<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN"
"http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head><meta http-equiv="content-type" content="text/html; charset=utf-8" />
<title>[208070] trunk</title>
</head>
<body>

<style type="text/css"><!--
#msg dl.meta { border: 1px #006 solid; background: #369; padding: 6px; color: #fff; }
#msg dl.meta dt { float: left; width: 6em; font-weight: bold; }
#msg dt:after { content:':';}
#msg dl, #msg dt, #msg ul, #msg li, #header, #footer, #logmsg { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt;  }
#msg dl a { font-weight: bold}
#msg dl a:link    { color:#fc3; }
#msg dl a:active  { color:#ff0; }
#msg dl a:visited { color:#cc6; }
h3 { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; font-weight: bold; }
#msg pre { overflow: auto; background: #ffc; border: 1px #fa0 solid; padding: 6px; }
#logmsg { background: #ffc; border: 1px #fa0 solid; padding: 1em 1em 0 1em; }
#logmsg p, #logmsg pre, #logmsg blockquote { margin: 0 0 1em 0; }
#logmsg p, #logmsg li, #logmsg dt, #logmsg dd { line-height: 14pt; }
#logmsg h1, #logmsg h2, #logmsg h3, #logmsg h4, #logmsg h5, #logmsg h6 { margin: .5em 0; }
#logmsg h1:first-child, #logmsg h2:first-child, #logmsg h3:first-child, #logmsg h4:first-child, #logmsg h5:first-child, #logmsg h6:first-child { margin-top: 0; }
#logmsg ul, #logmsg ol { padding: 0; list-style-position: inside; margin: 0 0 0 1em; }
#logmsg ul { text-indent: -1em; padding-left: 1em; }#logmsg ol { text-indent: -1.5em; padding-left: 1.5em; }
#logmsg > ul, #logmsg > ol { margin: 0 0 1em 0; }
#logmsg pre { background: #eee; padding: 1em; }
#logmsg blockquote { border: 1px solid #fa0; border-left-width: 10px; padding: 1em 1em 0 1em; background: white;}
#logmsg dl { margin: 0; }
#logmsg dt { font-weight: bold; }
#logmsg dd { margin: 0; padding: 0 0 0.5em 0; }
#logmsg dd:before { content:'\00bb';}
#logmsg table { border-spacing: 0px; border-collapse: collapse; border-top: 4px solid #fa0; border-bottom: 1px solid #fa0; background: #fff; }
#logmsg table th { text-align: left; font-weight: normal; padding: 0.2em 0.5em; border-top: 1px dotted #fa0; }
#logmsg table td { text-align: right; border-top: 1px dotted #fa0; padding: 0.2em 0.5em; }
#logmsg table thead th { text-align: center; border-bottom: 1px solid #fa0; }
#logmsg table th.Corner { text-align: left; }
#logmsg hr { border: none 0; border-top: 2px dashed #fa0; height: 1px; }
#header, #footer { color: #fff; background: #636; border: 1px #300 solid; padding: 6px; }
#patch { width: 100%; }
#patch h4 {font-family: verdana,arial,helvetica,sans-serif;font-size:10pt;padding:8px;background:#369;color:#fff;margin:0;}
#patch .propset h4, #patch .binary h4 {margin:0;}
#patch pre {padding:0;line-height:1.2em;margin:0;}
#patch .diff {width:100%;background:#eee;padding: 0 0 10px 0;overflow:auto;}
#patch .propset .diff, #patch .binary .diff  {padding:10px 0;}
#patch span {display:block;padding:0 10px;}
#patch .modfile, #patch .addfile, #patch .delfile, #patch .propset, #patch .binary, #patch .copfile {border:1px solid #ccc;margin:10px 0;}
#patch ins {background:#dfd;text-decoration:none;display:block;padding:0 10px;}
#patch del {background:#fdd;text-decoration:none;display:block;padding:0 10px;}
#patch .lines, .info {color:#888;background:#fff;}
--></style>
<div id="msg">
<dl class="meta">
<dt>Revision</dt> <dd><a href="http://trac.webkit.org/projects/webkit/changeset/208070">208070</a></dd>
<dt>Author</dt> <dd>utatane.tea@gmail.com</dd>
<dt>Date</dt> <dd>2016-10-28 14:33:30 -0700 (Fri, 28 Oct 2016)</dd>
</dl>

<h3>Log Message</h3>
<pre>[DOMJIT] Implement Document::documentElement
https://bugs.webkit.org/show_bug.cgi?id=164113

Reviewed by Sam Weinig.

Source/WebCore:

Test: js/dom/domjit-accessor-document-element.html

This patch implements document.documentElement DOMJIT accessor.
Similar to ownerDocument accessor, the way to access to document.documentElement
from JIT code is already prepared for CSSJIT. DOMJIT just utilizes the existing
functionality: using documentElementMemoryOffset().

document.documentElement is frequently called in jQuery. Especially, every time
we call jQuery.attr(), this is called.

To implement Document accessor, we clean up some code in DOMJITHelpers.
We create the cpp file for DOMJITHelpers and move some helpers to it.
And we also implement DOMJIT::checkDOM&lt;DOMInterface&gt; for convenience.
It returns appropriate CheckDOM patchpoint implementation.

This patch improves Dromaeo jslib-attr-jquery.html 10% (481.64 v.s. 532.54).

* CMakeLists.txt:
* WebCore.xcodeproj/project.pbxproj:
* cssjit/SelectorCompiler.cpp:
(WebCore::SelectorCompiler::SelectorCodeGenerator::generateElementIsScopeRoot):
* dom/Document.idl:
* domjit/DOMJITAbstractHeapRepository.h:
* domjit/DOMJITCheckDOM.h: Copied from Source/WebCore/domjit/DOMJITAbstractHeapRepository.h.
(WebCore::DOMJIT::TypeChecker&lt;Node&gt;::branchIfFail):
(WebCore::DOMJIT::TypeChecker&lt;Document&gt;::branchIfFail):
(WebCore::DOMJIT::TypeChecker&lt;Event&gt;::branchIfFail):
(WebCore::DOMJIT::TypeChecker&lt;Element&gt;::branchIfFail):
(WebCore::DOMJIT::checkDOM):
* domjit/DOMJITHelpers.cpp: Copied from Source/WebCore/domjit/DOMJITAbstractHeapRepository.h.
(WebCore::DOMJIT::loadDocument):
(WebCore::DOMJIT::loadDocumentElement):
* domjit/DOMJITHelpers.h:
(WebCore::DOMJIT::toWrapperSlow):
(WebCore::DOMJIT::loadDocument): Deleted.
* domjit/JSDocumentDOMJIT.cpp: Added.
(WebCore::DocumentDocumentElementDOMJIT::checkDOM):
(WebCore::DocumentDocumentElementDOMJIT::callDOM):
* domjit/JSNodeDOMJIT.cpp:
(WebCore::createCallDOMForOffsetAccess):
(WebCore::NodeFirstChildDOMJIT::checkDOM):
(WebCore::NodeLastChildDOMJIT::checkDOM):
(WebCore::NodeNextSiblingDOMJIT::checkDOM):
(WebCore::NodePreviousSiblingDOMJIT::checkDOM):
(WebCore::NodeParentNodeDOMJIT::checkDOM):
(WebCore::NodeNodeTypeDOMJIT::checkDOM):
(WebCore::NodeOwnerDocumentDOMJIT::checkDOM):
(WebCore::NodeOwnerDocumentDOMJIT::callDOM):
(WebCore::toWrapperSlow): Deleted.
(WebCore::checkNode): Deleted.

