<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN"
"http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head><meta http-equiv="content-type" content="text/html; charset=utf-8" />
<title>[203704] trunk/Source/JavaScriptCore</title>
</head>
<body>

<style type="text/css"><!--
#msg dl.meta { border: 1px #006 solid; background: #369; padding: 6px; color: #fff; }
#msg dl.meta dt { float: left; width: 6em; font-weight: bold; }
#msg dt:after { content:':';}
#msg dl, #msg dt, #msg ul, #msg li, #header, #footer, #logmsg { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt;  }
#msg dl a { font-weight: bold}
#msg dl a:link    { color:#fc3; }
#msg dl a:active  { color:#ff0; }
#msg dl a:visited { color:#cc6; }
h3 { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; font-weight: bold; }
#msg pre { overflow: auto; background: #ffc; border: 1px #fa0 solid; padding: 6px; }
#logmsg { background: #ffc; border: 1px #fa0 solid; padding: 1em 1em 0 1em; }
#logmsg p, #logmsg pre, #logmsg blockquote { margin: 0 0 1em 0; }
#logmsg p, #logmsg li, #logmsg dt, #logmsg dd { line-height: 14pt; }
#logmsg h1, #logmsg h2, #logmsg h3, #logmsg h4, #logmsg h5, #logmsg h6 { margin: .5em 0; }
#logmsg h1:first-child, #logmsg h2:first-child, #logmsg h3:first-child, #logmsg h4:first-child, #logmsg h5:first-child, #logmsg h6:first-child { margin-top: 0; }
#logmsg ul, #logmsg ol { padding: 0; list-style-position: inside; margin: 0 0 0 1em; }
#logmsg ul { text-indent: -1em; padding-left: 1em; }#logmsg ol { text-indent: -1.5em; padding-left: 1.5em; }
#logmsg > ul, #logmsg > ol { margin: 0 0 1em 0; }
#logmsg pre { background: #eee; padding: 1em; }
#logmsg blockquote { border: 1px solid #fa0; border-left-width: 10px; padding: 1em 1em 0 1em; background: white;}
#logmsg dl { margin: 0; }
#logmsg dt { font-weight: bold; }
#logmsg dd { margin: 0; padding: 0 0 0.5em 0; }
#logmsg dd:before { content:'\00bb';}
#logmsg table { border-spacing: 0px; border-collapse: collapse; border-top: 4px solid #fa0; border-bottom: 1px solid #fa0; background: #fff; }
#logmsg table th { text-align: left; font-weight: normal; padding: 0.2em 0.5em; border-top: 1px dotted #fa0; }
#logmsg table td { text-align: right; border-top: 1px dotted #fa0; padding: 0.2em 0.5em; }
#logmsg table thead th { text-align: center; border-bottom: 1px solid #fa0; }
#logmsg table th.Corner { text-align: left; }
#logmsg hr { border: none 0; border-top: 2px dashed #fa0; height: 1px; }
#header, #footer { color: #fff; background: #636; border: 1px #300 solid; padding: 6px; }
#patch { width: 100%; }
#patch h4 {font-family: verdana,arial,helvetica,sans-serif;font-size:10pt;padding:8px;background:#369;color:#fff;margin:0;}
#patch .propset h4, #patch .binary h4 {margin:0;}
#patch pre {padding:0;line-height:1.2em;margin:0;}
#patch .diff {width:100%;background:#eee;padding: 0 0 10px 0;overflow:auto;}
#patch .propset .diff, #patch .binary .diff  {padding:10px 0;}
#patch span {display:block;padding:0 10px;}
#patch .modfile, #patch .addfile, #patch .delfile, #patch .propset, #patch .binary, #patch .copfile {border:1px solid #ccc;margin:10px 0;}
#patch ins {background:#dfd;text-decoration:none;display:block;padding:0 10px;}
#patch del {background:#fdd;text-decoration:none;display:block;padding:0 10px;}
#patch .lines, .info {color:#888;background:#fff;}
--></style>
<div id="msg">
<dl class="meta">
<dt>Revision</dt> <dd><a href="http://trac.webkit.org/projects/webkit/changeset/203704">203704</a></dd>
<dt>Author</dt> <dd>benjamin@webkit.org</dd>
<dt>Date</dt> <dd>2016-07-25 18:05:43 -0700 (Mon, 25 Jul 2016)</dd>
</dl>

<h3>Log Message</h3>
<pre>Unreviewed, rolling out <a href="http://trac.webkit.org/projects/webkit/changeset/203703">r203703</a>.

It breaks some internal tests

Reverted changeset:

&quot;[JSC] DFG::Node should not have its own allocator&quot;
https://bugs.webkit.org/show_bug.cgi?id=160098
http://trac.webkit.org/changeset/203703</pre>

<h3>Modified Paths</h3>
<ul>
<li><a href="#trunkSourceJavaScriptCoreCMakeListstxt">trunk/Source/JavaScriptCore/CMakeLists.txt</a></li>
<li><a href="#trunkSourceJavaScriptCoreChangeLog">trunk/Source/JavaScriptCore/ChangeLog</a></li>
<li><a href="#trunkSourceJavaScriptCoreJavaScriptCorexcodeprojprojectpbxproj">trunk/Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj</a></li>
<li><a href="#trunkSourceJavaScriptCoreb3B3SparseCollectionh">trunk/Source/JavaScriptCore/b3/B3SparseCollection.h</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGByteCodeParsercpp">trunk/Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGCPSRethreadingPhasecpp">trunk/Source/JavaScriptCore/dfg/DFGCPSRethreadingPhase.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGCleanUpPhasecpp">trunk/Source/JavaScriptCore/dfg/DFGCleanUpPhase.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGConstantFoldingPhasecpp">trunk/Source/JavaScriptCore/dfg/DFGConstantFoldingPhase.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGConstantHoistingPhasecpp">trunk/Source/JavaScriptCore/dfg/DFGConstantHoistingPhase.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGDCEPhasecpp">trunk/Source/JavaScriptCore/dfg/DFGDCEPhase.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGDrivercpp">trunk/Source/JavaScriptCore/dfg/DFGDriver.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGGraphcpp">trunk/Source/JavaScriptCore/dfg/DFGGraph.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGGraphh">trunk/Source/JavaScriptCore/dfg/DFGGraph.h</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGLICMPhasecpp">trunk/Source/JavaScriptCore/dfg/DFGLICMPhase.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGNodecpp">trunk/Source/JavaScriptCore/dfg/DFGNode.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGNodeh">trunk/Source/JavaScriptCore/dfg/DFGNode.h</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGObjectAllocationSinkingPhasecpp">trunk/Source/JavaScriptCore/dfg/DFGObjectAllocationSinkingPhase.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGPlancpp">trunk/Source/JavaScriptCore/dfg/DFGPlan.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGPlanh">trunk/Source/JavaScriptCore/dfg/DFGPlan.h</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGSSAConversionPhasecpp">trunk/Source/JavaScriptCore/dfg/DFGSSAConversionPhase.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGWorklistcpp">trunk/Source/JavaScriptCore/dfg/DFGWorklist.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeVMcpp">trunk/Source/JavaScriptCore/runtime/VM.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeVMh">trunk/Source/JavaScriptCore/runtime/VM.h</a></li>
</ul>

<h3>Added Paths</h3>
<ul>
<li><a href="#trunkSourceJavaScriptCoredfgDFGAllocatorh">trunk/Source/JavaScriptCore/dfg/DFGAllocator.h</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGLongLivedStatecpp">trunk/Source/JavaScriptCore/dfg/DFGLongLivedState.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGLongLivedStateh">trunk/Source/JavaScriptCore/dfg/DFGLongLivedState.h</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGNodeAllocatorh">trunk/Source/JavaScriptCore/dfg/DFGNodeAllocator.h</a></li>
</ul>

</div>
<div id="patch">
<h3>Diff</h3>
<a id="trunkSourceJavaScriptCoreCMakeListstxt"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/CMakeLists.txt (203703 => 203704)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/CMakeLists.txt        2016-07-26 00:27:54 UTC (rev 203703)
+++ trunk/Source/JavaScriptCore/CMakeLists.txt        2016-07-26 01:05:43 UTC (rev 203704)
</span><span class="lines">@@ -312,6 +312,7 @@
</span><span class="cx">     dfg/DFGLazyJSValue.cpp
</span><span class="cx">     dfg/DFGLazyNode.cpp
</span><span class="cx">     dfg/DFGLivenessAnalysisPhase.cpp
</span><ins>+    dfg/DFGLongLivedState.cpp
</ins><span class="cx">     dfg/DFGLoopPreHeaderCreationPhase.cpp
</span><span class="cx">     dfg/DFGMaximalFlushInsertionPhase.cpp
</span><span class="cx">     dfg/DFGMayExit.cpp
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreChangeLog"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/ChangeLog (203703 => 203704)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/ChangeLog        2016-07-26 00:27:54 UTC (rev 203703)
+++ trunk/Source/JavaScriptCore/ChangeLog        2016-07-26 01:05:43 UTC (rev 203704)
</span><span class="lines">@@ -1,3 +1,15 @@
</span><ins>+2016-07-25  Benjamin Poulain  &lt;benjamin@webkit.org&gt;
+
+        Unreviewed, rolling out r203703.
