<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN"
"http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head><meta http-equiv="content-type" content="text/html; charset=utf-8" />
<title>[199093] trunk/Source/JavaScriptCore</title>
</head>
<body>

<style type="text/css"><!--
#msg dl.meta { border: 1px #006 solid; background: #369; padding: 6px; color: #fff; }
#msg dl.meta dt { float: left; width: 6em; font-weight: bold; }
#msg dt:after { content:':';}
#msg dl, #msg dt, #msg ul, #msg li, #header, #footer, #logmsg { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt;  }
#msg dl a { font-weight: bold}
#msg dl a:link    { color:#fc3; }
#msg dl a:active  { color:#ff0; }
#msg dl a:visited { color:#cc6; }
h3 { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; font-weight: bold; }
#msg pre { overflow: auto; background: #ffc; border: 1px #fa0 solid; padding: 6px; }
#logmsg { background: #ffc; border: 1px #fa0 solid; padding: 1em 1em 0 1em; }
#logmsg p, #logmsg pre, #logmsg blockquote { margin: 0 0 1em 0; }
#logmsg p, #logmsg li, #logmsg dt, #logmsg dd { line-height: 14pt; }
#logmsg h1, #logmsg h2, #logmsg h3, #logmsg h4, #logmsg h5, #logmsg h6 { margin: .5em 0; }
#logmsg h1:first-child, #logmsg h2:first-child, #logmsg h3:first-child, #logmsg h4:first-child, #logmsg h5:first-child, #logmsg h6:first-child { margin-top: 0; }
#logmsg ul, #logmsg ol { padding: 0; list-style-position: inside; margin: 0 0 0 1em; }
#logmsg ul { text-indent: -1em; padding-left: 1em; }#logmsg ol { text-indent: -1.5em; padding-left: 1.5em; }
#logmsg > ul, #logmsg > ol { margin: 0 0 1em 0; }
#logmsg pre { background: #eee; padding: 1em; }
#logmsg blockquote { border: 1px solid #fa0; border-left-width: 10px; padding: 1em 1em 0 1em; background: white;}
#logmsg dl { margin: 0; }
#logmsg dt { font-weight: bold; }
#logmsg dd { margin: 0; padding: 0 0 0.5em 0; }
#logmsg dd:before { content:'\00bb';}
#logmsg table { border-spacing: 0px; border-collapse: collapse; border-top: 4px solid #fa0; border-bottom: 1px solid #fa0; background: #fff; }
#logmsg table th { text-align: left; font-weight: normal; padding: 0.2em 0.5em; border-top: 1px dotted #fa0; }
#logmsg table td { text-align: right; border-top: 1px dotted #fa0; padding: 0.2em 0.5em; }
#logmsg table thead th { text-align: center; border-bottom: 1px solid #fa0; }
#logmsg table th.Corner { text-align: left; }
#logmsg hr { border: none 0; border-top: 2px dashed #fa0; height: 1px; }
#header, #footer { color: #fff; background: #636; border: 1px #300 solid; padding: 6px; }
#patch { width: 100%; }
#patch h4 {font-family: verdana,arial,helvetica,sans-serif;font-size:10pt;padding:8px;background:#369;color:#fff;margin:0;}
#patch .propset h4, #patch .binary h4 {margin:0;}
#patch pre {padding:0;line-height:1.2em;margin:0;}
#patch .diff {width:100%;background:#eee;padding: 0 0 10px 0;overflow:auto;}
#patch .propset .diff, #patch .binary .diff  {padding:10px 0;}
#patch span {display:block;padding:0 10px;}
#patch .modfile, #patch .addfile, #patch .delfile, #patch .propset, #patch .binary, #patch .copfile {border:1px solid #ccc;margin:10px 0;}
#patch ins {background:#dfd;text-decoration:none;display:block;padding:0 10px;}
#patch del {background:#fdd;text-decoration:none;display:block;padding:0 10px;}
#patch .lines, .info {color:#888;background:#fff;}
--></style>
<div id="msg">
<dl class="meta">
<dt>Revision</dt> <dd><a href="http://trac.webkit.org/projects/webkit/changeset/199093">199093</a></dd>
<dt>Author</dt> <dd>fpizlo@apple.com</dd>
<dt>Date</dt> <dd>2016-04-05 21:46:12 -0700 (Tue, 05 Apr 2016)</dd>
</dl>

<h3>Log Message</h3>
<pre>Improve some other cases of context-sensitive inlining
https://bugs.webkit.org/show_bug.cgi?id=156277

Reviewed by Benjamin Poulain.
        
