<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN"
"http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head><meta http-equiv="content-type" content="text/html; charset=utf-8" />
<title>[205654] trunk/Source</title>
</head>
<body>

<style type="text/css"><!--
#msg dl.meta { border: 1px #006 solid; background: #369; padding: 6px; color: #fff; }
#msg dl.meta dt { float: left; width: 6em; font-weight: bold; }
#msg dt:after { content:':';}
#msg dl, #msg dt, #msg ul, #msg li, #header, #footer, #logmsg { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt;  }
#msg dl a { font-weight: bold}
#msg dl a:link    { color:#fc3; }
#msg dl a:active  { color:#ff0; }
#msg dl a:visited { color:#cc6; }
h3 { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; font-weight: bold; }
#msg pre { overflow: auto; background: #ffc; border: 1px #fa0 solid; padding: 6px; }
#logmsg { background: #ffc; border: 1px #fa0 solid; padding: 1em 1em 0 1em; }
#logmsg p, #logmsg pre, #logmsg blockquote { margin: 0 0 1em 0; }
#logmsg p, #logmsg li, #logmsg dt, #logmsg dd { line-height: 14pt; }
#logmsg h1, #logmsg h2, #logmsg h3, #logmsg h4, #logmsg h5, #logmsg h6 { margin: .5em 0; }
#logmsg h1:first-child, #logmsg h2:first-child, #logmsg h3:first-child, #logmsg h4:first-child, #logmsg h5:first-child, #logmsg h6:first-child { margin-top: 0; }
#logmsg ul, #logmsg ol { padding: 0; list-style-position: inside; margin: 0 0 0 1em; }
#logmsg ul { text-indent: -1em; padding-left: 1em; }#logmsg ol { text-indent: -1.5em; padding-left: 1.5em; }
#logmsg > ul, #logmsg > ol { margin: 0 0 1em 0; }
#logmsg pre { background: #eee; padding: 1em; }
#logmsg blockquote { border: 1px solid #fa0; border-left-width: 10px; padding: 1em 1em 0 1em; background: white;}
#logmsg dl { margin: 0; }
#logmsg dt { font-weight: bold; }
#logmsg dd { margin: 0; padding: 0 0 0.5em 0; }
#logmsg dd:before { content:'\00bb';}
#logmsg table { border-spacing: 0px; border-collapse: collapse; border-top: 4px solid #fa0; border-bottom: 1px solid #fa0; background: #fff; }
#logmsg table th { text-align: left; font-weight: normal; padding: 0.2em 0.5em; border-top: 1px dotted #fa0; }
#logmsg table td { text-align: right; border-top: 1px dotted #fa0; padding: 0.2em 0.5em; }
#logmsg table thead th { text-align: center; border-bottom: 1px solid #fa0; }
#logmsg table th.Corner { text-align: left; }
#logmsg hr { border: none 0; border-top: 2px dashed #fa0; height: 1px; }
#header, #footer { color: #fff; background: #636; border: 1px #300 solid; padding: 6px; }
#patch { width: 100%; }
#patch h4 {font-family: verdana,arial,helvetica,sans-serif;font-size:10pt;padding:8px;background:#369;color:#fff;margin:0;}
#patch .propset h4, #patch .binary h4 {margin:0;}
#patch pre {padding:0;line-height:1.2em;margin:0;}
#patch .diff {width:100%;background:#eee;padding: 0 0 10px 0;overflow:auto;}
#patch .propset .diff, #patch .binary .diff  {padding:10px 0;}
#patch span {display:block;padding:0 10px;}
#patch .modfile, #patch .addfile, #patch .delfile, #patch .propset, #patch .binary, #patch .copfile {border:1px solid #ccc;margin:10px 0;}
#patch ins {background:#dfd;text-decoration:none;display:block;padding:0 10px;}
#patch del {background:#fdd;text-decoration:none;display:block;padding:0 10px;}
#patch .lines, .info {color:#888;background:#fff;}
--></style>
<div id="msg">
<dl class="meta">
<dt>Revision</dt> <dd><a href="http://trac.webkit.org/projects/webkit/changeset/205654">205654</a></dd>
<dt>Author</dt> <dd>fpizlo@apple.com</dd>
<dt>Date</dt> <dd>2016-09-08 11:59:02 -0700 (Thu, 08 Sep 2016)</dd>
</dl>

<h3>Log Message</h3>
<pre>Move JSMap/JSSet over to Auxiliary MarkedSpace
https://bugs.webkit.org/show_bug.cgi?id=161744

Reviewed by Saam Barati.
Source/JavaScriptCore:

        
This moves the buffer out of CopiedSpace and into Auxiliary MarkedSpace.
        
Also removes MapData.h/MapDataInlines.h since they are not used anywhere, but they still
speak of CopiedSpace.
        
This is a purely mechanical change.

* JavaScriptCore.xcodeproj/project.pbxproj:
* heap/CopyToken.h:
* runtime/HashMapImpl.cpp:
(JSC::HashMapImpl&lt;HashMapBucket&gt;::visitChildren):
(JSC::HashMapImpl&lt;HashMapBucket&gt;::copyBackingStore): Deleted.
* runtime/HashMapImpl.h:
(JSC::HashMapBuffer::create):
* runtime/JSMapIterator.cpp:
* runtime/JSMapIterator.h:
* runtime/JSSetIterator.cpp:
* runtime/JSSetIterator.h:
* runtime/MapBase.cpp:
* runtime/MapData.h: Removed.
* runtime/MapDataInlines.h: Removed.
* runtime/MapPrototype.cpp:
* runtime/SetConstructor.cpp:
* runtime/SetPrototype.cpp:
* runtime/VM.cpp:

Source/WebCore:


No new tests because no change in behavior.