+
+        It breaks some internal tests
+
+        Reverted changeset:
+
+        &quot;[JSC] DFG::Node should not have its own allocator&quot;
+        https://bugs.webkit.org/show_bug.cgi?id=160098
+        http://trac.webkit.org/changeset/203703
+
</ins><span class="cx"> 2016-07-25  Benjamin Poulain  &lt;bpoulain@apple.com&gt;
</span><span class="cx"> 
</span><span class="cx">         [JSC] DFG::Node should not have its own allocator
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreJavaScriptCorexcodeprojprojectpbxproj"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj (203703 => 203704)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj        2016-07-26 00:27:54 UTC (rev 203703)
+++ trunk/Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj        2016-07-26 01:05:43 UTC (rev 203704)
</span><span class="lines">@@ -884,6 +884,8 @@
</span><span class="cx">                 0FEFC9AB1681A3B600567F53 /* DFGOSRExitJumpPlaceholder.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FEFC9A81681A3B000567F53 /* DFGOSRExitJumpPlaceholder.h */; };
</span><span class="cx">                 0FF054F91AC35B4400E5BE57 /* ExecutableAllocationFuzz.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0FF054F71AC35B4400E5BE57 /* ExecutableAllocationFuzz.cpp */; };
</span><span class="cx">                 0FF054FA1AC35B4400E5BE57 /* ExecutableAllocationFuzz.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FF054F81AC35B4400E5BE57 /* ExecutableAllocationFuzz.h */; settings = {ATTRIBUTES = (Private, ); }; };
</span><ins>+                0FF0F19916B729F6005DF95B /* DFGLongLivedState.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0FB4B51C16B62772003F696B /* DFGLongLivedState.cpp */; };
+                0FF0F19B16B729FA005DF95B /* DFGLongLivedState.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FB4B51D16B62772003F696B /* DFGLongLivedState.h */; };
</ins><span class="cx">                 0FF0F19C16B72A03005DF95B /* DFGNode.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0FB4B51E16B62772003F696B /* DFGNode.cpp */; };
</span><span class="cx">                 0FF0F19D16B72A08005DF95B /* DFGCommon.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0FB4B51A16B62772003F696B /* DFGCommon.cpp */; };
</span><span class="cx">                 0FF0F19E16B72A0B005DF95B /* DFGEdge.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0FB4B51B16B62772003F696B /* DFGEdge.cpp */; };
</span><span class="lines">@@ -936,7 +938,9 @@
</span><span class="cx">                 0FFA549816B8835300B3A982 /* A64DOpcode.h in Headers */ = {isa = PBXBuildFile; fileRef = 652A3A231651C69700A80AFE /* A64DOpcode.h */; settings = {ATTRIBUTES = (Private, ); }; };
</span><span class="cx">                 0FFB6C381AF48DDC00DB1BF7 /* TypeofType.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0FFB6C361AF48DDC00DB1BF7 /* TypeofType.cpp */; };
</span><span class="cx">                 0FFB6C391AF48DDC00DB1BF7 /* TypeofType.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FFB6C371AF48DDC00DB1BF7 /* TypeofType.h */; settings = {ATTRIBUTES = (Private, ); }; };
</span><ins>+                0FFB921816D02EB20055A5DB /* DFGAllocator.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FB4B51916B62772003F696B /* DFGAllocator.h */; };
</ins><span class="cx">                 0FFB921A16D02EC50055A5DB /* DFGBasicBlockInlines.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FD5652216AB780A00197653 /* DFGBasicBlockInlines.h */; };
</span><ins>+                0FFB921B16D02F010055A5DB /* DFGNodeAllocator.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FB4B51F16B62772003F696B /* DFGNodeAllocator.h */; };
</ins><span class="cx">                 0FFB921C16D02F110055A5DB /* DFGOSRExitCompilationInfo.h in Headers */ = {isa = PBXBuildFile; fileRef = 65987F2C167FE84B003C2F8D /* DFGOSRExitCompilationInfo.h */; };
</span><span class="cx">                 0FFB921D16D02F300055A5DB /* DFGSlowPathGenerator.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F1E3A501537C2CB000F9456 /* DFGSlowPathGenerator.h */; };
</span><span class="cx">                 0FFB922016D033B70055A5DB /* NodeConstructors.h in Headers */ = {isa = PBXBuildFile; fileRef = 930DAD030FB1EB1A0082D205 /* NodeConstructors.h */; settings = {ATTRIBUTES = (Private, ); }; };
</span><span class="lines">@@ -2787,9 +2791,13 @@
</span><span class="cx">                 0FB387911BFD31A100E3AB1E /* FTLCompile.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = FTLCompile.cpp; path = ftl/FTLCompile.cpp; sourceTree = &quot;&lt;group&gt;&quot;; };
</span><span class="cx">                 0FB438A219270B1D00E1FBC9 /* StructureSet.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = StructureSet.cpp; sourceTree = &quot;&lt;group&gt;&quot;; };
</span><span class="cx">                 0FB4B51016B3A964003F696B /* DFGMinifiedID.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGMinifiedID.h; path = dfg/DFGMinifiedID.h; sourceTree = &quot;&lt;group&gt;&quot;; };
</span><ins>+                0FB4B51916B62772003F696B /* DFGAllocator.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGAllocator.h; path = dfg/DFGAllocator.h; sourceTree = &quot;&lt;group&gt;&quot;; };
</ins><span class="cx">                 0FB4B51A16B62772003F696B /* DFGCommon.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGCommon.cpp; path = dfg/DFGCommon.cpp; sourceTree = &quot;&lt;group&gt;&quot;; };
</span><span class="cx">                 0FB4B51B16B62772003F696B /* DFGEdge.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGEdge.cpp; path = dfg/DFGEdge.cpp; sourceTree = &quot;&lt;group&gt;&quot;; };
</span><ins>+                0FB4B51C16B62772003F696B /* DFGLongLivedState.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGLongLivedState.cpp; path = dfg/DFGLongLivedState.cpp; sourceTree = &quot;&lt;group&gt;&quot;; };
+                0FB4B51D16B62772003F696B /* DFGLongLivedState.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGLongLivedState.h; path = dfg/DFGLongLivedState.h; sourceTree = &quot;&lt;group&gt;&quot;; };
</ins><span class="cx">                 0FB4B51E16B62772003F696B /* DFGNode.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGNode.cpp; path = dfg/DFGNode.cpp; sourceTree = &quot;&lt;group&gt;&quot;; };
</span><ins>+                0FB4B51F16B62772003F696B /* DFGNodeAllocator.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGNodeAllocator.h; path = dfg/DFGNodeAllocator.h; sourceTree = &quot;&lt;group&gt;&quot;; };
</ins><span class="cx">                 0FB4B52116B6278D003F696B /* FunctionExecutableDump.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = FunctionExecutableDump.cpp; sourceTree = &quot;&lt;group&gt;&quot;; };
</span><span class="cx">                 0FB4B52216B6278D003F696B /* FunctionExecutableDump.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = FunctionExecutableDump.h; sourceTree = &quot;&lt;group&gt;&quot;; };
</span><span class="cx">                 0FB4FB701BC843140025CA5A /* FTLLazySlowPath.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = FTLLazySlowPath.cpp; path = ftl/FTLLazySlowPath.cpp; sourceTree = &quot;&lt;group&gt;&quot;; };
</span><span class="lines">@@ -6187,6 +6195,7 @@
</span><span class="cx">                                 0F18D3CD1B55A6E0002C5C9F /* DFGAdaptiveStructureWatchpoint.cpp */,
</span><span class="cx">                                 0F18D3CE1B55A6E0002C5C9F /* DFGAdaptiveStructureWatchpoint.h */,
</span><span class="cx">                                 0F66E16814DF3F1300B7B2E4 /* DFGAdjacencyList.h */,
</span><ins>+                                0FB4B51916B62772003F696B /* DFGAllocator.h */,
</ins><span class="cx">                                 0F1E3A431534CBAD000F9456 /* DFGArgumentPosition.h */,
</span><span class="cx">                                 0F2DD80C1AB3D8BE00BBB8E8 /* DFGArgumentsEliminationPhase.cpp */,
</span><span class="cx">                                 0F2DD80D1AB3D8BE00BBB8E8 /* DFGArgumentsEliminationPhase.h */,
</span><span class="lines">@@ -6336,6 +6345,8 @@