LayoutTests:

* js/dom/domjit-accessor-document-element-changed-expected.txt: Added.
* js/dom/domjit-accessor-document-element-changed.html: Added.
* js/dom/domjit-accessor-document-element-expected.txt: Added.
* js/dom/domjit-accessor-document-element.html: Added.</pre>

<h3>Modified Paths</h3>
<ul>
<li><a href="#trunkLayoutTestsChangeLog">trunk/LayoutTests/ChangeLog</a></li>
<li><a href="#trunkSourceWebCoreCMakeListstxt">trunk/Source/WebCore/CMakeLists.txt</a></li>
<li><a href="#trunkSourceWebCoreChangeLog">trunk/Source/WebCore/ChangeLog</a></li>
<li><a href="#trunkSourceWebCoreWebCorexcodeprojprojectpbxproj">trunk/Source/WebCore/WebCore.xcodeproj/project.pbxproj</a></li>
<li><a href="#trunkSourceWebCorecssjitSelectorCompilercpp">trunk/Source/WebCore/cssjit/SelectorCompiler.cpp</a></li>
<li><a href="#trunkSourceWebCoredomDocumentidl">trunk/Source/WebCore/dom/Document.idl</a></li>
<li><a href="#trunkSourceWebCoredomjitDOMJITAbstractHeapRepositoryh">trunk/Source/WebCore/domjit/DOMJITAbstractHeapRepository.h</a></li>
<li><a href="#trunkSourceWebCoredomjitDOMJITHelpersh">trunk/Source/WebCore/domjit/DOMJITHelpers.h</a></li>
<li><a href="#trunkSourceWebCoredomjitJSNodeDOMJITcpp">trunk/Source/WebCore/domjit/JSNodeDOMJIT.cpp</a></li>
</ul>

<h3>Added Paths</h3>
<ul>
<li><a href="#trunkLayoutTestsjsdomdomjitaccessordocumentelementchangedexpectedtxt">trunk/LayoutTests/js/dom/domjit-accessor-document-element-changed-expected.txt</a></li>
<li><a href="#trunkLayoutTestsjsdomdomjitaccessordocumentelementchangedhtml">trunk/LayoutTests/js/dom/domjit-accessor-document-element-changed.html</a></li>
<li><a href="#trunkLayoutTestsjsdomdomjitaccessordocumentelementexpectedtxt">trunk/LayoutTests/js/dom/domjit-accessor-document-element-expected.txt</a></li>
<li><a href="#trunkLayoutTestsjsdomdomjitaccessordocumentelementhtml">trunk/LayoutTests/js/dom/domjit-accessor-document-element.html</a></li>
<li><a href="#trunkSourceWebCoredomjitDOMJITCheckDOMh">trunk/Source/WebCore/domjit/DOMJITCheckDOM.h</a></li>
<li><a href="#trunkSourceWebCoredomjitDOMJITHelperscpp">trunk/Source/WebCore/domjit/DOMJITHelpers.cpp</a></li>
<li><a href="#trunkSourceWebCoredomjitJSDocumentDOMJITcpp">trunk/Source/WebCore/domjit/JSDocumentDOMJIT.cpp</a></li>
</ul>

