<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN"
"http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head><meta http-equiv="content-type" content="text/html; charset=utf-8" />
<title>[210912] trunk/Source</title>
</head>
<body>
<style type="text/css"><!--
#msg dl.meta { border: 1px #006 solid; background: #369; padding: 6px; color: #fff; }
#msg dl.meta dt { float: left; width: 6em; font-weight: bold; }
#msg dt:after { content:':';}
#msg dl, #msg dt, #msg ul, #msg li, #header, #footer, #logmsg { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; }
#msg dl a { font-weight: bold}
#msg dl a:link { color:#fc3; }
#msg dl a:active { color:#ff0; }
#msg dl a:visited { color:#cc6; }
h3 { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; font-weight: bold; }
#msg pre { overflow: auto; background: #ffc; border: 1px #fa0 solid; padding: 6px; }
#logmsg { background: #ffc; border: 1px #fa0 solid; padding: 1em 1em 0 1em; }
#logmsg p, #logmsg pre, #logmsg blockquote { margin: 0 0 1em 0; }
#logmsg p, #logmsg li, #logmsg dt, #logmsg dd { line-height: 14pt; }
#logmsg h1, #logmsg h2, #logmsg h3, #logmsg h4, #logmsg h5, #logmsg h6 { margin: .5em 0; }
#logmsg h1:first-child, #logmsg h2:first-child, #logmsg h3:first-child, #logmsg h4:first-child, #logmsg h5:first-child, #logmsg h6:first-child { margin-top: 0; }
#logmsg ul, #logmsg ol { padding: 0; list-style-position: inside; margin: 0 0 0 1em; }
#logmsg ul { text-indent: -1em; padding-left: 1em; }#logmsg ol { text-indent: -1.5em; padding-left: 1.5em; }
#logmsg > ul, #logmsg > ol { margin: 0 0 1em 0; }
#logmsg pre { background: #eee; padding: 1em; }
#logmsg blockquote { border: 1px solid #fa0; border-left-width: 10px; padding: 1em 1em 0 1em; background: white;}
#logmsg dl { margin: 0; }
#logmsg dt { font-weight: bold; }
#logmsg dd { margin: 0; padding: 0 0 0.5em 0; }
#logmsg dd:before { content:'\00bb';}
#logmsg table { border-spacing: 0px; border-collapse: collapse; border-top: 4px solid #fa0; border-bottom: 1px solid #fa0; background: #fff; }
#logmsg table th { text-align: left; font-weight: normal; padding: 0.2em 0.5em; border-top: 1px dotted #fa0; }
#logmsg table td { text-align: right; border-top: 1px dotted #fa0; padding: 0.2em 0.5em; }
#logmsg table thead th { text-align: center; border-bottom: 1px solid #fa0; }
#logmsg table th.Corner { text-align: left; }
#logmsg hr { border: none 0; border-top: 2px dashed #fa0; height: 1px; }
#header, #footer { color: #fff; background: #636; border: 1px #300 solid; padding: 6px; }
#patch { width: 100%; }
#patch h4 {font-family: verdana,arial,helvetica,sans-serif;font-size:10pt;padding:8px;background:#369;color:#fff;margin:0;}
#patch .propset h4, #patch .binary h4 {margin:0;}
#patch pre {padding:0;line-height:1.2em;margin:0;}
#patch .diff {width:100%;background:#eee;padding: 0 0 10px 0;overflow:auto;}
#patch .propset .diff, #patch .binary .diff {padding:10px 0;}
#patch span {display:block;padding:0 10px;}
#patch .modfile, #patch .addfile, #patch .delfile, #patch .propset, #patch .binary, #patch .copfile {border:1px solid #ccc;margin:10px 0;}
#patch ins {background:#dfd;text-decoration:none;display:block;padding:0 10px;}
#patch del {background:#fdd;text-decoration:none;display:block;padding:0 10px;}
#patch .lines, .info {color:#888;background:#fff;}
--></style>
<div id="msg">
<dl class="meta">
<dt>Revision</dt> <dd><a href="http://trac.webkit.org/projects/webkit/changeset/210912">210912</a></dd>
<dt>Author</dt> <dd>fpizlo@apple.com</dd>
<dt>Date</dt> <dd>2017-01-18 21:13:21 -0800 (Wed, 18 Jan 2017)</dd>
</dl>
<h3>Log Message</h3>
<pre>JSSegmentedVariableObject and its subclasses should have a sane destruction story
https://bugs.webkit.org/show_bug.cgi?id=167193
Reviewed by Saam Barati.
Source/JavaScriptCore:
Prior to this change, JSSegmentedVariableObjects' subclasses install finalizers that call
destroy. They did this in random ways, which sometimes resulted in
JSSegmentedVariableObject::~JSSegmentedVariableObject executing more than once (which worked
because of the way that ~SegmentedVector is written). Maybe this works now, but it's a disaster
waiting to happen.
Fortunately we can now just give those things their own Subspace and teach it its own protocol of
destruction. This change introduces JSSegmentedVariableObjectSubspace and stashes a m_classInfo
in JSSegmentedVariableObject. Now, subclasses of JSSegmentedVariableObject are destructible in
much the same way as JSDestructibleObject without having to be subclasses of
JSDestructibleObject.
* API/JSCallbackObject.cpp:
(JSC::JSCallbackObject<JSGlobalObject>::create):
* CMakeLists.txt:
* JavaScriptCore.xcodeproj/project.pbxproj:
* jsc.cpp:
(GlobalObject::create):
* runtime/JSGlobalLexicalEnvironment.h:
(JSC::JSGlobalLexicalEnvironment::create):
* runtime/JSGlobalObject.cpp:
(JSC::JSGlobalObject::create):
(JSC::JSGlobalObject::finishCreation):
* runtime/JSGlobalObject.h:
(JSC::JSGlobalObject::create): Deleted.
(JSC::JSGlobalObject::finishCreation): Deleted.
* runtime/JSSegmentedVariableObject.cpp:
(JSC::JSSegmentedVariableObject::destroy):
(JSC::JSSegmentedVariableObject::JSSegmentedVariableObject):
(JSC::JSSegmentedVariableObject::~JSSegmentedVariableObject):
(JSC::JSSegmentedVariableObject::finishCreation):
* runtime/JSSegmentedVariableObject.h:
(JSC::JSSegmentedVariableObject::subspaceFor):
(JSC::JSSegmentedVariableObject::classInfo):
(JSC::JSSegmentedVariableObject::JSSegmentedVariableObject): Deleted.
(JSC::JSSegmentedVariableObject::finishCreation): Deleted.
* runtime/JSSegmentedVariableObjectSubspace.cpp: Added.
(JSC::JSSegmentedVariableObjectSubspace::JSSegmentedVariableObjectSubspace):
(JSC::JSSegmentedVariableObjectSubspace::~JSSegmentedVariableObjectSubspace):
(JSC::JSSegmentedVariableObjectSubspace::finishSweep):
(JSC::JSSegmentedVariableObjectSubspace::destroy):
* runtime/JSSegmentedVariableObjectSubspace.h: Added.
* runtime/VM.cpp:
(JSC::VM::VM):
* runtime/VM.h:
* testRegExp.cpp:
(GlobalObject::create):
Source/WebCore:
No new tests because no new behavior.
JSSegmentedVariableObjects now get to have a sane destruction story. This means switching
subspace types for the DOM's global object subspace.