</span><span class="cx">                                 79C4B15C1BA2158F00FD592E /* DFGLiveCatchVariablePreservationPhase.h */,
</span><span class="cx">                                 A7D89CEC17A0B8CC00773AD8 /* DFGLivenessAnalysisPhase.cpp */,
</span><span class="cx">                                 A7D89CED17A0B8CC00773AD8 /* DFGLivenessAnalysisPhase.h */,
</span><ins>+                                0FB4B51C16B62772003F696B /* DFGLongLivedState.cpp */,
+                                0FB4B51D16B62772003F696B /* DFGLongLivedState.h */,
</ins><span class="cx">                                 A767B5B317A0B9650063D940 /* DFGLoopPreHeaderCreationPhase.cpp */,
</span><span class="cx">                                 A767B5B417A0B9650063D940 /* DFGLoopPreHeaderCreationPhase.h */,
</span><span class="cx">                                 79F8FC1C1B9FED0F00CA66AB /* DFGMaximalFlushInsertionPhase.cpp */,
</span><span class="lines">@@ -6355,6 +6366,7 @@
</span><span class="cx">                                 A737810B1799EA2E00817533 /* DFGNaturalLoops.h */,
</span><span class="cx">                                 0FB4B51E16B62772003F696B /* DFGNode.cpp */,
</span><span class="cx">                                 86ECA3E9132DEF1C002B2AD7 /* DFGNode.h */,
</span><ins>+                                0FB4B51F16B62772003F696B /* DFGNodeAllocator.h */,
</ins><span class="cx">                                 0FA581B7150E952A00B9A2D9 /* DFGNodeFlags.cpp */,
</span><span class="cx">                                 0FA581B8150E952A00B9A2D9 /* DFGNodeFlags.h */,
</span><span class="cx">                                 0F5D085C1B8CF99D001143B4 /* DFGNodeOrigin.cpp */,
</span><span class="lines">@@ -7292,6 +7304,7 @@
</span><span class="cx">                                 998ED6751BED768C00DD8017 /* RemoteControllableTarget.h in Headers */,
</span><span class="cx">                                 0F33FCF81C136E2500323F67 /* B3StackmapGenerationParams.h in Headers */,
</span><span class="cx">                                 0F66E16B14DF3F1600B7B2E4 /* DFGAdjacencyList.h in Headers */,
</span><ins>+                                0FFB921816D02EB20055A5DB /* DFGAllocator.h in Headers */,
</ins><span class="cx">                                 0F1E3A461534CBAF000F9456 /* DFGArgumentPosition.h in Headers */,
</span><span class="cx">                                 0F2DD8121AB3D8BE00BBB8E8 /* DFGArgumentsEliminationPhase.h in Headers */,
</span><span class="cx">                                 0F2DD8141AB3D8BE00BBB8E8 /* DFGArgumentsUtilities.h in Headers */,
</span><span class="lines">@@ -7388,6 +7401,7 @@
</span><span class="cx">                                 99D6A1161BEAD34D00E25C37 /* RemoteAutomationTarget.h in Headers */,
</span><span class="cx">                                 79C4B15E1BA2158F00FD592E /* DFGLiveCatchVariablePreservationPhase.h in Headers */,
</span><span class="cx">                                 A7D89CFC17A0B8CC00773AD8 /* DFGLivenessAnalysisPhase.h in Headers */,
</span><ins>+                                0FF0F19B16B729FA005DF95B /* DFGLongLivedState.h in Headers */,
</ins><span class="cx">                                 0F338DF21BE93AD10013C88F /* B3StackmapValue.h in Headers */,
</span><span class="cx">                                 A767B5B617A0B9650063D940 /* DFGLoopPreHeaderCreationPhase.h in Headers */,
</span><span class="cx">                                 79F8FC1F1B9FED0F00CA66AB /* DFGMaximalFlushInsertionPhase.h in Headers */,
</span><span class="lines">@@ -7400,6 +7414,7 @@
</span><span class="cx">                                 0FF2CD5C1B61A4F8004955A8 /* DFGMultiGetByOffsetData.h in Headers */,
</span><span class="cx">                                 A737810E1799EA2E00817533 /* DFGNaturalLoops.h in Headers */,
</span><span class="cx">                                 86ECA3EA132DEF1C002B2AD7 /* DFGNode.h in Headers */,
</span><ins>+                                0FFB921B16D02F010055A5DB /* DFGNodeAllocator.h in Headers */,
</ins><span class="cx">                                 70B791931C024A28002481E2 /* GeneratorFrame.h in Headers */,
</span><span class="cx">                                 0FA581BB150E953000B9A2D9 /* DFGNodeFlags.h in Headers */,
</span><span class="cx">                                 0F300B7818AB051100A6D72E /* DFGNodeOrigin.h in Headers */,
</span><span class="lines">@@ -8945,6 +8960,7 @@
</span><span class="cx">                                 A7D9A29717A0BC7400EE2618 /* DFGLICMPhase.cpp in Sources */,
</span><span class="cx">                                 79C4B15D1BA2158F00FD592E /* DFGLiveCatchVariablePreservationPhase.cpp in Sources */,
</span><span class="cx">                                 A7D89CFB17A0B8CC00773AD8 /* DFGLivenessAnalysisPhase.cpp in Sources */,
</span><ins>+                                0FF0F19916B729F6005DF95B /* DFGLongLivedState.cpp in Sources */,
</ins><span class="cx">                                 A767B5B517A0B9650063D940 /* DFGLoopPreHeaderCreationPhase.cpp in Sources */,
</span><span class="cx">                                 79F8FC1E1B9FED0F00CA66AB /* DFGMaximalFlushInsertionPhase.cpp in Sources */,
</span><span class="cx">                                 0F5874ED194FEB1200AAB2C1 /* DFGMayExit.cpp in Sources */,
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreb3B3SparseCollectionh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/b3/B3SparseCollection.h (203703 => 203704)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/b3/B3SparseCollection.h        2016-07-26 00:27:54 UTC (rev 203703)
+++ trunk/Source/JavaScriptCore/b3/B3SparseCollection.h        2016-07-26 01:05:43 UTC (rev 203704)
</span><span class="lines">@@ -26,6 +26,8 @@
</span><span class="cx"> #ifndef B3SparseCollection_h
</span><span class="cx"> #define B3SparseCollection_h
</span><span class="cx"> 
</span><ins>+#if ENABLE(B3_JIT)
+
</ins><span class="cx"> #include &lt;wtf/StdLibExtras.h&gt;
</span><span class="cx"> #include &lt;wtf/Vector.h&gt;
</span><span class="cx"> 
</span><span class="lines">@@ -138,5 +140,7 @@
</span><span class="cx"> 
</span><span class="cx"> } } // namespace JSC::B3
</span><span class="cx"> 
</span><ins>+#endif // ENABLE(B3_JIT)
+
</ins><span class="cx"> #endif // B3SparseCollection_h
</span><span class="cx"> 
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGAllocatorhfromrev203702trunkSourceJavaScriptCoredfgDFGAllocatorh"></a>
<div class="copfile"><h4>Copied: trunk/Source/JavaScriptCore/dfg/DFGAllocator.h (from rev 203702, trunk/Source/JavaScriptCore/dfg/DFGAllocator.h) (0 => 203704)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGAllocator.h                                (rev 0)
+++ trunk/Source/JavaScriptCore/dfg/DFGAllocator.h        2016-07-26 01:05:43 UTC (rev 203704)
</span><span class="lines">@@ -0,0 +1,239 @@
</span><ins>+/*
+ * Copyright (C) 2013 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef DFGAllocator_h
+#define DFGAllocator_h
+
+#if ENABLE(DFG_JIT)
+
+#include &quot;DFGCommon.h&quot;
+#include &lt;wtf/StdLibExtras.h&gt;
+
+namespace JSC { namespace DFG {
+
+// Custom pool allocator for exactly one type (type T). It has fast (O(1), only a few
+// instructions) allocator, and a similarly fast free(). Recycling works if either of
+// the following is true:
+// - T has a trivial destructor. In that case you don't have to ever call free() on
+//   anything. You can just call freeAll() instead.
+// - You call free() on all T's that you allocated, and never use freeAll().
+
+template&lt;typename T&gt;
+class Allocator {
+public:
+    Allocator();
+    ~Allocator();
+    
+    void* allocate(); // Use placement new to allocate, and avoid using this method.
+    void free(T*); // Call this method to delete; never use 'delete' directly.
+    
+    void freeAll(); // Only call this if you've either freed everything or if T has a trivial destructor.
+    void reset(); // Like freeAll(), but also returns all memory to the OS.