* bindings/js/SerializedScriptValue.cpp:</pre>

<h3>Modified Paths</h3>
<ul>
<li><a href="#trunkSourceJavaScriptCoreChangeLog">trunk/Source/JavaScriptCore/ChangeLog</a></li>
<li><a href="#trunkSourceJavaScriptCoreJavaScriptCorexcodeprojprojectpbxproj">trunk/Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj</a></li>
<li><a href="#trunkSourceJavaScriptCoreheapCopyTokenh">trunk/Source/JavaScriptCore/heap/CopyToken.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeHashMapImplcpp">trunk/Source/JavaScriptCore/runtime/HashMapImpl.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeHashMapImplh">trunk/Source/JavaScriptCore/runtime/HashMapImpl.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeJSMapIteratorcpp">trunk/Source/JavaScriptCore/runtime/JSMapIterator.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeJSMapIteratorh">trunk/Source/JavaScriptCore/runtime/JSMapIterator.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeJSSetIteratorcpp">trunk/Source/JavaScriptCore/runtime/JSSetIterator.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeJSSetIteratorh">trunk/Source/JavaScriptCore/runtime/JSSetIterator.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeMapBasecpp">trunk/Source/JavaScriptCore/runtime/MapBase.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeMapPrototypecpp">trunk/Source/JavaScriptCore/runtime/MapPrototype.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeSetConstructorcpp">trunk/Source/JavaScriptCore/runtime/SetConstructor.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeSetPrototypecpp">trunk/Source/JavaScriptCore/runtime/SetPrototype.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeVMcpp">trunk/Source/JavaScriptCore/runtime/VM.cpp</a></li>
<li><a href="#trunkSourceWebCoreChangeLog">trunk/Source/WebCore/ChangeLog</a></li>
<li><a href="#trunkSourceWebCorebindingsjsSerializedScriptValuecpp">trunk/Source/WebCore/bindings/js/SerializedScriptValue.cpp</a></li>
</ul>

<h3>Removed Paths</h3>
<ul>
<li><a href="#trunkSourceJavaScriptCoreruntimeMapDatah">trunk/Source/JavaScriptCore/runtime/MapData.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeMapDataInlinesh">trunk/Source/JavaScriptCore/runtime/MapDataInlines.h</a></li>
</ul>

</div>
<div id="patch">
<h3>Diff</h3>
<a id="trunkSourceJavaScriptCoreChangeLog"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/ChangeLog (205653 => 205654)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/ChangeLog        2016-09-08 18:48:15 UTC (rev 205653)
+++ trunk/Source/JavaScriptCore/ChangeLog        2016-09-08 18:59:02 UTC (rev 205654)
</span><span class="lines">@@ -1,3 +1,36 @@
</span><ins>+2016-09-08  Filip Pizlo  &lt;fpizlo@apple.com&gt;
+
+        Move JSMap/JSSet over to Auxiliary MarkedSpace
+        https://bugs.webkit.org/show_bug.cgi?id=161744
+
+        Reviewed by Saam Barati.
+        
+        This moves the buffer out of CopiedSpace and into Auxiliary MarkedSpace.
+        
+        Also removes MapData.h/MapDataInlines.h since they are not used anywhere, but they still
+        speak of CopiedSpace.
+        
+        This is a purely mechanical change.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * heap/CopyToken.h:
+        * runtime/HashMapImpl.cpp:
+        (JSC::HashMapImpl&lt;HashMapBucket&gt;::visitChildren):
+        (JSC::HashMapImpl&lt;HashMapBucket&gt;::copyBackingStore): Deleted.
+        * runtime/HashMapImpl.h:
+        (JSC::HashMapBuffer::create):
+        * runtime/JSMapIterator.cpp:
+        * runtime/JSMapIterator.h:
+        * runtime/JSSetIterator.cpp:
+        * runtime/JSSetIterator.h:
+        * runtime/MapBase.cpp:
+        * runtime/MapData.h: Removed.
+        * runtime/MapDataInlines.h: Removed.
+        * runtime/MapPrototype.cpp:
+        * runtime/SetConstructor.cpp:
+        * runtime/SetPrototype.cpp:
+        * runtime/VM.cpp:
+
</ins><span class="cx"> 2016-09-06  Filip Pizlo  &lt;fpizlo@apple.com&gt;
</span><span class="cx"> 
</span><span class="cx">         Typed arrays should use MarkedSpace instead of CopiedSpace
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreJavaScriptCorexcodeprojprojectpbxproj"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj (205653 => 205654)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj        2016-09-08 18:48:15 UTC (rev 205653)
+++ trunk/Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj        2016-09-08 18:59:02 UTC (rev 205654)
</span><span class="lines">@@ -77,7 +77,6 @@
</span><span class="cx"> /* End PBXAggregateTarget section */
</span><span class="cx"> 
</span><span class="cx"> /* Begin PBXBuildFile section */
</span><del>-                0A6441519420A6C61AD1882E /* MapDataInlines.h in Headers */ = {isa = PBXBuildFile; fileRef = 593D43CCA0BBE06D89C59707 /* MapDataInlines.h */; settings = {ATTRIBUTES = (Private, ); }; };
</del><span class="cx">                 0F0123321944EA1B00843A0C /* DFGValueStrength.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F0123301944EA1B00843A0C /* DFGValueStrength.cpp */; };
</span><span class="cx">                 0F0123331944EA1B00843A0C /* DFGValueStrength.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F0123311944EA1B00843A0C /* DFGValueStrength.h */; };
</span><span class="cx">                 0F0332C018ADFAE1005F979A /* ExitingJITType.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F0332BF18ADFAE1005F979A /* ExitingJITType.cpp */; };
</span><span class="lines">@@ -1769,7 +1768,6 @@
</span><span class="cx">                 A77F1825164192C700640A47 /* ParserModes.h in Headers */ = {isa = PBXBuildFile; fileRef = A77F18241641925400640A47 /* ParserModes.h */; settings = {ATTRIBUTES = (Private, ); }; };
</span><span class="cx">                 A784A26111D16622005776AC /* ASTBuilder.h in Headers */ = {isa = PBXBuildFile; fileRef = A7A7EE7411B98B8D0065A14F /* ASTBuilder.h */; };
</span><span class="cx">                 A784A26411D16622005776AC /* SyntaxChecker.h in Headers */ = {isa = PBXBuildFile; fileRef = A7A7EE7711B98B8D0065A14F /* SyntaxChecker.h */; settings = {ATTRIBUTES = (Private, ); }; };
</span><del>-                A78507D717CBC6FD0011F6E7 /* MapData.h in Headers */ = {isa = PBXBuildFile; fileRef = A78507D517CBC6FD0011F6E7 /* MapData.h */; settings = {ATTRIBUTES = (Private, ); }; };
</del><span class="cx">                 A785F6BC18C553FE00F10626 /* SpillRegistersMode.h in Headers */ = {isa = PBXBuildFile; fileRef = A7FF647A18C52E8500B55307 /* SpillRegistersMode.h */; settings = {ATTRIBUTES = (Private, ); }; };
</span><span class="cx">                 A78A9774179738B8009DF744 /* DFGFailedFinalizer.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A78A976C179738B8009DF744 /* DFGFailedFinalizer.cpp */; };