* bindings/js/WebCoreJSClientData.cpp:
(WebCore::JSVMClientData::JSVMClientData):
* bindings/js/WebCoreJSClientData.h:
* bindings/scripts/CodeGeneratorJS.pm:
(GenerateHeader):</pre>
<h3>Modified Paths</h3>
<ul>
<li><a href="#trunkSourceJavaScriptCoreAPIJSCallbackObjectcpp">trunk/Source/JavaScriptCore/API/JSCallbackObject.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreCMakeListstxt">trunk/Source/JavaScriptCore/CMakeLists.txt</a></li>
<li><a href="#trunkSourceJavaScriptCoreChangeLog">trunk/Source/JavaScriptCore/ChangeLog</a></li>
<li><a href="#trunkSourceJavaScriptCoreJavaScriptCorexcodeprojprojectpbxproj">trunk/Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj</a></li>
<li><a href="#trunkSourceJavaScriptCorejsccpp">trunk/Source/JavaScriptCore/jsc.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeJSGlobalLexicalEnvironmenth">trunk/Source/JavaScriptCore/runtime/JSGlobalLexicalEnvironment.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeJSGlobalObjectcpp">trunk/Source/JavaScriptCore/runtime/JSGlobalObject.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeJSGlobalObjecth">trunk/Source/JavaScriptCore/runtime/JSGlobalObject.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeJSSegmentedVariableObjectcpp">trunk/Source/JavaScriptCore/runtime/JSSegmentedVariableObject.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeJSSegmentedVariableObjecth">trunk/Source/JavaScriptCore/runtime/JSSegmentedVariableObject.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeVMcpp">trunk/Source/JavaScriptCore/runtime/VM.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeVMh">trunk/Source/JavaScriptCore/runtime/VM.h</a></li>
<li><a href="#trunkSourceJavaScriptCoretestRegExpcpp">trunk/Source/JavaScriptCore/testRegExp.cpp</a></li>
<li><a href="#trunkSourceWebCoreChangeLog">trunk/Source/WebCore/ChangeLog</a></li>
<li><a href="#trunkSourceWebCorebindingsjsWebCoreJSClientDatacpp">trunk/Source/WebCore/bindings/js/WebCoreJSClientData.cpp</a></li>
<li><a href="#trunkSourceWebCorebindingsjsWebCoreJSClientDatah">trunk/Source/WebCore/bindings/js/WebCoreJSClientData.h</a></li>
<li><a href="#trunkSourceWebCorebindingsscriptsCodeGeneratorJSpm">trunk/Source/WebCore/bindings/scripts/CodeGeneratorJS.pm</a></li>
</ul>
<h3>Added Paths</h3>
<ul>
<li><a href="#trunkSourceJavaScriptCoreruntimeJSSegmentedVariableObjectSubspacecpp">trunk/Source/JavaScriptCore/runtime/JSSegmentedVariableObjectSubspace.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeJSSegmentedVariableObjectSubspaceh">trunk/Source/JavaScriptCore/runtime/JSSegmentedVariableObjectSubspace.h</a></li>
</ul>
</div>
<div id="patch">
<h3>Diff</h3>
<a id="trunkSourceJavaScriptCoreAPIJSCallbackObjectcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/API/JSCallbackObject.cpp (210911 => 210912)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/API/JSCallbackObject.cpp        2017-01-19 05:09:49 UTC (rev 210911)
+++ trunk/Source/JavaScriptCore/API/JSCallbackObject.cpp        2017-01-19 05:13:21 UTC (rev 210912)
</span><span class="lines">@@ -1,5 +1,5 @@
</span><span class="cx"> /*
</span><del>- * Copyright (C) 2006 Apple Inc. All rights reserved.
</del><ins>+ * Copyright (C) 2006-2017 Apple Inc. All rights reserved.
</ins><span class="cx"> * Copyright (C) 2007 Eric Seidel <eric@webkit.org>
</span><span class="cx"> *
</span><span class="cx"> * Redistribution and use in source and binary forms, with or without
</span><span class="lines">@@ -45,7 +45,6 @@
</span><span class="cx"> {
</span><span class="cx"> JSCallbackObject<JSGlobalObject>* callbackObject = new (NotNull, allocateCell<JSCallbackObject<JSGlobalObject>>(vm.heap)) JSCallbackObject(vm, classRef, structure);
</span><span class="cx"> callbackObject->finishCreation(vm);
</span><del>- vm.heap.addFinalizer(callbackObject, destroy);
</del><span class="cx"> return callbackObject;
</span><span class="cx"> }
</span><span class="cx">
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreCMakeListstxt"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/CMakeLists.txt (210911 => 210912)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/CMakeLists.txt        2017-01-19 05:09:49 UTC (rev 210911)
+++ trunk/Source/JavaScriptCore/CMakeLists.txt        2017-01-19 05:13:21 UTC (rev 210912)
</span><span class="lines">@@ -788,6 +788,7 @@
</span><span class="cx"> runtime/JSScope.cpp
</span><span class="cx"> runtime/JSScriptFetcher.cpp
</span><span class="cx"> runtime/JSSegmentedVariableObject.cpp
</span><ins>+ runtime/JSSegmentedVariableObjectSubspace.cpp
</ins><span class="cx"> runtime/JSSet.cpp
</span><span class="cx"> runtime/JSSetIterator.cpp
</span><span class="cx"> runtime/JSSourceCode.cpp
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreChangeLog"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/ChangeLog (210911 => 210912)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/ChangeLog        2017-01-19 05:09:49 UTC (rev 210911)
+++ trunk/Source/JavaScriptCore/ChangeLog        2017-01-19 05:13:21 UTC (rev 210912)
</span><span class="lines">@@ -1,3 +1,58 @@
</span><ins>+2017-01-18 Filip Pizlo <fpizlo@apple.com>
+
+ JSSegmentedVariableObject and its subclasses should have a sane destruction story
+ https://bugs.webkit.org/show_bug.cgi?id=167193
+
+ Reviewed by Saam Barati.
+
+ Prior to this change, JSSegmentedVariableObjects' subclasses install finalizers that call
+ destroy. They did this in random ways, which sometimes resulted in
+ JSSegmentedVariableObject::~JSSegmentedVariableObject executing more than once (which worked
+ because of the way that ~SegmentedVector is written). Maybe this works now, but it's a disaster
+ waiting to happen.
+
+ Fortunately we can now just give those things their own Subspace and teach it its own protocol of
+ destruction. This change introduces JSSegmentedVariableObjectSubspace and stashes a m_classInfo
+ in JSSegmentedVariableObject. Now, subclasses of JSSegmentedVariableObject are destructible in
+ much the same way as JSDestructibleObject without having to be subclasses of
+ JSDestructibleObject.
+
+ * API/JSCallbackObject.cpp:
+ (JSC::JSCallbackObject<JSGlobalObject>::create):
+ * CMakeLists.txt:
+ * JavaScriptCore.xcodeproj/project.pbxproj:
+ * jsc.cpp:
+ (GlobalObject::create):
+ * runtime/JSGlobalLexicalEnvironment.h:
+ (JSC::JSGlobalLexicalEnvironment::create):
+ * runtime/JSGlobalObject.cpp:
+ (JSC::JSGlobalObject::create):
+ (JSC::JSGlobalObject::finishCreation):
+ * runtime/JSGlobalObject.h:
+ (JSC::JSGlobalObject::create): Deleted.
+ (JSC::JSGlobalObject::finishCreation): Deleted.
+ * runtime/JSSegmentedVariableObject.cpp:
+ (JSC::JSSegmentedVariableObject::destroy):
+ (JSC::JSSegmentedVariableObject::JSSegmentedVariableObject):
+ (JSC::JSSegmentedVariableObject::~JSSegmentedVariableObject):
+ (JSC::JSSegmentedVariableObject::finishCreation):
+ * runtime/JSSegmentedVariableObject.h:
+ (JSC::JSSegmentedVariableObject::subspaceFor):
+ (JSC::JSSegmentedVariableObject::classInfo):
+ (JSC::JSSegmentedVariableObject::JSSegmentedVariableObject): Deleted.
+ (JSC::JSSegmentedVariableObject::finishCreation): Deleted.
+ * runtime/JSSegmentedVariableObjectSubspace.cpp: Added.
+ (JSC::JSSegmentedVariableObjectSubspace::JSSegmentedVariableObjectSubspace):
+ (JSC::JSSegmentedVariableObjectSubspace::~JSSegmentedVariableObjectSubspace):
+ (JSC::JSSegmentedVariableObjectSubspace::finishSweep):
+ (JSC::JSSegmentedVariableObjectSubspace::destroy):
+ * runtime/JSSegmentedVariableObjectSubspace.h: Added.