+    
+    unsigned indexOf(const T*);
+    
+    static Allocator* allocatorOf(const T*);
+    
+private:
+    void* bumpAllocate();
+    void* freeListAllocate();
+    void* allocateSlow();
+
+    struct Region {
+        static size_t size() { return 64 * KB; }
+        static size_t headerSize() { return std::max(sizeof(Region), sizeof(T)); }
+        static unsigned numberOfThingsPerRegion() { return (size() - headerSize()) / sizeof(T); }
+        T* data() { return bitwise_cast&lt;T*&gt;(bitwise_cast&lt;char*&gt;(this) + headerSize()); }
+        bool isInThisRegion(const T* pointer) { return static_cast&lt;unsigned&gt;(pointer - data()) &lt; numberOfThingsPerRegion(); }
+        static Region* regionFor(const T* pointer) { return bitwise_cast&lt;Region*&gt;(bitwise_cast&lt;uintptr_t&gt;(pointer) &amp; ~(size() - 1)); }
+        
+        void* m_allocation;
+        Allocator* m_allocator;
+        Region* m_next;
+    };
+    
+    void freeRegionsStartingAt(Region*);
+    void startBumpingIn(Region*);
+    
+    Region* m_regionHead;
+    void** m_freeListHead;
+    T* m_bumpEnd;
+    unsigned m_bumpRemaining;
+};
+
+template&lt;typename T&gt;
+inline Allocator&lt;T&gt;::Allocator()
+    : m_regionHead(0)
+    , m_freeListHead(0)
+    , m_bumpRemaining(0)
+{
+}
+
+template&lt;typename T&gt;
+inline Allocator&lt;T&gt;::~Allocator()
+{
+    reset();
+}
+
+template&lt;typename T&gt;
+ALWAYS_INLINE void* Allocator&lt;T&gt;::allocate()
+{
+    void* result = bumpAllocate();
+    if (LIKELY(!!result))
+        return result;
+    return freeListAllocate();
+}
+
+template&lt;typename T&gt;
+void Allocator&lt;T&gt;::free(T* object)
+{
+    object-&gt;~T();
+    
+    void** cell = bitwise_cast&lt;void**&gt;(object);
+    *cell = m_freeListHead;
+    m_freeListHead = cell;
+}
+
+template&lt;typename T&gt;
+void Allocator&lt;T&gt;::freeAll()
+{
+    if (!m_regionHead) {
+        ASSERT(!m_bumpRemaining);
+        ASSERT(!m_freeListHead);
+        return;
+    }
+    
+    // Since the caller is opting out of calling the destructor for any allocated thing,
+    // we have two choices, plus a continuum between: we can either just delete all regions
+    // (i.e. call reset()), or we can make all regions available for reuse. We do something
+    // that optimizes for (a) speed of freeAll(), (b) the assumption that if the user calls
+    // freeAll() then they will probably be calling allocate() in the near future. Namely,
+    // we free all but one region, and make the remaining region a bump allocation region.
+    
+    freeRegionsStartingAt(m_regionHead-&gt;m_next);
+    
+    m_regionHead-&gt;m_next = 0;
+    m_freeListHead = 0;
+    startBumpingIn(m_regionHead);
+}
+
+template&lt;typename T&gt;
+void Allocator&lt;T&gt;::reset()
+{
+    freeRegionsStartingAt(m_regionHead);
+    
+    m_regionHead = 0;
+    m_freeListHead = 0;
+    m_bumpRemaining = 0;
+}
+
+template&lt;typename T&gt;
+unsigned Allocator&lt;T&gt;::indexOf(const T* object)
+{
+    unsigned numRegions = 0;
+    for (Region* region = m_regionHead; region; region = region-&gt;m_next)
+        numRegions++;
+    unsigned regionIndex = 0;
+    for (Region* region = m_regionHead; region; region = region-&gt;m_next) {
+        if (region-&gt;isInThisRegion(object))
+            return (numRegions - 1 - regionIndex) * Region::numberOfThingsPerRegion() + (object - region-&gt;data());
+        regionIndex++;
+    }
+    CRASH();
+    return 0;
+}
+
+template&lt;typename T&gt;
+Allocator&lt;T&gt;* Allocator&lt;T&gt;::allocatorOf(const T* object)
+{
+    return Region::regionFor(object)-&gt;m_allocator;
+}
+
+template&lt;typename T&gt;
+ALWAYS_INLINE void* Allocator&lt;T&gt;::bumpAllocate()
+{
+    if (unsigned remaining = m_bumpRemaining) {
+        remaining--;
+        m_bumpRemaining = remaining;
+        return m_bumpEnd - (remaining + 1);
+    }
+    return 0;
+}
+
+template&lt;typename T&gt;
+void* Allocator&lt;T&gt;::freeListAllocate()
+{
+    void** result = m_freeListHead;
+    if (UNLIKELY(!result))
+        return allocateSlow();
+    m_freeListHead = bitwise_cast&lt;void**&gt;(*result);
+    return result;
+}
+
+template&lt;typename T&gt;
+void* Allocator&lt;T&gt;::allocateSlow()
+{
+    ASSERT(!m_freeListHead);
+    ASSERT(!m_bumpRemaining);
+    
+    if (logCompilationChanges())
+        dataLog(&quot;Allocating another allocator region.\n&quot;);
+
+    void* allocation = fastAlignedMalloc(Region::size(), Region::size());
+    Region* region = static_cast&lt;Region*&gt;(allocation);
+    region-&gt;m_allocation = allocation;
+    region-&gt;m_allocator = this;
+    startBumpingIn(region);
+    region-&gt;m_next = m_regionHead;
+    m_regionHead = region;
+    
+    void* result = bumpAllocate();
+    ASSERT(result);
+    return result;
+}
+
+template&lt;typename T&gt;
+void Allocator&lt;T&gt;::freeRegionsStartingAt(typename Allocator&lt;T&gt;::Region* region)
+{
+    while (region) {
+        Region* nextRegion = region-&gt;m_next;
+        fastAlignedFree(region-&gt;m_allocation);
+        region = nextRegion;
+    }
+}
+
+template&lt;typename T&gt;
+void Allocator&lt;T&gt;::startBumpingIn(typename Allocator&lt;T&gt;::Region* region)
+{
+    m_bumpEnd = region-&gt;data() + Region::numberOfThingsPerRegion();
+    m_bumpRemaining = Region::numberOfThingsPerRegion();
+}
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
+
+#endif // DFGAllocator_h
+
</ins></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGByteCodeParsercpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp (203703 => 203704)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp        2016-07-26 00:27:54 UTC (rev 203703)
+++ trunk/Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp        2016-07-26 01:05:43 UTC (rev 203704)
</span><span class="lines">@@ -712,7 +712,7 @@
</span><span class="cx">     Node* addToGraph(NodeType op, Node* child1 = 0, Node* child2 = 0, Node* child3 = 0)
</span><span class="cx">     {
</span><span class="cx">         Node* result = m_graph.addNode(
</span><del>-            op, currentNodeOrigin(), Edge(child1), Edge(child2),
</del><ins>+            SpecNone, op, currentNodeOrigin(), Edge(child1), Edge(child2),
</ins><span class="cx">             Edge(child3));
</span><span class="cx">         return addToGraph(result);
</span><span class="cx">     }
</span><span class="lines">@@ -719,25 +719,25 @@
</span><span class="cx">     Node* addToGraph(NodeType op, Edge child1, Edge child2 = Edge(), Edge child3 = Edge())
</span><span class="cx">     {
</span><span class="cx">         Node* result = m_graph.addNode(
</span><del>-            op, currentNodeOrigin(), child1, child2, child3);
</del><ins>+            SpecNone, op, currentNodeOrigin(), child1, child2, child3);
</ins><span class="cx">         return addToGraph(result);
</span><span class="cx">     }
</span><span class="cx">     Node* addToGraph(NodeType op, OpInfo info, Node* child1 = 0, Node* child2 = 0, Node* child3 = 0)
</span><span class="cx">     {
</span><span class="cx">         Node* result = m_graph.addNode(
</span><del>-            op, currentNodeOrigin(), info, Edge(child1), Edge(child2),
</del><ins>+            SpecNone, op, currentNodeOrigin(), info, Edge(child1), Edge(child2),
</ins><span class="cx">             Edge(child3));
</span><span class="cx">         return addToGraph(result);
</span><span class="cx">     }
</span><span class="cx">     Node* addToGraph(NodeType op, OpInfo info, Edge child1, Edge child2 = Edge(), Edge child3 = Edge())
</span><span class="cx">     {
</span><del>-        Node* result = m_graph.addNode(op, currentNodeOrigin(), info, child1, child2, child3);
</del><ins>+        Node* result = m_graph.addNode(SpecNone, op, currentNodeOrigin(), info, child1, child2, child3);
</ins><span class="cx">         return addToGraph(result);
