<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN"

"http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">

<html xmlns="http://www.w3.org/1999/xhtml">

<head><meta http-equiv="content-type" content="text/html; charset=utf-8" />

<title>[211247] trunk</title>

</head>

<body>

<style type="text/css"><!--

#msg dl.meta { border: 1px #006 solid; background: #369; padding: 6px; color: #fff; }

#msg dl.meta dt { float: left; width: 6em; font-weight: bold; }

#msg dt:after { content:':';}

#msg dl, #msg dt, #msg ul, #msg li, #header, #footer, #logmsg { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt;  }

#msg dl a { font-weight: bold}

#msg dl a:link    { color:#fc3; }

#msg dl a:active  { color:#ff0; }

#msg dl a:visited { color:#cc6; }

h3 { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; font-weight: bold; }

#msg pre { overflow: auto; background: #ffc; border: 1px #fa0 solid; padding: 6px; }

#logmsg { background: #ffc; border: 1px #fa0 solid; padding: 1em 1em 0 1em; }

#logmsg p, #logmsg pre, #logmsg blockquote { margin: 0 0 1em 0; }

#logmsg p, #logmsg li, #logmsg dt, #logmsg dd { line-height: 14pt; }

#logmsg h1, #logmsg h2, #logmsg h3, #logmsg h4, #logmsg h5, #logmsg h6 { margin: .5em 0; }

#logmsg h1:first-child, #logmsg h2:first-child, #logmsg h3:first-child, #logmsg h4:first-child, #logmsg h5:first-child, #logmsg h6:first-child { margin-top: 0; }

#logmsg ul, #logmsg ol { padding: 0; list-style-position: inside; margin: 0 0 0 1em; }

#logmsg ul { text-indent: -1em; padding-left: 1em; }#logmsg ol { text-indent: -1.5em; padding-left: 1.5em; }

#logmsg > ul, #logmsg > ol { margin: 0 0 1em 0; }

#logmsg pre { background: #eee; padding: 1em; }

#logmsg blockquote { border: 1px solid #fa0; border-left-width: 10px; padding: 1em 1em 0 1em; background: white;}

#logmsg dl { margin: 0; }

#logmsg dt { font-weight: bold; }

#logmsg dd { margin: 0; padding: 0 0 0.5em 0; }

#logmsg dd:before { content:'\00bb';}

#logmsg table { border-spacing: 0px; border-collapse: collapse; border-top: 4px solid #fa0; border-bottom: 1px solid #fa0; background: #fff; }

#logmsg table th { text-align: left; font-weight: normal; padding: 0.2em 0.5em; border-top: 1px dotted #fa0; }

#logmsg table td { text-align: right; border-top: 1px dotted #fa0; padding: 0.2em 0.5em; }

#logmsg table thead th { text-align: center; border-bottom: 1px solid #fa0; }

#logmsg table th.Corner { text-align: left; }

#logmsg hr { border: none 0; border-top: 2px dashed #fa0; height: 1px; }

#header, #footer { color: #fff; background: #636; border: 1px #300 solid; padding: 6px; }

#patch { width: 100%; }

#patch h4 {font-family: verdana,arial,helvetica,sans-serif;font-size:10pt;padding:8px;background:#369;color:#fff;margin:0;}

#patch .propset h4, #patch .binary h4 {margin:0;}

#patch pre {padding:0;line-height:1.2em;margin:0;}

#patch .diff {width:100%;background:#eee;padding: 0 0 10px 0;overflow:auto;}

#patch .propset .diff, #patch .binary .diff  {padding:10px 0;}

#patch span {display:block;padding:0 10px;}

#patch .modfile, #patch .addfile, #patch .delfile, #patch .propset, #patch .binary, #patch .copfile {border:1px solid #ccc;margin:10px 0;}

#patch ins {background:#dfd;text-decoration:none;display:block;padding:0 10px;}

#patch del {background:#fdd;text-decoration:none;display:block;padding:0 10px;}

#patch .lines, .info {color:#888;background:#fff;}

--></style>

<div id="msg">

<dl class="meta">

<dt>Revision</dt> <dd><a href="http://trac.webkit.org/projects/webkit/changeset/211247">211247</a></dd>

<dt>Author</dt> <dd>keith_miller@apple.com</dd>

<dt>Date</dt> <dd>2017-01-26 17:47:52 -0800 (Thu, 26 Jan 2017)</dd>

</dl>

<h3>Log Message</h3>

<pre>classInfo should take a VM so it is not materialized from the object on each call

https://bugs.webkit.org/show_bug.cgi?id=167424

Rubber Stamped by Michael Saboff.

Previously, classInfo() would get the VM from the target's

MarkedBlock.  Most callers already have a VM on hand, so it is

wasteful to compute the VM from the marked block every time. This

patch refactors some of the most common callers of classInfo(),

jsDynamicCast and inherits to take a VM as well.

Source/JavaScriptCore:

* API/JSCallbackConstructor.cpp:

(JSC::JSCallbackConstructor::finishCreation):

* API/JSCallbackFunction.cpp:

(JSC::JSCallbackFunction::finishCreation):

* API/JSCallbackObjectFunctions.h:

(JSC::JSCallbackObject&lt;Parent&gt;::asCallbackObject):

(JSC::JSCallbackObject&lt;Parent&gt;::finishCreation):

* API/JSObjectRef.cpp:

(JSObjectSetPrototype):

(classInfoPrivate):

(JSObjectGetPrivate):

(JSObjectSetPrivate):

(JSObjectGetPrivateProperty):

(JSObjectSetPrivateProperty):

(JSObjectDeletePrivateProperty):

* API/JSTypedArray.cpp:

(JSValueGetTypedArrayType):

(JSObjectMakeTypedArrayWithArrayBuffer):

(JSObjectMakeTypedArrayWithArrayBufferAndOffset):

(JSObjectGetTypedArrayBytesPtr):

(JSObjectGetTypedArrayLength):

(JSObjectGetTypedArrayByteLength):

(JSObjectGetTypedArrayByteOffset):

(JSObjectGetTypedArrayBuffer):

(JSObjectGetArrayBufferBytesPtr):

(JSObjectGetArrayBufferByteLength):

* API/JSValue.mm:

(isDate):

(isArray):

(valueToObjectWithoutCopy):

* API/JSValueRef.cpp:

(JSValueIsArray):

(JSValueIsDate):

(JSValueIsObjectOfClass):

* API/JSWeakObjectMapRefPrivate.cpp:

* API/JSWrapperMap.mm:

(tryUnwrapObjcObject):

* API/ObjCCallbackFunction.h:

* API/ObjCCallbackFunction.mm:

(tryUnwrapConstructor):

* bindings/ScriptFunctionCall.cpp:

(Deprecated::ScriptFunctionCall::call):

* bytecode/CallVariant.h:

(JSC::CallVariant::internalFunction):

(JSC::CallVariant::function):

(JSC::CallVariant::isClosureCall):

(JSC::CallVariant::executable):

(JSC::CallVariant::functionExecutable):

(JSC::CallVariant::nativeExecutable):

* bytecode/CodeBlock.cpp:

(JSC::CodeBlock::finishCreation):

(JSC::CodeBlock::setConstantRegisters):

(JSC::CodeBlock::replacement):

(JSC::CodeBlock::computeCapabilityLevel):

(JSC::CodeBlock::nameForRegister):

* bytecode/ObjectAllocationProfile.h:

(JSC::ObjectAllocationProfile::possibleDefaultPropertyCount):

* bytecode/ObjectPropertyCondition.cpp:

(JSC::ObjectPropertyCondition::attemptToMakeEquivalenceWithoutBarrier):

* bytecode/ObjectPropertyCondition.h:

(JSC::ObjectPropertyCondition::isValidValueForPresence):

* bytecode/PropertyCondition.cpp:

(JSC::PropertyCondition::isValidValueForAttributes):

(JSC::PropertyCondition::isValidValueForPresence):

(JSC::PropertyCondition::attemptToMakeEquivalenceWithoutBarrier):

* bytecode/PropertyCondition.h:

* bytecode/SpeculatedType.cpp:

(JSC::speculationFromCell):

* debugger/Debugger.cpp:

* debugger/DebuggerCallFrame.cpp:

(JSC::DebuggerCallFrame::functionName):

(JSC::DebuggerCallFrame::scope):

(JSC::DebuggerCallFrame::type):

* debugger/DebuggerScope.cpp:

(JSC::DebuggerScope::name):

(JSC::DebuggerScope::location):

* dfg/DFGAbstractInterpreter.h:

* dfg/DFGAbstractInterpreterInlines.h:

(JSC::DFG::AbstractInterpreter&lt;AbstractStateType&gt;::AbstractInterpreter):

(JSC::DFG::AbstractInterpreter&lt;AbstractStateType&gt;::executeEffects):

* dfg/DFGByteCodeParser.cpp:

(JSC::DFG::ByteCodeParser::get):

(JSC::DFG::ByteCodeParser::handleIntrinsicCall):

(JSC::DFG::ByteCodeParser::planLoad):

(JSC::DFG::ByteCodeParser::checkPresenceLike):

(JSC::DFG::ByteCodeParser::load):

(JSC::DFG::ByteCodeParser::parseBlock):

* dfg/DFGConstantFoldingPhase.cpp:

(JSC::DFG::ConstantFoldingPhase::foldConstants):

* dfg/DFGDesiredWeakReferences.cpp:

(JSC::DFG::DesiredWeakReferences::reallyAdd):

* dfg/DFGFixupPhase.cpp:

(JSC::DFG::FixupPhase::fixupMakeRope):

* dfg/DFGFrozenValue.h:

(JSC::DFG::FrozenValue::FrozenValue):

(JSC::DFG::FrozenValue::dynamicCast):

* dfg/DFGGraph.cpp:

(JSC::DFG::Graph::dump):

(JSC::DFG::Graph::tryGetConstantClosureVar):

(JSC::DFG::Graph::tryGetFoldableView):

(JSC::DFG::Graph::getRegExpPrototypeProperty):

(JSC::DFG::Graph::isStringPrototypeMethodSane):

(JSC::DFG::Graph::canOptimizeStringObjectAccess):

* dfg/DFGLazyJSValue.cpp:

(JSC::DFG::LazyJSValue::tryGetStringImpl):

(JSC::DFG::LazyJSValue::tryGetString):

* dfg/DFGLazyJSValue.h:

* dfg/DFGNode.cpp:

(JSC::DFG::Node::convertToPutStructureHint):

* dfg/DFGNode.h:

(JSC::DFG::Node::dynamicCastConstant):

(JSC::DFG::Node::castConstant):

* dfg/DFGOperations.cpp:

* dfg/DFGSafeToExecute.h:

(JSC::DFG::safeToExecute):

* dfg/DFGSpeculativeJIT.cpp:

(JSC::DFG::SpeculativeJIT::compileIn):

(JSC::DFG::SpeculativeJIT::compileMaterializeNewObject):

* dfg/DFGSpeculativeJIT32_64.cpp:

(JSC::DFG::SpeculativeJIT::emitCall):

(JSC::DFG::SpeculativeJIT::compile):

* dfg/DFGSpeculativeJIT64.cpp:

(JSC::DFG::SpeculativeJIT::emitCall):

(JSC::DFG::SpeculativeJIT::compile):

* dfg/DFGStrengthReductionPhase.cpp:

(JSC::DFG::StrengthReductionPhase::handleNode):

* ftl/FTLLowerDFGToB3.cpp:

(JSC::FTL::DFG::LowerDFGToB3::compileDirectCallOrConstruct):

(JSC::FTL::DFG::LowerDFGToB3::compileIn):

(JSC::FTL::DFG::LowerDFGToB3::compileMaterializeCreateActivation):

(JSC::FTL::DFG::LowerDFGToB3::compileStringReplace):

* ftl/FTLOperations.cpp:

(JSC::FTL::operationMaterializeObjectInOSR):

* heap/CodeBlockSet.cpp:

(JSC::CodeBlockSet::lastChanceToFinalize):

(JSC::CodeBlockSet::deleteUnmarkedAndUnreferenced):

* heap/CodeBlockSet.h:

* heap/GCAssertions.h:

* heap/Heap.cpp:

(JSC::Heap::lastChanceToFinalize):

(JSC::Heap::protectedObjectTypeCounts):

(JSC::Heap::objectTypeCounts):

(JSC::Heap::deleteUnmarkedCompiledCode):

* heap/HeapSnapshotBuilder.cpp:

(JSC::HeapSnapshotBuilder::json):

* heap/SlotVisitor.cpp:

(JSC::validate):

* inspector/InjectedScriptHost.h:

* inspector/JSGlobalObjectInspectorController.cpp:

(Inspector::JSGlobalObjectInspectorController::reportAPIException):

* inspector/JSInjectedScriptHost.cpp:

(Inspector::JSInjectedScriptHost::finishCreation):

(Inspector::JSInjectedScriptHost::isHTMLAllCollection):

(Inspector::JSInjectedScriptHost::subtype):

(Inspector::JSInjectedScriptHost::functionDetails):

(Inspector::JSInjectedScriptHost::getInternalProperties):

(Inspector::JSInjectedScriptHost::proxyTargetValue):

(Inspector::JSInjectedScriptHost::weakMapSize):

(Inspector::JSInjectedScriptHost::weakMapEntries):

(Inspector::JSInjectedScriptHost::weakSetSize):

(Inspector::JSInjectedScriptHost::weakSetEntries):

(Inspector::JSInjectedScriptHost::iteratorEntries):

* inspector/JSInjectedScriptHostPrototype.cpp:

(Inspector::JSInjectedScriptHostPrototype::finishCreation):

(Inspector::jsInjectedScriptHostPrototypeAttributeEvaluate):

(Inspector::jsInjectedScriptHostPrototypeFunctionInternalConstructorName):

(Inspector::jsInjectedScriptHostPrototypeFunctionIsHTMLAllCollection):

(Inspector::jsInjectedScriptHostPrototypeFunctionProxyTargetValue):

(Inspector::jsInjectedScriptHostPrototypeFunctionWeakMapSize):

(Inspector::jsInjectedScriptHostPrototypeFunctionWeakMapEntries):

(Inspector::jsInjectedScriptHostPrototypeFunctionWeakSetSize):

(Inspector::jsInjectedScriptHostPrototypeFunctionWeakSetEntries):

(Inspector::jsInjectedScriptHostPrototypeFunctionIteratorEntries):

(Inspector::jsInjectedScriptHostPrototypeFunctionEvaluateWithScopeExtension):

(Inspector::jsInjectedScriptHostPrototypeFunctionSubtype):

(Inspector::jsInjectedScriptHostPrototypeFunctionFunctionDetails):

(Inspector::jsInjectedScriptHostPrototypeFunctionGetInternalProperties):

* inspector/JSJavaScriptCallFrame.cpp:

(Inspector::JSJavaScriptCallFrame::finishCreation):

(Inspector::toJSJavaScriptCallFrame): Deleted.

* inspector/JSJavaScriptCallFrame.h:

* inspector/JSJavaScriptCallFramePrototype.cpp:

(Inspector::JSJavaScriptCallFramePrototype::finishCreation):

(Inspector::jsJavaScriptCallFramePrototypeFunctionEvaluateWithScopeExtension):

(Inspector::jsJavaScriptCallFramePrototypeFunctionScopeDescriptions):

(Inspector::jsJavaScriptCallFrameAttributeCaller):

(Inspector::jsJavaScriptCallFrameAttributeSourceID):

(Inspector::jsJavaScriptCallFrameAttributeLine):

(Inspector::jsJavaScriptCallFrameAttributeColumn):

(Inspector::jsJavaScriptCallFrameAttributeFunctionName):

(Inspector::jsJavaScriptCallFrameAttributeScopeChain):

(Inspector::jsJavaScriptCallFrameAttributeThisObject):

(Inspector::jsJavaScriptCallFrameAttributeType):

(Inspector::jsJavaScriptCallFrameIsTailDeleted):

* inspector/ScriptArguments.cpp:

(Inspector::ScriptArguments::getFirstArgumentAsString):

* inspector/agents/InspectorHeapAgent.cpp:

(Inspector::InspectorHeapAgent::getPreview):

* interpreter/Interpreter.cpp:

(JSC::notifyDebuggerOfUnwinding):

(JSC::Interpreter::unwind):

(JSC::Interpreter::notifyDebuggerOfExceptionToBeThrown):

(JSC::Interpreter::execute):

* interpreter/ShadowChicken.cpp:

(JSC::ShadowChicken::update):

* interpreter/StackVisitor.cpp:

(JSC::StackVisitor::readFrame):

(JSC::StackVisitor::readNonInlinedFrame):

(JSC::StackVisitor::Frame::calleeSaveRegisters):

* jit/JITCode.cpp:

(JSC::JITCode::execute):

* jit/JITOperations.cpp:

(JSC::operationNewFunctionCommon):

* jit/Repatch.cpp:

(JSC::tryCacheGetByID):

* jsc.cpp:

(WTF::CustomGetter::customGetter):

(WTF::RuntimeArray::finishCreation):

(WTF::RuntimeArray::lengthGetter):

(WTF::DOMJITGetter::customGetter):

(WTF::DOMJITGetterComplex::DOMJITNodeDOMJIT::slowCall):

(WTF::DOMJITGetterComplex::functionEnableException):

(WTF::DOMJITGetterComplex::customGetter):

(WTF::DOMJITFunctionObject::safeFunction):

(functionDescribeArray):

(functionCreateElement):

(functionGetElement):

(functionSetElementRoot):

(functionGetHiddenValue):

(functionSetHiddenValue):

(functionSetImpureGetterDelegate):

(functionNoFTL):

(functionDollarEvalScript):

(functionDollarAgentBroadcast):

(functionTransferArrayBuffer):

(functionFindTypeForExpression):

(functionReturnTypeFor):

(functionHasBasicBlockExecuted):

(functionBasicBlockExecutionCount):

(functionEnsureArrayStorage):

* llint/LLIntSlowPaths.cpp:

(JSC::LLInt::LLINT_SLOW_PATH_DECL):

* runtime/AbstractModuleRecord.cpp:

(JSC::AbstractModuleRecord::finishCreation):

* runtime/ArrayBuffer.cpp:

(JSC::ArrayBuffer::transferTo):

* runtime/ArrayBuffer.h:

* runtime/ArrayConstructor.cpp:

(JSC::ArrayConstructor::finishCreation):

(JSC::arrayConstructorPrivateFuncIsArraySlow):

(JSC::arrayConstructorPrivateFuncIsArrayConstructor):

* runtime/ArrayConstructor.h:

(JSC::isArrayConstructor): Deleted.

* runtime/ArrayIteratorPrototype.cpp:

(JSC::ArrayIteratorPrototype::finishCreation):

* runtime/ArrayPrototype.cpp:

(JSC::ArrayPrototype::finishCreation):

* runtime/AsyncFunctionPrototype.cpp:

(JSC::AsyncFunctionPrototype::finishCreation):

* runtime/AtomicsObject.cpp:

(JSC::AtomicsObject::finishCreation):

(JSC::atomicsFuncWait):

(JSC::atomicsFuncWake):

* runtime/BooleanObject.cpp:

(JSC::BooleanObject::finishCreation):

* runtime/BooleanObject.h:

(JSC::asBooleanObject):

* runtime/BooleanPrototype.cpp:

(JSC::BooleanPrototype::finishCreation):

(JSC::booleanProtoFuncToString):

(JSC::booleanProtoFuncValueOf):

* runtime/ConsoleObject.cpp:

(JSC::ConsoleObject::finishCreation):

* runtime/DateConstructor.cpp:

(JSC::constructDate):

* runtime/DateInstance.cpp:

(JSC::DateInstance::finishCreation):

* runtime/DateInstance.h:

(JSC::asDateInstance):

* runtime/DatePrototype.cpp:

(JSC::formateDateInstance):

(JSC::DatePrototype::finishCreation):

(JSC::dateProtoFuncToISOString):

(JSC::dateProtoFuncToLocaleString):

(JSC::dateProtoFuncToLocaleDateString):

(JSC::dateProtoFuncToLocaleTimeString):

(JSC::dateProtoFuncGetTime):

(JSC::dateProtoFuncGetFullYear):

(JSC::dateProtoFuncGetUTCFullYear):

(JSC::dateProtoFuncGetMonth):

(JSC::dateProtoFuncGetUTCMonth):

(JSC::dateProtoFuncGetDate):

(JSC::dateProtoFuncGetUTCDate):

(JSC::dateProtoFuncGetDay):

(JSC::dateProtoFuncGetUTCDay):

(JSC::dateProtoFuncGetHours):

(JSC::dateProtoFuncGetUTCHours):

(JSC::dateProtoFuncGetMinutes):

(JSC::dateProtoFuncGetUTCMinutes):

(JSC::dateProtoFuncGetSeconds):

(JSC::dateProtoFuncGetUTCSeconds):

(JSC::dateProtoFuncGetMilliSeconds):

(JSC::dateProtoFuncGetUTCMilliseconds):

(JSC::dateProtoFuncGetTimezoneOffset):

(JSC::dateProtoFuncSetTime):

(JSC::setNewValueFromTimeArgs):

(JSC::setNewValueFromDateArgs):

(JSC::dateProtoFuncSetYear):

(JSC::dateProtoFuncGetYear):

* runtime/ErrorInstance.cpp:

(JSC::ErrorInstance::finishCreation):

* runtime/ErrorPrototype.cpp:

(JSC::ErrorPrototype::finishCreation):

* runtime/ExceptionHelpers.cpp:

(JSC::isTerminatedExecutionException):

* runtime/ExceptionHelpers.h:

* runtime/ExecutableBase.cpp:

(JSC::ExecutableBase::clearCode):

(JSC::ExecutableBase::dump):

(JSC::ExecutableBase::hashFor):

* runtime/FunctionPrototype.cpp:

(JSC::functionProtoFuncToString):

* runtime/GeneratorFunctionPrototype.cpp:

(JSC::GeneratorFunctionPrototype::finishCreation):

* runtime/GeneratorPrototype.cpp:

(JSC::GeneratorPrototype::finishCreation):

* runtime/GetterSetter.h:

* runtime/InspectorInstrumentationObject.cpp:

(JSC::InspectorInstrumentationObject::finishCreation):

* runtime/InternalFunction.cpp:

(JSC::InternalFunction::finishCreation):

(JSC::InternalFunction::createSubclassStructure):

* runtime/InternalFunction.h:

(JSC::asInternalFunction):

* runtime/IntlCollator.cpp:

(JSC::IntlCollator::finishCreation):

* runtime/IntlCollatorPrototype.cpp:

(JSC::IntlCollatorPrototypeGetterCompare):

(JSC::IntlCollatorPrototypeFuncResolvedOptions):

* runtime/IntlDateTimeFormat.cpp:

(JSC::IntlDateTimeFormat::finishCreation):

* runtime/IntlDateTimeFormatPrototype.cpp:

(JSC::IntlDateTimeFormatPrototypeGetterFormat):

(JSC::IntlDateTimeFormatPrototypeFuncResolvedOptions):

* runtime/IntlNumberFormat.cpp:

(JSC::IntlNumberFormat::finishCreation):

* runtime/IntlNumberFormatPrototype.cpp:

(JSC::IntlNumberFormatPrototypeGetterFormat):

(JSC::IntlNumberFormatPrototypeFuncResolvedOptions):

* runtime/IntlObject.cpp:

(JSC::IntlObject::finishCreation):

* runtime/IntlObjectInlines.h:

(JSC::constructIntlInstanceWithWorkaroundForLegacyIntlConstructor):

* runtime/IteratorPrototype.cpp:

(JSC::IteratorPrototype::finishCreation):

* runtime/JSArray.h:

(JSC::asArray):

(JSC::isJSArray):

* runtime/JSArrayBuffer.h:

(JSC::toPossiblySharedArrayBuffer):

(JSC::toUnsharedArrayBuffer):

(JSC::JSArrayBuffer::toWrapped):

* runtime/JSArrayBufferConstructor.cpp:

(JSC::arrayBufferFuncIsView):

* runtime/JSArrayBufferPrototype.cpp:

(JSC::arrayBufferProtoFuncSlice):

* runtime/JSArrayBufferView.h:

* runtime/JSArrayBufferViewInlines.h:

(JSC::JSArrayBufferView::toWrapped):

* runtime/JSBoundFunction.cpp:

(JSC::isBoundFunction):

(JSC::getBoundFunctionStructure):

(JSC::JSBoundFunction::finishCreation):

* runtime/JSCJSValue.cpp:

(JSC::JSValue::dumpForBacktrace):

* runtime/JSCJSValue.h:

* runtime/JSCJSValueInlines.h:

(JSC::JSValue::inherits):

(JSC::JSValue::classInfoOrNull):

* runtime/JSCallee.cpp:

(JSC::JSCallee::finishCreation):

* runtime/JSCell.cpp:

(JSC::JSCell::dumpToStream):

(JSC::JSCell::className):

(JSC::JSCell::isAnyWasmCallee):

* runtime/JSCell.h:

(JSC::jsCast):

(JSC::jsDynamicCast):

* runtime/JSCellInlines.h:

(JSC::JSCell::methodTable):

(JSC::JSCell::inherits):