+ * runtime/VM.cpp:
+ (JSC::VM::VM):
+ * runtime/VM.h:
+ * testRegExp.cpp:
+ (GlobalObject::create):
+
</ins><span class="cx"> 2017-01-18 Joseph Pecoraro <pecoraro@apple.com>
</span><span class="cx">
</span><span class="cx"> Web Inspector: console.table only works for the first 5 properties
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreJavaScriptCorexcodeprojprojectpbxproj"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj (210911 => 210912)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj        2017-01-19 05:09:49 UTC (rev 210911)
+++ trunk/Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj        2017-01-19 05:13:21 UTC (rev 210912)
</span><span class="lines">@@ -408,6 +408,8 @@
</span><span class="cx">                 0F4DE1D11C4D764B004D6C11 /* B3OriginDump.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F4DE1D01C4D764B004D6C11 /* B3OriginDump.cpp */; };
</span><span class="cx">                 0F4F29DF18B6AD1C0057BC15 /* DFGStaticExecutionCountEstimationPhase.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F4F29DD18B6AD1C0057BC15 /* DFGStaticExecutionCountEstimationPhase.cpp */; };
</span><span class="cx">                 0F4F29E018B6AD1C0057BC15 /* DFGStaticExecutionCountEstimationPhase.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F4F29DE18B6AD1C0057BC15 /* DFGStaticExecutionCountEstimationPhase.h */; };
</span><ins>+                0F4F82871E2FFDDD0075184C /* JSSegmentedVariableObjectSubspace.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F4F82851E2FFDDB0075184C /* JSSegmentedVariableObjectSubspace.cpp */; };
+                0F4F82881E2FFDE00075184C /* JSSegmentedVariableObjectSubspace.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F4F82861E2FFDDB0075184C /* JSSegmentedVariableObjectSubspace.h */; settings = {ATTRIBUTES = (Private, ); }; };
</ins><span class="cx">                 0F50AF3C193E8B3900674EE8 /* DFGStructureClobberState.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F50AF3B193E8B3900674EE8 /* DFGStructureClobberState.h */; };
</span><span class="cx">                 0F5513A61D5A682C00C32BD8 /* FreeList.h in Headers */ = {isa = PBXBuildFile; fileRef = 0F5513A51D5A682A00C32BD8 /* FreeList.h */; settings = {ATTRIBUTES = (Private, ); }; };
</span><span class="cx">                 0F5513A81D5A68CD00C32BD8 /* FreeList.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F5513A71D5A68CB00C32BD8 /* FreeList.cpp */; };
</span><span class="lines">@@ -1164,6 +1166,7 @@
</span><span class="cx">                 147F39D5107EC37600427A48 /* JSString.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BC02E9B60E1842FA000F9297 /* JSString.cpp */; };
</span><span class="cx">                 147F39D6107EC37600427A48 /* JSCJSValue.cpp in Sources */ = {isa = PBXBuildFile; fileRef = F692A8870255597D01FF60F7 /* JSCJSValue.cpp */; };
</span><span class="cx">                 147F39D7107EC37600427A48 /* JSEnvironmentRecord.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BC22A39A0E16E14800AF21C8 /* JSEnvironmentRecord.cpp */; };
</span><ins>+                14815F5F991C46BEB98D0016 /* JSScriptFetcher.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 11C197C2624848EDA84CED7F /* JSScriptFetcher.cpp */; };
</ins><span class="cx">                 1482B74E0A43032800517CFC /* JSStringRef.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 1482B74C0A43032800517CFC /* JSStringRef.cpp */; };
</span><span class="cx">                 1482B7E40A43076000517CFC /* JSObjectRef.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 1482B7E20A43076000517CFC /* JSObjectRef.cpp */; };
</span><span class="cx">                 14874AE515EBDE4A002E3587 /* JSScope.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 14874AE115EBDE4A002E3587 /* JSScope.cpp */; };
</span><span class="lines">@@ -1565,6 +1568,7 @@
</span><span class="cx">                 8B9F6D561D5912FA001C739F /* IterationKind.h in Headers */ = {isa = PBXBuildFile; fileRef = 8B9F6D551D5912FA001C739F /* IterationKind.h */; settings = {ATTRIBUTES = (Private, ); }; };
</span><span class="cx">                 90213E3D123A40C200D422F3 /* MemoryStatistics.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 90213E3B123A40C200D422F3 /* MemoryStatistics.cpp */; };
</span><span class="cx">                 90213E3E123A40C200D422F3 /* MemoryStatistics.h in Headers */ = {isa = PBXBuildFile; fileRef = 90213E3C123A40C200D422F3 /* MemoryStatistics.h */; settings = {ATTRIBUTES = (Private, ); }; };
</span><ins>+                9064337DD4B0402BAF34A592 /* JSScriptFetcher.h in Headers */ = {isa = PBXBuildFile; fileRef = 6BA93C9590484C5BAD9316EA /* JSScriptFetcher.h */; settings = {ATTRIBUTES = (Private, ); }; };
</ins><span class="cx">                 93052C340FB792190048FDC3 /* ParserArena.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 93052C320FB792190048FDC3 /* ParserArena.cpp */; };
</span><span class="cx">                 93052C350FB792190048FDC3 /* ParserArena.h in Headers */ = {isa = PBXBuildFile; fileRef = 93052C330FB792190048FDC3 /* ParserArena.h */; settings = {ATTRIBUTES = (Private, ); }; };
</span><span class="cx">                 932F5BD30822A1C700736975 /* CoreFoundation.framework in Frameworks */ = {isa = PBXBuildFile; fileRef = 6560A4CF04B3B3E7008AE952 /* CoreFoundation.framework */; };
</span><span class="lines">@@ -2152,6 +2156,7 @@
</span><span class="cx">                 BCF605140E203EF800B9A64D /* ArgList.h in Headers */ = {isa = PBXBuildFile; fileRef = BCF605120E203EF800B9A64D /* ArgList.h */; settings = {ATTRIBUTES = (Private, ); }; };
</span><span class="cx">                 BCFD8C920EEB2EE700283848 /* JumpTable.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BCFD8C900EEB2EE700283848 /* JumpTable.cpp */; };
</span><span class="cx">                 BCFD8C930EEB2EE700283848 /* JumpTable.h in Headers */ = {isa = PBXBuildFile; fileRef = BCFD8C910EEB2EE700283848 /* JumpTable.h */; settings = {ATTRIBUTES = (Private, ); }; };
</span><ins>+                BDFCB2BBE90F41349E1B0BED /* JSSourceCode.h in Headers */ = {isa = PBXBuildFile; fileRef = 3032175DF1AD47D8998B34E1 /* JSSourceCode.h */; settings = {ATTRIBUTES = (Private, ); }; };
</ins><span class="cx">                 C20328201981979D0088B499 /* CustomGlobalObjectClassTest.c in Sources */ = {isa = PBXBuildFile; fileRef = C203281E1981979D0088B499 /* CustomGlobalObjectClassTest.c */; };
</span><span class="cx">                 C20BA92D16BB1C1500B3AEA2 /* StructureRareDataInlines.h in Headers */ = {isa = PBXBuildFile; fileRef = C20BA92C16BB1C1500B3AEA2 /* StructureRareDataInlines.h */; settings = {ATTRIBUTES = (Private, ); }; };
</span><span class="cx">                 C2160FE715F7E95E00942DFC /* SlotVisitorInlines.h in Headers */ = {isa = PBXBuildFile; fileRef = 0FCB408515C0A3C30048932B /* SlotVisitorInlines.h */; settings = {ATTRIBUTES = (Private, ); }; };
</span><span class="lines">@@ -2197,6 +2202,7 @@
</span><span class="cx">                 C4F4B6F41A05C944005CAB76 /* cpp_generator.py in Headers */ = {isa = PBXBuildFile; fileRef = C4F4B6D01A05C76F005CAB76 /* cpp_generator.py */; settings = {ATTRIBUTES = (Private, ); }; };
</span><span class="cx">                 C4F4B6F51A05C984005CAB76 /* generate_objc_protocol_types_implementation.py in Headers */ = {isa = PBXBuildFile; fileRef = C4F4B6D71A05C76F005CAB76 /* generate_objc_protocol_types_implementation.py */; settings = {ATTRIBUTES = (Private, ); }; };
</span><span class="cx">                 C4F4B6F61A05C984005CAB76 /* objc_generator_templates.py in Headers */ = {isa = PBXBuildFile; fileRef = C4F4B6D81A05C76F005CAB76 /* objc_generator_templates.py */; settings = {ATTRIBUTES = (Private, ); }; };
</span><ins>+                CEAE7D7B889B477BA93ABA6C /* ScriptFetcher.h in Headers */ = {isa = PBXBuildFile; fileRef = 8852151A9C3842389B3215B7 /* ScriptFetcher.h */; settings = {ATTRIBUTES = (Private, ); }; };
</ins><span class="cx">                 D9722752DC54459B9125B539 /* JSModuleLoader.h in Headers */ = {isa = PBXBuildFile; fileRef = 77B25CB2C3094A92A38E1DB3 /* JSModuleLoader.h */; };
</span><span class="cx">                 DC00039319D8BE6F00023EB0 /* DFGPreciseLocalClobberize.h in Headers */ = {isa = PBXBuildFile; fileRef = DC00039019D8BE6F00023EB0 /* DFGPreciseLocalClobberize.h */; };
</span><span class="cx">                 DC0184191D10C1890057B053 /* JITWorklist.h in Headers */ = {isa = PBXBuildFile; fileRef = DC0184181D10C1870057B053 /* JITWorklist.h */; };
</span><span class="lines">@@ -2308,6 +2314,7 @@