</span><span class="cx">     }
</span><span class="cx">     Node* addToGraph(NodeType op, OpInfo info1, OpInfo info2, Node* child1 = 0, Node* child2 = 0, Node* child3 = 0)
</span><span class="cx">     {
</span><span class="cx">         Node* result = m_graph.addNode(
</span><del>-            op, currentNodeOrigin(), info1, info2,
</del><ins>+            SpecNone, op, currentNodeOrigin(), info1, info2,
</ins><span class="cx">             Edge(child1), Edge(child2), Edge(child3));
</span><span class="cx">         return addToGraph(result);
</span><span class="cx">     }
</span><span class="lines">@@ -744,7 +744,7 @@
</span><span class="cx">     Node* addToGraph(NodeType op, OpInfo info1, OpInfo info2, Edge child1, Edge child2 = Edge(), Edge child3 = Edge())
</span><span class="cx">     {
</span><span class="cx">         Node* result = m_graph.addNode(
</span><del>-            op, currentNodeOrigin(), info1, info2, child1, child2, child3);
</del><ins>+            SpecNone, op, currentNodeOrigin(), info1, info2, child1, child2, child3);
</ins><span class="cx">         return addToGraph(result);
</span><span class="cx">     }
</span><span class="cx">     
</span><span class="lines">@@ -751,7 +751,7 @@
</span><span class="cx">     Node* addToGraph(Node::VarArgTag, NodeType op, OpInfo info1, OpInfo info2)
</span><span class="cx">     {
</span><span class="cx">         Node* result = m_graph.addNode(
</span><del>-            Node::VarArg, op, currentNodeOrigin(), info1, info2,
</del><ins>+            SpecNone, Node::VarArg, op, currentNodeOrigin(), info1, info2,
</ins><span class="cx">             m_graph.m_varArgChildren.size() - m_numPassedVarArgs, m_numPassedVarArgs);
</span><span class="cx">         addToGraph(result);
</span><span class="cx">         
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGCPSRethreadingPhasecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGCPSRethreadingPhase.cpp (203703 => 203704)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGCPSRethreadingPhase.cpp        2016-07-26 00:27:54 UTC (rev 203703)
+++ trunk/Source/JavaScriptCore/dfg/DFGCPSRethreadingPhase.cpp        2016-07-26 01:05:43 UTC (rev 203704)
</span><span class="lines">@@ -90,7 +90,7 @@
</span><span class="cx">                     break;
</span><span class="cx">                 case Phantom:
</span><span class="cx">                     if (!node-&gt;child1()) {
</span><del>-                        m_graph.deleteNode(node);
</del><ins>+                        m_graph.m_allocator.free(node);
</ins><span class="cx">                         continue;
</span><span class="cx">                     }
</span><span class="cx">                     switch (node-&gt;child1()-&gt;op()) {
</span><span class="lines">@@ -112,7 +112,7 @@
</span><span class="cx">             block-&gt;resize(toIndex);
</span><span class="cx">             
</span><span class="cx">             for (unsigned phiIndex = block-&gt;phis.size(); phiIndex--;)
</span><del>-                m_graph.deleteNode(block-&gt;phis[phiIndex]);
</del><ins>+                m_graph.m_allocator.free(block-&gt;phis[phiIndex]);
</ins><span class="cx">             block-&gt;phis.resize(0);
</span><span class="cx">         }
</span><span class="cx">     }
</span><span class="lines">@@ -132,7 +132,7 @@
</span><span class="cx">     
</span><span class="cx">     ALWAYS_INLINE Node* addPhiSilently(BasicBlock* block, const NodeOrigin&amp; origin, VariableAccessData* variable)
</span><span class="cx">     {
</span><del>-        Node* result = m_graph.addNode(Phi, origin, OpInfo(variable));
</del><ins>+        Node* result = m_graph.addNode(SpecNone, Phi, origin, OpInfo(variable));
</ins><span class="cx">         block-&gt;phis.append(result);
</span><span class="cx">         return result;
</span><span class="cx">     }
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGCleanUpPhasecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGCleanUpPhase.cpp (203703 => 203704)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGCleanUpPhase.cpp        2016-07-26 00:27:54 UTC (rev 203703)
+++ trunk/Source/JavaScriptCore/dfg/DFGCleanUpPhase.cpp        2016-07-26 01:05:43 UTC (rev 203704)
</span><span class="lines">@@ -69,7 +69,7 @@
</span><span class="cx">                 }
</span><span class="cx">                 
</span><span class="cx">                 if (kill)
</span><del>-                    m_graph.deleteNode(node);
</del><ins>+                    m_graph.m_allocator.free(node);
</ins><span class="cx">                 else
</span><span class="cx">                     block-&gt;at(targetIndex++) = node;
</span><span class="cx">             }
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGConstantFoldingPhasecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGConstantFoldingPhase.cpp (203703 => 203704)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGConstantFoldingPhase.cpp        2016-07-26 00:27:54 UTC (rev 203703)
+++ trunk/Source/JavaScriptCore/dfg/DFGConstantFoldingPhase.cpp        2016-07-26 01:05:43 UTC (rev 203704)
</span><span class="lines">@@ -83,7 +83,7 @@
</span><span class="cx">                     if (!m_state.isValid()) {
</span><span class="cx">                         NodeOrigin origin = block-&gt;at(nodeIndex)-&gt;origin;
</span><span class="cx">                         for (unsigned killIndex = nodeIndex; killIndex &lt; block-&gt;size(); ++killIndex)
</span><del>-                            m_graph.deleteNode(block-&gt;at(killIndex));
</del><ins>+                            m_graph.m_allocator.free(block-&gt;at(killIndex));
</ins><span class="cx">                         block-&gt;resize(nodeIndex);
</span><span class="cx">                         block-&gt;appendNode(m_graph, SpecNone, Unreachable, origin);
</span><span class="cx">                         didClipBlock = true;
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGConstantHoistingPhasecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGConstantHoistingPhase.cpp (203703 => 203704)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGConstantHoistingPhase.cpp        2016-07-26 00:27:54 UTC (rev 203703)
+++ trunk/Source/JavaScriptCore/dfg/DFGConstantHoistingPhase.cpp        2016-07-26 01:05:43 UTC (rev 203704)
</span><span class="lines">@@ -129,7 +129,7 @@
</span><span class="cx">         
</span><span class="cx">         // And finally free the constants that we removed.
</span><span class="cx">         for (Node* node : toFree)
</span><del>-            m_graph.deleteNode(node);
</del><ins>+            m_graph.m_allocator.free(node);
</ins><span class="cx">         
</span><span class="cx">         return true;
</span><span class="cx">     }
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGDCEPhasecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGDCEPhase.cpp (203703 => 203704)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGDCEPhase.cpp        2016-07-26 00:27:54 UTC (rev 203703)
+++ trunk/Source/JavaScriptCore/dfg/DFGDCEPhase.cpp        2016-07-26 01:05:43 UTC (rev 203704)
</span><span class="lines">@@ -93,7 +93,7 @@
</span><span class="cx">             for (unsigned phiIndex = 0; phiIndex &lt; block-&gt;phis.size(); ++phiIndex) {
</span><span class="cx">                 Node* phi = block-&gt;phis[phiIndex];
</span><span class="cx">                 if (!phi-&gt;shouldGenerate()) {
</span><del>-                    m_graph.deleteNode(phi);
</del><ins>+                    m_graph.m_allocator.free(phi);
</ins><span class="cx">                     block-&gt;phis[phiIndex--] = block-&gt;phis.last();
</span><span class="cx">                     block-&gt;phis.removeLast();
</span><span class="cx">                 }
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGDrivercpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGDriver.cpp (203703 => 203704)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGDriver.cpp        2016-07-26 00:27:54 UTC (rev 203703)
