<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN"
"http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head><meta http-equiv="content-type" content="text/html; charset=utf-8" />
<title>[199170] trunk/Source/JavaScriptCore</title>
</head>
<body>

<style type="text/css"><!--
#msg dl.meta { border: 1px #006 solid; background: #369; padding: 6px; color: #fff; }
#msg dl.meta dt { float: left; width: 6em; font-weight: bold; }
#msg dt:after { content:':';}
#msg dl, #msg dt, #msg ul, #msg li, #header, #footer, #logmsg { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt;  }
#msg dl a { font-weight: bold}
#msg dl a:link    { color:#fc3; }
#msg dl a:active  { color:#ff0; }
#msg dl a:visited { color:#cc6; }
h3 { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; font-weight: bold; }
#msg pre { overflow: auto; background: #ffc; border: 1px #fa0 solid; padding: 6px; }
#logmsg { background: #ffc; border: 1px #fa0 solid; padding: 1em 1em 0 1em; }
#logmsg p, #logmsg pre, #logmsg blockquote { margin: 0 0 1em 0; }
#logmsg p, #logmsg li, #logmsg dt, #logmsg dd { line-height: 14pt; }
#logmsg h1, #logmsg h2, #logmsg h3, #logmsg h4, #logmsg h5, #logmsg h6 { margin: .5em 0; }
#logmsg h1:first-child, #logmsg h2:first-child, #logmsg h3:first-child, #logmsg h4:first-child, #logmsg h5:first-child, #logmsg h6:first-child { margin-top: 0; }
#logmsg ul, #logmsg ol { padding: 0; list-style-position: inside; margin: 0 0 0 1em; }
#logmsg ul { text-indent: -1em; padding-left: 1em; }#logmsg ol { text-indent: -1.5em; padding-left: 1.5em; }
#logmsg > ul, #logmsg > ol { margin: 0 0 1em 0; }
#logmsg pre { background: #eee; padding: 1em; }
#logmsg blockquote { border: 1px solid #fa0; border-left-width: 10px; padding: 1em 1em 0 1em; background: white;}
#logmsg dl { margin: 0; }
#logmsg dt { font-weight: bold; }
#logmsg dd { margin: 0; padding: 0 0 0.5em 0; }
#logmsg dd:before { content:'\00bb';}
#logmsg table { border-spacing: 0px; border-collapse: collapse; border-top: 4px solid #fa0; border-bottom: 1px solid #fa0; background: #fff; }
#logmsg table th { text-align: left; font-weight: normal; padding: 0.2em 0.5em; border-top: 1px dotted #fa0; }
#logmsg table td { text-align: right; border-top: 1px dotted #fa0; padding: 0.2em 0.5em; }
#logmsg table thead th { text-align: center; border-bottom: 1px solid #fa0; }
#logmsg table th.Corner { text-align: left; }
#logmsg hr { border: none 0; border-top: 2px dashed #fa0; height: 1px; }
#header, #footer { color: #fff; background: #636; border: 1px #300 solid; padding: 6px; }
#patch { width: 100%; }
#patch h4 {font-family: verdana,arial,helvetica,sans-serif;font-size:10pt;padding:8px;background:#369;color:#fff;margin:0;}
#patch .propset h4, #patch .binary h4 {margin:0;}
#patch pre {padding:0;line-height:1.2em;margin:0;}
#patch .diff {width:100%;background:#eee;padding: 0 0 10px 0;overflow:auto;}
#patch .propset .diff, #patch .binary .diff  {padding:10px 0;}
#patch span {display:block;padding:0 10px;}
#patch .modfile, #patch .addfile, #patch .delfile, #patch .propset, #patch .binary, #patch .copfile {border:1px solid #ccc;margin:10px 0;}
#patch ins {background:#dfd;text-decoration:none;display:block;padding:0 10px;}
#patch del {background:#fdd;text-decoration:none;display:block;padding:0 10px;}
#patch .lines, .info {color:#888;background:#fff;}
--></style>
<div id="msg">
<dl class="meta">
<dt>Revision</dt> <dd><a href="http://trac.webkit.org/projects/webkit/changeset/199170">199170</a></dd>
<dt>Author</dt> <dd>keith_miller@apple.com</dd>
<dt>Date</dt> <dd>2016-04-07 12:38:00 -0700 (Thu, 07 Apr 2016)</dd>
</dl>

<h3>Log Message</h3>
<pre>We should support the ability to do a non-effectful getById
https://bugs.webkit.org/show_bug.cgi?id=156116

Reviewed by Benjamin Poulain.

Currently, there is no way in JS to do a non-effectful getById. A non-effectful getById is
useful because it enables us to take different code paths based on values that we would
otherwise not be able to have knowledge of. This patch adds this new feature called
try_get_by_id that will attempt to do as much of a get_by_id as possible without performing
an effectful behavior. Thus, try_get_by_id will return the value if the slot is a value, the
GetterSetter object if the slot is a normal accessor (not a CustomGetterSetter) and
undefined if the slot is unset.  If the slot is proxied or any other cases then the result
is null. In theory, if we ever wanted to check for null we could add a sentinal object to
the global object that indicates we could not get the result.

In order to implement this feature we add a new enum GetByIdKind that indicates what to do
for accessor properties in PolymorphicAccess. If the GetByIdKind is pure then we treat the
get_by_id the same way we would for load and return the value at the appropriate offset.
Additionally, in order to make sure the we can properly compare the GetterSetter object
with === GetterSetters are now JSObjects. This comes at the cost of eight extra bytes on the
GetterSetter object but it vastly simplifies the patch. Additionally, the extra bytes are
likely to have little to no impact on memory usage as normal accessors are generally rare.

* JavaScriptCore.xcodeproj/project.pbxproj:
* builtins/BuiltinExecutableCreator.cpp: Added.
(JSC::createBuiltinExecutable):
* builtins/BuiltinExecutableCreator.h: Copied from Source/JavaScriptCore/builtins/BuiltinExecutables.h.
* builtins/BuiltinExecutables.cpp:
(JSC::BuiltinExecutables::createDefaultConstructor):
(JSC::BuiltinExecutables::createBuiltinExecutable):
(JSC::createBuiltinExecutable):
(JSC::BuiltinExecutables::createExecutable):
(JSC::createExecutableInternal): Deleted.
* builtins/BuiltinExecutables.h:
* bytecode/BytecodeIntrinsicRegistry.h:
* bytecode/BytecodeList.json:
* bytecode/BytecodeUseDef.h:
(JSC::computeUsesForBytecodeOffset):
(JSC::computeDefsForBytecodeOffset):
* bytecode/CodeBlock.cpp:
(JSC::CodeBlock::dumpBytecode):
* bytecode/PolymorphicAccess.cpp:
(JSC::AccessCase::tryGet):
(JSC::AccessCase::generate):
(WTF::printInternal):
* bytecode/PolymorphicAccess.h:
(JSC::AccessCase::isGet): Deleted.
(JSC::AccessCase::isPut): Deleted.
(JSC::AccessCase::isIn): Deleted.
* bytecode/StructureStubInfo.cpp:
(JSC::StructureStubInfo::reset):
* bytecode/StructureStubInfo.h:
* bytecompiler/BytecodeGenerator.cpp:
(JSC::BytecodeGenerator::emitTryGetById):
* bytecompiler/BytecodeGenerator.h:
* bytecompiler/NodesCodegen.cpp:
(JSC::BytecodeIntrinsicNode::emit_intrinsic_tryGetById):
* dfg/DFGSpeculativeJIT32_64.cpp:
(JSC::DFG::SpeculativeJIT::cachedGetById):
* dfg/DFGSpeculativeJIT64.cpp:
(JSC::DFG::SpeculativeJIT::cachedGetById):
* ftl/FTLLowerDFGToB3.cpp:
(JSC::FTL::DFG::LowerDFGToB3::getById):
* jit/JIT.cpp:
(JSC::JIT::privateCompileMainPass):
(JSC::JIT::privateCompileSlowCases):
* jit/JIT.h:
* jit/JITInlineCacheGenerator.cpp:
(JSC::JITGetByIdGenerator::JITGetByIdGenerator):
* jit/JITInlineCacheGenerator.h:
* jit/JITInlines.h:
(JSC::JIT::callOperation):
* jit/JITOperations.cpp:
* jit/JITOperations.h:
* jit/JITPropertyAccess.cpp:
(JSC::JIT::emitGetByValWithCachedId):
(JSC::JIT::emit_op_try_get_by_id):
(JSC::JIT::emitSlow_op_try_get_by_id):
(JSC::JIT::emit_op_get_by_id):
* jit/JITPropertyAccess32_64.cpp:
(JSC::JIT::emitGetByValWithCachedId):
(JSC::JIT::emit_op_try_get_by_id):
(JSC::JIT::emitSlow_op_try_get_by_id):
(JSC::JIT::emit_op_get_by_id):
* jit/Repatch.cpp:
(JSC::repatchByIdSelfAccess):
(JSC::appropriateOptimizingGetByIdFunction):
(JSC::appropriateGenericGetByIdFunction):
(JSC::tryCacheGetByID):
(JSC::repatchGetByID):
(JSC::resetGetByID):
* jit/Repatch.h:
* jsc.cpp:
(GlobalObject::finishCreation):
(functionGetGetterSetter):
(functionCreateBuiltin):
* llint/LLIntData.cpp:
(JSC::LLInt::Data::performAssertions):
* llint/LLIntSlowPaths.cpp:
(JSC::LLInt::LLINT_SLOW_PATH_DECL):
* llint/LLIntSlowPaths.h:
* llint/LowLevelInterpreter.asm:
* runtime/GetterSetter.cpp:
* runtime/GetterSetter.h:
* runtime/JSType.h:
* runtime/PropertySlot.cpp:
(JSC::PropertySlot::getPureResult):
* runtime/PropertySlot.h:
* runtime/ProxyObject.cpp:
(JSC::ProxyObject::getOwnPropertySlotCommon):
* tests/stress/try-get-by-id.js: Added.
(tryGetByIdText):
(getCaller.obj.1.throw.new.Error.let.func):
(getCaller.obj.1.throw.new.Error):
(throw.new.Error.get let):
(throw.new.Error.):
(throw.new.Error.let.get createBuiltin):
(get let):
(let.get createBuiltin):
(let.func):
(get let.func):
(get throw):</pre>

<h3>Modified Paths</h3>
<ul>
<li><a href="#trunkSourceJavaScriptCoreChangeLog">trunk/Source/JavaScriptCore/ChangeLog</a></li>
<li><a href="#trunkSourceJavaScriptCoreJavaScriptCorexcodeprojprojectpbxproj">trunk/Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj</a></li>
<li><a href="#trunkSourceJavaScriptCorebuiltinsBuiltinExecutablescpp">trunk/Source/JavaScriptCore/builtins/BuiltinExecutables.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCorebuiltinsBuiltinExecutablesh">trunk/Source/JavaScriptCore/builtins/BuiltinExecutables.h</a></li>
<li><a href="#trunkSourceJavaScriptCorebytecodeBytecodeIntrinsicRegistryh">trunk/Source/JavaScriptCore/bytecode/BytecodeIntrinsicRegistry.h</a></li>
<li><a href="#trunkSourceJavaScriptCorebytecodeBytecodeListjson">trunk/Source/JavaScriptCore/bytecode/BytecodeList.json</a></li>
<li><a href="#trunkSourceJavaScriptCorebytecodeBytecodeUseDefh">trunk/Source/JavaScriptCore/bytecode/BytecodeUseDef.h</a></li>
<li><a href="#trunkSourceJavaScriptCorebytecodeCodeBlockcpp">trunk/Source/JavaScriptCore/bytecode/CodeBlock.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCorebytecodePolymorphicAccesscpp">trunk/Source/JavaScriptCore/bytecode/PolymorphicAccess.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCorebytecodePolymorphicAccessh">trunk/Source/JavaScriptCore/bytecode/PolymorphicAccess.h</a></li>
<li><a href="#trunkSourceJavaScriptCorebytecodeStructureStubInfocpp">trunk/Source/JavaScriptCore/bytecode/StructureStubInfo.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCorebytecodeStructureStubInfoh">trunk/Source/JavaScriptCore/bytecode/StructureStubInfo.h</a></li>
<li><a href="#trunkSourceJavaScriptCorebytecompilerBytecodeGeneratorcpp">trunk/Source/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCorebytecompilerBytecodeGeneratorh">trunk/Source/JavaScriptCore/bytecompiler/BytecodeGenerator.h</a></li>
<li><a href="#trunkSourceJavaScriptCorebytecompilerNodesCodegencpp">trunk/Source/JavaScriptCore/bytecompiler/NodesCodegen.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGSpeculativeJIT32_64cpp">trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGSpeculativeJIT64cpp">trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreftlFTLLowerDFGToB3cpp">trunk/Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCorejitJITcpp">trunk/Source/JavaScriptCore/jit/JIT.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCorejitJITh">trunk/Source/JavaScriptCore/jit/JIT.h</a></li>
<li><a href="#trunkSourceJavaScriptCorejitJITInlineCacheGeneratorcpp">trunk/Source/JavaScriptCore/jit/JITInlineCacheGenerator.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCorejitJITInlineCacheGeneratorh">trunk/Source/JavaScriptCore/jit/JITInlineCacheGenerator.h</a></li>
<li><a href="#trunkSourceJavaScriptCorejitJITInlinesh">trunk/Source/JavaScriptCore/jit/JITInlines.h</a></li>
<li><a href="#trunkSourceJavaScriptCorejitJITOperationscpp">trunk/Source/JavaScriptCore/jit/JITOperations.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCorejitJITOperationsh">trunk/Source/JavaScriptCore/jit/JITOperations.h</a></li>
<li><a href="#trunkSourceJavaScriptCorejitJITPropertyAccesscpp">trunk/Source/JavaScriptCore/jit/JITPropertyAccess.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCorejitJITPropertyAccess32_64cpp">trunk/Source/JavaScriptCore/jit/JITPropertyAccess32_64.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCorejitRepatchcpp">trunk/Source/JavaScriptCore/jit/Repatch.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCorejitRepatchh">trunk/Source/JavaScriptCore/jit/Repatch.h</a></li>
<li><a href="#trunkSourceJavaScriptCorejsccpp">trunk/Source/JavaScriptCore/jsc.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCorellintLLIntDatacpp">trunk/Source/JavaScriptCore/llint/LLIntData.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCorellintLLIntSlowPathscpp">trunk/Source/JavaScriptCore/llint/LLIntSlowPaths.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCorellintLLIntSlowPathsh">trunk/Source/JavaScriptCore/llint/LLIntSlowPaths.h</a></li>
<li><a href="#trunkSourceJavaScriptCorellintLowLevelInterpreterasm">trunk/Source/JavaScriptCore/llint/LowLevelInterpreter.asm</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeGetterSettercpp">trunk/Source/JavaScriptCore/runtime/GetterSetter.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeGetterSetterh">trunk/Source/JavaScriptCore/runtime/GetterSetter.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeJSTypeh">trunk/Source/JavaScriptCore/runtime/JSType.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimePropertySlotcpp">trunk/Source/JavaScriptCore/runtime/PropertySlot.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimePropertySloth">trunk/Source/JavaScriptCore/runtime/PropertySlot.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeProxyObjectcpp">trunk/Source/JavaScriptCore/runtime/ProxyObject.cpp</a></li>
</ul>

<h3>Added Paths</h3>
<ul>
<li><a href="#trunkSourceJavaScriptCorebuiltinsBuiltinExecutableCreatorcpp">trunk/Source/JavaScriptCore/builtins/BuiltinExecutableCreator.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCorebuiltinsBuiltinExecutableCreatorh">trunk/Source/JavaScriptCore/builtins/BuiltinExecutableCreator.h</a></li>
<li><a href="#trunkSourceJavaScriptCoretestsstresstrygetbyidjs">trunk/Source/JavaScriptCore/tests/stress/try-get-by-id.js</a></li>
</ul>

</div>
<div id="patch">
<h3>Diff</h3>
<a id="trunkSourceJavaScriptCoreChangeLog"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/ChangeLog (199169 => 199170)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/ChangeLog        2016-04-07 19:29:38 UTC (rev 199169)
+++ trunk/Source/JavaScriptCore/ChangeLog        2016-04-07 19:38:00 UTC (rev 199170)
</span><span class="lines">@@ -1,3 +1,128 @@
</span><ins>+2016-04-07  Keith Miller  &lt;keith_miller@apple.com&gt;
+
+        We should support the ability to do a non-effectful getById
+        https://bugs.webkit.org/show_bug.cgi?id=156116
+
+        Reviewed by Benjamin Poulain.
