFixupPhase.cpp 2016-03-15 15:26:36 UTC (rev 198212)
</span><span class="lines">@@ -1151,8 +1151,7 @@
</span><span class="cx"> case CheckStructure:
</span><span class="cx"> case CheckCell:
</span><span class="cx"> case CreateThis:
</span><del>- case GetButterfly:
- case GetButterflyReadOnly: {
</del><ins>+ case GetButterfly: {
</ins><span class="cx"> fixEdge<CellUse>(node->child1());
</span><span class="cx"> break;
</span><span class="cx"> }
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGHeapLocationcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGHeapLocation.cpp (198211 => 198212)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGHeapLocation.cpp 2016-03-15 15:20:40 UTC (rev 198211)
+++ trunk/Source/JavaScriptCore/dfg/DFGHeapLocation.cpp 2016-03-15 15:26:36 UTC (rev 198212)
</span><span class="lines">@@ -92,10 +92,6 @@
</span><span class="cx"> out.print("ButterflyLoc");
</span><span class="cx"> return;
</span><span class="cx">
</span><del>- case ButterflyReadOnlyLoc:
- out.print("ButterflyReadOnlyLoc");
- return;
-
</del><span class="cx"> case CheckTypeInfoFlagsLoc:
</span><span class="cx"> out.print("CheckTypeInfoFlagsLoc");
</span><span class="cx"> return;
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGHeapLocationh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGHeapLocation.h (198211 => 198212)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGHeapLocation.h 2016-03-15 15:20:40 UTC (rev 198211)
+++ trunk/Source/JavaScriptCore/dfg/DFGHeapLocation.h 2016-03-15 15:26:36 UTC (rev 198212)
</span><span class="lines">@@ -39,7 +39,6 @@
</span><span class="cx">
</span><span class="cx"> ArrayLengthLoc,
</span><span class="cx"> ButterflyLoc,
</span><del>- ButterflyReadOnlyLoc,
</del><span class="cx"> CheckTypeInfoFlagsLoc,
</span><span class="cx"> OverridesHasInstanceLoc,
</span><span class="cx"> ClosureVariableLoc,
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGNodeTypeh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGNodeType.h (198211 => 198212)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGNodeType.h 2016-03-15 15:20:40 UTC (rev 198211)
+++ trunk/Source/JavaScriptCore/dfg/DFGNodeType.h 2016-03-15 15:26:36 UTC (rev 198212)
</span><span class="lines">@@ -197,7 +197,6 @@
</span><span class="cx"> macro(AllocatePropertyStorage, NodeMustGenerate | NodeResultStorage) \
</span><span class="cx"> macro(ReallocatePropertyStorage, NodeMustGenerate | NodeResultStorage) \
</span><span class="cx"> macro(GetButterfly, NodeResultStorage) \
</span><del>- macro(GetButterflyReadOnly, NodeResultStorage) /* A node used to replace GetButterfly at the bitter end of compilation. */\
</del><span class="cx"> macro(CheckArray, NodeMustGenerate) \
</span><span class="cx"> macro(Arrayify, NodeMustGenerate) \
</span><span class="cx"> macro(ArrayifyToStructure, NodeMustGenerate) \
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGOperationscpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGOperations.cpp (198211 => 198212)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGOperations.cpp 2016-03-15 15:20:40 UTC (rev 198211)
+++ trunk/Source/JavaScriptCore/dfg/DFGOperations.cpp 2016-03-15 15:26:36 UTC (rev 198212)
</span><span class="lines">@@ -1298,22 +1298,6 @@
</span><span class="cx"> return exec->codeBlock()->stringSwitchJumpTable(tableIndex).offsetForValue(string->value(exec).impl(), std::numeric_limits<int32_t>::min());
</span><span class="cx"> }
</span><span class="cx">
</span><del>-char* JIT_OPERATION operationGetButterfly(ExecState* exec, JSCell* cell)
-{
- VM& vm = exec->vm();
- NativeCallFrameTracer tracer(&vm, exec);
-
- return bitwise_cast<char*>(jsCast<JSObject*>(cell)->butterfly());
-}
-
-char* JIT_OPERATION operationGetArrayBufferVector(ExecState* exec, JSCell* cell)
-{
- VM& vm = exec->vm();
- NativeCallFrameTracer tracer(&vm, exec);
-
- return bitwise_cast<char*>(jsCast<JSArrayBufferView*>(cell)->vector());
-}
-
</del><span class="cx"> void JIT_OPERATION operationNotifyWrite(ExecState* exec, WatchpointSet* set)
</span><span class="cx"> {
</span><span class="cx"> VM& vm = exec->vm();
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGOperationsh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGOperations.h (198211 => 198212)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGOperations.h 2016-03-15 15:20:40 UTC (rev 198211)
+++ trunk/Source/JavaScriptCore/dfg/DFGOperations.h 2016-03-15 15:26:36 UTC (rev 198212)
</span><span class="lines">@@ -145,8 +145,6 @@
</span><span class="cx"> char* JIT_OPERATION operationFindSwitchImmTargetForDouble(ExecState*, EncodedJSValue, size_t tableIndex);
</span><span class="cx"> char* JIT_OPERATION operationSwitchString(ExecState*, size_t tableIndex, JSString*);
</span><span class="cx"> int32_t JIT_OPERATION operationSwitchStringAndGetBranchOffset(ExecState*, size_t tableIndex, JSString*);
</span><del>-char* JIT_OPERATION operationGetButterfly(ExecState*, JSCell*);
-char* JIT_OPERATION operationGetArrayBufferVector(ExecState*, JSCell*);
</del><span class="cx"> void JIT_OPERATION operationNotifyWrite(ExecState*, WatchpointSet*);
</span><span class="cx"> void JIT_OPERATION operationThrowStackOverflowForVarargs(ExecState*) WTF_INTERNAL;
</span><span class="cx"> int32_t JIT_OPERATION operationSizeOfVarargs(ExecState*, EncodedJSValue arguments, int32_t firstVarArgOffset);
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGPlancpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGPlan.cpp (198211 => 198212)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGPlan.cpp 2016-03-15 15:20:40 UTC (rev 198211)
+++ trunk/Source/JavaScriptCore/dfg/DFGPlan.cpp 2016-03-15 15:26:36 UTC (rev 198212)
</span><span class="lines">@@ -38,7 +38,6 @@
</span><span class="cx"> #include "DFGCleanUpPhase.h"
</span><span class="cx"> #include "DFGConstantFoldingPhase.h"
</span><span class="cx"> #include "DFGConstantHoistingPhase.h"
</span><del>-#include "DFGCopyBarrierOptimizationPhase.h"
</del><span class="cx"> #include "DFGCriticalEdgeBreakingPhase.h"
</span><span class="cx"> #include "DFGDCEPhase.h"
</span><span class="cx"> #include "DFGFailedFinalizer.h"
</span><span class="lines">@@ -357,8 +356,6 @@
</span><span class="cx"> performCleanUp(dfg);
</span><span class="cx"> performCPSRethreading(dfg);
</span><span class="cx"> performDCE(dfg);
</span><del>- if (Options::useCopyBarrierOptimization())
- performCopyBarrierOptimization(dfg);
</del><span class="cx"> performPhantomInsertion(dfg);
</span><span class="cx"> performStackLayout(dfg);
</span><span class="cx"> performVirtualRegisterAllocation(dfg);
</span><span class="lines">@@ -439,8 +436,6 @@
</span><span class="cx"> performMovHintRemoval(dfg);
</span><span class="cx"> performCleanUp(dfg);
</span><span class="cx"> performDCE(dfg); // We rely on this to kill dead code that won't be recognized as dead by B3.
</span><del>- if (Options::useCopyBarrierOptimization())
- performCopyBarrierOptimization(dfg);
</del><span class="cx"> performStackLayout(dfg);
</span><span class="cx"> performLivenessAnalysis(dfg);
</span><span class="cx"> performOSRAvailabilityAnalysis(dfg);
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGPredictionPropagationPhasecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGPredictionPropagationPhase.cpp (198211 => 198212)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGPredictionPropagationPhase.cpp 2016-03-15 15:20:40 UTC (rev 198211)
+++ trunk/Source/JavaScriptCore/dfg/DFGPredictionPropagationPhase.cpp 2016-03-15 15:26:36 UTC (rev 198212)
</span><span class="lines">@@ -483,7 +483,6 @@
</span><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> case GetButterfly:
</span><del>- case GetButterflyReadOnly:
</del><span class="cx"> case GetIndexedPropertyStorage:
</span><span class="cx"> case AllocatePropertyStorage:
</span><span class="cx"> case ReallocatePropertyStorage: {
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGSafeToExecuteh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGSafeToExecute.h (198211 => 198212)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGSafeToExecute.h 2016-03-15 15:20:40 UTC (rev 198211)
+++ trunk/Source/JavaScriptCore/dfg/DFGSafeToExecute.h 2016-03-15 15:26:36 UTC (rev 198212)
</span><span class="lines">@@ -203,7 +203,6 @@
</span><span class="cx"> case CheckStructure:
</span><span class="cx"> case GetExecutable:
</span><span class="cx"> case GetButterfly:
</span><del>- case GetButterflyReadOnly:
</del><span class="cx"> case CheckArray:
</span><span class="cx"> case Arrayify:
</span><span class="cx"> case ArrayifyToStructure:
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGSpeculativeJITcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp (198211 => 198212)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp 2016-03-15 15:20:40 UTC (rev 198211)
+++ trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp 2016-03-15 15:26:36 UTC (rev 198212)
</span><span class="lines">@@ -5226,10 +5226,7 @@
</span><span class="cx"> default:
</span><span class="cx"> ASSERT(isTypedView(node->arrayMode().typedArrayType()));
</span><span class="cx">
</span><del>- JITCompiler::Jump fail = m_jit.loadTypedArrayVector(baseReg, storageReg);
-
- addSlowPathGenerator(
- slowPathCall(fail, this, operationGetArrayBufferVector, storageReg, baseReg));
</del><ins>+ m_jit.loadPtr(JITCompiler::Address(baseReg, JSArrayBufferView::offsetOfVector()), storageReg);
</ins><span class="cx"> break;
</span><span class="cx"> }
</span><span class="cx">
</span><span class="lines">@@ -5252,13 +5249,7 @@
</span><span class="cx"> TrustedImm32(WastefulTypedArray));
</span><span class="cx">
</span><span class="cx"> m_jit.loadPtr(MacroAssembler::Address(baseGPR, JSObject::butterflyOffset()), dataGPR);
</span><del>- m_jit.removeSpaceBits(dataGPR);
</del><span class="cx"> m_jit.loadPtr(MacroAssembler::Address(baseGPR, JSArrayBufferView::offsetOfVector()), vectorGPR);
</span><del>- JITCompiler::JumpList vectorReady;
- vectorReady.append(m_jit.branchIfToSpace(vectorGPR));
- vectorReady.append(m_jit.branchIfNotFastTypedArray(baseGPR));
- m_jit.removeSpaceBits(vectorGPR);
- vectorReady.link(&m_jit);
</del><span class="cx"> m_jit.loadPtr(MacroAssembler::Address(dataGPR, Butterfly::offsetOfArrayBuffer()), dataGPR);
</span><span class="cx"> m_jit.loadPtr(MacroAssembler::Address(dataGPR, ArrayBuffer::offsetOfData()), dataGPR);
</span><span class="cx"> m_jit.subPtr(dataGPR, vectorGPR);
</span><span class="lines">@@ -6322,23 +6313,6 @@
</span><span class="cx">
</span><span class="cx"> m_jit.loadPtr(JITCompiler::Address(baseGPR, JSObject::butterflyOffset()), resultGPR);
</span><span class="cx">
</span><del>- switch (node->op()) {
- case GetButterfly:
- addSlowPathGenerator(
- slowPathCall(
- m_jit.branchIfNotToSpace(resultGPR),
- this, operationGetButterfly, resultGPR, baseGPR));
- break;
-
- case GetButterflyReadOnly:
- m_jit.removeSpaceBits(resultGPR);
- break;
-
- default:
- DFG_CRASH(m_jit.graph(), node, "Bad node type");
- break;
- }
-
</del><span class="cx"> storageResult(resultGPR, node);
</span><span class="cx"> }
</span><span class="cx">
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGSpeculativeJIT32_64cpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp (198211 => 198212)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp 2016-03-15 15:20:40 UTC (rev 198211)
+++ trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp 2016-03-15 15:26:36 UTC (rev 198212)
</span><span class="lines">@@ -4126,7 +4126,6 @@
</span><span class="cx"> break;
</span><span class="cx">
</span><span class="cx"> case GetButterfly:
</span><del>- case GetButterflyReadOnly:
</del><span class="cx"> compileGetButterfly(node);
</span><span class="cx"> break;
</span><span class="cx">
</span><span class="lines">@@ -4813,7 +4812,6 @@
</span><span class="cx"> // We use resultPayloadGPR as a temporary here. We have to make sure clobber it after getting the
</span><span class="cx"> // value out of indexGPR and enumeratorGPR because resultPayloadGPR could reuse either of those registers.