+++ trunk/Source/JavaScriptCore/dfg/DFGDriver.cpp        2016-07-26 01:05:43 UTC (rev 203704)
</span><span class="lines">@@ -108,7 +108,7 @@
</span><span class="cx">         return CompilationDeferred;
</span><span class="cx">     }
</span><span class="cx">     
</span><del>-    plan-&gt;compileInThread(nullptr);
</del><ins>+    plan-&gt;compileInThread(*vm.dfgState, 0);
</ins><span class="cx">     return plan-&gt;finalizeWithoutNotifyingCallback();
</span><span class="cx"> }
</span><span class="cx"> #else // ENABLE(DFG_JIT)
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGGraphcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGGraph.cpp (203703 => 203704)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGGraph.cpp        2016-07-26 00:27:54 UTC (rev 203703)
+++ trunk/Source/JavaScriptCore/dfg/DFGGraph.cpp        2016-07-26 01:05:43 UTC (rev 203704)
</span><span class="lines">@@ -66,11 +66,12 @@
</span><span class="cx"> #undef STRINGIZE_DFG_OP_ENUM
</span><span class="cx"> };
</span><span class="cx"> 
</span><del>-Graph::Graph(VM&amp; vm, Plan&amp; plan)
</del><ins>+Graph::Graph(VM&amp; vm, Plan&amp; plan, LongLivedState&amp; longLivedState)
</ins><span class="cx">     : m_vm(vm)
</span><span class="cx">     , m_plan(plan)
</span><span class="cx">     , m_codeBlock(m_plan.codeBlock)
</span><span class="cx">     , m_profiledBlock(m_codeBlock-&gt;alternative())
</span><ins>+    , m_allocator(longLivedState.m_allocator)
</ins><span class="cx">     , m_cfg(std::make_unique&lt;CFG&gt;(*this))
</span><span class="cx">     , m_nextMachineLocal(0)
</span><span class="cx">     , m_fixpointState(BeforeFixpoint)
</span><span class="lines">@@ -86,6 +87,17 @@
</span><span class="cx"> 
</span><span class="cx"> Graph::~Graph()
</span><span class="cx"> {
</span><ins>+    for (BlockIndex blockIndex = numBlocks(); blockIndex--;) {
+        BasicBlock* block = this-&gt;block(blockIndex);
+        if (!block)
+            continue;
+
+        for (unsigned phiIndex = block-&gt;phis.size(); phiIndex--;)
+            m_allocator.free(block-&gt;phis[phiIndex]);
+        for (unsigned nodeIndex = block-&gt;size(); nodeIndex--;)
+            m_allocator.free(block-&gt;at(nodeIndex));
+    }
+    m_allocator.freeAll();
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> const char *Graph::opName(NodeType op)
</span><span class="lines">@@ -567,11 +579,6 @@
</span><span class="cx">     }
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-void Graph::deleteNode(Node* node)
-{
-    m_nodes.remove(node);
-}
-
</del><span class="cx"> void Graph::dethread()
</span><span class="cx"> {
</span><span class="cx">     if (m_form == LoadStore || m_form == SSA)
</span><span class="lines">@@ -738,9 +745,9 @@
</span><span class="cx"> void Graph::killBlockAndItsContents(BasicBlock* block)
</span><span class="cx"> {
</span><span class="cx">     for (unsigned phiIndex = block-&gt;phis.size(); phiIndex--;)
</span><del>-        deleteNode(block-&gt;phis[phiIndex]);
-    for (Node* node : *block)
-        deleteNode(node);
</del><ins>+        m_allocator.free(block-&gt;phis[phiIndex]);
+    for (unsigned nodeIndex = block-&gt;size(); nodeIndex--;)
+        m_allocator.free(block-&gt;at(nodeIndex));
</ins><span class="cx">     
</span><span class="cx">     killBlock(block);
</span><span class="cx"> }
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGGraphh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGGraph.h (203703 => 203704)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGGraph.h        2016-07-26 00:27:54 UTC (rev 203703)
+++ trunk/Source/JavaScriptCore/dfg/DFGGraph.h        2016-07-26 01:05:43 UTC (rev 203704)
</span><span class="lines">@@ -29,13 +29,14 @@
</span><span class="cx"> #if ENABLE(DFG_JIT)
</span><span class="cx"> 
</span><span class="cx"> #include &quot;AssemblyHelpers.h&quot;
</span><del>-#include &quot;B3SparseCollection.h&quot;
</del><span class="cx"> #include &quot;BytecodeLivenessAnalysisInlines.h&quot;
</span><span class="cx"> #include &quot;CodeBlock.h&quot;
</span><span class="cx"> #include &quot;DFGArgumentPosition.h&quot;
</span><span class="cx"> #include &quot;DFGBasicBlock.h&quot;
</span><span class="cx"> #include &quot;DFGFrozenValue.h&quot;
</span><ins>+#include &quot;DFGLongLivedState.h&quot;
</ins><span class="cx"> #include &quot;DFGNode.h&quot;
</span><ins>+#include &quot;DFGNodeAllocator.h&quot;
</ins><span class="cx"> #include &quot;DFGPlan.h&quot;
</span><span class="cx"> #include &quot;DFGPropertyTypeKey.h&quot;
</span><span class="cx"> #include &quot;DFGScannable.h&quot;
</span><span class="lines">@@ -123,7 +124,7 @@
</span><span class="cx"> // Nodes that are 'dead' remain in the vector with refCount 0.
</span><span class="cx"> class Graph : public virtual Scannable {
</span><span class="cx"> public:
</span><del>-    Graph(VM&amp;, Plan&amp;);
</del><ins>+    Graph(VM&amp;, Plan&amp;, LongLivedState&amp;);
</ins><span class="cx">     ~Graph();
</span><span class="cx">     
</span><span class="cx">     void changeChild(Edge&amp; edge, Node* newNode)
</span><span class="lines">@@ -181,20 +182,12 @@
</span><span class="cx">     }
</span><span class="cx">     
</span><span class="cx">     template&lt;typename... Params&gt;
</span><del>-    Node* addNode(Params... params)
-    {
-        Node* node = new Node(params...);
-        m_nodes.add(std::unique_ptr&lt;Node&gt;(node));
-        return node;
-    }
-    template&lt;typename... Params&gt;
</del><span class="cx">     Node* addNode(SpeculatedType type, Params... params)
</span><span class="cx">     {
</span><del>-        Node* node = addNode(params...);
</del><ins>+        Node* node = new (m_allocator) Node(params...);
</ins><span class="cx">         node-&gt;predict(type);
</span><span class="cx">         return node;
</span><span class="cx">     }
</span><del>-    void deleteNode(Node*);
</del><span class="cx"> 
</span><span class="cx">     void dethread();
</span><span class="cx">     
</span><span class="lines">@@ -828,6 +821,8 @@
</span><span class="cx">     Plan&amp; m_plan;
</span><span class="cx">     CodeBlock* m_codeBlock;
</span><span class="cx">     CodeBlock* m_profiledBlock;
</span><ins>+    
+    NodeAllocator&amp; m_allocator;
</ins><span class="cx"> 
</span><span class="cx">     Vector&lt; RefPtr&lt;BasicBlock&gt; , 8&gt; m_blocks;
</span><span class="cx">     Vector&lt;Edge, 16&gt; m_varArgChildren;
</span><span class="lines">@@ -916,7 +911,6 @@
</span><span class="cx">     bool m_hasDebuggerEnabled;
</span><span class="cx">     bool m_hasExceptionHandlers { false };
</span><span class="cx"> private:
</span><del>-    void adoptNodeOutOfLine(Node&amp;);
</del><span class="cx"> 
</span><span class="cx">     bool isStringPrototypeMethodSane(JSGlobalObject*, UniquedStringImpl*);
</span><span class="cx"> 
</span><span class="lines">@@ -949,8 +943,6 @@
</span><span class="cx">         
</span><span class="cx">         return bytecodeCanTruncateInteger(add-&gt;arithNodeFlags()) ? SpeculateInt32AndTruncateConstants : DontSpeculateInt32;
</span><span class="cx">     }
</span><del>-
-    B3::SparseCollection&lt;Node&gt; m_nodes;
</del><span class="cx"> };
</span><span class="cx"> 
</span><span class="cx"> } } // namespace JSC::DFG
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGLICMPhasecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGLICMPhase.cpp (203703 => 203704)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGLICMPhase.cpp        2016-07-26 00:27:54 UTC (rev 203703)
+++ trunk/Source/JavaScriptCore/dfg/DFGLICMPhase.cpp        2016-07-26 01:05:43 UTC (rev 203704)
</span><span class="lines">@@ -341,7 +341,7 @@
</span><span class="cx">         // code. But for now we just assert that's the case.