This implements some improvements for inlining:

- We no longer do guarded inlining when the profiling doesn't come from a stub. Doing so would have
  been risky, and according to benchmarks, it wasn't common enough to matter. I think it's better to
  err on the side of not inlining.
        
- The jneq_ptr pattern for variadic calls no longer breaks the basic block. Not breaking the block
  increases the chances of the parser seeing the callee constant. While inlining doesn't require a
  callee constant, sometimes it makes a difference. Note that we were previously breaking the block
  for no reason at all: if the boundary after jneq_ptr is a jump target from some other jump, then
  the parser will automatically break the block for us. There is no reason to add any block breaking
  ourselves since we implement jneq_ptr by ignoring the affirmative jump destination and inserting a
  check and falling through.
        
- get_by_id handling now tries to apply some common sense to its status object. In particular, if
  the source is a NewObject and there was no interfering operation that could clobber the structure,
  then we know which case of a polymorphic GetByIdStatus we would take. This arises in some
  constructor patterns.
        
Long term, we should address all of these cases comprehensively by having a late inliner. The inliner
being part of the bytecode parser means that there is a lot of complexity in the parser and it
prevents us from inlining upon learning new information from static analysis. But for now, I think
it's fine to experiment with one-off hacks, if only to learn what the possibilities are.
        
This is a 14% speed-up on Octane/raytrace.

* bytecode/CallLinkStatus.cpp:
(JSC::CallLinkStatus::dump):
* bytecode/CallLinkStatus.h:
(JSC::CallLinkStatus::couldTakeSlowPath):
(JSC::CallLinkStatus::setCouldTakeSlowPath):
(JSC::CallLinkStatus::variants):
(JSC::CallLinkStatus::size):
(JSC::CallLinkStatus::at):
* bytecode/GetByIdStatus.cpp:
(JSC::GetByIdStatus::makesCalls):
(JSC::GetByIdStatus::filter):
(JSC::GetByIdStatus::dump):
* bytecode/GetByIdStatus.h:
(JSC::GetByIdStatus::wasSeenInJIT):
* dfg/DFGByteCodeParser.cpp:
(JSC::DFG::ByteCodeParser::handleCall):
(JSC::DFG::ByteCodeParser::refineStatically):
(JSC::DFG::ByteCodeParser::handleVarargsCall):
(JSC::DFG::ByteCodeParser::handleInlining):
(JSC::DFG::ByteCodeParser::handleGetById):
(JSC::DFG::ByteCodeParser::parseBlock):
* runtime/Options.h:</pre>

<h3>Modified Paths</h3>
<ul>
<li><a href="#trunkSourceJavaScriptCoreChangeLog">trunk/Source/JavaScriptCore/ChangeLog</a></li>
<li><a href="#trunkSourceJavaScriptCorebytecodeCallLinkStatuscpp">trunk/Source/JavaScriptCore/bytecode/CallLinkStatus.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCorebytecodeCallLinkStatush">trunk/Source/JavaScriptCore/bytecode/CallLinkStatus.h</a></li>
<li><a href="#trunkSourceJavaScriptCorebytecodeGetByIdStatuscpp">trunk/Source/JavaScriptCore/bytecode/GetByIdStatus.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCorebytecodeGetByIdStatush">trunk/Source/JavaScriptCore/bytecode/GetByIdStatus.h</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGByteCodeParsercpp">trunk/Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeOptionsh">trunk/Source/JavaScriptCore/runtime/Options.h</a></li>
</ul>