+
+        Currently, there is no way in JS to do a non-effectful getById. A non-effectful getById is
+        useful because it enables us to take different code paths based on values that we would
+        otherwise not be able to have knowledge of. This patch adds this new feature called
+        try_get_by_id that will attempt to do as much of a get_by_id as possible without performing
+        an effectful behavior. Thus, try_get_by_id will return the value if the slot is a value, the
+        GetterSetter object if the slot is a normal accessor (not a CustomGetterSetter) and
+        undefined if the slot is unset.  If the slot is proxied or any other cases then the result
+        is null. In theory, if we ever wanted to check for null we could add a sentinal object to
+        the global object that indicates we could not get the result.
+
+        In order to implement this feature we add a new enum GetByIdKind that indicates what to do
+        for accessor properties in PolymorphicAccess. If the GetByIdKind is pure then we treat the
+        get_by_id the same way we would for load and return the value at the appropriate offset.
+        Additionally, in order to make sure the we can properly compare the GetterSetter object
+        with === GetterSetters are now JSObjects. This comes at the cost of eight extra bytes on the
+        GetterSetter object but it vastly simplifies the patch. Additionally, the extra bytes are
+        likely to have little to no impact on memory usage as normal accessors are generally rare.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * builtins/BuiltinExecutableCreator.cpp: Added.
+        (JSC::createBuiltinExecutable):
+        * builtins/BuiltinExecutableCreator.h: Copied from Source/JavaScriptCore/builtins/BuiltinExecutables.h.
+        * builtins/BuiltinExecutables.cpp:
+        (JSC::BuiltinExecutables::createDefaultConstructor):
+        (JSC::BuiltinExecutables::createBuiltinExecutable):
+        (JSC::createBuiltinExecutable):
+        (JSC::BuiltinExecutables::createExecutable):
+        (JSC::createExecutableInternal): Deleted.
+        * builtins/BuiltinExecutables.h:
+        * bytecode/BytecodeIntrinsicRegistry.h:
+        * bytecode/BytecodeList.json:
+        * bytecode/BytecodeUseDef.h:
+        (JSC::computeUsesForBytecodeOffset):
+        (JSC::computeDefsForBytecodeOffset):
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dumpBytecode):
+        * bytecode/PolymorphicAccess.cpp:
+        (JSC::AccessCase::tryGet):
+        (JSC::AccessCase::generate):
+        (WTF::printInternal):
+        * bytecode/PolymorphicAccess.h:
+        (JSC::AccessCase::isGet): Deleted.
+        (JSC::AccessCase::isPut): Deleted.
+        (JSC::AccessCase::isIn): Deleted.
+        * bytecode/StructureStubInfo.cpp:
+        (JSC::StructureStubInfo::reset):
+        * bytecode/StructureStubInfo.h:
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitTryGetById):
+        * bytecompiler/BytecodeGenerator.h:
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::BytecodeIntrinsicNode::emit_intrinsic_tryGetById):
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::cachedGetById):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::cachedGetById):
+        * ftl/FTLLowerDFGToB3.cpp:
+        (JSC::FTL::DFG::LowerDFGToB3::getById):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        (JSC::JIT::privateCompileSlowCases):
+        * jit/JIT.h:
+        * jit/JITInlineCacheGenerator.cpp:
+        (JSC::JITGetByIdGenerator::JITGetByIdGenerator):
+        * jit/JITInlineCacheGenerator.h:
+        * jit/JITInlines.h:
+        (JSC::JIT::callOperation):
+        * jit/JITOperations.cpp:
+        * jit/JITOperations.h:
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::emitGetByValWithCachedId):
+        (JSC::JIT::emit_op_try_get_by_id):
+        (JSC::JIT::emitSlow_op_try_get_by_id):
+        (JSC::JIT::emit_op_get_by_id):
+        * jit/JITPropertyAccess32_64.cpp:
+        (JSC::JIT::emitGetByValWithCachedId):
+        (JSC::JIT::emit_op_try_get_by_id):
+        (JSC::JIT::emitSlow_op_try_get_by_id):
+        (JSC::JIT::emit_op_get_by_id):
+        * jit/Repatch.cpp:
+        (JSC::repatchByIdSelfAccess):
+        (JSC::appropriateOptimizingGetByIdFunction):
+        (JSC::appropriateGenericGetByIdFunction):
+        (JSC::tryCacheGetByID):
+        (JSC::repatchGetByID):
+        (JSC::resetGetByID):
+        * jit/Repatch.h:
+        * jsc.cpp:
+        (GlobalObject::finishCreation):
+        (functionGetGetterSetter):
+        (functionCreateBuiltin):
+        * llint/LLIntData.cpp:
+        (JSC::LLInt::Data::performAssertions):
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
+        * llint/LLIntSlowPaths.h:
+        * llint/LowLevelInterpreter.asm:
+        * runtime/GetterSetter.cpp:
+        * runtime/GetterSetter.h:
+        * runtime/JSType.h:
+        * runtime/PropertySlot.cpp:
+        (JSC::PropertySlot::getPureResult):
+        * runtime/PropertySlot.h:
+        * runtime/ProxyObject.cpp:
+        (JSC::ProxyObject::getOwnPropertySlotCommon):
+        * tests/stress/try-get-by-id.js: Added.
+        (tryGetByIdText):
+        (getCaller.obj.1.throw.new.Error.let.func):
+        (getCaller.obj.1.throw.new.Error):
+        (throw.new.Error.get let):
+        (throw.new.Error.):
+        (throw.new.Error.let.get createBuiltin):
+        (get let):
+        (let.get createBuiltin):
+        (let.func):
+        (get let.func):
+        (get throw):
+
</ins><span class="cx"> 2016-04-07  Filip Pizlo  &lt;fpizlo@apple.com&gt;
</span><span class="cx"> 
</span><span class="cx">         Rationalize the makeSpaceForCCall stuff
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreJavaScriptCorexcodeprojprojectpbxproj"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj (199169 => 199170)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj        2016-04-07 19:29:38 UTC (rev 199169)
+++ trunk/Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj        2016-04-07 19:38:00 UTC (rev 199170)
</span><span class="lines">@@ -1995,6 +1995,8 @@
</span><span class="cx">                 DC17E8181C9C91D9008A6AB3 /* ShadowChicken.h in Headers */ = {isa = PBXBuildFile; fileRef = DC17E8141C9C7FD4008A6AB3 /* ShadowChicken.h */; };
</span><span class="cx">                 DC17E8191C9C91DB008A6AB3 /* ShadowChickenInlines.h in Headers */ = {isa = PBXBuildFile; fileRef = DC17E8151C9C7FD4008A6AB3 /* ShadowChickenInlines.h */; };
</span><span class="cx">                 DC17E81A1C9C91E9008A6AB3 /* CCallHelpers.cpp in Sources */ = {isa = PBXBuildFile; fileRef = DC17E8161C9C802B008A6AB3 /* CCallHelpers.cpp */; };
</span><ins>+                DE26E9031CB5DD0500D2BE82 /* BuiltinExecutableCreator.h in Headers */ = {isa = PBXBuildFile; fileRef = DE26E9021CB5DD0500D2BE82 /* BuiltinExecutableCreator.h */; };
+                DE26E9071CB5DEFB00D2BE82 /* BuiltinExecutableCreator.cpp in Sources */ = {isa = PBXBuildFile; fileRef = DE26E9061CB5DD9600D2BE82 /* BuiltinExecutableCreator.cpp */; };
</ins><span class="cx">                 DE5A0A001BA3AC3E003D4424 /* IntrinsicEmitter.cpp in Sources */ = {isa = PBXBuildFile; fileRef = DE5A09FF1BA3AC3E003D4424 /* IntrinsicEmitter.cpp */; };
</span><span class="cx">                 DEA7E2441BBC677200D78440 /* JSTypedArrayViewPrototype.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 53F256E11B87E28000B4B768 /* JSTypedArrayViewPrototype.cpp */; };
</span><span class="cx">                 DEA7E2451BBC677F00D78440 /* JSTypedArrayViewPrototype.h in Headers */ = {isa = PBXBuildFile; fileRef = 53917E7C1B791106000EBD33 /* JSTypedArrayViewPrototype.h */; settings = {ATTRIBUTES = (Private, ); }; };
</span><span class="lines">@@ -4204,6 +4206,8 @@
</span><span class="cx">                 DC17E8141C9C7FD4008A6AB3 /* ShadowChicken.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ShadowChicken.h; sourceTree = &quot;&lt;group&gt;&quot;; };
</span><span class="cx">                 DC17E8151C9C7FD4008A6AB3 /* ShadowChickenInlines.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ShadowChickenInlines.h; sourceTree = &quot;&lt;group&gt;&quot;; };
</span><span class="cx">                 DC17E8161C9C802B008A6AB3 /* CCallHelpers.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = CCallHelpers.cpp; sourceTree = &quot;&lt;group&gt;&quot;; };
</span><ins>+                DE26E9021CB5DD0500D2BE82 /* BuiltinExecutableCreator.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = BuiltinExecutableCreator.h; sourceTree = &quot;&lt;group&gt;&quot;; };
+                DE26E9061CB5DD9600D2BE82 /* BuiltinExecutableCreator.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = BuiltinExecutableCreator.cpp; sourceTree = &quot;&lt;group&gt;&quot;; };
</ins><span class="cx">                 DE5A09FF1BA3AC3E003D4424 /* IntrinsicEmitter.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = IntrinsicEmitter.cpp; sourceTree = &quot;&lt;group&gt;&quot;; };
</span><span class="cx">                 E124A8F50E555775003091F1 /* OpaqueJSString.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = OpaqueJSString.h; sourceTree = &quot;&lt;group&gt;&quot;; };
</span><span class="cx">                 E124A8F60E555775003091F1 /* OpaqueJSString.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = OpaqueJSString.cpp; sourceTree = &quot;&lt;group&gt;&quot;; };
</span><span class="lines">@@ -6838,6 +6842,8 @@
</span><span class="cx">                                 A7D801A01880D66E0026C39B /* ArrayPrototype.js */,
</span><span class="cx">                                 7CF9BC581B65D9A3009DB1EF /* ArrayConstructor.js */,
</span><span class="cx">                                 7CF9BC591B65D9A3009DB1EF /* ArrayIteratorPrototype.js */,
</span><ins>+                                DE26E9061CB5DD9600D2BE82 /* BuiltinExecutableCreator.cpp */,
+                                DE26E9021CB5DD0500D2BE82 /* BuiltinExecutableCreator.h */,
</ins><span class="cx">                                 A7D801A11880D66E0026C39B /* BuiltinExecutables.cpp */,
</span><span class="cx">                                 A7D801A21880D66E0026C39B /* BuiltinExecutables.h */,
</span><span class="cx">                                 A75EE9B018AAB7E200AAD043 /* BuiltinNames.h */,
</span><span class="lines">@@ -7383,6 +7389,7 @@
</span><span class="cx">                                 14142E531B796EDD00F4BF4B /* ExecutableInfo.h in Headers */,
</span><span class="cx">                                 0F56A1D315000F35002992B1 /* ExecutionCounter.h in Headers */,
</span><span class="cx">                                 0F3AC754188E5EC80032029F /* ExitingJITType.h in Headers */,
</span><ins>+                                DE26E9031CB5DD0500D2BE82 /* BuiltinExecutableCreator.h in Headers */,
</ins><span class="cx">                                 0FB105861675481200F8AB6E /* ExitKind.h in Headers */,
</span><span class="cx">                                 0F0B83AB14BCF5BB00885B4F /* ExpressionRangeInfo.h in Headers */,
</span><span class="cx">                                 0F4DE1CF1C4C1B54004D6C11 /* AirFixObviousSpills.h in Headers */,
</span><span class="lines">@@ -8777,6 +8784,7 @@
</span><span class="cx">                                 0FEA0A31170D40BF00BB722C /* DFGCommonData.cpp in Sources */,
</span><span class="cx">                                 0F38B01717CFE75500B144D3 /* DFGCompilationKey.cpp in Sources */,
</span><span class="cx">                                 0F38B01917CFE75500B144D3 /* DFGCompilationMode.cpp in Sources */,
</span><ins>+                                DE26E9071CB5DEFB00D2BE82 /* BuiltinExecutableCreator.cpp in Sources */,
</ins><span class="cx">                                 0F3B3A1A153E68F2003ED0FF /* DFGConstantFoldingPhase.cpp in Sources */,
</span><span class="cx">                                 0FED67B91B26256D0066CE15 /* DFGConstantHoistingPhase.cpp in Sources */,
