<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN"
"http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head><meta http-equiv="content-type" content="text/html; charset=utf-8" />
<title>[207625] trunk/Source/JavaScriptCore</title>
</head>
<body>
<style type="text/css"><!--
#msg dl.meta { border: 1px #006 solid; background: #369; padding: 6px; color: #fff; }
#msg dl.meta dt { float: left; width: 6em; font-weight: bold; }
#msg dt:after { content:':';}
#msg dl, #msg dt, #msg ul, #msg li, #header, #footer, #logmsg { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; }
#msg dl a { font-weight: bold}
#msg dl a:link { color:#fc3; }
#msg dl a:active { color:#ff0; }
#msg dl a:visited { color:#cc6; }
h3 { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; font-weight: bold; }
#msg pre { overflow: auto; background: #ffc; border: 1px #fa0 solid; padding: 6px; }
#logmsg { background: #ffc; border: 1px #fa0 solid; padding: 1em 1em 0 1em; }
#logmsg p, #logmsg pre, #logmsg blockquote { margin: 0 0 1em 0; }
#logmsg p, #logmsg li, #logmsg dt, #logmsg dd { line-height: 14pt; }
#logmsg h1, #logmsg h2, #logmsg h3, #logmsg h4, #logmsg h5, #logmsg h6 { margin: .5em 0; }
#logmsg h1:first-child, #logmsg h2:first-child, #logmsg h3:first-child, #logmsg h4:first-child, #logmsg h5:first-child, #logmsg h6:first-child { margin-top: 0; }
#logmsg ul, #logmsg ol { padding: 0; list-style-position: inside; margin: 0 0 0 1em; }
#logmsg ul { text-indent: -1em; padding-left: 1em; }#logmsg ol { text-indent: -1.5em; padding-left: 1.5em; }
#logmsg > ul, #logmsg > ol { margin: 0 0 1em 0; }
#logmsg pre { background: #eee; padding: 1em; }
#logmsg blockquote { border: 1px solid #fa0; border-left-width: 10px; padding: 1em 1em 0 1em; background: white;}
#logmsg dl { margin: 0; }
#logmsg dt { font-weight: bold; }
#logmsg dd { margin: 0; padding: 0 0 0.5em 0; }
#logmsg dd:before { content:'\00bb';}
#logmsg table { border-spacing: 0px; border-collapse: collapse; border-top: 4px solid #fa0; border-bottom: 1px solid #fa0; background: #fff; }
#logmsg table th { text-align: left; font-weight: normal; padding: 0.2em 0.5em; border-top: 1px dotted #fa0; }
#logmsg table td { text-align: right; border-top: 1px dotted #fa0; padding: 0.2em 0.5em; }
#logmsg table thead th { text-align: center; border-bottom: 1px solid #fa0; }
#logmsg table th.Corner { text-align: left; }
#logmsg hr { border: none 0; border-top: 2px dashed #fa0; height: 1px; }
#header, #footer { color: #fff; background: #636; border: 1px #300 solid; padding: 6px; }
#patch { width: 100%; }
#patch h4 {font-family: verdana,arial,helvetica,sans-serif;font-size:10pt;padding:8px;background:#369;color:#fff;margin:0;}
#patch .propset h4, #patch .binary h4 {margin:0;}
#patch pre {padding:0;line-height:1.2em;margin:0;}
#patch .diff {width:100%;background:#eee;padding: 0 0 10px 0;overflow:auto;}
#patch .propset .diff, #patch .binary .diff {padding:10px 0;}
#patch span {display:block;padding:0 10px;}
#patch .modfile, #patch .addfile, #patch .delfile, #patch .propset, #patch .binary, #patch .copfile {border:1px solid #ccc;margin:10px 0;}
#patch ins {background:#dfd;text-decoration:none;display:block;padding:0 10px;}
#patch del {background:#fdd;text-decoration:none;display:block;padding:0 10px;}
#patch .lines, .info {color:#888;background:#fff;}
--></style>
<div id="msg">
<dl class="meta">
<dt>Revision</dt> <dd><a href="http://trac.webkit.org/projects/webkit/changeset/207625">207625</a></dd>
<dt>Author</dt> <dd>utatane.tea@gmail.com</dd>
<dt>Date</dt> <dd>2016-10-20 11:02:31 -0700 (Thu, 20 Oct 2016)</dd>
</dl>
<h3>Log Message</h3>
<pre>[JSC] Move InterceptsGetOwnPropertySlotByIndexEvenWhenLengthIsNotZero to out of line type info flags
https://bugs.webkit.org/show_bug.cgi?id=163716
Reviewed by Saam Barati.
We found that all the accesses to the InterceptsGetOwnPropertySlotByIndexEvenWhenLengthIsNotZero flag is
done through the Structure. There is no user that accesses this flag in the cell inlined member. And JIT
code does not access it directly. That means that we can move this flag from inlined flags to out of line
flags. This patch moves it to the out of line flags. And make one bit empty in inlined flags. Later this
new empty flag will be used by megamorphic DOMJIT implementation.