(JSC::JSCell::classInfo):

* runtime/JSCustomGetterSetterFunction.cpp:

(JSC::JSCustomGetterSetterFunction::finishCreation):

* runtime/JSDataViewPrototype.cpp:

(JSC::getData):

(JSC::setData):

(JSC::dataViewProtoGetterBuffer):

(JSC::dataViewProtoGetterByteLength):

(JSC::dataViewProtoGetterByteOffset):

* runtime/JSFunction.cpp:

(JSC::JSFunction::finishCreation):

(JSC::JSFunction::allocateAndInitializeRareData):

(JSC::JSFunction::initializeRareData):

(JSC::RetrieveArgumentsFunctor::RetrieveArgumentsFunctor):

(JSC::RetrieveCallerFunctionFunctor::RetrieveCallerFunctionFunctor):

(JSC::RetrieveCallerFunctionFunctor::operator()):

(JSC::JSFunction::callerGetter):

(JSC::JSFunction::getOwnNonIndexPropertyNames):

(JSC::getCalculatedDisplayName):

(JSC::JSFunction::reifyBoundNameIfNeeded):

* runtime/JSGenericTypedArrayView.h:

(JSC::toPossiblySharedNativeTypedView):

(JSC::toUnsharedNativeTypedView):

(JSC::JSGenericTypedArrayView&lt;Adaptor&gt;::toWrapped):

* runtime/JSGenericTypedArrayViewConstructorInlines.h:

(JSC::constructGenericTypedArrayViewWithArguments):

(JSC::constructGenericTypedArrayView):

* runtime/JSGenericTypedArrayViewInlines.h:

(JSC::JSGenericTypedArrayView&lt;Adaptor&gt;::set):

* runtime/JSGenericTypedArrayViewPrototypeFunctions.h:

(JSC::speciesConstruct):

(JSC::genericTypedArrayViewProtoFuncSet):

(JSC::genericTypedArrayViewProtoFuncSlice):

(JSC::genericTypedArrayViewPrivateFuncSubarrayCreate):

* runtime/JSGenericTypedArrayViewPrototypeInlines.h:

(JSC::JSGenericTypedArrayViewPrototype&lt;ViewClass&gt;::finishCreation):

* runtime/JSGlobalObject.cpp:

(JSC::getTemplateObject):

(JSC::enqueueJob):

(JSC::JSGlobalObject::init):

* runtime/JSGlobalObjectFunctions.cpp:

(JSC::globalFuncProtoGetter):

(JSC::globalFuncProtoSetter):

* runtime/JSInternalPromiseDeferred.cpp:

(JSC::JSInternalPromiseDeferred::create):

* runtime/JSLexicalEnvironment.h:

(JSC::asActivation):

* runtime/JSModuleLoader.cpp:

(JSC::JSModuleLoader::finishCreation):

(JSC::JSModuleLoader::evaluate):

(JSC::JSModuleLoader::getModuleNamespaceObject):

* runtime/JSModuleNamespaceObject.cpp:

(JSC::JSModuleNamespaceObject::finishCreation):

(JSC::moduleNamespaceObjectSymbolIterator):

* runtime/JSModuleRecord.cpp:

(JSC::JSModuleRecord::finishCreation):

* runtime/JSNativeStdFunction.cpp:

(JSC::JSNativeStdFunction::finishCreation):

* runtime/JSONObject.cpp:

(JSC::JSONObject::finishCreation):

(JSC::unwrapBoxedPrimitive):

(JSC::Stringifier::Stringifier):

(JSC::Walker::walk):

* runtime/JSObject.cpp:

(JSC::JSObject::className):

(JSC::JSObject::toStringName):

(JSC::JSObject::calculatedClassName):

(JSC::JSObject::putInlineSlow):

(JSC::JSObject::ensureInt32Slow):

(JSC::JSObject::ensureDoubleSlow):

(JSC::JSObject::ensureContiguousSlow):

(JSC::JSObject::ensureArrayStorageSlow):

(JSC::JSObject::deleteProperty):

(JSC::JSObject::getOwnStaticPropertySlot):

(JSC::JSObject::findPropertyHashEntry):

(JSC::JSObject::getOwnNonIndexPropertyNames):

(JSC::JSObject::reifyAllStaticProperties):

(JSC::JSObject::getOwnPropertyDescriptor):

* runtime/JSObject.h:

(JSC::JSObject::finishCreation):

(JSC::JSNonFinalObject::finishCreation):

(JSC::JSFinalObject::finishCreation):

* runtime/JSPromiseDeferred.cpp:

(JSC::JSPromiseDeferred::create):

* runtime/JSPropertyNameIterator.cpp:

(JSC::JSPropertyNameIterator::finishCreation):

(JSC::propertyNameIteratorFuncNext):

* runtime/JSScope.cpp:

(JSC::JSScope::symbolTable):

* runtime/JSScope.h:

* runtime/JSString.cpp:

(JSC::JSString::dumpToStream):

* runtime/JSStringIterator.cpp:

(JSC::JSStringIterator::finishCreation):

* runtime/JSTypedArrayViewPrototype.cpp:

(JSC::typedArrayViewPrivateFuncIsTypedArrayView):

(JSC::typedArrayViewPrivateFuncLength):

(JSC::typedArrayViewPrivateFuncGetOriginalConstructor):

(JSC::typedArrayViewProtoGetterFuncToStringTag):

(JSC::JSTypedArrayViewPrototype::finishCreation):

* runtime/LazyClassStructure.cpp:

(JSC::LazyClassStructure::Initializer::setConstructor):

* runtime/Lookup.h:

(JSC::putEntry):

* runtime/MapConstructor.cpp:

(JSC::MapConstructor::finishCreation):

* runtime/MapIteratorPrototype.cpp:

(JSC::MapIteratorPrototype::finishCreation):

(JSC::MapIteratorPrototypeFuncNext):

* runtime/MapPrototype.cpp:

(JSC::MapPrototype::finishCreation):

(JSC::mapProtoFuncValues):

(JSC::mapProtoFuncEntries):

(JSC::mapProtoFuncKeys):

(JSC::privateFuncMapIterator):

(JSC::privateFuncMapIteratorNext):

* runtime/MathObject.cpp:

(JSC::MathObject::finishCreation):

* runtime/ModuleLoaderPrototype.cpp:

(JSC::moduleLoaderPrototypeParseModule):

(JSC::moduleLoaderPrototypeRequestedModules):

(JSC::moduleLoaderPrototypeModuleDeclarationInstantiation):

(JSC::moduleLoaderPrototypeResolve):

(JSC::moduleLoaderPrototypeFetch):

(JSC::moduleLoaderPrototypeInstantiate):

(JSC::moduleLoaderPrototypeGetModuleNamespaceObject):

(JSC::moduleLoaderPrototypeEvaluate):

* runtime/NativeErrorConstructor.cpp:

(JSC::NativeErrorConstructor::finishCreation):

* runtime/NumberConstructor.cpp:

(JSC::NumberConstructor::finishCreation):

* runtime/NumberObject.cpp:

(JSC::NumberObject::finishCreation):

* runtime/NumberPrototype.cpp:

(JSC::NumberPrototype::finishCreation):

* runtime/ObjectConstructor.cpp:

(JSC::ObjectConstructor::finishCreation):

* runtime/ObjectPrototype.cpp:

(JSC::ObjectPrototype::finishCreation):

* runtime/ProxyObject.cpp:

(JSC::ProxyObject::toStringName):

(JSC::ProxyObject::finishCreation):

* runtime/ReflectObject.cpp:

(JSC::ReflectObject::finishCreation):

(JSC::reflectObjectConstruct):

* runtime/RegExpConstructor.cpp:

(JSC::RegExpConstructor::finishCreation):

(JSC::setRegExpConstructorInput):

(JSC::setRegExpConstructorMultiline):

(JSC::constructRegExp):

* runtime/RegExpConstructor.h:

(JSC::asRegExpConstructor):

(JSC::isRegExp):

* runtime/RegExpObject.cpp:

(JSC::RegExpObject::finishCreation):

* runtime/RegExpObject.h:

(JSC::asRegExpObject):

* runtime/RegExpPrototype.cpp:

(JSC::RegExpPrototype::finishCreation):

(JSC::regExpProtoFuncTestFast):

(JSC::regExpProtoFuncExec):

(JSC::regExpProtoFuncMatchFast):

(JSC::regExpProtoFuncCompile):

(JSC::regExpProtoGetterGlobal):

(JSC::regExpProtoGetterIgnoreCase):

(JSC::regExpProtoGetterMultiline):

(JSC::regExpProtoGetterSticky):

(JSC::regExpProtoGetterUnicode):

(JSC::regExpProtoGetterSource):

* runtime/SamplingProfiler.cpp:

(JSC::SamplingProfiler::processUnverifiedStackTraces):

* runtime/ScriptExecutable.cpp:

(JSC::ScriptExecutable::newCodeBlockFor):

(JSC::ScriptExecutable::newReplacementCodeBlockFor):

* runtime/SetConstructor.cpp:

(JSC::SetConstructor::finishCreation):

* runtime/SetIteratorPrototype.cpp:

(JSC::SetIteratorPrototype::finishCreation):

(JSC::SetIteratorPrototypeFuncNext):

* runtime/SetPrototype.cpp:

(JSC::SetPrototype::finishCreation):

(JSC::setProtoFuncValues):

(JSC::setProtoFuncEntries):

(JSC::privateFuncSetIterator):

(JSC::privateFuncSetIteratorNext):

* runtime/StackFrame.cpp:

(JSC::StackFrame::sourceURL):

(JSC::StackFrame::functionName):

* runtime/StringIteratorPrototype.cpp:

(JSC::StringIteratorPrototype::finishCreation):

* runtime/StringObject.cpp:

(JSC::StringObject::finishCreation):

* runtime/StringObject.h:

(JSC::asStringObject):

* runtime/StringPrototype.cpp:

(JSC::StringPrototype::finishCreation):

(JSC::replace):

(JSC::stringProtoFuncReplaceUsingRegExp):

(JSC::stringProtoFuncToString):

* runtime/StructureRareData.cpp:

(JSC::StructureRareData::setObjectToStringValue):

* runtime/Symbol.cpp:

(JSC::Symbol::finishCreation):

* runtime/SymbolConstructor.cpp:

(JSC::SymbolConstructor::finishCreation):

* runtime/SymbolObject.cpp:

(JSC::SymbolObject::finishCreation):

* runtime/SymbolPrototype.cpp:

(JSC::SymbolPrototype::finishCreation):

(JSC::symbolProtoFuncToString):

(JSC::symbolProtoFuncValueOf):

* runtime/TestRunnerUtils.cpp:

(JSC::getExecutableForFunction):

* runtime/ThrowScope.cpp:

(JSC::ThrowScope::throwException):

* runtime/VM.cpp:

(JSC::VM::throwException):

* runtime/WeakMapConstructor.cpp:

(JSC::WeakMapConstructor::finishCreation):

* runtime/WeakMapPrototype.cpp:

(JSC::WeakMapPrototype::finishCreation):

(JSC::getWeakMapData):

* runtime/WeakSetConstructor.cpp:

(JSC::WeakSetConstructor::finishCreation):

* runtime/WeakSetPrototype.cpp:

(JSC::WeakSetPrototype::finishCreation):

(JSC::getWeakMapData):

* tools/JSDollarVMPrototype.cpp:

(JSC::codeBlockFromArg):

* wasm/JSWebAssembly.cpp:

(JSC::JSWebAssembly::finishCreation):

* wasm/js/JSWebAssemblyHelpers.h:

(JSC::getWasmBufferFromValue):

* wasm/js/JSWebAssemblyInstance.cpp:

(JSC::JSWebAssemblyInstance::finishCreation):

* wasm/js/JSWebAssemblyMemory.cpp:

(JSC::JSWebAssemblyMemory::grow):

(JSC::JSWebAssemblyMemory::finishCreation):

(JSC::JSWebAssemblyMemory::destroy):

(JSC::JSWebAssemblyMemory::~JSWebAssemblyMemory): Deleted.

* wasm/js/JSWebAssemblyMemory.h:

* wasm/js/JSWebAssemblyModule.cpp:

(JSC::JSWebAssemblyModule::finishCreation):

* wasm/js/JSWebAssemblyTable.cpp:

(JSC::JSWebAssemblyTable::finishCreation):

* wasm/js/WebAssemblyFunction.cpp:

(JSC::callWebAssemblyFunction):

(JSC::WebAssemblyFunction::finishCreation):

* wasm/js/WebAssemblyInstanceConstructor.cpp:

(JSC::constructJSWebAssemblyInstance):

* wasm/js/WebAssemblyMemoryPrototype.cpp:

(JSC::getMemory):

* wasm/js/WebAssemblyModulePrototype.cpp:

(JSC::webAssemblyModuleProtoCustomSections):

* wasm/js/WebAssemblyModuleRecord.cpp:

(JSC::WebAssemblyModuleRecord::finishCreation):

* wasm/js/WebAssemblyTablePrototype.cpp:

(JSC::getTable):

(JSC::webAssemblyTableProtoFuncSet):

Source/WebCore:

* Modules/fetch/FetchBody.cpp:

(WebCore::FetchBody::extract):

* Modules/plugins/QuickTimePluginReplacement.mm:

(WebCore::QuickTimePluginReplacement::installReplacement):

* bindings/js/IDBBindingUtilities.cpp:

(WebCore::createIDBKeyFromValue):

* bindings/js/JSCommandLineAPIHostCustom.cpp:

(WebCore::JSCommandLineAPIHost::getEventListeners):

(WebCore::JSCommandLineAPIHost::databaseId):

(WebCore::JSCommandLineAPIHost::storageId):

* bindings/js/JSCryptoAlgorithmDictionary.cpp:

(WebCore::JSCryptoAlgorithmDictionary::parseAlgorithmIdentifier):

(WebCore::createRsaKeyGenParams):

* bindings/js/JSCryptoCustom.cpp:

(WebCore::JSCrypto::getRandomValues):

* bindings/js/JSCryptoOperationData.cpp:

(WebCore::cryptoOperationDataFromJSValue):

* bindings/js/JSCustomElementInterface.cpp:

(WebCore::constructCustomElementSynchronously):

(WebCore::JSCustomElementInterface::upgradeElement):

* bindings/js/JSDOMBinding.cpp:

(WebCore::valueToDate):

(WebCore::reportException):

(WebCore::retrieveErrorMessage):

* bindings/js/JSDOMBinding.h:

(WebCore::castThisValue):

(WebCore::toPossiblySharedArrayBufferView):

(WebCore::toUnsharedArrayBufferView):

(WebCore::toPossiblySharedInt8Array):

(WebCore::toPossiblySharedInt16Array):

(WebCore::toPossiblySharedInt32Array):

(WebCore::toPossiblySharedUint8Array):

(WebCore::toPossiblySharedUint8ClampedArray):

(WebCore::toPossiblySharedUint16Array):

(WebCore::toPossiblySharedUint32Array):

(WebCore::toPossiblySharedFloat32Array):

(WebCore::toPossiblySharedFloat64Array):

(WebCore::toUnsharedInt8Array):

(WebCore::toUnsharedInt16Array):

(WebCore::toUnsharedInt32Array):

(WebCore::toUnsharedUint8Array):

(WebCore::toUnsharedUint8ClampedArray):

(WebCore::toUnsharedUint16Array):

(WebCore::toUnsharedUint32Array):

(WebCore::toUnsharedFloat32Array):

(WebCore::toUnsharedFloat64Array):

(WebCore::toRefNativeArray):

* bindings/js/JSDOMConstructor.h:

(WebCore::JSDOMConstructorNotConstructable&lt;JSClass&gt;::finishCreation):

(WebCore::JSDOMConstructor&lt;JSClass&gt;::finishCreation):

(WebCore::JSDOMNamedConstructor&lt;JSClass&gt;::finishCreation):

(WebCore::JSBuiltinConstructor&lt;JSClass&gt;::finishCreation):

* bindings/js/JSDOMConvert.h:

(WebCore::Converter&lt;IDLInterface&lt;T&gt;&gt;::convert):

(WebCore::Converter&lt;IDLXPathNSResolver&lt;T&gt;&gt;::convert):

* bindings/js/JSDOMGlobalObject.cpp:

(WebCore::JSDOMGlobalObject::finishCreation):

(WebCore::JSDOMGlobalObject::scriptExecutionContext):

* bindings/js/JSDOMIterator.h:

(WebCore::IteratorTraits&gt;::next):

(WebCore::IteratorTraits&gt;::finishCreation):

* bindings/js/JSDOMWindowBase.cpp:

(WebCore::JSDOMWindowBase::finishCreation):

(WebCore::toJSDOMWindow):

* bindings/js/JSDOMWindowBase.h:

* bindings/js/JSDOMWindowCustom.cpp:

(WebCore::jsDOMWindowWebKit):

(WebCore::JSDOMWindow::toWrapped):

* bindings/js/JSDOMWindowShell.cpp:

(WebCore::JSDOMWindowShell::finishCreation):

(WebCore::JSDOMWindowShell::toWrapped):

* bindings/js/JSDOMWindowShell.h:

* bindings/js/JSDocumentCustom.cpp:

(WebCore::cachedDocumentWrapper):

(WebCore::JSDocument::createTouchList):

* bindings/js/JSDynamicDowncast.h:

(WebCore::JSDynamicCastTrait::cast):

(WebCore::JSDynamicCastTrait&lt;JSNode&gt;::cast):

(WebCore::JSDynamicCastTrait&lt;JSElement&gt;::cast):

(WebCore::JSDynamicCastTrait&lt;JSDocument&gt;::cast):

(WebCore::JSDynamicCastTrait&lt;JSEvent&gt;::cast):

(WebCore::jsDynamicDowncast):

* bindings/js/JSEventListener.cpp:

(WebCore::JSEventListener::handleEvent):

* bindings/js/JSEventTargetCustom.cpp:

(WebCore::JSEventTarget::toWrapped):

(WebCore::jsEventTargetCast):

* bindings/js/JSEventTargetCustom.h:

(WebCore::BindingCaller&lt;JSEventTarget&gt;::callOperation):

* bindings/js/JSExceptionBase.cpp:

(WebCore::toExceptionBase):

* bindings/js/JSExceptionBase.h:

* bindings/js/JSInspectorFrontendHostCustom.cpp:

(WebCore::populateContextMenuItems):

(WebCore::JSInspectorFrontendHost::showContextMenu):

* bindings/js/JSNodeCustom.cpp:

(WebCore::JSNode::insertBefore):

(WebCore::JSNode::replaceChild):

(WebCore::JSNode::removeChild):

(WebCore::JSNode::appendChild):

(WebCore::JSNode::pushEventHandlerScope):

* bindings/js/JSPluginElementFunctions.cpp:

(WebCore::pluginElementPropertyGetter):

* bindings/js/JSReadableStreamPrivateConstructors.cpp:

(WebCore::constructJSReadableStreamDefaultReader):

* bindings/js/JSReadableStreamSourceCustom.cpp:

(WebCore::startReadableStream):

(WebCore::JSReadableStreamSource::start):

(WebCore::pullReadableStream):

* bindings/js/JSSubtleCryptoCustom.cpp:

(WebCore::toCryptoKey):

(WebCore::jsSubtleCryptoFunctionEncryptPromise):

(WebCore::jsSubtleCryptoFunctionDecryptPromise):

(WebCore::jsSubtleCryptoFunctionSignPromise):

(WebCore::jsSubtleCryptoFunctionVerifyPromise):

(WebCore::jsSubtleCryptoFunctionDigestPromise):

(WebCore::jsSubtleCryptoFunctionWrapKeyPromise):

(WebCore::jsSubtleCryptoFunctionUnwrapKeyPromise):

* bindings/js/JSTrackCustom.cpp:

(WebCore::toTrack): Deleted.

* bindings/js/JSTrackCustom.h:

* bindings/js/JSWebKitSubtleCryptoCustom.cpp:

(WebCore::JSWebKitSubtleCrypto::encrypt):

(WebCore::JSWebKitSubtleCrypto::decrypt):

(WebCore::JSWebKitSubtleCrypto::sign):

(WebCore::JSWebKitSubtleCrypto::verify):

(WebCore::JSWebKitSubtleCrypto::exportKey):

(WebCore::JSWebKitSubtleCrypto::wrapKey):

(WebCore::JSWebKitSubtleCrypto::unwrapKey):

* bindings/js/JSWorkerGlobalScopeBase.cpp:

(WebCore::JSWorkerGlobalScopeBase::finishCreation):

(WebCore::toJSDedicatedWorkerGlobalScope):

(WebCore::toJSWorkerGlobalScope):

* bindings/js/JSWorkerGlobalScopeBase.h:

* bindings/js/JSXMLHttpRequestCustom.cpp:

(WebCore::JSXMLHttpRequest::send):

* bindings/js/JSXPathNSResolverCustom.cpp:

(WebCore::JSXPathNSResolver::toWrapped):

* bindings/js/ScriptController.cpp:

(WebCore::ScriptController::setupModuleScriptHandlers):

* bindings/js/ScriptModuleLoader.cpp:

(WebCore::ScriptModuleLoader::fetch):

(WebCore::ScriptModuleLoader::evaluate):

* bindings/js/ScriptState.cpp:

(WebCore::domWindowFromExecState):

(WebCore::scriptExecutionContextFromExecState):

* bindings/js/SerializedScriptValue.cpp:

(WebCore::CloneSerializer::isArray):

(WebCore::CloneSerializer::isMap):

(WebCore::CloneSerializer::isSet):

(WebCore::CloneSerializer::dumpArrayBufferView):

(WebCore::CloneSerializer::dumpIfTerminal):

(WebCore::CloneSerializer::serialize):

(WebCore::CloneDeserializer::CloneDeserializer):

(WebCore::CloneDeserializer::readArrayBufferView):

(WebCore::CloneDeserializer::readTerminal):

(WebCore::transferArrayBuffers):

(WebCore::SerializedScriptValue::create):

* bindings/js/StructuredClone.cpp:

(WebCore::structuredCloneArrayBuffer):

(WebCore::structuredCloneArrayBufferView):

* bindings/js/WorkerScriptController.cpp:

(WebCore::WorkerScriptController::evaluate):

* bindings/scripts/CodeGeneratorJS.pm:

(GenerateHeader):

(GenerateOverloadedFunctionOrConstructor):

(GenerateImplementation):

* bindings/scripts/test/JS/JSInterfaceName.cpp:

(WebCore::JSInterfaceName::finishCreation):

(WebCore::jsInterfaceNameConstructor):

(WebCore::setJSInterfaceNameConstructor):

(WebCore::JSInterfaceName::toWrapped):

* bindings/scripts/test/JS/JSInterfaceName.h:

* bindings/scripts/test/JS/JSTestActiveDOMObject.cpp:

(WebCore::JSTestActiveDOMObject::finishCreation):

(WebCore::BindingCaller&lt;JSTestActiveDOMObject&gt;::castForAttribute):

(WebCore::BindingCaller&lt;JSTestActiveDOMObject&gt;::castForOperation):

(WebCore::jsTestActiveDOMObjectConstructor):

(WebCore::setJSTestActiveDOMObjectConstructor):

(WebCore::JSTestActiveDOMObject::toWrapped):

* bindings/scripts/test/JS/JSTestActiveDOMObject.h:

* bindings/scripts/test/JS/JSTestCEReactions.cpp:

(WebCore::JSTestCEReactions::finishCreation):

(WebCore::BindingCaller&lt;JSTestCEReactions&gt;::castForAttribute):

(WebCore::BindingCaller&lt;JSTestCEReactions&gt;::castForOperation):

(WebCore::jsTestCEReactionsConstructor):

(WebCore::setJSTestCEReactionsConstructor):

(WebCore::JSTestCEReactions::toWrapped):

* bindings/scripts/test/JS/JSTestCEReactions.h:

* bindings/scripts/test/JS/JSTestCEReactionsStringifier.cpp:

(WebCore::JSTestCEReactionsStringifier::finishCreation):

(WebCore::BindingCaller&lt;JSTestCEReactionsStringifier&gt;::castForAttribute):

(WebCore::BindingCaller&lt;JSTestCEReactionsStringifier&gt;::castForOperation):

(WebCore::jsTestCEReactionsStringifierConstructor):

(WebCore::setJSTestCEReactionsStringifierConstructor):

(WebCore::JSTestCEReactionsStringifier::toWrapped):

* bindings/scripts/test/JS/JSTestCEReactionsStringifier.h:

* bindings/scripts/test/JS/JSTestClassWithJSBuiltinConstructor.cpp:

(WebCore::JSTestClassWithJSBuiltinConstructor::finishCreation):

(WebCore::jsTestClassWithJSBuiltinConstructorConstructor):

(WebCore::setJSTestClassWithJSBuiltinConstructorConstructor):

(WebCore::JSTestClassWithJSBuiltinConstructor::toWrapped):

* bindings/scripts/test/JS/JSTestClassWithJSBuiltinConstructor.h:

* bindings/scripts/test/JS/JSTestCustomConstructorWithNoInterfaceObject.cpp:

(WebCore::JSTestCustomConstructorWithNoInterfaceObject::finishCreation):