</span><span class="cx">                 A78A9775179738B8009DF744 /* DFGFailedFinalizer.h in Headers */ = {isa = PBXBuildFile; fileRef = A78A976D179738B8009DF744 /* DFGFailedFinalizer.h */; };
</span><span class="lines">@@ -3445,7 +3443,6 @@
</span><span class="cx">                 53FA2AE21CF380390022711D /* LLIntPrototypeLoadAdaptiveStructureWatchpoint.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = LLIntPrototypeLoadAdaptiveStructureWatchpoint.cpp; sourceTree = &quot;&lt;group&gt;&quot;; };
</span><span class="cx">                 53FD04D11D7AB187003287D3 /* WASMCallingConvention.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = WASMCallingConvention.cpp; sourceTree = &quot;&lt;group&gt;&quot;; };
</span><span class="cx">                 53FD04D21D7AB187003287D3 /* WASMCallingConvention.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WASMCallingConvention.h; sourceTree = &quot;&lt;group&gt;&quot;; };
</span><del>-                593D43CCA0BBE06D89C59707 /* MapDataInlines.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = MapDataInlines.h; sourceTree = &quot;&lt;group&gt;&quot;; };
</del><span class="cx">                 5D5D8AD00E0D0EBE00F9C692 /* libedit.dylib */ = {isa = PBXFileReference; lastKnownFileType = &quot;compiled.mach-o.dylib&quot;; name = libedit.dylib; path = /usr/lib/libedit.dylib; sourceTree = &quot;&lt;absolute&gt;&quot;; };
</span><span class="cx">                 5DAFD6CB146B686300FBEFB4 /* JSC.xcconfig */ = {isa = PBXFileReference; lastKnownFileType = text.xcconfig; path = JSC.xcconfig; sourceTree = &quot;&lt;group&gt;&quot;; };
</span><span class="cx">                 5DDDF44614FEE72200B4FB4D /* LLIntDesiredOffsets.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = LLIntDesiredOffsets.h; path = LLIntOffsets/LLIntDesiredOffsets.h; sourceTree = BUILT_PRODUCTS_DIR; };
</span><span class="lines">@@ -4060,7 +4057,6 @@
</span><span class="cx">                 A77F181F164088B200640A47 /* CodeCache.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = CodeCache.cpp; sourceTree = &quot;&lt;group&gt;&quot;; };
</span><span class="cx">                 A77F1820164088B200640A47 /* CodeCache.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = CodeCache.h; sourceTree = &quot;&lt;group&gt;&quot;; };
</span><span class="cx">                 A77F18241641925400640A47 /* ParserModes.h */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.c.h; path = ParserModes.h; sourceTree = &quot;&lt;group&gt;&quot;; };
</span><del>-                A78507D517CBC6FD0011F6E7 /* MapData.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = MapData.h; sourceTree = &quot;&lt;group&gt;&quot;; };
</del><span class="cx">                 A78A976C179738B8009DF744 /* DFGFailedFinalizer.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGFailedFinalizer.cpp; path = dfg/DFGFailedFinalizer.cpp; sourceTree = &quot;&lt;group&gt;&quot;; };
</span><span class="cx">                 A78A976D179738B8009DF744 /* DFGFailedFinalizer.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGFailedFinalizer.h; path = dfg/DFGFailedFinalizer.h; sourceTree = &quot;&lt;group&gt;&quot;; };
</span><span class="cx">                 A78A976E179738B8009DF744 /* DFGFinalizer.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGFinalizer.cpp; path = dfg/DFGFinalizer.cpp; sourceTree = &quot;&lt;group&gt;&quot;; };
</span><span class="lines">@@ -6065,8 +6061,6 @@
</span><span class="cx">                                 795B19961D78BE3500262FA0 /* MapBase.h */,
</span><span class="cx">                                 A700873717CBE85300C3E643 /* MapConstructor.cpp */,
</span><span class="cx">                                 A700873817CBE85300C3E643 /* MapConstructor.h */,
</span><del>-                                A78507D517CBC6FD0011F6E7 /* MapData.h */,
-                                593D43CCA0BBE06D89C59707 /* MapDataInlines.h */,
</del><span class="cx">                                 A74DEF8D182D991400522C22 /* MapIteratorPrototype.cpp */,
</span><span class="cx">                                 A74DEF8E182D991400522C22 /* MapIteratorPrototype.h */,
</span><span class="cx">                                 A700873B17CBE8D300C3E643 /* MapPrototype.cpp */,
</span><span class="lines">@@ -8108,9 +8102,7 @@
</span><span class="cx">                                 860161E50F3A83C100F84710 /* MacroAssemblerX86_64.h in Headers */,
</span><span class="cx">                                 860161E60F3A83C100F84710 /* MacroAssemblerX86Common.h in Headers */,
</span><span class="cx">                                 A700873A17CBE85300C3E643 /* MapConstructor.h in Headers */,
</span><del>-                                A78507D717CBC6FD0011F6E7 /* MapData.h in Headers */,
</del><span class="cx">                                 0F37308F1C0CD68500052BFA /* DisallowMacroScratchRegisterUsage.h in Headers */,
</span><del>-                                0A6441519420A6C61AD1882E /* MapDataInlines.h in Headers */,
</del><span class="cx">                                 A74DEF94182D991400522C22 /* MapIteratorPrototype.h in Headers */,
</span><span class="cx">                                 A700873E17CBE8D300C3E643 /* MapPrototype.h in Headers */,
</span><span class="cx">                                 C2B916C214DA014E00CBAC86 /* MarkedAllocator.h in Headers */,
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreheapCopyTokenh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/heap/CopyToken.h (205653 => 205654)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/heap/CopyToken.h        2016-09-08 18:48:15 UTC (rev 205653)
+++ trunk/Source/JavaScriptCore/heap/CopyToken.h        2016-09-08 18:59:02 UTC (rev 205654)
</span><span class="lines">@@ -29,7 +29,6 @@
</span><span class="cx"> namespace JSC {
</span><span class="cx"> 
</span><span class="cx"> enum CopyToken {
</span><del>-    MapBackingStoreCopyToken,
</del><span class="cx">     DirectArgumentsOverridesCopyToken
</span><span class="cx"> };
</span><span class="cx"> 
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeHashMapImplcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/HashMapImpl.cpp (205653 => 205654)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/HashMapImpl.cpp        2016-09-08 18:48:15 UTC (rev 205653)
+++ trunk/Source/JavaScriptCore/runtime/HashMapImpl.cpp        2016-09-08 18:59:02 UTC (rev 205654)
</span><span class="lines">@@ -26,8 +26,7 @@
</span><span class="cx"> #include &quot;config.h&quot;
</span><span class="cx"> #include &quot;HashMapImpl.h&quot;
</span><span class="cx"> 
</span><del>-#include &quot;CopiedBlockInlines.h&quot;
-#include &quot;CopyVisitorInlines.h&quot;
</del><ins>+#include &quot;JSCInlines.h&quot;
</ins><span class="cx"> 
</span><span class="cx"> namespace JSC {
</span><span class="cx"> 
</span><span class="lines">@@ -70,24 +69,9 @@