</span><span class="cx">                 E49DC16B12EF293E00184A1F /* SourceProviderCache.cpp in Sources */ = {isa = PBXBuildFile; fileRef = E49DC15512EF277200184A1F /* SourceProviderCache.cpp */; };
</span><span class="cx">                 E49DC16C12EF294E00184A1F /* SourceProviderCache.h in Headers */ = {isa = PBXBuildFile; fileRef = E49DC15112EF272200184A1F /* SourceProviderCache.h */; settings = {ATTRIBUTES = (Private, ); }; };
</span><span class="cx">                 E49DC16D12EF295300184A1F /* SourceProviderCacheItem.h in Headers */ = {isa = PBXBuildFile; fileRef = E49DC14912EF261A00184A1F /* SourceProviderCacheItem.h */; settings = {ATTRIBUTES = (Private, ); }; };
</span><ins>+                FA3AB211C8494524AB390267 /* JSSourceCode.cpp in Sources */ = {isa = PBXBuildFile; fileRef = F73926918DC64330AFCDF0D7 /* JSSourceCode.cpp */; };
</ins><span class="cx">                 FE0D4A061AB8DD0A002F54BF /* ExecutionTimeLimitTest.cpp in Sources */ = {isa = PBXBuildFile; fileRef = FE0D4A041AB8DD0A002F54BF /* ExecutionTimeLimitTest.cpp */; };
</span><span class="cx">                 FE0D4A091ABA2437002F54BF /* GlobalContextWithFinalizerTest.cpp in Sources */ = {isa = PBXBuildFile; fileRef = FE0D4A071ABA2437002F54BF /* GlobalContextWithFinalizerTest.cpp */; };
</span><span class="cx">                 FE1220271BE7F58C0039E6F2 /* JITAddGenerator.h in Headers */ = {isa = PBXBuildFile; fileRef = FE1220261BE7F5640039E6F2 /* JITAddGenerator.h */; };
</span><span class="lines">@@ -2379,11 +2386,6 @@
</span><span class="cx">                 FED94F2F171E3E2300BE77A4 /* Watchdog.h in Headers */ = {isa = PBXBuildFile; fileRef = FED94F2C171E3E2300BE77A4 /* Watchdog.h */; settings = {ATTRIBUTES = (Private, ); }; };
</span><span class="cx">                 FEF040511AAE662D00BD28B0 /* CompareAndSwapTest.cpp in Sources */ = {isa = PBXBuildFile; fileRef = FEF040501AAE662D00BD28B0 /* CompareAndSwapTest.cpp */; };
</span><span class="cx">                 FEFD6FC61D5E7992008F2F0B /* JSStringInlines.h in Headers */ = {isa = PBXBuildFile; fileRef = FEFD6FC51D5E7970008F2F0B /* JSStringInlines.h */; settings = {ATTRIBUTES = (Private, ); }; };
</span><del>-                FA3AB211C8494524AB390267 /* JSSourceCode.cpp in Sources */ = {isa = PBXBuildFile; fileRef = F73926918DC64330AFCDF0D7 /* JSSourceCode.cpp */; };
-                BDFCB2BBE90F41349E1B0BED /* JSSourceCode.h in Headers */ = {isa = PBXBuildFile; fileRef = 3032175DF1AD47D8998B34E1 /* JSSourceCode.h */; settings = {ATTRIBUTES = (Private, ); }; };
-                14815F5F991C46BEB98D0016 /* JSScriptFetcher.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 11C197C2624848EDA84CED7F /* JSScriptFetcher.cpp */; };
-                9064337DD4B0402BAF34A592 /* JSScriptFetcher.h in Headers */ = {isa = PBXBuildFile; fileRef = 6BA93C9590484C5BAD9316EA /* JSScriptFetcher.h */; settings = {ATTRIBUTES = (Private, ); }; };
-                CEAE7D7B889B477BA93ABA6C /* ScriptFetcher.h in Headers */ = {isa = PBXBuildFile; fileRef = 8852151A9C3842389B3215B7 /* ScriptFetcher.h */; settings = {ATTRIBUTES = (Private, ); }; };
</del><span class="cx"> /* End PBXBuildFile section */
</span><span class="cx">
</span><span class="cx"> /* Begin PBXContainerItemProxy section */
</span><span class="lines">@@ -2859,6 +2861,8 @@
</span><span class="cx">                 0F4DE1D01C4D764B004D6C11 /* B3OriginDump.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = B3OriginDump.cpp; path = b3/B3OriginDump.cpp; sourceTree = "<group>"; };
</span><span class="cx">                 0F4F29DD18B6AD1C0057BC15 /* DFGStaticExecutionCountEstimationPhase.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGStaticExecutionCountEstimationPhase.cpp; path = dfg/DFGStaticExecutionCountEstimationPhase.cpp; sourceTree = "<group>"; };
</span><span class="cx">                 0F4F29DE18B6AD1C0057BC15 /* DFGStaticExecutionCountEstimationPhase.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGStaticExecutionCountEstimationPhase.h; path = dfg/DFGStaticExecutionCountEstimationPhase.h; sourceTree = "<group>"; };
</span><ins>+                0F4F82851E2FFDDB0075184C /* JSSegmentedVariableObjectSubspace.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSSegmentedVariableObjectSubspace.cpp; sourceTree = "<group>"; };
+                0F4F82861E2FFDDB0075184C /* JSSegmentedVariableObjectSubspace.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSSegmentedVariableObjectSubspace.h; sourceTree = "<group>"; };
</ins><span class="cx">                 0F50AF3B193E8B3900674EE8 /* DFGStructureClobberState.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGStructureClobberState.h; path = dfg/DFGStructureClobberState.h; sourceTree = "<group>"; };
</span><span class="cx">                 0F5513A51D5A682A00C32BD8 /* FreeList.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = FreeList.h; sourceTree = "<group>"; };
</span><span class="cx">                 0F5513A71D5A68CB00C32BD8 /* FreeList.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = FreeList.cpp; sourceTree = "<group>"; };
</span><span class="lines">@@ -3481,6 +3485,7 @@
</span><span class="cx">                 0FFFC95214EF909500C72532 /* DFGPredictionPropagationPhase.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGPredictionPropagationPhase.h; path = dfg/DFGPredictionPropagationPhase.h; sourceTree = "<group>"; };
</span><span class="cx">                 0FFFC95314EF909500C72532 /* DFGVirtualRegisterAllocationPhase.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DFGVirtualRegisterAllocationPhase.cpp; path = dfg/DFGVirtualRegisterAllocationPhase.cpp; sourceTree = "<group>"; };
</span><span class="cx">                 0FFFC95414EF909500C72532 /* DFGVirtualRegisterAllocationPhase.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DFGVirtualRegisterAllocationPhase.h; path = dfg/DFGVirtualRegisterAllocationPhase.h; sourceTree = "<group>"; };
</span><ins>+                11C197C2624848EDA84CED7F /* JSScriptFetcher.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSScriptFetcher.cpp; sourceTree = "<group>"; };
</ins><span class="cx">                 140D17D60E8AD4A9000CD17D /* JSBasePrivate.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSBasePrivate.h; sourceTree = "<group>"; };
</span><span class="cx">                 141211020A48780900480255 /* minidom.c */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.c; name = minidom.c; path = tests/minidom.c; sourceTree = "<group>"; };
</span><span class="cx">                 1412110D0A48788700480255 /* minidom.js */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.javascript; name = minidom.js; path = tests/minidom.js; sourceTree = "<group>"; };
</span><span class="lines">@@ -3672,6 +3677,7 @@
</span><span class="cx">                 2ADFA26218EF3540004F9FCC /* GCLogging.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = GCLogging.cpp; sourceTree = "<group>"; };
</span><span class="cx">                 2AF7382A18BBBF92008A5A37 /* StructureIDTable.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = StructureIDTable.cpp; sourceTree = "<group>"; };
</span><span class="cx">                 2AF7382B18BBBF92008A5A37 /* StructureIDTable.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = StructureIDTable.h; sourceTree = "<group>"; };
</span><ins>+                3032175DF1AD47D8998B34E1 /* JSSourceCode.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSSourceCode.h; sourceTree = "<group>"; };
</ins><span class="cx">                 371D842C17C98B6E00ECF994 /* libz.dylib */ = {isa = PBXFileReference; lastKnownFileType = "compiled.mach-o.dylib"; name = libz.dylib; path = usr/lib/libz.dylib; sourceTree = SDKROOT; };
</span><span class="cx">                 412952731D2CF6AC00E78B89 /* builtins_generate_internals_wrapper_header.py */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text.script.python; path = builtins_generate_internals_wrapper_header.py; sourceTree = "<group>"; };
</span><span class="cx">                 412952741D2CF6AC00E78B89 /* builtins_generate_internals_wrapper_implementation.py */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text.script.python; path = builtins_generate_internals_wrapper_implementation.py; sourceTree = "<group>"; };
</span><span class="lines">@@ -3831,6 +3837,7 @@
</span><span class="cx">                 65FB5115184EE8F800C12B70 /* ProtoCallFrame.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ProtoCallFrame.h; sourceTree = "<group>"; };