(WebCore::jsTestCustomConstructorWithNoInterfaceObjectConstructor):

(WebCore::setJSTestCustomConstructorWithNoInterfaceObjectConstructor):

(WebCore::JSTestCustomConstructorWithNoInterfaceObject::toWrapped):

* bindings/scripts/test/JS/JSTestCustomConstructorWithNoInterfaceObject.h:

* bindings/scripts/test/JS/JSTestCustomNamedGetter.cpp:

(WebCore::JSTestCustomNamedGetter::finishCreation):

(WebCore::BindingCaller&lt;JSTestCustomNamedGetter&gt;::castForOperation):

(WebCore::jsTestCustomNamedGetterConstructor):

(WebCore::setJSTestCustomNamedGetterConstructor):

(WebCore::JSTestCustomNamedGetter::toWrapped):

* bindings/scripts/test/JS/JSTestCustomNamedGetter.h:

* bindings/scripts/test/JS/JSTestDOMJIT.cpp:

(WebCore::JSTestDOMJIT::finishCreation):

(WebCore::BindingCaller&lt;JSTestDOMJIT&gt;::castForAttribute):

(WebCore::BindingCaller&lt;JSTestDOMJIT&gt;::castForOperation):

(WebCore::jsTestDOMJITConstructor):

(WebCore::setJSTestDOMJITConstructor):

* bindings/scripts/test/JS/JSTestEventConstructor.cpp:

(WebCore::JSTestEventConstructor::finishCreation):

(WebCore::BindingCaller&lt;JSTestEventConstructor&gt;::castForAttribute):

(WebCore::jsTestEventConstructorConstructor):

(WebCore::setJSTestEventConstructorConstructor):

* bindings/scripts/test/JS/JSTestEventTarget.cpp:

(WebCore::JSTestEventTarget::finishCreation):

(WebCore::BindingCaller&lt;JSTestEventTarget&gt;::castForOperation):

(WebCore::jsTestEventTargetConstructor):

(WebCore::setJSTestEventTargetConstructor):

(WebCore::JSTestEventTarget::toWrapped):

* bindings/scripts/test/JS/JSTestEventTarget.h:

* bindings/scripts/test/JS/JSTestException.cpp:

(WebCore::JSTestException::finishCreation):

(WebCore::BindingCaller&lt;JSTestException&gt;::castForAttribute):

(WebCore::jsTestExceptionConstructor):

(WebCore::setJSTestExceptionConstructor):

(WebCore::JSTestException::toWrapped):

* bindings/scripts/test/JS/JSTestException.h:

* bindings/scripts/test/JS/JSTestGenerateIsReachable.cpp:

(WebCore::JSTestGenerateIsReachable::finishCreation):

(WebCore::jsTestGenerateIsReachableConstructor):

(WebCore::setJSTestGenerateIsReachableConstructor):

(WebCore::JSTestGenerateIsReachable::toWrapped):

* bindings/scripts/test/JS/JSTestGenerateIsReachable.h:

* bindings/scripts/test/JS/JSTestGlobalObject.cpp:

(WebCore::JSTestGlobalObject::finishCreation):

(WebCore::BindingCaller&lt;JSTestGlobalObject&gt;::castForAttribute):

(WebCore::BindingCaller&lt;JSTestGlobalObject&gt;::castForOperation):

(WebCore::jsTestGlobalObjectConstructor):

(WebCore::setJSTestGlobalObjectConstructor):

(WebCore::JSTestGlobalObject::toWrapped):

* bindings/scripts/test/JS/JSTestGlobalObject.h:

* bindings/scripts/test/JS/JSTestInterface.cpp:

(WebCore::JSTestInterface::finishCreation):

(WebCore::BindingCaller&lt;JSTestInterface&gt;::castForAttribute):

(WebCore::BindingCaller&lt;JSTestInterface&gt;::castForOperation):

(WebCore::jsTestInterfaceConstructor):

(WebCore::setJSTestInterfaceConstructor):

(WebCore::JSTestInterface::toWrapped):

* bindings/scripts/test/JS/JSTestInterface.h:

* bindings/scripts/test/JS/JSTestInterfaceLeadingUnderscore.cpp:

(WebCore::JSTestInterfaceLeadingUnderscore::finishCreation):

(WebCore::BindingCaller&lt;JSTestInterfaceLeadingUnderscore&gt;::castForAttribute):

(WebCore::jsTestInterfaceLeadingUnderscoreConstructor):

(WebCore::setJSTestInterfaceLeadingUnderscoreConstructor):

(WebCore::JSTestInterfaceLeadingUnderscore::toWrapped):

* bindings/scripts/test/JS/JSTestInterfaceLeadingUnderscore.h:

* bindings/scripts/test/JS/JSTestIterable.cpp:

(WebCore::JSTestIterable::finishCreation):

(WebCore::BindingCaller&lt;JSTestIterable&gt;::castForOperation):

(WebCore::jsTestIterableConstructor):

(WebCore::setJSTestIterableConstructor):

(WebCore::JSTestIterable::toWrapped):

* bindings/scripts/test/JS/JSTestIterable.h:

* bindings/scripts/test/JS/JSTestJSBuiltinConstructor.cpp:

(WebCore::JSTestJSBuiltinConstructor::finishCreation):

(WebCore::BindingCaller&lt;JSTestJSBuiltinConstructor&gt;::castForAttribute):

(WebCore::BindingCaller&lt;JSTestJSBuiltinConstructor&gt;::castForOperation):

(WebCore::jsTestJSBuiltinConstructorConstructor):

(WebCore::setJSTestJSBuiltinConstructorConstructor):

* bindings/scripts/test/JS/JSTestMediaQueryListListener.cpp:

(WebCore::JSTestMediaQueryListListener::finishCreation):

(WebCore::BindingCaller&lt;JSTestMediaQueryListListener&gt;::castForOperation):

(WebCore::jsTestMediaQueryListListenerConstructor):

(WebCore::setJSTestMediaQueryListListenerConstructor):

(WebCore::JSTestMediaQueryListListener::toWrapped):

* bindings/scripts/test/JS/JSTestMediaQueryListListener.h:

* bindings/scripts/test/JS/JSTestNamedConstructor.cpp:

(WebCore::JSTestNamedConstructor::finishCreation):

(WebCore::jsTestNamedConstructorConstructor):

(WebCore::setJSTestNamedConstructorConstructor):

(WebCore::JSTestNamedConstructor::toWrapped):

* bindings/scripts/test/JS/JSTestNamedConstructor.h:

* bindings/scripts/test/JS/JSTestNode.cpp:

(WebCore::JSTestNode::finishCreation):

(WebCore::BindingCaller&lt;JSTestNode&gt;::castForAttribute):

(WebCore::BindingCaller&lt;JSTestNode&gt;::castForOperation):

(WebCore::jsTestNodeConstructor):

(WebCore::setJSTestNodeConstructor):

* bindings/scripts/test/JS/JSTestObj.cpp:

(WebCore::JSTestObj::finishCreation):

(WebCore::BindingCaller&lt;JSTestObj&gt;::castForAttribute):

(WebCore::BindingCaller&lt;JSTestObj&gt;::castForOperation):

(WebCore::jsTestObjConstructor):

(WebCore::setJSTestObjConstructor):

(WebCore::jsTestObjPrototypeFunctionOverloadedMethod):

(WebCore::jsTestObjPrototypeFunctionOverloadedMethodWithOptionalParameter):

(WebCore::jsTestObjPrototypeFunctionOverloadedMethodWithDistinguishingUnion):

(WebCore::jsTestObjPrototypeFunctionOverloadedMethodWith2DistinguishingUnions):

(WebCore::jsTestObjPrototypeFunctionOverloadedMethodWithNonDistinguishingUnion):

(WebCore::jsTestObjPrototypeFunctionOverloadWithNullableUnion):

(WebCore::jsTestObjPrototypeFunctionOverloadWithNullableNonDistinguishingParameter):

(WebCore::jsTestObjPrototypeFunctionTestPromiseOverloadedFunction):

(WebCore::JSTestObj::toWrapped):

* bindings/scripts/test/JS/JSTestObj.h:

* bindings/scripts/test/JS/JSTestOverloadedConstructors.cpp:

(WebCore::JSTestOverloadedConstructorsConstructor::construct):

(WebCore::JSTestOverloadedConstructors::finishCreation):

(WebCore::jsTestOverloadedConstructorsConstructor):

(WebCore::setJSTestOverloadedConstructorsConstructor):

(WebCore::JSTestOverloadedConstructors::toWrapped):

* bindings/scripts/test/JS/JSTestOverloadedConstructors.h:

* bindings/scripts/test/JS/JSTestOverloadedConstructorsWithSequence.cpp:

(WebCore::JSTestOverloadedConstructorsWithSequence::finishCreation):

(WebCore::jsTestOverloadedConstructorsWithSequenceConstructor):

(WebCore::setJSTestOverloadedConstructorsWithSequenceConstructor):

(WebCore::JSTestOverloadedConstructorsWithSequence::toWrapped):

* bindings/scripts/test/JS/JSTestOverloadedConstructorsWithSequence.h:

* bindings/scripts/test/JS/JSTestOverrideBuiltins.cpp:

(WebCore::JSTestOverrideBuiltins::finishCreation):

(WebCore::BindingCaller&lt;JSTestOverrideBuiltins&gt;::castForOperation):

(WebCore::jsTestOverrideBuiltinsConstructor):

(WebCore::setJSTestOverrideBuiltinsConstructor):

(WebCore::JSTestOverrideBuiltins::toWrapped):

* bindings/scripts/test/JS/JSTestOverrideBuiltins.h:

* bindings/scripts/test/JS/JSTestSerialization.cpp:

(WebCore::JSTestSerialization::finishCreation):

(WebCore::BindingCaller&lt;JSTestSerialization&gt;::castForAttribute):

(WebCore::BindingCaller&lt;JSTestSerialization&gt;::castForOperation):

(WebCore::jsTestSerializationConstructor):

(WebCore::setJSTestSerializationConstructor):

(WebCore::JSTestSerialization::toWrapped):

* bindings/scripts/test/JS/JSTestSerialization.h:

* bindings/scripts/test/JS/JSTestSerializedScriptValueInterface.cpp:

(WebCore::JSTestSerializedScriptValueInterface::finishCreation):

(WebCore::BindingCaller&lt;JSTestSerializedScriptValueInterface&gt;::castForAttribute):

(WebCore::BindingCaller&lt;JSTestSerializedScriptValueInterface&gt;::castForOperation):

(WebCore::jsTestSerializedScriptValueInterfaceConstructor):

(WebCore::setJSTestSerializedScriptValueInterfaceConstructor):

(WebCore::JSTestSerializedScriptValueInterface::toWrapped):

* bindings/scripts/test/JS/JSTestSerializedScriptValueInterface.h:

* bindings/scripts/test/JS/JSTestTypedefs.cpp:

(WebCore::JSTestTypedefs::finishCreation):

(WebCore::BindingCaller&lt;JSTestTypedefs&gt;::castForAttribute):

(WebCore::BindingCaller&lt;JSTestTypedefs&gt;::castForOperation):

(WebCore::jsTestTypedefsConstructor):

(WebCore::setJSTestTypedefsConstructor):

(WebCore::JSTestTypedefs::toWrapped):

* bindings/scripts/test/JS/JSTestTypedefs.h:

* bridge/c/CRuntimeObject.cpp:

(JSC::Bindings::CRuntimeObject::finishCreation):

* bridge/c/c_instance.cpp:

(JSC::Bindings::CRuntimeMethod::finishCreation):

(JSC::Bindings::CInstance::invokeMethod):

* bridge/c/c_utility.cpp:

(JSC::Bindings::convertValueToNPVariant):

* bridge/objc/ObjCRuntimeObject.mm:

(JSC::Bindings::ObjCRuntimeObject::finishCreation):

* bridge/objc/WebScriptObject.mm:

(-[WebScriptObject setValue:forKey:]):

(+[WebScriptObject _convertValueToObjcValue:originRootObject:rootObject:]):

* bridge/objc/objc_instance.mm:

(ObjCRuntimeMethod::finishCreation):

(ObjcInstance::invokeMethod):

* bridge/objc/objc_runtime.mm:

(JSC::Bindings::ObjcFallbackObjectImp::finishCreation):

(JSC::Bindings::callObjCFallbackObject):

* bridge/runtime_array.cpp:

(JSC::RuntimeArray::finishCreation):

(JSC::RuntimeArray::lengthGetter):

* bridge/runtime_method.cpp:

(JSC::RuntimeMethod::finishCreation):

(JSC::RuntimeMethod::lengthGetter):

(JSC::callRuntimeMethod):

* bridge/runtime_object.cpp:

(JSC::Bindings::RuntimeObject::finishCreation):

(JSC::Bindings::callRuntimeObject):

(JSC::Bindings::callRuntimeConstructor):

* css/FontFace.cpp:

(WebCore::FontFace::create):

* html/HTMLMediaElement.cpp:

(WebCore::controllerJSValue):

(WebCore::HTMLMediaElement::updateCaptionContainer):

(WebCore::HTMLMediaElement::didAddUserAgentShadowRoot):

* inspector/InspectorController.cpp:

(WebCore::InspectorController::canAccessInspectedScriptState):

* inspector/InspectorDOMAgent.cpp:

(WebCore::InspectorDOMAgent::buildObjectForEventListener):

(WebCore::InspectorDOMAgent::scriptValueAsNode):

* inspector/WebInjectedScriptHost.cpp:

(WebCore::WebInjectedScriptHost::subtype):

(WebCore::WebInjectedScriptHost::isHTMLAllCollection):

* inspector/WebInjectedScriptHost.h:

Source/WebKit/mac:

* DOM/DOM.mm:

(+[DOMNode _nodeFromJSWrapper:]):

* DOM/DOMUtility.mm:

(createDOMWrapper):

* DOM/WebDOMOperations.mm:

* Plugins/Hosted/NetscapePluginInstanceProxy.mm:

(WebKit::getObjectID):

(WebKit::NetscapePluginInstanceProxy::retainLocalObject):

(WebKit::NetscapePluginInstanceProxy::releaseLocalObject):

* Plugins/Hosted/ProxyInstance.mm:

(WebKit::ProxyRuntimeMethod::finishCreation):

(WebKit::ProxyInstance::invokeMethod):

* Plugins/Hosted/ProxyRuntimeObject.mm:

(WebKit::ProxyRuntimeObject::finishCreation):

* WebView/WebFrame.mm:

(-[WebFrame _stringByEvaluatingJavaScriptFromString:withGlobalObject:inScriptWorld:]):

* WebView/WebView.mm:

(+[WebView _reportException:inContext:]):

(aeDescFromJSValue):

(-[WebView _notificationIDForTesting:]):

Source/WebKit/win:

* WebFrame.cpp:

(WebFrame::stringByEvaluatingJavaScriptInScriptWorld):

* WebView.cpp:

(WebView::elementFromJS):

Source/WebKit2:

* WebProcess/Automation/WebAutomationSessionProxy.cpp:

(WebKit::WebAutomationSessionProxy::elementForNodeHandle):

* WebProcess/InjectedBundle/DOM/InjectedBundleNodeHandle.cpp:

(WebKit::InjectedBundleNodeHandle::getOrCreate):

* WebProcess/InjectedBundle/DOM/InjectedBundleRangeHandle.cpp:

(WebKit::InjectedBundleRangeHandle::getOrCreate):

* WebProcess/InjectedBundle/InjectedBundle.cpp:

(WebKit::InjectedBundle::reportException):

(WebKit::InjectedBundle::webNotificationID):

(WebKit::InjectedBundle::createWebDataFromUint8Array):

* WebProcess/Plugins/Netscape/JSNPMethod.cpp:

(WebKit::JSNPMethod::finishCreation):

(WebKit::callMethod):

* WebProcess/Plugins/Netscape/JSNPObject.cpp:

(WebKit::JSNPObject::finishCreation):

(WebKit::callNPJSObject):

(WebKit::constructWithConstructor):

* WebProcess/Plugins/Netscape/NPJSObject.cpp:

(WebKit::NPJSObject::create):

* WebProcess/Plugins/Netscape/NPRuntimeObjectMap.cpp:

(WebKit::NPRuntimeObjectMap::getOrCreateNPObject):

* WebProcess/WebPage/WebFrame.cpp:

(WebKit::WebFrame::frameForContext):

(WebKit::WebFrame::counterValue):

Tools:

* DumpRenderTree/TestRunner.cpp:

(setAudioResultCallback):</pre>

<h3>Modified Paths</h3>

<ul>

<li><a href="#trunkSourceJavaScriptCoreAPIJSCallbackConstructorcpp">trunk/Source/JavaScriptCore/API/JSCallbackConstructor.cpp</a></li>

<li><a href="#trunkSourceJavaScriptCoreAPIJSCallbackFunctioncpp">trunk/Source/JavaScriptCore/API/JSCallbackFunction.cpp</a></li>

<li><a href="#trunkSourceJavaScriptCoreAPIJSCallbackObjectFunctionsh">trunk/Source/JavaScriptCore/API/JSCallbackObjectFunctions.h</a></li>

<li><a href="#trunkSourceJavaScriptCoreAPIJSObjectRefcpp">trunk/Source/JavaScriptCore/API/JSObjectRef.cpp</a></li>

<li><a href="#trunkSourceJavaScriptCoreAPIJSTypedArraycpp">trunk/Source/JavaScriptCore/API/JSTypedArray.cpp</a></li>

<li><a href="#trunkSourceJavaScriptCoreAPIJSValuemm">trunk/Source/JavaScriptCore/API/JSValue.mm</a></li>

<li><a href="#trunkSourceJavaScriptCoreAPIJSValueRefcpp">trunk/Source/JavaScriptCore/API/JSValueRef.cpp</a></li>

<li><a href="#trunkSourceJavaScriptCoreAPIJSWeakObjectMapRefPrivatecpp">trunk/Source/JavaScriptCore/API/JSWeakObjectMapRefPrivate.cpp</a></li>

<li><a href="#trunkSourceJavaScriptCoreAPIJSWrapperMapmm">trunk/Source/JavaScriptCore/API/JSWrapperMap.mm</a></li>

<li><a href="#trunkSourceJavaScriptCoreAPIObjCCallbackFunctionh">trunk/Source/JavaScriptCore/API/ObjCCallbackFunction.h</a></li>

<li><a href="#trunkSourceJavaScriptCoreAPIObjCCallbackFunctionmm">trunk/Source/JavaScriptCore/API/ObjCCallbackFunction.mm</a></li>

<li><a href="#trunkSourceJavaScriptCoreChangeLog">trunk/Source/JavaScriptCore/ChangeLog</a></li>

<li><a href="#trunkSourceJavaScriptCorebindingsScriptFunctionCallcpp">trunk/Source/JavaScriptCore/bindings/ScriptFunctionCall.cpp</a></li>

<li><a href="#trunkSourceJavaScriptCorebytecodeCallVarianth">trunk/Source/JavaScriptCore/bytecode/CallVariant.h</a></li>

<li><a href="#trunkSourceJavaScriptCorebytecodeCodeBlockcpp">trunk/Source/JavaScriptCore/bytecode/CodeBlock.cpp</a></li>

<li><a href="#trunkSourceJavaScriptCorebytecodeObjectAllocationProfileh">trunk/Source/JavaScriptCore/bytecode/ObjectAllocationProfile.h</a></li>

<li><a href="#trunkSourceJavaScriptCorebytecodeObjectPropertyConditioncpp">trunk/Source/JavaScriptCore/bytecode/ObjectPropertyCondition.cpp</a></li>

<li><a href="#trunkSourceJavaScriptCorebytecodeObjectPropertyConditionh">trunk/Source/JavaScriptCore/bytecode/ObjectPropertyCondition.h</a></li>

<li><a href="#trunkSourceJavaScriptCorebytecodePropertyConditioncpp">trunk/Source/JavaScriptCore/bytecode/PropertyCondition.cpp</a></li>

<li><a href="#trunkSourceJavaScriptCorebytecodePropertyConditionh">trunk/Source/JavaScriptCore/bytecode/PropertyCondition.h</a></li>

<li><a href="#trunkSourceJavaScriptCorebytecodeSpeculatedTypecpp">trunk/Source/JavaScriptCore/bytecode/SpeculatedType.cpp</a></li>

<li><a href="#trunkSourceJavaScriptCoredebuggerDebuggercpp">trunk/Source/JavaScriptCore/debugger/Debugger.cpp</a></li>

<li><a href="#trunkSourceJavaScriptCoredebuggerDebuggerCallFramecpp">trunk/Source/JavaScriptCore/debugger/DebuggerCallFrame.cpp</a></li>

<li><a href="#trunkSourceJavaScriptCoredebuggerDebuggerScopecpp">trunk/Source/JavaScriptCore/debugger/DebuggerScope.cpp</a></li>

<li><a href="#trunkSourceJavaScriptCoredfgDFGAbstractInterpreterh">trunk/Source/JavaScriptCore/dfg/DFGAbstractInterpreter.h</a></li>

<li><a href="#trunkSourceJavaScriptCoredfgDFGAbstractInterpreterInlinesh">trunk/Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h</a></li>

<li><a href="#trunkSourceJavaScriptCoredfgDFGByteCodeParsercpp">trunk/Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp</a></li>

<li><a href="#trunkSourceJavaScriptCoredfgDFGConstantFoldingPhasecpp">trunk/Source/JavaScriptCore/dfg/DFGConstantFoldingPhase.cpp</a></li>

<li><a href="#trunkSourceJavaScriptCoredfgDFGDesiredWeakReferencescpp">trunk/Source/JavaScriptCore/dfg/DFGDesiredWeakReferences.cpp</a></li>

<li><a href="#trunkSourceJavaScriptCoredfgDFGFixupPhasecpp">trunk/Source/JavaScriptCore/dfg/DFGFixupPhase.cpp</a></li>

<li><a href="#trunkSourceJavaScriptCoredfgDFGFrozenValueh">trunk/Source/JavaScriptCore/dfg/DFGFrozenValue.h</a></li>

<li><a href="#trunkSourceJavaScriptCoredfgDFGGraphcpp">trunk/Source/JavaScriptCore/dfg/DFGGraph.cpp</a></li>

<li><a href="#trunkSourceJavaScriptCoredfgDFGLazyJSValuecpp">trunk/Source/JavaScriptCore/dfg/DFGLazyJSValue.cpp</a></li>

<li><a href="#trunkSourceJavaScriptCoredfgDFGLazyJSValueh">trunk/Source/JavaScriptCore/dfg/DFGLazyJSValue.h</a></li>

<li><a href="#trunkSourceJavaScriptCoredfgDFGNodecpp">trunk/Source/JavaScriptCore/dfg/DFGNode.cpp</a></li>

<li><a href="#trunkSourceJavaScriptCoredfgDFGNodeh">trunk/Source/JavaScriptCore/dfg/DFGNode.h</a></li>

<li><a href="#trunkSourceJavaScriptCoredfgDFGOperationscpp">trunk/Source/JavaScriptCore/dfg/DFGOperations.cpp</a></li>

<li><a href="#trunkSourceJavaScriptCoredfgDFGSafeToExecuteh">trunk/Source/JavaScriptCore/dfg/DFGSafeToExecute.h</a></li>

<li><a href="#trunkSourceJavaScriptCoredfgDFGSpeculativeJITcpp">trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp</a></li>

<li><a href="#trunkSourceJavaScriptCoredfgDFGSpeculativeJITh">trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h</a></li>

<li><a href="#trunkSourceJavaScriptCoredfgDFGSpeculativeJIT32_64cpp">trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp</a></li>

<li><a href="#trunkSourceJavaScriptCoredfgDFGSpeculativeJIT64cpp">trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp</a></li>

<li><a href="#trunkSourceJavaScriptCoredfgDFGStrengthReductionPhasecpp">trunk/Source/JavaScriptCore/dfg/DFGStrengthReductionPhase.cpp</a></li>

<li><a href="#trunkSourceJavaScriptCoreftlFTLLowerDFGToB3cpp">trunk/Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp</a></li>

<li><a href="#trunkSourceJavaScriptCoreftlFTLOperationscpp">trunk/Source/JavaScriptCore/ftl/FTLOperations.cpp</a></li>

<li><a href="#trunkSourceJavaScriptCoreheapCodeBlockSetcpp">trunk/Source/JavaScriptCore/heap/CodeBlockSet.cpp</a></li>

<li><a href="#trunkSourceJavaScriptCoreheapCodeBlockSeth">trunk/Source/JavaScriptCore/heap/CodeBlockSet.h</a></li>

<li><a href="#trunkSourceJavaScriptCoreheapGCAssertionsh">trunk/Source/JavaScriptCore/heap/GCAssertions.h</a></li>

<li><a href="#trunkSourceJavaScriptCoreheapHeapcpp">trunk/Source/JavaScriptCore/heap/Heap.cpp</a></li>

<li><a href="#trunkSourceJavaScriptCoreheapHeapSnapshotBuildercpp">trunk/Source/JavaScriptCore/heap/HeapSnapshotBuilder.cpp</a></li>