</span><span class="cx"> 
</span><span class="cx">     visitor.append(&amp;thisObject-&gt;m_head);
</span><span class="cx">     visitor.append(&amp;thisObject-&gt;m_tail);
</span><del>-
-    visitor.copyLater(thisObject, MapBackingStoreCopyToken, thisObject-&gt;m_buffer.get(), thisObject-&gt;bufferSizeInBytes());
</del><ins>+    
+    if (thisObject-&gt;m_buffer)
+        visitor.markAuxiliary(thisObject-&gt;m_buffer.get());
</ins><span class="cx"> }
</span><span class="cx"> 
</span><del>-template &lt;typename HashMapBucket&gt;
-void HashMapImpl&lt;HashMapBucket&gt;::copyBackingStore(JSCell* cell, CopyVisitor&amp; visitor, CopyToken token)
-{
-    Base::copyBackingStore(cell, visitor, token);
-
-    HashMapImpl* thisObject = jsCast&lt;HashMapImpl*&gt;(cell);
-    if (token == MapBackingStoreCopyToken &amp;&amp; visitor.checkIfShouldCopy(thisObject-&gt;m_buffer.get())) {
-        HashMapBufferType* oldBuffer = thisObject-&gt;m_buffer.get();
-        size_t bufferSizeInBytes = thisObject-&gt;bufferSizeInBytes();
-        HashMapBufferType* newBuffer = static_cast&lt;HashMapBufferType*&gt;(visitor.allocateNewSpace(bufferSizeInBytes));
-        memcpy(newBuffer, oldBuffer, bufferSizeInBytes);
-        thisObject-&gt;m_buffer.setWithoutBarrier(newBuffer);
-        visitor.didCopy(oldBuffer, bufferSizeInBytes);
-    }
-}
-
</del><span class="cx"> } // namespace JSC
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeHashMapImplh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/HashMapImpl.h (205653 => 205654)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/HashMapImpl.h        2016-09-08 18:48:15 UTC (rev 205653)
+++ trunk/Source/JavaScriptCore/runtime/HashMapImpl.h        2016-09-08 18:59:02 UTC (rev 205654)
</span><span class="lines">@@ -25,7 +25,7 @@
</span><span class="cx"> 
</span><span class="cx"> #pragma once
</span><span class="cx"> 
</span><del>-#include &quot;JSCInlines.h&quot;
</del><ins>+#include &quot;ExceptionHelpers.h&quot;
</ins><span class="cx"> #include &quot;JSObject.h&quot;
</span><span class="cx"> 
</span><span class="cx"> namespace JSC {
</span><span class="lines">@@ -151,9 +151,8 @@
</span><span class="cx">     {
</span><span class="cx">         auto scope = DECLARE_THROW_SCOPE(vm);
</span><span class="cx">         size_t allocationSize = HashMapBuffer::allocationSize(capacity);
</span><del>-        void* data = nullptr;
-        DeferGCForAWhile defer(vm.heap);
-        if (!vm.heap.tryAllocateStorage(owner, allocationSize, &amp;data)) {
</del><ins>+        void* data = vm.heap.tryAllocateAuxiliary(owner, allocationSize);
+        if (!data) {
</ins><span class="cx">             throwOutOfMemoryError(exec, scope);
</span><span class="cx">             return nullptr;
</span><span class="cx">         }
</span><span class="lines">@@ -259,7 +258,6 @@
</span><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     static void visitChildren(JSCell*, SlotVisitor&amp;);
</span><del>-    static void copyBackingStore(JSCell*, CopyVisitor&amp;, CopyToken);
</del><span class="cx"> 
</span><span class="cx">     HashMapImpl(VM&amp; vm, Structure* structure)
</span><span class="cx">         : Base(vm, structure)
</span><span class="lines">@@ -515,7 +513,7 @@
</span><span class="cx"> 
</span><span class="cx">     WriteBarrier&lt;HashMapBucketType&gt; m_head;
</span><span class="cx">     WriteBarrier&lt;HashMapBucketType&gt; m_tail;
</span><del>-    CopyBarrier&lt;HashMapBufferType&gt; m_buffer;
</del><ins>+    AuxiliaryBarrier&lt;HashMapBufferType*&gt; m_buffer;
</ins><span class="cx">     uint32_t m_size;
</span><span class="cx">     uint32_t m_deleteCount;
</span><span class="cx">     uint32_t m_capacity;
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeJSMapIteratorcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/JSMapIterator.cpp (205653 => 205654)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/JSMapIterator.cpp        2016-09-08 18:48:15 UTC (rev 205653)
+++ trunk/Source/JavaScriptCore/runtime/JSMapIterator.cpp        2016-09-08 18:59:02 UTC (rev 205654)
</span><span class="lines">@@ -28,7 +28,6 @@
</span><span class="cx"> 
</span><span class="cx"> #include &quot;JSCInlines.h&quot;
</span><span class="cx"> #include &quot;JSMap.h&quot;
</span><del>-#include &quot;MapDataInlines.h&quot;
</del><span class="cx"> 
</span><span class="cx"> namespace JSC {
</span><span class="cx"> 
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeJSMapIteratorh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/JSMapIterator.h (205653 => 205654)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/JSMapIterator.h        2016-09-08 18:48:15 UTC (rev 205653)
+++ trunk/Source/JavaScriptCore/runtime/JSMapIterator.h        2016-09-08 18:59:02 UTC (rev 205654)
</span><span class="lines">@@ -29,7 +29,6 @@
</span><span class="cx"> #include &quot;IterationKind.h&quot;
</span><span class="cx"> #include &quot;JSMap.h&quot;
</span><span class="cx"> #include &quot;JSObject.h&quot;
</span><del>-#include &quot;MapData.h&quot;
</del><span class="cx"> 
</span><span class="cx"> namespace JSC {
</span><span class="cx"> 
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeJSSetIteratorcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/JSSetIterator.cpp (205653 => 205654)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/JSSetIterator.cpp        2016-09-08 18:48:15 UTC (rev 205653)
+++ trunk/Source/JavaScriptCore/runtime/JSSetIterator.cpp        2016-09-08 18:59:02 UTC (rev 205654)
</span><span class="lines">@@ -28,7 +28,6 @@
</span><span class="cx"> 
</span><span class="cx"> #include &quot;JSCInlines.h&quot;
</span><span class="cx"> #include &quot;JSSet.h&quot;
</span><del>-#include &quot;MapDataInlines.h&quot;
</del><span class="cx"> 
</span><span class="cx"> namespace JSC {
</span><span class="cx"> 
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeJSSetIteratorh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/JSSetIterator.h (205653 => 205654)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/JSSetIterator.h        2016-09-08 18:48:15 UTC (rev 205653)
+++ trunk/Source/JavaScriptCore/runtime/JSSetIterator.h        2016-09-08 18:59:02 UTC (rev 205654)
</span><span class="lines">@@ -30,8 +30,6 @@
</span><span class="cx"> #include &quot;JSObject.h&quot;
</span><span class="cx"> #include &quot;JSSet.h&quot;
</span><span class="cx"> 
</span><del>-#include &quot;MapData.h&quot;
-
</del><span class="cx"> namespace JSC {
</span><span class="cx"> 
</span><span class="cx"> class JSSetIterator : public JSNonFinalObject {
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeMapBasecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/MapBase.cpp (205653 => 205654)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/MapBase.cpp        2016-09-08 18:48:15 UTC (rev 205653)