* runtime/JSTypeInfo.h:
(JSC::TypeInfo::hasStaticPropertyTable):
(JSC::TypeInfo::interceptsGetOwnPropertySlotByIndexEvenWhenLengthIsNotZero):</pre>
<h3>Modified Paths</h3>
<ul>
<li><a href="#trunkSourceJavaScriptCoreChangeLog">trunk/Source/JavaScriptCore/ChangeLog</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeJSTypeInfoh">trunk/Source/JavaScriptCore/runtime/JSTypeInfo.h</a></li>
</ul>
</div>
<div id="patch">
<h3>Diff</h3>
<a id="trunkSourceJavaScriptCoreChangeLog"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/ChangeLog (207624 => 207625)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/ChangeLog 2016-10-20 17:44:37 UTC (rev 207624)
+++ trunk/Source/JavaScriptCore/ChangeLog 2016-10-20 18:02:31 UTC (rev 207625)
</span><span class="lines">@@ -1,3 +1,20 @@
</span><ins>+2016-10-19 Yusuke Suzuki <utatane.tea@gmail.com>
+
+ [JSC] Move InterceptsGetOwnPropertySlotByIndexEvenWhenLengthIsNotZero to out of line type info flags
+ https://bugs.webkit.org/show_bug.cgi?id=163716
+
+ Reviewed by Saam Barati.
+
+ We found that all the accesses to the InterceptsGetOwnPropertySlotByIndexEvenWhenLengthIsNotZero flag is
+ done through the Structure. There is no user that accesses this flag in the cell inlined member. And JIT
+ code does not access it directly. That means that we can move this flag from inlined flags to out of line
+ flags. This patch moves it to the out of line flags. And make one bit empty in inlined flags. Later this
+ new empty flag will be used by megamorphic DOMJIT implementation.
+
+ * runtime/JSTypeInfo.h:
+ (JSC::TypeInfo::hasStaticPropertyTable):
+ (JSC::TypeInfo::interceptsGetOwnPropertySlotByIndexEvenWhenLengthIsNotZero):
+
</ins><span class="cx"> 2016-10-20 Keith Miller <keith_miller@apple.com>
</span><span class="cx">
</span><span class="cx"> Invalid assertion in arguments elimination
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeJSTypeInfoh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/JSTypeInfo.h (207624 => 207625)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/JSTypeInfo.h 2016-10-20 17:44:37 UTC (rev 207624)
+++ trunk/Source/JavaScriptCore/runtime/JSTypeInfo.h 2016-10-20 18:02:31 UTC (rev 207625)
</span><span class="lines">@@ -39,7 +39,6 @@
</span><span class="cx"> static const unsigned ImplementsDefaultHasInstance = 1 << 1;
</span><span class="cx"> static const unsigned TypeOfShouldCallGetCallData = 1 << 2; // Need this flag if you override getCallData() and you want typeof to use this to determine if it should say "function". Currently we always set this flag when we override getCallData().
</span><span class="cx"> static const unsigned OverridesGetOwnPropertySlot = 1 << 3;
</span><del>-static const unsigned InterceptsGetOwnPropertySlotByIndexEvenWhenLengthIsNotZero = 1 << 4;
</del><span class="cx"> static const unsigned StructureIsImmortal = 1 << 5;
</span><span class="cx"> static const unsigned OverridesToThis = 1 << 6; // If this is false then this returns something other than 'this'. Non-object cells that are visible to JS have this set as do some exotic objects.
</span><span class="cx"> static const unsigned HasStaticPropertyTable = 1 << 7;
</span><span class="lines">@@ -51,6 +50,7 @@
</span><span class="cx"> static const unsigned NewImpurePropertyFiresWatchpoints = 1 << 12;
</span><span class="cx"> static const unsigned IsEnvironmentRecord = 1 << 13;
</span><span class="cx"> static const unsigned GetOwnPropertySlotIsImpureForPropertyAbsence = 1 << 14;
</span><ins>+static const unsigned InterceptsGetOwnPropertySlotByIndexEvenWhenLengthIsNotZero = 1 << 15;
</ins><span class="cx">
</span><span class="cx"> class TypeInfo {
</span><span class="cx"> public:
</span><span class="lines">@@ -83,7 +83,6 @@
</span><span class="cx"> bool overridesGetOwnPropertySlot() const { return overridesGetOwnPropertySlot(inlineTypeFlags()); }
</span><span class="cx"> static bool overridesGetOwnPropertySlot(InlineTypeFlags flags) { return flags & OverridesGetOwnPropertySlot; }
</span><span class="cx"> static bool hasStaticPropertyTable(InlineTypeFlags flags) { return flags & HasStaticPropertyTable; }
</span><del>- bool interceptsGetOwnPropertySlotByIndexEvenWhenLengthIsNotZero() const { return isSetOnFlags1(InterceptsGetOwnPropertySlotByIndexEvenWhenLengthIsNotZero); }
</del><span class="cx"> bool structureIsImmortal() const { return isSetOnFlags1(StructureIsImmortal); }
</span><span class="cx"> bool overridesToThis() const { return isSetOnFlags1(OverridesToThis); }
</span><span class="cx"> bool overridesGetPropertyNames() const { return isSetOnFlags2(OverridesGetPropertyNames); }
</span><span class="lines">@@ -92,6 +91,7 @@
</span><span class="cx"> bool getOwnPropertySlotIsImpureForPropertyAbsence() const { return isSetOnFlags2(GetOwnPropertySlotIsImpureForPropertyAbsence); }
</span><span class="cx"> bool newImpurePropertyFiresWatchpoints() const { return isSetOnFlags2(NewImpurePropertyFiresWatchpoints); }
</span><span class="cx"> bool isEnvironmentRecord() const { return isSetOnFlags2(IsEnvironmentRecord); }
</span><ins>+ bool interceptsGetOwnPropertySlotByIndexEvenWhenLengthIsNotZero() const { return isSetOnFlags2(InterceptsGetOwnPropertySlotByIndexEvenWhenLengthIsNotZero); }
</ins><span class="cx">
</span><span class="cx"> static ptrdiff_t flagsOffset()
</span><span class="cx"> {
</span></span></pre>
</div>
</div>
</body>
</html>