</div>
<div id="patch">
<h3>Diff</h3>
<a id="trunkLayoutTestsChangeLog"></a>
<div class="modfile"><h4>Modified: trunk/LayoutTests/ChangeLog (208069 => 208070)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/ChangeLog        2016-10-28 21:12:41 UTC (rev 208069)
+++ trunk/LayoutTests/ChangeLog        2016-10-28 21:33:30 UTC (rev 208070)
</span><span class="lines">@@ -1,3 +1,15 @@
</span><ins>+2016-10-28  Yusuke Suzuki  &lt;utatane.tea@gmail.com&gt;
+
+        [DOMJIT] Implement Document::documentElement
+        https://bugs.webkit.org/show_bug.cgi?id=164113
+
+        Reviewed by Sam Weinig.
+
+        * js/dom/domjit-accessor-document-element-changed-expected.txt: Added.
+        * js/dom/domjit-accessor-document-element-changed.html: Added.
+        * js/dom/domjit-accessor-document-element-expected.txt: Added.
+        * js/dom/domjit-accessor-document-element.html: Added.
+
</ins><span class="cx"> 2016-10-28  Simon Fraser  &lt;simon.fraser@apple.com&gt;
</span><span class="cx"> 
</span><span class="cx">         Wrong blur radius for filter: drop-shadow()
</span></span></pre></div>
<a id="trunkLayoutTestsjsdomdomjitaccessordocumentelementchangedexpectedtxt"></a>
<div class="addfile"><h4>Added: trunk/LayoutTests/js/dom/domjit-accessor-document-element-changed-expected.txt (0 => 208070)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/dom/domjit-accessor-document-element-changed-expected.txt                                (rev 0)
+++ trunk/LayoutTests/js/dom/domjit-accessor-document-element-changed-expected.txt        2016-10-28 21:33:30 UTC (rev 208070)
</span><span class="lines">@@ -0,0 +1,11 @@
</span><ins>+Test DOMJIT documentElement accessor works after the documentElement is changed.
+
+On success, you will see a series of &quot;PASS&quot; messages, followed by &quot;TEST COMPLETE&quot;.
+
+
+PASS testNull(target, result) is false
+PASS testNull(target, result) is true
+PASS successfullyParsed is true
+
+TEST COMPLETE
+
</ins></span></pre></div>
<a id="trunkLayoutTestsjsdomdomjitaccessordocumentelementchangedhtml"></a>
<div class="addfile"><h4>Added: trunk/LayoutTests/js/dom/domjit-accessor-document-element-changed.html (0 => 208070)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/dom/domjit-accessor-document-element-changed.html                                (rev 0)
+++ trunk/LayoutTests/js/dom/domjit-accessor-document-element-changed.html        2016-10-28 21:33:30 UTC (rev 208070)
</span><span class="lines">@@ -0,0 +1,36 @@
</span><ins>+&lt;!DOCTYPE html&gt;
+&lt;html&gt;
+&lt;head&gt;
+&lt;script src=&quot;../../resources/js-test-pre.js&quot;&gt;&lt;/script&gt;
+&lt;/head&gt;
+&lt;body&gt;
+&lt;script&gt;
+description('Test DOMJIT documentElement accessor works after the documentElement is changed.');
+
+var target = null;
+var result = null;
+
+function testNull(element, result)
+{
+    return element.documentElement === result;
+}
+
+function runTest()
+{
+    target = document.implementation.createDocument('', null, null);
+    var element = target.createElement('html');
+    result = null;
+    for (var i = 0; i &lt; 1e4; ++i)
+        shouldBeTrueQuiet(`testNull(target, result)`);
+
+    target.appendChild(element);
+    shouldBeFalse(`testNull(target, result)`);
+    result = element;
+    shouldBeTrue(`testNull(target, result)`);
+
+}
+runTest();
+&lt;/script&gt;
+&lt;script src=&quot;../../resources/js-test-post.js&quot;&gt;&lt;/script&gt;
+&lt;/body&gt;
+&lt;/html&gt;
</ins></span></pre></div>
<a id="trunkLayoutTestsjsdomdomjitaccessordocumentelementexpectedtxt"></a>
<div class="addfile"><h4>Added: trunk/LayoutTests/js/dom/domjit-accessor-document-element-expected.txt (0 => 208070)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/dom/domjit-accessor-document-element-expected.txt                                (rev 0)
+++ trunk/LayoutTests/js/dom/domjit-accessor-document-element-expected.txt        2016-10-28 21:33:30 UTC (rev 208070)
</span><span class="lines">@@ -0,0 +1,39 @@
</span><ins>+Test DOMJIT documentElement accessor works.
+
+On success, you will see a series of &quot;PASS&quot; messages, followed by &quot;TEST COMPLETE&quot;.
+
+
+PASS successfullyParsed is true
+
+TEST COMPLETE
+PASS (
+            function testHTMLDocument(element, result)
+            {
+                for (var i = 0; i &lt; 1e4; ++i) {
+                    if (element.documentElement !== result)
+                        return false;
+                }
+                return true;
+            }
+        )(target, result) is true
+PASS (
+            function testXMLDocument(element, result)
+            {
+                for (var i = 0; i &lt; 1e4; ++i) {
+                    if (element.documentElement !== result)
+                        return false;
+                }
+                return true;
+            }
+        )(target, result) is true
+PASS (
+            function testNull(element, result)
+            {
+                for (var i = 0; i &lt; 1e4; ++i) {
+                    if (element.documentElement !== result)
+                        return false;
+                }
+                return true;
+            }
+        )(target, result) is true
+
</ins></span></pre></div>
<a id="trunkLayoutTestsjsdomdomjitaccessordocumentelementhtml"></a>
<div class="addfile"><h4>Added: trunk/LayoutTests/js/dom/domjit-accessor-document-element.html (0 => 208070)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/dom/domjit-accessor-document-element.html                                (rev 0)
+++ trunk/LayoutTests/js/dom/domjit-accessor-document-element.html        2016-10-28 21:33:30 UTC (rev 208070)
</span><span class="lines">@@ -0,0 +1,49 @@
</span><ins>+&lt;!DOCTYPE html&gt;
+&lt;html&gt;
+&lt;head&gt;
+&lt;script src=&quot;../../resources/js-test-pre.js&quot;&gt;&lt;/script&gt;
+&lt;/head&gt;
+&lt;body&gt;
+&lt;iframe id=&quot;xmlframe&quot; onload=&quot;frameLoaded()&quot; style=&quot;height:0px&quot; src=&quot;data:application/xhtml+xml,&lt;?xml version='1.0' encoding='UTF-8'?&gt;&lt;body/&gt;&quot;&gt;&lt;/iframe&gt;
+&lt;script&gt;
+description('Test DOMJIT documentElement accessor works.');
+
+if (window.testRunner)
+    testRunner.waitUntilDone();
+
+var target = null;
+var result = null;
+function runTest()
+{
+    var xmlDocument = document.getElementById('xmlframe').contentDocument;
+    var targets = [
+        ['HTMLDocument', document, document.firstElementChild],
+        ['XMLDocument', xmlDocument, xmlDocument.firstElementChild],
+        ['Null', document.implementation.createDocument('', null, null), null],
+    ];
+
+    for ([name, target, result] of targets) {
+        var text = `
+            function test${name}(element, result)