+++ trunk/Source/JavaScriptCore/runtime/MapBase.cpp        2016-09-08 18:59:02 UTC (rev 205654)
</span><span class="lines">@@ -26,7 +26,7 @@
</span><span class="cx"> #include &quot;config.h&quot;
</span><span class="cx"> #include &quot;MapBase.h&quot;
</span><span class="cx"> 
</span><del>-#include &quot;SlotVisitorInlines.h&quot;
</del><ins>+#include &quot;JSCInlines.h&quot;
</ins><span class="cx"> 
</span><span class="cx"> namespace JSC {
</span><span class="cx"> 
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeMapDatah"></a>
<div class="delfile"><h4>Deleted: trunk/Source/JavaScriptCore/runtime/MapData.h (205653 => 205654)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/MapData.h        2016-09-08 18:48:15 UTC (rev 205653)
+++ trunk/Source/JavaScriptCore/runtime/MapData.h        2016-09-08 18:59:02 UTC (rev 205654)
</span><span class="lines">@@ -1,215 +0,0 @@
</span><del>-/*
- * Copyright (C) 2013, 2015-2016 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
- * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
- * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
- * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
- * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
- * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
- * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
- * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
- * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
- * THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#ifndef MapData_h
-#define MapData_h
-
-#include &quot;CopyBarrier.h&quot;
-#include &quot;JSCell.h&quot;
-#include &quot;WeakGCMapInlines.h&quot;
-#include &lt;wtf/HashFunctions.h&gt;
-#include &lt;wtf/HashMap.h&gt;
-#include &lt;wtf/MathExtras.h&gt;
-#include &lt;wtf/RefPtr.h&gt;
-
-namespace JSC {
-
-class ExecState;
-class VM;
-
-template&lt;typename Entry, typename JSIterator&gt;
-class MapDataImpl {
-public:
-    enum : int32_t {
-        minimumMapSize = 8
-    };
-
-    class IteratorData {
-    public:
-        friend class MapDataImpl;
-
-        IteratorData(const MapDataImpl*);
-        bool next(WTF::KeyValuePair&lt;JSValue, JSValue&gt;&amp;);
-
-        // This function is called while packing a map's backing store. The
-        // passed-in index is the new index the entry would have after packing.
-        void didRemoveEntry(int32_t packedIndex)
-        {
-            if (isFinished())
-                return;
-
-            if (m_index &lt;= packedIndex)
-                return;
-
-            --m_index;
-        }
-
-        void didRemoveAllEntries()
-        {
-            if (isFinished())
-                return;
-            m_index = 0;
-        }
-
-        void finish()
-        {
-            m_index = -1;
-        }
-
-    private:
-        bool ensureSlot() const;
-        bool isFinished() const { return m_index == -1; }
-        int32_t refreshCursor() const;
-
-        const MapDataImpl* m_mapData;
-        mutable int32_t m_index;
-    };
-    STATIC_ASSERT_IS_TRIVIALLY_DESTRUCTIBLE(IteratorData);
-
-    struct KeyType {
-        ALWAYS_INLINE KeyType() { }
-        KeyType(JSValue);
-        JSValue value;
-    };
-
-    MapDataImpl(VM&amp;, JSCell* owner);
-
-    void set(ExecState*, JSCell* owner, KeyType, JSValue);
-    JSValue get(ExecState*, KeyType);
-    bool remove(ExecState*, KeyType);
-    bool contains(ExecState*, KeyType);
-    size_t size(ExecState*) const { return m_size - m_deletedCount; }
-
-    IteratorData createIteratorData(JSIterator*);
-
-    void clear();
-
-    void visitChildren(JSCell* owner, SlotVisitor&amp;);
-    void copyBackingStore(CopyVisitor&amp;, CopyToken);
-
-    size_t capacityInBytes() const { return m_capacity * sizeof(Entry); }
-
-private:
-    typedef WTF::UnsignedWithZeroKeyHashTraits&lt;int32_t&gt; IndexTraits;
-
-    typedef HashMap&lt;JSCell*, int32_t, typename WTF::DefaultHash&lt;JSCell*&gt;::Hash, WTF::HashTraits&lt;JSCell*&gt;, IndexTraits&gt; CellKeyedMap;
-    typedef HashMap&lt;EncodedJSValue, int32_t, EncodedJSValueHash, EncodedJSValueHashTraits, IndexTraits&gt; ValueKeyedMap;
-    typedef HashMap&lt;StringImpl*, int32_t, typename WTF::DefaultHash&lt;StringImpl*&gt;::Hash, WTF::HashTraits&lt;StringImpl*&gt;, IndexTraits&gt; StringKeyedMap;
-
-    ALWAYS_INLINE Entry* find(ExecState*, KeyType);
-    ALWAYS_INLINE Entry* add(ExecState*, JSCell* owner, KeyType);
-    template &lt;typename Map, typename Key&gt; ALWAYS_INLINE Entry* add(ExecState*, JSCell* owner, Map&amp;, Key, KeyType);
-
-    ALWAYS_INLINE bool shouldPack() const { return m_deletedCount; }
-    CheckedBoolean ensureSpaceForAppend(ExecState*, JSCell* owner);
-
-    ALWAYS_INLINE void replaceAndPackBackingStore(Entry* destination, int32_t newSize);
-    ALWAYS_INLINE void replaceBackingStore(Entry* destination, int32_t newSize);
-
-    CellKeyedMap m_cellKeyedTable;
-    ValueKeyedMap m_valueKeyedTable;
-    StringKeyedMap m_stringKeyedTable;
-    int32_t m_capacity;
-    int32_t m_size;
-    int32_t m_deletedCount;
-    JSCell* m_owner;
-    CopyBarrier&lt;Entry&gt; m_entries;
-    WeakGCMap&lt;JSIterator*, JSIterator&gt; m_iterators;
-};
-
-template&lt;typename Entry, typename JSIterator&gt;
-ALWAYS_INLINE MapDataImpl&lt;Entry, JSIterator&gt;::MapDataImpl(VM&amp; vm, JSCell* owner)
-    : m_capacity(0)
-    , m_size(0)
-    , m_deletedCount(0)
-    , m_owner(owner)
-    , m_iterators(vm)
-{
-}
-
-template&lt;typename Entry, typename JSIterator&gt;
-ALWAYS_INLINE MapDataImpl&lt;Entry, JSIterator&gt;::KeyType::KeyType(JSValue v)
-{
-    if (!v.isDouble()) {
-        value = v;
-        return;
-    }
-    double d = v.asDouble();
-    if (std::isnan(d)) {
-        value = v;
-        return;
-    }
-
-    int i = static_cast&lt;int&gt;(v.asDouble());
-    if (i != d)
-        value = v;
-    else
-        value = jsNumber(i);
-}
-
-template&lt;typename Entry, typename JSIterator&gt;
-ALWAYS_INLINE MapDataImpl&lt;Entry, JSIterator&gt;::IteratorData::IteratorData(const MapDataImpl&lt;Entry, JSIterator&gt;* mapData)
-    : m_mapData(mapData)
-    , m_index(0)
-{
-}
-
-template&lt;typename Entry, typename JSIterator&gt;
-ALWAYS_INLINE bool MapDataImpl&lt;Entry, JSIterator&gt;::IteratorData::next(WTF::KeyValuePair&lt;JSValue, JSValue&gt;&amp; pair)
-{
-    if (!ensureSlot())
-        return false;
-    Entry* entry = &amp;m_mapData-&gt;m_entries.get()[m_index];
-    pair = WTF::KeyValuePair&lt;JSValue, JSValue&gt;(entry-&gt;key().get(), entry-&gt;value().get());
-    m_index += 1;
-    return true;
-}
-
-// This is a bit gnarly. We use an index of -1 to indicate the
-// finished state. By casting to unsigned we can immediately
-// test if both iterators are at the end of their iteration.