</span><span class="cx"> m_jit.loadPtr(MacroAssembler::Address(baseGPR, JSObject::butterflyOffset()), resultPayloadGPR);
</span><del>- slowPath.append(m_jit.branchIfNotToSpace(resultPayloadGPR));
</del><span class="cx"> int32_t offsetOfFirstProperty = static_cast<int32_t>(offsetInButterfly(firstOutOfLineOffset)) * sizeof(EncodedJSValue);
</span><span class="cx"> m_jit.load32(MacroAssembler::BaseIndex(resultPayloadGPR, scratchGPR, MacroAssembler::TimesEight, offsetOfFirstProperty + OBJECT_OFFSETOF(JSValue, u.asBits.tag)), resultTagGPR);
</span><span class="cx"> m_jit.load32(MacroAssembler::BaseIndex(resultPayloadGPR, scratchGPR, MacroAssembler::TimesEight, offsetOfFirstProperty + OBJECT_OFFSETOF(JSValue, u.asBits.payload)), resultPayloadGPR);
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGSpeculativeJIT64cpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp (198211 => 198212)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp 2016-03-15 15:20:40 UTC (rev 198211)
+++ trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp 2016-03-15 15:26:36 UTC (rev 198212)
</span><span class="lines">@@ -4147,7 +4147,6 @@
</span><span class="cx"> break;
</span><span class="cx">
</span><span class="cx"> case GetButterfly:
</span><del>- case GetButterflyReadOnly:
</del><span class="cx"> compileGetButterfly(node);
</span><span class="cx"> break;
</span><span class="cx">
</span><span class="lines">@@ -4818,7 +4817,6 @@
</span><span class="cx"> // Otherwise it's out of line
</span><span class="cx"> outOfLineAccess.link(&m_jit);
</span><span class="cx"> m_jit.loadPtr(MacroAssembler::Address(baseGPR, JSObject::butterflyOffset()), scratch2GPR);
</span><del>- slowPath.append(m_jit.branchIfNotToSpace(scratch2GPR));
</del><span class="cx"> m_jit.move(indexGPR, scratch1GPR);
</span><span class="cx"> m_jit.sub32(MacroAssembler::Address(enumeratorGPR, JSPropertyNameEnumerator::cachedInlineCapacityOffset()), scratch1GPR);
</span><span class="cx"> m_jit.neg32(scratch1GPR);
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGTypeCheckHoistingPhasecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGTypeCheckHoistingPhase.cpp (198211 => 198212)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGTypeCheckHoistingPhase.cpp 2016-03-15 15:20:40 UTC (rev 198211)
+++ trunk/Source/JavaScriptCore/dfg/DFGTypeCheckHoistingPhase.cpp 2016-03-15 15:26:36 UTC (rev 198212)
</span><span class="lines">@@ -247,7 +247,6 @@
</span><span class="cx"> case AllocatePropertyStorage:
</span><span class="cx"> case ReallocatePropertyStorage:
</span><span class="cx"> case GetButterfly:
</span><del>- case GetButterflyReadOnly:
</del><span class="cx"> case GetByVal:
</span><span class="cx"> case PutByValDirect:
</span><span class="cx"> case PutByVal:
</span><span class="lines">@@ -326,7 +325,6 @@
</span><span class="cx"> case PutStructure:
</span><span class="cx"> case ReallocatePropertyStorage:
</span><span class="cx"> case GetButterfly:
</span><del>- case GetButterflyReadOnly:
</del><span class="cx"> case GetByVal:
</span><span class="cx"> case PutByValDirect:
</span><span class="cx"> case PutByVal:
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreftlFTLCapabilitiescpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/ftl/FTLCapabilities.cpp (198211 => 198212)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/ftl/FTLCapabilities.cpp 2016-03-15 15:20:40 UTC (rev 198211)
+++ trunk/Source/JavaScriptCore/ftl/FTLCapabilities.cpp 2016-03-15 15:26:36 UTC (rev 198212)
</span><span class="lines">@@ -69,7 +69,6 @@
</span><span class="cx"> case ArrayifyToStructure:
</span><span class="cx"> case PutStructure:
</span><span class="cx"> case GetButterfly:
</span><del>- case GetButterflyReadOnly:
</del><span class="cx"> case NewObject:
</span><span class="cx"> case NewArray:
</span><span class="cx"> case NewArrayBuffer:
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreftlFTLLowerDFGToB3cpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp (198211 => 198212)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp 2016-03-15 15:20:40 UTC (rev 198211)
+++ trunk/Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp 2016-03-15 15:26:36 UTC (rev 198212)
</span><span class="lines">@@ -615,9 +615,6 @@
</span><span class="cx"> case GetButterfly:
</span><span class="cx"> compileGetButterfly();
</span><span class="cx"> break;
</span><del>- case GetButterflyReadOnly:
- compileGetButterflyReadOnly();
- break;
</del><span class="cx"> case ConstantStoragePointer:
</span><span class="cx"> compileConstantStoragePointer();
</span><span class="cx"> break;
</span><span class="lines">@@ -2394,14 +2391,9 @@
</span><span class="cx">
</span><span class="cx"> void compileGetButterfly()
</span><span class="cx"> {
</span><del>- setStorage(loadButterflyWithBarrier(lowCell(m_node->child1())));
</del><ins>+ setStorage(m_out.loadPtr(lowCell(m_node->child1()), m_heaps.JSObject_butterfly));
</ins><span class="cx"> }
</span><span class="cx">
</span><del>- void compileGetButterflyReadOnly()
- {
- setStorage(loadButterflyReadOnly(lowCell(m_node->child1())));
- }
-
</del><span class="cx"> void compileConstantStoragePointer()
</span><span class="cx"> {
</span><span class="cx"> setStorage(m_out.constIntPtr(m_node->storagePointer()));
</span><span class="lines">@@ -2434,7 +2426,7 @@
</span><span class="cx"> return;
</span><span class="cx"> }
</span><span class="cx">
</span><del>- setStorage(loadVectorWithBarrier(cell));
</del><ins>+ setStorage(m_out.loadPtr(cell, m_heaps.JSArrayBufferView_vector));
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> void compileCheckArray()
</span><span class="lines">@@ -2471,8 +2463,8 @@
</span><span class="cx">
</span><span class="cx"> m_out.appendTo(wastefulCase, continuation);
</span><span class="cx">
</span><del>- LValue vectorPtr = loadVectorReadOnly(basePtr);
- LValue butterflyPtr = loadButterflyReadOnly(basePtr);
</del><ins>+ LValue vectorPtr = m_out.loadPtr(basePtr, m_heaps.JSArrayBufferView_vector);
+ LValue butterflyPtr = m_out.loadPtr(basePtr, m_heaps.JSObject_butterfly);
</ins><span class="cx"> LValue arrayBufferPtr = m_out.loadPtr(butterflyPtr, m_heaps.Butterfly_arrayBuffer);
</span><span class="cx"> LValue dataPtr = m_out.loadPtr(arrayBufferPtr, m_heaps.ArrayBuffer_data);
</span><span class="cx">
</span><span class="lines">@@ -4342,7 +4334,7 @@
</span><span class="cx"> else
</span><span class="cx"> propertyBase = weakPointer(method.prototype()->value().asCell());
</span><span class="cx"> if (!isInlineOffset(method.offset()))
</span><del>- propertyBase = loadButterflyReadOnly(propertyBase);
</del><ins>+ propertyBase = m_out.loadPtr(propertyBase, m_heaps.JSObject_butterfly);
</ins><span class="cx"> result = loadProperty(
</span><span class="cx"> propertyBase, data.identifierNumber, method.offset());
</span><span class="cx"> break;
</span><span class="lines">@@ -4410,7 +4402,7 @@
</span><span class="cx"> if (isInlineOffset(variant.offset()))
</span><span class="cx"> storage = base;
</span><span class="cx"> else
</span><del>- storage = loadButterflyWithBarrier(base);
</del><ins>+ storage = m_out.loadPtr(base, m_heaps.JSObject_butterfly);
</ins><span class="cx"> } else {
</span><span class="cx"> m_graph.m_plan.transitions.addLazily(
</span><span class="cx"> codeBlock(), m_node->origin.semantic.codeOriginOwner(),
</span><span class="lines">@@ -6182,7 +6174,7 @@
</span><span class="cx"> m_out.jump(continuation);
</span><span class="cx">
</span><span class="cx"> m_out.appendTo(outOfLineLoad, slowCase);
</span><del>- LValue storage = loadButterflyReadOnly(base);
</del><ins>+ LValue storage = m_out.loadPtr(base, m_heaps.JSObject_butterfly);
</ins><span class="cx"> LValue realIndex = m_out.signExt32To64(
</span><span class="cx"> m_out.neg(m_out.sub(index, m_out.load32(enumerator, m_heaps.JSPropertyNameEnumerator_cachedInlineCapacity))));
</span><span class="cx"> int32_t offsetOfFirstProperty = static_cast<int32_t>(offsetInButterfly(firstOutOfLineOffset)) * sizeof(EncodedJSValue);
</span><span class="lines">@@ -6955,14 +6947,14 @@
</span><span class="cx"> return object;
</span><span class="cx">
</span><span class="cx"> if (previousStructure->outOfLineCapacity() == nextStructure->outOfLineCapacity())
</span><del>- return loadButterflyWithBarrier(object);
</del><ins>+ return m_out.loadPtr(object, m_heaps.JSObject_butterfly);
</ins><span class="cx">
</span><span class="cx"> LValue result;
</span><span class="cx"> if (!previousStructure->outOfLineCapacity())
</span><span class="cx"> result = allocatePropertyStorage(object, previousStructure);
</span><span class="cx"> else {
</span><span class="cx"> result = reallocatePropertyStorage(
</span><del>- object, loadButterflyWithBarrier(object),
</del><ins>+ object, m_out.loadPtr(object, m_heaps.JSObject_butterfly),
</ins><span class="cx"> previousStructure, nextStructure);
</span><span class="cx"> }
</span><span class="cx">
</span><span class="lines">@@ -7125,110 +7117,6 @@
</span><span class="cx"> return patchpoint;
</span><span class="cx"> }
</span><span class="cx">
</span><del>- LValue loadButterflyWithBarrier(LValue object)
- {
- return copyBarrier(
- object, m_out.loadPtr(object, m_heaps.JSObject_butterfly), operationGetButterfly);
- }
-
- LValue loadVectorWithBarrier(LValue object)
- {
- LValue fastResultValue = m_out.loadPtr(object, m_heaps.JSArrayBufferView_vector);
- return copyBarrier(
- fastResultValue,
- [&] () -> LValue {
- LBasicBlock slowPath = m_out.newBlock();
- LBasicBlock continuation = m_out.newBlock();
-
- ValueFromBlock fastResult = m_out.anchor(fastResultValue);
- m_out.branch(isFastTypedArray(object), rarely(slowPath), usually(continuation));
-
- LBasicBlock lastNext = m_out.appendTo(slowPath, continuation);
-
- LValue slowResultValue = lazySlowPath(
- [=] (const Vector<Location>& locations) -> RefPtr<LazySlowPath::Generator> {
- return createLazyCallGenerator(
- operationGetArrayBufferVector, locations[0].directGPR(),
- locations[1].directGPR());
- }, object);
- ValueFromBlock slowResult = m_out.anchor(slowResultValue);
- m_out.jump(continuation);
-
- m_out.appendTo(continuation, lastNext);
- return m_out.phi(m_out.intPtr, fastResult, slowResult);
- });
- }
-
- LValue copyBarrier(LValue object, LValue pointer, P_JITOperation_EC slowPathFunction)
- {
- return copyBarrier(
- pointer,
- [&] () -> LValue {
- return lazySlowPath(
- [=] (const Vector<Location>& locations) -> RefPtr<LazySlowPath::Generator> {
- return createLazyCallGenerator(
- slowPathFunction, locations[0].directGPR(), locations[1].directGPR());
- }, object);
- });
- }
-
- template<typename Functor>
- LValue copyBarrier(LValue pointer, const Functor& functor)
- {
- LBasicBlock slowPath = m_out.newBlock();
- LBasicBlock continuation = m_out.newBlock();
-
- ValueFromBlock fastResult = m_out.anchor(pointer);
- m_out.branch(isInToSpace(pointer), usually(continuation), rarely(slowPath));
-
- LBasicBlock lastNext = m_out.appendTo(slowPath, continuation);
-
- ValueFromBlock slowResult = m_out.anchor(functor());
- m_out.jump(continuation);
-
- m_out.appendTo(continuation, lastNext);
- return m_out.phi(m_out.intPtr, fastResult, slowResult);
- }
-
- LValue isInToSpace(LValue pointer)
- {
- return m_out.testIsZeroPtr(pointer, m_out.constIntPtr(CopyBarrierBase::spaceBits));
- }
-
- LValue loadButterflyReadOnly(LValue object)
- {
- return removeSpaceBits(m_out.loadPtr(object, m_heaps.JSObject_butterfly));
- }
-
- LValue loadVectorReadOnly(LValue object)
- {
- LValue fastResultValue = m_out.loadPtr(object, m_heaps.JSArrayBufferView_vector);
-
- LBasicBlock possiblyFromSpace = m_out.newBlock();
- LBasicBlock continuation = m_out.newBlock();
-
- ValueFromBlock fastResult = m_out.anchor(fastResultValue);
-
- m_out.branch(isInToSpace(fastResultValue), usually(continuation), rarely(possiblyFromSpace));
-
- LBasicBlock lastNext = m_out.appendTo(possiblyFromSpace, continuation);
-
- LValue slowResultValue = m_out.select(
- isFastTypedArray(object), removeSpaceBits(fastResultValue), fastResultValue);
- ValueFromBlock slowResult = m_out.anchor(slowResultValue);
- m_out.jump(continuation);
-
- m_out.appendTo(continuation, lastNext);
-
- return m_out.phi(m_out.intPtr, fastResult, slowResult);
- }
-
- LValue removeSpaceBits(LValue storage)
- {
- return m_out.bitAnd(
- storage, m_out.constIntPtr(~static_cast<intptr_t>(CopyBarrierBase::spaceBits)));
- }
-
</del><span class="cx"> LValue isFastTypedArray(LValue object)
</span><span class="cx"> {
</span><span class="cx"> return m_out.equal(
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreheapCopyBarrierh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/heap/CopyBarrier.h (198211 => 198212)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/heap/CopyBarrier.h 2016-03-15 15:20:40 UTC (rev 198211)
+++ trunk/Source/JavaScriptCore/heap/CopyBarrier.h 2016-03-15 15:26:36 UTC (rev 198212)
</span><span class="lines">@@ -1,5 +1,5 @@
</span><span class="cx"> /*
</span><del>- * Copyright (C) 2014, 2015 Apple Inc. All rights reserved.
</del><ins>+ * Copyright (C) 2014-2016 Apple Inc. All rights reserved.
</ins><span class="cx"> *
</span><span class="cx"> * Redistribution and use in source and binary forms, with or without
</span><span class="cx"> * modification, are permitted provided that the following conditions
</span><span class="lines">@@ -30,88 +30,20 @@
</span><span class="cx">
</span><span class="cx"> namespace JSC {
</span><span class="cx">
</span><del>-enum class CopyState {
- // The backing store is not planned to get copied in this epoch. If you keep a pointer to the backing
- // store on the stack, it will not get copied. If you don't keep it on the stack, it may get copied
- // starting at the next handshake (that is, it may transition from ToSpace to CopyPlanned, but
- // CopyPlanned means ToSpace prior to the handshake that starts the copy phase).
- ToSpace,
-
- // The marking phase has selected this backing store to be copied. If we are not yet in the copying
- // phase, this backing store is still in to-space. All that is needed in such a case is to mask off the
- // low bits. If we are in the copying phase, this means that the object points to from-space. The
- // barrier should first copy the object - or wait for copying to finish - before using the object.
- CopyPlanned,
-
- // The object is being copied right now. Anyone wanting to use the object must wait for the object to
- // finish being copied. Notifications about copying use the ParkingLot combined with these bits. If the
- // state is CopyingAndWaiting, then when the copying finishes, whatever thread was doing it will
- // unparkAll() on the address of the CopyBarrierBase. So, to wait for copying to finish, CAS this to
- // CopyingAndWaiting and then parkConditionally on the barrier address.
- Copying,
-
- // The object is being copied right now, and there are one or more threads parked. Those threads want
- // to be unparked when copying is done. So, whichever thread does the copying needs to call unparkAll()
- // on the barrier address after copying is done.
- CopyingAndWaiting
-};
-
</del><span class="cx"> class CopyBarrierBase {
</span><span class="cx"> public:
</span><del>- static const unsigned spaceBits = 3;
-
</del><span class="cx"> CopyBarrierBase()
</span><span class="cx"> : m_value(nullptr)
</span><span class="cx"> {
</span><span class="cx"> }
</span><span class="cx">
</span><del>- bool operator!() const { return !m_value; }
-
</del><span class="cx"> explicit operator bool() const { return m_value; }
</span><span class="cx">
</span><del>- void* getWithoutBarrier() const
</del><ins>+ void* get() const
</ins><span class="cx"> {
</span><span class="cx"> return m_value;
</span><span class="cx"> }
</span><span class="cx">
</span><del>- // Use this version of get() if you only want to execute the barrier slow path if some condition
- // holds, and you only want to evaluate that condition after first checking the barrier's
- // condition. Usually, you just want to use get().
- template<typename Functor>
- void* getPredicated(const JSCell* owner, const Functor& functor) const
- {
- void* result = m_value;
- if (UNLIKELY(bitwise_cast<uintptr_t>(result) & spaceBits)) {
- if (functor())
- return Heap::copyBarrier(owner, m_value);
- }
- return result;
- }
-
- // When we are in the concurrent copying phase, this method may lock the barrier object (i.e. the field
- // pointing to copied space) and call directly into the owning object's copyBackingStore() method.
- void* get(const JSCell* owner) const
- {
- return getPredicated(owner, [] () -> bool { return true; });
- }
-
- CopyState copyState() const
- {
- return static_cast<CopyState>(bitwise_cast<uintptr_t>(m_value) & spaceBits);
- }
-
- // This only works when you know that there is nobody else concurrently messing with this CopyBarrier.
- // That's hard to guarantee, though there are a few unusual places where this ends up being safe.
- // Usually you want to use CopyBarrier::weakCAS().
- void setCopyState(CopyState copyState)
- {
- WTF::storeStoreFence();
- uintptr_t value = bitwise_cast<uintptr_t>(m_value);
- value &= ~static_cast<uintptr_t>(spaceBits);
- value |= static_cast<uintptr_t>(copyState);
- m_value = bitwise_cast<void*>(value);
- }
-
</del><span class="cx"> void clear() { m_value = nullptr; }
</span><span class="cx">
</span><span class="cx"> protected:
</span><span class="lines">@@ -131,15 +63,6 @@
</span><span class="cx"> this->m_value = value;
</span><span class="cx"> }
</span><span class="cx">
</span><del>- bool weakCASWithoutBarrier(
- void* oldPointer, CopyState oldCopyState, void* newPointer, CopyState newCopyState)
- {
- uintptr_t oldValue = bitwise_cast<uintptr_t>(oldPointer) | static_cast<uintptr_t>(oldCopyState);
- uintptr_t newValue = bitwise_cast<uintptr_t>(newPointer) | static_cast<uintptr_t>(newCopyState);
- return WTF::weakCompareAndSwap(
- &m_value, bitwise_cast<void*>(oldValue), bitwise_cast<void*>(newValue));
- }
-
</del><span class="cx"> private:
</span><span class="cx"> mutable void* m_value;
</span><span class="cx"> };
</span><span class="lines">@@ -161,22 +84,11 @@
</span><span class="cx"> {
</span><span class="cx"> }
</span><span class="cx">
</span><del>- T* getWithoutBarrier() const
</del><ins>+ T* get() const
</ins><span class="cx"> {
</span><del>- return bitwise_cast<T*>(CopyBarrierBase::getWithoutBarrier());
</del><ins>+ return bitwise_cast<T*>(CopyBarrierBase::get());
</ins><span class="cx"> }
</span><del>-
- T* get(const JSCell* owner) const
- {
- return bitwise_cast<T*>(CopyBarrierBase::get(owner));
- }
</del><span class="cx">
</span><del>- template<typename Functor>
- T* getPredicated(const JSCell* owner, const Functor& functor) const
- {
- return bitwise_cast<T*>(CopyBarrierBase::getPredicated(owner, functor));
- }
-
</del><span class="cx"> void set(VM& vm, const JSCell* owner, T* value)
</span><span class="cx"> {
</span><span class="cx"> CopyBarrierBase::set(vm, owner, value);
</span><span class="lines">@@ -186,11 +98,6 @@
</span><span class="cx"> {
</span><span class="cx"> CopyBarrierBase::setWithoutBarrier(value);
</span><span class="cx"> }
</span><del>-
- bool weakCASWithoutBarrier(T* oldPointer, CopyState oldCopyState, T* newPointer, CopyState newCopyState)
- {
- return CopyBarrierBase::weakCASWithoutBarrier(oldPointer, oldCopyState, newPointer, newCopyState);
- }
</del><span class="cx"> };
</span><span class="cx">
</span><span class="cx"> } // namespace JSC
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreheapHeapcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/heap/Heap.cpp (198211 => 198212)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/heap/Heap.cpp 2016-03-15 15:20:40 UTC (rev 198211)
+++ trunk/Source/JavaScriptCore/heap/Heap.cpp 2016-03-15 15:26:36 UTC (rev 198212)
</span><span class="lines">@@ -1,5 +1,5 @@
</span><span class="cx"> /*
</span><del>- * Copyright (C) 2003-2009, 2011, 2013-2015 Apple Inc. All rights reserved.