</span><span class="cx">                 65FB5116184EE9BC00C12B70 /* ProtoCallFrame.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ProtoCallFrame.cpp; sourceTree = "<group>"; };
</span><span class="cx">                 6AD2CB4C19B9140100065719 /* DebuggerEvalEnabler.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DebuggerEvalEnabler.h; sourceTree = "<group>"; };
</span><ins>+                6BA93C9590484C5BAD9316EA /* JSScriptFetcher.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSScriptFetcher.h; sourceTree = "<group>"; };
</ins><span class="cx">                 70113D491A8DB093003848C4 /* IteratorOperations.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = IteratorOperations.cpp; sourceTree = "<group>"; };
</span><span class="cx">                 70113D4A1A8DB093003848C4 /* IteratorOperations.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = IteratorOperations.h; sourceTree = "<group>"; };
</span><span class="cx">                 7013CA891B491A9400CAE613 /* JSJob.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSJob.cpp; sourceTree = "<group>"; };
</span><span class="lines">@@ -4050,6 +4057,7 @@
</span><span class="cx">                 86F75EFD151C062F007C9BA3 /* RegExpMatchesArray.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = RegExpMatchesArray.cpp; sourceTree = "<group>"; };
</span><span class="cx">                 86FA9E8F142BBB2D001773B7 /* JSBoundFunction.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSBoundFunction.cpp; sourceTree = "<group>"; };
</span><span class="cx">                 86FA9E90142BBB2E001773B7 /* JSBoundFunction.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSBoundFunction.h; sourceTree = "<group>"; };
</span><ins>+                8852151A9C3842389B3215B7 /* ScriptFetcher.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ScriptFetcher.h; sourceTree = "<group>"; };
</ins><span class="cx">                 8B47F234366C4B72AC852A7E /* TemplateRegistryKeyTable.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = TemplateRegistryKeyTable.cpp; sourceTree = "<group>"; };
</span><span class="cx">                 8B9F6D551D5912FA001C739F /* IterationKind.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = IterationKind.h; sourceTree = "<group>"; };
</span><span class="cx">                 90213E3B123A40C200D422F3 /* MemoryStatistics.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = MemoryStatistics.cpp; sourceTree = "<group>"; };
</span><span class="lines">@@ -4840,6 +4848,7 @@
</span><span class="cx">                 F692A87D0255597D01FF60F7 /* RegExp.cpp */ = {isa = PBXFileReference; fileEncoding = 30; indentWidth = 4; lastKnownFileType = sourcecode.cpp.cpp; path = RegExp.cpp; sourceTree = "<group>"; tabWidth = 8; };
</span><span class="cx">                 F692A87E0255597D01FF60F7 /* RegExp.h */ = {isa = PBXFileReference; fileEncoding = 30; indentWidth = 4; lastKnownFileType = sourcecode.c.h; path = RegExp.h; sourceTree = "<group>"; tabWidth = 8; };
</span><span class="cx">                 F692A8870255597D01FF60F7 /* JSCJSValue.cpp */ = {isa = PBXFileReference; fileEncoding = 30; indentWidth = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSCJSValue.cpp; sourceTree = "<group>"; tabWidth = 8; };
</span><ins>+                F73926918DC64330AFCDF0D7 /* JSSourceCode.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSSourceCode.cpp; sourceTree = "<group>"; };
</ins><span class="cx">                 FE0D4A041AB8DD0A002F54BF /* ExecutionTimeLimitTest.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = ExecutionTimeLimitTest.cpp; path = API/tests/ExecutionTimeLimitTest.cpp; sourceTree = "<group>"; };
</span><span class="cx">                 FE0D4A051AB8DD0A002F54BF /* ExecutionTimeLimitTest.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = ExecutionTimeLimitTest.h; path = API/tests/ExecutionTimeLimitTest.h; sourceTree = "<group>"; };
</span><span class="cx">                 FE0D4A071ABA2437002F54BF /* GlobalContextWithFinalizerTest.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = GlobalContextWithFinalizerTest.cpp; path = API/tests/GlobalContextWithFinalizerTest.cpp; sourceTree = "<group>"; };
</span><span class="lines">@@ -4919,11 +4928,6 @@
</span><span class="cx">                 FEF040501AAE662D00BD28B0 /* CompareAndSwapTest.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = CompareAndSwapTest.cpp; path = API/tests/CompareAndSwapTest.cpp; sourceTree = "<group>"; };
</span><span class="cx">                 FEF040521AAEC4ED00BD28B0 /* CompareAndSwapTest.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = CompareAndSwapTest.h; path = API/tests/CompareAndSwapTest.h; sourceTree = "<group>"; };
</span><span class="cx">                 FEFD6FC51D5E7970008F2F0B /* JSStringInlines.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSStringInlines.h; sourceTree = "<group>"; };
</span><del>-                F73926918DC64330AFCDF0D7 /* JSSourceCode.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = JSSourceCode.cpp; path = JSSourceCode.cpp; sourceTree = "<group>"; };
-                3032175DF1AD47D8998B34E1 /* JSSourceCode.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = JSSourceCode.h; path = JSSourceCode.h; sourceTree = "<group>"; };
-                11C197C2624848EDA84CED7F /* JSScriptFetcher.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = JSScriptFetcher.cpp; path = JSScriptFetcher.cpp; sourceTree = "<group>"; };
-                6BA93C9590484C5BAD9316EA /* JSScriptFetcher.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = JSScriptFetcher.h; path = JSScriptFetcher.h; sourceTree = "<group>"; };
-                8852151A9C3842389B3215B7 /* ScriptFetcher.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = ScriptFetcher.h; path = ScriptFetcher.h; sourceTree = "<group>"; };
</del><span class="cx"> /* End PBXFileReference section */
</span><span class="cx">
</span><span class="cx"> /* Begin PBXFrameworksBuildPhase section */
</span><span class="lines">@@ -6502,12 +6506,18 @@
</span><span class="cx">                                 862553CF16136AA5009F17D0 /* JSProxy.h */,
</span><span class="cx">                                 14874AE115EBDE4A002E3587 /* JSScope.cpp */,
</span><span class="cx">                                 14874AE215EBDE4A002E3587 /* JSScope.h */,
</span><ins>+                                11C197C2624848EDA84CED7F /* JSScriptFetcher.cpp */,
+                                6BA93C9590484C5BAD9316EA /* JSScriptFetcher.h */,
</ins><span class="cx">                                 0F919D0E157F3327004A4E7D /* JSSegmentedVariableObject.cpp */,
</span><span class="cx">                                 0F919D0F157F3327004A4E7D /* JSSegmentedVariableObject.h */,
</span><ins>+                                0F4F82851E2FFDDB0075184C /* JSSegmentedVariableObjectSubspace.cpp */,
+                                0F4F82861E2FFDDB0075184C /* JSSegmentedVariableObjectSubspace.h */,
</ins><span class="cx">                                 A7299D9B17D12837005F5FF9 /* JSSet.cpp */,
</span><span class="cx">                                 A7299D9C17D12837005F5FF9 /* JSSet.h */,
</span><span class="cx">                                 A790DD69182F499700588807 /* JSSetIterator.cpp */,
</span><span class="cx">                                 A790DD6A182F499700588807 /* JSSetIterator.h */,
</span><ins>+                                F73926918DC64330AFCDF0D7 /* JSSourceCode.cpp */,
+                                3032175DF1AD47D8998B34E1 /* JSSourceCode.h */,
</ins><span class="cx">                                 BC02E9B60E1842FA000F9297 /* JSString.cpp */,
</span><span class="cx">                                 F692A8620255597D01FF60F7 /* JSString.h */,
</span><span class="cx">                                 86E85538111B9968001AF51E /* JSStringBuilder.h */,
</span><span class="lines">@@ -6663,6 +6673,7 @@
</span><span class="cx">                                 0FE050221AA9095600D33B33 /* ScopeOffset.h */,
</span><span class="cx">                                 147341E01DC2CE9600AA29BA /* ScriptExecutable.cpp */,
</span><span class="cx">                                 147341CD1DC02D7900AA29BA /* ScriptExecutable.h */,
</span><ins>+                                8852151A9C3842389B3215B7 /* ScriptFetcher.h */,
</ins><span class="cx">                                 A7299DA317D12858005F5FF9 /* SetConstructor.cpp */,
</span><span class="cx">                                 A7299DA417D12858005F5FF9 /* SetConstructor.h */,
</span><span class="cx">                                 A790DD67182F499700588807 /* SetIteratorPrototype.cpp */,