</div>
<div id="patch">
<h3>Diff</h3>
<a id="trunkSourceJavaScriptCoreChangeLog"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/ChangeLog (199092 => 199093)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/ChangeLog        2016-04-06 03:55:11 UTC (rev 199092)
+++ trunk/Source/JavaScriptCore/ChangeLog        2016-04-06 04:46:12 UTC (rev 199093)
</span><span class="lines">@@ -1,3 +1,59 @@
</span><ins>+2016-04-05  Filip Pizlo  &lt;fpizlo@apple.com&gt;
+
+        Improve some other cases of context-sensitive inlining
+        https://bugs.webkit.org/show_bug.cgi?id=156277
+
+        Reviewed by Benjamin Poulain.
+        
+        This implements some improvements for inlining:
+
+        - We no longer do guarded inlining when the profiling doesn't come from a stub. Doing so would have
+          been risky, and according to benchmarks, it wasn't common enough to matter. I think it's better to
+          err on the side of not inlining.
+        
+        - The jneq_ptr pattern for variadic calls no longer breaks the basic block. Not breaking the block
+          increases the chances of the parser seeing the callee constant. While inlining doesn't require a
+          callee constant, sometimes it makes a difference. Note that we were previously breaking the block
+          for no reason at all: if the boundary after jneq_ptr is a jump target from some other jump, then
+          the parser will automatically break the block for us. There is no reason to add any block breaking
+          ourselves since we implement jneq_ptr by ignoring the affirmative jump destination and inserting a
+          check and falling through.
+        
+        - get_by_id handling now tries to apply some common sense to its status object. In particular, if
+          the source is a NewObject and there was no interfering operation that could clobber the structure,
+          then we know which case of a polymorphic GetByIdStatus we would take. This arises in some
+          constructor patterns.
+        
+        Long term, we should address all of these cases comprehensively by having a late inliner. The inliner
+        being part of the bytecode parser means that there is a lot of complexity in the parser and it
+        prevents us from inlining upon learning new information from static analysis. But for now, I think
+        it's fine to experiment with one-off hacks, if only to learn what the possibilities are.
+        
+        This is a 14% speed-up on Octane/raytrace.
+
+        * bytecode/CallLinkStatus.cpp:
+        (JSC::CallLinkStatus::dump):
+        * bytecode/CallLinkStatus.h:
+        (JSC::CallLinkStatus::couldTakeSlowPath):
+        (JSC::CallLinkStatus::setCouldTakeSlowPath):
+        (JSC::CallLinkStatus::variants):
+        (JSC::CallLinkStatus::size):
+        (JSC::CallLinkStatus::at):
+        * bytecode/GetByIdStatus.cpp:
+        (JSC::GetByIdStatus::makesCalls):
+        (JSC::GetByIdStatus::filter):
+        (JSC::GetByIdStatus::dump):
+        * bytecode/GetByIdStatus.h:
+        (JSC::GetByIdStatus::wasSeenInJIT):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::handleCall):
+        (JSC::DFG::ByteCodeParser::refineStatically):
+        (JSC::DFG::ByteCodeParser::handleVarargsCall):
+        (JSC::DFG::ByteCodeParser::handleInlining):
+        (JSC::DFG::ByteCodeParser::handleGetById):
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * runtime/Options.h:
+
</ins><span class="cx"> 2016-04-05  Saam barati  &lt;sbarati@apple.com&gt;
</span><span class="cx"> 
</span><span class="cx">         JSC SamplingProfiler: Use a thread + sleep loop instead of WTF::WorkQueue for taking samples
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorebytecodeCallLinkStatuscpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/bytecode/CallLinkStatus.cpp (199092 => 199093)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/bytecode/CallLinkStatus.cpp        2016-04-06 03:55:11 UTC (rev 199092)