</del><ins>+ * Copyright (C) 2003-2009, 2011, 2013-2016 Apple Inc. All rights reserved.
</ins><span class="cx"> * Copyright (C) 2007 Eric Seidel <eric@webkit.org>
</span><span class="cx"> *
</span><span class="cx"> * This library is free software; you can redistribute it and/or
</span><span class="lines">@@ -1083,16 +1083,6 @@
</span><span class="cx"> m_slotVisitor.appendToMarkStack(const_cast<JSCell*>(cell));
</span><span class="cx"> }
</span><span class="cx">
</span><del>-void* Heap::copyBarrier(const JSCell*, void*& pointer)
-{
- // Do nothing for now, except making sure that the low bits are masked off. This helps to
- // simulate enough of this barrier that at least we can test the low bits assumptions.
- pointer = bitwise_cast<void*>(
- bitwise_cast<uintptr_t>(pointer) & ~static_cast<uintptr_t>(CopyBarrierBase::spaceBits));
-
- return pointer;
-}
-
</del><span class="cx"> void Heap::collectAndSweep(HeapOperation collectionType)
</span><span class="cx"> {
</span><span class="cx"> if (!m_isSafeToCollect)
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreheapHeaph"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/heap/Heap.h (198211 => 198212)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/heap/Heap.h 2016-03-15 15:20:40 UTC (rev 198211)
+++ trunk/Source/JavaScriptCore/heap/Heap.h 2016-03-15 15:26:36 UTC (rev 198212)
</span><span class="lines">@@ -1,7 +1,7 @@
</span><span class="cx"> /*
</span><span class="cx"> * Copyright (C) 1999-2000 Harri Porten (porten@kde.org)
</span><span class="cx"> * Copyright (C) 2001 Peter Kelly (pmk@post.com)
</span><del>- * Copyright (C) 2003-2009, 2013-2015 Apple Inc. All rights reserved.
</del><ins>+ * Copyright (C) 2003-2009, 2013-2016 Apple Inc. All rights reserved.
</ins><span class="cx"> *
</span><span class="cx"> * This library is free software; you can redistribute it and/or
</span><span class="cx"> * modify it under the terms of the GNU Lesser General Public
</span><span class="lines">@@ -112,8 +112,6 @@
</span><span class="cx"> void writeBarrier(const JSCell*, JSValue);
</span><span class="cx"> void writeBarrier(const JSCell*, JSCell*);
</span><span class="cx">
</span><del>- JS_EXPORT_PRIVATE static void* copyBarrier(const JSCell* owner, void*& copiedSpacePointer);
-
</del><span class="cx"> WriteBarrierBuffer& writeBarrierBuffer() { return m_writeBarrierBuffer; }
</span><span class="cx"> void flushWriteBarrierBuffer(JSCell*);
</span><span class="cx">
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorejitAssemblyHelperscpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/jit/AssemblyHelpers.cpp (198211 => 198212)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/jit/AssemblyHelpers.cpp 2016-03-15 15:20:40 UTC (rev 198211)
+++ trunk/Source/JavaScriptCore/jit/AssemblyHelpers.cpp 2016-03-15 15:26:36 UTC (rev 198212)
</span><span class="lines">@@ -148,17 +148,6 @@
</span><span class="cx"> TrustedImm32(FastTypedArray));
</span><span class="cx"> }
</span><span class="cx">
</span><del>-AssemblyHelpers::Jump AssemblyHelpers::loadTypedArrayVector(GPRReg baseGPR, GPRReg resultGPR)
-{
- RELEASE_ASSERT(baseGPR != resultGPR);
-
- loadPtr(Address(baseGPR, JSArrayBufferView::offsetOfVector()), resultGPR);
- Jump ok = branchIfToSpace(resultGPR);
- Jump result = branchIfFastTypedArray(baseGPR);
- ok.link(this);
- return result;
-}
-
</del><span class="cx"> void AssemblyHelpers::purifyNaN(FPRReg fpr)
</span><span class="cx"> {
</span><span class="cx"> MacroAssembler::Jump notNaN = branchDouble(DoubleEqual, fpr, fpr);
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorejitAssemblyHelpersh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/jit/AssemblyHelpers.h (198211 => 198212)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/jit/AssemblyHelpers.h 2016-03-15 15:20:40 UTC (rev 198211)
+++ trunk/Source/JavaScriptCore/jit/AssemblyHelpers.h 2016-03-15 15:26:36 UTC (rev 198212)
</span><span class="lines">@@ -822,28 +822,9 @@
</span><span class="cx"> #endif
</span><span class="cx"> }
</span><span class="cx">
</span><del>- Jump branchIfToSpace(GPRReg storageGPR)
- {
- return branchTest32(Zero, storageGPR, TrustedImm32(CopyBarrierBase::spaceBits));
- }
-
- Jump branchIfNotToSpace(GPRReg storageGPR)
- {
- return branchTest32(NonZero, storageGPR, TrustedImm32(CopyBarrierBase::spaceBits));
- }
-
- void removeSpaceBits(GPRReg storageGPR)
- {
- andPtr(TrustedImmPtr(~static_cast<uintptr_t>(CopyBarrierBase::spaceBits)), storageGPR);
- }
-
</del><span class="cx"> Jump branchIfFastTypedArray(GPRReg baseGPR);
</span><span class="cx"> Jump branchIfNotFastTypedArray(GPRReg baseGPR);
</span><span class="cx">
</span><del>- // Returns a jump to slow path for when we need to execute the barrier. Note that baseGPR and
- // resultGPR must be different.
- Jump loadTypedArrayVector(GPRReg baseGPR, GPRReg resultGPR);
-
</del><span class="cx"> static Address addressForByteOffset(ptrdiff_t byteOffset)
</span><span class="cx"> {
</span><span class="cx"> return Address(GPRInfo::callFrameRegister, byteOffset);
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorejitJITcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/jit/JIT.cpp (198211 => 198212)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/jit/JIT.cpp 2016-03-15 15:20:40 UTC (rev 198211)
+++ trunk/Source/JavaScriptCore/jit/JIT.cpp 2016-03-15 15:26:36 UTC (rev 198212)
</span><span class="lines">@@ -186,7 +186,7 @@
</span><span class="cx"> updateTopCallFrame();
</span><span class="cx">
</span><span class="cx"> unsigned bytecodeOffset = m_bytecodeOffset;
</span><del>-
</del><ins>+
</ins><span class="cx"> switch (opcodeID) {
</span><span class="cx"> DEFINE_SLOW_OP(del_by_val)
</span><span class="cx"> DEFINE_SLOW_OP(in)
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorejitJITOpcodescpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/jit/JITOpcodes.cpp (198211 => 198212)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/jit/JITOpcodes.cpp 2016-03-15 15:20:40 UTC (rev 198211)
+++ trunk/Source/JavaScriptCore/jit/JITOpcodes.cpp 2016-03-15 15:26:36 UTC (rev 198212)
</span><span class="lines">@@ -1159,7 +1159,6 @@
</span><span class="cx">
</span><span class="cx"> linkSlowCaseIfNotJSCell(iter, base); // base cell check
</span><span class="cx"> linkSlowCase(iter); // base array check
</span><del>- linkSlowCase(iter); // read barrier
</del><span class="cx"> linkSlowCase(iter); // vector length check
</span><span class="cx"> linkSlowCase(iter); // empty value
</span><span class="cx">
</span><span class="lines">@@ -1203,7 +1202,6 @@
</span><span class="cx"> // Otherwise it's out of line
</span><span class="cx"> outOfLineAccess.link(this);
</span><span class="cx"> loadPtr(Address(regT0, JSObject::butterflyOffset()), regT0);
</span><del>- addSlowCase(branchIfNotToSpace(regT0));
</del><span class="cx"> sub32(Address(regT2, JSPropertyNameEnumerator::cachedInlineCapacityOffset()), regT1);
</span><span class="cx"> neg32(regT1);
</span><span class="cx"> signExtend32ToPtr(regT1, regT1);
</span><span class="lines">@@ -1220,7 +1218,6 @@
</span><span class="cx"> int base = currentInstruction[2].u.operand;
</span><span class="cx"> linkSlowCaseIfNotJSCell(iter, base);
</span><span class="cx"> linkSlowCase(iter);
</span><del>- linkSlowCase(iter);
</del><span class="cx">
</span><span class="cx"> JITSlowPathCall slowPathCall(this, currentInstruction, slow_path_get_direct_pname);
</span><span class="cx"> slowPathCall.call();
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorejitJITOpcodes32_64cpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/jit/JITOpcodes32_64.cpp (198211 => 198212)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/jit/JITOpcodes32_64.cpp 2016-03-15 15:20:40 UTC (rev 198211)
+++ trunk/Source/JavaScriptCore/jit/JITOpcodes32_64.cpp 2016-03-15 15:26:36 UTC (rev 198212)
</span><span class="lines">@@ -1196,7 +1196,6 @@
</span><span class="cx"> // Otherwise it's out of line
</span><span class="cx"> outOfLineAccess.link(this);
</span><span class="cx"> loadPtr(Address(regT0, JSObject::butterflyOffset()), regT0);
</span><del>- addSlowCase(branchIfNotToSpace(regT0));
</del><span class="cx"> sub32(Address(regT1, JSPropertyNameEnumerator::cachedInlineCapacityOffset()), regT2);
</span><span class="cx"> neg32(regT2);
</span><span class="cx"> int32_t offsetOfFirstProperty = static_cast<int32_t>(offsetInButterfly(firstOutOfLineOffset)) * sizeof(EncodedJSValue);
</span><span class="lines">@@ -1213,7 +1212,6 @@
</span><span class="cx"> int base = currentInstruction[2].u.operand;
</span><span class="cx"> linkSlowCaseIfNotJSCell(iter, base);
</span><span class="cx"> linkSlowCase(iter);
</span><del>- linkSlowCase(iter);
</del><span class="cx">
</span><span class="cx"> JITSlowPathCall slowPathCall(this, currentInstruction, slow_path_get_direct_pname);
</span><span class="cx"> slowPathCall.call();
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorejitJITPropertyAccesscpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/jit/JITPropertyAccess.cpp (198211 => 198212)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/jit/JITPropertyAccess.cpp 2016-03-15 15:20:40 UTC (rev 198211)
+++ trunk/Source/JavaScriptCore/jit/JITPropertyAccess.cpp 2016-03-15 15:26:36 UTC (rev 198212)
</span><span class="lines">@@ -165,7 +165,6 @@
</span><span class="cx">
</span><span class="cx"> badType = patchableBranch32(NotEqual, regT2, TrustedImm32(DoubleShape));
</span><span class="cx"> loadPtr(Address(regT0, JSObject::butterflyOffset()), regT2);
</span><del>- slowCases.append(branchIfNotToSpace(regT2));
</del><span class="cx"> slowCases.append(branch32(AboveOrEqual, regT1, Address(regT2, Butterfly::offsetOfPublicLength())));
</span><span class="cx"> loadDouble(BaseIndex(regT2, regT1, TimesEight), fpRegT0);
</span><span class="cx"> slowCases.append(branchDouble(DoubleNotEqualOrUnordered, fpRegT0, fpRegT0));
</span><span class="lines">@@ -179,7 +178,6 @@
</span><span class="cx">
</span><span class="cx"> badType = patchableBranch32(NotEqual, regT2, TrustedImm32(expectedShape));
</span><span class="cx"> loadPtr(Address(regT0, JSObject::butterflyOffset()), regT2);
</span><del>- slowCases.append(branchIfNotToSpace(regT2));
</del><span class="cx"> slowCases.append(branch32(AboveOrEqual, regT1, Address(regT2, Butterfly::offsetOfPublicLength())));
</span><span class="cx"> load64(BaseIndex(regT2, regT1, TimesEight), regT0);
</span><span class="cx"> slowCases.append(branchTest64(Zero, regT0));
</span><span class="lines">@@ -195,7 +193,6 @@
</span><span class="cx"> badType = patchableBranch32(Above, regT3, TrustedImm32(SlowPutArrayStorageShape - ArrayStorageShape));
</span><span class="cx">
</span><span class="cx"> loadPtr(Address(regT0, JSObject::butterflyOffset()), regT2);
</span><del>- slowCases.append(branchIfNotToSpace(regT2));
</del><span class="cx"> slowCases.append(branch32(AboveOrEqual, regT1, Address(regT2, ArrayStorage::vectorLengthOffset())));
</span><span class="cx">
</span><span class="cx"> load64(BaseIndex(regT2, regT1, TimesEight, ArrayStorage::vectorOffset()), regT0);
</span><span class="lines">@@ -254,7 +251,6 @@
</span><span class="cx"> notString.link(this);
</span><span class="cx"> nonCell.link(this);
</span><span class="cx">
</span><del>- linkSlowCase(iter); // read barrier
</del><span class="cx"> linkSlowCase(iter); // vector length check
</span><span class="cx"> linkSlowCase(iter); // empty value
</span><span class="cx">
</span><span class="lines">@@ -327,7 +323,6 @@
</span><span class="cx"> badType = patchableBranch32(NotEqual, regT2, TrustedImm32(indexingShape));
</span><span class="cx">
</span><span class="cx"> loadPtr(Address(regT0, JSObject::butterflyOffset()), regT2);
</span><del>- slowCases.append(branchIfNotToSpace(regT2));
</del><span class="cx"> Jump outOfBounds = branch32(AboveOrEqual, regT1, Address(regT2, Butterfly::offsetOfPublicLength()));
</span><span class="cx">
</span><span class="cx"> Label storeResult = label();
</span><span class="lines">@@ -383,7 +378,6 @@
</span><span class="cx">
</span><span class="cx"> badType = patchableBranch32(NotEqual, regT2, TrustedImm32(ArrayStorageShape));
</span><span class="cx"> loadPtr(Address(regT0, JSObject::butterflyOffset()), regT2);
</span><del>- slowCases.append(branchIfNotToSpace(regT2));
</del><span class="cx"> slowCases.append(branch32(AboveOrEqual, regT1, Address(regT2, ArrayStorage::vectorLengthOffset())));
</span><span class="cx">
</span><span class="cx"> Jump empty = branchTest64(Zero, BaseIndex(regT2, regT1, TimesEight, OBJECT_OFFSETOF(ArrayStorage, m_vector[0])));
</span><span class="lines">@@ -454,7 +448,6 @@
</span><span class="cx"> linkSlowCase(iter); // property int32 check
</span><span class="cx"> linkSlowCase(iter); // base not array check
</span><span class="cx">
</span><del>- linkSlowCase(iter); // read barrier
</del><span class="cx"> linkSlowCase(iter); // out of bounds
</span><span class="cx">
</span><span class="cx"> JITArrayMode mode = chooseArrayMode(profile);
</span><span class="lines">@@ -786,7 +779,6 @@
</span><span class="cx"> isOutOfLine.link(this);
</span><span class="cx"> }
</span><span class="cx"> loadPtr(Address(base, JSObject::butterflyOffset()), scratch);
</span><del>- addSlowCase(branchIfNotToSpace(scratch));
</del><span class="cx"> neg32(offset);
</span><span class="cx"> signExtend32ToPtr(offset, offset);
</span><span class="cx"> load64(BaseIndex(scratch, offset, TimesEight, (firstOutOfLineOffset - 2) * sizeof(EncodedJSValue)), result);
</span><span class="lines">@@ -866,10 +858,8 @@
</span><span class="cx"> if (resolveType == GlobalVar || resolveType == ClosureVar)
</span><span class="cx"> return;
</span><span class="cx">
</span><del>- if (resolveType == GlobalProperty || resolveType == GlobalPropertyWithVarInjectionChecks) {
</del><ins>+ if (resolveType == GlobalProperty || resolveType == GlobalPropertyWithVarInjectionChecks)
</ins><span class="cx"> linkSlowCase(iter); // bad structure
</span><del>- linkSlowCase(iter); // read barrier
- }
</del><span class="cx">
</span><span class="cx"> if (resolveType == GlobalLexicalVarWithVarInjectionChecks) // Var injections check.