+            {
+                for (var i = 0; i &lt; 1e4; ++i) {
+                    if (element.documentElement !== result)
+                        return false;
+                }
+                return true;
+            }
+        `;
+        shouldBeTrue(`(${text})(target, result)`);
+    }
+
+    if (window.testRunner)
+        testRunner.notifyDone();
+}
+function frameLoaded()
+{
+    runTest();
+}
+&lt;/script&gt;
+&lt;script src=&quot;../../resources/js-test-post.js&quot;&gt;&lt;/script&gt;
+&lt;/body&gt;
+&lt;/html&gt;
</ins></span></pre></div>
<a id="trunkSourceWebCoreCMakeListstxt"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/CMakeLists.txt (208069 => 208070)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/CMakeLists.txt        2016-10-28 21:12:41 UTC (rev 208069)
+++ trunk/Source/WebCore/CMakeLists.txt        2016-10-28 21:33:30 UTC (rev 208070)
</span><span class="lines">@@ -1545,6 +1545,8 @@
</span><span class="cx">     dom/default/PlatformMessagePortChannel.cpp
</span><span class="cx"> 
</span><span class="cx">     domjit/DOMJITAbstractHeapRepository.cpp
</span><ins>+    domjit/DOMJITHelpers.cpp
+    domjit/JSDocumentDOMJIT.cpp
</ins><span class="cx">     domjit/JSNodeDOMJIT.cpp
</span><span class="cx"> 
</span><span class="cx">     editing/AlternativeTextController.cpp
</span></span></pre></div>
<a id="trunkSourceWebCoreChangeLog"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/ChangeLog (208069 => 208070)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/ChangeLog        2016-10-28 21:12:41 UTC (rev 208069)
+++ trunk/Source/WebCore/ChangeLog        2016-10-28 21:33:30 UTC (rev 208070)
</span><span class="lines">@@ -1,3 +1,61 @@
</span><ins>+2016-10-28  Yusuke Suzuki  &lt;utatane.tea@gmail.com&gt;
+
+        [DOMJIT] Implement Document::documentElement
+        https://bugs.webkit.org/show_bug.cgi?id=164113
+
+        Reviewed by Sam Weinig.
+
+        Test: js/dom/domjit-accessor-document-element.html
+
+        This patch implements document.documentElement DOMJIT accessor.
+        Similar to ownerDocument accessor, the way to access to document.documentElement
+        from JIT code is already prepared for CSSJIT. DOMJIT just utilizes the existing
+        functionality: using documentElementMemoryOffset().
+
+        document.documentElement is frequently called in jQuery. Especially, every time
+        we call jQuery.attr(), this is called.
+
+        To implement Document accessor, we clean up some code in DOMJITHelpers.
+        We create the cpp file for DOMJITHelpers and move some helpers to it.
+        And we also implement DOMJIT::checkDOM&lt;DOMInterface&gt; for convenience.
+        It returns appropriate CheckDOM patchpoint implementation.
+
+        This patch improves Dromaeo jslib-attr-jquery.html 10% (481.64 v.s. 532.54).
+
+        * CMakeLists.txt:
+        * WebCore.xcodeproj/project.pbxproj:
+        * cssjit/SelectorCompiler.cpp:
+        (WebCore::SelectorCompiler::SelectorCodeGenerator::generateElementIsScopeRoot):
+        * dom/Document.idl:
+        * domjit/DOMJITAbstractHeapRepository.h:
+        * domjit/DOMJITCheckDOM.h: Copied from Source/WebCore/domjit/DOMJITAbstractHeapRepository.h.
+        (WebCore::DOMJIT::TypeChecker&lt;Node&gt;::branchIfFail):
+        (WebCore::DOMJIT::TypeChecker&lt;Document&gt;::branchIfFail):
+        (WebCore::DOMJIT::TypeChecker&lt;Event&gt;::branchIfFail):
+        (WebCore::DOMJIT::TypeChecker&lt;Element&gt;::branchIfFail):
+        (WebCore::DOMJIT::checkDOM):
+        * domjit/DOMJITHelpers.cpp: Copied from Source/WebCore/domjit/DOMJITAbstractHeapRepository.h.
+        (WebCore::DOMJIT::loadDocument):
+        (WebCore::DOMJIT::loadDocumentElement):
+        * domjit/DOMJITHelpers.h:
+        (WebCore::DOMJIT::toWrapperSlow):
+        (WebCore::DOMJIT::loadDocument): Deleted.
+        * domjit/JSDocumentDOMJIT.cpp: Added.
+        (WebCore::DocumentDocumentElementDOMJIT::checkDOM):
+        (WebCore::DocumentDocumentElementDOMJIT::callDOM):
+        * domjit/JSNodeDOMJIT.cpp:
+        (WebCore::createCallDOMForOffsetAccess):
+        (WebCore::NodeFirstChildDOMJIT::checkDOM):
+        (WebCore::NodeLastChildDOMJIT::checkDOM):
+        (WebCore::NodeNextSiblingDOMJIT::checkDOM):
+        (WebCore::NodePreviousSiblingDOMJIT::checkDOM):
+        (WebCore::NodeParentNodeDOMJIT::checkDOM):
+        (WebCore::NodeNodeTypeDOMJIT::checkDOM):
+        (WebCore::NodeOwnerDocumentDOMJIT::checkDOM):
+        (WebCore::NodeOwnerDocumentDOMJIT::callDOM):
+        (WebCore::toWrapperSlow): Deleted.
+        (WebCore::checkNode): Deleted.
+
</ins><span class="cx"> 2016-10-28  Dave Hyatt  &lt;hyatt@apple.com&gt;
</span><span class="cx"> 
</span><span class="cx">         [CSS Parser] Support initial-letter
</span></span></pre></div>
<a id="trunkSourceWebCoreWebCorexcodeprojprojectpbxproj"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/WebCore.xcodeproj/project.pbxproj (208069 => 208070)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/WebCore.xcodeproj/project.pbxproj        2016-10-28 21:12:41 UTC (rev 208069)
+++ trunk/Source/WebCore/WebCore.xcodeproj/project.pbxproj        2016-10-28 21:33:30 UTC (rev 208070)
</span><span class="lines">@@ -6207,11 +6207,14 @@
</span><span class="cx">                 E377FE4D1DADE16500CDD025 /* NodeConstants.h in Headers */ = {isa = PBXBuildFile; fileRef = E3D049931DADC04500718F3C /* NodeConstants.h */; settings = {ATTRIBUTES = (Private, ); }; };
</span><span class="cx">                 E38838981BAD145F00D62EE3 /* ScriptModuleLoader.cpp in Sources */ = {isa = PBXBuildFile; fileRef = E38838941BAD145F00D62EE3 /* ScriptModuleLoader.cpp */; };
</span><span class="cx">                 E38838991BAD145F00D62EE3 /* ScriptModuleLoader.h in Headers */ = {isa = PBXBuildFile; fileRef = E38838951BAD145F00D62EE3 /* ScriptModuleLoader.h */; };
</span><ins>+                E398FC241DC32A20003C4684 /* DOMJITHelpers.cpp in Sources */ = {isa = PBXBuildFile; fileRef = E398FC231DC32A1B003C4684 /* DOMJITHelpers.cpp */; };
</ins><span class="cx">                 E3B2F0EB1D7F4C9D00B0C9D1 /* LoadableClassicScript.cpp in Sources */ = {isa = PBXBuildFile; fileRef = E3B2F0E31D7F35EC00B0C9D1 /* LoadableClassicScript.cpp */; };
</span><span class="cx">                 E3B2F0EC1D7F4CA100B0C9D1 /* LoadableScript.cpp in Sources */ = {isa = PBXBuildFile; fileRef = E3B2F0E91D7F3D3C00B0C9D1 /* LoadableScript.cpp */; };
</span><span class="cx">                 E3B2F0ED1D7F4CA300B0C9D1 /* LoadableScript.h in Headers */ = {isa = PBXBuildFile; fileRef = E3B2F0E71D7F35EC00B0C9D1 /* LoadableScript.h */; settings = {ATTRIBUTES = (Private, ); }; };