+++ trunk/Source/JavaScriptCore/bytecode/CallLinkStatus.cpp        2016-04-06 04:46:12 UTC (rev 199093)
</span><span class="lines">@@ -342,6 +342,9 @@
</span><span class="cx">     if (m_couldTakeSlowPath)
</span><span class="cx">         out.print(comma, &quot;Could Take Slow Path&quot;);
</span><span class="cx">     
</span><ins>+    if (m_isBasedOnStub)
+        out.print(comma, &quot;Based On Stub&quot;);
+    
</ins><span class="cx">     if (!m_variants.isEmpty())
</span><span class="cx">         out.print(comma, listDump(m_variants));
</span><span class="cx">     
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorebytecodeCallLinkStatush"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/bytecode/CallLinkStatus.h (199092 => 199093)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/bytecode/CallLinkStatus.h        2016-04-06 03:55:11 UTC (rev 199092)
+++ trunk/Source/JavaScriptCore/bytecode/CallLinkStatus.h        2016-04-06 04:46:12 UTC (rev 199093)
</span><span class="lines">@@ -101,6 +101,8 @@
</span><span class="cx">     
</span><span class="cx">     bool couldTakeSlowPath() const { return m_couldTakeSlowPath; }
</span><span class="cx">     
</span><ins>+    void setCouldTakeSlowPath(bool value) { m_couldTakeSlowPath = value; }
+    
</ins><span class="cx">     CallVariantList variants() const { return m_variants; }
</span><span class="cx">     unsigned size() const { return m_variants.size(); }
</span><span class="cx">     CallVariant at(unsigned i) const { return m_variants[i]; }
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorebytecodeGetByIdStatuscpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/bytecode/GetByIdStatus.cpp (199092 => 199093)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/bytecode/GetByIdStatus.cpp        2016-04-06 03:55:11 UTC (rev 199092)
+++ trunk/Source/JavaScriptCore/bytecode/GetByIdStatus.cpp        2016-04-06 04:46:12 UTC (rev 199093)
</span><span class="lines">@@ -350,6 +350,22 @@
</span><span class="cx">     return false;
</span><span class="cx"> }
</span><span class="cx"> 
</span><ins>+void GetByIdStatus::filter(const StructureSet&amp; set)
+{
+    if (m_state != Simple)
+        return;
+    
+    // FIXME: We could also filter the variants themselves.
+    
+    m_variants.removeAllMatching(
+        [&amp;] (GetByIdVariant&amp; variant) -&gt; bool {
+            return !variant.structureSet().overlaps(set);
+        });
+    
+    if (m_variants.isEmpty())
+        m_state = NoInformation;
+}
+
</ins><span class="cx"> void GetByIdStatus::dump(PrintStream&amp; out) const
</span><span class="cx"> {
</span><span class="cx">     out.print(&quot;(&quot;);
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorebytecodeGetByIdStatush"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/bytecode/GetByIdStatus.h (199092 => 199093)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/bytecode/GetByIdStatus.h        2016-04-06 03:55:11 UTC (rev 199092)
+++ trunk/Source/JavaScriptCore/bytecode/GetByIdStatus.h        2016-04-06 04:46:12 UTC (rev 199093)
</span><span class="lines">@@ -92,6 +92,9 @@
</span><span class="cx">     
</span><span class="cx">     bool wasSeenInJIT() const { return m_wasSeenInJIT; }
</span><span class="cx">     
</span><ins>+    // Attempts to reduce the set of variants to fit the given structure set. This may be approximate.
+    void filter(const StructureSet&amp;);
+    
</ins><span class="cx">     void dump(PrintStream&amp;) const;
</span><span class="cx">     
</span><span class="cx"> private:
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGByteCodeParsercpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp (199092 => 199093)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp        2016-04-06 03:55:11 UTC (rev 199092)
+++ trunk/Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp        2016-04-06 04:46:12 UTC (rev 199093)
</span><span class="lines">@@ -33,8 +33,10 @@
</span><span class="cx"> #include &quot;CallLinkStatus.h&quot;