</span><span class="cx"> linkSlowCase(iter);
</span><span class="lines">@@ -878,7 +868,6 @@
</span><span class="cx"> // GlobalProperty/GlobalPropertyWithVarInjectionChecks
</span><span class="cx"> linkSlowCase(iter); // emitLoadWithStructureCheck
</span><span class="cx"> linkSlowCase(iter); // emitLoadWithStructureCheck
</span><del>- linkSlowCase(iter); // read barrier
</del><span class="cx"> // GlobalLexicalVar
</span><span class="cx"> linkSlowCase(iter); // TDZ check.
</span><span class="cx"> // GlobalLexicalVarWithVarInjectionChecks.
</span><span class="lines">@@ -932,7 +921,6 @@
</span><span class="cx"> emitGetVirtualRegister(value, regT2);
</span><span class="cx">
</span><span class="cx"> loadPtr(Address(regT0, JSObject::butterflyOffset()), regT0);
</span><del>- addSlowCase(branchIfNotToSpace(regT0));
</del><span class="cx"> loadPtr(operandSlot, regT1);
</span><span class="cx"> negPtr(regT1);
</span><span class="cx"> storePtr(regT2, BaseIndex(regT0, regT1, TimesEight, (firstOutOfLineOffset - 2) * sizeof(EncodedJSValue)));
</span><span class="lines">@@ -1026,17 +1014,14 @@
</span><span class="cx"> || resolveType == LocalClosureVar)
</span><span class="cx"> && currentInstruction[5].u.watchpointSet->state() != IsInvalidated)
</span><span class="cx"> linkCount++;
</span><del>- if (resolveType == GlobalProperty || resolveType == GlobalPropertyWithVarInjectionChecks) {
</del><ins>+ if (resolveType == GlobalProperty || resolveType == GlobalPropertyWithVarInjectionChecks)
</ins><span class="cx"> linkCount++; // bad structure
</span><del>- linkCount++; // read barrier
- }
</del><span class="cx"> if (getPutInfo.initializationMode() != Initialization && (resolveType == GlobalLexicalVar || resolveType == GlobalLexicalVarWithVarInjectionChecks)) // TDZ check.
</span><span class="cx"> linkCount++;
</span><span class="cx"> if (resolveType == UnresolvedProperty || resolveType == UnresolvedPropertyWithVarInjectionChecks) {
</span><span class="cx"> // GlobalProperty/GlobalPropertyWithVarInjectionsCheck
</span><span class="cx"> linkCount++; // emitLoadWithStructureCheck
</span><span class="cx"> linkCount++; // emitLoadWithStructureCheck
</span><del>- linkCount++; // read barrier
</del><span class="cx">
</span><span class="cx"> // GlobalLexicalVar
</span><span class="cx"> bool needsTDZCheck = getPutInfo.initializationMode() != Initialization;
</span><span class="lines">@@ -1454,7 +1439,7 @@
</span><span class="cx"> load8(Address(base, JSCell::typeInfoTypeOffset()), scratch);
</span><span class="cx"> badType = patchableBranch32(NotEqual, scratch, TrustedImm32(typeForTypedArrayType(type)));
</span><span class="cx"> slowCases.append(branch32(AboveOrEqual, property, Address(base, JSArrayBufferView::offsetOfLength())));
</span><del>- slowCases.append(loadTypedArrayVector(base, scratch));
</del><ins>+ loadPtr(Address(base, JSArrayBufferView::offsetOfVector()), scratch);
</ins><span class="cx">
</span><span class="cx"> switch (elementSize(type)) {
</span><span class="cx"> case 1:
</span><span class="lines">@@ -1525,7 +1510,7 @@
</span><span class="cx"> load8(Address(base, JSCell::typeInfoTypeOffset()), scratch);
</span><span class="cx"> badType = patchableBranch32(NotEqual, scratch, TrustedImm32(typeForTypedArrayType(type)));
</span><span class="cx"> slowCases.append(branch32(AboveOrEqual, property, Address(base, JSArrayBufferView::offsetOfLength())));
</span><del>- slowCases.append(loadTypedArrayVector(base, scratch));
</del><ins>+ loadPtr(Address(base, JSArrayBufferView::offsetOfVector()), scratch);
</ins><span class="cx">
</span><span class="cx"> switch (elementSize(type)) {
</span><span class="cx"> case 4:
</span><span class="lines">@@ -1592,7 +1577,7 @@
</span><span class="cx">
</span><span class="cx"> // We would be loading this into base as in get_by_val, except that the slow
</span><span class="cx"> // path expects the base to be unclobbered.
</span><del>- slowCases.append(loadTypedArrayVector(base, lateScratch));
</del><ins>+ loadPtr(Address(base, JSArrayBufferView::offsetOfVector()), lateScratch);
</ins><span class="cx">
</span><span class="cx"> if (isClamped(type)) {
</span><span class="cx"> ASSERT(elementSize(type) == 1);
</span><span class="lines">@@ -1677,7 +1662,7 @@
</span><span class="cx">
</span><span class="cx"> // We would be loading this into base as in get_by_val, except that the slow
</span><span class="cx"> // path expects the base to be unclobbered.
</span><del>- slowCases.append(loadTypedArrayVector(base, lateScratch));
</del><ins>+ loadPtr(Address(base, JSArrayBufferView::offsetOfVector()), lateScratch);
</ins><span class="cx">
</span><span class="cx"> switch (elementSize(type)) {
</span><span class="cx"> case 4:
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorellintLowLevelInterpreterasm"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/llint/LowLevelInterpreter.asm (198211 => 198212)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/llint/LowLevelInterpreter.asm 2016-03-15 15:20:40 UTC (rev 198211)
+++ trunk/Source/JavaScriptCore/llint/LowLevelInterpreter.asm 2016-03-15 15:26:36 UTC (rev 198212)
</span><span class="lines">@@ -221,8 +221,6 @@
</span><span class="cx"> const PutByIdSecondaryTypeObjectOrOther = 0x40
</span><span class="cx"> const PutByIdSecondaryTypeTop = 0x48
</span><span class="cx">
</span><del>-const CopyBarrierSpaceBits = 3
-
</del><span class="cx"> const CallOpCodeSize = 9
</span><span class="cx">
</span><span class="cx"> if X86_64 or ARM64 or C_LOOP
</span><span class="lines">@@ -661,10 +659,6 @@
</span><span class="cx"> end
</span><span class="cx"> end
</span><span class="cx">
</span><del>-macro copyBarrier(value, slow)
- btpnz value, CopyBarrierSpaceBits, slow
-end
-
</del><span class="cx"> macro functionPrologue()
</span><span class="cx"> if X86 or X86_WIN or X86_64 or X86_64_WIN
</span><span class="cx"> push cfr
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorellintLowLevelInterpreter64asm"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/llint/LowLevelInterpreter64.asm (198211 => 198212)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/llint/LowLevelInterpreter64.asm 2016-03-15 15:20:40 UTC (rev 198211)
+++ trunk/Source/JavaScriptCore/llint/LowLevelInterpreter64.asm 2016-03-15 15:26:36 UTC (rev 198212)
</span><span class="lines">@@ -1176,10 +1176,9 @@
</span><span class="cx"> dispatch(3)
</span><span class="cx">
</span><span class="cx">
</span><del>-macro loadPropertyAtVariableOffset(propertyOffsetAsInt, objectAndStorage, value, slow)
</del><ins>+macro loadPropertyAtVariableOffset(propertyOffsetAsInt, objectAndStorage, value)
</ins><span class="cx"> bilt propertyOffsetAsInt, firstOutOfLineOffset, .isInline
</span><span class="cx"> loadp JSObject::m_butterfly[objectAndStorage], objectAndStorage
</span><del>- copyBarrier(objectAndStorage, slow)
</del><span class="cx"> negi propertyOffsetAsInt
</span><span class="cx"> sxi2q propertyOffsetAsInt, propertyOffsetAsInt
</span><span class="cx"> jmp .ready
</span><span class="lines">@@ -1190,10 +1189,9 @@
</span><span class="cx"> end
</span><span class="cx">
</span><span class="cx">
</span><del>-macro storePropertyAtVariableOffset(propertyOffsetAsInt, objectAndStorage, value, slow)
</del><ins>+macro storePropertyAtVariableOffset(propertyOffsetAsInt, objectAndStorage, value)
</ins><span class="cx"> bilt propertyOffsetAsInt, firstOutOfLineOffset, .isInline
</span><span class="cx"> loadp JSObject::m_butterfly[objectAndStorage], objectAndStorage
</span><del>- copyBarrier(objectAndStorage, slow)
</del><span class="cx"> negi propertyOffsetAsInt
</span><span class="cx"> sxi2q propertyOffsetAsInt, propertyOffsetAsInt
</span><span class="cx"> jmp .ready
</span><span class="lines">@@ -1212,7 +1210,7 @@
</span><span class="cx"> bineq t2, t1, .opGetByIdSlow
</span><span class="cx"> loadisFromInstruction(5, t1)
</span><span class="cx"> loadisFromInstruction(1, t2)
</span><del>- loadPropertyAtVariableOffset(t1, t3, t0, .opGetByIdSlow)
</del><ins>+ loadPropertyAtVariableOffset(t1, t3, t0)
</ins><span class="cx"> storeq t0, [cfr, t2, 8]
</span><span class="cx"> valueProfile(t0, 8, t1)
</span><span class="cx"> dispatch(9)
</span><span class="lines">@@ -1233,7 +1231,6 @@
</span><span class="cx"> btiz t2, IndexingShapeMask, .opGetArrayLengthSlow
</span><span class="cx"> loadisFromInstruction(1, t1)
</span><span class="cx"> loadp JSObject::m_butterfly[t3], t0
</span><del>- copyBarrier(t0, .opGetArrayLengthSlow)
</del><span class="cx"> loadi -sizeof IndexingHeader + IndexingHeader::u.lengths.publicLength[t0], t0
</span><span class="cx"> bilt t0, 0, .opGetArrayLengthSlow
</span><span class="cx"> orq tagTypeNumber, t0
</span><span class="lines">@@ -1377,7 +1374,7 @@
</span><span class="cx"> loadisFromInstruction(3, t1)
</span><span class="cx"> loadConstantOrVariable(t1, t2)
</span><span class="cx"> loadisFromInstruction(5, t1)
</span><del>- storePropertyAtVariableOffset(t1, t0, t2, .opPutByIdSlow)
</del><ins>+ storePropertyAtVariableOffset(t1, t0, t2)
</ins><span class="cx"> dispatch(9)
</span><span class="cx">
</span><span class="cx"> .opPutByIdSlow:
</span><span class="lines">@@ -1396,7 +1393,6 @@
</span><span class="cx"> loadConstantOrVariableInt32(t3, t1, .opGetByValSlow)
</span><span class="cx"> sxi2q t1, t1
</span><span class="cx"> loadp JSObject::m_butterfly[t0], t3
</span><del>- copyBarrier(t3, .opGetByValSlow)
</del><span class="cx"> andi IndexingShapeMask, t2
</span><span class="cx"> bieq t2, Int32Shape, .opGetByValIsContiguous
</span><span class="cx"> bineq t2, ContiguousShape, .opGetByValNotContiguous
</span><span class="lines">@@ -1467,7 +1463,6 @@
</span><span class="cx"> loadConstantOrVariableInt32(t0, t3, .opPutByValSlow)
</span><span class="cx"> sxi2q t3, t3
</span><span class="cx"> loadp JSObject::m_butterfly[t1], t0
</span><del>- copyBarrier(t0, .opPutByValSlow)
</del><span class="cx"> andi IndexingShapeMask, t2
</span><span class="cx"> bineq t2, Int32Shape, .opPutByValNotInt32
</span><span class="cx"> contiguousPutByVal(
</span><span class="lines">@@ -1988,9 +1983,9 @@
</span><span class="cx"> bpneq t2, t1, slowPath
</span><span class="cx"> end
</span><span class="cx">
</span><del>-macro getProperty(slow)
</del><ins>+macro getProperty()
</ins><span class="cx"> loadisFromInstruction(6, t1)
</span><del>- loadPropertyAtVariableOffset(t1, t0, t2, slow)
</del><ins>+ loadPropertyAtVariableOffset(t1, t0, t2)
</ins><span class="cx"> valueProfile(t2, 7, t0)
</span><span class="cx"> loadisFromInstruction(1, t0)
</span><span class="cx"> storeq t2, [cfr, t0, 8]
</span><span class="lines">@@ -2021,7 +2016,7 @@
</span><span class="cx"> #gGlobalProperty:
</span><span class="cx"> bineq t0, GlobalProperty, .gGlobalVar
</span><span class="cx"> loadWithStructureCheck(2, .gDynamic)
</span><del>- getProperty(.gDynamic)
</del><ins>+ getProperty()
</ins><span class="cx"> dispatch(8)
</span><span class="cx">
</span><span class="cx"> .gGlobalVar:
</span><span class="lines">@@ -2046,7 +2041,7 @@
</span><span class="cx"> .gGlobalPropertyWithVarInjectionChecks:
</span><span class="cx"> bineq t0, GlobalPropertyWithVarInjectionChecks, .gGlobalVarWithVarInjectionChecks
</span><span class="cx"> loadWithStructureCheck(2, .gDynamic)
</span><del>- getProperty(.gDynamic)
</del><ins>+ getProperty()
</ins><span class="cx"> dispatch(8)
</span><span class="cx">
</span><span class="cx"> .gGlobalVarWithVarInjectionChecks:
</span><span class="lines">@@ -2076,11 +2071,11 @@
</span><span class="cx"> dispatch(8)
</span><span class="cx">
</span><span class="cx">
</span><del>-macro putProperty(slow)
</del><ins>+macro putProperty()
</ins><span class="cx"> loadisFromInstruction(3, t1)
</span><span class="cx"> loadConstantOrVariable(t1, t2)
</span><span class="cx"> loadisFromInstruction(6, t1)
</span><del>- storePropertyAtVariableOffset(t1, t0, t2, slow)
</del><ins>+ storePropertyAtVariableOffset(t1, t0, t2)
</ins><span class="cx"> end
</span><span class="cx">
</span><span class="cx"> macro putGlobalVariable()
</span><span class="lines">@@ -2138,7 +2133,7 @@
</span><span class="cx"> bineq t0, GlobalProperty, .pGlobalVar
</span><span class="cx"> writeBarrierOnOperands(1, 3)
</span><span class="cx"> loadWithStructureCheck(1, .pDynamic)
</span><del>- putProperty(.pDynamic)
</del><ins>+ putProperty()
</ins><span class="cx"> dispatch(7)
</span><span class="cx">
</span><span class="cx"> .pGlobalVar:
</span><span class="lines">@@ -2165,7 +2160,7 @@
</span><span class="cx"> bineq t0, GlobalPropertyWithVarInjectionChecks, .pGlobalVarWithVarInjectionChecks
</span><span class="cx"> writeBarrierOnOperands(1, 3)
</span><span class="cx"> loadWithStructureCheck(1, .pDynamic)
</span><del>- putProperty(.pDynamic)
</del><ins>+ putProperty()
</ins><span class="cx"> dispatch(7)
</span><span class="cx">
</span><span class="cx"> .pGlobalVarWithVarInjectionChecks:
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeDirectArgumentscpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/DirectArguments.cpp (198211 => 198212)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/DirectArguments.cpp 2016-03-15 15:20:40 UTC (rev 198211)
+++ trunk/Source/JavaScriptCore/runtime/DirectArguments.cpp 2016-03-15 15:26:36 UTC (rev 198212)
</span><span class="lines">@@ -1,5 +1,5 @@
</span><span class="cx"> /*
</span><del>- * Copyright (C) 2015 Apple Inc. All rights reserved.
</del><ins>+ * Copyright (C) 2015-2016 Apple Inc. All rights reserved.