</span><span class="cx">                                 0FBE0F7216C1DB030082C5E8 /* DFGCPSRethreadingPhase.cpp in Sources */,
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorebuiltinsBuiltinExecutableCreatorcppfromrev199169trunkSourceJavaScriptCorebuiltinsBuiltinExecutablesh"></a>
<div class="copfile"><h4>Copied: trunk/Source/JavaScriptCore/builtins/BuiltinExecutableCreator.cpp (from rev 199169, trunk/Source/JavaScriptCore/builtins/BuiltinExecutables.h) (0 => 199170)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/builtins/BuiltinExecutableCreator.cpp                                (rev 0)
+++ trunk/Source/JavaScriptCore/builtins/BuiltinExecutableCreator.cpp        2016-04-07 19:38:00 UTC (rev 199170)
</span><span class="lines">@@ -0,0 +1,38 @@
</span><ins>+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include &quot;config.h&quot;
+#include &quot;BuiltinExecutableCreator.h&quot;
+
+#include &quot;BuiltinExecutables.h&quot;
+
+namespace JSC {
+
+UnlinkedFunctionExecutable* createBuiltinExecutable(VM&amp; vm, const SourceCode&amp; source, const Identifier&amp; ident, ConstructorKind kind, ConstructAbility ability)
+{
+    return BuiltinExecutables::createExecutable(vm, source, ident, kind, ability);
+}
+    
+} // namespace JSC
</ins></span></pre></div>
<a id="trunkSourceJavaScriptCorebuiltinsBuiltinExecutableCreatorhfromrev199169trunkSourceJavaScriptCorebuiltinsBuiltinExecutablesh"></a>
<div class="copfile"><h4>Copied: trunk/Source/JavaScriptCore/builtins/BuiltinExecutableCreator.h (from rev 199169, trunk/Source/JavaScriptCore/builtins/BuiltinExecutables.h) (0 => 199170)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/builtins/BuiltinExecutableCreator.h                                (rev 0)
+++ trunk/Source/JavaScriptCore/builtins/BuiltinExecutableCreator.h        2016-04-07 19:38:00 UTC (rev 199170)
</span><span class="lines">@@ -0,0 +1,39 @@
</span><ins>+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef BuiltinExecutableCreator_h
+#define BuiltinExecutableCreator_h
+
+#include &quot;ConstructAbility.h&quot;
+#include &quot;ParserModes.h&quot;
+#include &quot;SourceCode.h&quot;
+
+namespace JSC {
+
+JS_EXPORT_PRIVATE UnlinkedFunctionExecutable* createBuiltinExecutable(VM&amp;, const SourceCode&amp;, const Identifier&amp;, ConstructorKind, ConstructAbility);
+
+} // namespace JSC
+
+#endif /* BuiltinExecutableCreator_h */
</ins></span></pre></div>
<a id="trunkSourceJavaScriptCorebuiltinsBuiltinExecutablescpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/builtins/BuiltinExecutables.cpp (199169 => 199170)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/builtins/BuiltinExecutables.cpp        2016-04-07 19:29:38 UTC (rev 199169)
+++ trunk/Source/JavaScriptCore/builtins/BuiltinExecutables.cpp        2016-04-07 19:38:00 UTC (rev 199170)
</span><span class="lines">@@ -35,8 +35,6 @@
</span><span class="cx"> 
</span><span class="cx"> namespace JSC {
</span><span class="cx"> 
</span><del>-static UnlinkedFunctionExecutable* createExecutableInternal(VM&amp;, const SourceCode&amp;, const Identifier&amp;, ConstructorKind, ConstructAbility);
-
</del><span class="cx"> BuiltinExecutables::BuiltinExecutables(VM&amp; vm)
</span><span class="cx">     : m_vm(vm)
</span><span class="cx"> #define INITIALIZE_BUILTIN_SOURCE_MEMBERS(name, functionName, length) , m_##name##Source(makeSource(StringImpl::createFromLiteral(s_##name, length)))
</span><span class="lines">@@ -54,9 +52,9 @@
</span><span class="cx">     case ConstructorKind::None:
</span><span class="cx">         break;
</span><span class="cx">     case ConstructorKind::Base:
</span><del>-        return createExecutableInternal(m_vm, makeSource(baseConstructorCode), name, constructorKind, ConstructAbility::CanConstruct);
</del><ins>+        return createExecutable(m_vm, makeSource(baseConstructorCode), name, constructorKind, ConstructAbility::CanConstruct);
</ins><span class="cx">     case ConstructorKind::Derived:
</span><del>-        return createExecutableInternal(m_vm, makeSource(derivedConstructorCode), name, constructorKind, ConstructAbility::CanConstruct);
</del><ins>+        return createExecutable(m_vm, makeSource(derivedConstructorCode), name, constructorKind, ConstructAbility::CanConstruct);
</ins><span class="cx">     }
</span><span class="cx">     ASSERT_NOT_REACHED();
</span><span class="cx">     return nullptr;
</span><span class="lines">@@ -64,15 +62,15 @@
</span><span class="cx"> 
</span><span class="cx"> UnlinkedFunctionExecutable* BuiltinExecutables::createBuiltinExecutable(const SourceCode&amp; code, const Identifier&amp; name, ConstructAbility constructAbility)
</span><span class="cx"> {
</span><del>-    return createExecutableInternal(m_vm, code, name, ConstructorKind::None, constructAbility);
</del><ins>+    return createExecutable(m_vm, code, name, ConstructorKind::None, constructAbility);
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> UnlinkedFunctionExecutable* createBuiltinExecutable(VM&amp; vm, const SourceCode&amp; code, const Identifier&amp; name, ConstructAbility constructAbility)
</span><span class="cx"> {
</span><del>-    return createExecutableInternal(vm, code, name, ConstructorKind::None, constructAbility);
</del><ins>+    return BuiltinExecutables::createExecutable(vm, code, name, ConstructorKind::None, constructAbility);
</ins><span class="cx"> }
</span><span class="cx"> 
</span><del>-UnlinkedFunctionExecutable* createExecutableInternal(VM&amp; vm, const SourceCode&amp; source, const Identifier&amp; name, ConstructorKind constructorKind, ConstructAbility constructAbility)
</del><ins>+UnlinkedFunctionExecutable* BuiltinExecutables::createExecutable(VM&amp; vm, const SourceCode&amp; source, const Identifier&amp; name, ConstructorKind constructorKind, ConstructAbility constructAbility)
</ins><span class="cx"> {
</span><span class="cx">     JSTextPosition positionBeforeLastNewline;
</span><span class="cx">     ParserError error;
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorebuiltinsBuiltinExecutablesh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/builtins/BuiltinExecutables.h (199169 => 199170)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/builtins/BuiltinExecutables.h        2016-04-07 19:29:38 UTC (rev 199169)
+++ trunk/Source/JavaScriptCore/builtins/BuiltinExecutables.h        2016-04-07 19:38:00 UTC (rev 199170)
</span><span class="lines">@@ -52,6 +52,7 @@
</span><span class="cx"> 
</span><span class="cx">     UnlinkedFunctionExecutable* createDefaultConstructor(ConstructorKind, const Identifier&amp; name);
</span><span class="cx"> 
</span><ins>+    static UnlinkedFunctionExecutable* createExecutable(VM&amp;, const SourceCode&amp;, const Identifier&amp;, ConstructorKind, ConstructAbility);
</ins><span class="cx"> private:
</span><span class="cx">     void finalize(Handle&lt;Unknown&gt;, void* context) override;
</span><span class="cx"> 
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorebytecodeBytecodeIntrinsicRegistryh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/bytecode/BytecodeIntrinsicRegistry.h (199169 => 199170)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/bytecode/BytecodeIntrinsicRegistry.h        2016-04-07 19:29:38 UTC (rev 199169)
+++ trunk/Source/JavaScriptCore/bytecode/BytecodeIntrinsicRegistry.h        2016-04-07 19:38:00 UTC (rev 199170)
</span><span class="lines">@@ -41,6 +41,7 @@
</span><span class="cx"> #define JSC_COMMON_BYTECODE_INTRINSIC_FUNCTIONS_EACH_NAME(macro) \
</span><span class="cx">     macro(assert) \
</span><span class="cx">     macro(isObject) \
</span><ins>+    macro(tryGetById) \
</ins><span class="cx">     macro(putByValDirect) \
</span><span class="cx">     macro(toString)
</span><span class="cx"> 
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorebytecodeBytecodeListjson"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/bytecode/BytecodeList.json (199169 => 199170)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/bytecode/BytecodeList.json        2016-04-07 19:29:38 UTC (rev 199169)
+++ trunk/Source/JavaScriptCore/bytecode/BytecodeList.json        2016-04-07 19:38:00 UTC (rev 199170)
</span><span class="lines">@@ -57,6 +57,7 @@
</span><span class="cx">             { &quot;name&quot; : &quot;op_is_object_or_null&quot;, &quot;length&quot; : 3 },
</span><span class="cx">             { &quot;name&quot; : &quot;op_is_function&quot;, &quot;length&quot; : 3 },
</span><span class="cx">             { &quot;name&quot; : &quot;op_in&quot;, &quot;length&quot; : 4 },
</span><ins>+            { &quot;name&quot; : &quot;op_try_get_by_id&quot;, &quot;length&quot; : 4 },
</ins><span class="cx">             { &quot;name&quot; : &quot;op_get_by_id&quot;, &quot;length&quot; : 9  },
</span><span class="cx">             { &quot;name&quot; : &quot;op_get_array_length&quot;, &quot;length&quot; : 9 },
</span><span class="cx">             { &quot;name&quot; : &quot;op_put_by_id&quot;, &quot;length&quot; : 9 },
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorebytecodeBytecodeUseDefh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/bytecode/BytecodeUseDef.h (199169 => 199170)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/bytecode/BytecodeUseDef.h        2016-04-07 19:29:38 UTC (rev 199169)
+++ trunk/Source/JavaScriptCore/bytecode/BytecodeUseDef.h        2016-04-07 19:38:00 UTC (rev 199170)
</span><span class="lines">@@ -143,6 +143,7 @@
</span><span class="cx">     case op_resolve_scope:
</span><span class="cx">     case op_get_from_scope:
</span><span class="cx">     case op_to_primitive:
</span><ins>+    case op_try_get_by_id:
</ins><span class="cx">     case op_get_by_id:
</span><span class="cx">     case op_get_array_length:
</span><span class="cx">     case op_typeof:
</span><span class="lines">@@ -367,6 +368,7 @@
</span><span class="cx">     case op_tail_call:
</span><span class="cx">     case op_call_eval:
</span><span class="cx">     case op_construct:
</span><ins>+    case op_try_get_by_id:
</ins><span class="cx">     case op_get_by_id:
</span><span class="cx">     case op_get_array_length:
</span><span class="cx">     case op_overrides_has_instance:
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorebytecodeCodeBlockcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/bytecode/CodeBlock.cpp (199169 => 199170)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/bytecode/CodeBlock.cpp        2016-04-07 19:29:38 UTC (rev 199169)
+++ trunk/Source/JavaScriptCore/bytecode/CodeBlock.cpp        2016-04-07 19:38:00 UTC (rev 199170)
</span><span class="lines">@@ -1095,6 +1095,14 @@
</span><span class="cx">             printBinaryOp(out, exec, location, it, &quot;in&quot;);
</span><span class="cx">             break;
</span><span class="cx">         }
</span><ins>+        case op_try_get_by_id: {
+            int r0 = (++it)-&gt;u.operand;
+            int r1 = (++it)-&gt;u.operand;
+            int id0 = (++it)-&gt;u.operand;
+            printLocationAndOp(out, exec, location, it, &quot;try_get_by_id&quot;);
+            out.printf(&quot;%s, %s, %s&quot;, registerName(r0).data(), registerName(r1).data(), idName(id0, identifier(id0)).data());
+            break;
+        }
</ins><span class="cx">         case op_get_by_id:
</span><span class="cx">         case op_get_array_length: {
</span><span class="cx">             printGetByIdOp(out, exec, location, it);
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorebytecodePolymorphicAccesscpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/bytecode/PolymorphicAccess.cpp (199169 => 199170)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/bytecode/PolymorphicAccess.cpp        2016-04-07 19:29:38 UTC (rev 199169)
+++ trunk/Source/JavaScriptCore/bytecode/PolymorphicAccess.cpp        2016-04-07 19:38:00 UTC (rev 199170)
</span><span class="lines">@@ -159,6 +159,26 @@
</span><span class="cx"> {
</span><span class="cx"> }
</span><span class="cx"> 
</span><ins>+std::unique_ptr&lt;AccessCase&gt; AccessCase::tryGet(