</span><span class="cx"> #include &quot;CodeBlock.h&quot;
</span><span class="cx"> #include &quot;CodeBlockWithJITType.h&quot;
</span><ins>+#include &quot;DFGAbstractHeap.h&quot;
</ins><span class="cx"> #include &quot;DFGArrayMode.h&quot;
</span><span class="cx"> #include &quot;DFGCapabilities.h&quot;
</span><ins>+#include &quot;DFGClobberize.h&quot;
</ins><span class="cx"> #include &quot;DFGClobbersExitState.h&quot;
</span><span class="cx"> #include &quot;DFGGraph.h&quot;
</span><span class="cx"> #include &quot;DFGJITCode.h&quot;
</span><span class="lines">@@ -177,6 +179,7 @@
</span><span class="cx">     template&lt;typename ChecksFunctor&gt;
</span><span class="cx">     bool handleMinMax(int resultOperand, NodeType op, int registerOffset, int argumentCountIncludingThis, const ChecksFunctor&amp; insertChecks);
</span><span class="cx"> 
</span><ins>+    void refineStatically(CallLinkStatus&amp;, Node* callTarget);
</ins><span class="cx">     // Handle calls. This resolves issues surrounding inlining and intrinsics.
</span><span class="cx">     enum Terminality { Terminal, NonTerminal };
</span><span class="cx">     Terminality handleCall(
</span><span class="lines">@@ -230,8 +233,7 @@
</span><span class="cx">     Node* store(Node* base, unsigned identifier, const PutByIdVariant&amp;, Node* value);
</span><span class="cx">         
</span><span class="cx">     void handleGetById(
</span><del>-        int destinationOperand, SpeculatedType, Node* base, unsigned identifierNumber,
-        const GetByIdStatus&amp;);
</del><ins>+        int destinationOperand, SpeculatedType, Node* base, unsigned identifierNumber, GetByIdStatus);
</ins><span class="cx">     void emitPutById(
</span><span class="cx">         Node* base, unsigned identifierNumber, Node* value,  const PutByIdStatus&amp;, bool isDirect);
</span><span class="cx">     void handlePutById(
</span><span class="lines">@@ -1167,16 +1169,23 @@
</span><span class="cx">         registerOffset, callLinkStatus, getPrediction());
</span><span class="cx"> }
</span><span class="cx"> 
</span><ins>+void ByteCodeParser::refineStatically(CallLinkStatus&amp; callLinkStatus, Node* callTarget)
+{
+    if (callTarget-&gt;isCellConstant()) {
+        callLinkStatus.setProvenConstantCallee(CallVariant(callTarget-&gt;asCell()));
+        return;
+    }
+}
+
</ins><span class="cx"> ByteCodeParser::Terminality ByteCodeParser::handleCall(
</span><span class="cx">     int result, NodeType op, InlineCallFrame::Kind kind, unsigned instructionSize,
</span><span class="cx">     Node* callTarget, int argumentCountIncludingThis, int registerOffset,
</span><span class="cx">     CallLinkStatus callLinkStatus, SpeculatedType prediction)
</span><span class="cx"> {
</span><span class="cx">     ASSERT(registerOffset &lt;= 0);
</span><ins>+
+    refineStatically(callLinkStatus, callTarget);
</ins><span class="cx">     
</span><del>-    if (callTarget-&gt;isCellConstant())
-        callLinkStatus.setProvenConstantCallee(CallVariant(callTarget-&gt;asCell()));
-    
</del><span class="cx">     if (Options::verboseDFGByteCodeParsing())
</span><span class="cx">         dataLog(&quot;    Handling call at &quot;, currentCodeOrigin(), &quot;: &quot;, callLinkStatus, &quot;\n&quot;);
</span><span class="cx">     
</span><span class="lines">@@ -1227,8 +1236,7 @@
</span><span class="cx">     CallLinkStatus callLinkStatus = CallLinkStatus::computeFor(
</span><span class="cx">         m_inlineStackTop-&gt;m_profiledBlock, currentCodeOrigin(),
</span><span class="cx">         m_inlineStackTop-&gt;m_callLinkInfos, m_callContextMap);
</span><del>-    if (callTarget-&gt;isCellConstant())
-        callLinkStatus.setProvenConstantCallee(CallVariant(callTarget-&gt;asCell()));
</del><ins>+    refineStatically(callLinkStatus, callTarget);
</ins><span class="cx">     
</span><span class="cx">     if (Options::verboseDFGByteCodeParsing())