</span><span class="cx">         DFG_ASSERT(m_graph, node, !(node-&gt;flags() &amp; NodeHasVarArgs));
</span><span class="cx">         
</span><del>-        nodeRef = m_graph.addNode(Check, originalOrigin, node-&gt;children);
</del><ins>+        nodeRef = m_graph.addNode(SpecNone, Check, originalOrigin, node-&gt;children);
</ins><span class="cx">         
</span><span class="cx">         return true;
</span><span class="cx">     }
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGLongLivedStatecppfromrev203702trunkSourceJavaScriptCoredfgDFGLongLivedStatecpp"></a>
<div class="copfile"><h4>Copied: trunk/Source/JavaScriptCore/dfg/DFGLongLivedState.cpp (from rev 203702, trunk/Source/JavaScriptCore/dfg/DFGLongLivedState.cpp) (0 => 203704)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGLongLivedState.cpp                                (rev 0)
+++ trunk/Source/JavaScriptCore/dfg/DFGLongLivedState.cpp        2016-07-26 01:05:43 UTC (rev 203704)
</span><span class="lines">@@ -0,0 +1,51 @@
</span><ins>+/*
+ * Copyright (C) 2013 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include &quot;config.h&quot;
+#include &quot;DFGLongLivedState.h&quot;
+
+#if ENABLE(DFG_JIT)
+
+#include &quot;JSCInlines.h&quot;
+
+namespace JSC { namespace DFG {
+
+LongLivedState::LongLivedState()
+{
+}
+
+LongLivedState::~LongLivedState()
+{
+}
+
+void LongLivedState::shrinkToFit()
+{
+    m_allocator.reset();
+}
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
+
</ins></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGLongLivedStatehfromrev203702trunkSourceJavaScriptCoredfgDFGLongLivedStateh"></a>
<div class="copfile"><h4>Copied: trunk/Source/JavaScriptCore/dfg/DFGLongLivedState.h (from rev 203702, trunk/Source/JavaScriptCore/dfg/DFGLongLivedState.h) (0 => 203704)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGLongLivedState.h                                (rev 0)
+++ trunk/Source/JavaScriptCore/dfg/DFGLongLivedState.h        2016-07-26 01:05:43 UTC (rev 203704)
</span><span class="lines">@@ -0,0 +1,53 @@
</span><ins>+/*
+ * Copyright (C) 2013 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef DFGLongLivedState_h
+#define DFGLongLivedState_h
+
+#if ENABLE(DFG_JIT)
+
+#include &quot;DFGNodeAllocator.h&quot;
+#include &lt;wtf/FastMalloc.h&gt;
+#include &lt;wtf/Noncopyable.h&gt;
+
+namespace JSC { namespace DFG {
+
+class LongLivedState {
+    WTF_MAKE_FAST_ALLOCATED; WTF_MAKE_NONCOPYABLE(LongLivedState);
+public:
+    LongLivedState();
+    ~LongLivedState();
+    
+    void shrinkToFit();
+    
+    NodeAllocator m_allocator;
+};
+
+} } // namespace JSC::DFG
+
+#endif // ENABLE(DFG_JIT)
+
+#endif // DFGLongLivedState_h
+
</ins></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGNodecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGNode.cpp (203703 => 203704)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGNode.cpp        2016-07-26 00:27:54 UTC (rev 203703)
+++ trunk/Source/JavaScriptCore/dfg/DFGNode.cpp        2016-07-26 01:05:43 UTC (rev 203704)
</span><span class="lines">@@ -29,6 +29,7 @@
</span><span class="cx"> #if ENABLE(DFG_JIT)
</span><span class="cx"> 
</span><span class="cx"> #include &quot;DFGGraph.h&quot;
</span><ins>+#include &quot;DFGNodeAllocator.h&quot;
</ins><span class="cx"> #include &quot;DFGPromotedHeapLocation.h&quot;
</span><span class="cx"> #include &quot;JSCInlines.h&quot;
</span><span class="cx"> 
</span><span class="lines">@@ -63,6 +64,11 @@
</span><span class="cx">         out.print(&quot;/w:&quot;, count);
</span><span class="cx"> }
</span><span class="cx"> 
</span><ins>+unsigned Node::index() const
+{
+    return NodeAllocator::allocatorOf(this)-&gt;indexOf(this);
+}
+
</ins><span class="cx"> bool Node::hasVariableAccessData(Graph&amp; graph)
</span><span class="cx"> {
</span><span class="cx">     switch (op()) {
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGNodeh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGNode.h (203703 => 203704)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGNode.h        2016-07-26 00:27:54 UTC (rev 203703)
+++ trunk/Source/JavaScriptCore/dfg/DFGNode.h        2016-07-26 01:05:43 UTC (rev 203704)
</span><span class="lines">@@ -28,7 +28,6 @@
</span><span class="cx"> 
</span><span class="cx"> #if ENABLE(DFG_JIT)
</span><span class="cx"> 
</span><del>-#include &quot;B3SparseCollection.h&quot;
</del><span class="cx"> #include &quot;BasicBlockLocation.h&quot;
</span><span class="cx"> #include &quot;CodeBlock.h&quot;
</span><span class="cx"> #include &quot;DFGAbstractValue.h&quot;
</span><span class="lines">@@ -231,8 +230,6 @@
</span><span class="cx"> //
</span><span class="cx"> // Node represents a single operation in the data flow graph.
</span><span class="cx"> struct Node {
</span><del>-    WTF_MAKE_FAST_ALLOCATED;
-public:
</del><span class="cx">     enum VarArgTag { VarArg };
</span><span class="cx">     
</span><span class="cx">     Node() { }
</span><span class="lines">@@ -349,9 +346,10 @@
</span><span class="cx">     
</span><span class="cx">     NodeType op() const { return static_cast&lt;NodeType&gt;(m_op); }
</span><span class="cx">     NodeFlags flags() const { return m_flags; }
</span><del>-
-    unsigned index() const { return m_index; }
</del><span class="cx">     
</span><ins>+    // This is not a fast method.
+    unsigned index() const;
+    
</ins><span class="cx">     void setOp(NodeType op)
</span><span class="cx">     {
</span><span class="cx">         m_op = op;
</span><span class="lines">@@ -2346,9 +2344,6 @@
</span><span class="cx">     AdjacencyList children;
</span><span class="cx"> 
</span><span class="cx"> private:
</span><del>-    friend class B3::SparseCollection&lt;Node&gt;;
-
-    unsigned m_index { std::numeric_limits&lt;unsigned&gt;::max() };
</del><span class="cx">     unsigned m_op : 10; // real type is NodeType
</span><span class="cx">     unsigned m_flags : 20;
</span><span class="cx">     // The virtual register number (spill location) associated with this .
</span><span class="lines">@@ -2356,7 +2351,7 @@
</span><span class="cx">     // The number of uses of the result of this operation (+1 for 'must generate' nodes, which have side-effects).
</span><span class="cx">     unsigned m_refCount;
</span><span class="cx">     // The prediction ascribed to this node after propagation.
</span><del>-    SpeculatedType m_prediction { SpecNone };
</del><ins>+    SpeculatedType m_prediction;
</ins><span class="cx">     // Immediate values, accesses type-checked via accessors above. The first one is
</span><span class="cx">     // big enough to store a pointer.
</span><span class="cx">     uintptr_t m_opInfo;
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGNodeAllocatorhfromrev203702trunkSourceJavaScriptCoredfgDFGNodeAllocatorh"></a>
<div class="copfile"><h4>Copied: trunk/Source/JavaScriptCore/dfg/DFGNodeAllocator.h (from rev 203702, trunk/Source/JavaScriptCore/dfg/DFGNodeAllocator.h) (0 => 203704)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGNodeAllocator.h                                (rev 0)
+++ trunk/Source/JavaScriptCore/dfg/DFGNodeAllocator.h        2016-07-26 01:05:43 UTC (rev 203704)
</span><span class="lines">@@ -0,0 +1,49 @@
</span><ins>+/*
+ * Copyright (C) 2013 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef DFGNodeAllocator_h
+#define DFGNodeAllocator_h
+
+#if ENABLE(DFG_JIT)
+
+#include &quot;DFGAllocator.h&quot;
+#include &quot;DFGNode.h&quot;
+
+namespace JSC { namespace DFG {
+
+typedef Allocator&lt;Node&gt; NodeAllocator;
+
+} } // namespace JSC::DFG
+
+inline void* operator new (size_t size, JSC::DFG::NodeAllocator&amp; allocator)
+{
+    ASSERT_UNUSED(size, size == sizeof(JSC::DFG::Node));
+    return allocator.allocate();
+}
+
+#endif // ENABLE(DFG_JIT)
+
+#endif // DFGNodeAllocator_h
+
</ins></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGObjectAllocationSinkingPhasecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGObjectAllocationSinkingPhase.cpp (203703 => 203704)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGObjectAllocationSinkingPhase.cpp        2016-07-26 00:27:54 UTC (rev 203703)
+++ trunk/Source/JavaScriptCore/dfg/DFGObjectAllocationSinkingPhase.cpp        2016-07-26 01:05:43 UTC (rev 203704)
</span><span class="lines">@@ -2102,6 +2102,7 @@
</span><span class="cx">                 data-&gt;identifierNumber = identifierNumber;
</span><span class="cx"> 
</span><span class="cx">                 return m_graph.addNode(
</span><ins>+                    SpecNone,
</ins><span class="cx">                     PutByOffset,
</span><span class="cx">                     origin.takeValidExit(canExit),
</span><span class="cx">                     OpInfo(data),
</span><span class="lines">@@ -2136,6 +2137,7 @@
</span><span class="cx">             }
</span><span class="cx"> 
</span><span class="cx">             return m_graph.addNode(
</span><ins>+                SpecNone,
</ins><span class="cx">                 MultiPutByOffset,
</span><span class="cx">                 origin.takeValidExit(canExit),
</span><span class="cx">                 OpInfo(data),
</span><span class="lines">@@ -2146,6 +2148,7 @@
</span><span class="cx"> 
</span><span class="cx">         case ClosureVarPLoc: {
</span><span class="cx">             return m_graph.addNode(
</span><ins>+                SpecNone,
</ins><span class="cx">                 PutClosureVar,