+    VM&amp; vm, JSCell* owner, AccessType type, PropertyOffset offset, Structure* structure,
+    const ObjectPropertyConditionSet&amp; conditionSet, bool viaProxy, WatchpointSet* additionalSet)
+{
+    std::unique_ptr&lt;AccessCase&gt; result(new AccessCase());
+
+    result-&gt;m_type = type;
+    result-&gt;m_offset = offset;
+    result-&gt;m_structure.set(vm, owner, structure);
+    result-&gt;m_conditionSet = conditionSet;
+
+    if (viaProxy || additionalSet) {
+        result-&gt;m_rareData = std::make_unique&lt;RareData&gt;();
+        result-&gt;m_rareData-&gt;viaProxy = viaProxy;
+        result-&gt;m_rareData-&gt;additionalSet = additionalSet;
+    }
+
+    return result;
+}
+
</ins><span class="cx"> std::unique_ptr&lt;AccessCase&gt; AccessCase::get(
</span><span class="cx">     VM&amp; vm, JSCell* owner, AccessType type, PropertyOffset offset, Structure* structure,
</span><span class="cx">     const ObjectPropertyConditionSet&amp; conditionSet, bool viaProxy, WatchpointSet* additionalSet,
</span><span class="lines">@@ -685,6 +705,7 @@
</span><span class="cx">         return;
</span><span class="cx"> 
</span><span class="cx">     case Load:
</span><ins>+    case GetGetter:
</ins><span class="cx">     case Getter:
</span><span class="cx">     case Setter:
</span><span class="cx">     case CustomValueGetter:
</span><span class="lines">@@ -720,7 +741,7 @@
</span><span class="cx"> 
</span><span class="cx">         GPRReg loadedValueGPR = InvalidGPRReg;
</span><span class="cx">         if (m_type != CustomValueGetter &amp;&amp; m_type != CustomAccessorGetter &amp;&amp; m_type != CustomValueSetter &amp;&amp; m_type != CustomAccessorSetter) {
</span><del>-            if (m_type == Load)
</del><ins>+            if (m_type == Load || m_type == GetGetter)
</ins><span class="cx">                 loadedValueGPR = valueRegs.payloadGPR();
</span><span class="cx">             else
</span><span class="cx">                 loadedValueGPR = scratchGPR;
</span><span class="lines">@@ -739,7 +760,7 @@
</span><span class="cx">             jit.load64(
</span><span class="cx">                 CCallHelpers::Address(storageGPR, offsetRelativeToBase(m_offset)), loadedValueGPR);
</span><span class="cx"> #else
</span><del>-            if (m_type == Load) {
</del><ins>+            if (m_type == Load || m_type == GetGetter) {
</ins><span class="cx">                 jit.load32(
</span><span class="cx">                     CCallHelpers::Address(storageGPR, offsetRelativeToBase(m_offset) + TagOffset),
</span><span class="cx">                     valueRegs.tagGPR());
</span><span class="lines">@@ -750,7 +771,7 @@
</span><span class="cx"> #endif
</span><span class="cx">         }
</span><span class="cx"> 
</span><del>-        if (m_type == Load) {
</del><ins>+        if (m_type == Load || m_type == GetGetter) {
</ins><span class="cx">             state.succeed();
</span><span class="cx">             return;
</span><span class="cx">         }
</span><span class="lines">@@ -1567,6 +1588,9 @@
</span><span class="cx">     case AccessCase::Miss:
</span><span class="cx">         out.print(&quot;Miss&quot;);
</span><span class="cx">         return;
</span><ins>+    case AccessCase::GetGetter:
+        out.print(&quot;GetGetter&quot;);
+        return;
</ins><span class="cx">     case AccessCase::Getter:
</span><span class="cx">         out.print(&quot;Getter&quot;);
</span><span class="cx">         return;
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorebytecodePolymorphicAccessh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/bytecode/PolymorphicAccess.h (199169 => 199170)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/bytecode/PolymorphicAccess.h        2016-04-07 19:29:38 UTC (rev 199169)
+++ trunk/Source/JavaScriptCore/bytecode/PolymorphicAccess.h        2016-04-07 19:38:00 UTC (rev 199170)
</span><span class="lines">@@ -57,6 +57,7 @@
</span><span class="cx">         Transition,
</span><span class="cx">         Replace,
</span><span class="cx">         Miss,
</span><ins>+        GetGetter,
</ins><span class="cx">         Getter,
</span><span class="cx">         Setter,
</span><span class="cx">         CustomValueGetter,
</span><span class="lines">@@ -70,78 +71,12 @@
</span><span class="cx">         StringLength
</span><span class="cx">     };
</span><span class="cx"> 
</span><del>-    static bool isGet(AccessType type)
-    {
-        switch (type) {
-        case Transition:
-        case Replace:
-        case Setter:
-        case CustomValueSetter:
-        case CustomAccessorSetter:
-        case InHit:
-        case InMiss:
-            return false;
-        case Load:
-        case MegamorphicLoad:
-        case Miss:
-        case Getter:
-        case CustomValueGetter:
-        case CustomAccessorGetter:
-        case IntrinsicGetter:
-        case ArrayLength:
-        case StringLength:
-            return true;
-        }
-    }
</del><ins>+    static std::unique_ptr&lt;AccessCase&gt; tryGet(
+        VM&amp;, JSCell* owner, AccessType, PropertyOffset, Structure*,
+        const ObjectPropertyConditionSet&amp; = ObjectPropertyConditionSet(),
+        bool viaProxy = false,
+        WatchpointSet* additionalSet = nullptr);
</ins><span class="cx"> 
</span><del>-    static bool isPut(AccessType type)
-    {
-        switch (type) {
-        case Load:
-        case MegamorphicLoad:
-        case Miss:
-        case Getter:
-        case CustomValueGetter:
-        case CustomAccessorGetter:
-        case IntrinsicGetter:
-        case InHit:
-        case InMiss:
-        case ArrayLength:
-        case StringLength:
-            return false;
-        case Transition:
-        case Replace:
-        case Setter:
-        case CustomValueSetter:
-        case CustomAccessorSetter:
-            return true;
-        }
-    }
-
-    static bool isIn(AccessType type)
-    {
-        switch (type) {
-        case Load:
-        case MegamorphicLoad:
-        case Miss:
-        case Getter:
-        case CustomValueGetter:
-        case CustomAccessorGetter:
-        case IntrinsicGetter:
-        case Transition:
-        case Replace:
-        case Setter:
-        case CustomValueSetter:
-        case CustomAccessorSetter:
-        case ArrayLength:
-        case StringLength:
-            return false;
-        case InHit:
-        case InMiss:
-            return true;
-        }
-    }
-
</del><span class="cx">     static std::unique_ptr&lt;AccessCase&gt; get(
</span><span class="cx">         VM&amp;, JSCell* owner, AccessType, PropertyOffset, Structure*,
</span><span class="cx">         const ObjectPropertyConditionSet&amp; = ObjectPropertyConditionSet(),
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorebytecodeStructureStubInfocpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/bytecode/StructureStubInfo.cpp (199169 => 199170)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/bytecode/StructureStubInfo.cpp        2016-04-07 19:29:38 UTC (rev 199169)
+++ trunk/Source/JavaScriptCore/bytecode/StructureStubInfo.cpp        2016-04-07 19:38:00 UTC (rev 199170)
</span><span class="lines">@@ -148,8 +148,11 @@
</span><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     switch (accessType) {
</span><ins>+    case AccessType::GetPure:
+        resetGetByID(codeBlock, *this, GetByIDKind::Pure);
+        break;
</ins><span class="cx">     case AccessType::Get:
</span><del>-        resetGetByID(codeBlock, *this);
</del><ins>+        resetGetByID(codeBlock, *this, GetByIDKind::Normal);
</ins><span class="cx">         break;
</span><span class="cx">     case AccessType::Put:
</span><span class="cx">         resetPutByID(codeBlock, *this);
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorebytecodeStructureStubInfoh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/bytecode/StructureStubInfo.h (199169 => 199170)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/bytecode/StructureStubInfo.h        2016-04-07 19:29:38 UTC (rev 199169)
+++ trunk/Source/JavaScriptCore/bytecode/StructureStubInfo.h        2016-04-07 19:38:00 UTC (rev 199170)
</span><span class="lines">@@ -47,6 +47,7 @@
</span><span class="cx"> 
</span><span class="cx"> enum class AccessType : int8_t {
</span><span class="cx">     Get,
</span><ins>+    GetPure,
</ins><span class="cx">     Put,
</span><span class="cx">     In
</span><span class="cx"> };
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorebytecompilerBytecodeGeneratorcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp (199169 => 199170)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp        2016-04-07 19:29:38 UTC (rev 199169)
+++ trunk/Source/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp        2016-04-07 19:38:00 UTC (rev 199170)
</span><span class="lines">@@ -2360,6 +2360,17 @@
</span><span class="cx">     return dst;
</span><span class="cx"> }
</span><span class="cx"> 
</span><ins>+RegisterID* BytecodeGenerator::emitTryGetById(RegisterID* dst, RegisterID* base, const Identifier&amp; property)
+{
+    ASSERT_WITH_MESSAGE(!parseIndex(property), &quot;Indexed properties are not supported with tryGetById.&quot;);
+
+    emitOpcode(op_try_get_by_id);
+    instructions().append(kill(dst));
+    instructions().append(base-&gt;index());
+    instructions().append(addConstant(property));
+    return dst;
+}
+
</ins><span class="cx"> RegisterID* BytecodeGenerator::emitGetById(RegisterID* dst, RegisterID* base, const Identifier&amp; property)
</span><span class="cx"> {
</span><span class="cx">     ASSERT_WITH_MESSAGE(!parseIndex(property), &quot;Indexed properties should be handled with get_by_val.&quot;);
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorebytecompilerBytecodeGeneratorh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/bytecompiler/BytecodeGenerator.h (199169 => 199170)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/bytecompiler/BytecodeGenerator.h        2016-04-07 19:29:38 UTC (rev 199169)
+++ trunk/Source/JavaScriptCore/bytecompiler/BytecodeGenerator.h        2016-04-07 19:38:00 UTC (rev 199170)
</span><span class="lines">@@ -540,6 +540,7 @@
</span><span class="cx">         RegisterID* emitTypeOf(RegisterID* dst, RegisterID* src) { return emitUnaryOp(op_typeof, dst, src); }
</span><span class="cx">         RegisterID* emitIn(RegisterID* dst, RegisterID* property, RegisterID* base) { return emitBinaryOp(op_in, dst, property, base, OperandTypes()); }
</span><span class="cx"> 
</span><ins>+        RegisterID* emitTryGetById(RegisterID* dst, RegisterID* base, const Identifier&amp; property);
</ins><span class="cx">         RegisterID* emitGetById(RegisterID* dst, RegisterID* base, const Identifier&amp; property);
</span><span class="cx">         RegisterID* emitPutById(RegisterID* base, const Identifier&amp; property, RegisterID* value);
</span><span class="cx">         RegisterID* emitDirectPutById(RegisterID* base, const Identifier&amp; property, RegisterID* value, PropertyNode::PutType);
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorebytecompilerNodesCodegencpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/bytecompiler/NodesCodegen.cpp (199169 => 199170)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/bytecompiler/NodesCodegen.cpp        2016-04-07 19:29:38 UTC (rev 199169)
+++ trunk/Source/JavaScriptCore/bytecompiler/NodesCodegen.cpp        2016-04-07 19:38:00 UTC (rev 199170)
</span><span class="lines">@@ -842,6 +842,21 @@
</span><span class="cx">     return generator.moveToDestinationIfNeeded(dst, generator.emitDirectPutByVal(base.get(), index.get(), value.get()));
</span><span class="cx"> }
</span><span class="cx"> 
</span><ins>+RegisterID* BytecodeIntrinsicNode::emit_intrinsic_tryGetById(BytecodeGenerator&amp; generator, RegisterID* dst)
+{
+    ArgumentListNode* node = m_args-&gt;m_listNode;
+    RefPtr&lt;RegisterID&gt; base = generator.emitNode(node);
+    node = node-&gt;m_next;
+
+    // Since this is a builtin we expect the creator to use a string literal as the second argument.