</span><span class="cx">                 E3B2F0EE1D7F4CA900B0C9D1 /* LoadableScriptClient.h in Headers */ = {isa = PBXBuildFile; fileRef = E3B2F0E81D7F35EC00B0C9D1 /* LoadableScriptClient.h */; settings = {ATTRIBUTES = (Private, ); }; };
</span><span class="cx">                 E3B2F0F01D7F4CB500B0C9D1 /* LoadableClassicScript.h in Headers */ = {isa = PBXBuildFile; fileRef = E3B2F0E41D7F35EC00B0C9D1 /* LoadableClassicScript.h */; settings = {ATTRIBUTES = (Private, ); }; };
</span><ins>+                E3B7C0631DC34160001FB0B8 /* JSDocumentDOMJIT.cpp in Sources */ = {isa = PBXBuildFile; fileRef = E3B7C0621DC3415A001FB0B8 /* JSDocumentDOMJIT.cpp */; };
+                E3C99A091DC3D41C00794AD3 /* DOMJITCheckDOM.h in Headers */ = {isa = PBXBuildFile; fileRef = E3C99A081DC3D41700794AD3 /* DOMJITCheckDOM.h */; };
</ins><span class="cx">                 E3FA38641D71812D00AA5950 /* PendingScriptClient.h in Headers */ = {isa = PBXBuildFile; fileRef = E3FA38611D716E7600AA5950 /* PendingScriptClient.h */; };
</span><span class="cx">                 E401C27517CE53EC00C41A35 /* ElementIteratorAssertions.h in Headers */ = {isa = PBXBuildFile; fileRef = E401C27417CE53EC00C41A35 /* ElementIteratorAssertions.h */; settings = {ATTRIBUTES = (Private, ); }; };
</span><span class="cx">                 E401E0A41C3C0B8300F34D10 /* StyleChange.h in Headers */ = {isa = PBXBuildFile; fileRef = E401E0A31C3C0B8300F34D10 /* StyleChange.h */; settings = {ATTRIBUTES = (Private, ); }; };
</span><span class="lines">@@ -14038,6 +14041,7 @@
</span><span class="cx">                 E35CA14C1DBC3A3C00F83516 /* DOMJITAbstractHeapRepository.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DOMJITAbstractHeapRepository.h; sourceTree = &quot;&lt;group&gt;&quot;; };
</span><span class="cx">                 E38838941BAD145F00D62EE3 /* ScriptModuleLoader.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ScriptModuleLoader.cpp; sourceTree = &quot;&lt;group&gt;&quot;; };
</span><span class="cx">                 E38838951BAD145F00D62EE3 /* ScriptModuleLoader.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ScriptModuleLoader.h; sourceTree = &quot;&lt;group&gt;&quot;; };
</span><ins>+                E398FC231DC32A1B003C4684 /* DOMJITHelpers.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = DOMJITHelpers.cpp; sourceTree = &quot;&lt;group&gt;&quot;; };
</ins><span class="cx">                 E3AFA9641DA6E908002861BD /* JSNodeDOMJIT.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSNodeDOMJIT.cpp; sourceTree = &quot;&lt;group&gt;&quot;; };
</span><span class="cx">                 E3B2F0E31D7F35EC00B0C9D1 /* LoadableClassicScript.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = LoadableClassicScript.cpp; sourceTree = &quot;&lt;group&gt;&quot;; };
</span><span class="cx">                 E3B2F0E41D7F35EC00B0C9D1 /* LoadableClassicScript.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = LoadableClassicScript.h; sourceTree = &quot;&lt;group&gt;&quot;; };
</span><span class="lines">@@ -14044,6 +14048,8 @@
</span><span class="cx">                 E3B2F0E71D7F35EC00B0C9D1 /* LoadableScript.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = LoadableScript.h; sourceTree = &quot;&lt;group&gt;&quot;; };
</span><span class="cx">                 E3B2F0E81D7F35EC00B0C9D1 /* LoadableScriptClient.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = LoadableScriptClient.h; sourceTree = &quot;&lt;group&gt;&quot;; };
</span><span class="cx">                 E3B2F0E91D7F3D3C00B0C9D1 /* LoadableScript.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = LoadableScript.cpp; sourceTree = &quot;&lt;group&gt;&quot;; };
</span><ins>+                E3B7C0621DC3415A001FB0B8 /* JSDocumentDOMJIT.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSDocumentDOMJIT.cpp; sourceTree = &quot;&lt;group&gt;&quot;; };
+                E3C99A081DC3D41700794AD3 /* DOMJITCheckDOM.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DOMJITCheckDOM.h; sourceTree = &quot;&lt;group&gt;&quot;; };
</ins><span class="cx">                 E3D049931DADC04500718F3C /* NodeConstants.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = NodeConstants.h; sourceTree = &quot;&lt;group&gt;&quot;; };
</span><span class="cx">                 E3FA38611D716E7600AA5950 /* PendingScriptClient.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = PendingScriptClient.h; sourceTree = &quot;&lt;group&gt;&quot;; };
</span><span class="cx">                 E401C27417CE53EC00C41A35 /* ElementIteratorAssertions.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ElementIteratorAssertions.h; sourceTree = &quot;&lt;group&gt;&quot;; };
</span><span class="lines">@@ -22822,7 +22828,10 @@
</span><span class="cx">                         children = (
</span><span class="cx">                                 E35CA14B1DBC3A3C00F83516 /* DOMJITAbstractHeapRepository.cpp */,
</span><span class="cx">                                 E35CA14C1DBC3A3C00F83516 /* DOMJITAbstractHeapRepository.h */,
</span><ins>+                                E3C99A081DC3D41700794AD3 /* DOMJITCheckDOM.h */,
+                                E398FC231DC32A1B003C4684 /* DOMJITHelpers.cpp */,
</ins><span class="cx">                                 E3150EA51DA7218D00194012 /* DOMJITHelpers.h */,
</span><ins>+                                E3B7C0621DC3415A001FB0B8 /* JSDocumentDOMJIT.cpp */,
</ins><span class="cx">                                 E3AFA9641DA6E908002861BD /* JSNodeDOMJIT.cpp */,
</span><span class="cx">                         );
</span><span class="cx">                         path = domjit;
</span><span class="lines">@@ -27397,6 +27406,7 @@
</span><span class="cx">                                 B2227A8F0D00BF220071B782 /* SVGPolyElement.h in Headers */,
</span><span class="cx">                                 B2227A910D00BF220071B782 /* SVGPolygonElement.h in Headers */,
</span><span class="cx">                                 B2227A940D00BF220071B782 /* SVGPolylineElement.h in Headers */,
</span><ins>+                                E3C99A091DC3D41C00794AD3 /* DOMJITCheckDOM.h in Headers */,
</ins><span class="cx">                                 B2227A970D00BF220071B782 /* SVGPreserveAspectRatio.h in Headers */,
</span><span class="cx">                                 088A0E0A126EF1DB00978F7A /* SVGProperty.h in Headers */,
</span><span class="cx">                                 081DD49C13BA1A6000DC7627 /* SVGPropertyInfo.h in Headers */,
</span><span class="lines">@@ -29026,6 +29036,7 @@
</span><span class="cx">                                 A871DE240A152AC800B12A68 /* HTMLIFrameElement.cpp in Sources */,