</ins><span class="cx"> *
</span><span class="cx"> * Redistribution and use in source and binary forms, with or without
</span><span class="cx"> * modification, are permitted provided that the following conditions
</span><span class="lines">@@ -104,7 +104,7 @@
</span><span class="cx"> if (thisObject->m_overrides) {
</span><span class="cx"> visitor.copyLater(
</span><span class="cx"> thisObject, DirectArgumentsOverridesCopyToken,
</span><del>- thisObject->m_overrides.getWithoutBarrier(), thisObject->overridesSize());
</del><ins>+ thisObject->m_overrides.get(), thisObject->overridesSize());
</ins><span class="cx"> }
</span><span class="cx"> }
</span><span class="cx">
</span><span class="lines">@@ -115,7 +115,7 @@
</span><span class="cx">
</span><span class="cx"> RELEASE_ASSERT(token == DirectArgumentsOverridesCopyToken);
</span><span class="cx">
</span><del>- void* oldOverrides = thisObject->m_overrides.getWithoutBarrier();
</del><ins>+ void* oldOverrides = thisObject->m_overrides.get();
</ins><span class="cx"> if (visitor.checkIfShouldCopy(oldOverrides)) {
</span><span class="cx"> bool* newOverrides = static_cast<bool*>(visitor.allocateNewSpace(thisObject->overridesSize()));
</span><span class="cx"> memcpy(newOverrides, oldOverrides, thisObject->m_length);
</span><span class="lines">@@ -154,7 +154,7 @@
</span><span class="cx"> void DirectArguments::overrideArgument(VM& vm, unsigned index)
</span><span class="cx"> {
</span><span class="cx"> overrideThingsIfNecessary(vm);
</span><del>- m_overrides.get(this)[index] = true;
</del><ins>+ m_overrides.get()[index] = true;
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> void DirectArguments::copyToArguments(ExecState* exec, VirtualRegister firstElementDest, unsigned offset, unsigned length)
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeDirectArgumentsh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/DirectArguments.h (198211 => 198212)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/DirectArguments.h 2016-03-15 15:20:40 UTC (rev 198211)
+++ trunk/Source/JavaScriptCore/runtime/DirectArguments.h 2016-03-15 15:26:36 UTC (rev 198212)
</span><span class="lines">@@ -1,5 +1,5 @@
</span><span class="cx"> /*
</span><del>- * Copyright (C) 2015 Apple Inc. All rights reserved.
</del><ins>+ * Copyright (C) 2015-2016 Apple Inc. All rights reserved.
</ins><span class="cx"> *
</span><span class="cx"> * Redistribution and use in source and binary forms, with or without
</span><span class="cx"> * modification, are permitted provided that the following conditions
</span><span class="lines">@@ -74,7 +74,7 @@
</span><span class="cx">
</span><span class="cx"> bool canAccessIndexQuickly(uint32_t i) const
</span><span class="cx"> {
</span><del>- return i < m_length && (!m_overrides || !m_overrides.get(this)[i]);
</del><ins>+ return i < m_length && (!m_overrides || !m_overrides.get()[i]);
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> bool canAccessArgumentIndexQuicklyInDFG(uint32_t i) const
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeJSArraycpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/JSArray.cpp (198211 => 198212)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/JSArray.cpp 2016-03-15 15:20:40 UTC (rev 198211)
+++ trunk/Source/JavaScriptCore/runtime/JSArray.cpp 2016-03-15 15:26:36 UTC (rev 198212)
</span><span class="lines">@@ -1,6 +1,6 @@
</span><span class="cx"> /*
</span><span class="cx"> * Copyright (C) 1999-2000 Harri Porten (porten@kde.org)
</span><del>- * Copyright (C) 2003, 2007, 2008, 2009, 2012, 2013, 2015 Apple Inc. All rights reserved.
</del><ins>+ * Copyright (C) 2003, 2007, 2008, 2009, 2012, 2013, 2015-2016 Apple Inc. All rights reserved.
</ins><span class="cx"> * Copyright (C) 2003 Peter Kelly (pmk@post.com)
</span><span class="cx"> * Copyright (C) 2006 Alexey Proskuryakov (ap@nypop.com)
</span><span class="cx"> *
</span><span class="lines">@@ -391,7 +391,7 @@
</span><span class="cx">
</span><span class="cx"> bool JSArray::setLength(ExecState* exec, unsigned newLength, bool throwException)
</span><span class="cx"> {
</span><del>- Butterfly* butterfly = m_butterfly.get(this);
</del><ins>+ Butterfly* butterfly = m_butterfly.get();
</ins><span class="cx"> switch (indexingType()) {
</span><span class="cx"> case ArrayClass:
</span><span class="cx"> if (!newLength)
</span><span class="lines">@@ -452,7 +452,7 @@
</span><span class="cx">
</span><span class="cx"> JSValue JSArray::pop(ExecState* exec)
</span><span class="cx"> {
</span><del>- Butterfly* butterfly = m_butterfly.get(this);
</del><ins>+ Butterfly* butterfly = m_butterfly.get();
</ins><span class="cx">
</span><span class="cx"> switch (indexingType()) {
</span><span class="cx"> case ArrayClass:
</span><span class="lines">@@ -549,7 +549,7 @@
</span><span class="cx"> // - pushing to an array of length 2^32-1 stores the property, but throws a range error.
</span><span class="cx"> void JSArray::push(ExecState* exec, JSValue value)
</span><span class="cx"> {
</span><del>- Butterfly* butterfly = m_butterfly.get(this);
</del><ins>+ Butterfly* butterfly = m_butterfly.get();
</ins><span class="cx">
</span><span class="cx"> switch (indexingType()) {
</span><span class="cx"> case ArrayClass: {
</span><span class="lines">@@ -701,9 +701,9 @@
</span><span class="cx">
</span><span class="cx"> auto& resultButterfly = *resultArray->butterfly();
</span><span class="cx"> if (arrayType == ArrayWithDouble)
</span><del>- memcpy(resultButterfly.contiguousDouble().data(), m_butterfly.get(this)->contiguousDouble().data() + startIndex, sizeof(JSValue) * count);
</del><ins>+ memcpy(resultButterfly.contiguousDouble().data(), m_butterfly.get()->contiguousDouble().data() + startIndex, sizeof(JSValue) * count);
</ins><span class="cx"> else
</span><del>- memcpy(resultButterfly.contiguous().data(), m_butterfly.get(this)->contiguous().data() + startIndex, sizeof(JSValue) * count);
</del><ins>+ memcpy(resultButterfly.contiguous().data(), m_butterfly.get()->contiguous().data() + startIndex, sizeof(JSValue) * count);
</ins><span class="cx"> resultButterfly.setPublicLength(count);
</span><span class="cx">
</span><span class="cx"> return resultArray;
</span><span class="lines">@@ -720,8 +720,8 @@
</span><span class="cx"> VM& vm = exec.vm();
</span><span class="cx"> ASSERT(newArrayType == fastConcatType(vm, *this, otherArray));
</span><span class="cx">
</span><del>- unsigned thisArraySize = m_butterfly.get(this)->publicLength();
- unsigned otherArraySize = otherArray.m_butterfly.get(this)->publicLength();
</del><ins>+ unsigned thisArraySize = m_butterfly.get()->publicLength();
+ unsigned otherArraySize = otherArray.m_butterfly.get()->publicLength();
</ins><span class="cx"> ASSERT(thisArraySize + otherArraySize < MIN_SPARSE_ARRAY_INDEX);
</span><span class="cx">
</span><span class="cx"> Structure* resultStructure = exec.lexicalGlobalObject()->arrayStructureForIndexingTypeDuringAllocation(newArrayType);
</span><span class="lines">@@ -733,11 +733,11 @@
</span><span class="cx"> auto& otherButterfly = *otherArray.butterfly();
</span><span class="cx"> if (newArrayType == ArrayWithDouble) {
</span><span class="cx"> auto buffer = resultButterfly.contiguousDouble().data();
</span><del>- memcpy(buffer, m_butterfly.get(this)->contiguousDouble().data(), sizeof(JSValue) * thisArraySize);
</del><ins>+ memcpy(buffer, m_butterfly.get()->contiguousDouble().data(), sizeof(JSValue) * thisArraySize);
</ins><span class="cx"> memcpy(buffer + thisArraySize, otherButterfly.contiguousDouble().data(), sizeof(JSValue) * otherArraySize);
</span><span class="cx"> } else {
</span><span class="cx"> auto buffer = resultButterfly.contiguous().data();
</span><del>- memcpy(buffer, m_butterfly.get(this)->contiguous().data(), sizeof(JSValue) * thisArraySize);
</del><ins>+ memcpy(buffer, m_butterfly.get()->contiguous().data(), sizeof(JSValue) * thisArraySize);
</ins><span class="cx"> memcpy(buffer + thisArraySize, otherButterfly.contiguous().data(), sizeof(JSValue) * otherArraySize);
</span><span class="cx"> }
</span><span class="cx">
</span><span class="lines">@@ -810,7 +810,7 @@
</span><span class="cx"> // Adjust the Butterfly and the index bias. We only need to do this here because we're changing
</span><span class="cx"> // the start of the Butterfly, which needs to point at the first indexed property in the used
</span><span class="cx"> // portion of the vector.
</span><del>- Butterfly* butterfly = m_butterfly.get(this)->shift(structure(), count);
</del><ins>+ Butterfly* butterfly = m_butterfly.get()->shift(structure(), count);
</ins><span class="cx"> m_butterfly.setWithoutBarrier(butterfly);
</span><span class="cx"> storage = butterfly->arrayStorage();
</span><span class="cx"> storage->m_indexBias += count;
</span><span class="lines">@@ -855,7 +855,7 @@
</span><span class="cx"> VM& vm = exec->vm();
</span><span class="cx"> RELEASE_ASSERT(count > 0);
</span><span class="cx">
</span><del>- Butterfly* butterfly = m_butterfly.get(this);
</del><ins>+ Butterfly* butterfly = m_butterfly.get();
</ins><span class="cx">
</span><span class="cx"> switch (indexingType()) {
</span><span class="cx"> case ArrayClass:
</span><span class="lines">@@ -994,7 +994,7 @@
</span><span class="cx">
</span><span class="cx"> bool JSArray::unshiftCountWithAnyIndexingType(ExecState* exec, unsigned startIndex, unsigned count)
</span><span class="cx"> {
</span><del>- Butterfly* butterfly = m_butterfly.get(this);
</del><ins>+ Butterfly* butterfly = m_butterfly.get();
</ins><span class="cx">
</span><span class="cx"> switch (indexingType()) {
</span><span class="cx"> case ArrayClass:
</span><span class="lines">@@ -1012,7 +1012,7 @@
</span><span class="cx"> return unshiftCountWithArrayStorage(exec, startIndex, count, ensureArrayStorage(exec->vm()));
</span><span class="cx">
</span><span class="cx"> ensureLength(exec->vm(), oldLength + count);
</span><del>- butterfly = m_butterfly.get(this);
</del><ins>+ butterfly = m_butterfly.get();
</ins><span class="cx">
</span><span class="cx"> // We have to check for holes before we start moving things around so that we don't get halfway
</span><span class="cx"> // through shifting and then realize we should have been in ArrayStorage mode.
</span><span class="lines">@@ -1045,7 +1045,7 @@
</span><span class="cx"> return unshiftCountWithArrayStorage(exec, startIndex, count, ensureArrayStorage(exec->vm()));
</span><span class="cx">
</span><span class="cx"> ensureLength(exec->vm(), oldLength + count);
</span><del>- butterfly = m_butterfly.get(this);
</del><ins>+ butterfly = m_butterfly.get();
</ins><span class="cx">
</span><span class="cx"> // We have to check for holes before we start moving things around so that we don't get halfway
</span><span class="cx"> // through shifting and then realize we should have been in ArrayStorage mode.
</span><span class="lines">@@ -1085,7 +1085,7 @@
</span><span class="cx"> unsigned vectorEnd;
</span><span class="cx"> WriteBarrier<Unknown>* vector;
</span><span class="cx">
</span><del>- Butterfly* butterfly = m_butterfly.get(this);
</del><ins>+ Butterfly* butterfly = m_butterfly.get();
</ins><span class="cx">
</span><span class="cx"> switch (indexingType()) {
</span><span class="cx"> case ArrayClass:
</span><span class="lines">@@ -1155,7 +1155,7 @@
</span><span class="cx"> // FIXME: What prevents this from being called with a RuntimeArray? The length function will always return 0 in that case.
</span><span class="cx"> ASSERT(length == this->length());
</span><span class="cx">
</span><del>- Butterfly* butterfly = m_butterfly.get(this);
</del><ins>+ Butterfly* butterfly = m_butterfly.get();
</ins><span class="cx">
</span><span class="cx"> switch (indexingType()) {
</span><span class="cx"> case ArrayClass:
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeJSArrayBufferViewcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/JSArrayBufferView.cpp (198211 => 198212)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/JSArrayBufferView.cpp 2016-03-15 15:20:40 UTC (rev 198211)
+++ trunk/Source/JavaScriptCore/runtime/JSArrayBufferView.cpp 2016-03-15 15:26:36 UTC (rev 198212)
</span><span class="lines">@@ -213,7 +213,7 @@
</span><span class="cx"> JSArrayBufferView* thisObject = static_cast<JSArrayBufferView*>(cell);
</span><span class="cx"> ASSERT(thisObject->m_mode == OversizeTypedArray || thisObject->m_mode == WastefulTypedArray);
</span><span class="cx"> if (thisObject->m_mode == OversizeTypedArray)
</span><del>- fastFree(thisObject->m_vector.getWithoutBarrier());
</del><ins>+ fastFree(thisObject->m_vector.get());
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> } // namespace JSC
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeJSArrayBufferViewh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/JSArrayBufferView.h (198211 => 198212)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/JSArrayBufferView.h 2016-03-15 15:20:40 UTC (rev 198211)
+++ trunk/Source/JavaScriptCore/runtime/JSArrayBufferView.h 2016-03-15 15:26:36 UTC (rev 198212)
</span><span class="lines">@@ -164,14 +164,7 @@
</span><span class="cx"> bool isNeutered() { return hasArrayBuffer() && !vector(); }
</span><span class="cx"> void neuter();
</span><span class="cx">
</span><del>- void* vector()
- {
- return m_vector.getPredicated(
- this,
- [this] () -> bool {
- return mode() == FastTypedArray;
- });
- }
</del><ins>+ void* vector() { return m_vector.get(); }
</ins><span class="cx">
</span><span class="cx"> unsigned byteOffset();
</span><span class="cx"> unsigned length() const { return m_length; }
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeJSGenericTypedArrayViewInlinesh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/JSGenericTypedArrayViewInlines.h (198211 => 198212)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/JSGenericTypedArrayViewInlines.h 2016-03-15 15:20:40 UTC (rev 198211)
+++ trunk/Source/JavaScriptCore/runtime/JSGenericTypedArrayViewInlines.h 2016-03-15 15:26:36 UTC (rev 198212)
</span><span class="lines">@@ -422,7 +422,7 @@
</span><span class="cx"> switch (thisObject->m_mode) {
</span><span class="cx"> case FastTypedArray: {
</span><span class="cx"> if (thisObject->m_vector)
</span><del>- visitor.copyLater(thisObject, TypedArrayVectorCopyToken, thisObject->m_vector.getWithoutBarrier(), thisObject->byteSize());
</del><ins>+ visitor.copyLater(thisObject, TypedArrayVectorCopyToken, thisObject->m_vector.get(), thisObject->byteSize());
</ins><span class="cx"> break;
</span><span class="cx"> }
</span><span class="cx">
</span><span class="lines">@@ -449,7 +449,7 @@
</span><span class="cx"> JSGenericTypedArrayView* thisObject = jsCast<JSGenericTypedArrayView*>(cell);
</span><span class="cx">
</span><span class="cx"> if (token == TypedArrayVectorCopyToken
</span><del>- && visitor.checkIfShouldCopy(thisObject->m_vector.getWithoutBarrier())) {
</del><ins>+ && visitor.checkIfShouldCopy(thisObject->m_vector.get())) {
</ins><span class="cx"> ASSERT(thisObject->m_vector);
</span><span class="cx"> void* oldVector = thisObject->vector();
</span><span class="cx"> void* newVector = visitor.allocateNewSpace(thisObject->byteSize());
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeJSObjectcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/JSObject.cpp (198211 => 198212)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/JSObject.cpp 2016-03-15 15:20:40 UTC (rev 198211)
+++ trunk/Source/JavaScriptCore/runtime/JSObject.cpp 2016-03-15 15:26:36 UTC (rev 198212)
</span><span class="lines">@@ -216,7 +216,7 @@
</span><span class="cx">
</span><span class="cx"> JSCell::visitChildren(thisObject, visitor);
</span><span class="cx">
</span><del>- Butterfly* butterfly = thisObject->m_butterfly.getWithoutBarrier();
</del><ins>+ Butterfly* butterfly = thisObject->m_butterfly.get();