-template&lt;typename Entry, typename JSIterator&gt;
-ALWAYS_INLINE bool MapDataImpl&lt;Entry, JSIterator&gt;::IteratorData::ensureSlot() const
-{
-    int32_t index = refreshCursor();
-    return static_cast&lt;size_t&gt;(index) &lt; static_cast&lt;size_t&gt;(m_mapData-&gt;m_size);
-}
-
-template&lt;typename Entry, typename JSIterator&gt;
-ALWAYS_INLINE int32_t MapDataImpl&lt;Entry, JSIterator&gt;::IteratorData::refreshCursor() const
-{
-    if (isFinished())
-        return m_index;
-
-    Entry* entries = m_mapData-&gt;m_entries.get();
-    size_t end = m_mapData-&gt;m_size;
-    while (static_cast&lt;size_t&gt;(m_index) &lt; end &amp;&amp; !entries[m_index].key())
-        m_index++;
-    return m_index;
-}
-
-}
-
-#endif /* !defined(MapData_h) */
</del></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeMapDataInlinesh"></a>
<div class="delfile"><h4>Deleted: trunk/Source/JavaScriptCore/runtime/MapDataInlines.h (205653 => 205654)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/MapDataInlines.h        2016-09-08 18:48:15 UTC (rev 205653)
+++ trunk/Source/JavaScriptCore/runtime/MapDataInlines.h        2016-09-08 18:59:02 UTC (rev 205654)
</span><span class="lines">@@ -1,270 +0,0 @@
</span><del>-/*
- * Copyright (C) 2013, 2016 Apple Inc. All rights reserved.
- * Copyright (C) 2015 Yusuke Suzuki &lt;utatane.tea@gmail.com&gt;.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
- * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
- * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
- * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
- * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
- * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
- * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
- * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
- * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
- * THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include &quot;CopiedAllocator.h&quot;
-#include &quot;CopyVisitorInlines.h&quot;
-#include &quot;ExceptionHelpers.h&quot;
-#include &quot;JSCJSValueInlines.h&quot;
-#include &quot;MapData.h&quot;
-#include &quot;SlotVisitorInlines.h&quot;
-
-namespace JSC {
-
-template&lt;typename Entry, typename JSIterator&gt;
-inline void MapDataImpl&lt;Entry, JSIterator&gt;::clear()
-{
-    m_cellKeyedTable.clear();
-    m_valueKeyedTable.clear();
-    m_stringKeyedTable.clear();
-    m_capacity = 0;
-    m_size = 0;
-    m_deletedCount = 0;
-    m_entries.clear();
-    m_iterators.forEach([](JSIterator* iterator, JSIterator*) {
-        iterator-&gt;iteratorData()-&gt;didRemoveAllEntries();
-    });
-}
-
-template&lt;typename Entry, typename JSIterator&gt;
-inline Entry* MapDataImpl&lt;Entry, JSIterator&gt;::find(ExecState* exec, KeyType key)
-{
-    if (key.value.isString()) {
-        auto iter = m_stringKeyedTable.find(asString(key.value)-&gt;value(exec).impl());
-        if (iter == m_stringKeyedTable.end())
-            return 0;
-        return &amp;m_entries.get()[iter-&gt;value];
-    }
-    if (key.value.isCell()) {
-        auto iter = m_cellKeyedTable.find(key.value.asCell());
-        if (iter == m_cellKeyedTable.end())
-            return 0;
-        return &amp;m_entries.get()[iter-&gt;value];
-    }
-
-    auto iter = m_valueKeyedTable.find(JSValue::encode(key.value));
-    if (iter == m_valueKeyedTable.end())
-        return 0;
-    return &amp;m_entries.get()[iter-&gt;value];
-}
-
-template&lt;typename Entry, typename JSIterator&gt;
-inline bool MapDataImpl&lt;Entry, JSIterator&gt;::contains(ExecState* exec, KeyType key)
-{
-    return find(exec, key);
-}
-
-template&lt;typename Entry, typename JSIterator&gt;
-template &lt;typename Map, typename Key&gt;
-inline Entry* MapDataImpl&lt;Entry, JSIterator&gt;::add(ExecState* exec, JSCell* owner, Map&amp; map, Key key, KeyType keyValue)
-{
-    typename Map::iterator location = map.find(key);
-    if (location != map.end())
-        return &amp;m_entries.get()[location-&gt;value];
-
-    if (!ensureSpaceForAppend(exec, owner))
-        return 0;
-
-    auto result = map.add(key, m_size);
-    RELEASE_ASSERT(result.isNewEntry);
-    Entry* entry = &amp;m_entries.get()[m_size++];
-    new (entry) Entry();
-    entry-&gt;setKey(exec-&gt;vm(), owner, keyValue.value);
-    return entry;
-}
-
-template&lt;typename Entry, typename JSIterator&gt;
-inline void MapDataImpl&lt;Entry, JSIterator&gt;::set(ExecState* exec, JSCell* owner, KeyType key, JSValue value)
-{
-    Entry* location = add(exec, owner, key);
-    if (!location)
-        return;
-    location-&gt;setValue(exec-&gt;vm(), owner, value);
-}
-
-template&lt;typename Entry, typename JSIterator&gt;
-inline Entry* MapDataImpl&lt;Entry, JSIterator&gt;::add(ExecState* exec, JSCell* owner, KeyType key)
-{
-    if (key.value.isString())
-        return add(exec, owner, m_stringKeyedTable, asString(key.value)-&gt;value(exec).impl(), key);
-    if (key.value.isCell())
-        return add(exec, owner, m_cellKeyedTable, key.value.asCell(), key);