+    ASSERT(node-&gt;m_expr-&gt;isString());
+    const Identifier&amp; ident = static_cast&lt;StringNode*&gt;(node-&gt;m_expr)-&gt;value();
+    ASSERT(!node-&gt;m_next);
+
+    RegisterID* finalDest = generator.finalDestination(dst);
+    return generator.emitTryGetById(finalDest, base.get(), ident);
+}
+
</ins><span class="cx"> RegisterID* BytecodeIntrinsicNode::emit_intrinsic_toString(BytecodeGenerator&amp; generator, RegisterID* dst)
</span><span class="cx"> {
</span><span class="cx">     ArgumentListNode* node = m_args-&gt;m_listNode;
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGSpeculativeJIT32_64cpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp (199169 => 199170)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp        2016-04-07 19:29:38 UTC (rev 199169)
+++ trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp        2016-04-07 19:38:00 UTC (rev 199170)
</span><span class="lines">@@ -194,7 +194,7 @@
</span><span class="cx">     JITGetByIdGenerator gen(
</span><span class="cx">         m_jit.codeBlock(), codeOrigin, callSite, usedRegisters,
</span><span class="cx">         JSValueRegs(baseTagGPROrNone, basePayloadGPR),
</span><del>-        JSValueRegs(resultTagGPR, resultPayloadGPR));
</del><ins>+        JSValueRegs(resultTagGPR, resultPayloadGPR), AccessType::Get);
</ins><span class="cx">     
</span><span class="cx">     gen.generateFastPath(m_jit);
</span><span class="cx">     
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGSpeculativeJIT64cpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp (199169 => 199170)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp        2016-04-07 19:29:38 UTC (rev 199169)
+++ trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp        2016-04-07 19:38:00 UTC (rev 199170)
</span><span class="lines">@@ -164,7 +164,7 @@
</span><span class="cx">     }
</span><span class="cx">     JITGetByIdGenerator gen(
</span><span class="cx">         m_jit.codeBlock(), codeOrigin, callSite, usedRegisters, JSValueRegs(baseGPR),
</span><del>-        JSValueRegs(resultGPR));
</del><ins>+        JSValueRegs(resultGPR), AccessType::Get);
</ins><span class="cx">     gen.generateFastPath(m_jit);
</span><span class="cx">     
</span><span class="cx">     JITCompiler::JumpList slowCases;
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreftlFTLLowerDFGToB3cpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp (199169 => 199170)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp        2016-04-07 19:29:38 UTC (rev 199169)
+++ trunk/Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp        2016-04-07 19:38:00 UTC (rev 199170)
</span><span class="lines">@@ -7331,7 +7331,7 @@
</span><span class="cx">                 auto generator = Box&lt;JITGetByIdGenerator&gt;::create(
</span><span class="cx">                     jit.codeBlock(), node-&gt;origin.semantic, callSiteIndex,
</span><span class="cx">                     params.unavailableRegisters(), JSValueRegs(params[1].gpr()),
</span><del>-                    JSValueRegs(params[0].gpr()));
</del><ins>+                    JSValueRegs(params[0].gpr()), AccessType::Get);
</ins><span class="cx"> 
</span><span class="cx">                 generator-&gt;generateFastPath(jit);
</span><span class="cx">                 CCallHelpers::Label done = jit.label();
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorejitJITcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/jit/JIT.cpp (199169 => 199170)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/jit/JIT.cpp        2016-04-07 19:29:38 UTC (rev 199169)
+++ trunk/Source/JavaScriptCore/jit/JIT.cpp        2016-04-07 19:38:00 UTC (rev 199170)
</span><span class="lines">@@ -228,6 +228,7 @@
</span><span class="cx">         DEFINE_OP(op_get_scope)
</span><span class="cx">         DEFINE_OP(op_eq)
</span><span class="cx">         DEFINE_OP(op_eq_null)
</span><ins>+        DEFINE_OP(op_try_get_by_id)
</ins><span class="cx">         case op_get_array_length:
</span><span class="cx">         DEFINE_OP(op_get_by_id)
</span><span class="cx">         DEFINE_OP(op_get_by_val)
</span><span class="lines">@@ -406,6 +407,7 @@
</span><span class="cx">         DEFINE_SLOWCASE_OP(op_create_this)
</span><span class="cx">         DEFINE_SLOWCASE_OP(op_div)
</span><span class="cx">         DEFINE_SLOWCASE_OP(op_eq)
</span><ins>+        DEFINE_SLOWCASE_OP(op_try_get_by_id)
</ins><span class="cx">         case op_get_array_length:
</span><span class="cx">         DEFINE_SLOWCASE_OP(op_get_by_id)
</span><span class="cx">         DEFINE_SLOWCASE_OP(op_get_by_val)
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorejitJITh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/jit/JIT.h (199169 => 199170)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/jit/JIT.h        2016-04-07 19:29:38 UTC (rev 199169)
+++ trunk/Source/JavaScriptCore/jit/JIT.h        2016-04-07 19:38:00 UTC (rev 199170)
</span><span class="lines">@@ -502,6 +502,7 @@
</span><span class="cx">         void emit_op_get_scope(Instruction*);
</span><span class="cx">         void emit_op_eq(Instruction*);
</span><span class="cx">         void emit_op_eq_null(Instruction*);
</span><ins>+        void emit_op_try_get_by_id(Instruction*);
</ins><span class="cx">         void emit_op_get_by_id(Instruction*);
</span><span class="cx">         void emit_op_get_arguments_length(Instruction*);
</span><span class="cx">         void emit_op_get_by_val(Instruction*);
</span><span class="lines">@@ -614,6 +615,7 @@
</span><span class="cx">         void emitSlow_op_div(Instruction*, Vector&lt;SlowCaseEntry&gt;::iterator&amp;);
</span><span class="cx">         void emitSlow_op_eq(Instruction*, Vector&lt;SlowCaseEntry&gt;::iterator&amp;);
</span><span class="cx">         void emitSlow_op_get_callee(Instruction*, Vector&lt;SlowCaseEntry&gt;::iterator&amp;);
</span><ins>+        void emitSlow_op_try_get_by_id(Instruction*, Vector&lt;SlowCaseEntry&gt;::iterator&amp;);
</ins><span class="cx">         void emitSlow_op_get_by_id(Instruction*, Vector&lt;SlowCaseEntry&gt;::iterator&amp;);
</span><span class="cx">         void emitSlow_op_get_arguments_length(Instruction*, Vector&lt;SlowCaseEntry&gt;::iterator&amp;);
</span><span class="cx">         void emitSlow_op_get_by_val(Instruction*, Vector&lt;SlowCaseEntry&gt;::iterator&amp;);
</span><span class="lines">@@ -738,8 +740,10 @@
</span><span class="cx">         MacroAssembler::Call callOperation(V_JITOperation_EC, JSCell*);
</span><span class="cx">         MacroAssembler::Call callOperation(J_JITOperation_EJ, int, GPRReg);
</span><span class="cx"> #if USE(JSVALUE64)
</span><ins>+        MacroAssembler::Call callOperation(J_JITOperation_ESsiJI, int, StructureStubInfo*, GPRReg, UniquedStringImpl*);
</ins><span class="cx">         MacroAssembler::Call callOperation(WithProfileTag, J_JITOperation_ESsiJI, int, StructureStubInfo*, GPRReg, UniquedStringImpl*);
</span><span class="cx"> #else
</span><ins>+        MacroAssembler::Call callOperation(J_JITOperation_ESsiJI, int, StructureStubInfo*, GPRReg, GPRReg, UniquedStringImpl*);
</ins><span class="cx">         MacroAssembler::Call callOperation(WithProfileTag, J_JITOperation_ESsiJI, int, StructureStubInfo*, GPRReg, GPRReg, UniquedStringImpl*);
</span><span class="cx"> #endif
</span><span class="cx">         MacroAssembler::Call callOperation(J_JITOperation_EJIdc, int, GPRReg, const Identifier*);
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorejitJITInlineCacheGeneratorcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/jit/JITInlineCacheGenerator.cpp (199169 => 199170)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/jit/JITInlineCacheGenerator.cpp        2016-04-07 19:29:38 UTC (rev 199169)
+++ trunk/Source/JavaScriptCore/jit/JITInlineCacheGenerator.cpp        2016-04-07 19:38:00 UTC (rev 199170)
</span><span class="lines">@@ -104,9 +104,9 @@
</span><span class="cx"> 
</span><span class="cx"> JITGetByIdGenerator::JITGetByIdGenerator(
</span><span class="cx">     CodeBlock* codeBlock, CodeOrigin codeOrigin, CallSiteIndex callSite, const RegisterSet&amp; usedRegisters,
</span><del>-    JSValueRegs base, JSValueRegs value)
</del><ins>+    JSValueRegs base, JSValueRegs value, AccessType accessType)
</ins><span class="cx">     : JITByIdGenerator(
</span><del>-        codeBlock, codeOrigin, callSite, AccessType::Get, usedRegisters, base, value)
</del><ins>+        codeBlock, codeOrigin, callSite, accessType, usedRegisters, base, value)
</ins><span class="cx"> {
</span><span class="cx">     RELEASE_ASSERT(base.payloadGPR() != value.tagGPR());
</span><span class="cx"> }
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorejitJITInlineCacheGeneratorh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/jit/JITInlineCacheGenerator.h (199169 => 199170)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/jit/JITInlineCacheGenerator.h        2016-04-07 19:29:38 UTC (rev 199169)
+++ trunk/Source/JavaScriptCore/jit/JITInlineCacheGenerator.h        2016-04-07 19:38:00 UTC (rev 199170)
</span><span class="lines">@@ -96,7 +96,7 @@
</span><span class="cx"> 
</span><span class="cx">     JITGetByIdGenerator(
</span><span class="cx">         CodeBlock*, CodeOrigin, CallSiteIndex, const RegisterSet&amp; usedRegisters, JSValueRegs base,
</span><del>-        JSValueRegs value);
</del><ins>+        JSValueRegs value, AccessType);
</ins><span class="cx">     
</span><span class="cx">     void generateFastPath(MacroAssembler&amp;);
</span><span class="cx"> };
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorejitJITInlinesh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/jit/JITInlines.h (199169 => 199170)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/jit/JITInlines.h        2016-04-07 19:29:38 UTC (rev 199169)
+++ trunk/Source/JavaScriptCore/jit/JITInlines.h        2016-04-07 19:38:00 UTC (rev 199170)
</span><span class="lines">@@ -459,6 +459,12 @@
</span><span class="cx">     return appendCallWithExceptionCheck(operation);
</span><span class="cx"> }
</span><span class="cx"> 
</span><ins>+ALWAYS_INLINE MacroAssembler::Call JIT::callOperation(J_JITOperation_ESsiJI operation, int dst, StructureStubInfo* stubInfo, GPRReg arg1, UniquedStringImpl* uid)
+{
+    setupArgumentsWithExecState(TrustedImmPtr(stubInfo), arg1, TrustedImmPtr(uid));
+    return appendCallWithExceptionCheckSetJSValueResult(operation, dst);
+}
+
</ins><span class="cx"> ALWAYS_INLINE MacroAssembler::Call JIT::callOperation(JIT::WithProfileTag, J_JITOperation_ESsiJI operation, int dst, StructureStubInfo* stubInfo, GPRReg arg1, UniquedStringImpl* uid)
</span><span class="cx"> {
</span><span class="cx">     setupArgumentsWithExecState(TrustedImmPtr(stubInfo), arg1, TrustedImmPtr(uid));
</span><span class="lines">@@ -642,6 +648,12 @@
</span><span class="cx">     return appendCallWithExceptionCheckSetJSValueResult(operation, dst);
</span><span class="cx"> }
</span><span class="cx"> 
</span><ins>+ALWAYS_INLINE MacroAssembler::Call JIT::callOperation(J_JITOperation_ESsiJI operation, int dst, StructureStubInfo* stubInfo, GPRReg arg1Tag, GPRReg arg1Payload, UniquedStringImpl* uid)
+{
+    setupArgumentsWithExecState(TrustedImmPtr(stubInfo), arg1Payload, arg1Tag, TrustedImmPtr(uid));
+    return appendCallWithExceptionCheckSetJSValueResult(operation, dst);
+}
+
</ins><span class="cx"> ALWAYS_INLINE MacroAssembler::Call JIT::callOperation(JIT::WithProfileTag, J_JITOperation_ESsiJI operation, int dst, StructureStubInfo* stubInfo, GPRReg arg1Tag, GPRReg arg1Payload, UniquedStringImpl* uid)
</span><span class="cx"> {
</span><span class="cx">     setupArgumentsWithExecState(TrustedImmPtr(stubInfo), arg1Payload, arg1Tag, TrustedImmPtr(uid));
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorejitJITOperationscpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/jit/JITOperations.cpp (199169 => 199170)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/jit/JITOperations.cpp        2016-04-07 19:29:38 UTC (rev 199169)
+++ trunk/Source/JavaScriptCore/jit/JITOperations.cpp        2016-04-07 19:38:00 UTC (rev 199170)
</span><span class="lines">@@ -156,6 +156,36 @@
</span><span class="cx">     return missingArgCount;
</span><span class="cx"> }
</span><span class="cx"> 
</span><ins>+EncodedJSValue JIT_OPERATION operationTryGetById(ExecState* exec, StructureStubInfo* stubInfo, EncodedJSValue base, UniquedStringImpl* uid)
+{
+    VM* vm = &amp;exec-&gt;vm();
+    NativeCallFrameTracer tracer(vm, exec);
+    Identifier ident = Identifier::fromUid(vm, uid);
+    stubInfo-&gt;tookSlowPath = true;
+
+    JSValue baseValue = JSValue::decode(base);
+    PropertySlot slot(baseValue, PropertySlot::InternalMethodType::VMInquiry);
+    baseValue.getPropertySlot(exec, ident, slot);
+
+    return JSValue::encode(slot.getPureResult());
+}
+
+EncodedJSValue JIT_OPERATION operationTryGetByIdOptimize(ExecState* exec, StructureStubInfo* stubInfo, EncodedJSValue base, UniquedStringImpl* uid)
+{
+    VM* vm = &amp;exec-&gt;vm();
+    NativeCallFrameTracer tracer(vm, exec);
+    Identifier ident = Identifier::fromUid(vm, uid);
+
+    JSValue baseValue = JSValue::decode(base);
+    PropertySlot slot(baseValue, PropertySlot::InternalMethodType::VMInquiry);
+
+    baseValue.getPropertySlot(exec, ident, slot);
+    if (stubInfo-&gt;considerCaching() &amp;&amp; !slot.isTaintedByProxy() &amp;&amp; (slot.isCacheableValue() || slot.isCacheableGetter() || slot.isUnset()))
+        repatchGetByID(exec, baseValue, ident, slot, *stubInfo, GetByIDKind::Pure);
+
+    return JSValue::encode(slot.getPureResult());
+}
+