</span><span class="lines">@@ -6771,11 +6782,6 @@
</span><span class="cx">                                 709FB8661AE335C60039D069 /* WeakSetPrototype.h */,
</span><span class="cx">                                 A7DCB77912E3D90500911940 /* WriteBarrier.h */,
</span><span class="cx">                                 C2B6D75218A33793004A9301 /* WriteBarrierInlines.h */,
</span><del>-                                F73926918DC64330AFCDF0D7 /* JSSourceCode.cpp */,
-                                3032175DF1AD47D8998B34E1 /* JSSourceCode.h */,
-                                11C197C2624848EDA84CED7F /* JSScriptFetcher.cpp */,
-                                6BA93C9590484C5BAD9316EA /* JSScriptFetcher.h */,
-                                8852151A9C3842389B3215B7 /* ScriptFetcher.h */,
</del><span class="cx">                         );
</span><span class="cx">                         path = runtime;
</span><span class="cx">                         sourceTree = "<group>";
</span><span class="lines">@@ -8123,6 +8129,7 @@
</span><span class="cx">                                 0F2DD8141AB3D8BE00BBB8E8 /* DFGArgumentsUtilities.h in Headers */,
</span><span class="cx">                                 0F485322187750560083B687 /* DFGArithMode.h in Headers */,
</span><span class="cx">                                 0F05C3B41683CF9200BAF45B /* DFGArrayifySlowPathGenerator.h in Headers */,
</span><ins>+                                0F4F82881E2FFDE00075184C /* JSSegmentedVariableObjectSubspace.h in Headers */,
</ins><span class="cx">                                 0F63948515E4811B006A597C /* DFGArrayMode.h in Headers */,
</span><span class="cx">                                 A7D9A29517A0BC7400EE2618 /* DFGAtTailAbstractState.h in Headers */,
</span><span class="cx">                                 0F666EC71835672B00D017F1 /* DFGAvailability.h in Headers */,
</span><span class="lines">@@ -9782,6 +9789,7 @@
</span><span class="cx">                                 0F64B2711A784BAF006E4E66 /* BinarySwitch.cpp in Sources */,
</span><span class="cx">                                 14280863107EC11A0013E7B2 /* BooleanConstructor.cpp in Sources */,
</span><span class="cx">                                 14280864107EC11A0013E7B2 /* BooleanObject.cpp in Sources */,
</span><ins>+                                0F4F82871E2FFDDD0075184C /* JSSegmentedVariableObjectSubspace.cpp in Sources */,
</ins><span class="cx">                                 ADB6F67D1E15D7600082F384 /* WasmPageCount.cpp in Sources */,
</span><span class="cx">                                 14280865107EC11A0013E7B2 /* BooleanPrototype.cpp in Sources */,
</span><span class="cx">                                 DE26E9071CB5DEFB00D2BE82 /* BuiltinExecutableCreator.cpp in Sources */,
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorejsccpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/jsc.cpp (210911 => 210912)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/jsc.cpp        2017-01-19 05:09:49 UTC (rev 210911)
+++ trunk/Source/JavaScriptCore/jsc.cpp        2017-01-19 05:13:21 UTC (rev 210912)
</span><span class="lines">@@ -1119,7 +1119,6 @@
</span><span class="cx"> {
</span><span class="cx"> GlobalObject* object = new (NotNull, allocateCell<GlobalObject>(vm.heap)) GlobalObject(vm, structure);
</span><span class="cx"> object->finishCreation(vm, arguments);
</span><del>- vm.heap.addFinalizer(object, destroy);
</del><span class="cx"> return object;
</span><span class="cx"> }
</span><span class="cx">
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeJSGlobalLexicalEnvironmenth"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/JSGlobalLexicalEnvironment.h (210911 => 210912)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/JSGlobalLexicalEnvironment.h        2017-01-19 05:09:49 UTC (rev 210911)
+++ trunk/Source/JavaScriptCore/runtime/JSGlobalLexicalEnvironment.h        2017-01-19 05:13:21 UTC (rev 210912)
</span><span class="lines">@@ -42,7 +42,6 @@
</span><span class="cx"> new (NotNull, allocateCell<JSGlobalLexicalEnvironment>(vm.heap)) JSGlobalLexicalEnvironment(vm, structure, parentScope);
</span><span class="cx"> result->finishCreation(vm);
</span><span class="cx"> result->symbolTable()->setScopeType(SymbolTable::ScopeType::GlobalLexicalScope);
</span><del>- vm.heap.addFinalizer(result, destroy);
</del><span class="cx"> return result;
</span><span class="cx"> }
</span><span class="cx">
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeJSGlobalObjectcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/JSGlobalObject.cpp (210911 => 210912)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/JSGlobalObject.cpp        2017-01-19 05:09:49 UTC (rev 210911)
+++ trunk/Source/JavaScriptCore/runtime/JSGlobalObject.cpp        2017-01-19 05:13:21 UTC (rev 210912)
</span><span class="lines">@@ -1449,4 +1449,29 @@
</span><span class="cx"> return m_debugger && m_debugger->isInteractivelyDebugging();
</span><span class="cx"> }
</span><span class="cx">
</span><ins>+JSGlobalObject* JSGlobalObject::create(VM& vm, Structure* structure)
+{
+ JSGlobalObject* globalObject = new (NotNull, allocateCell<JSGlobalObject>(vm.heap)) JSGlobalObject(vm, structure);
+ globalObject->finishCreation(vm);
+ return globalObject;
+}
+
+void JSGlobalObject::finishCreation(VM& vm)
+{
+ Base::finishCreation(vm);
+ structure()->setGlobalObject(vm, this);
+ m_runtimeFlags = m_globalObjectMethodTable->javaScriptRuntimeFlags(this);
+ init(vm);
+ setGlobalThis(vm, JSProxy::create(vm, JSProxy::createStructure(vm, this, getPrototypeDirect(), PureForwardingProxyType), this));
+}
+
+void JSGlobalObject::finishCreation(VM& vm, JSObject* thisValue)
+{
+ Base::finishCreation(vm);
+ structure()->setGlobalObject(vm, this);
+ m_runtimeFlags = m_globalObjectMethodTable->javaScriptRuntimeFlags(this);
+ init(vm);
+ setGlobalThis(vm, thisValue);
+}
+
</ins><span class="cx"> } // namespace JSC
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeJSGlobalObjecth"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/JSGlobalObject.h (210911 => 210912)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/JSGlobalObject.h        2017-01-19 05:09:49 UTC (rev 210911)
+++ trunk/Source/JavaScriptCore/runtime/JSGlobalObject.h        2017-01-19 05:13:21 UTC (rev 210912)
</span><span class="lines">@@ -433,13 +433,7 @@
</span><span class="cx"> typedef JSSegmentedVariableObject Base;
</span><span class="cx"> static const unsigned StructureFlags = Base::StructureFlags | HasStaticPropertyTable | OverridesGetOwnPropertySlot | OverridesGetPropertyNames | OverridesToThis;
</span><span class="cx">
</span><del>- static JSGlobalObject* create(VM& vm, Structure* structure)
- {
- JSGlobalObject* globalObject = new (NotNull, allocateCell<JSGlobalObject>(vm.heap)) JSGlobalObject(vm, structure);
- globalObject->finishCreation(vm);
- vm.heap.addFinalizer(globalObject, destroy);
- return globalObject;
- }
</del><ins>+ JS_EXPORT_PRIVATE static JSGlobalObject* create(VM&, Structure*);
</ins><span class="cx">
</span><span class="cx"> DECLARE_EXPORT_INFO;
</span><span class="cx">
</span><span class="lines">@@ -450,23 +444,9 @@
</span><span class="cx"> protected:
</span><span class="cx"> JS_EXPORT_PRIVATE explicit JSGlobalObject(VM&, Structure*, const GlobalObjectMethodTable* = 0);
</span><span class="cx">
</span><del>- void finishCreation(VM& vm)
- {
- Base::finishCreation(vm);
- structure()->setGlobalObject(vm, this);
- m_runtimeFlags = m_globalObjectMethodTable->javaScriptRuntimeFlags(this);
- init(vm);
- setGlobalThis(vm, JSProxy::create(vm, JSProxy::createStructure(vm, this, getPrototypeDirect(), PureForwardingProxyType), this));
- }
</del><ins>+ JS_EXPORT_PRIVATE void finishCreation(VM&);
</ins><span class="cx">
</span><del>- void finishCreation(VM& vm, JSObject* thisValue)
- {
- Base::finishCreation(vm);
- structure()->setGlobalObject(vm, this);
- m_runtimeFlags = m_globalObjectMethodTable->javaScriptRuntimeFlags(this);
- init(vm);
- setGlobalThis(vm, thisValue);
- }
</del><ins>+ JS_EXPORT_PRIVATE void finishCreation(VM&, JSObject*);
</ins><span class="cx">
</span><span class="cx"> void addGlobalVar(const Identifier&);
</span><span class="cx">
</span><span class="lines">@@ -473,8 +453,6 @@
</span><span class="cx"> public:
</span><span class="cx"> JS_EXPORT_PRIVATE ~JSGlobalObject();
</span><span class="cx"> JS_EXPORT_PRIVATE static void destroy(JSCell*);
</span><del>- // We don't need a destructor because we use a finalizer instead.