-    return add(exec, owner, m_valueKeyedTable, JSValue::encode(key.value), key);
-}
-
-template&lt;typename Entry, typename JSIterator&gt;
-inline JSValue MapDataImpl&lt;Entry, JSIterator&gt;::get(ExecState* exec, KeyType key)
-{
-    if (Entry* entry = find(exec, key))
-        return entry-&gt;value().get();
-    return JSValue();
-}
-
-template&lt;typename Entry, typename JSIterator&gt;
-inline bool MapDataImpl&lt;Entry, JSIterator&gt;::remove(ExecState* exec, KeyType key)
-{
-    int32_t location;
-    if (key.value.isString()) {
-        auto iter = m_stringKeyedTable.find(asString(key.value)-&gt;value(exec).impl());
-        if (iter == m_stringKeyedTable.end())
-            return false;
-        location = iter-&gt;value;
-        m_stringKeyedTable.remove(iter);
-    } else if (key.value.isCell()) {
-        auto iter = m_cellKeyedTable.find(key.value.asCell());
-        if (iter == m_cellKeyedTable.end())
-            return false;
-        location = iter-&gt;value;
-        m_cellKeyedTable.remove(iter);
-    } else {
-        auto iter = m_valueKeyedTable.find(JSValue::encode(key.value));
-        if (iter == m_valueKeyedTable.end())
-            return false;
-        location = iter-&gt;value;
-        m_valueKeyedTable.remove(iter);
-    }
-    m_entries.get()[location].clear();
-    m_deletedCount++;
-    return true;
-}
-
-template&lt;typename Entry, typename JSIterator&gt;
-inline void MapDataImpl&lt;Entry, JSIterator&gt;::replaceAndPackBackingStore(Entry* destination, int32_t newCapacity)
-{
-    ASSERT(shouldPack());
-    int32_t newEnd = 0;
-    RELEASE_ASSERT(newCapacity &gt; 0);
-    for (int32_t i = 0; i &lt; m_size; i++) {
-        Entry&amp; entry = m_entries.get()[i];
-        if (!entry.key()) {
-            m_iterators.forEach([newEnd](JSIterator* iterator, JSIterator*) {
-                iterator-&gt;iteratorData()-&gt;didRemoveEntry(newEnd);
-            });
-            continue;
-        }
-        ASSERT(newEnd &lt; newCapacity);
-        destination[newEnd] = entry;
-
-        // We overwrite the old entry with a forwarding index for the new entry,
-        // so that we can fix up our hash tables below without doing additional
-        // hash lookups
-        entry.setKeyWithoutWriteBarrier(jsNumber(newEnd));
-        newEnd++;
-    }
-
-    // Fixup for the hashmaps
-    for (auto ptr = m_valueKeyedTable.begin(); ptr != m_valueKeyedTable.end(); ++ptr)
-        ptr-&gt;value = m_entries.get()[ptr-&gt;value].key().get().asInt32();
-    for (auto ptr = m_cellKeyedTable.begin(); ptr != m_cellKeyedTable.end(); ++ptr)
-        ptr-&gt;value = m_entries.get()[ptr-&gt;value].key().get().asInt32();
-    for (auto ptr = m_stringKeyedTable.begin(); ptr != m_stringKeyedTable.end(); ++ptr)
-        ptr-&gt;value = m_entries.get()[ptr-&gt;value].key().get().asInt32();
-
-    ASSERT((m_size - newEnd) == m_deletedCount);
-    m_deletedCount = 0;
-
-    m_capacity = newCapacity;
-    m_size = newEnd;
-    m_entries.setWithoutBarrier(destination);
-}
-
-template&lt;typename Entry, typename JSIterator&gt;
-inline void MapDataImpl&lt;Entry, JSIterator&gt;::replaceBackingStore(Entry* destination, int32_t newCapacity)
-{
-    ASSERT(!shouldPack());
-    RELEASE_ASSERT(newCapacity &gt; 0);
-    ASSERT(newCapacity &gt;= m_capacity);
-    memcpy(destination, m_entries.get(), sizeof(Entry) * m_size);
-    m_capacity = newCapacity;
-    m_entries.setWithoutBarrier(destination);
-}
-
-template&lt;typename Entry, typename JSIterator&gt;
-inline CheckedBoolean MapDataImpl&lt;Entry, JSIterator&gt;::ensureSpaceForAppend(ExecState* exec, JSCell* owner)
-{
-    VM&amp; vm = exec-&gt;vm();
-    auto scope = DECLARE_THROW_SCOPE(vm);
-
-    if (m_capacity &gt; m_size)
-        return true;
-
-    size_t requiredSize = std::max(m_capacity + (m_capacity / 2) + 1, static_cast&lt;int32_t&gt;(minimumMapSize));
-    void* newStorage = nullptr;
-    DeferGC defer(*exec-&gt;heap());
-    if (!exec-&gt;heap()-&gt;tryAllocateStorage(owner, requiredSize * sizeof(Entry), &amp;newStorage)) {
-        throwOutOfMemoryError(exec, scope);
-        return false;
-    }
-    Entry* newEntries = static_cast&lt;Entry*&gt;(newStorage);
-    if (shouldPack())
-        replaceAndPackBackingStore(newEntries, requiredSize);
-    else
-        replaceBackingStore(newEntries, requiredSize);
-    exec-&gt;heap()-&gt;writeBarrier(owner);
-    return true;
-}
-
-template&lt;typename Entry, typename JSIterator&gt;
-inline void MapDataImpl&lt;Entry, JSIterator&gt;::visitChildren(JSCell* owner, SlotVisitor&amp; visitor)
-{
-    Entry* entries = m_entries.get();
-    if (!entries)
-        return;
-    if (m_deletedCount) {
-        for (int32_t i = 0; i &lt; m_size; i++) {
-            if (!entries[i].key())
-                continue;
-            entries[i].visitChildren(visitor);
-        }
-    } else {
-        // Guaranteed that all fields of Entry type is WriteBarrier&lt;Unknown&gt;.