</span><span class="cx">                                 A8EA7D310A19385500A8EF5F /* HTMLImageElement.cpp in Sources */,
</span><span class="cx">                                 A8EA7D300A19385500A8EF5F /* HTMLImageLoader.cpp in Sources */,
</span><ins>+                                E3B7C0631DC34160001FB0B8 /* JSDocumentDOMJIT.cpp in Sources */,
</ins><span class="cx">                                 A81369CD097374F600D74463 /* HTMLInputElement.cpp in Sources */,
</span><span class="cx">                                 93309DE5099E64920056E581 /* HTMLInterchange.cpp in Sources */,
</span><span class="cx">                                 A81369E5097374F600D74463 /* HTMLKeygenElement.cpp in Sources */,
</span><span class="lines">@@ -29334,6 +29345,7 @@
</span><span class="cx">                                 9BD4E9161C462872005065BC /* JSCustomElementInterface.cpp in Sources */,
</span><span class="cx">                                 9BE6710B1D5AEB2100345514 /* JSCustomElementRegistry.cpp in Sources */,
</span><span class="cx">                                 9BC5F9E01D5AAF6B002B749D /* JSCustomElementRegistryCustom.cpp in Sources */,
</span><ins>+                                E398FC241DC32A20003C4684 /* DOMJITHelpers.cpp in Sources */,
</ins><span class="cx">                                 E4778B7F115A581A00B5D372 /* JSCustomEvent.cpp in Sources */,
</span><span class="cx">                                 DEC297611B4F2F8D005F5945 /* JSCustomEventCustom.cpp in Sources */,
</span><span class="cx">                                 51EC92650CE90DD400F90308 /* JSCustomSQLStatementErrorCallback.cpp in Sources */,
</span></span></pre></div>
<a id="trunkSourceWebCorecssjitSelectorCompilercpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/cssjit/SelectorCompiler.cpp (208069 => 208070)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/cssjit/SelectorCompiler.cpp        2016-10-28 21:12:41 UTC (rev 208069)
+++ trunk/Source/WebCore/cssjit/SelectorCompiler.cpp        2016-10-28 21:33:30 UTC (rev 208070)
</span><span class="lines">@@ -3790,7 +3790,7 @@
</span><span class="cx">     Assembler::Jump scopeIsNotNull = m_assembler.branchTestPtr(Assembler::NonZero, scope);
</span><span class="cx"> 
</span><span class="cx">     DOMJIT::loadDocument(m_assembler, elementAddressRegister, scope);
</span><del>-    m_assembler.loadPtr(Assembler::Address(scope, Document::documentElementMemoryOffset()), scope);
</del><ins>+    DOMJIT::loadDocumentElement(m_assembler, scope, scope);
</ins><span class="cx"> 
</span><span class="cx">     scopeIsNotNull.link(&amp;m_assembler);
</span><span class="cx">     failureCases.append(m_assembler.branchPtr(Assembler::NotEqual, scope, elementAddressRegister));
</span></span></pre></div>
<a id="trunkSourceWebCoredomDocumentidl"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/dom/Document.idl (208069 => 208070)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/dom/Document.idl        2016-10-28 21:12:41 UTC (rev 208069)
+++ trunk/Source/WebCore/dom/Document.idl        2016-10-28 21:33:30 UTC (rev 208070)
</span><span class="lines">@@ -29,7 +29,7 @@
</span><span class="cx"> ] interface Document : Node {
</span><span class="cx">     readonly attribute DocumentType? doctype;
</span><span class="cx">     readonly attribute DOMImplementation implementation;
</span><del>-    readonly attribute Element? documentElement;
</del><ins>+    [DOMJIT] readonly attribute Element? documentElement;
</ins><span class="cx"> 
</span><span class="cx">     [NewObject, MayThrowLegacyException, ImplementedAs=createElementForBindings] Element createElement(DOMString tagName);
</span><span class="cx">     [NewObject] DocumentFragment createDocumentFragment();
</span></span></pre></div>
<a id="trunkSourceWebCoredomjitDOMJITAbstractHeapRepositoryh"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/domjit/DOMJITAbstractHeapRepository.h (208069 => 208070)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/domjit/DOMJITAbstractHeapRepository.h        2016-10-28 21:12:41 UTC (rev 208069)
+++ trunk/Source/WebCore/domjit/DOMJITAbstractHeapRepository.h        2016-10-28 21:33:30 UTC (rev 208070)
</span><span class="lines">@@ -43,6 +43,8 @@
</span><span class="cx">     V(Node_nextSibling, Node) \
</span><span class="cx">     V(Node_previousSibling, Node) \
</span><span class="cx">     V(Node_ownerDocument, Node) \
</span><ins>+    V(Document, DOM) \
+    V(Document_documentElement, Document) \
</ins><span class="cx"> 
</span><span class="cx"> 
</span><span class="cx"> class AbstractHeapRepository {
</span></span></pre></div>
<a id="trunkSourceWebCoredomjitDOMJITCheckDOMhfromrev208069trunkSourceWebCoredomjitDOMJITAbstractHeapRepositoryh"></a>
<div class="copfile"><h4>Copied: trunk/Source/WebCore/domjit/DOMJITCheckDOM.h (from rev 208069, trunk/Source/WebCore/domjit/DOMJITAbstractHeapRepository.h) (0 => 208070)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/domjit/DOMJITCheckDOM.h                                (rev 0)
+++ trunk/Source/WebCore/domjit/DOMJITCheckDOM.h        2016-10-28 21:33:30 UTC (rev 208070)
</span><span class="lines">@@ -0,0 +1,88 @@
</span><ins>+/*
+ * Copyright (C) 2016 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ *
+ */
+
+#pragma once
+
+#include &quot;DOMJITHelpers.h&quot;
+
+#if ENABLE(JIT)
+
+#include &quot;Document.h&quot;
+#include &quot;Element.h&quot;
+#include &quot;Event.h&quot;
+#include &quot;Node.h&quot;
+
+namespace WebCore { namespace DOMJIT {
+
+template&lt;typename DOMInterface&gt;
+struct TypeChecker {
+};
+
+template&lt;&gt;
+struct TypeChecker&lt;Node&gt; {
+    static CCallHelpers::Jump branchIfFail(CCallHelpers&amp; jit, GPRReg dom)
+    {
+        return DOMJIT::branchIfNotNode(jit, dom);
+    }
+};
+
+template&lt;&gt;
+struct TypeChecker&lt;Document&gt; {
+    static CCallHelpers::Jump branchIfFail(CCallHelpers&amp; jit, GPRReg dom)
+    {
+        return DOMJIT::branchIfNotDocumentWrapper(jit, dom);
+    }
+};
+
+template&lt;&gt;
+struct TypeChecker&lt;Event&gt; {
+    static CCallHelpers::Jump branchIfFail(CCallHelpers&amp; jit, GPRReg dom)
+    {
+        return DOMJIT::branchIfNotEvent(jit, dom);
+    }
+};
+
+template&lt;&gt;
+struct TypeChecker&lt;Element&gt; {
+    static CCallHelpers::Jump branchIfFail(CCallHelpers&amp; jit, GPRReg dom)
+    {
+        return DOMJIT::branchIfNotElement(jit, dom);
+    }
+};
+
+template&lt;typename DOMInterface&gt;
+Ref&lt;JSC::DOMJIT::Patchpoint&gt; checkDOM()
+{
+    Ref&lt;JSC::DOMJIT::Patchpoint&gt; patchpoint = JSC::DOMJIT::Patchpoint::create();
+    patchpoint-&gt;setGenerator([=](CCallHelpers&amp; jit, JSC::DOMJIT::PatchpointParams&amp; params) {
+        return TypeChecker&lt;DOMInterface&gt;::branchIfFail(jit, params[0].gpr());