</ins><span class="cx"> if (butterfly)
</span><span class="cx"> thisObject->visitButterfly(visitor, butterfly, thisObject->structure(visitor.vm()));
</span><span class="cx">
</span><span class="lines">@@ -233,7 +233,7 @@
</span><span class="cx"> if (token != ButterflyCopyToken)
</span><span class="cx"> return;
</span><span class="cx">
</span><del>- Butterfly* butterfly = thisObject->m_butterfly.getWithoutBarrier();
</del><ins>+ Butterfly* butterfly = thisObject->m_butterfly.get();
</ins><span class="cx"> if (butterfly)
</span><span class="cx"> thisObject->copyButterfly(visitor, butterfly, thisObject->structure()->outOfLineSize());
</span><span class="cx"> }
</span><span class="lines">@@ -250,7 +250,7 @@
</span><span class="cx"> builder.appendPropertyNameEdge(thisObject, toValue.asCell(), entry.key);
</span><span class="cx"> }
</span><span class="cx">
</span><del>- Butterfly* butterfly = thisObject->m_butterfly.getWithoutBarrier();
</del><ins>+ Butterfly* butterfly = thisObject->m_butterfly.get();
</ins><span class="cx"> if (butterfly) {
</span><span class="cx"> WriteBarrier<Unknown>* data;
</span><span class="cx"> uint32_t count = 0;
</span><span class="lines">@@ -389,7 +389,7 @@
</span><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> case ALL_ARRAY_STORAGE_INDEXING_TYPES: {
</span><del>- ArrayStorage* storage = thisObject->m_butterfly.get(thisObject)->arrayStorage();
</del><ins>+ ArrayStorage* storage = thisObject->m_butterfly.get()->arrayStorage();
</ins><span class="cx"> if (i >= storage->length())
</span><span class="cx"> return false;
</span><span class="cx">
</span><span class="lines">@@ -548,7 +548,7 @@
</span><span class="cx">
</span><span class="cx"> case NonArrayWithArrayStorage:
</span><span class="cx"> case ArrayWithArrayStorage: {
</span><del>- ArrayStorage* storage = thisObject->m_butterfly.get(thisObject)->arrayStorage();
</del><ins>+ ArrayStorage* storage = thisObject->m_butterfly.get()->arrayStorage();
</ins><span class="cx">
</span><span class="cx"> if (propertyName >= storage->vectorLength())
</span><span class="cx"> break;
</span><span class="lines">@@ -570,7 +570,7 @@
</span><span class="cx">
</span><span class="cx"> case NonArrayWithSlowPutArrayStorage:
</span><span class="cx"> case ArrayWithSlowPutArrayStorage: {
</span><del>- ArrayStorage* storage = thisObject->m_butterfly.get(thisObject)->arrayStorage();
</del><ins>+ ArrayStorage* storage = thisObject->m_butterfly.get()->arrayStorage();
</ins><span class="cx">
</span><span class="cx"> if (propertyName >= storage->vectorLength())
</span><span class="cx"> break;
</span><span class="lines">@@ -652,7 +652,7 @@
</span><span class="cx"> enterDictionaryIndexingModeWhenArrayStorageAlreadyExists(vm, storage);
</span><span class="cx"> break;
</span><span class="cx"> case ALL_ARRAY_STORAGE_INDEXING_TYPES:
</span><del>- enterDictionaryIndexingModeWhenArrayStorageAlreadyExists(vm, m_butterfly.get(this)->arrayStorage());
</del><ins>+ enterDictionaryIndexingModeWhenArrayStorageAlreadyExists(vm, m_butterfly.get()->arrayStorage());
</ins><span class="cx"> break;
</span><span class="cx">
</span><span class="cx"> default:
</span><span class="lines">@@ -682,7 +682,7 @@
</span><span class="cx"> ASSERT(!indexingShouldBeSparse());
</span><span class="cx"> unsigned vectorLength = std::max(length, BASE_VECTOR_LEN);
</span><span class="cx"> Butterfly* newButterfly = Butterfly::createOrGrowArrayRight(
</span><del>- m_butterfly.get(this), vm, this, structure(), structure()->outOfLineCapacity(), false, 0,
</del><ins>+ m_butterfly.get(), vm, this, structure(), structure()->outOfLineCapacity(), false, 0,
</ins><span class="cx"> elementSize * vectorLength);
</span><span class="cx"> newButterfly->setPublicLength(length);
</span><span class="cx"> newButterfly->setVectorLength(vectorLength);
</span><span class="lines">@@ -734,7 +734,7 @@
</span><span class="cx"> IndexingType oldType = indexingType();
</span><span class="cx"> ASSERT_UNUSED(oldType, !hasIndexedProperties(oldType));
</span><span class="cx"> Butterfly* newButterfly = Butterfly::createOrGrowArrayRight(
</span><del>- m_butterfly.get(this), vm, this, structure, structure->outOfLineCapacity(), false, 0,
</del><ins>+ m_butterfly.get(), vm, this, structure, structure->outOfLineCapacity(), false, 0,
</ins><span class="cx"> ArrayStorage::sizeFor(vectorLength));
</span><span class="cx"> RELEASE_ASSERT(newButterfly);
</span><span class="cx">
</span><span class="lines">@@ -758,32 +758,32 @@
</span><span class="cx"> {
</span><span class="cx"> ASSERT(hasUndecided(indexingType()));
</span><span class="cx"> setStructure(vm, Structure::nonPropertyTransition(vm, structure(vm), AllocateInt32));
</span><del>- return m_butterfly.get(this)->contiguousInt32();
</del><ins>+ return m_butterfly.get()->contiguousInt32();
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> ContiguousDoubles JSObject::convertUndecidedToDouble(VM& vm)
</span><span class="cx"> {
</span><span class="cx"> ASSERT(hasUndecided(indexingType()));
</span><span class="cx">
</span><del>- Butterfly* butterfly = m_butterfly.get(this);
</del><ins>+ Butterfly* butterfly = m_butterfly.get();
</ins><span class="cx"> for (unsigned i = butterfly->vectorLength(); i--;)
</span><span class="cx"> butterfly->contiguousDouble()[i] = PNaN;
</span><span class="cx">
</span><span class="cx"> setStructure(vm, Structure::nonPropertyTransition(vm, structure(vm), AllocateDouble));
</span><del>- return m_butterfly.get(this)->contiguousDouble();
</del><ins>+ return m_butterfly.get()->contiguousDouble();
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> ContiguousJSValues JSObject::convertUndecidedToContiguous(VM& vm)
</span><span class="cx"> {
</span><span class="cx"> ASSERT(hasUndecided(indexingType()));
</span><span class="cx"> setStructure(vm, Structure::nonPropertyTransition(vm, structure(vm), AllocateContiguous));
</span><del>- return m_butterfly.get(this)->contiguous();
</del><ins>+ return m_butterfly.get()->contiguous();
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> ArrayStorage* JSObject::constructConvertedArrayStorageWithoutCopyingElements(VM& vm, unsigned neededLength)
</span><span class="cx"> {
</span><span class="cx"> Structure* structure = this->structure(vm);
</span><del>- unsigned publicLength = m_butterfly.get(this)->publicLength();
</del><ins>+ unsigned publicLength = m_butterfly.get()->publicLength();
</ins><span class="cx"> unsigned propertyCapacity = structure->outOfLineCapacity();
</span><span class="cx"> unsigned propertySize = structure->outOfLineSize();
</span><span class="cx">
</span><span class="lines">@@ -792,7 +792,7 @@
</span><span class="cx">
</span><span class="cx"> memcpy(
</span><span class="cx"> newButterfly->propertyStorage() - propertySize,
</span><del>- m_butterfly.get(this)->propertyStorage() - propertySize,
</del><ins>+ m_butterfly.get()->propertyStorage() - propertySize,
</ins><span class="cx"> propertySize * sizeof(EncodedJSValue));
</span><span class="cx">
</span><span class="cx"> ArrayStorage* newStorage = newButterfly->arrayStorage();
</span><span class="lines">@@ -810,7 +810,7 @@
</span><span class="cx"> DeferGC deferGC(vm.heap);
</span><span class="cx"> ASSERT(hasUndecided(indexingType()));
</span><span class="cx">
</span><del>- unsigned vectorLength = m_butterfly.get(this)->vectorLength();
</del><ins>+ unsigned vectorLength = m_butterfly.get()->vectorLength();
</ins><span class="cx"> ArrayStorage* storage = constructConvertedArrayStorageWithoutCopyingElements(vm, vectorLength);
</span><span class="cx"> // No need to copy elements.
</span><span class="cx">
</span><span class="lines">@@ -828,7 +828,7 @@
</span><span class="cx"> {
</span><span class="cx"> ASSERT(hasInt32(indexingType()));
</span><span class="cx">
</span><del>- Butterfly* butterfly = m_butterfly.get(this);
</del><ins>+ Butterfly* butterfly = m_butterfly.get();
</ins><span class="cx"> for (unsigned i = butterfly->vectorLength(); i--;) {
</span><span class="cx"> WriteBarrier<Unknown>* current = &butterfly->contiguousInt32()[i];
</span><span class="cx"> double* currentAsDouble = bitwise_cast<double*>(current);
</span><span class="lines">@@ -842,7 +842,7 @@
</span><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> setStructure(vm, Structure::nonPropertyTransition(vm, structure(vm), AllocateDouble));
</span><del>- return m_butterfly.get(this)->contiguousDouble();
</del><ins>+ return m_butterfly.get()->contiguousDouble();
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> ContiguousJSValues JSObject::convertInt32ToContiguous(VM& vm)
</span><span class="lines">@@ -850,7 +850,7 @@
</span><span class="cx"> ASSERT(hasInt32(indexingType()));
</span><span class="cx">
</span><span class="cx"> setStructure(vm, Structure::nonPropertyTransition(vm, structure(vm), AllocateContiguous));
</span><del>- return m_butterfly.get(this)->contiguous();
</del><ins>+ return m_butterfly.get()->contiguous();
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> ArrayStorage* JSObject::convertInt32ToArrayStorage(VM& vm, NonPropertyTransition transition)
</span><span class="lines">@@ -858,9 +858,9 @@
</span><span class="cx"> DeferGC deferGC(vm.heap);
</span><span class="cx"> ASSERT(hasInt32(indexingType()));
</span><span class="cx">
</span><del>- unsigned vectorLength = m_butterfly.get(this)->vectorLength();
</del><ins>+ unsigned vectorLength = m_butterfly.get()->vectorLength();
</ins><span class="cx"> ArrayStorage* newStorage = constructConvertedArrayStorageWithoutCopyingElements(vm, vectorLength);
</span><del>- Butterfly* butterfly = m_butterfly.get(this);
</del><ins>+ Butterfly* butterfly = m_butterfly.get();
</ins><span class="cx"> for (unsigned i = 0; i < butterfly->publicLength(); i++) {
</span><span class="cx"> JSValue v = butterfly->contiguous()[i].get();
</span><span class="cx"> if (v) {
</span><span class="lines">@@ -884,7 +884,7 @@
</span><span class="cx"> {
</span><span class="cx"> ASSERT(hasDouble(indexingType()));
</span><span class="cx">
</span><del>- Butterfly* butterfly = m_butterfly.get(this);
</del><ins>+ Butterfly* butterfly = m_butterfly.get();
</ins><span class="cx"> for (unsigned i = butterfly->vectorLength(); i--;) {
</span><span class="cx"> double* current = &butterfly->contiguousDouble()[i];
</span><span class="cx"> WriteBarrier<Unknown>* currentAsValue = bitwise_cast<WriteBarrier<Unknown>*>(current);
</span><span class="lines">@@ -898,7 +898,7 @@
</span><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> setStructure(vm, Structure::nonPropertyTransition(vm, structure(vm), AllocateContiguous));
</span><del>- return m_butterfly.get(this)->contiguous();
</del><ins>+ return m_butterfly.get()->contiguous();
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> ArrayStorage* JSObject::convertDoubleToArrayStorage(VM& vm, NonPropertyTransition transition)
</span><span class="lines">@@ -906,9 +906,9 @@
</span><span class="cx"> DeferGC deferGC(vm.heap);
</span><span class="cx"> ASSERT(hasDouble(indexingType()));
</span><span class="cx">
</span><del>- unsigned vectorLength = m_butterfly.get(this)->vectorLength();
</del><ins>+ unsigned vectorLength = m_butterfly.get()->vectorLength();
</ins><span class="cx"> ArrayStorage* newStorage = constructConvertedArrayStorageWithoutCopyingElements(vm, vectorLength);
</span><del>- Butterfly* butterfly = m_butterfly.get(this);
</del><ins>+ Butterfly* butterfly = m_butterfly.get();
</ins><span class="cx"> for (unsigned i = 0; i < butterfly->publicLength(); i++) {
</span><span class="cx"> double value = butterfly->contiguousDouble()[i];
</span><span class="cx"> if (value == value) {
</span><span class="lines">@@ -933,9 +933,9 @@
</span><span class="cx"> DeferGC deferGC(vm.heap);
</span><span class="cx"> ASSERT(hasContiguous(indexingType()));
</span><span class="cx">
</span><del>- unsigned vectorLength = m_butterfly.get(this)->vectorLength();
</del><ins>+ unsigned vectorLength = m_butterfly.get()->vectorLength();
</ins><span class="cx"> ArrayStorage* newStorage = constructConvertedArrayStorageWithoutCopyingElements(vm, vectorLength);
</span><del>- Butterfly* butterfly = m_butterfly.get(this);
</del><ins>+ Butterfly* butterfly = m_butterfly.get();
</ins><span class="cx"> for (unsigned i = 0; i < butterfly->publicLength(); i++) {
</span><span class="cx"> JSValue v = butterfly->contiguous()[i].get();
</span><span class="cx"> if (v) {
</span><span class="lines">@@ -1002,8 +1002,8 @@
</span><span class="cx">
</span><span class="cx"> void JSObject::setIndexQuicklyToUndecided(VM& vm, unsigned index, JSValue value)
</span><span class="cx"> {
</span><del>- ASSERT(index < m_butterfly.get(this)->publicLength());
- ASSERT(index < m_butterfly.get(this)->vectorLength());
</del><ins>+ ASSERT(index < m_butterfly.get()->publicLength());
+ ASSERT(index < m_butterfly.get()->vectorLength());
</ins><span class="cx"> convertUndecidedForValue(vm, value);
</span><span class="cx"> setIndexQuickly(vm, index, value);
</span><span class="cx"> }
</span><span class="lines">@@ -1171,7 +1171,7 @@
</span><span class="cx"> return enterDictionaryIndexingModeWhenArrayStorageAlreadyExists(vm, convertContiguousToArrayStorage(vm));
</span><span class="cx">
</span><span class="cx"> case ALL_ARRAY_STORAGE_INDEXING_TYPES:
</span><del>- return enterDictionaryIndexingModeWhenArrayStorageAlreadyExists(vm, m_butterfly.get(this)->arrayStorage());
</del><ins>+ return enterDictionaryIndexingModeWhenArrayStorageAlreadyExists(vm, m_butterfly.get()->arrayStorage());
</ins><span class="cx">
</span><span class="cx"> default:
</span><span class="cx"> CRASH();
</span><span class="lines">@@ -1448,7 +1448,7 @@
</span><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> case ALL_ARRAY_STORAGE_INDEXING_TYPES: {
</span><del>- ArrayStorage* storage = thisObject->m_butterfly.get(thisObject)->arrayStorage();
</del><ins>+ ArrayStorage* storage = thisObject->m_butterfly.get()->arrayStorage();
</ins><span class="cx">
</span><span class="cx"> if (i < storage->vectorLength()) {
</span><span class="cx"> WriteBarrier<Unknown>& valueSlot = storage->m_vector[i];
</span><span class="lines">@@ -1717,7 +1717,7 @@
</span><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> case ALL_ARRAY_STORAGE_INDEXING_TYPES: {
</span><del>- ArrayStorage* storage = object->m_butterfly.get(object)->arrayStorage();
</del><ins>+ ArrayStorage* storage = object->m_butterfly.get()->arrayStorage();
</ins><span class="cx">
</span><span class="cx"> unsigned usedVectorLength = std::min(storage->length(), storage->vectorLength());
</span><span class="cx"> for (unsigned i = 0; i < usedVectorLength; ++i) {
</span><span class="lines">@@ -1890,7 +1890,7 @@
</span><span class="cx"> bool JSObject::putIndexedDescriptor(ExecState* exec, SparseArrayEntry* entryInMap, const PropertyDescriptor& descriptor, PropertyDescriptor& oldDescriptor)
</span><span class="cx"> {
</span><span class="cx"> VM& vm = exec->vm();
</span><del>- auto map = m_butterfly.get(this)->arrayStorage()->m_sparseMap.get();
</del><ins>+ auto map = m_butterfly.get()->arrayStorage()->m_sparseMap.get();
</ins><span class="cx">
</span><span class="cx"> if (descriptor.isDataDescriptor()) {
</span><span class="cx"> if (descriptor.value())
</span><span class="lines">@@ -1950,7 +1950,7 @@
</span><span class="cx"> if (descriptor.attributes() & (ReadOnly | Accessor))
</span><span class="cx"> notifyPresenceOfIndexedAccessors(exec->vm());
</span><span class="cx">
</span><del>- SparseArrayValueMap* map = m_butterfly.get(this)->arrayStorage()->m_sparseMap.get();
</del><ins>+ SparseArrayValueMap* map = m_butterfly.get()->arrayStorage()->m_sparseMap.get();
</ins><span class="cx"> RELEASE_ASSERT(map);
</span><span class="cx">
</span><span class="cx"> // 1. Let current be the result of calling the [[GetOwnProperty]] internal method of O with property name P.