- static const bool needsDestruction = false;
</del><span class="cx">
</span><span class="cx"> JS_EXPORT_PRIVATE static void visitChildren(JSCell*, SlotVisitor&);
</span><span class="cx">
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeJSSegmentedVariableObjectcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/JSSegmentedVariableObject.cpp (210911 => 210912)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/JSSegmentedVariableObject.cpp        2017-01-19 05:09:49 UTC (rev 210911)
+++ trunk/Source/JavaScriptCore/runtime/JSSegmentedVariableObject.cpp        2017-01-19 05:13:21 UTC (rev 210912)
</span><span class="lines">@@ -1,5 +1,5 @@
</span><span class="cx"> /*
</span><del>- * Copyright (C) 2012, 2013, 2015 Apple Inc. All rights reserved.
</del><ins>+ * Copyright (C) 2012-2017 Apple Inc. All rights reserved.
</ins><span class="cx"> *
</span><span class="cx"> * Redistribution and use in source and binary forms, with or without
</span><span class="cx"> * modification, are permitted provided that the following conditions
</span><span class="lines">@@ -93,5 +93,28 @@
</span><span class="cx"> }
</span><span class="cx"> }
</span><span class="cx">
</span><ins>+void JSSegmentedVariableObject::destroy(JSCell* cell)
+{
+ static_cast<JSSegmentedVariableObject*>(cell)->JSSegmentedVariableObject::~JSSegmentedVariableObject();
+}
+
+JSSegmentedVariableObject::JSSegmentedVariableObject(VM& vm, Structure* structure, JSScope* scope)
+ : JSSymbolTableObject(vm, structure, scope)
+ , m_classInfo(structure->classInfo())
+{
+}
+
+JSSegmentedVariableObject::~JSSegmentedVariableObject()
+{
+ RELEASE_ASSERT(!m_alreadyDestroyed);
+ m_alreadyDestroyed = true;
+}
+
+void JSSegmentedVariableObject::finishCreation(VM& vm)
+{
+ Base::finishCreation(vm);
+ setSymbolTable(vm, SymbolTable::create(vm));
+}
+
</ins><span class="cx"> } // namespace JSC
</span><span class="cx">
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeJSSegmentedVariableObjecth"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/JSSegmentedVariableObject.h (210911 => 210912)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/JSSegmentedVariableObject.h        2017-01-19 05:09:49 UTC (rev 210911)
+++ trunk/Source/JavaScriptCore/runtime/JSSegmentedVariableObject.h        2017-01-19 05:13:21 UTC (rev 210912)
</span><span class="lines">@@ -1,5 +1,5 @@
</span><span class="cx"> /*
</span><del>- * Copyright (C) 2012, 2013, 2015 Apple Inc. All rights reserved.
</del><ins>+ * Copyright (C) 2012-2017 Apple Inc. All rights reserved.
</ins><span class="cx"> *
</span><span class="cx"> * Redistribution and use in source and binary forms, with or without
</span><span class="cx"> * modification, are permitted provided that the following conditions
</span><span class="lines">@@ -86,23 +86,28 @@
</span><span class="cx"> JS_EXPORT_PRIVATE static void visitChildren(JSCell*, SlotVisitor&);
</span><span class="cx"> JS_EXPORT_PRIVATE static void heapSnapshot(JSCell*, HeapSnapshotBuilder&);
</span><span class="cx">
</span><del>-protected:
- JSSegmentedVariableObject(VM& vm, Structure* structure, JSScope* scope)
- : JSSymbolTableObject(vm, structure, scope)
</del><ins>+ static void destroy(JSCell*);
+
+ template<typename>
+ static Subspace* subspaceFor(VM& vm)
</ins><span class="cx"> {
</span><ins>+ return &vm.segmentedVariableObjectSpace;
</ins><span class="cx"> }
</span><ins>+
+ const ClassInfo* classInfo() const { return m_classInfo; }
+
+protected:
+ JSSegmentedVariableObject(VM&, Structure*, JSScope*);
+
+ ~JSSegmentedVariableObject();
</ins><span class="cx">
</span><del>- void finishCreation(VM& vm)
- {
- Base::finishCreation(vm);
- setSymbolTable(vm, SymbolTable::create(vm));
- }
</del><ins>+ void finishCreation(VM&);
</ins><span class="cx">
</span><span class="cx"> private:
</span><del>- // FIXME: This needs a destructor, which can only be added using custom subspace.
-
</del><span class="cx"> SegmentedVector<WriteBarrier<Unknown>, 16> m_variables;
</span><span class="cx"> ConcurrentJSLock m_lock;
</span><ins>+ bool m_alreadyDestroyed { false }; // We use these assertions to check that we aren't doing ancient hacks that result in this being destroyed more than once.
+ const ClassInfo* m_classInfo;
</ins><span class="cx"> };
</span><span class="cx">
</span><span class="cx"> } // namespace JSC
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeJSSegmentedVariableObjectSubspacecpp"></a>
<div class="addfile"><h4>Added: trunk/Source/JavaScriptCore/runtime/JSSegmentedVariableObjectSubspace.cpp (0 => 210912)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/JSSegmentedVariableObjectSubspace.cpp         (rev 0)
+++ trunk/Source/JavaScriptCore/runtime/JSSegmentedVariableObjectSubspace.cpp        2017-01-19 05:13:21 UTC (rev 210912)
</span><span class="lines">@@ -0,0 +1,66 @@
</span><ins>+/*
+ * Copyright (C) 2017 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ * notice, this list of conditions and the following disclaimer in the
+ * documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "JSSegmentedVariableObjectSubspace.h"
+
+#include "JSCInlines.h"
+#include "MarkedBlockInlines.h"
+#include "SubspaceInlines.h"
+
+namespace JSC {
+
+namespace {
+
+struct DestroyFunc {
+ ALWAYS_INLINE void operator()(VM&, JSCell* cell) const
+ {
+ static_cast<JSSegmentedVariableObject*>(cell)->classInfo()->methodTable.destroy(cell);
+ }
+};
+
+} // anonymous namespace
+
+JSSegmentedVariableObjectSubspace::JSSegmentedVariableObjectSubspace(CString name, Heap& heap)
+ : Subspace(name, heap, AllocatorAttributes(NeedsDestruction, HeapCell::JSCell))
+{
+}
+
+JSSegmentedVariableObjectSubspace::~JSSegmentedVariableObjectSubspace()
+{
+}
+
+FreeList JSSegmentedVariableObjectSubspace::finishSweep(MarkedBlock::Handle& handle, MarkedBlock::Handle::SweepMode sweepMode)
+{
+ return handle.finishSweepKnowingSubspace(sweepMode, DestroyFunc());
+}
+
+void JSSegmentedVariableObjectSubspace::destroy(VM& vm, JSCell* cell)
+{
+ DestroyFunc()(vm, cell);
+}
+
+} // namespace JSC
+
</ins></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeJSSegmentedVariableObjectSubspaceh"></a>
<div class="addfile"><h4>Added: trunk/Source/JavaScriptCore/runtime/JSSegmentedVariableObjectSubspace.h (0 => 210912)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/JSSegmentedVariableObjectSubspace.h         (rev 0)
+++ trunk/Source/JavaScriptCore/runtime/JSSegmentedVariableObjectSubspace.h        2017-01-19 05:13:21 UTC (rev 210912)
</span><span class="lines">@@ -0,0 +1,42 @@
</span><ins>+/*
+ * Copyright (C) 2017 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ * notice, this list of conditions and the following disclaimer in the
+ * documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include "Subspace.h"
+
+namespace JSC {
+
+class JSSegmentedVariableObjectSubspace : public Subspace {
+public:
+ JS_EXPORT_PRIVATE JSSegmentedVariableObjectSubspace(CString name, Heap&);
+ JS_EXPORT_PRIVATE virtual ~JSSegmentedVariableObjectSubspace();
+
+ FreeList finishSweep(MarkedBlock::Handle&, MarkedBlock::Handle::SweepMode) override;
+ void destroy(VM&, JSCell*) override;
+};
+
+} // namespace JSC
+
</ins></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeVMcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/VM.cpp (210911 => 210912)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/VM.cpp        2017-01-19 05:09:49 UTC (rev 210911)
+++ trunk/Source/JavaScriptCore/runtime/VM.cpp        2017-01-19 05:13:21 UTC (rev 210912)
</span><span class="lines">@@ -171,6 +171,7 @@
</span><span class="cx"> , destructibleCellSpace("Destructible JSCell", heap, AllocatorAttributes(NeedsDestruction, HeapCell::JSCell))
</span><span class="cx"> , stringSpace("JSString", heap)
</span><span class="cx"> , destructibleObjectSpace("JSDestructibleObject", heap)