<li><a href="#trunkSourceJavaScriptCoreheapSlotVisitorcpp">trunk/Source/JavaScriptCore/heap/SlotVisitor.cpp</a></li>

<li><a href="#trunkSourceJavaScriptCoreinspectorInjectedScriptHosth">trunk/Source/JavaScriptCore/inspector/InjectedScriptHost.h</a></li>

<li><a href="#trunkSourceJavaScriptCoreinspectorJSGlobalObjectInspectorControllercpp">trunk/Source/JavaScriptCore/inspector/JSGlobalObjectInspectorController.cpp</a></li>

<li><a href="#trunkSourceJavaScriptCoreinspectorJSInjectedScriptHostcpp">trunk/Source/JavaScriptCore/inspector/JSInjectedScriptHost.cpp</a></li>

<li><a href="#trunkSourceJavaScriptCoreinspectorJSInjectedScriptHostPrototypecpp">trunk/Source/JavaScriptCore/inspector/JSInjectedScriptHostPrototype.cpp</a></li>

<li><a href="#trunkSourceJavaScriptCoreinspectorJSJavaScriptCallFramecpp">trunk/Source/JavaScriptCore/inspector/JSJavaScriptCallFrame.cpp</a></li>

<li><a href="#trunkSourceJavaScriptCoreinspectorJSJavaScriptCallFrameh">trunk/Source/JavaScriptCore/inspector/JSJavaScriptCallFrame.h</a></li>

<li><a href="#trunkSourceJavaScriptCoreinspectorJSJavaScriptCallFramePrototypecpp">trunk/Source/JavaScriptCore/inspector/JSJavaScriptCallFramePrototype.cpp</a></li>

<li><a href="#trunkSourceJavaScriptCoreinspectorScriptArgumentscpp">trunk/Source/JavaScriptCore/inspector/ScriptArguments.cpp</a></li>

<li><a href="#trunkSourceJavaScriptCoreinspectoragentsInspectorHeapAgentcpp">trunk/Source/JavaScriptCore/inspector/agents/InspectorHeapAgent.cpp</a></li>

<li><a href="#trunkSourceJavaScriptCoreinterpreterInterpretercpp">trunk/Source/JavaScriptCore/interpreter/Interpreter.cpp</a></li>

<li><a href="#trunkSourceJavaScriptCoreinterpreterShadowChickencpp">trunk/Source/JavaScriptCore/interpreter/ShadowChicken.cpp</a></li>

<li><a href="#trunkSourceJavaScriptCoreinterpreterStackVisitorcpp">trunk/Source/JavaScriptCore/interpreter/StackVisitor.cpp</a></li>

<li><a href="#trunkSourceJavaScriptCorejitJITCodecpp">trunk/Source/JavaScriptCore/jit/JITCode.cpp</a></li>

<li><a href="#trunkSourceJavaScriptCorejitJITOperationscpp">trunk/Source/JavaScriptCore/jit/JITOperations.cpp</a></li>

<li><a href="#trunkSourceJavaScriptCorejitRepatchcpp">trunk/Source/JavaScriptCore/jit/Repatch.cpp</a></li>

<li><a href="#trunkSourceJavaScriptCorejsccpp">trunk/Source/JavaScriptCore/jsc.cpp</a></li>

<li><a href="#trunkSourceJavaScriptCorellintLLIntSlowPathscpp">trunk/Source/JavaScriptCore/llint/LLIntSlowPaths.cpp</a></li>

<li><a href="#trunkSourceJavaScriptCoreruntimeAbstractModuleRecordcpp">trunk/Source/JavaScriptCore/runtime/AbstractModuleRecord.cpp</a></li>

<li><a href="#trunkSourceJavaScriptCoreruntimeArrayBuffercpp">trunk/Source/JavaScriptCore/runtime/ArrayBuffer.cpp</a></li>

<li><a href="#trunkSourceJavaScriptCoreruntimeArrayBufferh">trunk/Source/JavaScriptCore/runtime/ArrayBuffer.h</a></li>

<li><a href="#trunkSourceJavaScriptCoreruntimeArrayConstructorcpp">trunk/Source/JavaScriptCore/runtime/ArrayConstructor.cpp</a></li>

<li><a href="#trunkSourceJavaScriptCoreruntimeArrayConstructorh">trunk/Source/JavaScriptCore/runtime/ArrayConstructor.h</a></li>

<li><a href="#trunkSourceJavaScriptCoreruntimeArrayIteratorPrototypecpp">trunk/Source/JavaScriptCore/runtime/ArrayIteratorPrototype.cpp</a></li>

<li><a href="#trunkSourceJavaScriptCoreruntimeArrayPrototypecpp">trunk/Source/JavaScriptCore/runtime/ArrayPrototype.cpp</a></li>

<li><a href="#trunkSourceJavaScriptCoreruntimeAsyncFunctionPrototypecpp">trunk/Source/JavaScriptCore/runtime/AsyncFunctionPrototype.cpp</a></li>

<li><a href="#trunkSourceJavaScriptCoreruntimeAtomicsObjectcpp">trunk/Source/JavaScriptCore/runtime/AtomicsObject.cpp</a></li>

<li><a href="#trunkSourceJavaScriptCoreruntimeBooleanObjectcpp">trunk/Source/JavaScriptCore/runtime/BooleanObject.cpp</a></li>

<li><a href="#trunkSourceJavaScriptCoreruntimeBooleanObjecth">trunk/Source/JavaScriptCore/runtime/BooleanObject.h</a></li>

<li><a href="#trunkSourceJavaScriptCoreruntimeBooleanPrototypecpp">trunk/Source/JavaScriptCore/runtime/BooleanPrototype.cpp</a></li>

<li><a href="#trunkSourceJavaScriptCoreruntimeConsoleObjectcpp">trunk/Source/JavaScriptCore/runtime/ConsoleObject.cpp</a></li>

<li><a href="#trunkSourceJavaScriptCoreruntimeDateConstructorcpp">trunk/Source/JavaScriptCore/runtime/DateConstructor.cpp</a></li>

<li><a href="#trunkSourceJavaScriptCoreruntimeDateInstancecpp">trunk/Source/JavaScriptCore/runtime/DateInstance.cpp</a></li>

<li><a href="#trunkSourceJavaScriptCoreruntimeDateInstanceh">trunk/Source/JavaScriptCore/runtime/DateInstance.h</a></li>

<li><a href="#trunkSourceJavaScriptCoreruntimeDatePrototypecpp">trunk/Source/JavaScriptCore/runtime/DatePrototype.cpp</a></li>

<li><a href="#trunkSourceJavaScriptCoreruntimeErrorInstancecpp">trunk/Source/JavaScriptCore/runtime/ErrorInstance.cpp</a></li>

<li><a href="#trunkSourceJavaScriptCoreruntimeErrorPrototypecpp">trunk/Source/JavaScriptCore/runtime/ErrorPrototype.cpp</a></li>

<li><a href="#trunkSourceJavaScriptCoreruntimeExceptionHelperscpp">trunk/Source/JavaScriptCore/runtime/ExceptionHelpers.cpp</a></li>

<li><a href="#trunkSourceJavaScriptCoreruntimeExceptionHelpersh">trunk/Source/JavaScriptCore/runtime/ExceptionHelpers.h</a></li>

<li><a href="#trunkSourceJavaScriptCoreruntimeExecutableBasecpp">trunk/Source/JavaScriptCore/runtime/ExecutableBase.cpp</a></li>

<li><a href="#trunkSourceJavaScriptCoreruntimeFunctionPrototypecpp">trunk/Source/JavaScriptCore/runtime/FunctionPrototype.cpp</a></li>

<li><a href="#trunkSourceJavaScriptCoreruntimeGeneratorFunctionPrototypecpp">trunk/Source/JavaScriptCore/runtime/GeneratorFunctionPrototype.cpp</a></li>

<li><a href="#trunkSourceJavaScriptCoreruntimeGeneratorPrototypecpp">trunk/Source/JavaScriptCore/runtime/GeneratorPrototype.cpp</a></li>

<li><a href="#trunkSourceJavaScriptCoreruntimeGetterSetterh">trunk/Source/JavaScriptCore/runtime/GetterSetter.h</a></li>

<li><a href="#trunkSourceJavaScriptCoreruntimeInspectorInstrumentationObjectcpp">trunk/Source/JavaScriptCore/runtime/InspectorInstrumentationObject.cpp</a></li>

<li><a href="#trunkSourceJavaScriptCoreruntimeInternalFunctioncpp">trunk/Source/JavaScriptCore/runtime/InternalFunction.cpp</a></li>

<li><a href="#trunkSourceJavaScriptCoreruntimeInternalFunctionh">trunk/Source/JavaScriptCore/runtime/InternalFunction.h</a></li>

<li><a href="#trunkSourceJavaScriptCoreruntimeIntlCollatorcpp">trunk/Source/JavaScriptCore/runtime/IntlCollator.cpp</a></li>

<li><a href="#trunkSourceJavaScriptCoreruntimeIntlCollatorPrototypecpp">trunk/Source/JavaScriptCore/runtime/IntlCollatorPrototype.cpp</a></li>

<li><a href="#trunkSourceJavaScriptCoreruntimeIntlDateTimeFormatcpp">trunk/Source/JavaScriptCore/runtime/IntlDateTimeFormat.cpp</a></li>

<li><a href="#trunkSourceJavaScriptCoreruntimeIntlDateTimeFormatPrototypecpp">trunk/Source/JavaScriptCore/runtime/IntlDateTimeFormatPrototype.cpp</a></li>

<li><a href="#trunkSourceJavaScriptCoreruntimeIntlNumberFormatcpp">trunk/Source/JavaScriptCore/runtime/IntlNumberFormat.cpp</a></li>

<li><a href="#trunkSourceJavaScriptCoreruntimeIntlNumberFormatPrototypecpp">trunk/Source/JavaScriptCore/runtime/IntlNumberFormatPrototype.cpp</a></li>

<li><a href="#trunkSourceJavaScriptCoreruntimeIntlObjectcpp">trunk/Source/JavaScriptCore/runtime/IntlObject.cpp</a></li>

<li><a href="#trunkSourceJavaScriptCoreruntimeIntlObjectInlinesh">trunk/Source/JavaScriptCore/runtime/IntlObjectInlines.h</a></li>

<li><a href="#trunkSourceJavaScriptCoreruntimeIteratorPrototypecpp">trunk/Source/JavaScriptCore/runtime/IteratorPrototype.cpp</a></li>

<li><a href="#trunkSourceJavaScriptCoreruntimeJSArrayh">trunk/Source/JavaScriptCore/runtime/JSArray.h</a></li>

<li><a href="#trunkSourceJavaScriptCoreruntimeJSArrayBufferh">trunk/Source/JavaScriptCore/runtime/JSArrayBuffer.h</a></li>

<li><a href="#trunkSourceJavaScriptCoreruntimeJSArrayBufferConstructorcpp">trunk/Source/JavaScriptCore/runtime/JSArrayBufferConstructor.cpp</a></li>

<li><a href="#trunkSourceJavaScriptCoreruntimeJSArrayBufferPrototypecpp">trunk/Source/JavaScriptCore/runtime/JSArrayBufferPrototype.cpp</a></li>

<li><a href="#trunkSourceJavaScriptCoreruntimeJSArrayBufferViewh">trunk/Source/JavaScriptCore/runtime/JSArrayBufferView.h</a></li>

<li><a href="#trunkSourceJavaScriptCoreruntimeJSArrayBufferViewInlinesh">trunk/Source/JavaScriptCore/runtime/JSArrayBufferViewInlines.h</a></li>

<li><a href="#trunkSourceJavaScriptCoreruntimeJSBoundFunctioncpp">trunk/Source/JavaScriptCore/runtime/JSBoundFunction.cpp</a></li>

<li><a href="#trunkSourceJavaScriptCoreruntimeJSCJSValuecpp">trunk/Source/JavaScriptCore/runtime/JSCJSValue.cpp</a></li>

<li><a href="#trunkSourceJavaScriptCoreruntimeJSCJSValueh">trunk/Source/JavaScriptCore/runtime/JSCJSValue.h</a></li>

<li><a href="#trunkSourceJavaScriptCoreruntimeJSCJSValueInlinesh">trunk/Source/JavaScriptCore/runtime/JSCJSValueInlines.h</a></li>

<li><a href="#trunkSourceJavaScriptCoreruntimeJSCalleecpp">trunk/Source/JavaScriptCore/runtime/JSCallee.cpp</a></li>

<li><a href="#trunkSourceJavaScriptCoreruntimeJSCellcpp">trunk/Source/JavaScriptCore/runtime/JSCell.cpp</a></li>

<li><a href="#trunkSourceJavaScriptCoreruntimeJSCellh">trunk/Source/JavaScriptCore/runtime/JSCell.h</a></li>

<li><a href="#trunkSourceJavaScriptCoreruntimeJSCellInlinesh">trunk/Source/JavaScriptCore/runtime/JSCellInlines.h</a></li>

<li><a href="#trunkSourceJavaScriptCoreruntimeJSCustomGetterSetterFunctioncpp">trunk/Source/JavaScriptCore/runtime/JSCustomGetterSetterFunction.cpp</a></li>

<li><a href="#trunkSourceJavaScriptCoreruntimeJSDataViewPrototypecpp">trunk/Source/JavaScriptCore/runtime/JSDataViewPrototype.cpp</a></li>

<li><a href="#trunkSourceJavaScriptCoreruntimeJSFunctioncpp">trunk/Source/JavaScriptCore/runtime/JSFunction.cpp</a></li>

<li><a href="#trunkSourceJavaScriptCoreruntimeJSGenericTypedArrayViewh">trunk/Source/JavaScriptCore/runtime/JSGenericTypedArrayView.h</a></li>

<li><a href="#trunkSourceJavaScriptCoreruntimeJSGenericTypedArrayViewConstructorInlinesh">trunk/Source/JavaScriptCore/runtime/JSGenericTypedArrayViewConstructorInlines.h</a></li>

<li><a href="#trunkSourceJavaScriptCoreruntimeJSGenericTypedArrayViewInlinesh">trunk/Source/JavaScriptCore/runtime/JSGenericTypedArrayViewInlines.h</a></li>

<li><a href="#trunkSourceJavaScriptCoreruntimeJSGenericTypedArrayViewPrototypeFunctionsh">trunk/Source/JavaScriptCore/runtime/JSGenericTypedArrayViewPrototypeFunctions.h</a></li>

<li><a href="#trunkSourceJavaScriptCoreruntimeJSGenericTypedArrayViewPrototypeInlinesh">trunk/Source/JavaScriptCore/runtime/JSGenericTypedArrayViewPrototypeInlines.h</a></li>

<li><a href="#trunkSourceJavaScriptCoreruntimeJSGlobalObjectcpp">trunk/Source/JavaScriptCore/runtime/JSGlobalObject.cpp</a></li>

<li><a href="#trunkSourceJavaScriptCoreruntimeJSGlobalObjectFunctionscpp">trunk/Source/JavaScriptCore/runtime/JSGlobalObjectFunctions.cpp</a></li>

<li><a href="#trunkSourceJavaScriptCoreruntimeJSInternalPromiseDeferredcpp">trunk/Source/JavaScriptCore/runtime/JSInternalPromiseDeferred.cpp</a></li>

<li><a href="#trunkSourceJavaScriptCoreruntimeJSLexicalEnvironmenth">trunk/Source/JavaScriptCore/runtime/JSLexicalEnvironment.h</a></li>

<li><a href="#trunkSourceJavaScriptCoreruntimeJSModuleLoadercpp">trunk/Source/JavaScriptCore/runtime/JSModuleLoader.cpp</a></li>

<li><a href="#trunkSourceJavaScriptCoreruntimeJSModuleNamespaceObjectcpp">trunk/Source/JavaScriptCore/runtime/JSModuleNamespaceObject.cpp</a></li>

<li><a href="#trunkSourceJavaScriptCoreruntimeJSModuleRecordcpp">trunk/Source/JavaScriptCore/runtime/JSModuleRecord.cpp</a></li>

<li><a href="#trunkSourceJavaScriptCoreruntimeJSNativeStdFunctioncpp">trunk/Source/JavaScriptCore/runtime/JSNativeStdFunction.cpp</a></li>

<li><a href="#trunkSourceJavaScriptCoreruntimeJSONObjectcpp">trunk/Source/JavaScriptCore/runtime/JSONObject.cpp</a></li>

<li><a href="#trunkSourceJavaScriptCoreruntimeJSObjectcpp">trunk/Source/JavaScriptCore/runtime/JSObject.cpp</a></li>

<li><a href="#trunkSourceJavaScriptCoreruntimeJSObjecth">trunk/Source/JavaScriptCore/runtime/JSObject.h</a></li>

<li><a href="#trunkSourceJavaScriptCoreruntimeJSPromiseDeferredcpp">trunk/Source/JavaScriptCore/runtime/JSPromiseDeferred.cpp</a></li>

<li><a href="#trunkSourceJavaScriptCoreruntimeJSPropertyNameIteratorcpp">trunk/Source/JavaScriptCore/runtime/JSPropertyNameIterator.cpp</a></li>

<li><a href="#trunkSourceJavaScriptCoreruntimeJSScopecpp">trunk/Source/JavaScriptCore/runtime/JSScope.cpp</a></li>

<li><a href="#trunkSourceJavaScriptCoreruntimeJSScopeh">trunk/Source/JavaScriptCore/runtime/JSScope.h</a></li>

<li><a href="#trunkSourceJavaScriptCoreruntimeJSStringcpp">trunk/Source/JavaScriptCore/runtime/JSString.cpp</a></li>

<li><a href="#trunkSourceJavaScriptCoreruntimeJSStringIteratorcpp">trunk/Source/JavaScriptCore/runtime/JSStringIterator.cpp</a></li>

<li><a href="#trunkSourceJavaScriptCoreruntimeJSTypedArrayViewPrototypecpp">trunk/Source/JavaScriptCore/runtime/JSTypedArrayViewPrototype.cpp</a></li>

<li><a href="#trunkSourceJavaScriptCoreruntimeLazyClassStructurecpp">trunk/Source/JavaScriptCore/runtime/LazyClassStructure.cpp</a></li>

<li><a href="#trunkSourceJavaScriptCoreruntimeLookuph">trunk/Source/JavaScriptCore/runtime/Lookup.h</a></li>

<li><a href="#trunkSourceJavaScriptCoreruntimeMapConstructorcpp">trunk/Source/JavaScriptCore/runtime/MapConstructor.cpp</a></li>

<li><a href="#trunkSourceJavaScriptCoreruntimeMapIteratorPrototypecpp">trunk/Source/JavaScriptCore/runtime/MapIteratorPrototype.cpp</a></li>

<li><a href="#trunkSourceJavaScriptCoreruntimeMapPrototypecpp">trunk/Source/JavaScriptCore/runtime/MapPrototype.cpp</a></li>

<li><a href="#trunkSourceJavaScriptCoreruntimeMathObjectcpp">trunk/Source/JavaScriptCore/runtime/MathObject.cpp</a></li>

<li><a href="#trunkSourceJavaScriptCoreruntimeModuleLoaderPrototypecpp">trunk/Source/JavaScriptCore/runtime/ModuleLoaderPrototype.cpp</a></li>

<li><a href="#trunkSourceJavaScriptCoreruntimeNativeErrorConstructorcpp">trunk/Source/JavaScriptCore/runtime/NativeErrorConstructor.cpp</a></li>

<li><a href="#trunkSourceJavaScriptCoreruntimeNumberConstructorcpp">trunk/Source/JavaScriptCore/runtime/NumberConstructor.cpp</a></li>

<li><a href="#trunkSourceJavaScriptCoreruntimeNumberObjectcpp">trunk/Source/JavaScriptCore/runtime/NumberObject.cpp</a></li>

<li><a href="#trunkSourceJavaScriptCoreruntimeNumberPrototypecpp">trunk/Source/JavaScriptCore/runtime/NumberPrototype.cpp</a></li>

<li><a href="#trunkSourceJavaScriptCoreruntimeObjectConstructorcpp">trunk/Source/JavaScriptCore/runtime/ObjectConstructor.cpp</a></li>

<li><a href="#trunkSourceJavaScriptCoreruntimeObjectPrototypecpp">trunk/Source/JavaScriptCore/runtime/ObjectPrototype.cpp</a></li>

<li><a href="#trunkSourceJavaScriptCoreruntimeProxyObjectcpp">trunk/Source/JavaScriptCore/runtime/ProxyObject.cpp</a></li>

<li><a href="#trunkSourceJavaScriptCoreruntimeReflectObjectcpp">trunk/Source/JavaScriptCore/runtime/ReflectObject.cpp</a></li>

<li><a href="#trunkSourceJavaScriptCoreruntimeRegExpConstructorcpp">trunk/Source/JavaScriptCore/runtime/RegExpConstructor.cpp</a></li>

<li><a href="#trunkSourceJavaScriptCoreruntimeRegExpConstructorh">trunk/Source/JavaScriptCore/runtime/RegExpConstructor.h</a></li>

<li><a href="#trunkSourceJavaScriptCoreruntimeRegExpObjectcpp">trunk/Source/JavaScriptCore/runtime/RegExpObject.cpp</a></li>

<li><a href="#trunkSourceJavaScriptCoreruntimeRegExpObjecth">trunk/Source/JavaScriptCore/runtime/RegExpObject.h</a></li>

<li><a href="#trunkSourceJavaScriptCoreruntimeRegExpPrototypecpp">trunk/Source/JavaScriptCore/runtime/RegExpPrototype.cpp</a></li>

<li><a href="#trunkSourceJavaScriptCoreruntimeSamplingProfilercpp">trunk/Source/JavaScriptCore/runtime/SamplingProfiler.cpp</a></li>

<li><a href="#trunkSourceJavaScriptCoreruntimeScriptExecutablecpp">trunk/Source/JavaScriptCore/runtime/ScriptExecutable.cpp</a></li>

<li><a href="#trunkSourceJavaScriptCoreruntimeSetConstructorcpp">trunk/Source/JavaScriptCore/runtime/SetConstructor.cpp</a></li>

<li><a href="#trunkSourceJavaScriptCoreruntimeSetIteratorPrototypecpp">trunk/Source/JavaScriptCore/runtime/SetIteratorPrototype.cpp</a></li>

<li><a href="#trunkSourceJavaScriptCoreruntimeSetPrototypecpp">trunk/Source/JavaScriptCore/runtime/SetPrototype.cpp</a></li>

<li><a href="#trunkSourceJavaScriptCoreruntimeStackFramecpp">trunk/Source/JavaScriptCore/runtime/StackFrame.cpp</a></li>

<li><a href="#trunkSourceJavaScriptCoreruntimeStringIteratorPrototypecpp">trunk/Source/JavaScriptCore/runtime/StringIteratorPrototype.cpp</a></li>

<li><a href="#trunkSourceJavaScriptCoreruntimeStringObjectcpp">trunk/Source/JavaScriptCore/runtime/StringObject.cpp</a></li>

<li><a href="#trunkSourceJavaScriptCoreruntimeStringObjecth">trunk/Source/JavaScriptCore/runtime/StringObject.h</a></li>

<li><a href="#trunkSourceJavaScriptCoreruntimeStringPrototypecpp">trunk/Source/JavaScriptCore/runtime/StringPrototype.cpp</a></li>

<li><a href="#trunkSourceJavaScriptCoreruntimeStructureRareDatacpp">trunk/Source/JavaScriptCore/runtime/StructureRareData.cpp</a></li>

<li><a href="#trunkSourceJavaScriptCoreruntimeSymbolcpp">trunk/Source/JavaScriptCore/runtime/Symbol.cpp</a></li>

<li><a href="#trunkSourceJavaScriptCoreruntimeSymbolConstructorcpp">trunk/Source/JavaScriptCore/runtime/SymbolConstructor.cpp</a></li>

<li><a href="#trunkSourceJavaScriptCoreruntimeSymbolObjectcpp">trunk/Source/JavaScriptCore/runtime/SymbolObject.cpp</a></li>

<li><a href="#trunkSourceJavaScriptCoreruntimeSymbolPrototypecpp">trunk/Source/JavaScriptCore/runtime/SymbolPrototype.cpp</a></li>

<li><a href="#trunkSourceJavaScriptCoreruntimeTestRunnerUtilscpp">trunk/Source/JavaScriptCore/runtime/TestRunnerUtils.cpp</a></li>

<li><a href="#trunkSourceJavaScriptCoreruntimeThrowScopecpp">trunk/Source/JavaScriptCore/runtime/ThrowScope.cpp</a></li>

<li><a href="#trunkSourceJavaScriptCoreruntimeVMcpp">trunk/Source/JavaScriptCore/runtime/VM.cpp</a></li>

<li><a href="#trunkSourceJavaScriptCoreruntimeWeakMapConstructorcpp">trunk/Source/JavaScriptCore/runtime/WeakMapConstructor.cpp</a></li>

<li><a href="#trunkSourceJavaScriptCoreruntimeWeakMapPrototypecpp">trunk/Source/JavaScriptCore/runtime/WeakMapPrototype.cpp</a></li>

<li><a href="#trunkSourceJavaScriptCoreruntimeWeakSetConstructorcpp">trunk/Source/JavaScriptCore/runtime/WeakSetConstructor.cpp</a></li>