</ins><span class="cx"> EncodedJSValue JIT_OPERATION operationGetById(ExecState* exec, StructureStubInfo* stubInfo, EncodedJSValue base, UniquedStringImpl* uid)
</span><span class="cx"> {
</span><span class="cx">     VM* vm = &amp;exec-&gt;vm();
</span><span class="lines">@@ -195,7 +225,7 @@
</span><span class="cx">     
</span><span class="cx">     bool hasResult = baseValue.getPropertySlot(exec, ident, slot);
</span><span class="cx">     if (stubInfo-&gt;considerCaching())
</span><del>-        repatchGetByID(exec, baseValue, ident, slot, *stubInfo);
</del><ins>+        repatchGetByID(exec, baseValue, ident, slot, *stubInfo, GetByIDKind::Normal);
</ins><span class="cx">     
</span><span class="cx">     return JSValue::encode(hasResult? slot.getValue(exec, ident) : jsUndefined());
</span><span class="cx"> }
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorejitJITOperationsh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/jit/JITOperations.h (199169 => 199170)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/jit/JITOperations.h        2016-04-07 19:29:38 UTC (rev 199169)
+++ trunk/Source/JavaScriptCore/jit/JITOperations.h        2016-04-07 19:38:00 UTC (rev 199170)
</span><span class="lines">@@ -287,9 +287,10 @@
</span><span class="cx"> #endif
</span><span class="cx"> int32_t JIT_OPERATION operationCallArityCheck(ExecState*) WTF_INTERNAL;
</span><span class="cx"> int32_t JIT_OPERATION operationConstructArityCheck(ExecState*) WTF_INTERNAL;
</span><ins>+EncodedJSValue JIT_OPERATION operationTryGetById(ExecState*, StructureStubInfo*, EncodedJSValue, UniquedStringImpl*) WTF_INTERNAL;
+EncodedJSValue JIT_OPERATION operationTryGetByIdOptimize(ExecState*, StructureStubInfo*, EncodedJSValue, UniquedStringImpl*) WTF_INTERNAL;
</ins><span class="cx"> EncodedJSValue JIT_OPERATION operationGetById(ExecState*, StructureStubInfo*, EncodedJSValue, UniquedStringImpl*) WTF_INTERNAL;
</span><span class="cx"> EncodedJSValue JIT_OPERATION operationGetByIdGeneric(ExecState*, EncodedJSValue, UniquedStringImpl*) WTF_INTERNAL;
</span><del>-EncodedJSValue JIT_OPERATION operationGetByIdBuildList(ExecState*, StructureStubInfo*, EncodedJSValue, UniquedStringImpl*) WTF_INTERNAL;
</del><span class="cx"> EncodedJSValue JIT_OPERATION operationGetByIdOptimize(ExecState*, StructureStubInfo*, EncodedJSValue, UniquedStringImpl*) WTF_INTERNAL;
</span><span class="cx"> EncodedJSValue JIT_OPERATION operationInOptimize(ExecState*, StructureStubInfo*, JSCell*, UniquedStringImpl*) WTF_INTERNAL;
</span><span class="cx"> EncodedJSValue JIT_OPERATION operationIn(ExecState*, StructureStubInfo*, JSCell*, UniquedStringImpl*) WTF_INTERNAL;
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorejitJITPropertyAccesscpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/jit/JITPropertyAccess.cpp (199169 => 199170)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/jit/JITPropertyAccess.cpp        2016-04-07 19:29:38 UTC (rev 199169)
+++ trunk/Source/JavaScriptCore/jit/JITPropertyAccess.cpp        2016-04-07 19:38:00 UTC (rev 199170)
</span><span class="lines">@@ -213,7 +213,7 @@
</span><span class="cx"> 
</span><span class="cx">     JITGetByIdGenerator gen(
</span><span class="cx">         m_codeBlock, CodeOrigin(m_bytecodeOffset), CallSiteIndex(m_bytecodeOffset), RegisterSet::stubUnavailableRegisters(),
</span><del>-        JSValueRegs(regT0), JSValueRegs(regT0));
</del><ins>+        JSValueRegs(regT0), JSValueRegs(regT0), AccessType::Get);
</ins><span class="cx">     gen.generateFastPath(*this);
</span><span class="cx"> 
</span><span class="cx">     fastDoneCase = jump();
</span><span class="lines">@@ -531,6 +531,43 @@
</span><span class="cx">     callOperation(operationDeleteById, dst, regT0, &amp;m_codeBlock-&gt;identifier(property));
</span><span class="cx"> }
</span><span class="cx"> 
</span><ins>+void JIT::emit_op_try_get_by_id(Instruction* currentInstruction)
+{
+    int resultVReg = currentInstruction[1].u.operand;
+    int baseVReg = currentInstruction[2].u.operand;
+
+    emitGetVirtualRegister(baseVReg, regT0);
+
+    emitJumpSlowCaseIfNotJSCell(regT0, baseVReg);
+
+    JITGetByIdGenerator gen(
+        m_codeBlock, CodeOrigin(m_bytecodeOffset), CallSiteIndex(m_bytecodeOffset), RegisterSet::stubUnavailableRegisters(),
+        JSValueRegs(regT0), JSValueRegs(regT0), AccessType::GetPure);
+    gen.generateFastPath(*this);
+    addSlowCase(gen.slowPathJump());
+    m_getByIds.append(gen);
+    
+    emitPutVirtualRegister(resultVReg);
+}
+
+void JIT::emitSlow_op_try_get_by_id(Instruction* currentInstruction, Vector&lt;SlowCaseEntry&gt;::iterator&amp; iter)
+{
+    int resultVReg = currentInstruction[1].u.operand;
+    int baseVReg = currentInstruction[2].u.operand;
+    const Identifier* ident = &amp;(m_codeBlock-&gt;identifier(currentInstruction[3].u.operand));
+
+    linkSlowCaseIfNotJSCell(iter, baseVReg);
+    linkSlowCase(iter);
+
+    JITGetByIdGenerator&amp; gen = m_getByIds[m_getByIdIndex++];
+
+    Label coldPathBegin = label();
+
+    Call call = callOperation(operationTryGetByIdOptimize, resultVReg, gen.stubInfo(), regT0, ident-&gt;impl());
+    
+    gen.reportSlowPathCall(coldPathBegin, call);
+}
+
</ins><span class="cx"> void JIT::emit_op_get_by_id(Instruction* currentInstruction)
</span><span class="cx"> {
</span><span class="cx">     int resultVReg = currentInstruction[1].u.operand;
</span><span class="lines">@@ -546,7 +583,7 @@
</span><span class="cx"> 
</span><span class="cx">     JITGetByIdGenerator gen(
</span><span class="cx">         m_codeBlock, CodeOrigin(m_bytecodeOffset), CallSiteIndex(m_bytecodeOffset), RegisterSet::stubUnavailableRegisters(),
</span><del>-        JSValueRegs(regT0), JSValueRegs(regT0));
</del><ins>+        JSValueRegs(regT0), JSValueRegs(regT0), AccessType::Get);
</ins><span class="cx">     gen.generateFastPath(*this);
</span><span class="cx">     addSlowCase(gen.slowPathJump());
</span><span class="cx">     m_getByIds.append(gen);
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorejitJITPropertyAccess32_64cpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/jit/JITPropertyAccess32_64.cpp (199169 => 199170)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/jit/JITPropertyAccess32_64.cpp        2016-04-07 19:29:38 UTC (rev 199169)
+++ trunk/Source/JavaScriptCore/jit/JITPropertyAccess32_64.cpp        2016-04-07 19:38:00 UTC (rev 199170)
</span><span class="lines">@@ -282,7 +282,7 @@
</span><span class="cx"> 
</span><span class="cx">     JITGetByIdGenerator gen(
</span><span class="cx">         m_codeBlock, CodeOrigin(m_bytecodeOffset), CallSiteIndex(currentInstruction), RegisterSet::stubUnavailableRegisters(),
</span><del>-        JSValueRegs::payloadOnly(regT0), JSValueRegs(regT1, regT0));
</del><ins>+        JSValueRegs::payloadOnly(regT0), JSValueRegs(regT1, regT0), AccessType::Get);
</ins><span class="cx">     gen.generateFastPath(*this);
</span><span class="cx"> 
</span><span class="cx">     fastDoneCase = jump();
</span><span class="lines">@@ -573,6 +573,43 @@
</span><span class="cx">     m_byValInstructionIndex++;
</span><span class="cx"> }
</span><span class="cx"> 
</span><ins>+void JIT::emit_op_try_get_by_id(Instruction* currentInstruction)
+{
+    int dst = currentInstruction[1].u.operand;
+    int base = currentInstruction[2].u.operand;
+
+    emitLoad(base, regT1, regT0);
+    emitJumpSlowCaseIfNotJSCell(base, regT1);
+
+    JITGetByIdGenerator gen(
+        m_codeBlock, CodeOrigin(m_bytecodeOffset), CallSiteIndex(currentInstruction), RegisterSet::stubUnavailableRegisters(),
+        JSValueRegs::payloadOnly(regT0), JSValueRegs(regT1, regT0), AccessType::GetPure);
+    gen.generateFastPath(*this);
+    addSlowCase(gen.slowPathJump());
+    m_getByIds.append(gen);
+    
+    emitStore(dst, regT1, regT0);
+}
+
+void JIT::emitSlow_op_try_get_by_id(Instruction* currentInstruction, Vector&lt;SlowCaseEntry&gt;::iterator&amp; iter)
+{
+    int resultVReg = currentInstruction[1].u.operand;
+    int baseVReg = currentInstruction[2].u.operand;
+    const Identifier* ident = &amp;(m_codeBlock-&gt;identifier(currentInstruction[3].u.operand));
+
+    linkSlowCaseIfNotJSCell(iter, baseVReg);
+    linkSlowCase(iter);
+
+    JITGetByIdGenerator&amp; gen = m_getByIds[m_getByIdIndex++];
+
+    Label coldPathBegin = label();
+
+    Call call = callOperation(operationTryGetByIdOptimize, resultVReg, gen.stubInfo(), regT1, regT0, ident-&gt;impl());
+    
+    gen.reportSlowPathCall(coldPathBegin, call);
+}
+
+
</ins><span class="cx"> void JIT::emit_op_get_by_id(Instruction* currentInstruction)
</span><span class="cx"> {
</span><span class="cx">     int dst = currentInstruction[1].u.operand;
</span><span class="lines">@@ -587,7 +624,7 @@
</span><span class="cx"> 
</span><span class="cx">     JITGetByIdGenerator gen(
</span><span class="cx">         m_codeBlock, CodeOrigin(m_bytecodeOffset), CallSiteIndex(currentInstruction), RegisterSet::stubUnavailableRegisters(),
</span><del>-        JSValueRegs::payloadOnly(regT0), JSValueRegs(regT1, regT0));
</del><ins>+        JSValueRegs::payloadOnly(regT0), JSValueRegs(regT1, regT0), AccessType::Get);
</ins><span class="cx">     gen.generateFastPath(*this);
</span><span class="cx">     addSlowCase(gen.slowPathJump());
</span><span class="cx">     m_getByIds.append(gen);
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorejitRepatchcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/jit/Repatch.cpp (199169 => 199170)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/jit/Repatch.cpp        2016-04-07 19:29:38 UTC (rev 199169)
+++ trunk/Source/JavaScriptCore/jit/Repatch.cpp        2016-04-07 19:38:00 UTC (rev 199170)
</span><span class="lines">@@ -93,7 +93,7 @@
</span><span class="cx"> 
</span><span class="cx"> static void repatchByIdSelfAccess(
</span><span class="cx">     CodeBlock* codeBlock, StructureStubInfo&amp; stubInfo, Structure* structure,
</span><del>-    PropertyOffset offset, const FunctionPtr &amp;slowPathFunction,
</del><ins>+    PropertyOffset offset, const FunctionPtr&amp; slowPathFunction,
</ins><span class="cx">     bool compact)
</span><span class="cx"> {
</span><span class="cx">     // Only optimize once!
</span><span class="lines">@@ -213,8 +213,22 @@
</span><span class="cx">     return Options::forceICFailure();
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-static InlineCacheAction tryCacheGetByID(ExecState* exec, JSValue baseValue, const Identifier&amp; propertyName, const PropertySlot&amp; slot, StructureStubInfo&amp; stubInfo)
</del><ins>+inline J_JITOperation_ESsiJI appropriateOptimizingGetByIdFunction(GetByIDKind kind)
</ins><span class="cx"> {
</span><ins>+    if (kind == GetByIDKind::Normal)
+        return operationGetByIdOptimize;
+    return operationTryGetByIdOptimize;
+}
+
+inline J_JITOperation_ESsiJI appropriateGenericGetByIdFunction(GetByIDKind kind)
+{
+    if (kind == GetByIDKind::Normal)
+        return operationGetById;
+    return operationTryGetById;
+}
+
+static InlineCacheAction tryCacheGetByID(ExecState* exec, JSValue baseValue, const Identifier&amp; propertyName, const PropertySlot&amp; slot, StructureStubInfo&amp; stubInfo, GetByIDKind kind)
+{
</ins><span class="cx">     if (forceICFailure(exec))
</span><span class="cx">         return GiveUpOnCache;
</span><span class="cx">     
</span><span class="lines">@@ -262,7 +276,7 @@
</span><span class="cx">             &amp;&amp; !structure-&gt;needImpurePropertyWatchpoint()
</span><span class="cx">             &amp;&amp; !loadTargetFromProxy) {
</span><span class="cx">             structure-&gt;startWatchingPropertyForReplacements(vm, slot.cachedOffset());
</span><del>-            repatchByIdSelfAccess(codeBlock, stubInfo, structure, slot.cachedOffset(), operationGetByIdOptimize, true);
</del><ins>+            repatchByIdSelfAccess(codeBlock, stubInfo, structure, slot.cachedOffset(), appropriateOptimizingGetByIdFunction(kind), true);
</ins><span class="cx">             stubInfo.initGetByIdSelf(codeBlock, structure, slot.cachedOffset());
</span><span class="cx">             return RetryCacheLater;
</span><span class="cx">         }
</span><span class="lines">@@ -295,7 +309,19 @@
</span><span class="cx">         if (slot.isCacheableGetter())
</span><span class="cx">             getter = jsDynamicCast&lt;JSFunction*&gt;(slot.getterSetter()-&gt;getter());
</span><span class="cx"> 
</span><del>-        if (!loadTargetFromProxy &amp;&amp; getter &amp;&amp; AccessCase::canEmitIntrinsicGetter(getter, structure))
</del><ins>+        if (kind == GetByIDKind::Pure) {
+            AccessCase::AccessType type;
+            if (slot.isCacheableValue())
+                type = AccessCase::Load;
+            else if (slot.isUnset())
+                type = AccessCase::Miss;
+            else if (slot.isCacheableGetter())
+                type = AccessCase::GetGetter;
+            else
+                RELEASE_ASSERT_NOT_REACHED();
+
+            newCase = AccessCase::tryGet(vm, codeBlock, type, offset, structure, conditionSet, loadTargetFromProxy, slot.watchpointSet());
+        } else if (!loadTargetFromProxy &amp;&amp; getter &amp;&amp; AccessCase::canEmitIntrinsicGetter(getter, structure))
</ins><span class="cx">             newCase = AccessCase::getIntrinsic(vm, codeBlock, getter, slot.cachedOffset(), structure, conditionSet);
</span><span class="cx">         else {
</span><span class="cx">             AccessCase::AccessType type;
</span><span class="lines">@@ -330,12 +356,12 @@
</span><span class="cx">     return RetryCacheLater;