</span><ins>+ , segmentedVariableObjectSpace("JSSegmentedVariableObjectSpace", heap)
</ins><span class="cx"> , vmType(vmType)
</span><span class="cx"> , clientData(0)
</span><span class="cx"> , topVMEntryFrame(nullptr)
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeVMh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/VM.h (210911 => 210912)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/VM.h        2017-01-19 05:09:49 UTC (rev 210911)
+++ trunk/Source/JavaScriptCore/runtime/VM.h        2017-01-19 05:13:21 UTC (rev 210912)
</span><span class="lines">@@ -42,6 +42,7 @@
</span><span class="cx"> #include "JSCJSValue.h"
</span><span class="cx"> #include "JSDestructibleObjectSubspace.h"
</span><span class="cx"> #include "JSLock.h"
</span><ins>+#include "JSSegmentedVariableObjectSubspace.h"
</ins><span class="cx"> #include "JSStringSubspace.h"
</span><span class="cx"> #include "MacroAssemblerCodeRef.h"
</span><span class="cx"> #include "Microtask.h"
</span><span class="lines">@@ -298,6 +299,7 @@
</span><span class="cx"> Subspace destructibleCellSpace;
</span><span class="cx"> JSStringSubspace stringSpace;
</span><span class="cx"> JSDestructibleObjectSubspace destructibleObjectSpace;
</span><ins>+ JSSegmentedVariableObjectSubspace segmentedVariableObjectSpace;
</ins><span class="cx">
</span><span class="cx"> #if ENABLE(DFG_JIT)
</span><span class="cx"> std::unique_ptr<DFG::LongLivedState> dfgState;
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoretestRegExpcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/testRegExp.cpp (210911 => 210912)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/testRegExp.cpp        2017-01-19 05:09:49 UTC (rev 210911)
+++ trunk/Source/JavaScriptCore/testRegExp.cpp        2017-01-19 05:13:21 UTC (rev 210912)
</span><span class="lines">@@ -112,7 +112,6 @@
</span><span class="cx"> static GlobalObject* create(VM& vm, Structure* structure, const Vector<String>& arguments)
</span><span class="cx"> {
</span><span class="cx"> GlobalObject* globalObject = new (NotNull, allocateCell<GlobalObject>(vm.heap)) GlobalObject(vm, structure, arguments);
</span><del>- vm.heap.addFinalizer(globalObject, destroy);
</del><span class="cx"> return globalObject;
</span><span class="cx"> }
</span><span class="cx">
</span></span></pre></div>
<a id="trunkSourceWebCoreChangeLog"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/ChangeLog (210911 => 210912)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/ChangeLog        2017-01-19 05:09:49 UTC (rev 210911)
+++ trunk/Source/WebCore/ChangeLog        2017-01-19 05:13:21 UTC (rev 210912)
</span><span class="lines">@@ -1,3 +1,21 @@
</span><ins>+2017-01-18 Filip Pizlo <fpizlo@apple.com>
+
+ JSSegmentedVariableObject and its subclasses should have a sane destruction story
+ https://bugs.webkit.org/show_bug.cgi?id=167193
+
+ Reviewed by Saam Barati.
+
+ No new tests because no new behavior.
+
+ JSSegmentedVariableObjects now get to have a sane destruction story. This means switching
+ subspace types for the DOM's global object subspace.
+
+ * bindings/js/WebCoreJSClientData.cpp:
+ (WebCore::JSVMClientData::JSVMClientData):
+ * bindings/js/WebCoreJSClientData.h:
+ * bindings/scripts/CodeGeneratorJS.pm:
+ (GenerateHeader):
+
</ins><span class="cx"> 2017-01-18 Ryan Haddad <ryanhaddad@apple.com>
</span><span class="cx">
</span><span class="cx"> Unreviewed, rolling out r210848.
</span></span></pre></div>
<a id="trunkSourceWebCorebindingsjsWebCoreJSClientDatacpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/js/WebCoreJSClientData.cpp (210911 => 210912)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/bindings/js/WebCoreJSClientData.cpp        2017-01-19 05:09:49 UTC (rev 210911)
+++ trunk/Source/WebCore/bindings/js/WebCoreJSClientData.cpp        2017-01-19 05:13:21 UTC (rev 210912)
</span><span class="lines">@@ -44,7 +44,7 @@
</span><span class="cx"> : m_builtinFunctions(vm)
</span><span class="cx"> , m_builtinNames(&vm)
</span><span class="cx"> , m_outputConstraintSpace("WebCore Wrapper w/ Output Constraint", vm.heap)
</span><del>- , m_globalObjectOutputConstraintSpace("WebCore Global Object w/ Output Constraint", vm.heap, AllocatorAttributes(DoesNotNeedDestruction, HeapCell::JSCell))
</del><ins>+ , m_globalObjectOutputConstraintSpace("WebCore Global Object w/ Output Constraint", vm.heap)
</ins><span class="cx"> {
</span><span class="cx"> }
</span><span class="cx">
</span></span></pre></div>
<a id="trunkSourceWebCorebindingsjsWebCoreJSClientDatah"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/js/WebCoreJSClientData.h (210911 => 210912)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/bindings/js/WebCoreJSClientData.h        2017-01-19 05:09:49 UTC (rev 210911)
+++ trunk/Source/WebCore/bindings/js/WebCoreJSClientData.h        2017-01-19 05:13:21 UTC (rev 210912)
</span><span class="lines">@@ -78,7 +78,7 @@
</span><span class="cx"> WebCoreBuiltinNames m_builtinNames;
</span><span class="cx">
</span><span class="cx"> JSC::JSDestructibleObjectSubspace m_outputConstraintSpace;
</span><del>- JSC::Subspace m_globalObjectOutputConstraintSpace;
</del><ins>+ JSC::JSSegmentedVariableObjectSubspace m_globalObjectOutputConstraintSpace;
</ins><span class="cx"> };
</span><span class="cx">
</span><span class="cx"> } // namespace WebCore
</span></span></pre></div>
<a id="trunkSourceWebCorebindingsscriptsCodeGeneratorJSpm"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/scripts/CodeGeneratorJS.pm (210911 => 210912)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/bindings/scripts/CodeGeneratorJS.pm        2017-01-19 05:09:49 UTC (rev 210911)
+++ trunk/Source/WebCore/bindings/scripts/CodeGeneratorJS.pm        2017-01-19 05:13:21 UTC (rev 210912)
</span><span class="lines">@@ -3,7 +3,7 @@
</span><span class="cx"> # Copyright (C) 2006 Anders Carlsson <andersca@mac.com>
</span><span class="cx"> # Copyright (C) 2006, 2007 Samuel Weinig <sam@webkit.org>
</span><span class="cx"> # Copyright (C) 2006 Alexey Proskuryakov <ap@webkit.org>
</span><del>-# Copyright (C) 2006-2010, 2013-2016 Apple Inc. All rights reserved.
</del><ins>+# Copyright (C) 2006-2017 Apple Inc. All rights reserved.
</ins><span class="cx"> # Copyright (C) 2009 Cameron McCormack <cam@mcc.id.au>
</span><span class="cx"> # Copyright (C) Research In Motion Limited 2010. All rights reserved.
</span><span class="cx"> # Copyright (C) 2010 Nokia Corporation and/or its subsidiary(-ies)
</span><span class="lines">@@ -1751,7 +1751,6 @@
</span><span class="cx"> push(@headerContent, " {\n");
</span><span class="cx"> push(@headerContent, " $className* ptr = new (NotNull, JSC::allocateCell<$className>(vm.heap)) ${className}(vm, structure, WTFMove(impl), windowShell);\n");
</span><span class="cx"> push(@headerContent, " ptr->finishCreation(vm, windowShell);\n");
</span><del>- push(@headerContent, " vm.heap.addFinalizer(ptr, destroy);\n");
</del><span class="cx"> push(@headerContent, " return ptr;\n");
</span><span class="cx"> push(@headerContent, " }\n\n");
</span><span class="cx"> } elsif ($codeGenerator->InheritsInterface($interface, "WorkerGlobalScope")) {
</span><span class="lines">@@ -1759,7 +1758,6 @@
</span><span class="cx"> push(@headerContent, " {\n");
</span><span class="cx"> push(@headerContent, " $className* ptr = new (NotNull, JSC::allocateCell<$className>(vm.heap)) ${className}(vm, structure, WTFMove(impl));\n");
</span><span class="cx"> push(@headerContent, " ptr->finishCreation(vm, proxy);\n");
</span><del>- push(@headerContent, " vm.heap.addFinalizer(ptr, destroy);\n");
</del><span class="cx"> push(@headerContent, " return ptr;\n");
</span><span class="cx"> push(@headerContent, " }\n\n");
</span><span class="cx"> } elsif ($interface->extendedAttributes->{MasqueradesAsUndefined}) {
</span></span></pre>
</div>
</div>
</body>
</html>