<li><a href="#trunkSourceJavaScriptCoreruntimeWeakSetPrototypecpp">trunk/Source/JavaScriptCore/runtime/WeakSetPrototype.cpp</a></li>

<li><a href="#trunkSourceJavaScriptCoretoolsJSDollarVMPrototypecpp">trunk/Source/JavaScriptCore/tools/JSDollarVMPrototype.cpp</a></li>

<li><a href="#trunkSourceJavaScriptCorewasmJSWebAssemblycpp">trunk/Source/JavaScriptCore/wasm/JSWebAssembly.cpp</a></li>

<li><a href="#trunkSourceJavaScriptCorewasmjsJSWebAssemblyHelpersh">trunk/Source/JavaScriptCore/wasm/js/JSWebAssemblyHelpers.h</a></li>

<li><a href="#trunkSourceJavaScriptCorewasmjsJSWebAssemblyInstancecpp">trunk/Source/JavaScriptCore/wasm/js/JSWebAssemblyInstance.cpp</a></li>

<li><a href="#trunkSourceJavaScriptCorewasmjsJSWebAssemblyMemorycpp">trunk/Source/JavaScriptCore/wasm/js/JSWebAssemblyMemory.cpp</a></li>

<li><a href="#trunkSourceJavaScriptCorewasmjsJSWebAssemblyMemoryh">trunk/Source/JavaScriptCore/wasm/js/JSWebAssemblyMemory.h</a></li>

<li><a href="#trunkSourceJavaScriptCorewasmjsJSWebAssemblyModulecpp">trunk/Source/JavaScriptCore/wasm/js/JSWebAssemblyModule.cpp</a></li>

<li><a href="#trunkSourceJavaScriptCorewasmjsJSWebAssemblyTablecpp">trunk/Source/JavaScriptCore/wasm/js/JSWebAssemblyTable.cpp</a></li>

<li><a href="#trunkSourceJavaScriptCorewasmjsWebAssemblyFunctioncpp">trunk/Source/JavaScriptCore/wasm/js/WebAssemblyFunction.cpp</a></li>

<li><a href="#trunkSourceJavaScriptCorewasmjsWebAssemblyInstanceConstructorcpp">trunk/Source/JavaScriptCore/wasm/js/WebAssemblyInstanceConstructor.cpp</a></li>

<li><a href="#trunkSourceJavaScriptCorewasmjsWebAssemblyMemoryPrototypecpp">trunk/Source/JavaScriptCore/wasm/js/WebAssemblyMemoryPrototype.cpp</a></li>

<li><a href="#trunkSourceJavaScriptCorewasmjsWebAssemblyModulePrototypecpp">trunk/Source/JavaScriptCore/wasm/js/WebAssemblyModulePrototype.cpp</a></li>

<li><a href="#trunkSourceJavaScriptCorewasmjsWebAssemblyModuleRecordcpp">trunk/Source/JavaScriptCore/wasm/js/WebAssemblyModuleRecord.cpp</a></li>

<li><a href="#trunkSourceJavaScriptCorewasmjsWebAssemblyTablePrototypecpp">trunk/Source/JavaScriptCore/wasm/js/WebAssemblyTablePrototype.cpp</a></li>

<li><a href="#trunkSourceWebCoreChangeLog">trunk/Source/WebCore/ChangeLog</a></li>

<li><a href="#trunkSourceWebCoreModulesfetchFetchBodycpp">trunk/Source/WebCore/Modules/fetch/FetchBody.cpp</a></li>

<li><a href="#trunkSourceWebCoreModulespluginsQuickTimePluginReplacementmm">trunk/Source/WebCore/Modules/plugins/QuickTimePluginReplacement.mm</a></li>

<li><a href="#trunkSourceWebCorebindingsjsIDBBindingUtilitiescpp">trunk/Source/WebCore/bindings/js/IDBBindingUtilities.cpp</a></li>

<li><a href="#trunkSourceWebCorebindingsjsJSCommandLineAPIHostCustomcpp">trunk/Source/WebCore/bindings/js/JSCommandLineAPIHostCustom.cpp</a></li>

<li><a href="#trunkSourceWebCorebindingsjsJSCryptoAlgorithmDictionarycpp">trunk/Source/WebCore/bindings/js/JSCryptoAlgorithmDictionary.cpp</a></li>

<li><a href="#trunkSourceWebCorebindingsjsJSCryptoCustomcpp">trunk/Source/WebCore/bindings/js/JSCryptoCustom.cpp</a></li>

<li><a href="#trunkSourceWebCorebindingsjsJSCryptoOperationDatacpp">trunk/Source/WebCore/bindings/js/JSCryptoOperationData.cpp</a></li>

<li><a href="#trunkSourceWebCorebindingsjsJSCustomElementInterfacecpp">trunk/Source/WebCore/bindings/js/JSCustomElementInterface.cpp</a></li>

<li><a href="#trunkSourceWebCorebindingsjsJSDOMBindingcpp">trunk/Source/WebCore/bindings/js/JSDOMBinding.cpp</a></li>

<li><a href="#trunkSourceWebCorebindingsjsJSDOMBindingh">trunk/Source/WebCore/bindings/js/JSDOMBinding.h</a></li>

<li><a href="#trunkSourceWebCorebindingsjsJSDOMConstructorh">trunk/Source/WebCore/bindings/js/JSDOMConstructor.h</a></li>

<li><a href="#trunkSourceWebCorebindingsjsJSDOMConverth">trunk/Source/WebCore/bindings/js/JSDOMConvert.h</a></li>

<li><a href="#trunkSourceWebCorebindingsjsJSDOMGlobalObjectcpp">trunk/Source/WebCore/bindings/js/JSDOMGlobalObject.cpp</a></li>

<li><a href="#trunkSourceWebCorebindingsjsJSDOMIteratorh">trunk/Source/WebCore/bindings/js/JSDOMIterator.h</a></li>

<li><a href="#trunkSourceWebCorebindingsjsJSDOMWindowBasecpp">trunk/Source/WebCore/bindings/js/JSDOMWindowBase.cpp</a></li>

<li><a href="#trunkSourceWebCorebindingsjsJSDOMWindowBaseh">trunk/Source/WebCore/bindings/js/JSDOMWindowBase.h</a></li>

<li><a href="#trunkSourceWebCorebindingsjsJSDOMWindowCustomcpp">trunk/Source/WebCore/bindings/js/JSDOMWindowCustom.cpp</a></li>

<li><a href="#trunkSourceWebCorebindingsjsJSDOMWindowShellcpp">trunk/Source/WebCore/bindings/js/JSDOMWindowShell.cpp</a></li>

<li><a href="#trunkSourceWebCorebindingsjsJSDOMWindowShellh">trunk/Source/WebCore/bindings/js/JSDOMWindowShell.h</a></li>

<li><a href="#trunkSourceWebCorebindingsjsJSDocumentCustomcpp">trunk/Source/WebCore/bindings/js/JSDocumentCustom.cpp</a></li>

<li><a href="#trunkSourceWebCorebindingsjsJSDynamicDowncasth">trunk/Source/WebCore/bindings/js/JSDynamicDowncast.h</a></li>

<li><a href="#trunkSourceWebCorebindingsjsJSEventListenercpp">trunk/Source/WebCore/bindings/js/JSEventListener.cpp</a></li>

<li><a href="#trunkSourceWebCorebindingsjsJSEventTargetCustomcpp">trunk/Source/WebCore/bindings/js/JSEventTargetCustom.cpp</a></li>

<li><a href="#trunkSourceWebCorebindingsjsJSEventTargetCustomh">trunk/Source/WebCore/bindings/js/JSEventTargetCustom.h</a></li>

<li><a href="#trunkSourceWebCorebindingsjsJSExceptionBasecpp">trunk/Source/WebCore/bindings/js/JSExceptionBase.cpp</a></li>

<li><a href="#trunkSourceWebCorebindingsjsJSExceptionBaseh">trunk/Source/WebCore/bindings/js/JSExceptionBase.h</a></li>

<li><a href="#trunkSourceWebCorebindingsjsJSInspectorFrontendHostCustomcpp">trunk/Source/WebCore/bindings/js/JSInspectorFrontendHostCustom.cpp</a></li>

<li><a href="#trunkSourceWebCorebindingsjsJSNodeCustomcpp">trunk/Source/WebCore/bindings/js/JSNodeCustom.cpp</a></li>

<li><a href="#trunkSourceWebCorebindingsjsJSPluginElementFunctionscpp">trunk/Source/WebCore/bindings/js/JSPluginElementFunctions.cpp</a></li>

<li><a href="#trunkSourceWebCorebindingsjsJSReadableStreamPrivateConstructorscpp">trunk/Source/WebCore/bindings/js/JSReadableStreamPrivateConstructors.cpp</a></li>

<li><a href="#trunkSourceWebCorebindingsjsJSReadableStreamSourceCustomcpp">trunk/Source/WebCore/bindings/js/JSReadableStreamSourceCustom.cpp</a></li>

<li><a href="#trunkSourceWebCorebindingsjsJSSubtleCryptoCustomcpp">trunk/Source/WebCore/bindings/js/JSSubtleCryptoCustom.cpp</a></li>

<li><a href="#trunkSourceWebCorebindingsjsJSTrackCustomcpp">trunk/Source/WebCore/bindings/js/JSTrackCustom.cpp</a></li>

<li><a href="#trunkSourceWebCorebindingsjsJSTrackCustomh">trunk/Source/WebCore/bindings/js/JSTrackCustom.h</a></li>

<li><a href="#trunkSourceWebCorebindingsjsJSWebKitSubtleCryptoCustomcpp">trunk/Source/WebCore/bindings/js/JSWebKitSubtleCryptoCustom.cpp</a></li>

<li><a href="#trunkSourceWebCorebindingsjsJSWorkerGlobalScopeBasecpp">trunk/Source/WebCore/bindings/js/JSWorkerGlobalScopeBase.cpp</a></li>

<li><a href="#trunkSourceWebCorebindingsjsJSWorkerGlobalScopeBaseh">trunk/Source/WebCore/bindings/js/JSWorkerGlobalScopeBase.h</a></li>

<li><a href="#trunkSourceWebCorebindingsjsJSXMLHttpRequestCustomcpp">trunk/Source/WebCore/bindings/js/JSXMLHttpRequestCustom.cpp</a></li>

<li><a href="#trunkSourceWebCorebindingsjsJSXPathNSResolverCustomcpp">trunk/Source/WebCore/bindings/js/JSXPathNSResolverCustom.cpp</a></li>

<li><a href="#trunkSourceWebCorebindingsjsScriptControllercpp">trunk/Source/WebCore/bindings/js/ScriptController.cpp</a></li>

<li><a href="#trunkSourceWebCorebindingsjsScriptModuleLoadercpp">trunk/Source/WebCore/bindings/js/ScriptModuleLoader.cpp</a></li>

<li><a href="#trunkSourceWebCorebindingsjsScriptStatecpp">trunk/Source/WebCore/bindings/js/ScriptState.cpp</a></li>

<li><a href="#trunkSourceWebCorebindingsjsSerializedScriptValuecpp">trunk/Source/WebCore/bindings/js/SerializedScriptValue.cpp</a></li>

<li><a href="#trunkSourceWebCorebindingsjsStructuredClonecpp">trunk/Source/WebCore/bindings/js/StructuredClone.cpp</a></li>

<li><a href="#trunkSourceWebCorebindingsjsWorkerScriptControllercpp">trunk/Source/WebCore/bindings/js/WorkerScriptController.cpp</a></li>

<li><a href="#trunkSourceWebCorebindingsscriptsCodeGeneratorJSpm">trunk/Source/WebCore/bindings/scripts/CodeGeneratorJS.pm</a></li>

<li><a href="#trunkSourceWebCorebindingsscriptstestJSJSInterfaceNamecpp">trunk/Source/WebCore/bindings/scripts/test/JS/JSInterfaceName.cpp</a></li>

<li><a href="#trunkSourceWebCorebindingsscriptstestJSJSInterfaceNameh">trunk/Source/WebCore/bindings/scripts/test/JS/JSInterfaceName.h</a></li>

<li><a href="#trunkSourceWebCorebindingsscriptstestJSJSTestActiveDOMObjectcpp">trunk/Source/WebCore/bindings/scripts/test/JS/JSTestActiveDOMObject.cpp</a></li>

<li><a href="#trunkSourceWebCorebindingsscriptstestJSJSTestActiveDOMObjecth">trunk/Source/WebCore/bindings/scripts/test/JS/JSTestActiveDOMObject.h</a></li>

<li><a href="#trunkSourceWebCorebindingsscriptstestJSJSTestCEReactionscpp">trunk/Source/WebCore/bindings/scripts/test/JS/JSTestCEReactions.cpp</a></li>

<li><a href="#trunkSourceWebCorebindingsscriptstestJSJSTestCEReactionsh">trunk/Source/WebCore/bindings/scripts/test/JS/JSTestCEReactions.h</a></li>

<li><a href="#trunkSourceWebCorebindingsscriptstestJSJSTestCEReactionsStringifiercpp">trunk/Source/WebCore/bindings/scripts/test/JS/JSTestCEReactionsStringifier.cpp</a></li>

<li><a href="#trunkSourceWebCorebindingsscriptstestJSJSTestCEReactionsStringifierh">trunk/Source/WebCore/bindings/scripts/test/JS/JSTestCEReactionsStringifier.h</a></li>

<li><a href="#trunkSourceWebCorebindingsscriptstestJSJSTestClassWithJSBuiltinConstructorcpp">trunk/Source/WebCore/bindings/scripts/test/JS/JSTestClassWithJSBuiltinConstructor.cpp</a></li>

<li><a href="#trunkSourceWebCorebindingsscriptstestJSJSTestClassWithJSBuiltinConstructorh">trunk/Source/WebCore/bindings/scripts/test/JS/JSTestClassWithJSBuiltinConstructor.h</a></li>

<li><a href="#trunkSourceWebCorebindingsscriptstestJSJSTestCustomConstructorWithNoInterfaceObjectcpp">trunk/Source/WebCore/bindings/scripts/test/JS/JSTestCustomConstructorWithNoInterfaceObject.cpp</a></li>

<li><a href="#trunkSourceWebCorebindingsscriptstestJSJSTestCustomConstructorWithNoInterfaceObjecth">trunk/Source/WebCore/bindings/scripts/test/JS/JSTestCustomConstructorWithNoInterfaceObject.h</a></li>

<li><a href="#trunkSourceWebCorebindingsscriptstestJSJSTestCustomNamedGettercpp">trunk/Source/WebCore/bindings/scripts/test/JS/JSTestCustomNamedGetter.cpp</a></li>

<li><a href="#trunkSourceWebCorebindingsscriptstestJSJSTestCustomNamedGetterh">trunk/Source/WebCore/bindings/scripts/test/JS/JSTestCustomNamedGetter.h</a></li>

<li><a href="#trunkSourceWebCorebindingsscriptstestJSJSTestDOMJITcpp">trunk/Source/WebCore/bindings/scripts/test/JS/JSTestDOMJIT.cpp</a></li>

<li><a href="#trunkSourceWebCorebindingsscriptstestJSJSTestEventConstructorcpp">trunk/Source/WebCore/bindings/scripts/test/JS/JSTestEventConstructor.cpp</a></li>

<li><a href="#trunkSourceWebCorebindingsscriptstestJSJSTestEventTargetcpp">trunk/Source/WebCore/bindings/scripts/test/JS/JSTestEventTarget.cpp</a></li>

<li><a href="#trunkSourceWebCorebindingsscriptstestJSJSTestEventTargeth">trunk/Source/WebCore/bindings/scripts/test/JS/JSTestEventTarget.h</a></li>

<li><a href="#trunkSourceWebCorebindingsscriptstestJSJSTestExceptioncpp">trunk/Source/WebCore/bindings/scripts/test/JS/JSTestException.cpp</a></li>

<li><a href="#trunkSourceWebCorebindingsscriptstestJSJSTestExceptionh">trunk/Source/WebCore/bindings/scripts/test/JS/JSTestException.h</a></li>

<li><a href="#trunkSourceWebCorebindingsscriptstestJSJSTestGenerateIsReachablecpp">trunk/Source/WebCore/bindings/scripts/test/JS/JSTestGenerateIsReachable.cpp</a></li>

<li><a href="#trunkSourceWebCorebindingsscriptstestJSJSTestGenerateIsReachableh">trunk/Source/WebCore/bindings/scripts/test/JS/JSTestGenerateIsReachable.h</a></li>

<li><a href="#trunkSourceWebCorebindingsscriptstestJSJSTestGlobalObjectcpp">trunk/Source/WebCore/bindings/scripts/test/JS/JSTestGlobalObject.cpp</a></li>

<li><a href="#trunkSourceWebCorebindingsscriptstestJSJSTestGlobalObjecth">trunk/Source/WebCore/bindings/scripts/test/JS/JSTestGlobalObject.h</a></li>

<li><a href="#trunkSourceWebCorebindingsscriptstestJSJSTestInterfacecpp">trunk/Source/WebCore/bindings/scripts/test/JS/JSTestInterface.cpp</a></li>

<li><a href="#trunkSourceWebCorebindingsscriptstestJSJSTestInterfaceh">trunk/Source/WebCore/bindings/scripts/test/JS/JSTestInterface.h</a></li>

<li><a href="#trunkSourceWebCorebindingsscriptstestJSJSTestInterfaceLeadingUnderscorecpp">trunk/Source/WebCore/bindings/scripts/test/JS/JSTestInterfaceLeadingUnderscore.cpp</a></li>

<li><a href="#trunkSourceWebCorebindingsscriptstestJSJSTestInterfaceLeadingUnderscoreh">trunk/Source/WebCore/bindings/scripts/test/JS/JSTestInterfaceLeadingUnderscore.h</a></li>

<li><a href="#trunkSourceWebCorebindingsscriptstestJSJSTestIterablecpp">trunk/Source/WebCore/bindings/scripts/test/JS/JSTestIterable.cpp</a></li>

<li><a href="#trunkSourceWebCorebindingsscriptstestJSJSTestIterableh">trunk/Source/WebCore/bindings/scripts/test/JS/JSTestIterable.h</a></li>

<li><a href="#trunkSourceWebCorebindingsscriptstestJSJSTestJSBuiltinConstructorcpp">trunk/Source/WebCore/bindings/scripts/test/JS/JSTestJSBuiltinConstructor.cpp</a></li>

<li><a href="#trunkSourceWebCorebindingsscriptstestJSJSTestMediaQueryListListenercpp">trunk/Source/WebCore/bindings/scripts/test/JS/JSTestMediaQueryListListener.cpp</a></li>

<li><a href="#trunkSourceWebCorebindingsscriptstestJSJSTestMediaQueryListListenerh">trunk/Source/WebCore/bindings/scripts/test/JS/JSTestMediaQueryListListener.h</a></li>

<li><a href="#trunkSourceWebCorebindingsscriptstestJSJSTestNamedConstructorcpp">trunk/Source/WebCore/bindings/scripts/test/JS/JSTestNamedConstructor.cpp</a></li>

<li><a href="#trunkSourceWebCorebindingsscriptstestJSJSTestNamedConstructorh">trunk/Source/WebCore/bindings/scripts/test/JS/JSTestNamedConstructor.h</a></li>

<li><a href="#trunkSourceWebCorebindingsscriptstestJSJSTestNodecpp">trunk/Source/WebCore/bindings/scripts/test/JS/JSTestNode.cpp</a></li>

<li><a href="#trunkSourceWebCorebindingsscriptstestJSJSTestObjcpp">trunk/Source/WebCore/bindings/scripts/test/JS/JSTestObj.cpp</a></li>

<li><a href="#trunkSourceWebCorebindingsscriptstestJSJSTestObjh">trunk/Source/WebCore/bindings/scripts/test/JS/JSTestObj.h</a></li>

<li><a href="#trunkSourceWebCorebindingsscriptstestJSJSTestOverloadedConstructorscpp">trunk/Source/WebCore/bindings/scripts/test/JS/JSTestOverloadedConstructors.cpp</a></li>

<li><a href="#trunkSourceWebCorebindingsscriptstestJSJSTestOverloadedConstructorsh">trunk/Source/WebCore/bindings/scripts/test/JS/JSTestOverloadedConstructors.h</a></li>

<li><a href="#trunkSourceWebCorebindingsscriptstestJSJSTestOverloadedConstructorsWithSequencecpp">trunk/Source/WebCore/bindings/scripts/test/JS/JSTestOverloadedConstructorsWithSequence.cpp</a></li>

<li><a href="#trunkSourceWebCorebindingsscriptstestJSJSTestOverloadedConstructorsWithSequenceh">trunk/Source/WebCore/bindings/scripts/test/JS/JSTestOverloadedConstructorsWithSequence.h</a></li>

<li><a href="#trunkSourceWebCorebindingsscriptstestJSJSTestOverrideBuiltinscpp">trunk/Source/WebCore/bindings/scripts/test/JS/JSTestOverrideBuiltins.cpp</a></li>

<li><a href="#trunkSourceWebCorebindingsscriptstestJSJSTestOverrideBuiltinsh">trunk/Source/WebCore/bindings/scripts/test/JS/JSTestOverrideBuiltins.h</a></li>

<li><a href="#trunkSourceWebCorebindingsscriptstestJSJSTestSerializationcpp">trunk/Source/WebCore/bindings/scripts/test/JS/JSTestSerialization.cpp</a></li>

<li><a href="#trunkSourceWebCorebindingsscriptstestJSJSTestSerializationh">trunk/Source/WebCore/bindings/scripts/test/JS/JSTestSerialization.h</a></li>

<li><a href="#trunkSourceWebCorebindingsscriptstestJSJSTestSerializedScriptValueInterfacecpp">trunk/Source/WebCore/bindings/scripts/test/JS/JSTestSerializedScriptValueInterface.cpp</a></li>

<li><a href="#trunkSourceWebCorebindingsscriptstestJSJSTestSerializedScriptValueInterfaceh">trunk/Source/WebCore/bindings/scripts/test/JS/JSTestSerializedScriptValueInterface.h</a></li>

<li><a href="#trunkSourceWebCorebindingsscriptstestJSJSTestTypedefscpp">trunk/Source/WebCore/bindings/scripts/test/JS/JSTestTypedefs.cpp</a></li>

<li><a href="#trunkSourceWebCorebindingsscriptstestJSJSTestTypedefsh">trunk/Source/WebCore/bindings/scripts/test/JS/JSTestTypedefs.h</a></li>

<li><a href="#trunkSourceWebCorebridgecCRuntimeObjectcpp">trunk/Source/WebCore/bridge/c/CRuntimeObject.cpp</a></li>

<li><a href="#trunkSourceWebCorebridgecc_instancecpp">trunk/Source/WebCore/bridge/c/c_instance.cpp</a></li>

<li><a href="#trunkSourceWebCorebridgecc_utilitycpp">trunk/Source/WebCore/bridge/c/c_utility.cpp</a></li>

<li><a href="#trunkSourceWebCorebridgeobjcObjCRuntimeObjectmm">trunk/Source/WebCore/bridge/objc/ObjCRuntimeObject.mm</a></li>

<li><a href="#trunkSourceWebCorebridgeobjcWebScriptObjectmm">trunk/Source/WebCore/bridge/objc/WebScriptObject.mm</a></li>

<li><a href="#trunkSourceWebCorebridgeobjcobjc_instancemm">trunk/Source/WebCore/bridge/objc/objc_instance.mm</a></li>

<li><a href="#trunkSourceWebCorebridgeobjcobjc_runtimemm">trunk/Source/WebCore/bridge/objc/objc_runtime.mm</a></li>

<li><a href="#trunkSourceWebCorebridgeruntime_arraycpp">trunk/Source/WebCore/bridge/runtime_array.cpp</a></li>

<li><a href="#trunkSourceWebCorebridgeruntime_methodcpp">trunk/Source/WebCore/bridge/runtime_method.cpp</a></li>

<li><a href="#trunkSourceWebCorebridgeruntime_objectcpp">trunk/Source/WebCore/bridge/runtime_object.cpp</a></li>

<li><a href="#trunkSourceWebCorecssFontFacecpp">trunk/Source/WebCore/css/FontFace.cpp</a></li>

<li><a href="#trunkSourceWebCorehtmlHTMLMediaElementcpp">trunk/Source/WebCore/html/HTMLMediaElement.cpp</a></li>

<li><a href="#trunkSourceWebCoreinspectorInspectorControllercpp">trunk/Source/WebCore/inspector/InspectorController.cpp</a></li>

<li><a href="#trunkSourceWebCoreinspectorInspectorDOMAgentcpp">trunk/Source/WebCore/inspector/InspectorDOMAgent.cpp</a></li>

<li><a href="#trunkSourceWebCoreinspectorWebInjectedScriptHostcpp">trunk/Source/WebCore/inspector/WebInjectedScriptHost.cpp</a></li>

<li><a href="#trunkSourceWebCoreinspectorWebInjectedScriptHosth">trunk/Source/WebCore/inspector/WebInjectedScriptHost.h</a></li>