</span><span class="cx">         dataLog(&quot;    Varargs call link status at &quot;, currentCodeOrigin(), &quot;: &quot;, callLinkStatus, &quot;\n&quot;);
</span><span class="lines">@@ -1785,6 +1793,18 @@
</span><span class="cx">         return false;
</span><span class="cx">     }
</span><span class="cx">     
</span><ins>+    // If the claim is that this did not originate from a stub, then we don't want to emit a switch
+    // statement. Whenever the non-stub profiling says that it could take slow path, it really means that
+    // it has no idea.
+    if (!Options::usePolymorphicCallInliningForNonStubStatus()
+        &amp;&amp; !callLinkStatus.isBasedOnStub()) {
+        if (verbose) {
+            dataLog(&quot;Bailing inlining (non-stub polymorphism).\n&quot;);
+            dataLog(&quot;Stack: &quot;, currentCodeOrigin(), &quot;\n&quot;);
+        }
+        return false;
+    }
+    
</ins><span class="cx">     unsigned oldOffset = m_currentIndex;
</span><span class="cx">     
</span><span class="cx">     bool allAreClosureCalls = true;
</span><span class="lines">@@ -2867,8 +2887,24 @@
</span><span class="cx"> 
</span><span class="cx"> void ByteCodeParser::handleGetById(
</span><span class="cx">     int destinationOperand, SpeculatedType prediction, Node* base, unsigned identifierNumber,
</span><del>-    const GetByIdStatus&amp; getByIdStatus)
</del><ins>+    GetByIdStatus getByIdStatus)
</ins><span class="cx"> {
</span><ins>+    // Attempt to reduce the set of things in the GetByIdStatus.
+    if (base-&gt;op() == NewObject) {
+        bool ok = true;
+        for (unsigned i = m_currentBlock-&gt;size(); i--;) {
+            Node* node = m_currentBlock-&gt;at(i);
+            if (node == base)
+                break;
+            if (writesOverlap(m_graph, node, JSCell_structureID)) {
+                ok = false;
+                break;
+            }
+        }
+        if (ok)
+            getByIdStatus.filter(base-&gt;structure());
+    }
+    
</ins><span class="cx">     NodeType getById = getByIdStatus.makesCalls() ? GetByIdFlush : GetById;
</span><span class="cx">     
</span><span class="cx">     if (!getByIdStatus.isSimple() || !getByIdStatus.numVariants() || !Options::useAccessInlining()) {
</span><span class="lines">@@ -4173,8 +4209,7 @@
</span><span class="cx">                 OpInfo(m_graph.freeze(static_cast&lt;JSCell*&gt;(actualPointerFor(
</span><span class="cx">                     m_inlineStackTop-&gt;m_codeBlock, currentInstruction[2].u.specialPointer)))),
</span><span class="cx">                 get(VirtualRegister(currentInstruction[1].u.operand)));
</span><del>-            addToGraph(Jump, OpInfo(m_currentIndex + OPCODE_LENGTH(op_jneq_ptr)));
-            LAST_OPCODE(op_jneq_ptr);
</del><ins>+            NEXT_OPCODE(op_jneq_ptr);
</ins><span class="cx"> 
</span><span class="cx">         case op_resolve_scope: {
</span><span class="cx">             int dst = currentInstruction[1].u.operand;
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeOptionsh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/Options.h (199092 => 199093)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/Options.h        2016-04-06 03:55:11 UTC (rev 199092)
+++ trunk/Source/JavaScriptCore/runtime/Options.h        2016-04-06 04:46:12 UTC (rev 199093)
</span><span class="lines">@@ -195,6 +195,7 @@
</span><span class="cx">     v(bool, usePolyvariantDevirtualization, true, nullptr) \
</span><span class="cx">     v(bool, usePolymorphicAccessInlining, true, nullptr) \
</span><span class="cx">     v(bool, usePolymorphicCallInlining, true, nullptr) \
</span><ins>+    v(bool, usePolymorphicCallInliningForNonStubStatus, false, nullptr) \
</ins><span class="cx">     v(unsigned, maxPolymorphicCallVariantListSize, 15, nullptr) \
</span><span class="cx">     v(unsigned, maxPolymorphicCallVariantListSizeForTopTier, 5, nullptr) \
</span><span class="cx">     v(unsigned, maxPolymorphicCallVariantsForInlining, 5, nullptr) \
</span></span></pre>
</div>
</div>

</body>
</html>