+    });
+    return patchpoint;
+}
+
+} }
+
+#endif
</ins></span></pre></div>
<a id="trunkSourceWebCoredomjitDOMJITHelperscppfromrev208069trunkSourceWebCoredomjitDOMJITAbstractHeapRepositoryh"></a>
<div class="copfile"><h4>Copied: trunk/Source/WebCore/domjit/DOMJITHelpers.cpp (from rev 208069, trunk/Source/WebCore/domjit/DOMJITAbstractHeapRepository.h) (0 => 208070)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/domjit/DOMJITHelpers.cpp                                (rev 0)
+++ trunk/Source/WebCore/domjit/DOMJITHelpers.cpp        2016-10-28 21:33:30 UTC (rev 208070)
</span><span class="lines">@@ -0,0 +1,55 @@
</span><ins>+/*
+ * Copyright (C) 2016 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include &quot;config.h&quot;
+#include &quot;DOMJITHelpers.h&quot;
+
+#if ENABLE(JIT)
+
+#include &quot;Document.h&quot;
+#include &quot;JSDOMBinding.h&quot;
+#include &quot;Node.h&quot;
+
+namespace WebCore { namespace DOMJIT {
+
+using JSC::CCallHelpers;
+using JSC::GPRReg;
+using JSC::JSValueRegs;
+using JSC::MacroAssembler;
+
+void loadDocument(MacroAssembler&amp; jit, GPRReg node, GPRReg output)
+{
+    jit.loadPtr(CCallHelpers::Address(node, Node::treeScopeMemoryOffset()), output);
+    jit.loadPtr(CCallHelpers::Address(output, TreeScope::documentScopeMemoryOffset()), output);
+}
+
+void loadDocumentElement(MacroAssembler&amp; jit, GPRReg document, GPRReg output)
+{
+    jit.loadPtr(CCallHelpers::Address(document, Document::documentElementMemoryOffset()), output);
+}
+
+} }
+
+#endif
</ins></span></pre></div>
<a id="trunkSourceWebCoredomjitDOMJITHelpersh"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/domjit/DOMJITHelpers.h (208069 => 208070)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/domjit/DOMJITHelpers.h        2016-10-28 21:12:41 UTC (rev 208069)
+++ trunk/Source/WebCore/domjit/DOMJITHelpers.h        2016-10-28 21:33:30 UTC (rev 208070)
</span><span class="lines">@@ -27,8 +27,10 @@
</span><span class="cx"> #pragma once
</span><span class="cx"> 
</span><span class="cx"> #include &quot;JSDOMWrapper.h&quot;
</span><ins>+#include &quot;ScriptWrappable.h&quot;
</ins><span class="cx"> #include &lt;domjit/DOMJITPatchpoint.h&gt;
</span><span class="cx"> #include &lt;domjit/DOMJITPatchpointParams.h&gt;
</span><ins>+#include &lt;interpreter/FrameTracers.h&gt;
</ins><span class="cx"> 
</span><span class="cx"> #if ENABLE(JIT)
</span><span class="cx"> 
</span><span class="lines">@@ -51,6 +53,16 @@
</span><span class="cx">     return jit.branchTestPtr(CCallHelpers::NonZero, CCallHelpers::Address(weakImpl, JSC::WeakImpl::offsetOfWeakHandleOwner()), CCallHelpers::TrustedImm32(JSC::WeakImpl::StateMask));
</span><span class="cx"> }
</span><span class="cx"> 
</span><ins>+template&lt;typename WrappedNode&gt;
+JSC::EncodedJSValue JIT_OPERATION toWrapperSlow(JSC::ExecState* exec, JSC::JSGlobalObject* globalObject, void* result)
+{
+    ASSERT(exec);
+    ASSERT(result);
+    ASSERT(globalObject);
+    JSC::NativeCallFrameTracer tracer(&amp;exec-&gt;vm(), exec);
+    return JSC::JSValue::encode(toJS(exec, static_cast&lt;JSDOMGlobalObject*&gt;(globalObject), *static_cast&lt;WrappedNode*&gt;(result)));
+}
+
</ins><span class="cx"> template&lt;typename WrappedType&gt;
</span><span class="cx"> void tryLookUpWrapperCache(CCallHelpers&amp; jit, CCallHelpers::JumpList&amp; failureCases, GPRReg wrapped, GPRReg resultGPR)
</span><span class="cx"> {
</span><span class="lines">@@ -150,11 +162,8 @@
</span><span class="cx">     return jit.branchIfNotType(target, JSC::JSType(JSDocumentWrapperType));
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-inline void loadDocument(MacroAssembler&amp; jit, GPRReg node, GPRReg output)
-{
-    jit.loadPtr(CCallHelpers::Address(node, Node::treeScopeMemoryOffset()), output);
-    jit.loadPtr(CCallHelpers::Address(output, TreeScope::documentScopeMemoryOffset()), output);
-}
</del><ins>+void loadDocument(MacroAssembler&amp;, GPRReg node, GPRReg output);
+void loadDocumentElement(MacroAssembler&amp;, GPRReg document, GPRReg output);
</ins><span class="cx"> 
</span><span class="cx"> } }
</span><span class="cx"> 
</span></span></pre></div>
<a id="trunkSourceWebCoredomjitJSDocumentDOMJITcpp"></a>
<div class="addfile"><h4>Added: trunk/Source/WebCore/domjit/JSDocumentDOMJIT.cpp (0 => 208070)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/domjit/JSDocumentDOMJIT.cpp                                (rev 0)
+++ trunk/Source/WebCore/domjit/JSDocumentDOMJIT.cpp        2016-10-28 21:33:30 UTC (rev 208070)
</span><span class="lines">@@ -0,0 +1,79 @@
</span><ins>+/*
+ * Copyright (C) 2016 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include &quot;config.h&quot;
+#include &quot;JSDocument.h&quot;
+
+#if ENABLE(JIT)
+
+#include &quot;DOMJITAbstractHeapRepository.h&quot;
+#include &quot;DOMJITCheckDOM.h&quot;
+#include &quot;DOMJITHelpers.h&quot;
+#include &quot;Document.h&quot;
+#include &quot;JSDOMWrapper.h&quot;
+#include &quot;JSElement.h&quot;
+#include &lt;domjit/DOMJITPatchpoint.h&gt;
+#include &lt;domjit/DOMJITPatchpointParams.h&gt;
+
+using namespace JSC;
+
+namespace WebCore {
+
+Ref&lt;JSC::DOMJIT::Patchpoint&gt; DocumentDocumentElementDOMJIT::checkDOM()
+{
+    return DOMJIT::checkDOM&lt;Document&gt;();
+}
+
+Ref&lt;JSC::DOMJIT::CallDOMPatchpoint&gt; DocumentDocumentElementDOMJIT::callDOM()
+{
+    const auto&amp; heap = DOMJIT::AbstractHeapRepository::shared();
+    Ref&lt;JSC::DOMJIT::CallDOMPatchpoint&gt; patchpoint = JSC::DOMJIT::CallDOMPatchpoint::create();
+    patchpoint-&gt;numGPScratchRegisters = 1;
+    patchpoint-&gt;setGenerator([=](CCallHelpers&amp; jit, JSC::DOMJIT::PatchpointParams&amp; params) {
+        JSValueRegs result = params[0].jsValueRegs();
+        GPRReg document = params[1].gpr();
+        GPRReg globalObject = params[2].gpr();
+        JSValue globalObjectValue = params[2].value();
+        GPRReg scratch = params.gpScratch(0);
+
+        jit.loadPtr(CCallHelpers::Address(document, JSDocument::offsetOfWrapped()), scratch);
+        DOMJIT::loadDocumentElement(jit, scratch, scratch);
+        auto nullCase = jit.branchTestPtr(CCallHelpers::Zero, scratch);
+        DOMJIT::toWrapper&lt;Element&gt;(jit, params, scratch, globalObject, result, DOMJIT::toWrapperSlow&lt;Element&gt;, globalObjectValue);
+        auto done = jit.jump();
+
+        nullCase.link(&amp;jit);
+        jit.moveValue(jsNull(), result);
+        done.link(&amp;jit);
+
+        return CCallHelpers::JumpList();
+    });
+    patchpoint-&gt;effect = JSC::DOMJIT::Effect::forDef(heap.Document_documentElement);
+    return patchpoint;
+}
+
+}
+
+#endif
</ins></span></pre></div>