<li><a href="#trunkSourceWebKitmacChangeLog">trunk/Source/WebKit/mac/ChangeLog</a></li>

<li><a href="#trunkSourceWebKitmacDOMDOMmm">trunk/Source/WebKit/mac/DOM/DOM.mm</a></li>

<li><a href="#trunkSourceWebKitmacDOMDOMUtilitymm">trunk/Source/WebKit/mac/DOM/DOMUtility.mm</a></li>

<li><a href="#trunkSourceWebKitmacDOMWebDOMOperationsmm">trunk/Source/WebKit/mac/DOM/WebDOMOperations.mm</a></li>

<li><a href="#trunkSourceWebKitmacPluginsHostedNetscapePluginInstanceProxymm">trunk/Source/WebKit/mac/Plugins/Hosted/NetscapePluginInstanceProxy.mm</a></li>

<li><a href="#trunkSourceWebKitmacPluginsHostedProxyInstancemm">trunk/Source/WebKit/mac/Plugins/Hosted/ProxyInstance.mm</a></li>

<li><a href="#trunkSourceWebKitmacPluginsHostedProxyRuntimeObjectmm">trunk/Source/WebKit/mac/Plugins/Hosted/ProxyRuntimeObject.mm</a></li>

<li><a href="#trunkSourceWebKitmacWebViewWebFramemm">trunk/Source/WebKit/mac/WebView/WebFrame.mm</a></li>

<li><a href="#trunkSourceWebKitmacWebViewWebViewmm">trunk/Source/WebKit/mac/WebView/WebView.mm</a></li>

<li><a href="#trunkSourceWebKitwinChangeLog">trunk/Source/WebKit/win/ChangeLog</a></li>

<li><a href="#trunkSourceWebKitwinWebFramecpp">trunk/Source/WebKit/win/WebFrame.cpp</a></li>

<li><a href="#trunkSourceWebKitwinWebViewcpp">trunk/Source/WebKit/win/WebView.cpp</a></li>

<li><a href="#trunkSourceWebKit2ChangeLog">trunk/Source/WebKit2/ChangeLog</a></li>

<li><a href="#trunkSourceWebKit2WebProcessAutomationWebAutomationSessionProxycpp">trunk/Source/WebKit2/WebProcess/Automation/WebAutomationSessionProxy.cpp</a></li>

<li><a href="#trunkSourceWebKit2WebProcessInjectedBundleDOMInjectedBundleNodeHandlecpp">trunk/Source/WebKit2/WebProcess/InjectedBundle/DOM/InjectedBundleNodeHandle.cpp</a></li>

<li><a href="#trunkSourceWebKit2WebProcessInjectedBundleDOMInjectedBundleRangeHandlecpp">trunk/Source/WebKit2/WebProcess/InjectedBundle/DOM/InjectedBundleRangeHandle.cpp</a></li>

<li><a href="#trunkSourceWebKit2WebProcessInjectedBundleInjectedBundlecpp">trunk/Source/WebKit2/WebProcess/InjectedBundle/InjectedBundle.cpp</a></li>

<li><a href="#trunkSourceWebKit2WebProcessPluginsNetscapeJSNPMethodcpp">trunk/Source/WebKit2/WebProcess/Plugins/Netscape/JSNPMethod.cpp</a></li>

<li><a href="#trunkSourceWebKit2WebProcessPluginsNetscapeJSNPObjectcpp">trunk/Source/WebKit2/WebProcess/Plugins/Netscape/JSNPObject.cpp</a></li>

<li><a href="#trunkSourceWebKit2WebProcessPluginsNetscapeNPJSObjectcpp">trunk/Source/WebKit2/WebProcess/Plugins/Netscape/NPJSObject.cpp</a></li>

<li><a href="#trunkSourceWebKit2WebProcessPluginsNetscapeNPRuntimeObjectMapcpp">trunk/Source/WebKit2/WebProcess/Plugins/Netscape/NPRuntimeObjectMap.cpp</a></li>

<li><a href="#trunkSourceWebKit2WebProcessWebPageWebFramecpp">trunk/Source/WebKit2/WebProcess/WebPage/WebFrame.cpp</a></li>

<li><a href="#trunkToolsChangeLog">trunk/Tools/ChangeLog</a></li>

<li><a href="#trunkToolsDumpRenderTreeTestRunnercpp">trunk/Tools/DumpRenderTree/TestRunner.cpp</a></li>

</ul>

</div>

<div id="patch">

<h3>Diff</h3>

<a id="trunkSourceJavaScriptCoreAPIJSCallbackConstructorcpp"></a>

<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/API/JSCallbackConstructor.cpp (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/JavaScriptCore/API/JSCallbackConstructor.cpp        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/JavaScriptCore/API/JSCallbackConstructor.cpp        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -48,7 +48,7 @@

</span><span class="cx"> void JSCallbackConstructor::finishCreation(JSGlobalObject* globalObject, JSClassRef jsClass)

</span><span class="cx"> {

</span><span class="cx">     Base::finishCreation(globalObject-&gt;vm());

</span><del>-    ASSERT(inherits(info()));

</del><ins>+    ASSERT(inherits(*vm(), info()));

</ins><span class="cx">     if (m_class)

</span><span class="cx">         JSClassRetain(jsClass);

</span><span class="cx"> }

</span></span></pre></div>

<a id="trunkSourceJavaScriptCoreAPIJSCallbackFunctioncpp"></a>

<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/API/JSCallbackFunction.cpp (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/JavaScriptCore/API/JSCallbackFunction.cpp        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/JavaScriptCore/API/JSCallbackFunction.cpp        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -52,7 +52,7 @@

</span><span class="cx"> void JSCallbackFunction::finishCreation(VM&amp; vm, const String&amp; name)

</span><span class="cx"> {

</span><span class="cx">     Base::finishCreation(vm, name);

</span><del>-    ASSERT(inherits(info()));

</del><ins>+    ASSERT(inherits(vm, info()));

</ins><span class="cx"> }

</span><span class="cx"> 

</span><span class="cx"> JSCallbackFunction* JSCallbackFunction::create(VM&amp; vm, JSGlobalObject* globalObject, JSObjectCallAsFunctionCallback callback, const String&amp; name)

</span></span></pre></div>

<a id="trunkSourceJavaScriptCoreAPIJSCallbackObjectFunctionsh"></a>

<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/API/JSCallbackObjectFunctions.h (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/JavaScriptCore/API/JSCallbackObjectFunctions.h        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/JavaScriptCore/API/JSCallbackObjectFunctions.h        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -44,15 +44,16 @@

</span><span class="cx"> template &lt;class Parent&gt;

</span><span class="cx"> inline JSCallbackObject&lt;Parent&gt;* JSCallbackObject&lt;Parent&gt;::asCallbackObject(JSValue value)

</span><span class="cx"> {

</span><del>-    ASSERT(asObject(value)-&gt;inherits(info()));

</del><ins>+    ASSERT(asObject(value)-&gt;inherits(*value.getObject()-&gt;vm(), info()));

</ins><span class="cx">     return jsCast&lt;JSCallbackObject*&gt;(asObject(value));

</span><span class="cx"> }

</span><span class="cx"> 

</span><span class="cx"> template &lt;class Parent&gt;

</span><del>-inline JSCallbackObject&lt;Parent&gt;* JSCallbackObject&lt;Parent&gt;::asCallbackObject(EncodedJSValue value)

</del><ins>+inline JSCallbackObject&lt;Parent&gt;* JSCallbackObject&lt;Parent&gt;::asCallbackObject(EncodedJSValue encodedValue)

</ins><span class="cx"> {

</span><del>-    ASSERT(asObject(JSValue::decode(value))-&gt;inherits(info()));

-    return jsCast&lt;JSCallbackObject*&gt;(asObject(JSValue::decode(value)));

</del><ins>+    JSValue value = JSValue::decode(encodedValue);

+    ASSERT(asObject(value)-&gt;inherits(*value.getObject()-&gt;vm(), info()));

+    return jsCast&lt;JSCallbackObject*&gt;(asObject(value));

</ins><span class="cx"> }

</span><span class="cx"> 

</span><span class="cx"> template &lt;class Parent&gt;

</span><span class="lines">@@ -90,8 +91,9 @@

</span><span class="cx"> template &lt;class Parent&gt;

</span><span class="cx"> void JSCallbackObject&lt;Parent&gt;::finishCreation(ExecState* exec)

</span><span class="cx"> {

</span><del>-    Base::finishCreation(exec-&gt;vm());

-    ASSERT(Parent::inherits(info()));

</del><ins>+    VM&amp; vm = exec-&gt;vm();

+    Base::finishCreation(vm);

+    ASSERT(Parent::inherits(vm, info()));

</ins><span class="cx">     init(exec);

</span><span class="cx"> }

</span><span class="cx"> 

</span><span class="lines">@@ -99,7 +101,7 @@

</span><span class="cx"> template &lt;class Parent&gt;

</span><span class="cx"> void JSCallbackObject&lt;Parent&gt;::finishCreation(VM&amp; vm)

</span><span class="cx"> {

</span><del>-    ASSERT(Parent::inherits(info()));

</del><ins>+    ASSERT(Parent::inherits(vm, info()));

</ins><span class="cx">     ASSERT(Parent::isGlobalObject());

</span><span class="cx">     Base::finishCreation(vm);

</span><span class="cx">     init(jsCast&lt;JSGlobalObject*&gt;(this)-&gt;globalExec());

</span></span></pre></div>

<a id="trunkSourceJavaScriptCoreAPIJSObjectRefcpp"></a>

<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/API/JSObjectRef.cpp (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/JavaScriptCore/API/JSObjectRef.cpp        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/JavaScriptCore/API/JSObjectRef.cpp        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -257,13 +257,14 @@

</span><span class="cx">         return;

</span><span class="cx">     }

</span><span class="cx">     ExecState* exec = toJS(ctx);

</span><ins>+    VM&amp; vm = exec-&gt;vm();

</ins><span class="cx">     JSLockHolder locker(exec);

</span><span class="cx"> 

</span><span class="cx">     JSObject* jsObject = toJS(object);

</span><span class="cx">     JSValue jsValue = toJS(exec, value);

</span><span class="cx"> 

</span><del>-    if (JSProxy* proxy = jsDynamicCast&lt;JSProxy*&gt;(jsObject)) {

-        if (JSGlobalObject* globalObject = jsDynamicCast&lt;JSGlobalObject*&gt;(proxy-&gt;target())) {

</del><ins>+    if (JSProxy* proxy = jsDynamicCast&lt;JSProxy*&gt;(vm, jsObject)) {

+        if (JSGlobalObject* globalObject = jsDynamicCast&lt;JSGlobalObject*&gt;(vm, proxy-&gt;target())) {

</ins><span class="cx">             globalObject-&gt;resetPrototype(exec-&gt;vm(), jsValue.isObject() ? jsValue : jsNull());

</span><span class="cx">             return;

</span><span class="cx">         }

</span><span class="lines">@@ -385,17 +386,18 @@

<span class="cx"> // during destruction.

</span><span class="cx"> static const ClassInfo* classInfoPrivate(JSObject* jsObject)

</span><span class="cx"> {

</span><del>-    VM* vm = jsObject-&gt;vm();

</del><ins>+    VM&amp; vm = *jsObject-&gt;vm();

</ins><span class="cx">     

</span><del>-    if (vm-&gt;currentlyDestructingCallbackObject != jsObject)

-        return jsObject-&gt;classInfo();

</del><ins>+    if (vm.currentlyDestructingCallbackObject != jsObject)

+        return jsObject-&gt;classInfo(vm);

</ins><span class="cx"> 

</span><del>-    return vm-&gt;currentlyDestructingCallbackObjectClassInfo;

</del><ins>+    return vm.currentlyDestructingCallbackObjectClassInfo;

</ins><span class="cx"> }

</span><span class="cx"> 

</span><span class="cx"> void* JSObjectGetPrivate(JSObjectRef object)

</span><span class="cx"> {

</span><span class="cx">     JSObject* jsObject = uncheckedToJS(object);

</span><ins>+    VM&amp; vm = *jsObject-&gt;vm();

</ins><span class="cx"> 

</span><span class="cx">     const ClassInfo* classInfo = classInfoPrivate(jsObject);

</span><span class="cx">     

</span><span class="lines">@@ -402,7 +404,7 @@

</span><span class="cx">     // Get wrapped object if proxied

</span><span class="cx">     if (classInfo-&gt;isSubClassOf(JSProxy::info())) {

</span><span class="cx">         jsObject = static_cast&lt;JSProxy*&gt;(jsObject)-&gt;target();

</span><del>-        classInfo = jsObject-&gt;classInfo();

</del><ins>+        classInfo = jsObject-&gt;classInfo(vm);

</ins><span class="cx">     }

</span><span class="cx"> 

</span><span class="cx">     if (classInfo-&gt;isSubClassOf(JSCallbackObject&lt;JSGlobalObject&gt;::info()))

</span><span class="lines">@@ -420,6 +422,7 @@

</span><span class="cx"> bool JSObjectSetPrivate(JSObjectRef object, void* data)

</span><span class="cx"> {

</span><span class="cx">     JSObject* jsObject = uncheckedToJS(object);

</span><ins>+    VM&amp; vm = *jsObject-&gt;vm();

</ins><span class="cx"> 

</span><span class="cx">     const ClassInfo* classInfo = classInfoPrivate(jsObject);

</span><span class="cx">     

</span><span class="lines">@@ -426,7 +429,7 @@

</span><span class="cx">     // Get wrapped object if proxied

</span><span class="cx">     if (classInfo-&gt;isSubClassOf(JSProxy::info())) {

</span><span class="cx">         jsObject = static_cast&lt;JSProxy*&gt;(jsObject)-&gt;target();

</span><del>-        classInfo = jsObject-&gt;classInfo();

</del><ins>+        classInfo = jsObject-&gt;classInfo(vm);

</ins><span class="cx">     }

</span><span class="cx"> 

</span><span class="cx">     if (classInfo-&gt;isSubClassOf(JSCallbackObject&lt;JSGlobalObject&gt;::info())) {

</span><span class="lines">@@ -450,21 +453,23 @@

</span><span class="cx"> JSValueRef JSObjectGetPrivateProperty(JSContextRef ctx, JSObjectRef object, JSStringRef propertyName)

</span><span class="cx"> {

</span><span class="cx">     ExecState* exec = toJS(ctx);

</span><ins>+    VM&amp; vm = exec-&gt;vm();

</ins><span class="cx">     JSLockHolder locker(exec);

</span><span class="cx">     JSObject* jsObject = toJS(object);

</span><span class="cx">     JSValue result;

</span><span class="cx">     Identifier name(propertyName-&gt;identifier(&amp;exec-&gt;vm()));

</span><span class="cx"> 

</span><ins>+

</ins><span class="cx">     // Get wrapped object if proxied

</span><del>-    if (jsObject-&gt;inherits(JSProxy::info()))

</del><ins>+    if (jsObject-&gt;inherits(vm, JSProxy::info()))

</ins><span class="cx">         jsObject = jsCast&lt;JSProxy*&gt;(jsObject)-&gt;target();

</span><span class="cx"> 

</span><del>-    if (jsObject-&gt;inherits(JSCallbackObject&lt;JSGlobalObject&gt;::info()))

</del><ins>+    if (jsObject-&gt;inherits(vm, JSCallbackObject&lt;JSGlobalObject&gt;::info()))

</ins><span class="cx">         result = jsCast&lt;JSCallbackObject&lt;JSGlobalObject&gt;*&gt;(jsObject)-&gt;getPrivateProperty(name);

</span><del>-    else if (jsObject-&gt;inherits(JSCallbackObject&lt;JSDestructibleObject&gt;::info()))

</del><ins>+    else if (jsObject-&gt;inherits(vm, JSCallbackObject&lt;JSDestructibleObject&gt;::info()))

</ins><span class="cx">         result = jsCast&lt;JSCallbackObject&lt;JSDestructibleObject&gt;*&gt;(jsObject)-&gt;getPrivateProperty(name);

</span><span class="cx"> #if JSC_OBJC_API_ENABLED

</span><del>-    else if (jsObject-&gt;inherits(JSCallbackObject&lt;JSAPIWrapperObject&gt;::info()))

</del><ins>+    else if (jsObject-&gt;inherits(vm, JSCallbackObject&lt;JSAPIWrapperObject&gt;::info()))

</ins><span class="cx">         result = jsCast&lt;JSCallbackObject&lt;JSAPIWrapperObject&gt;*&gt;(jsObject)-&gt;getPrivateProperty(name);

</span><span class="cx"> #endif

</span><span class="cx">     return toRef(exec, result);

</span><span class="lines">@@ -473,6 +478,7 @@

</span><span class="cx"> bool JSObjectSetPrivateProperty(JSContextRef ctx, JSObjectRef object, JSStringRef propertyName, JSValueRef value)

</span><span class="cx"> {

</span><span class="cx">     ExecState* exec = toJS(ctx);

</span><ins>+    VM&amp; vm = exec-&gt;vm();

</ins><span class="cx">     JSLockHolder locker(exec);

</span><span class="cx">     JSObject* jsObject = toJS(object);

</span><span class="cx">     JSValue jsValue = value ? toJS(exec, value) : JSValue();

</span><span class="lines">@@ -479,19 +485,19 @@

</span><span class="cx">     Identifier name(propertyName-&gt;identifier(&amp;exec-&gt;vm()));

</span><span class="cx"> 

</span><span class="cx">     // Get wrapped object if proxied

</span><del>-    if (jsObject-&gt;inherits(JSProxy::info()))

</del><ins>+    if (jsObject-&gt;inherits(vm, JSProxy::info()))

</ins><span class="cx">         jsObject = jsCast&lt;JSProxy*&gt;(jsObject)-&gt;target();

</span><span class="cx"> 

</span><del>-    if (jsObject-&gt;inherits(JSCallbackObject&lt;JSGlobalObject&gt;::info())) {

</del><ins>+    if (jsObject-&gt;inherits(vm, JSCallbackObject&lt;JSGlobalObject&gt;::info())) {

</ins><span class="cx">         jsCast&lt;JSCallbackObject&lt;JSGlobalObject&gt;*&gt;(jsObject)-&gt;setPrivateProperty(exec-&gt;vm(), name, jsValue);

</span><span class="cx">         return true;

</span><span class="cx">     }

</span><del>-    if (jsObject-&gt;inherits(JSCallbackObject&lt;JSDestructibleObject&gt;::info())) {

</del><ins>+    if (jsObject-&gt;inherits(vm, JSCallbackObject&lt;JSDestructibleObject&gt;::info())) {

</ins><span class="cx">         jsCast&lt;JSCallbackObject&lt;JSDestructibleObject&gt;*&gt;(jsObject)-&gt;setPrivateProperty(exec-&gt;vm(), name, jsValue);

</span><span class="cx">         return true;

</span><span class="cx">     }

</span><span class="cx"> #if JSC_OBJC_API_ENABLED

</span><del>-    if (jsObject-&gt;inherits(JSCallbackObject&lt;JSAPIWrapperObject&gt;::info())) {

</del><ins>+    if (jsObject-&gt;inherits(vm, JSCallbackObject&lt;JSAPIWrapperObject&gt;::info())) {

</ins><span class="cx">         jsCast&lt;JSCallbackObject&lt;JSAPIWrapperObject&gt;*&gt;(jsObject)-&gt;setPrivateProperty(exec-&gt;vm(), name, jsValue);

</span><span class="cx">         return true;

</span><span class="cx">     }

</span><span class="lines">@@ -502,24 +508,25 @@

</span><span class="cx"> bool JSObjectDeletePrivateProperty(JSContextRef ctx, JSObjectRef object, JSStringRef propertyName)

</span><span class="cx"> {

</span><span class="cx">     ExecState* exec = toJS(ctx);

</span><ins>+    VM&amp; vm = exec-&gt;vm();

</ins><span class="cx">     JSLockHolder locker(exec);

</span><span class="cx">     JSObject* jsObject = toJS(object);

</span><span class="cx">     Identifier name(propertyName-&gt;identifier(&amp;exec-&gt;vm()));

</span><span class="cx"> 

</span><span class="cx">     // Get wrapped object if proxied

</span><del>-    if (jsObject-&gt;inherits(JSProxy::info()))

</del><ins>+    if (jsObject-&gt;inherits(vm, JSProxy::info()))

</ins><span class="cx">         jsObject = jsCast&lt;JSProxy*&gt;(jsObject)-&gt;target();

</span><span class="cx"> 

</span><del>-    if (jsObject-&gt;inherits(JSCallbackObject&lt;JSGlobalObject&gt;::info())) {

</del><ins>+    if (jsObject-&gt;inherits(vm, JSCallbackObject&lt;JSGlobalObject&gt;::info())) {

</ins><span class="cx">         jsCast&lt;JSCallbackObject&lt;JSGlobalObject&gt;*&gt;(jsObject)-&gt;deletePrivateProperty(name);

</span><span class="cx">         return true;

</span><span class="cx">     }

</span><del>-    if (jsObject-&gt;inherits(JSCallbackObject&lt;JSDestructibleObject&gt;::info())) {

</del><ins>+    if (jsObject-&gt;inherits(vm, JSCallbackObject&lt;JSDestructibleObject&gt;::info())) {

</ins><span class="cx">         jsCast&lt;JSCallbackObject&lt;JSDestructibleObject&gt;*&gt;(jsObject)-&gt;deletePrivateProperty(name);

</span><span class="cx">         return true;

</span><span class="cx">     }

</span><span class="cx"> #if JSC_OBJC_API_ENABLED

</span><del>-    if (jsObject-&gt;inherits(JSCallbackObject&lt;JSAPIWrapperObject&gt;::info())) {

</del><ins>+    if (jsObject-&gt;inherits(vm, JSCallbackObject&lt;JSAPIWrapperObject&gt;::info())) {

</ins><span class="cx">         jsCast&lt;JSCallbackObject&lt;JSAPIWrapperObject&gt;*&gt;(jsObject)-&gt;deletePrivateProperty(name);

</span><span class="cx">         return true;

</span><span class="cx">     }

</span></span></pre></div>

<a id="trunkSourceJavaScriptCoreAPIJSTypedArraycpp"></a>

<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/API/JSTypedArray.cpp (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/JavaScriptCore/API/JSTypedArray.cpp        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/JavaScriptCore/API/JSTypedArray.cpp        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -140,6 +140,7 @@

</span><span class="cx"> {

</span><span class="cx"> 

</span><span class="cx">     ExecState* exec = toJS(ctx);

</span><ins>+    VM&amp; vm = exec-&gt;vm();

</ins><span class="cx">     JSLockHolder locker(exec);

</span><span class="cx"> 

</span><span class="cx">     JSValue value = toJS(exec, valueRef);

</span><span class="lines">@@ -147,10 +148,10 @@

</span><span class="cx">         return kJSTypedArrayTypeNone;

</span><span class="cx">     JSObject* object = value.getObject();

</span><span class="cx"> 

</span><del>-    if (jsDynamicCast&lt;JSArrayBuffer*&gt;(object))

</del><ins>+    if (jsDynamicCast&lt;JSArrayBuffer*&gt;(vm, object))

</ins><span class="cx">         return kJSTypedArrayTypeArrayBuffer;

</span><span class="cx"> 

</span><del>-    return toJSTypedArrayType(object-&gt;classInfo()-&gt;typedArrayStorageType);

</del><ins>+    return toJSTypedArrayType(object-&gt;classInfo(vm)-&gt;typedArrayStorageType);

</ins><span class="cx"> }

</span><span class="cx"> 

</span><span class="cx"> JSObjectRef JSObjectMakeTypedArray(JSContextRef ctx, JSTypedArrayType arrayType, size_t length, JSValueRef* exception)

</span><span class="lines">@@ -193,12 +194,13 @@

</span><span class="cx"> JSObjectRef JSObjectMakeTypedArrayWithArrayBuffer(JSContextRef ctx, JSTypedArrayType arrayType, JSObjectRef jsBufferRef, JSValueRef* exception)

</span><span class="cx"> {

</span><span class="cx">     ExecState* exec = toJS(ctx);

</span><ins>+    VM&amp; vm = exec-&gt;vm();

</ins><span class="cx">     JSLockHolder locker(exec);

</span><span class="cx"> 

</span><span class="cx">     if (arrayType == kJSTypedArrayTypeNone || arrayType == kJSTypedArrayTypeArrayBuffer)

</span><span class="cx">         return nullptr;

</span><span class="cx"> 

</span><del>-    JSArrayBuffer* jsBuffer = jsDynamicCast&lt;JSArrayBuffer*&gt;(toJS(jsBufferRef));

</del><ins>+    JSArrayBuffer* jsBuffer = jsDynamicCast&lt;JSArrayBuffer*&gt;(vm, toJS(jsBufferRef));

</ins><span class="cx">     if (!jsBuffer) {

</span><span class="cx">         setException(exec, exception, createTypeError(exec, &quot;JSObjectMakeTypedArrayWithArrayBuffer expects buffer to be an Array Buffer object&quot;));

</span><span class="cx">         return nullptr;