-        visitor.appendValues(reinterpret_cast&lt;WriteBarrier&lt;Unknown&gt;*&gt;(&amp;entries[0]), m_size * (sizeof(Entry) / sizeof(WriteBarrier&lt;Unknown&gt;)));
-    }
-
-    visitor.copyLater(owner, MapBackingStoreCopyToken, m_entries.get(), capacityInBytes());
-}
-
-template&lt;typename Entry, typename JSIterator&gt;
-inline void MapDataImpl&lt;Entry, JSIterator&gt;::copyBackingStore(CopyVisitor&amp; visitor, CopyToken token)
-{
-    if (token == MapBackingStoreCopyToken &amp;&amp; visitor.checkIfShouldCopy(m_entries.get())) {
-        Entry* oldEntries = m_entries.get();
-        Entry* newEntries = static_cast&lt;Entry*&gt;(visitor.allocateNewSpace(capacityInBytes()));
-        if (shouldPack())
-            replaceAndPackBackingStore(newEntries, m_capacity);
-        else
-            replaceBackingStore(newEntries, m_capacity);
-        visitor.didCopy(oldEntries, capacityInBytes());
-    }
-}
-
-template&lt;typename Entry, typename JSIterator&gt;
-inline auto MapDataImpl&lt;Entry, JSIterator&gt;::createIteratorData(JSIterator* iterator) -&gt; IteratorData
-{
-    m_iterators.set(iterator, iterator);
-    return IteratorData(this);
-}
-
-}
</del></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeMapPrototypecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/MapPrototype.cpp (205653 => 205654)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/MapPrototype.cpp        2016-09-08 18:48:15 UTC (rev 205653)
+++ trunk/Source/JavaScriptCore/runtime/MapPrototype.cpp        2016-09-08 18:59:02 UTC (rev 205654)
</span><span class="lines">@@ -35,7 +35,6 @@
</span><span class="cx"> #include &quot;JSMap.h&quot;
</span><span class="cx"> #include &quot;JSMapIterator.h&quot;
</span><span class="cx"> #include &quot;Lookup.h&quot;
</span><del>-#include &quot;MapDataInlines.h&quot;
</del><span class="cx"> 
</span><span class="cx"> #include &quot;MapPrototype.lut.h&quot;
</span><span class="cx"> 
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeSetConstructorcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/SetConstructor.cpp (205653 => 205654)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/SetConstructor.cpp        2016-09-08 18:48:15 UTC (rev 205653)
+++ trunk/Source/JavaScriptCore/runtime/SetConstructor.cpp        2016-09-08 18:59:02 UTC (rev 205654)
</span><span class="lines">@@ -33,7 +33,6 @@
</span><span class="cx"> #include &quot;JSGlobalObject.h&quot;
</span><span class="cx"> #include &quot;JSObjectInlines.h&quot;
</span><span class="cx"> #include &quot;JSSet.h&quot;
</span><del>-#include &quot;MapData.h&quot;
</del><span class="cx"> #include &quot;SetPrototype.h&quot;
</span><span class="cx"> 
</span><span class="cx"> namespace JSC {
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeSetPrototypecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/SetPrototype.cpp (205653 => 205654)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/SetPrototype.cpp        2016-09-08 18:48:15 UTC (rev 205653)
+++ trunk/Source/JavaScriptCore/runtime/SetPrototype.cpp        2016-09-08 18:59:02 UTC (rev 205654)
</span><span class="lines">@@ -35,7 +35,6 @@
</span><span class="cx"> #include &quot;JSSet.h&quot;
</span><span class="cx"> #include &quot;JSSetIterator.h&quot;
</span><span class="cx"> #include &quot;Lookup.h&quot;
</span><del>-#include &quot;MapDataInlines.h&quot;
</del><span class="cx"> 
</span><span class="cx"> #include &quot;SetPrototype.lut.h&quot;
</span><span class="cx"> 
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeVMcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/VM.cpp (205653 => 205654)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/VM.cpp        2016-09-08 18:48:15 UTC (rev 205653)
+++ trunk/Source/JavaScriptCore/runtime/VM.cpp        2016-09-08 18:59:02 UTC (rev 205654)
</span><span class="lines">@@ -73,7 +73,6 @@
</span><span class="cx"> #include &quot;LLIntData.h&quot;
</span><span class="cx"> #include &quot;Lexer.h&quot;
</span><span class="cx"> #include &quot;Lookup.h&quot;
</span><del>-#include &quot;MapData.h&quot;
</del><span class="cx"> #include &quot;NativeStdFunctionCell.h&quot;
</span><span class="cx"> #include &quot;Nodes.h&quot;
</span><span class="cx"> #include &quot;Parser.h&quot;
</span></span></pre></div>
<a id="trunkSourceWebCoreChangeLog"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/ChangeLog (205653 => 205654)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/ChangeLog        2016-09-08 18:48:15 UTC (rev 205653)
+++ trunk/Source/WebCore/ChangeLog        2016-09-08 18:59:02 UTC (rev 205654)
</span><span class="lines">@@ -1,3 +1,14 @@
</span><ins>+2016-09-08  Filip Pizlo  &lt;fpizlo@apple.com&gt;
+
+        Move JSMap/JSSet over to Auxiliary MarkedSpace
+        https://bugs.webkit.org/show_bug.cgi?id=161744
+
+        Reviewed by Saam Barati.
+
+        No new tests because no change in behavior.
+
+        * bindings/js/SerializedScriptValue.cpp:
+
</ins><span class="cx"> 2016-09-08  Commit Queue  &lt;commit-queue@webkit.org&gt;
</span><span class="cx"> 
</span><span class="cx">         Unreviewed, rolling out r205652.
</span></span></pre></div>
<a id="trunkSourceWebCorebindingsjsSerializedScriptValuecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/js/SerializedScriptValue.cpp (205653 => 205654)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/bindings/js/SerializedScriptValue.cpp        2016-09-08 18:48:15 UTC (rev 205653)
+++ trunk/Source/WebCore/bindings/js/SerializedScriptValue.cpp        2016-09-08 18:59:02 UTC (rev 205654)
</span><span class="lines">@@ -70,8 +70,6 @@
</span><span class="cx"> #include &lt;runtime/JSSet.h&gt;
</span><span class="cx"> #include &lt;runtime/JSSetIterator.h&gt;
</span><span class="cx"> #include &lt;runtime/JSTypedArrays.h&gt;
</span><del>-#include &lt;runtime/MapData.h&gt;
-#include &lt;runtime/MapDataInlines.h&gt;
</del><span class="cx"> #include &lt;runtime/ObjectConstructor.h&gt;
</span><span class="cx"> #include &lt;runtime/PropertyNameArray.h&gt;
</span><span class="cx"> #include &lt;runtime/RegExp.h&gt;
</span></span></pre>
</div>
</div>

</body>
</html>