</span><span class="lines">@@ -1982,7 +1982,7 @@
</span><span class="cx"> entryInMap->get(defaults);
</span><span class="cx">
</span><span class="cx"> putIndexedDescriptor(exec, entryInMap, descriptor, defaults);
</span><del>- Butterfly* butterfly = m_butterfly.get(this);
</del><ins>+ Butterfly* butterfly = m_butterfly.get();
</ins><span class="cx"> if (index >= butterfly->arrayStorage()->length())
</span><span class="cx"> butterfly->arrayStorage()->setLength(index + 1);
</span><span class="cx"> return true;
</span><span class="lines">@@ -2111,7 +2111,7 @@
</span><span class="cx"> ASSERT((indexingType() & IndexingShapeMask) == indexingShape);
</span><span class="cx"> ASSERT(!indexingShouldBeSparse());
</span><span class="cx">
</span><del>- Butterfly* butterfly = m_butterfly.get(this);
</del><ins>+ Butterfly* butterfly = m_butterfly.get();
</ins><span class="cx">
</span><span class="cx"> // For us to get here, the index is either greater than the public length, or greater than
</span><span class="cx"> // or equal to the vector length.
</span><span class="lines">@@ -2132,7 +2132,7 @@
</span><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> ensureLength(vm, i + 1);
</span><del>- butterfly = m_butterfly.get(this);
</del><ins>+ butterfly = m_butterfly.get();
</ins><span class="cx">
</span><span class="cx"> RELEASE_ASSERT(i < butterfly->vectorLength());
</span><span class="cx"> switch (indexingShape) {
</span><span class="lines">@@ -2415,7 +2415,7 @@
</span><span class="cx">
</span><span class="cx"> case ALL_INT32_INDEXING_TYPES: {
</span><span class="cx"> if (attributes) {
</span><del>- if (i < m_butterfly.get(this)->vectorLength())
</del><ins>+ if (i < m_butterfly.get()->vectorLength())
</ins><span class="cx"> return putDirectIndexBeyondVectorLengthWithArrayStorage(exec, i, value, attributes, mode, ensureArrayStorageExistsAndEnterDictionaryIndexingMode(vm));
</span><span class="cx"> return putDirectIndexBeyondVectorLengthWithArrayStorage(exec, i, value, attributes, mode, convertInt32ToArrayStorage(vm));
</span><span class="cx"> }
</span><span class="lines">@@ -2429,7 +2429,7 @@
</span><span class="cx">
</span><span class="cx"> case ALL_DOUBLE_INDEXING_TYPES: {
</span><span class="cx"> if (attributes) {
</span><del>- if (i < m_butterfly.get(this)->vectorLength())
</del><ins>+ if (i < m_butterfly.get()->vectorLength())
</ins><span class="cx"> return putDirectIndexBeyondVectorLengthWithArrayStorage(exec, i, value, attributes, mode, ensureArrayStorageExistsAndEnterDictionaryIndexingMode(vm));
</span><span class="cx"> return putDirectIndexBeyondVectorLengthWithArrayStorage(exec, i, value, attributes, mode, convertDoubleToArrayStorage(vm));
</span><span class="cx"> }
</span><span class="lines">@@ -2448,7 +2448,7 @@
</span><span class="cx">
</span><span class="cx"> case ALL_CONTIGUOUS_INDEXING_TYPES: {
</span><span class="cx"> if (attributes) {
</span><del>- if (i < m_butterfly.get(this)->vectorLength())
</del><ins>+ if (i < m_butterfly.get()->vectorLength())
</ins><span class="cx"> return putDirectIndexBeyondVectorLengthWithArrayStorage(exec, i, value, attributes, mode, ensureArrayStorageExistsAndEnterDictionaryIndexingMode(vm));
</span><span class="cx"> return putDirectIndexBeyondVectorLengthWithArrayStorage(exec, i, value, attributes, mode, convertContiguousToArrayStorage(vm));
</span><span class="cx"> }
</span><span class="lines">@@ -2458,7 +2458,7 @@
</span><span class="cx">
</span><span class="cx"> case ALL_ARRAY_STORAGE_INDEXING_TYPES:
</span><span class="cx"> if (attributes) {
</span><del>- if (i < m_butterfly.get(this)->vectorLength())
</del><ins>+ if (i < m_butterfly.get()->vectorLength())
</ins><span class="cx"> return putDirectIndexBeyondVectorLengthWithArrayStorage(exec, i, value, attributes, mode, ensureArrayStorageExistsAndEnterDictionaryIndexingMode(vm));
</span><span class="cx"> }
</span><span class="cx"> return putDirectIndexBeyondVectorLengthWithArrayStorage(exec, i, value, attributes, mode, arrayStorage());
</span><span class="lines">@@ -2544,8 +2544,8 @@
</span><span class="cx"> unsigned length;
</span><span class="cx">
</span><span class="cx"> if (hasIndexedProperties(indexingType())) {
</span><del>- vectorLength = m_butterfly.get(this)->vectorLength();
- length = m_butterfly.get(this)->publicLength();
</del><ins>+ vectorLength = m_butterfly.get()->vectorLength();
+ length = m_butterfly.get()->publicLength();
</ins><span class="cx"> } else {
</span><span class="cx"> vectorLength = 0;
</span><span class="cx"> length = 0;
</span><span class="lines">@@ -2651,7 +2651,7 @@
</span><span class="cx">
</span><span class="cx"> void JSObject::ensureLengthSlow(VM& vm, unsigned length)
</span><span class="cx"> {
</span><del>- Butterfly* butterfly = m_butterfly.get(this);
</del><ins>+ Butterfly* butterfly = m_butterfly.get();
</ins><span class="cx">
</span><span class="cx"> ASSERT(length < MAX_ARRAY_INDEX);
</span><span class="cx"> ASSERT(hasContiguous(indexingType()) || hasInt32(indexingType()) || hasDouble(indexingType()) || hasUndecided(indexingType()));
</span><span class="lines">@@ -2681,11 +2681,11 @@
</span><span class="cx"> ASSERT(length < MAX_ARRAY_INDEX);
</span><span class="cx"> ASSERT(length < MAX_STORAGE_VECTOR_LENGTH);
</span><span class="cx"> ASSERT(hasContiguous(indexingType()) || hasInt32(indexingType()) || hasDouble(indexingType()) || hasUndecided(indexingType()));
</span><del>- ASSERT(m_butterfly.get(this)->vectorLength() > length);
- ASSERT(!m_butterfly.get(this)->indexingHeader()->preCapacity(structure()));
</del><ins>+ ASSERT(m_butterfly.get()->vectorLength() > length);
+ ASSERT(!m_butterfly.get()->indexingHeader()->preCapacity(structure()));
</ins><span class="cx">
</span><span class="cx"> DeferGC deferGC(vm.heap);
</span><del>- Butterfly* newButterfly = m_butterfly.get(this)->resizeArray(vm, this, structure(), 0, ArrayStorage::sizeFor(length));
</del><ins>+ Butterfly* newButterfly = m_butterfly.get()->resizeArray(vm, this, structure(), 0, ArrayStorage::sizeFor(length));
</ins><span class="cx"> m_butterfly.set(vm, this, newButterfly);
</span><span class="cx"> newButterfly->setVectorLength(length);
</span><span class="cx"> newButterfly->setPublicLength(length);
</span><span class="lines">@@ -2698,7 +2698,7 @@
</span><span class="cx"> // It's important that this function not rely on structure(), for the property
</span><span class="cx"> // capacity, since we might have already mutated the structure in-place.
</span><span class="cx">
</span><del>- return Butterfly::createOrGrowPropertyStorage(m_butterfly.get(this), vm, this, structure(vm), oldSize, newSize);
</del><ins>+ return Butterfly::createOrGrowPropertyStorage(m_butterfly.get(), vm, this, structure(vm), oldSize, newSize);
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> static JSBoundSlotBaseFunction* getBoundSlotBaseFunctionForGetterSetter(ExecState* exec, PropertyName propertyName, JSC::PropertySlot& slot, CustomGetterSetter* getterSetter, JSBoundSlotBaseFunction::Type type)
</span><span class="lines">@@ -3051,7 +3051,7 @@
</span><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> case ALL_ARRAY_STORAGE_INDEXING_TYPES: {
</span><del>- ArrayStorage* storage = object->m_butterfly.get(object)->arrayStorage();
</del><ins>+ ArrayStorage* storage = object->m_butterfly.get()->arrayStorage();
</ins><span class="cx"> if (storage->m_sparseMap.get())
</span><span class="cx"> return 0;
</span><span class="cx">
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeJSObjecth"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/JSObject.h (198211 => 198212)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/JSObject.h 2016-03-15 15:20:40 UTC (rev 198211)
+++ trunk/Source/JavaScriptCore/runtime/JSObject.h 2016-03-15 15:26:36 UTC (rev 198212)
</span><span class="lines">@@ -162,14 +162,14 @@
</span><span class="cx"> {
</span><span class="cx"> if (!hasIndexedProperties(indexingType()))
</span><span class="cx"> return 0;
</span><del>- return m_butterfly.get(this)->publicLength();
</del><ins>+ return m_butterfly.get()->publicLength();
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> unsigned getVectorLength()
</span><span class="cx"> {
</span><span class="cx"> if (!hasIndexedProperties(indexingType()))
</span><span class="cx"> return 0;
</span><del>- return m_butterfly.get(this)->vectorLength();
</del><ins>+ return m_butterfly.get()->vectorLength();
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> static bool putInline(JSCell*, ExecState*, PropertyName, JSValue, PutPropertySlot&);
</span><span class="lines">@@ -214,7 +214,7 @@
</span><span class="cx">
</span><span class="cx"> bool canGetIndexQuickly(unsigned i)
</span><span class="cx"> {
</span><del>- Butterfly* butterfly = m_butterfly.get(this);
</del><ins>+ Butterfly* butterfly = m_butterfly.get();
</ins><span class="cx"> switch (indexingType()) {
</span><span class="cx"> case ALL_BLANK_INDEXING_TYPES:
</span><span class="cx"> case ALL_UNDECIDED_INDEXING_TYPES:
</span><span class="lines">@@ -240,7 +240,7 @@
</span><span class="cx">
</span><span class="cx"> JSValue getIndexQuickly(unsigned i)
</span><span class="cx"> {
</span><del>- Butterfly* butterfly = m_butterfly.get(this);
</del><ins>+ Butterfly* butterfly = m_butterfly.get();
</ins><span class="cx"> switch (indexingType()) {
</span><span class="cx"> case ALL_INT32_INDEXING_TYPES:
</span><span class="cx"> return jsNumber(butterfly->contiguous()[i].get().asInt32());
</span><span class="lines">@@ -258,7 +258,7 @@
</span><span class="cx">
</span><span class="cx"> JSValue tryGetIndexQuickly(unsigned i) const
</span><span class="cx"> {
</span><del>- Butterfly* butterfly = m_butterfly.get(this);
</del><ins>+ Butterfly* butterfly = m_butterfly.get();
</ins><span class="cx"> switch (indexingType()) {
</span><span class="cx"> case ALL_BLANK_INDEXING_TYPES:
</span><span class="cx"> case ALL_UNDECIDED_INDEXING_TYPES:
</span><span class="lines">@@ -312,7 +312,7 @@
</span><span class="cx">
</span><span class="cx"> bool canSetIndexQuickly(unsigned i)
</span><span class="cx"> {
</span><del>- Butterfly* butterfly = m_butterfly.get(this);
</del><ins>+ Butterfly* butterfly = m_butterfly.get();
</ins><span class="cx"> switch (indexingType()) {
</span><span class="cx"> case ALL_BLANK_INDEXING_TYPES:
</span><span class="cx"> case ALL_UNDECIDED_INDEXING_TYPES:
</span><span class="lines">@@ -343,7 +343,7 @@
</span><span class="cx"> case ALL_DOUBLE_INDEXING_TYPES:
</span><span class="cx"> case ALL_CONTIGUOUS_INDEXING_TYPES:
</span><span class="cx"> case ALL_ARRAY_STORAGE_INDEXING_TYPES:
</span><del>- return i < m_butterfly.get(this)->vectorLength();
</del><ins>+ return i < m_butterfly.get()->vectorLength();
</ins><span class="cx"> default:
</span><span class="cx"> RELEASE_ASSERT_NOT_REACHED();
</span><span class="cx"> return false;
</span><span class="lines">@@ -352,7 +352,7 @@
</span><span class="cx">
</span><span class="cx"> void setIndexQuickly(VM& vm, unsigned i, JSValue v)
</span><span class="cx"> {
</span><del>- Butterfly* butterfly = m_butterfly.get(this);
</del><ins>+ Butterfly* butterfly = m_butterfly.get();
</ins><span class="cx"> switch (indexingType()) {
</span><span class="cx"> case ALL_INT32_INDEXING_TYPES: {
</span><span class="cx"> ASSERT(i < butterfly->vectorLength());
</span><span class="lines">@@ -409,7 +409,7 @@
</span><span class="cx">
</span><span class="cx"> void initializeIndex(VM& vm, unsigned i, JSValue v, IndexingType indexingType)
</span><span class="cx"> {
</span><del>- Butterfly* butterfly = m_butterfly.get(this);
</del><ins>+ Butterfly* butterfly = m_butterfly.get();
</ins><span class="cx"> switch (indexingType) {
</span><span class="cx"> case ALL_UNDECIDED_INDEXING_TYPES: {
</span><span class="cx"> setIndexQuicklyToUndecided(vm, i, v);
</span><span class="lines">@@ -467,7 +467,7 @@
</span><span class="cx"> case ALL_CONTIGUOUS_INDEXING_TYPES:
</span><span class="cx"> return false;
</span><span class="cx"> case ALL_ARRAY_STORAGE_INDEXING_TYPES:
</span><del>- return !!m_butterfly.get(this)->arrayStorage()->m_sparseMap;
</del><ins>+ return !!m_butterfly.get()->arrayStorage()->m_sparseMap;
</ins><span class="cx"> default:
</span><span class="cx"> RELEASE_ASSERT_NOT_REACHED();
</span><span class="cx"> return false;
</span><span class="lines">@@ -484,7 +484,7 @@
</span><span class="cx"> case ALL_CONTIGUOUS_INDEXING_TYPES:
</span><span class="cx"> return false;
</span><span class="cx"> case ALL_ARRAY_STORAGE_INDEXING_TYPES:
</span><del>- return m_butterfly.get(this)->arrayStorage()->inSparseMode();
</del><ins>+ return m_butterfly.get()->arrayStorage()->inSparseMode();
</ins><span class="cx"> default:
</span><span class="cx"> RELEASE_ASSERT_NOT_REACHED();
</span><span class="cx"> return false;
</span><span class="lines">@@ -593,11 +593,11 @@
</span><span class="cx"> return inlineStorageUnsafe();
</span><span class="cx"> }
</span><span class="cx">
</span><del>- const Butterfly* butterfly() const { return m_butterfly.get(this); }
- Butterfly* butterfly() { return m_butterfly.get(this); }
</del><ins>+ const Butterfly* butterfly() const { return m_butterfly.get(); }
+ Butterfly* butterfly() { return m_butterfly.get(); }
</ins><span class="cx">
</span><del>- ConstPropertyStorage outOfLineStorage() const { return m_butterfly.get(this)->propertyStorage(); }
- PropertyStorage outOfLineStorage() { return m_butterfly.get(this)->propertyStorage(); }
</del><ins>+ ConstPropertyStorage outOfLineStorage() const { return m_butterfly.get()->propertyStorage(); }
+ PropertyStorage outOfLineStorage() { return m_butterfly.get()->propertyStorage(); }
</ins><span class="cx">
</span><span class="cx"> const WriteBarrierBase<Unknown>* locationForOffset(PropertyOffset offset) const
</span><span class="cx"> {
</span><span class="lines">@@ -713,7 +713,7 @@
</span><span class="cx"> ContiguousJSValues ensureInt32(VM& vm)
</span><span class="cx"> {
</span><span class="cx"> if (LIKELY(hasInt32(indexingType())))
</span><del>- return m_butterfly.get(this)->contiguousInt32();
</del><ins>+ return m_butterfly.get()->contiguousInt32();
</ins><span class="cx">
</span><span class="cx"> return ensureInt32Slow(vm);
</span><span class="cx"> }
</span><span class="lines">@@ -725,7 +725,7 @@
</span><span class="cx"> ContiguousDoubles ensureDouble(VM& vm)
</span><span class="cx"> {
</span><span class="cx"> if (LIKELY(hasDouble(indexingType())))
</span><del>- return m_butterfly.get(this)->contiguousDouble();
</del><ins>+ return m_butterfly.get()->contiguousDouble();
</ins><span class="cx">
</span><span class="cx"> return ensureDoubleSlow(vm);
</span><span class="cx"> }
</span><span class="lines">@@ -735,7 +735,7 @@
</span><span class="cx"> ContiguousJSValues ensureContiguous(VM& vm)
</span><span class="cx"> {
</span><span class="cx"> if (LIKELY(hasContiguous(indexingType())))
</span><del>- return m_butterfly.get(this)->contiguous();
</del><ins>+ return m_butterfly.get()->contiguous();
</ins><span class="cx">
</span><span class="cx"> return ensureContiguousSlow(vm);
</span><span class="cx"> }
</span><span class="lines">@@ -747,7 +747,7 @@
</span><span class="cx"> ArrayStorage* ensureArrayStorage(VM& vm)
</span><span class="cx"> {
</span><span class="cx"> if (LIKELY(hasAnyArrayStorage(indexingType())))
</span><del>- return m_butterfly.get(this)->arrayStorage();
</del><ins>+ return m_butterfly.get()->arrayStorage();
</ins><span class="cx">
</span><span class="cx"> return ensureArrayStorageSlow(vm);
</span><span class="cx"> }
</span><span class="lines">@@ -795,7 +795,7 @@
</span><span class="cx"> ArrayStorage* arrayStorage()
</span><span class="cx"> {
</span><span class="cx"> ASSERT(hasAnyArrayStorage(indexingType()));
</span><del>- return m_butterfly.get(this)->arrayStorage();
</del><ins>+ return m_butterfly.get()->arrayStorage();
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> // Call this if you want to predicate some actions on whether or not the
</span><span class="lines">@@ -804,7 +804,7 @@
</span><span class="cx"> {
</span><span class="cx"> switch (indexingType()) {
</span><span class="cx"> case ALL_ARRAY_STORAGE_INDEXING_TYPES:
</span><del>- return m_butterfly.get(this)->arrayStorage();
</del><ins>+ return m_butterfly.get()->arrayStorage();
</ins><span class="cx">
</span><span class="cx"> default:
</span><span class="cx"> return 0;
</span><span class="lines">@@ -869,11 +869,11 @@
</span><span class="cx"> ASSERT(length < MAX_ARRAY_INDEX);
</span><span class="cx"> ASSERT(hasContiguous(indexingType()) || hasInt32(indexingType()) || hasDouble(indexingType()) || hasUndecided(indexingType()));
</span><span class="cx">
</span><del>- if (m_butterfly.get(this)->vectorLength() < length)
</del><ins>+ if (m_butterfly.get()->vectorLength() < length)
</ins><span class="cx"> ensureLengthSlow(vm, length);
</span><span class="cx">
</span><del>- if (m_butterfly.get(this)->publicLength() < length)
- m_butterfly.get(this)->setPublicLength(length);
</del><ins>+ if (m_butterfly.get()->publicLength() < length)
+ m_butterfly.get()->setPublicLength(length);
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> // Call this if you want to shrink the butterfly backing store, and you're
</span><span class="lines">@@ -1489,7 +1489,7 @@
</span><span class="cx"> DeferGC deferGC(vm.heap);
</span><span class="cx"> ASSERT(!value.isGetterSetter() && !(attributes & Accessor));
</span><span class="cx"> ASSERT(!value.isCustomGetterSetter());
</span><del>- Butterfly* newButterfly = m_butterfly.get(this);
</del><ins>+ Butterfly* newButterfly = m_butterfly.get();
</ins><span class="cx"> if (structure()->putWillGrowOutOfLineStorage())
</span><span class="cx"> newButterfly = growOutOfLineStorage(vm, structure()->outOfLineCapacity(), structure()->suggestedNewOutOfLineStorageCapacity());
</span><span class="cx"> Structure* structure = this->structure();
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeMapDatah"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/MapData.h (198211 => 198212)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/MapData.h 2016-03-15 15:20:40 UTC (rev 198211)
+++ trunk/Source/JavaScriptCore/runtime/MapData.h 2016-03-15 15:26:36 UTC (rev 198212)
</span><span class="lines">@@ -1,5 +1,5 @@
</span><span class="cx"> /*
</span><del>- * Copyright (C) 2013, 2015 Apple Inc. All rights reserved.