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-void repatchGetByID(ExecState* exec, JSValue baseValue, const Identifier&amp; propertyName, const PropertySlot&amp; slot, StructureStubInfo&amp; stubInfo)
</del><ins>+void repatchGetByID(ExecState* exec, JSValue baseValue, const Identifier&amp; propertyName, const PropertySlot&amp; slot, StructureStubInfo&amp; stubInfo, GetByIDKind kind)
</ins><span class="cx"> {
</span><span class="cx">     GCSafeConcurrentJITLocker locker(exec-&gt;codeBlock()-&gt;m_lock, exec-&gt;vm().heap);
</span><span class="cx">     
</span><del>-    if (tryCacheGetByID(exec, baseValue, propertyName, slot, stubInfo) == GiveUpOnCache)
-        repatchCall(exec-&gt;codeBlock(), stubInfo.callReturnLocation, operationGetById);
</del><ins>+    if (tryCacheGetByID(exec, baseValue, propertyName, slot, stubInfo, kind) == GiveUpOnCache)
+        repatchCall(exec-&gt;codeBlock(), stubInfo.callReturnLocation, appropriateGenericGetByIdFunction(kind));
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> static V_JITOperation_ESsiJJI appropriateGenericPutByIdFunction(const PutPropertySlot &amp;slot, PutKind putKind)
</span><span class="lines">@@ -910,9 +936,9 @@
</span><span class="cx">         callLinkInfo.remove();
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-void resetGetByID(CodeBlock* codeBlock, StructureStubInfo&amp; stubInfo)
</del><ins>+void resetGetByID(CodeBlock* codeBlock, StructureStubInfo&amp; stubInfo, GetByIDKind kind)
</ins><span class="cx"> {
</span><del>-    repatchCall(codeBlock, stubInfo.callReturnLocation, operationGetByIdOptimize);
</del><ins>+    repatchCall(codeBlock, stubInfo.callReturnLocation, appropriateOptimizingGetByIdFunction(kind));
</ins><span class="cx">     resetGetByIDCheckAndLoad(stubInfo);
</span><span class="cx">     MacroAssembler::repatchJump(stubInfo.callReturnLocation.jumpAtOffset(stubInfo.patch.deltaCallToJump), stubInfo.callReturnLocation.labelAtOffset(stubInfo.patch.deltaCallToSlowCase));
</span><span class="cx"> }
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorejitRepatchh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/jit/Repatch.h (199169 => 199170)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/jit/Repatch.h        2016-04-07 19:29:38 UTC (rev 199169)
+++ trunk/Source/JavaScriptCore/jit/Repatch.h        2016-04-07 19:38:00 UTC (rev 199170)
</span><span class="lines">@@ -35,7 +35,12 @@
</span><span class="cx"> 
</span><span class="cx"> namespace JSC {
</span><span class="cx"> 
</span><del>-void repatchGetByID(ExecState*, JSValue, const Identifier&amp;, const PropertySlot&amp;, StructureStubInfo&amp;);
</del><ins>+enum class GetByIDKind {
+    Normal,
+    Pure
+};
+
+void repatchGetByID(ExecState*, JSValue, const Identifier&amp;, const PropertySlot&amp;, StructureStubInfo&amp;, GetByIDKind);
</ins><span class="cx"> void buildGetByIDList(ExecState*, JSValue, const Identifier&amp;, const PropertySlot&amp;, StructureStubInfo&amp;);
</span><span class="cx"> void buildGetByIDProtoList(ExecState*, JSValue, const Identifier&amp;, const PropertySlot&amp;, StructureStubInfo&amp;);
</span><span class="cx"> void repatchPutByID(ExecState*, JSValue, Structure*, const Identifier&amp;, const PutPropertySlot&amp;, StructureStubInfo&amp;, PutKind);
</span><span class="lines">@@ -46,7 +51,7 @@
</span><span class="cx"> void unlinkFor(VM&amp;, CallLinkInfo&amp;);
</span><span class="cx"> void linkVirtualFor(ExecState*, CallLinkInfo&amp;);
</span><span class="cx"> void linkPolymorphicCall(ExecState*, CallLinkInfo&amp;, CallVariant);
</span><del>-void resetGetByID(CodeBlock*, StructureStubInfo&amp;);
</del><ins>+void resetGetByID(CodeBlock*, StructureStubInfo&amp;, GetByIDKind);
</ins><span class="cx"> void resetPutByID(CodeBlock*, StructureStubInfo&amp;);
</span><span class="cx"> void resetIn(CodeBlock*, StructureStubInfo&amp;);
</span><span class="cx"> 
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorejsccpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/jsc.cpp (199169 => 199170)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/jsc.cpp        2016-04-07 19:29:38 UTC (rev 199169)
+++ trunk/Source/JavaScriptCore/jsc.cpp        2016-04-07 19:38:00 UTC (rev 199170)
</span><span class="lines">@@ -23,6 +23,7 @@
</span><span class="cx"> #include &quot;config.h&quot;
</span><span class="cx"> 
</span><span class="cx"> #include &quot;ArrayPrototype.h&quot;
</span><ins>+#include &quot;BuiltinExecutableCreator.h&quot;
</ins><span class="cx"> #include &quot;ButterflyInlines.h&quot;
</span><span class="cx"> #include &quot;BytecodeGenerator.h&quot;
</span><span class="cx"> #include &quot;CodeBlock.h&quot;
</span><span class="lines">@@ -32,6 +33,7 @@
</span><span class="cx"> #include &quot;Disassembler.h&quot;
</span><span class="cx"> #include &quot;Exception.h&quot;
</span><span class="cx"> #include &quot;ExceptionHelpers.h&quot;
</span><ins>+#include &quot;GetterSetter.h&quot;
</ins><span class="cx"> #include &quot;HeapProfiler.h&quot;
</span><span class="cx"> #include &quot;HeapSnapshotBuilder.h&quot;
</span><span class="cx"> #include &quot;HeapStatistics.h&quot;
</span><span class="lines">@@ -552,6 +554,7 @@
</span><span class="cx"> static EncodedJSValue JSC_HOST_CALL functionCreateRuntimeArray(ExecState*);
</span><span class="cx"> static EncodedJSValue JSC_HOST_CALL functionCreateImpureGetter(ExecState*);
</span><span class="cx"> static EncodedJSValue JSC_HOST_CALL functionCreateCustomGetterObject(ExecState*);
</span><ins>+static EncodedJSValue JSC_HOST_CALL functionCreateBuiltin(ExecState*);
</ins><span class="cx"> static EncodedJSValue JSC_HOST_CALL functionSetImpureGetterDelegate(ExecState*);
</span><span class="cx"> 
</span><span class="cx"> static EncodedJSValue JSC_HOST_CALL functionSetElementRoot(ExecState*);
</span><span class="lines">@@ -572,6 +575,7 @@
</span><span class="cx"> static EncodedJSValue JSC_HOST_CALL functionForceGCSlowPaths(ExecState*);
</span><span class="cx"> static EncodedJSValue JSC_HOST_CALL functionHeapSize(ExecState*);
</span><span class="cx"> static EncodedJSValue JSC_HOST_CALL functionAddressOf(ExecState*);
</span><ins>+static EncodedJSValue JSC_HOST_CALL functionGetGetterSetter(ExecState*);
</ins><span class="cx"> #ifndef NDEBUG
</span><span class="cx"> static EncodedJSValue JSC_HOST_CALL functionDumpCallFrame(ExecState*);
</span><span class="cx"> #endif
</span><span class="lines">@@ -743,6 +747,7 @@
</span><span class="cx">         addFunction(vm, &quot;forceGCSlowPaths&quot;, functionForceGCSlowPaths, 0);
</span><span class="cx">         addFunction(vm, &quot;gcHeapSize&quot;, functionHeapSize, 0);
</span><span class="cx">         addFunction(vm, &quot;addressOf&quot;, functionAddressOf, 1);
</span><ins>+        addFunction(vm, &quot;getGetterSetter&quot;, functionGetGetterSetter, 2);
</ins><span class="cx"> #ifndef NDEBUG
</span><span class="cx">         addFunction(vm, &quot;dumpCallFrame&quot;, functionDumpCallFrame, 0);
</span><span class="cx"> #endif
</span><span class="lines">@@ -792,6 +797,7 @@
</span><span class="cx"> 
</span><span class="cx">         addFunction(vm, &quot;createImpureGetter&quot;, functionCreateImpureGetter, 1);
</span><span class="cx">         addFunction(vm, &quot;createCustomGetterObject&quot;, functionCreateCustomGetterObject, 0);
</span><ins>+        addFunction(vm, &quot;createBuiltin&quot;, functionCreateBuiltin, 2);
</ins><span class="cx">         addFunction(vm, &quot;setImpureGetterDelegate&quot;, functionSetImpureGetterDelegate, 2);
</span><span class="cx"> 
</span><span class="cx">         addFunction(vm, &quot;dumpTypesForAllVariables&quot;, functionDumpTypesForAllVariables , 0);
</span><span class="lines">@@ -1332,6 +1338,30 @@
</span><span class="cx">     return returnValue;
</span><span class="cx"> }
</span><span class="cx"> 
</span><ins>+static EncodedJSValue JSC_HOST_CALL functionGetGetterSetter(ExecState* exec)
+{
+    JSValue value = exec-&gt;argument(0);
+    if (!value.isObject())
+        return JSValue::encode(jsUndefined());
+
+    JSValue property = exec-&gt;argument(1);
+    if (!property.isString())
+        return JSValue::encode(jsUndefined());
+
+    Identifier ident = Identifier::fromString(&amp;exec-&gt;vm(), property.toString(exec)-&gt;value(exec));
+
+    PropertySlot slot(value, PropertySlot::InternalMethodType::VMInquiry);
+    value.getPropertySlot(exec, ident, slot);
+
+    JSValue result;
+    if (slot.isCacheableGetter())
+        result = slot.getterSetter();
+    else
+        result = jsNull();
+
+    return JSValue::encode(result);
+}
+
</ins><span class="cx"> EncodedJSValue JSC_HOST_CALL functionVersion(ExecState*)
</span><span class="cx"> {
</span><span class="cx">     // We need this function for compatibility with the Mozilla JS tests but for now
</span><span class="lines">@@ -1721,6 +1751,22 @@
</span><span class="cx">     return JSValue::encode(jsUndefined());
</span><span class="cx"> }
</span><span class="cx"> 
</span><ins>+EncodedJSValue JSC_HOST_CALL functionCreateBuiltin(ExecState* exec)
+{
+    if (exec-&gt;argumentCount() &lt; 1 || !exec-&gt;argument(0).isString())
+        return JSValue::encode(jsUndefined());
+
+    String functionText = exec-&gt;argument(0).toString(exec)-&gt;value(exec);
+    if (exec-&gt;hadException())
+        return JSValue::encode(JSValue());
+
+    VM&amp; vm = exec-&gt;vm();
+    const SourceCode&amp; source = makeSource(functionText);
+    JSFunction* func = JSFunction::createBuiltinFunction(vm, createBuiltinExecutable(vm, source, Identifier::fromString(&amp;vm, &quot;foo&quot;), ConstructorKind::None, ConstructAbility::CannotConstruct)-&gt;link(vm, source), exec-&gt;lexicalGlobalObject());
+
+    return JSValue::encode(func);
+}
+
</ins><span class="cx"> EncodedJSValue JSC_HOST_CALL functionCheckModuleSyntax(ExecState* exec)
</span><span class="cx"> {
</span><span class="cx">     String source = exec-&gt;argument(0).toString(exec)-&gt;value(exec);
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorellintLLIntDatacpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/llint/LLIntData.cpp (199169 => 199170)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/llint/LLIntData.cpp        2016-04-07 19:29:38 UTC (rev 199169)
+++ trunk/Source/JavaScriptCore/llint/LLIntData.cpp        2016-04-07 19:38:00 UTC (rev 199170)
</span><span class="lines">@@ -144,9 +144,9 @@
</span><span class="cx">     
</span><span class="cx">     STATIC_ASSERT(StringType == 6);
</span><span class="cx">     STATIC_ASSERT(SymbolType == 7);
</span><del>-    STATIC_ASSERT(ObjectType == 21);
-    STATIC_ASSERT(FinalObjectType == 22);
-    STATIC_ASSERT(JSFunctionType == 24);
</del><ins>+    STATIC_ASSERT(ObjectType == 20);
+    STATIC_ASSERT(FinalObjectType == 21);
+    STATIC_ASSERT(JSFunctionType == 23);
</ins><span class="cx">     STATIC_ASSERT(MasqueradesAsUndefined == 1);
</span><span class="cx">     STATIC_ASSERT(ImplementsDefaultHasInstance == 2);
</span><span class="cx">     STATIC_ASSERT(FirstConstantRegisterIndex == 0x40000000);
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorellintLLIntSlowPathscpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/llint/LLIntSlowPaths.cpp (199169 => 199170)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/llint/LLIntSlowPaths.cpp        2016-04-07 19:29:38 UTC (rev 199169)
+++ trunk/Source/JavaScriptCore/llint/LLIntSlowPaths.cpp        2016-04-07 19:38:00 UTC (rev 199170)
</span><span class="lines">@@ -545,6 +545,19 @@
</span><span class="cx">     LLINT_RETURN(result);
</span><span class="cx"> }
</span><span class="cx"> 
</span><ins>+LLINT_SLOW_PATH_DECL(slow_path_try_get_by_id)
+{
+    LLINT_BEGIN();
+    CodeBlock* codeBlock = exec-&gt;codeBlock();
+    const Identifier&amp; ident = codeBlock-&gt;identifier(pc[3].u.operand);
+    JSValue baseValue = LLINT_OP_C(2).jsValue();
+    PropertySlot slot(baseValue, PropertySlot::PropertySlot::InternalMethodType::VMInquiry);
+
+    baseValue.getPropertySlot(exec, ident, slot);
+
+    LLINT_RETURN(slot.getPureResult());
+}
+
</ins><span class="cx"> LLINT_SLOW_PATH_DECL(slow_path_get_by_id)
</span><span class="cx"> {
</span><span class="cx">     LLINT_BEGIN();
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorellintLLIntSlowPathsh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/llint/LLIntSlowPaths.h (199169 => 199170)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/llint/LLIntSlowPaths.h        2016-04-07 19:29:38 UTC (rev 199169)
+++ trunk/Source/JavaScriptCore/llint/LLIntSlowPaths.h        2016-04-07 19:38:00 UTC (rev 199170)
</span><span class="lines">@@ -69,6 +69,7 @@
</span><span class="cx"> LLINT_SLOW_PATH_HIDDEN_DECL(slow_path_new_regexp);
</span><span class="cx"> LLINT_SLOW_PATH_HIDDEN_DECL(slow_path_instanceof);
</span><span class="cx"> LLINT_SLOW_PATH_HIDDEN_DECL(slow_path_instanceof_custom);
</span><ins>+LLINT_SLOW_PATH_HIDDEN_DECL(slow_path_try_get_by_id);
</ins><span class="cx"> LLINT_SLOW_PATH_HIDDEN_DECL(slow_path_get_by_id);
</span><span class="cx"> LLINT_SLOW_PATH_HIDDEN_DECL(slow_path_get_arguments_length);
</span><span class="cx"> LLINT_SLOW_PATH_HIDDEN_DECL(slow_path_put_by_id);
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorellintLowLevelInterpreterasm"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/llint/LowLevelInterpreter.asm (199169 => 199170)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/llint/LowLevelInterpreter.asm        2016-04-07 19:29:38 UTC (rev 199169)
+++ trunk/Source/JavaScriptCore/llint/LowLevelInterpreter.asm        2016-04-07 19:38:00 UTC (rev 199170)
</span><span class="lines">@@ -326,9 +326,9 @@
</span><span class="cx"> # Type constants.