</span><span class="cx">                 origin.takeValidExit(canExit),
</span><span class="cx">                 OpInfo(location.info()),
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGPlancpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGPlan.cpp (203703 => 203704)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGPlan.cpp        2016-07-26 00:27:54 UTC (rev 203703)
+++ trunk/Source/JavaScriptCore/dfg/DFGPlan.cpp        2016-07-26 01:05:43 UTC (rev 203704)
</span><span class="lines">@@ -170,7 +170,7 @@
</span><span class="cx">         || (Options::reportFTLCompileTimes() &amp;&amp; isFTL(mode));
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-void Plan::compileInThread(ThreadData* threadData)
</del><ins>+void Plan::compileInThread(LongLivedState&amp; longLivedState, ThreadData* threadData)
</ins><span class="cx"> {
</span><span class="cx">     this-&gt;threadData = threadData;
</span><span class="cx">     
</span><span class="lines">@@ -186,7 +186,7 @@
</span><span class="cx">     if (logCompilationChanges(mode))
</span><span class="cx">         dataLog(&quot;DFG(Plan) compiling &quot;, *codeBlock, &quot; with &quot;, mode, &quot;, number of instructions = &quot;, codeBlock-&gt;instructionCount(), &quot;\n&quot;);
</span><span class="cx"> 
</span><del>-    CompilationPath path = compileInThreadImpl();
</del><ins>+    CompilationPath path = compileInThreadImpl(longLivedState);
</ins><span class="cx"> 
</span><span class="cx">     RELEASE_ASSERT(path == CancelPath || finalizer);
</span><span class="cx">     RELEASE_ASSERT((path == CancelPath) == (stage == Cancelled));
</span><span class="lines">@@ -236,7 +236,7 @@
</span><span class="cx">     }
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-Plan::CompilationPath Plan::compileInThreadImpl()
</del><ins>+Plan::CompilationPath Plan::compileInThreadImpl(LongLivedState&amp; longLivedState)
</ins><span class="cx"> {
</span><span class="cx">     cleanMustHandleValuesIfNecessary();
</span><span class="cx">     
</span><span class="lines">@@ -246,7 +246,7 @@
</span><span class="cx">         dataLog(&quot;\n&quot;);
</span><span class="cx">     }
</span><span class="cx">     
</span><del>-    Graph dfg(*vm, *this);
</del><ins>+    Graph dfg(*vm, *this, longLivedState);
</ins><span class="cx">     
</span><span class="cx">     if (!parse(dfg)) {
</span><span class="cx">         finalizer = std::make_unique&lt;FailedFinalizer&gt;(*this);
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGPlanh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGPlan.h (203703 => 203704)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGPlan.h        2016-07-26 00:27:54 UTC (rev 203703)
+++ trunk/Source/JavaScriptCore/dfg/DFGPlan.h        2016-07-26 01:05:43 UTC (rev 203704)
</span><span class="lines">@@ -48,6 +48,7 @@
</span><span class="cx"> 
</span><span class="cx"> namespace DFG {
</span><span class="cx"> 
</span><ins>+class LongLivedState;
</ins><span class="cx"> class ThreadData;
</span><span class="cx"> 
</span><span class="cx"> #if ENABLE(DFG_JIT)
</span><span class="lines">@@ -59,7 +60,7 @@
</span><span class="cx">         const Operands&lt;JSValue&gt;&amp; mustHandleValues);
</span><span class="cx">     ~Plan();
</span><span class="cx"> 
</span><del>-    void compileInThread(ThreadData*);
</del><ins>+    void compileInThread(LongLivedState&amp;, ThreadData*);
</ins><span class="cx">     
</span><span class="cx">     CompilationResult finalizeWithoutNotifyingCallback();
</span><span class="cx">     void finalizeAndNotifyCallback();
</span><span class="lines">@@ -120,7 +121,7 @@
</span><span class="cx">     bool reportCompileTimes() const;
</span><span class="cx">     
</span><span class="cx">     enum CompilationPath { FailPath, DFGPath, FTLPath, CancelPath };
</span><del>-    CompilationPath compileInThreadImpl();
</del><ins>+    CompilationPath compileInThreadImpl(LongLivedState&amp;);
</ins><span class="cx">     
</span><span class="cx">     bool isStillValid();
</span><span class="cx">     void reallyAdd(CommonData*);
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGSSAConversionPhasecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGSSAConversionPhase.cpp (203703 => 203704)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGSSAConversionPhase.cpp        2016-07-26 00:27:54 UTC (rev 203703)
+++ trunk/Source/JavaScriptCore/dfg/DFGSSAConversionPhase.cpp        2016-07-26 01:05:43 UTC (rev 203704)
</span><span class="lines">@@ -373,7 +373,7 @@
</span><span class="cx">             if (!block)
</span><span class="cx">                 continue;
</span><span class="cx">             for (unsigned phiIndex = block-&gt;phis.size(); phiIndex--;)
</span><del>-                m_graph.deleteNode(block-&gt;phis[phiIndex]);
</del><ins>+                m_graph.m_allocator.free(block-&gt;phis[phiIndex]);
</ins><span class="cx">             block-&gt;phis.clear();
</span><span class="cx">             block-&gt;variablesAtHead.clear();
</span><span class="cx">             block-&gt;variablesAtTail.clear();
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGWorklistcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGWorklist.cpp (203703 => 203704)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGWorklist.cpp        2016-07-26 00:27:54 UTC (rev 203703)
+++ trunk/Source/JavaScriptCore/dfg/DFGWorklist.cpp        2016-07-26 01:05:43 UTC (rev 203704)
</span><span class="lines">@@ -30,6 +30,7 @@
</span><span class="cx"> 
</span><span class="cx"> #include &quot;CodeBlock.h&quot;
</span><span class="cx"> #include &quot;DeferGC.h&quot;
</span><ins>+#include &quot;DFGLongLivedState.h&quot;
</ins><span class="cx"> #include &quot;DFGSafepoint.h&quot;
</span><span class="cx"> #include &quot;JSCInlines.h&quot;
</span><span class="cx"> #include &lt;mutex&gt;
</span><span class="lines">@@ -361,6 +362,8 @@
</span><span class="cx">     if (Options::verboseCompilationQueue())
</span><span class="cx">         dataLog(*this, &quot;: Thread started\n&quot;);
</span><span class="cx">     
</span><ins>+    LongLivedState longLivedState;
+    
</ins><span class="cx">     for (;;) {
</span><span class="cx">         RefPtr&lt;Plan&gt; plan;
</span><span class="cx">         {
</span><span class="lines">@@ -396,7 +399,7 @@
</span><span class="cx">                 dataLog(*this, &quot;: Compiling &quot;, plan-&gt;key(), &quot; asynchronously\n&quot;);
</span><span class="cx">         
</span><span class="cx">             RELEASE_ASSERT(!plan-&gt;vm-&gt;heap.isCollecting());
</span><del>-            plan-&gt;compileInThread(data);
</del><ins>+            plan-&gt;compileInThread(longLivedState, data);
</ins><span class="cx">             RELEASE_ASSERT(plan-&gt;stage == Plan::Cancelled || !plan-&gt;vm-&gt;heap.isCollecting());
</span><span class="cx">             
</span><span class="cx">             {
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeVMcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/VM.cpp (203703 => 203704)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/VM.cpp        2016-07-26 00:27:54 UTC (rev 203703)
+++ trunk/Source/JavaScriptCore/runtime/VM.cpp        2016-07-26 01:05:43 UTC (rev 203704)
</span><span class="lines">@@ -38,6 +38,7 @@
</span><span class="cx"> #include &quot;CommonIdentifiers.h&quot;
</span><span class="cx"> #include &quot;CommonSlowPaths.h&quot;
</span><span class="cx"> #include &quot;CustomGetterSetter.h&quot;
</span><ins>+#include &quot;DFGLongLivedState.h&quot;
</ins><span class="cx"> #include &quot;DFGWorklist.h&quot;
</span><span class="cx"> #include &quot;Disassembler.h&quot;
</span><span class="cx"> #include &quot;ErrorInstance.h&quot;
</span><span class="lines">@@ -289,6 +290,11 @@
</span><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     callFrameForCatch = nullptr;
</span><ins>+
+#if ENABLE(DFG_JIT)
+    if (canUseJIT())
+        dfgState = std::make_unique&lt;DFG::LongLivedState&gt;();
+#endif
</ins><span class="cx">     
</span><span class="cx">     // Initialize this last, as a free way of asserting that VM initialization itself
</span><span class="cx">     // won't use this.
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeVMh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/VM.h (203703 => 203704)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/VM.h        2016-07-26 00:27:54 UTC (rev 203703)
+++ trunk/Source/JavaScriptCore/runtime/VM.h        2016-07-26 01:05:43 UTC (rev 203704)
</span><span class="lines">@@ -119,6 +119,11 @@
</span><span class="cx"> class Watchpoint;
</span><span class="cx"> class WatchpointSet;
</span><span class="cx"> 
</span><ins>+#if ENABLE(DFG_JIT)
+namespace DFG {
+class LongLivedState;
+}
+#endif // ENABLE(DFG_JIT)
</ins><span class="cx"> #if ENABLE(FTL_JIT)
</span><span class="cx"> namespace FTL {
</span><span class="cx"> class Thunks;
</span><span class="lines">@@ -266,6 +271,10 @@
</span><span class="cx">     // destructed after all the objects that reference it.
</span><span class="cx">     Heap heap;
</span><span class="cx"> 
</span><ins>+#if ENABLE(DFG_JIT)
+    std::unique_ptr&lt;DFG::LongLivedState&gt; dfgState;
+#endif // ENABLE(DFG_JIT)
+
</ins><span class="cx">     VMType vmType;
</span><span class="cx">     ClientData* clientData;
</span><span class="cx">     VMEntryFrame* topVMEntryFrame;
</span></span></pre>
</div>
</div>

</body>
</html>