<a id="trunkSourceWebCoredomjitJSNodeDOMJITcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/domjit/JSNodeDOMJIT.cpp (208069 => 208070)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/domjit/JSNodeDOMJIT.cpp        2016-10-28 21:12:41 UTC (rev 208069)
+++ trunk/Source/WebCore/domjit/JSNodeDOMJIT.cpp        2016-10-28 21:33:30 UTC (rev 208070)
</span><span class="lines">@@ -29,6 +29,7 @@
</span><span class="cx"> #if ENABLE(JIT)
</span><span class="cx"> 
</span><span class="cx"> #include &quot;DOMJITAbstractHeapRepository.h&quot;
</span><ins>+#include &quot;DOMJITCheckDOM.h&quot;
</ins><span class="cx"> #include &quot;DOMJITHelpers.h&quot;
</span><span class="cx"> #include &quot;JSDOMWrapper.h&quot;
</span><span class="cx"> #include &quot;Node.h&quot;
</span><span class="lines">@@ -43,16 +44,6 @@
</span><span class="cx"> enum class IsContainerGuardRequirement { Required, NotRequired };
</span><span class="cx"> 
</span><span class="cx"> template&lt;typename WrappedNode&gt;
</span><del>-EncodedJSValue JIT_OPERATION toWrapperSlow(JSC::ExecState* exec, JSC::JSGlobalObject* globalObject, void* result)
-{
-    ASSERT(exec);
-    ASSERT(result);
-    ASSERT(globalObject);
-    JSC::NativeCallFrameTracer tracer(&amp;exec-&gt;vm(), exec);
-    return JSValue::encode(toJS(exec, static_cast&lt;JSDOMGlobalObject*&gt;(globalObject), *static_cast&lt;WrappedNode*&gt;(result)));
-}
-
-template&lt;typename WrappedNode&gt;
</del><span class="cx"> static Ref&lt;JSC::DOMJIT::CallDOMPatchpoint&gt; createCallDOMForOffsetAccess(ptrdiff_t offset, IsContainerGuardRequirement isContainerGuardRequirement)
</span><span class="cx"> {
</span><span class="cx">     Ref&lt;JSC::DOMJIT::CallDOMPatchpoint&gt; patchpoint = JSC::DOMJIT::CallDOMPatchpoint::create();
</span><span class="lines">@@ -74,7 +65,7 @@
</span><span class="cx">         jit.loadPtr(CCallHelpers::Address(scratch, offset), scratch);
</span><span class="cx">         nullCases.append(jit.branchTestPtr(CCallHelpers::Zero, scratch));
</span><span class="cx"> 
</span><del>-        DOMJIT::toWrapper&lt;WrappedNode&gt;(jit, params, scratch, globalObject, result, toWrapperSlow&lt;WrappedNode&gt;, globalObjectValue);
</del><ins>+        DOMJIT::toWrapper&lt;WrappedNode&gt;(jit, params, scratch, globalObject, result, DOMJIT::toWrapperSlow&lt;WrappedNode&gt;, globalObjectValue);
</ins><span class="cx">         CCallHelpers::Jump done = jit.jump();
</span><span class="cx"> 
</span><span class="cx">         nullCases.link(&amp;jit);
</span><span class="lines">@@ -85,20 +76,9 @@
</span><span class="cx">     return patchpoint;
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-static Ref&lt;JSC::DOMJIT::Patchpoint&gt; checkNode()
-{
-    Ref&lt;JSC::DOMJIT::Patchpoint&gt; patchpoint = JSC::DOMJIT::Patchpoint::create();
-    patchpoint-&gt;setGenerator([=](CCallHelpers&amp; jit, JSC::DOMJIT::PatchpointParams&amp; params) {
-        CCallHelpers::JumpList failureCases;
-        failureCases.append(DOMJIT::branchIfNotNode(jit, params[0].gpr()));
-        return failureCases;
-    });
-    return patchpoint;
-}
-
</del><span class="cx"> Ref&lt;JSC::DOMJIT::Patchpoint&gt; NodeFirstChildDOMJIT::checkDOM()
</span><span class="cx"> {
</span><del>-    return checkNode();
</del><ins>+    return DOMJIT::checkDOM&lt;Node&gt;();
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> Ref&lt;JSC::DOMJIT::CallDOMPatchpoint&gt; NodeFirstChildDOMJIT::callDOM()
</span><span class="lines">@@ -111,7 +91,7 @@
</span><span class="cx"> 
</span><span class="cx"> Ref&lt;JSC::DOMJIT::Patchpoint&gt; NodeLastChildDOMJIT::checkDOM()
</span><span class="cx"> {
</span><del>-    return checkNode();
</del><ins>+    return DOMJIT::checkDOM&lt;Node&gt;();
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> Ref&lt;JSC::DOMJIT::CallDOMPatchpoint&gt; NodeLastChildDOMJIT::callDOM()
</span><span class="lines">@@ -124,7 +104,7 @@
</span><span class="cx"> 
</span><span class="cx"> Ref&lt;JSC::DOMJIT::Patchpoint&gt; NodeNextSiblingDOMJIT::checkDOM()
</span><span class="cx"> {
</span><del>-    return checkNode();
</del><ins>+    return DOMJIT::checkDOM&lt;Node&gt;();
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> Ref&lt;JSC::DOMJIT::CallDOMPatchpoint&gt; NodeNextSiblingDOMJIT::callDOM()
</span><span class="lines">@@ -137,7 +117,7 @@
</span><span class="cx"> 
</span><span class="cx"> Ref&lt;JSC::DOMJIT::Patchpoint&gt; NodePreviousSiblingDOMJIT::checkDOM()
</span><span class="cx"> {
</span><del>-    return checkNode();
</del><ins>+    return DOMJIT::checkDOM&lt;Node&gt;();
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> Ref&lt;JSC::DOMJIT::CallDOMPatchpoint&gt; NodePreviousSiblingDOMJIT::callDOM()
</span><span class="lines">@@ -150,7 +130,7 @@
</span><span class="cx"> 
</span><span class="cx"> Ref&lt;JSC::DOMJIT::Patchpoint&gt; NodeParentNodeDOMJIT::checkDOM()
</span><span class="cx"> {
</span><del>-    return checkNode();
</del><ins>+    return DOMJIT::checkDOM&lt;Node&gt;();
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> Ref&lt;JSC::DOMJIT::CallDOMPatchpoint&gt; NodeParentNodeDOMJIT::callDOM()
</span><span class="lines">@@ -163,7 +143,7 @@
</span><span class="cx"> 
</span><span class="cx"> Ref&lt;JSC::DOMJIT::Patchpoint&gt; NodeNodeTypeDOMJIT::checkDOM()
</span><span class="cx"> {
</span><del>-    return checkNode();
</del><ins>+    return DOMJIT::checkDOM&lt;Node&gt;();
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> Ref&lt;JSC::DOMJIT::CallDOMPatchpoint&gt; NodeNodeTypeDOMJIT::callDOM()
</span><span class="lines">@@ -184,7 +164,7 @@
</span><span class="cx"> 
</span><span class="cx"> Ref&lt;JSC::DOMJIT::Patchpoint&gt; NodeOwnerDocumentDOMJIT::checkDOM()
</span><span class="cx"> {
</span><del>-    return checkNode();
</del><ins>+    return DOMJIT::checkDOM&lt;Node&gt;();
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> Ref&lt;JSC::DOMJIT::CallDOMPatchpoint&gt; NodeOwnerDocumentDOMJIT::callDOM()
</span><span class="lines">@@ -207,7 +187,7 @@
</span><span class="cx">         notDocument.link(&amp;jit);
</span><span class="cx">         jit.loadPtr(CCallHelpers::Address(node, JSNode::offsetOfWrapped()), scratch);
</span><span class="cx">         DOMJIT::loadDocument(jit, scratch, scratch);
</span><del>-        DOMJIT::toWrapper&lt;Document&gt;(jit, params, scratch, globalObject, result, toWrapperSlow&lt;Document&gt;, globalObjectValue);
</del><ins>+        DOMJIT::toWrapper&lt;Document&gt;(jit, params, scratch, globalObject, result, DOMJIT::toWrapperSlow&lt;Document&gt;, globalObjectValue);
</ins><span class="cx">         done.link(&amp;jit);
</span><span class="cx">         return CCallHelpers::JumpList();
</span><span class="cx">     });
</span></span></pre>
</div>
</div>

</body>
</html>