</span><span class="cx"> const StringType = 6
</span><span class="cx"> const SymbolType = 7
</span><del>-const ObjectType = 21
-const FinalObjectType = 22
-const JSFunctionType = 24
</del><ins>+const ObjectType = 20
+const FinalObjectType = 21
+const JSFunctionType = 23
</ins><span class="cx"> 
</span><span class="cx"> # Type flags constants.
</span><span class="cx"> const MasqueradesAsUndefined = 1
</span><span class="lines">@@ -1301,6 +1301,12 @@
</span><span class="cx">     dispatch(4)
</span><span class="cx"> 
</span><span class="cx"> 
</span><ins>+_llint_op_try_get_by_id:
+    traceExecution()
+    callSlowPath(_llint_slow_path_try_get_by_id)
+    dispatch(4)
+
+
</ins><span class="cx"> _llint_op_del_by_id:
</span><span class="cx">     traceExecution()
</span><span class="cx">     callSlowPath(_llint_slow_path_del_by_id)
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeGetterSettercpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/GetterSetter.cpp (199169 => 199170)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/GetterSetter.cpp        2016-04-07 19:29:38 UTC (rev 199169)
+++ trunk/Source/JavaScriptCore/runtime/GetterSetter.cpp        2016-04-07 19:38:00 UTC (rev 199170)
</span><span class="lines">@@ -33,7 +33,7 @@
</span><span class="cx"> 
</span><span class="cx"> STATIC_ASSERT_IS_TRIVIALLY_DESTRUCTIBLE(GetterSetter);
</span><span class="cx"> 
</span><del>-const ClassInfo GetterSetter::s_info = { &quot;GetterSetter&quot;, 0, 0, CREATE_METHOD_TABLE(GetterSetter) };
</del><ins>+const ClassInfo GetterSetter::s_info = { &quot;GetterSetter&quot;, &amp;Base::s_info, 0, CREATE_METHOD_TABLE(GetterSetter) };
</ins><span class="cx"> 
</span><span class="cx"> void GetterSetter::visitChildren(JSCell* cell, SlotVisitor&amp; visitor)
</span><span class="cx"> {
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeGetterSetterh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/GetterSetter.h (199169 => 199170)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/GetterSetter.h        2016-04-07 19:29:38 UTC (rev 199169)
+++ trunk/Source/JavaScriptCore/runtime/GetterSetter.h        2016-04-07 19:38:00 UTC (rev 199170)
</span><span class="lines">@@ -41,21 +41,21 @@
</span><span class="cx"> // that if a property holding a GetterSetter reference is constant-inferred and
</span><span class="cx"> // that constant is observed to have a non-null setter (or getter) then we can
</span><span class="cx"> // constant fold that setter (or getter).
</span><del>-class GetterSetter final : public JSCell {
</del><ins>+class GetterSetter final : public JSNonFinalObject {
</ins><span class="cx">     friend class JIT;
</span><del>-
</del><ins>+    typedef JSNonFinalObject Base;
</ins><span class="cx"> private:
</span><span class="cx">     GetterSetter(VM&amp; vm, JSGlobalObject* globalObject)
</span><del>-        : JSCell(vm, vm.getterSetterStructure.get())
</del><ins>+        : Base(vm, vm.getterSetterStructure.get())
</ins><span class="cx">     {
</span><span class="cx">         m_getter.set(vm, this, globalObject-&gt;nullGetterFunction());
</span><span class="cx">         m_setter.set(vm, this, globalObject-&gt;nullSetterFunction());
</span><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx"> public:
</span><del>-    typedef JSCell Base;
-    static const unsigned StructureFlags = Base::StructureFlags | StructureIsImmortal;
</del><span class="cx"> 
</span><ins>+    static const unsigned StructureFlags = Base::StructureFlags | OverridesGetOwnPropertySlot | StructureIsImmortal;
+
</ins><span class="cx">     static GetterSetter* create(VM&amp; vm, JSGlobalObject* globalObject)
</span><span class="cx">     {
</span><span class="cx">         GetterSetter* getterSetter = new (NotNull, allocateCell&lt;GetterSetter&gt;(vm.heap)) GetterSetter(vm, globalObject);
</span><span class="lines">@@ -128,8 +128,13 @@
</span><span class="cx">         return OBJECT_OFFSETOF(GetterSetter, m_setter);
</span><span class="cx">     }
</span><span class="cx"> 
</span><del>-    DECLARE_INFO;
</del><ins>+    DECLARE_EXPORT_INFO;
</ins><span class="cx"> 
</span><ins>+    static bool getOwnPropertySlot(JSObject*, ExecState*, PropertyName, PropertySlot&amp;) { RELEASE_ASSERT_NOT_REACHED(); return false; }
+    static bool put(JSCell*, ExecState*, PropertyName, JSValue, PutPropertySlot&amp;) { RELEASE_ASSERT_NOT_REACHED(); return false; }
+    static bool defineOwnProperty(JSObject*, ExecState*, PropertyName, const PropertyDescriptor&amp;, bool) { RELEASE_ASSERT_NOT_REACHED(); return false; }
+    static bool deleteProperty(JSCell*, ExecState*, PropertyName) { RELEASE_ASSERT_NOT_REACHED(); return false; }
+
</ins><span class="cx"> private:
</span><span class="cx">     WriteBarrier&lt;JSObject&gt; m_getter;
</span><span class="cx">     WriteBarrier&lt;JSObject&gt; m_setter;  
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeJSTypeh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/JSType.h (199169 => 199170)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/JSType.h        2016-04-07 19:29:38 UTC (rev 199169)
+++ trunk/Source/JavaScriptCore/runtime/JSType.h        2016-04-07 19:38:00 UTC (rev 199170)
</span><span class="lines">@@ -35,7 +35,6 @@
</span><span class="cx">     StringType,
</span><span class="cx">     SymbolType,
</span><span class="cx"> 
</span><del>-    GetterSetterType,
</del><span class="cx">     CustomGetterSetterType,
</span><span class="cx">     APIValueWrapperType,
</span><span class="cx"> 
</span><span class="lines">@@ -75,6 +74,7 @@
</span><span class="cx">     Float64ArrayType,
</span><span class="cx">     DataViewType,
</span><span class="cx"> 
</span><ins>+    GetterSetterType,
</ins><span class="cx">     GlobalObjectType,
</span><span class="cx">     LexicalEnvironmentType,
</span><span class="cx">     GlobalLexicalEnvironmentType,
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimePropertySlotcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/PropertySlot.cpp (199169 => 199170)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/PropertySlot.cpp        2016-04-07 19:29:38 UTC (rev 199169)
+++ trunk/Source/JavaScriptCore/runtime/PropertySlot.cpp        2016-04-07 19:38:00 UTC (rev 199170)
</span><span class="lines">@@ -39,4 +39,21 @@
</span><span class="cx">     return JSValue::decode(m_data.custom.getValue(exec, JSValue::encode(thisValue), propertyName));
</span><span class="cx"> }
</span><span class="cx"> 
</span><ins>+JSValue PropertySlot::getPureResult() const
+{
+    JSValue result;
+    if (isTaintedByProxy())
+        result = jsNull();
+    else if (isCacheableValue())
+        result = JSValue::decode(m_data.value);
+    else if (isCacheableGetter())
+        result = getterSetter();
+    else if (isUnset())
+        result = jsUndefined();
+    else
+        result = jsNull();
+    
+    return result;
+}
+
</ins><span class="cx"> } // namespace JSC
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimePropertySloth"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/PropertySlot.h (199169 => 199170)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/PropertySlot.h        2016-04-07 19:29:38 UTC (rev 199169)
+++ trunk/Source/JavaScriptCore/runtime/PropertySlot.h        2016-04-07 19:38:00 UTC (rev 199170)
</span><span class="lines">@@ -94,6 +94,7 @@
</span><span class="cx"> 
</span><span class="cx">     JSValue getValue(ExecState*, PropertyName) const;
</span><span class="cx">     JSValue getValue(ExecState*, unsigned propertyName) const;
</span><ins>+    JSValue getPureResult() const;
</ins><span class="cx"> 
</span><span class="cx">     bool isCacheable() const { return m_cacheability == CachingAllowed &amp;&amp; m_offset != invalidOffset; }
</span><span class="cx">     bool isUnset() const { return m_propertyType == TypeUnset; }
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeProxyObjectcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/ProxyObject.cpp (199169 => 199170)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/ProxyObject.cpp        2016-04-07 19:29:38 UTC (rev 199169)
+++ trunk/Source/JavaScriptCore/runtime/ProxyObject.cpp        2016-04-07 19:38:00 UTC (rev 199170)
</span><span class="lines">@@ -332,8 +332,7 @@
</span><span class="cx"> bool ProxyObject::getOwnPropertySlotCommon(ExecState* exec, PropertyName propertyName, PropertySlot&amp; slot)
</span><span class="cx"> {
</span><span class="cx">     slot.disableCaching();
</span><del>-    if (slot.internalMethodType() != PropertySlot::InternalMethodType::VMInquiry)
-        slot.setIsTaintedByProxy();
</del><ins>+    slot.setIsTaintedByProxy();
</ins><span class="cx">     switch (slot.internalMethodType()) {
</span><span class="cx">     case PropertySlot::InternalMethodType::Get:
</span><span class="cx">         slot.setCustom(this, CustomAccessor, performProxyGet);
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoretestsstresstrygetbyidjs"></a>
<div class="addfile"><h4>Added: trunk/Source/JavaScriptCore/tests/stress/try-get-by-id.js (0 => 199170)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/tests/stress/try-get-by-id.js                                (rev 0)
+++ trunk/Source/JavaScriptCore/tests/stress/try-get-by-id.js        2016-04-07 19:38:00 UTC (rev 199170)
</span><span class="lines">@@ -0,0 +1,117 @@
</span><ins>+function tryGetByIdText(propertyName) { return `(function (base) { return @tryGetById(base, '${propertyName}'); })`; }
+
+
+// Test get value off object.
+{
+    let getCaller = createBuiltin(tryGetByIdText(&quot;caller&quot;));
+    noInline(getCaller);
+    let obj = {caller: 1};
+
+    for (let i = 0; i &lt; 100000; i++) {
+        if (getCaller(obj) !== 1)
+            throw new Error(&quot;wrong on iteration: &quot; + i);
+    }
+}
+
+// Test slot is custom function trap for a value.
+{
+    let getCaller = createBuiltin(tryGetByIdText(&quot;caller&quot;));
+    noInline(getCaller);
+    let func = function () {};
+
+    for (let i = 0; i &lt; 100000; i++) {
+        if (getCaller(func) !== null)
+            throw new Error(&quot;wrong on iteration: &quot; + i);
+    }
+}
+
+// Test slot is a GetterSetter.
+{
+    let get = createBuiltin(tryGetByIdText(&quot;getterSetter&quot;));
+    noInline(get);
+    let obj = {};
+    Object.defineProperty(obj, &quot;getterSetter&quot;, { get: function () { throw new Error(&quot;should not be called&quot;); } });
+
+    for (let i = 0; i &lt; 100000; i++) {
+        if (get(obj) !== getGetterSetter(obj, &quot;getterSetter&quot;))
+            throw new Error(&quot;wrong on iteration: &quot; + i);
+    }
+}
+
+// Test slot is unset.
+{
+    let get = createBuiltin(tryGetByIdText(&quot;getterSetter&quot;));
+    noInline(get);
+    let obj = {};
+
+    for (let i = 0; i &lt; 100000; i++) {
+        if (get(obj) !== undefined)
+            throw new Error(&quot;wrong on iteration: &quot; + i);
+    }
+}
+
+// Test slot is on a proxy with value.
+{
+    let get = createBuiltin(tryGetByIdText(&quot;value&quot;));
+    noInline(get);
+
+    let obj = {value: 1};
+    let p = new Proxy(obj, { get: function() { throw new Error(&quot;should not be called&quot;); } });
+
+    for (let i = 0; i &lt; 100000; i++) {
+        if (get(p) !== null)
+            throw new Error(&quot;wrong on iteration: &quot; + i);
+    }
+}
+
+// Test mutating inline cache.
+{
+    let get = createBuiltin(tryGetByIdText(&quot;caller&quot;));
+    noInline(get);
+
+    let obj = {caller : 1};
+    let func = function() {};
+
+    for (let i = 0; i &lt; 100000; i++) {
+        if (i % 100 === 0) {
+            if (get(func) !== null)
+                throw new Error(&quot;wrong on iteration: &quot; + i);
+        } else {
+            if (get(obj) !== 1)
+                throw new Error(&quot;wrong on iteration: &quot; + i);
+        }
+    }
+}
+
+// Test new type on each iteration.
+{
+    let get = createBuiltin(tryGetByIdText(&quot;caller&quot;));
+    noInline(get);
+
+    let func = function() {};
+
+    for (let i = 0; i &lt; 100000; i++) {
+        if (i % 100 === 0) {
+            if (get(func) !== null)
+                throw new Error(&quot;wrong on iteration: &quot; + i);
+        } else {
+            let obj = {caller : 1};
+            if (get(obj) !== 1)
+                throw new Error(&quot;wrong on iteration: &quot; + i);
+        }
+    }
+}
+
+// Test with array length. This is null because the value is not cacheable.
+{
+    let get = createBuiltin(tryGetByIdText(&quot;length&quot;));
+    noInline(get);
+
+    let arr = [];
+
+    for (let i = 0; i &lt; 100000; i++) {
+        if (get(arr) !== null)
+            throw new Error(&quot;wrong on iteration: &quot; + i);
+
+    }
+}
</ins></span></pre>
</div>
</div>

</body>
</html>