</del><ins>+ * Copyright (C) 2013, 2015-2016 Apple Inc. All rights reserved.
</ins><span class="cx"> *
</span><span class="cx"> * Redistribution and use in source and binary forms, with or without
</span><span class="cx"> * modification, are permitted provided that the following conditions
</span><span class="lines">@@ -185,7 +185,7 @@
</span><span class="cx"> {
</span><span class="cx"> if (!ensureSlot())
</span><span class="cx"> return false;
</span><del>- Entry* entry = &m_mapData->m_entries.get(m_mapData->m_owner)[m_index];
</del><ins>+ Entry* entry = &m_mapData->m_entries.get()[m_index];
</ins><span class="cx"> pair = WTF::KeyValuePair<JSValue, JSValue>(entry->key().get(), entry->value().get());
</span><span class="cx"> m_index += 1;
</span><span class="cx"> return true;
</span><span class="lines">@@ -207,7 +207,7 @@
</span><span class="cx"> if (isFinished())
</span><span class="cx"> return m_index;
</span><span class="cx">
</span><del>- Entry* entries = m_mapData->m_entries.get(m_mapData->m_owner);
</del><ins>+ Entry* entries = m_mapData->m_entries.get();
</ins><span class="cx"> size_t end = m_mapData->m_size;
</span><span class="cx"> while (static_cast<size_t>(m_index) < end && !entries[m_index].key())
</span><span class="cx"> m_index++;
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeMapDataInlinesh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/MapDataInlines.h (198211 => 198212)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/MapDataInlines.h 2016-03-15 15:20:40 UTC (rev 198211)
+++ trunk/Source/JavaScriptCore/runtime/MapDataInlines.h 2016-03-15 15:26:36 UTC (rev 198212)
</span><span class="lines">@@ -1,5 +1,5 @@
</span><span class="cx"> /*
</span><del>- * Copyright (C) 2013 Apple Inc. All rights reserved.
</del><ins>+ * Copyright (C) 2013, 2016 Apple Inc. All rights reserved.
</ins><span class="cx"> * Copyright (C) 2015 Yusuke Suzuki <utatane.tea@gmail.com>.
</span><span class="cx"> *
</span><span class="cx"> * Redistribution and use in source and binary forms, with or without
</span><span class="lines">@@ -60,25 +60,25 @@
</span><span class="cx"> auto iter = m_stringKeyedTable.find(asString(key.value)->value(exec).impl());
</span><span class="cx"> if (iter == m_stringKeyedTable.end())
</span><span class="cx"> return 0;
</span><del>- return &m_entries.get(m_owner)[iter->value];
</del><ins>+ return &m_entries.get()[iter->value];
</ins><span class="cx"> }
</span><span class="cx"> if (key.value.isSymbol()) {
</span><span class="cx"> auto iter = m_symbolKeyedTable.find(asSymbol(key.value)->privateName().uid());
</span><span class="cx"> if (iter == m_symbolKeyedTable.end())
</span><span class="cx"> return 0;
</span><del>- return &m_entries.get(m_owner)[iter->value];
</del><ins>+ return &m_entries.get()[iter->value];
</ins><span class="cx"> }
</span><span class="cx"> if (key.value.isCell()) {
</span><span class="cx"> auto iter = m_cellKeyedTable.find(key.value.asCell());
</span><span class="cx"> if (iter == m_cellKeyedTable.end())
</span><span class="cx"> return 0;
</span><del>- return &m_entries.get(m_owner)[iter->value];
</del><ins>+ return &m_entries.get()[iter->value];
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> auto iter = m_valueKeyedTable.find(JSValue::encode(key.value));
</span><span class="cx"> if (iter == m_valueKeyedTable.end())
</span><span class="cx"> return 0;
</span><del>- return &m_entries.get(m_owner)[iter->value];
</del><ins>+ return &m_entries.get()[iter->value];
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> template<typename Entry, typename JSIterator>
</span><span class="lines">@@ -93,14 +93,14 @@
</span><span class="cx"> {
</span><span class="cx"> typename Map::iterator location = map.find(key);
</span><span class="cx"> if (location != map.end())
</span><del>- return &m_entries.get(m_owner)[location->value];
</del><ins>+ return &m_entries.get()[location->value];
</ins><span class="cx">
</span><span class="cx"> if (!ensureSpaceForAppend(exec, owner))
</span><span class="cx"> return 0;
</span><span class="cx">
</span><span class="cx"> auto result = map.add(key, m_size);
</span><span class="cx"> RELEASE_ASSERT(result.isNewEntry);
</span><del>- Entry* entry = &m_entries.get(m_owner)[m_size++];
</del><ins>+ Entry* entry = &m_entries.get()[m_size++];
</ins><span class="cx"> new (entry) Entry();
</span><span class="cx"> entry->setKey(exec->vm(), owner, keyValue.value);
</span><span class="cx"> return entry;
</span><span class="lines">@@ -164,7 +164,7 @@
</span><span class="cx"> location = iter->value;
</span><span class="cx"> m_valueKeyedTable.remove(iter);
</span><span class="cx"> }
</span><del>- m_entries.get(m_owner)[location].clear();
</del><ins>+ m_entries.get()[location].clear();
</ins><span class="cx"> m_deletedCount++;
</span><span class="cx"> return true;
</span><span class="cx"> }
</span><span class="lines">@@ -176,7 +176,7 @@
</span><span class="cx"> int32_t newEnd = 0;
</span><span class="cx"> RELEASE_ASSERT(newCapacity > 0);
</span><span class="cx"> for (int32_t i = 0; i < m_size; i++) {
</span><del>- Entry& entry = m_entries.getWithoutBarrier()[i];
</del><ins>+ Entry& entry = m_entries.get()[i];
</ins><span class="cx"> if (!entry.key()) {
</span><span class="cx"> m_iterators.forEach([newEnd](JSIterator* iterator, JSIterator*) {
</span><span class="cx"> iterator->iteratorData()->didRemoveEntry(newEnd);
</span><span class="lines">@@ -195,13 +195,13 @@
</span><span class="cx">
</span><span class="cx"> // Fixup for the hashmaps
</span><span class="cx"> for (auto ptr = m_valueKeyedTable.begin(); ptr != m_valueKeyedTable.end(); ++ptr)
</span><del>- ptr->value = m_entries.getWithoutBarrier()[ptr->value].key().get().asInt32();
</del><ins>+ ptr->value = m_entries.get()[ptr->value].key().get().asInt32();
</ins><span class="cx"> for (auto ptr = m_cellKeyedTable.begin(); ptr != m_cellKeyedTable.end(); ++ptr)
</span><del>- ptr->value = m_entries.getWithoutBarrier()[ptr->value].key().get().asInt32();
</del><ins>+ ptr->value = m_entries.get()[ptr->value].key().get().asInt32();
</ins><span class="cx"> for (auto ptr = m_stringKeyedTable.begin(); ptr != m_stringKeyedTable.end(); ++ptr)
</span><del>- ptr->value = m_entries.getWithoutBarrier()[ptr->value].key().get().asInt32();
</del><ins>+ ptr->value = m_entries.get()[ptr->value].key().get().asInt32();
</ins><span class="cx"> for (auto ptr = m_symbolKeyedTable.begin(); ptr != m_symbolKeyedTable.end(); ++ptr)
</span><del>- ptr->value = m_entries.getWithoutBarrier()[ptr->value].key().get().asInt32();
</del><ins>+ ptr->value = m_entries.get()[ptr->value].key().get().asInt32();
</ins><span class="cx">
</span><span class="cx"> ASSERT((m_size - newEnd) == m_deletedCount);
</span><span class="cx"> m_deletedCount = 0;
</span><span class="lines">@@ -217,7 +217,7 @@
</span><span class="cx"> ASSERT(!shouldPack());
</span><span class="cx"> RELEASE_ASSERT(newCapacity > 0);
</span><span class="cx"> ASSERT(newCapacity >= m_capacity);
</span><del>- memcpy(destination, m_entries.getWithoutBarrier(), sizeof(Entry) * m_size);
</del><ins>+ memcpy(destination, m_entries.get(), sizeof(Entry) * m_size);
</ins><span class="cx"> m_capacity = newCapacity;
</span><span class="cx"> m_entries.setWithoutBarrier(destination);
</span><span class="cx"> }
</span><span class="lines">@@ -236,8 +236,6 @@
</span><span class="cx"> return false;
</span><span class="cx"> }
</span><span class="cx"> Entry* newEntries = static_cast<Entry*>(newStorage);
</span><del>- // Do a read barrier to ensure that m_entries points to to-space for the remainder of this GC epoch.
- m_entries.get(m_owner);
</del><span class="cx"> if (shouldPack())
</span><span class="cx"> replaceAndPackBackingStore(newEntries, requiredSize);
</span><span class="cx"> else
</span><span class="lines">@@ -249,7 +247,7 @@
</span><span class="cx"> template<typename Entry, typename JSIterator>
</span><span class="cx"> inline void MapDataImpl<Entry, JSIterator>::visitChildren(JSCell* owner, SlotVisitor& visitor)
</span><span class="cx"> {
</span><del>- Entry* entries = m_entries.getWithoutBarrier();
</del><ins>+ Entry* entries = m_entries.get();
</ins><span class="cx"> if (!entries)
</span><span class="cx"> return;
</span><span class="cx"> if (m_deletedCount) {
</span><span class="lines">@@ -263,14 +261,14 @@
</span><span class="cx"> visitor.appendValues(reinterpret_cast<WriteBarrier<Unknown>*>(&entries[0]), m_size * (sizeof(Entry) / sizeof(WriteBarrier<Unknown>)));
</span><span class="cx"> }
</span><span class="cx">
</span><del>- visitor.copyLater(owner, MapBackingStoreCopyToken, m_entries.getWithoutBarrier(), capacityInBytes());
</del><ins>+ visitor.copyLater(owner, MapBackingStoreCopyToken, m_entries.get(), capacityInBytes());
</ins><span class="cx"> }
</span><span class="cx">
</span><span class="cx"> template<typename Entry, typename JSIterator>
</span><span class="cx"> inline void MapDataImpl<Entry, JSIterator>::copyBackingStore(CopyVisitor& visitor, CopyToken token)
</span><span class="cx"> {
</span><del>- if (token == MapBackingStoreCopyToken && visitor.checkIfShouldCopy(m_entries.getWithoutBarrier())) {
- Entry* oldEntries = m_entries.getWithoutBarrier();
</del><ins>+ if (token == MapBackingStoreCopyToken && visitor.checkIfShouldCopy(m_entries.get())) {
+ Entry* oldEntries = m_entries.get();
</ins><span class="cx"> Entry* newEntries = static_cast<Entry*>(visitor.allocateNewSpace(capacityInBytes()));
</span><span class="cx"> if (shouldPack())
</span><span class="cx"> replaceAndPackBackingStore(newEntries, m_capacity);
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeOptionsh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/Options.h (198211 => 198212)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/Options.h 2016-03-15 15:20:40 UTC (rev 198211)
+++ trunk/Source/JavaScriptCore/runtime/Options.h 2016-03-15 15:26:36 UTC (rev 198212)
</span><span class="lines">@@ -200,7 +200,6 @@
</span><span class="cx"> v(bool, useMovHintRemoval, true, nullptr) \
</span><span class="cx"> v(bool, usePutStackSinking, true, nullptr) \
</span><span class="cx"> v(bool, useObjectAllocationSinking, true, nullptr) \
</span><del>- v(bool, useCopyBarrierOptimization, true, nullptr) \
</del><span class="cx"> \
</span><span class="cx"> v(bool, useConcurrentJIT, true, "allows the DFG / FTL compilation in threads other than the executing JS thread") \
</span><span class="cx"> v(unsigned, numberOfDFGCompilerThreads, computeNumberOfWorkerThreads(2, 2) - 1, nullptr) \
</span><span class="lines">@@ -371,7 +370,6 @@
</span><span class="cx"> v(enablePolymorphicCallInlining, usePolymorphicCallInlining, SameOption) \
</span><span class="cx"> v(enableMovHintRemoval, useMovHintRemoval, SameOption) \
</span><span class="cx"> v(enableObjectAllocationSinking, useObjectAllocationSinking, SameOption) \
</span><del>- v(enableCopyBarrierOptimization, useCopyBarrierOptimization, SameOption) \
</del><span class="cx"> v(enableConcurrentJIT, useConcurrentJIT, SameOption) \
</span><span class="cx"> v(enableProfiler, useProfiler, SameOption) \
</span><span class="cx"> v(enableArchitectureSpecificOptimizations, useArchitectureSpecificOptimizations, SameOption) \
</span></span></pre>
</div>
</div>
</body>
</html>