</span><span class="lines">@@ -216,12 +218,13 @@

</span><span class="cx"> JSObjectRef JSObjectMakeTypedArrayWithArrayBufferAndOffset(JSContextRef ctx, JSTypedArrayType arrayType, JSObjectRef jsBufferRef, size_t offset, size_t length, JSValueRef* exception)

</span><span class="cx"> {

</span><span class="cx">     ExecState* exec = toJS(ctx);

</span><ins>+    VM&amp; vm = exec-&gt;vm();

</ins><span class="cx">     JSLockHolder locker(exec);

</span><span class="cx"> 

</span><span class="cx">     if (arrayType == kJSTypedArrayTypeNone || arrayType == kJSTypedArrayTypeArrayBuffer)

</span><span class="cx">         return nullptr;

</span><span class="cx"> 

</span><del>-    JSArrayBuffer* jsBuffer = jsDynamicCast&lt;JSArrayBuffer*&gt;(toJS(jsBufferRef));

</del><ins>+    JSArrayBuffer* jsBuffer = jsDynamicCast&lt;JSArrayBuffer*&gt;(vm, toJS(jsBufferRef));

</ins><span class="cx">     if (!jsBuffer) {

</span><span class="cx">         setException(exec, exception, createTypeError(exec, &quot;JSObjectMakeTypedArrayWithArrayBuffer expects buffer to be an Array Buffer object&quot;));

</span><span class="cx">         return nullptr;

</span><span class="lines">@@ -236,10 +239,11 @@

</span><span class="cx"> void* JSObjectGetTypedArrayBytesPtr(JSContextRef ctx, JSObjectRef objectRef, JSValueRef*)

</span><span class="cx"> {

</span><span class="cx">     ExecState* exec = toJS(ctx);

</span><ins>+    VM&amp; vm = exec-&gt;vm();

</ins><span class="cx">     JSLockHolder locker(exec);

</span><span class="cx">     JSObject* object = toJS(objectRef);

</span><span class="cx"> 

</span><del>-    if (JSArrayBufferView* typedArray = jsDynamicCast&lt;JSArrayBufferView*&gt;(object)) {

</del><ins>+    if (JSArrayBufferView* typedArray = jsDynamicCast&lt;JSArrayBufferView*&gt;(vm, object)) {

</ins><span class="cx">         ArrayBuffer* buffer = typedArray-&gt;possiblySharedBuffer();

</span><span class="cx">         buffer-&gt;pinAndLock();

</span><span class="cx">         return buffer-&gt;data();

</span><span class="lines">@@ -247,31 +251,37 @@

</span><span class="cx">     return nullptr;

</span><span class="cx"> }

</span><span class="cx"> 

</span><del>-size_t JSObjectGetTypedArrayLength(JSContextRef, JSObjectRef objectRef, JSValueRef*)

</del><ins>+size_t JSObjectGetTypedArrayLength(JSContextRef ctx, JSObjectRef objectRef, JSValueRef*)

</ins><span class="cx"> {

</span><ins>+    ExecState* exec = toJS(ctx);

+    VM&amp; vm = exec-&gt;vm();

</ins><span class="cx">     JSObject* object = toJS(objectRef);

</span><span class="cx"> 

</span><del>-    if (JSArrayBufferView* typedArray = jsDynamicCast&lt;JSArrayBufferView*&gt;(object))

</del><ins>+    if (JSArrayBufferView* typedArray = jsDynamicCast&lt;JSArrayBufferView*&gt;(vm, object))

</ins><span class="cx">         return typedArray-&gt;length();

</span><span class="cx"> 

</span><span class="cx">     return 0;

</span><span class="cx"> }

</span><span class="cx"> 

</span><del>-size_t JSObjectGetTypedArrayByteLength(JSContextRef, JSObjectRef objectRef, JSValueRef*)

</del><ins>+size_t JSObjectGetTypedArrayByteLength(JSContextRef ctx, JSObjectRef objectRef, JSValueRef*)

</ins><span class="cx"> {

</span><ins>+    ExecState* exec = toJS(ctx);

+    VM&amp; vm = exec-&gt;vm();

</ins><span class="cx">     JSObject* object = toJS(objectRef);

</span><span class="cx"> 

</span><del>-    if (JSArrayBufferView* typedArray = jsDynamicCast&lt;JSArrayBufferView*&gt;(object))

-        return typedArray-&gt;length() * elementSize(typedArray-&gt;classInfo()-&gt;typedArrayStorageType);

</del><ins>+    if (JSArrayBufferView* typedArray = jsDynamicCast&lt;JSArrayBufferView*&gt;(vm, object))

+        return typedArray-&gt;length() * elementSize(typedArray-&gt;classInfo(vm)-&gt;typedArrayStorageType);

</ins><span class="cx"> 

</span><span class="cx">     return 0;

</span><span class="cx"> }

</span><span class="cx"> 

</span><del>-size_t JSObjectGetTypedArrayByteOffset(JSContextRef, JSObjectRef objectRef, JSValueRef*)

</del><ins>+size_t JSObjectGetTypedArrayByteOffset(JSContextRef ctx, JSObjectRef objectRef, JSValueRef*)

</ins><span class="cx"> {

</span><ins>+    ExecState* exec = toJS(ctx);

+    VM&amp; vm = exec-&gt;vm();

</ins><span class="cx">     JSObject* object = toJS(objectRef);

</span><span class="cx"> 

</span><del>-    if (JSArrayBufferView* typedArray = jsDynamicCast&lt;JSArrayBufferView*&gt;(object))

</del><ins>+    if (JSArrayBufferView* typedArray = jsDynamicCast&lt;JSArrayBufferView*&gt;(vm, object))

</ins><span class="cx">         return typedArray-&gt;byteOffset();

</span><span class="cx"> 

</span><span class="cx">     return 0;

</span><span class="lines">@@ -280,10 +290,11 @@

</span><span class="cx"> JSObjectRef JSObjectGetTypedArrayBuffer(JSContextRef ctx, JSObjectRef objectRef, JSValueRef*)

</span><span class="cx"> {

</span><span class="cx">     ExecState* exec = toJS(ctx);

</span><ins>+    VM&amp; vm = exec-&gt;vm();

</ins><span class="cx">     JSLockHolder locker(exec);

</span><span class="cx">     JSObject* object = toJS(objectRef);

</span><span class="cx"> 

</span><del>-    if (JSArrayBufferView* typedArray = jsDynamicCast&lt;JSArrayBufferView*&gt;(object))

</del><ins>+    if (JSArrayBufferView* typedArray = jsDynamicCast&lt;JSArrayBufferView*&gt;(vm, object))

</ins><span class="cx">         return toRef(exec-&gt;vm().m_typedArrayController-&gt;toJS(exec, typedArray-&gt;globalObject(), typedArray-&gt;possiblySharedBuffer()));

</span><span class="cx"> 

</span><span class="cx">     return nullptr;

</span><span class="lines">@@ -309,10 +320,11 @@

</span><span class="cx"> void* JSObjectGetArrayBufferBytesPtr(JSContextRef ctx, JSObjectRef objectRef, JSValueRef*)

</span><span class="cx"> {

</span><span class="cx">     ExecState* exec = toJS(ctx);

</span><ins>+    VM&amp; vm = exec-&gt;vm();

</ins><span class="cx">     JSLockHolder locker(exec);

</span><span class="cx">     JSObject* object = toJS(objectRef);

</span><span class="cx"> 

</span><del>-    if (JSArrayBuffer* jsBuffer = jsDynamicCast&lt;JSArrayBuffer*&gt;(object)) {

</del><ins>+    if (JSArrayBuffer* jsBuffer = jsDynamicCast&lt;JSArrayBuffer*&gt;(vm, object)) {

</ins><span class="cx">         ArrayBuffer* buffer = jsBuffer-&gt;impl();

</span><span class="cx">         buffer-&gt;pinAndLock();

</span><span class="cx">         return buffer-&gt;data();

</span><span class="lines">@@ -320,11 +332,13 @@

</span><span class="cx">     return nullptr;

</span><span class="cx"> }

</span><span class="cx"> 

</span><del>-size_t JSObjectGetArrayBufferByteLength(JSContextRef, JSObjectRef objectRef, JSValueRef*)

</del><ins>+size_t JSObjectGetArrayBufferByteLength(JSContextRef ctx, JSObjectRef objectRef, JSValueRef*)

</ins><span class="cx"> {

</span><ins>+    ExecState* exec = toJS(ctx);

+    VM&amp; vm = exec-&gt;vm();

</ins><span class="cx">     JSObject* object = toJS(objectRef);

</span><span class="cx"> 

</span><del>-    if (JSArrayBuffer* jsBuffer = jsDynamicCast&lt;JSArrayBuffer*&gt;(object))

</del><ins>+    if (JSArrayBuffer* jsBuffer = jsDynamicCast&lt;JSArrayBuffer*&gt;(vm, object))

</ins><span class="cx">         return jsBuffer-&gt;impl()-&gt;byteLength();

</span><span class="cx">     

</span><span class="cx">     return 0;

</span></span></pre></div>

<a id="trunkSourceJavaScriptCoreAPIJSValuemm"></a>

<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/API/JSValue.mm (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/JavaScriptCore/API/JSValue.mm        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/JavaScriptCore/API/JSValue.mm        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -571,16 +571,16 @@

</span><span class="cx"> 

</span><span class="cx"> @end

</span><span class="cx"> 

</span><del>-inline bool isDate(JSObjectRef object, JSGlobalContextRef context)

</del><ins>+inline bool isDate(JSC::VM&amp; vm, JSObjectRef object, JSGlobalContextRef context)

</ins><span class="cx"> {

</span><span class="cx">     JSC::JSLockHolder locker(toJS(context));

</span><del>-    return toJS(object)-&gt;inherits(JSC::DateInstance::info());

</del><ins>+    return toJS(object)-&gt;inherits(vm, JSC::DateInstance::info());

</ins><span class="cx"> }

</span><span class="cx"> 

</span><del>-inline bool isArray(JSObjectRef object, JSGlobalContextRef context)

</del><ins>+inline bool isArray(JSC::VM&amp; vm, JSObjectRef object, JSGlobalContextRef context)

</ins><span class="cx"> {

</span><span class="cx">     JSC::JSLockHolder locker(toJS(context));

</span><del>-    return toJS(object)-&gt;inherits(JSC::JSArray::info());

</del><ins>+    return toJS(object)-&gt;inherits(vm, JSC::JSArray::info());

</ins><span class="cx"> }

</span><span class="cx"> 

</span><span class="cx"> @implementation JSValue(Internal)

</span><span class="lines">@@ -656,6 +656,9 @@

</span><span class="cx"> 

</span><span class="cx"> static JSContainerConvertor::Task valueToObjectWithoutCopy(JSGlobalContextRef context, JSValueRef value)

</span><span class="cx"> {

</span><ins>+    JSC::ExecState* exec = toJS(context);

+    JSC::VM&amp; vm = exec-&gt;vm();

+

</ins><span class="cx">     if (!JSValueIsObject(context, value)) {

</span><span class="cx">         id primitive;

</span><span class="cx">         if (JSValueIsBoolean(context, value))

</span><span class="lines">@@ -685,10 +688,10 @@

</span><span class="cx">     if (id wrapped = tryUnwrapObjcObject(context, object))

</span><span class="cx">         return (JSContainerConvertor::Task){ object, wrapped, ContainerNone };

</span><span class="cx"> 

</span><del>-    if (isDate(object, context))

</del><ins>+    if (isDate(vm, object, context))

</ins><span class="cx">         return (JSContainerConvertor::Task){ object, [NSDate dateWithTimeIntervalSince1970:JSValueToNumber(context, object, 0) / 1000.0], ContainerNone };

</span><span class="cx"> 

</span><del>-    if (isArray(object, context))

</del><ins>+    if (isArray(vm, object, context))

</ins><span class="cx">         return (JSContainerConvertor::Task){ object, [NSMutableArray array], ContainerArray };

</span><span class="cx"> 

</span><span class="cx">     return (JSContainerConvertor::Task){ object, [NSMutableDictionary dictionary], ContainerDictionary };

</span></span></pre></div>

<a id="trunkSourceJavaScriptCoreAPIJSValueRefcpp"></a>

<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/API/JSValueRef.cpp (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/JavaScriptCore/API/JSValueRef.cpp        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/JavaScriptCore/API/JSValueRef.cpp        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -169,9 +169,10 @@

</span><span class="cx">         return false;

</span><span class="cx">     }

</span><span class="cx">     ExecState* exec = toJS(ctx);

</span><ins>+    VM&amp; vm = exec-&gt;vm();

</ins><span class="cx">     JSLockHolder locker(exec);

</span><span class="cx"> 

</span><del>-    return toJS(exec, value).inherits(JSArray::info());

</del><ins>+    return toJS(exec, value).inherits(vm, JSArray::info());

</ins><span class="cx"> }

</span><span class="cx"> 

</span><span class="cx"> bool JSValueIsDate(JSContextRef ctx, JSValueRef value)

</span><span class="lines">@@ -181,9 +182,10 @@

</span><span class="cx">         return false;

</span><span class="cx">     }

</span><span class="cx">     ExecState* exec = toJS(ctx);

</span><ins>+    VM&amp; vm = exec-&gt;vm();

</ins><span class="cx">     JSLockHolder locker(exec);

</span><span class="cx"> 

</span><del>-    return toJS(exec, value).inherits(DateInstance::info());

</del><ins>+    return toJS(exec, value).inherits(vm, DateInstance::info());

</ins><span class="cx"> }

</span><span class="cx"> 

</span><span class="cx"> bool JSValueIsObjectOfClass(JSContextRef ctx, JSValueRef value, JSClassRef jsClass)

</span><span class="lines">@@ -193,20 +195,21 @@

</span><span class="cx">         return false;

</span><span class="cx">     }

</span><span class="cx">     ExecState* exec = toJS(ctx);

</span><ins>+    VM&amp; vm = exec-&gt;vm();

</ins><span class="cx">     JSLockHolder locker(exec);

</span><span class="cx"> 

</span><span class="cx">     JSValue jsValue = toJS(exec, value);

</span><span class="cx">     

</span><span class="cx">     if (JSObject* o = jsValue.getObject()) {

</span><del>-        if (o-&gt;inherits(JSProxy::info()))

</del><ins>+        if (o-&gt;inherits(vm, JSProxy::info()))

</ins><span class="cx">             o = jsCast&lt;JSProxy*&gt;(o)-&gt;target();

</span><span class="cx"> 

</span><del>-        if (o-&gt;inherits(JSCallbackObject&lt;JSGlobalObject&gt;::info()))

</del><ins>+        if (o-&gt;inherits(vm, JSCallbackObject&lt;JSGlobalObject&gt;::info()))

</ins><span class="cx">             return jsCast&lt;JSCallbackObject&lt;JSGlobalObject&gt;*&gt;(o)-&gt;inherits(jsClass);

</span><del>-        if (o-&gt;inherits(JSCallbackObject&lt;JSDestructibleObject&gt;::info()))

</del><ins>+        if (o-&gt;inherits(vm, JSCallbackObject&lt;JSDestructibleObject&gt;::info()))

</ins><span class="cx">             return jsCast&lt;JSCallbackObject&lt;JSDestructibleObject&gt;*&gt;(o)-&gt;inherits(jsClass);

</span><span class="cx"> #if JSC_OBJC_API_ENABLED

</span><del>-        if (o-&gt;inherits(JSCallbackObject&lt;JSAPIWrapperObject&gt;::info()))

</del><ins>+        if (o-&gt;inherits(vm, JSCallbackObject&lt;JSAPIWrapperObject&gt;::info()))

</ins><span class="cx">             return jsCast&lt;JSCallbackObject&lt;JSAPIWrapperObject&gt;*&gt;(o)-&gt;inherits(jsClass);

</span><span class="cx"> #endif

</span><span class="cx">     }

</span></span></pre></div>

<a id="trunkSourceJavaScriptCoreAPIJSWeakObjectMapRefPrivatecpp"></a>

<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/API/JSWeakObjectMapRefPrivate.cpp (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/JavaScriptCore/API/JSWeakObjectMapRefPrivate.cpp        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/JavaScriptCore/API/JSWeakObjectMapRefPrivate.cpp        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -61,9 +61,9 @@

</span><span class="cx">     JSObject* obj = toJS(object);

</span><span class="cx">     if (!obj)

</span><span class="cx">         return;

</span><del>-    ASSERT(obj-&gt;inherits(JSProxy::info())

-        || obj-&gt;inherits(JSCallbackObject&lt;JSGlobalObject&gt;::info()) 

-        || obj-&gt;inherits(JSCallbackObject&lt;JSDestructibleObject&gt;::info()));

</del><ins>+    ASSERT(obj-&gt;inherits(exec-&gt;vm(), JSProxy::info())

+        || obj-&gt;inherits(exec-&gt;vm(), JSCallbackObject&lt;JSGlobalObject&gt;::info())

+        || obj-&gt;inherits(exec-&gt;vm(), JSCallbackObject&lt;JSDestructibleObject&gt;::info()));

</ins><span class="cx">     map-&gt;map().set(key, obj);

</span><span class="cx"> }

</span><span class="cx"> 

</span></span></pre></div>

<a id="trunkSourceJavaScriptCoreAPIJSWrapperMapmm"></a>

<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/API/JSWrapperMap.mm (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/JavaScriptCore/API/JSWrapperMap.mm        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/JavaScriptCore/API/JSWrapperMap.mm        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -639,9 +639,10 @@

</span><span class="cx">     JSObjectRef object = JSValueToObject(context, value, &amp;exception);

</span><span class="cx">     ASSERT(!exception);

</span><span class="cx">     JSC::JSLockHolder locker(toJS(context));

</span><del>-    if (toJS(object)-&gt;inherits(JSC::JSCallbackObject&lt;JSC::JSAPIWrapperObject&gt;::info()))

</del><ins>+    JSC::VM&amp; vm = toJS(context)-&gt;vm();

+    if (toJS(object)-&gt;inherits(vm, JSC::JSCallbackObject&lt;JSC::JSAPIWrapperObject&gt;::info()))

</ins><span class="cx">         return (id)JSC::jsCast&lt;JSC::JSAPIWrapperObject*&gt;(toJS(object))-&gt;wrappedObject();

</span><del>-    if (id target = tryUnwrapConstructor(object))

</del><ins>+    if (id target = tryUnwrapConstructor(&amp;vm, object))

</ins><span class="cx">         return target;

</span><span class="cx">     return nil;

</span><span class="cx"> }

</span></span></pre></div>

<a id="trunkSourceJavaScriptCoreAPIObjCCallbackFunctionh"></a>

<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/API/ObjCCallbackFunction.h (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/JavaScriptCore/API/ObjCCallbackFunction.h        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/JavaScriptCore/API/ObjCCallbackFunction.h        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -36,7 +36,7 @@

</span><span class="cx"> JSObjectRef objCCallbackFunctionForBlock(JSContext *, id);

</span><span class="cx"> JSObjectRef objCCallbackFunctionForInit(JSContext *, Class, Protocol *, SEL, const char* types);

</span><span class="cx"> 

</span><del>-id tryUnwrapConstructor(JSObjectRef);

</del><ins>+id tryUnwrapConstructor(JSC::VM*, JSObjectRef);

</ins><span class="cx"> #endif

</span><span class="cx"> 

</span><span class="cx"> namespace JSC {

</span></span></pre></div>

<a id="trunkSourceJavaScriptCoreAPIObjCCallbackFunctionmm"></a>

<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/API/ObjCCallbackFunction.mm (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/JavaScriptCore/API/ObjCCallbackFunction.mm        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/JavaScriptCore/API/ObjCCallbackFunction.mm        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -715,9 +715,9 @@

</span><span class="cx">     return objCCallbackFunctionForInvocation(context, invocation, CallbackBlock, nil, signature);

</span><span class="cx"> }

</span><span class="cx"> 

</span><del>-id tryUnwrapConstructor(JSObjectRef object)

</del><ins>+id tryUnwrapConstructor(JSC::VM* vm, JSObjectRef object)

</ins><span class="cx"> {

</span><del>-    if (!toJS(object)-&gt;inherits(JSC::ObjCCallbackFunction::info()))

</del><ins>+    if (!toJS(object)-&gt;inherits(*vm, JSC::ObjCCallbackFunction::info()))

</ins><span class="cx">         return nil;

</span><span class="cx">     JSC::ObjCCallbackFunctionImpl* impl = static_cast&lt;JSC::ObjCCallbackFunction*&gt;(toJS(object))-&gt;impl();

</span><span class="cx">     if (!impl-&gt;isConstructible())

</span></span></pre></div>

<a id="trunkSourceJavaScriptCoreChangeLog"></a>

<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/ChangeLog (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/JavaScriptCore/ChangeLog        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/JavaScriptCore/ChangeLog        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -1,3 +1,667 @@

</span><ins>+2017-01-26  Keith Miller  &lt;keith_miller@apple.com&gt;

+

+        classInfo should take a VM so it is not materialized from the object on each call

+        https://bugs.webkit.org/show_bug.cgi?id=167424

+

+        Rubber Stamped by Michael Saboff.

+

+        Previously, classInfo() would get the VM from the target's

+        MarkedBlock.  Most callers already have a VM on hand, so it is

+        wasteful to compute the VM from the marked block every time. This

+        patch refactors some of the most common callers of classInfo(),

+        jsDynamicCast and inherits to take a VM as well.

+

+        * API/JSCallbackConstructor.cpp:

+        (JSC::JSCallbackConstructor::finishCreation):

+        * API/JSCallbackFunction.cpp:

+        (JSC::JSCallbackFunction::finishCreation):

+        * API/JSCallbackObjectFunctions.h:

+        (JSC::JSCallbackObject&lt;Parent&gt;::asCallbackObject):

+        (JSC::JSCallbackObject&lt;Parent&gt;::finishCreation):

+        * API/JSObjectRef.cpp:

+        (JSObjectSetPrototype):

+        (classInfoPrivate):

+        (JSObjectGetPrivate):

+        (JSObjectSetPrivate):

+        (JSObjectGetPrivateProperty):

+        (JSObjectSetPrivateProperty):

+        (JSObjectDeletePrivateProperty):

+        * API/JSTypedArray.cpp:

+        (JSValueGetTypedArrayType):

+        (JSObjectMakeTypedArrayWithArrayBuffer):

+        (JSObjectMakeTypedArrayWithArrayBufferAndOffset):

+        (JSObjectGetTypedArrayBytesPtr):

+        (JSObjectGetTypedArrayLength):

+        (JSObjectGetTypedArrayByteLength):

+        (JSObjectGetTypedArrayByteOffset):

+        (JSObjectGetTypedArrayBuffer):

+        (JSObjectGetArrayBufferBytesPtr):

+        (JSObjectGetArrayBufferByteLength):

+        * API/JSValue.mm:

+        (isDate):

+        (isArray):

+        (valueToObjectWithoutCopy):

+        * API/JSValueRef.cpp:

+        (JSValueIsArray):

+        (JSValueIsDate):

+        (JSValueIsObjectOfClass):

+        * API/JSWeakObjectMapRefPrivate.cpp:

+        * API/JSWrapperMap.mm:

+        (tryUnwrapObjcObject):

+        * API/ObjCCallbackFunction.h:

+        * API/ObjCCallbackFunction.mm:

+        (tryUnwrapConstructor):

+        * bindings/ScriptFunctionCall.cpp:

+        (Deprecated::ScriptFunctionCall::call):

+        * bytecode/CallVariant.h:

+        (JSC::CallVariant::internalFunction):

+        (JSC::CallVariant::function):

+        (JSC::CallVariant::isClosureCall):

+        (JSC::CallVariant::executable):

+        (JSC::CallVariant::functionExecutable):

+        (JSC::CallVariant::nativeExecutable):

+        * bytecode/CodeBlock.cpp:

+        (JSC::CodeBlock::finishCreation):

+        (JSC::CodeBlock::setConstantRegisters):

+        (JSC::CodeBlock::replacement):

+        (JSC::CodeBlock::computeCapabilityLevel):

+        (JSC::CodeBlock::nameForRegister):

+        * bytecode/ObjectAllocationProfile.h:

+        (JSC::ObjectAllocationProfile::possibleDefaultPropertyCount):

+        * bytecode/ObjectPropertyCondition.cpp:

+        (JSC::ObjectPropertyCondition::attemptToMakeEquivalenceWithoutBarrier):

+        * bytecode/ObjectPropertyCondition.h:

+        (JSC::ObjectPropertyCondition::isValidValueForPresence):

+        * bytecode/PropertyCondition.cpp:

+        (JSC::PropertyCondition::isValidValueForAttributes):

+        (JSC::PropertyCondition::isValidValueForPresence):

+        (JSC::PropertyCondition::attemptToMakeEquivalenceWithoutBarrier):

+        * bytecode/PropertyCondition.h:

+        * bytecode/SpeculatedType.cpp:

+        (JSC::speculationFromCell):

+        * debugger/Debugger.cpp:

+        * debugger/DebuggerCallFrame.cpp:

+        (JSC::DebuggerCallFrame::functionName):

+        (JSC::DebuggerCallFrame::scope):

+        (JSC::DebuggerCallFrame::type):

+        * debugger/DebuggerScope.cpp:

+        (JSC::DebuggerScope::name):

+        (JSC::DebuggerScope::location):

+        * dfg/DFGAbstractInterpreter.h:

+        * dfg/DFGAbstractInterpreterInlines.h:

+        (JSC::DFG::AbstractInterpreter&lt;AbstractStateType&gt;::AbstractInterpreter):

+        (JSC::DFG::AbstractInterpreter&lt;AbstractStateType&gt;::executeEffects):

+        * dfg/DFGByteCodeParser.cpp:

+        (JSC::DFG::ByteCodeParser::get):

+        (JSC::DFG::ByteCodeParser::handleIntrinsicCall):

+        (JSC::DFG::ByteCodeParser::planLoad):

+        (JSC::DFG::ByteCodeParser::checkPresenceLike):

+        (JSC::DFG::ByteCodeParser::load):

+        (JSC::DFG::ByteCodeParser::parseBlock):

+        * dfg/DFGConstantFoldingPhase.cpp:

+        (JSC::DFG::ConstantFoldingPhase::foldConstants):

+        * dfg/DFGDesiredWeakReferences.cpp:

+        (JSC::DFG::DesiredWeakReferences::reallyAdd):

+        * dfg/DFGFixupPhase.cpp:

+        (JSC::DFG::FixupPhase::fixupMakeRope):

+        * dfg/DFGFrozenValue.h:

+        (JSC::DFG::FrozenValue::FrozenValue):

+        (JSC::DFG::FrozenValue::dynamicCast):

+        * dfg/DFGGraph.cpp:

+        (JSC::DFG::Graph::dump):

+        (JSC::DFG::Graph::tryGetConstantClosureVar):

+        (JSC::DFG::Graph::tryGetFoldableView):

+        (JSC::DFG::Graph::getRegExpPrototypeProperty):

+        (JSC::DFG::Graph::isStringPrototypeMethodSane):

+        (JSC::DFG::Graph::canOptimizeStringObjectAccess):

+        * dfg/DFGLazyJSValue.cpp:

+        (JSC::DFG::LazyJSValue::tryGetStringImpl):

+        (JSC::DFG::LazyJSValue::tryGetString):

+        * dfg/DFGLazyJSValue.h:

+        * dfg/DFGNode.cpp:

+        (JSC::DFG::Node::convertToPutStructureHint):

+        * dfg/DFGNode.h:

+        (JSC::DFG::Node::dynamicCastConstant):

+        (JSC::DFG::Node::castConstant):

+        * dfg/DFGOperations.cpp:

+        * dfg/DFGSafeToExecute.h:

+        (JSC::DFG::safeToExecute):

+        * dfg/DFGSpeculativeJIT.cpp:

+        (JSC::DFG::SpeculativeJIT::compileIn):

+        (JSC::DFG::SpeculativeJIT::compileMaterializeNewObject):

+        * dfg/DFGSpeculativeJIT32_64.cpp:

+        (JSC::DFG::SpeculativeJIT::emitCall):

+        (JSC::DFG::SpeculativeJIT::compile):

+        * dfg/DFGSpeculativeJIT64.cpp:

+        (JSC::DFG::SpeculativeJIT::emitCall):

+        (JSC::DFG::SpeculativeJIT::compile):

+        * dfg/DFGStrengthReductionPhase.cpp:

+        (JSC::DFG::StrengthReductionPhase::handleNode):

+        * ftl/FTLLowerDFGToB3.cpp:

+        (JSC::FTL::DFG::LowerDFGToB3::compileDirectCallOrConstruct):

+        (JSC::FTL::DFG::LowerDFGToB3::compileIn):

+        (JSC::FTL::DFG::LowerDFGToB3::compileMaterializeCreateActivation):

+        (JSC::FTL::DFG::LowerDFGToB3::compileStringReplace):

+        * ftl/FTLOperations.cpp:

+        (JSC::FTL::operationMaterializeObjectInOSR):

+        * heap/CodeBlockSet.cpp:

+        (JSC::CodeBlockSet::lastChanceToFinalize):

+        (JSC::CodeBlockSet::deleteUnmarkedAndUnreferenced):

+        * heap/CodeBlockSet.h:

+        * heap/GCAssertions.h:

+        * heap/Heap.cpp:

+        (JSC::Heap::lastChanceToFinalize):

+        (JSC::Heap::protectedObjectTypeCounts):

+        (JSC::Heap::objectTypeCounts):

+        (JSC::Heap::deleteUnmarkedCompiledCode):

+        * heap/HeapSnapshotBuilder.cpp:

+        (JSC::HeapSnapshotBuilder::json):

+        * heap/SlotVisitor.cpp:

+        (JSC::validate):

+        * inspector/InjectedScriptHost.h:

+        * inspector/JSGlobalObjectInspectorController.cpp:

+        (Inspector::JSGlobalObjectInspectorController::reportAPIException):

+        * inspector/JSInjectedScriptHost.cpp:

+        (Inspector::JSInjectedScriptHost::finishCreation):

+        (Inspector::JSInjectedScriptHost::isHTMLAllCollection):

+        (Inspector::JSInjectedScriptHost::subtype):

+        (Inspector::JSInjectedScriptHost::functionDetails):

+        (Inspector::JSInjectedScriptHost::getInternalProperties):

+        (Inspector::JSInjectedScriptHost::proxyTargetValue):

+        (Inspector::JSInjectedScriptHost::weakMapSize):

+        (Inspector::JSInjectedScriptHost::weakMapEntries):

+        (Inspector::JSInjectedScriptHost::weakSetSize):

+        (Inspector::JSInjectedScriptHost::weakSetEntries):

+        (Inspector::JSInjectedScriptHost::iteratorEntries):

+        * inspector/JSInjectedScriptHostPrototype.cpp:

+        (Inspector::JSInjectedScriptHostPrototype::finishCreation):

+        (Inspector::jsInjectedScriptHostPrototypeAttributeEvaluate):

+        (Inspector::jsInjectedScriptHostPrototypeFunctionInternalConstructorName):

+        (Inspector::jsInjectedScriptHostPrototypeFunctionIsHTMLAllCollection):

+        (Inspector::jsInjectedScriptHostPrototypeFunctionProxyTargetValue):

+        (Inspector::jsInjectedScriptHostPrototypeFunctionWeakMapSize):

+        (Inspector::jsInjectedScriptHostPrototypeFunctionWeakMapEntries):

+        (Inspector::jsInjectedScriptHostPrototypeFunctionWeakSetSize):

+        (Inspector::jsInjectedScriptHostPrototypeFunctionWeakSetEntries):

+        (Inspector::jsInjectedScriptHostPrototypeFunctionIteratorEntries):

+        (Inspector::jsInjectedScriptHostPrototypeFunctionEvaluateWithScopeExtension):

+        (Inspector::jsInjectedScriptHostPrototypeFunctionSubtype):

+        (Inspector::jsInjectedScriptHostPrototypeFunctionFunctionDetails):

+        (Inspector::jsInjectedScriptHostPrototypeFunctionGetInternalProperties):

+        * inspector/JSJavaScriptCallFrame.cpp:

+        (Inspector::JSJavaScriptCallFrame::finishCreation):

+        (Inspector::toJSJavaScriptCallFrame): Deleted.

+        * inspector/JSJavaScriptCallFrame.h:

+        * inspector/JSJavaScriptCallFramePrototype.cpp:

+        (Inspector::JSJavaScriptCallFramePrototype::finishCreation):

+        (Inspector::jsJavaScriptCallFramePrototypeFunctionEvaluateWithScopeExtension):

+        (Inspector::jsJavaScriptCallFramePrototypeFunctionScopeDescriptions):

+        (Inspector::jsJavaScriptCallFrameAttributeCaller):

+        (Inspector::jsJavaScriptCallFrameAttributeSourceID):

+        (Inspector::jsJavaScriptCallFrameAttributeLine):

+        (Inspector::jsJavaScriptCallFrameAttributeColumn):

+        (Inspector::jsJavaScriptCallFrameAttributeFunctionName):

+        (Inspector::jsJavaScriptCallFrameAttributeScopeChain):

+        (Inspector::jsJavaScriptCallFrameAttributeThisObject):

+        (Inspector::jsJavaScriptCallFrameAttributeType):

+        (Inspector::jsJavaScriptCallFrameIsTailDeleted):

+        * inspector/ScriptArguments.cpp:

+        (Inspector::ScriptArguments::getFirstArgumentAsString):

+        * inspector/agents/InspectorHeapAgent.cpp:

+        (Inspector::InspectorHeapAgent::getPreview):

+        * interpreter/Interpreter.cpp:

+        (JSC::notifyDebuggerOfUnwinding):

+        (JSC::Interpreter::unwind):

+        (JSC::Interpreter::notifyDebuggerOfExceptionToBeThrown):

+        (JSC::Interpreter::execute):

+        * interpreter/ShadowChicken.cpp:

+        (JSC::ShadowChicken::update):

+        * interpreter/StackVisitor.cpp:

+        (JSC::StackVisitor::readFrame):

+        (JSC::StackVisitor::readNonInlinedFrame):

+        (JSC::StackVisitor::Frame::calleeSaveRegisters):

+        * jit/JITCode.cpp:

+        (JSC::JITCode::execute):

+        * jit/JITOperations.cpp:

+        (JSC::operationNewFunctionCommon):

+        * jit/Repatch.cpp:

+        (JSC::tryCacheGetByID):

+        * jsc.cpp:

+        (WTF::CustomGetter::customGetter):

+        (WTF::RuntimeArray::finishCreation):

+        (WTF::RuntimeArray::lengthGetter):

+        (WTF::DOMJITGetter::customGetter):

+        (WTF::DOMJITGetterComplex::DOMJITNodeDOMJIT::slowCall):

+        (WTF::DOMJITGetterComplex::functionEnableException):

+        (WTF::DOMJITGetterComplex::customGetter):

+        (WTF::DOMJITFunctionObject::safeFunction):

+        (functionDescribeArray):

+        (functionCreateElement):

+        (functionGetElement):

+        (functionSetElementRoot):

+        (functionGetHiddenValue):

+        (functionSetHiddenValue):

+        (functionSetImpureGetterDelegate):

+        (functionNoFTL):

+        (functionDollarEvalScript):

+        (functionDollarAgentBroadcast):

+        (functionTransferArrayBuffer):

+        (functionFindTypeForExpression):

+        (functionReturnTypeFor):

+        (functionHasBasicBlockExecuted):

+        (functionBasicBlockExecutionCount):

+        (functionEnsureArrayStorage):

+        * llint/LLIntSlowPaths.cpp:

+        (JSC::LLInt::LLINT_SLOW_PATH_DECL):

+        * runtime/AbstractModuleRecord.cpp:

+        (JSC::AbstractModuleRecord::finishCreation):

+        * runtime/ArrayBuffer.cpp:

+        (JSC::ArrayBuffer::transferTo):

+        * runtime/ArrayBuffer.h:

+        * runtime/ArrayConstructor.cpp:

+        (JSC::ArrayConstructor::finishCreation):

+        (JSC::arrayConstructorPrivateFuncIsArraySlow):

+        (JSC::arrayConstructorPrivateFuncIsArrayConstructor):

+        * runtime/ArrayConstructor.h:

+        (JSC::isArrayConstructor): Deleted.

+        * runtime/ArrayIteratorPrototype.cpp:

+        (JSC::ArrayIteratorPrototype::finishCreation):

+        * runtime/ArrayPrototype.cpp:

+        (JSC::ArrayPrototype::finishCreation):

+        * runtime/AsyncFunctionPrototype.cpp:

+        (JSC::AsyncFunctionPrototype::finishCreation):

+        * runtime/AtomicsObject.cpp:

+        (JSC::AtomicsObject::finishCreation):

+        (JSC::atomicsFuncWait):

+        (JSC::atomicsFuncWake):

+        * runtime/BooleanObject.cpp:

+        (JSC::BooleanObject::finishCreation):

+        * runtime/BooleanObject.h:

+        (JSC::asBooleanObject):

+        * runtime/BooleanPrototype.cpp:

+        (JSC::BooleanPrototype::finishCreation):

+        (JSC::booleanProtoFuncToString):

+        (JSC::booleanProtoFuncValueOf):

+        * runtime/ConsoleObject.cpp:

+        (JSC::ConsoleObject::finishCreation):

+        * runtime/DateConstructor.cpp:

+        (JSC::constructDate):

+        * runtime/DateInstance.cpp:

+        (JSC::DateInstance::finishCreation):

+        * runtime/DateInstance.h:

+        (JSC::asDateInstance):

+        * runtime/DatePrototype.cpp:

+        (JSC::formateDateInstance):

+        (JSC::DatePrototype::finishCreation):

+        (JSC::dateProtoFuncToISOString):

+        (JSC::dateProtoFuncToLocaleString):

+        (JSC::dateProtoFuncToLocaleDateString):

+        (JSC::dateProtoFuncToLocaleTimeString):

+        (JSC::dateProtoFuncGetTime):

+        (JSC::dateProtoFuncGetFullYear):

+        (JSC::dateProtoFuncGetUTCFullYear):

+        (JSC::dateProtoFuncGetMonth):

+        (JSC::dateProtoFuncGetUTCMonth):

+        (JSC::dateProtoFuncGetDate):

+        (JSC::dateProtoFuncGetUTCDate):

+        (JSC::dateProtoFuncGetDay):

+        (JSC::dateProtoFuncGetUTCDay):

+        (JSC::dateProtoFuncGetHours):

+        (JSC::dateProtoFuncGetUTCHours):

+        (JSC::dateProtoFuncGetMinutes):

+        (JSC::dateProtoFuncGetUTCMinutes):

+        (JSC::dateProtoFuncGetSeconds):

+        (JSC::dateProtoFuncGetUTCSeconds):

+        (JSC::dateProtoFuncGetMilliSeconds):

+        (JSC::dateProtoFuncGetUTCMilliseconds):

+        (JSC::dateProtoFuncGetTimezoneOffset):

+        (JSC::dateProtoFuncSetTime):

+        (JSC::setNewValueFromTimeArgs):

+        (JSC::setNewValueFromDateArgs):

+        (JSC::dateProtoFuncSetYear):

+        (JSC::dateProtoFuncGetYear):

+        * runtime/ErrorInstance.cpp:

+        (JSC::ErrorInstance::finishCreation):

+        * runtime/ErrorPrototype.cpp:

+        (JSC::ErrorPrototype::finishCreation):

+        * runtime/ExceptionHelpers.cpp:

+        (JSC::isTerminatedExecutionException):

+        * runtime/ExceptionHelpers.h:

+        * runtime/ExecutableBase.cpp:

+        (JSC::ExecutableBase::clearCode):

+        (JSC::ExecutableBase::dump):

+        (JSC::ExecutableBase::hashFor):

+        * runtime/FunctionPrototype.cpp:

+        (JSC::functionProtoFuncToString):

+        * runtime/GeneratorFunctionPrototype.cpp:

+        (JSC::GeneratorFunctionPrototype::finishCreation):

+        * runtime/GeneratorPrototype.cpp:

+        (JSC::GeneratorPrototype::finishCreation):

+        * runtime/GetterSetter.h:

+        * runtime/InspectorInstrumentationObject.cpp:

+        (JSC::InspectorInstrumentationObject::finishCreation):

+        * runtime/InternalFunction.cpp:

+        (JSC::InternalFunction::finishCreation):

+        (JSC::InternalFunction::createSubclassStructure):

+        * runtime/InternalFunction.h:

+        (JSC::asInternalFunction):

+        * runtime/IntlCollator.cpp:

+        (JSC::IntlCollator::finishCreation):

+        * runtime/IntlCollatorPrototype.cpp:

+        (JSC::IntlCollatorPrototypeGetterCompare):

+        (JSC::IntlCollatorPrototypeFuncResolvedOptions):

+        * runtime/IntlDateTimeFormat.cpp:

+        (JSC::IntlDateTimeFormat::finishCreation):

+        * runtime/IntlDateTimeFormatPrototype.cpp:

+        (JSC::IntlDateTimeFormatPrototypeGetterFormat):

+        (JSC::IntlDateTimeFormatPrototypeFuncResolvedOptions):

+        * runtime/IntlNumberFormat.cpp:

+        (JSC::IntlNumberFormat::finishCreation):

+        * runtime/IntlNumberFormatPrototype.cpp:

+        (JSC::IntlNumberFormatPrototypeGetterFormat):

+        (JSC::IntlNumberFormatPrototypeFuncResolvedOptions):

+        * runtime/IntlObject.cpp:

+        (JSC::IntlObject::finishCreation):

+        * runtime/IntlObjectInlines.h:

+        (JSC::constructIntlInstanceWithWorkaroundForLegacyIntlConstructor):

+        * runtime/IteratorPrototype.cpp:

+        (JSC::IteratorPrototype::finishCreation):

+        * runtime/JSArray.h:

+        (JSC::asArray):

+        (JSC::isJSArray):

+        * runtime/JSArrayBuffer.h:

+        (JSC::toPossiblySharedArrayBuffer):

+        (JSC::toUnsharedArrayBuffer):

+        (JSC::JSArrayBuffer::toWrapped):

+        * runtime/JSArrayBufferConstructor.cpp:

+        (JSC::arrayBufferFuncIsView):

+        * runtime/JSArrayBufferPrototype.cpp:

+        (JSC::arrayBufferProtoFuncSlice):

+        * runtime/JSArrayBufferView.h:

+        * runtime/JSArrayBufferViewInlines.h:

+        (JSC::JSArrayBufferView::toWrapped):

+        * runtime/JSBoundFunction.cpp:

+        (JSC::isBoundFunction):

+        (JSC::getBoundFunctionStructure):

+        (JSC::JSBoundFunction::finishCreation):

+        * runtime/JSCJSValue.cpp:

+        (JSC::JSValue::dumpForBacktrace):

+        * runtime/JSCJSValue.h:

+        * runtime/JSCJSValueInlines.h:

+        (JSC::JSValue::inherits):

+        (JSC::JSValue::classInfoOrNull):

+        * runtime/JSCallee.cpp:

+        (JSC::JSCallee::finishCreation):

+        * runtime/JSCell.cpp:

+        (JSC::JSCell::dumpToStream):

+        (JSC::JSCell::className):

+        (JSC::JSCell::isAnyWasmCallee):

+        * runtime/JSCell.h:

+        (JSC::jsCast):

+        (JSC::jsDynamicCast):

+        * runtime/JSCellInlines.h:

+        (JSC::JSCell::methodTable):

+        (JSC::JSCell::inherits):

+        (JSC::JSCell::classInfo):

+        * runtime/JSCustomGetterSetterFunction.cpp:

+        (JSC::JSCustomGetterSetterFunction::finishCreation):

+        * runtime/JSDataViewPrototype.cpp:

+        (JSC::getData):

+        (JSC::setData):

+        (JSC::dataViewProtoGetterBuffer):

+        (JSC::dataViewProtoGetterByteLength):

+        (JSC::dataViewProtoGetterByteOffset):

+        * runtime/JSFunction.cpp:

+        (JSC::JSFunction::finishCreation):

+        (JSC::JSFunction::allocateAndInitializeRareData):

+        (JSC::JSFunction::initializeRareData):

+        (JSC::RetrieveArgumentsFunctor::RetrieveArgumentsFunctor):

+        (JSC::RetrieveCallerFunctionFunctor::RetrieveCallerFunctionFunctor):

+        (JSC::RetrieveCallerFunctionFunctor::operator()):

+        (JSC::JSFunction::callerGetter):

+        (JSC::JSFunction::getOwnNonIndexPropertyNames):

+        (JSC::getCalculatedDisplayName):

+        (JSC::JSFunction::reifyBoundNameIfNeeded):

+        * runtime/JSGenericTypedArrayView.h:

+        (JSC::toPossiblySharedNativeTypedView):

+        (JSC::toUnsharedNativeTypedView):

+        (JSC::JSGenericTypedArrayView&lt;Adaptor&gt;::toWrapped):

+        * runtime/JSGenericTypedArrayViewConstructorInlines.h:

+        (JSC::constructGenericTypedArrayViewWithArguments):

+        (JSC::constructGenericTypedArrayView):

+        * runtime/JSGenericTypedArrayViewInlines.h:

+        (JSC::JSGenericTypedArrayView&lt;Adaptor&gt;::set):

+        * runtime/JSGenericTypedArrayViewPrototypeFunctions.h:

+        (JSC::speciesConstruct):

+        (JSC::genericTypedArrayViewProtoFuncSet):

+        (JSC::genericTypedArrayViewProtoFuncSlice):

+        (JSC::genericTypedArrayViewPrivateFuncSubarrayCreate):

+        * runtime/JSGenericTypedArrayViewPrototypeInlines.h:

+        (JSC::JSGenericTypedArrayViewPrototype&lt;ViewClass&gt;::finishCreation):

+        * runtime/JSGlobalObject.cpp:

+        (JSC::getTemplateObject):

+        (JSC::enqueueJob):

+        (JSC::JSGlobalObject::init):

+        * runtime/JSGlobalObjectFunctions.cpp:

+        (JSC::globalFuncProtoGetter):

+        (JSC::globalFuncProtoSetter):

+        * runtime/JSInternalPromiseDeferred.cpp:

+        (JSC::JSInternalPromiseDeferred::create):

+        * runtime/JSLexicalEnvironment.h:

+        (JSC::asActivation):

+        * runtime/JSModuleLoader.cpp:

+        (JSC::JSModuleLoader::finishCreation):

+        (JSC::JSModuleLoader::evaluate):

+        (JSC::JSModuleLoader::getModuleNamespaceObject):

+        * runtime/JSModuleNamespaceObject.cpp:

+        (JSC::JSModuleNamespaceObject::finishCreation):

+        (JSC::moduleNamespaceObjectSymbolIterator):

+        * runtime/JSModuleRecord.cpp:

+        (JSC::JSModuleRecord::finishCreation):

+        * runtime/JSNativeStdFunction.cpp:

+        (JSC::JSNativeStdFunction::finishCreation):

+        * runtime/JSONObject.cpp:

+        (JSC::JSONObject::finishCreation):

+        (JSC::unwrapBoxedPrimitive):

+        (JSC::Stringifier::Stringifier):

+        (JSC::Walker::walk):

+        * runtime/JSObject.cpp:

+        (JSC::JSObject::className):

+        (JSC::JSObject::toStringName):

+        (JSC::JSObject::calculatedClassName):

+        (JSC::JSObject::putInlineSlow):

+        (JSC::JSObject::ensureInt32Slow):

+        (JSC::JSObject::ensureDoubleSlow):

+        (JSC::JSObject::ensureContiguousSlow):

+        (JSC::JSObject::ensureArrayStorageSlow):

+        (JSC::JSObject::deleteProperty):

+        (JSC::JSObject::getOwnStaticPropertySlot):

+        (JSC::JSObject::findPropertyHashEntry):

+        (JSC::JSObject::getOwnNonIndexPropertyNames):

+        (JSC::JSObject::reifyAllStaticProperties):

+        (JSC::JSObject::getOwnPropertyDescriptor):

+        * runtime/JSObject.h:

+        (JSC::JSObject::finishCreation):

+        (JSC::JSNonFinalObject::finishCreation):

+        (JSC::JSFinalObject::finishCreation):

+        * runtime/JSPromiseDeferred.cpp:

+        (JSC::JSPromiseDeferred::create):

+        * runtime/JSPropertyNameIterator.cpp:

+        (JSC::JSPropertyNameIterator::finishCreation):

+        (JSC::propertyNameIteratorFuncNext):

+        * runtime/JSScope.cpp:

+        (JSC::JSScope::symbolTable):

+        * runtime/JSScope.h:

+        * runtime/JSString.cpp:

+        (JSC::JSString::dumpToStream):

+        * runtime/JSStringIterator.cpp:

+        (JSC::JSStringIterator::finishCreation):

+        * runtime/JSTypedArrayViewPrototype.cpp:

+        (JSC::typedArrayViewPrivateFuncIsTypedArrayView):

+        (JSC::typedArrayViewPrivateFuncLength):

+        (JSC::typedArrayViewPrivateFuncGetOriginalConstructor):

+        (JSC::typedArrayViewProtoGetterFuncToStringTag):

+        (JSC::JSTypedArrayViewPrototype::finishCreation):

+        * runtime/LazyClassStructure.cpp:

+        (JSC::LazyClassStructure::Initializer::setConstructor):

+        * runtime/Lookup.h:

+        (JSC::putEntry):

+        * runtime/MapConstructor.cpp:

+        (JSC::MapConstructor::finishCreation):

+        * runtime/MapIteratorPrototype.cpp:

+        (JSC::MapIteratorPrototype::finishCreation):

+        (JSC::MapIteratorPrototypeFuncNext):

+        * runtime/MapPrototype.cpp:

+        (JSC::MapPrototype::finishCreation):

+        (JSC::mapProtoFuncValues):

+        (JSC::mapProtoFuncEntries):

+        (JSC::mapProtoFuncKeys):

+        (JSC::privateFuncMapIterator):

+        (JSC::privateFuncMapIteratorNext):

+        * runtime/MathObject.cpp:

+        (JSC::MathObject::finishCreation):

+        * runtime/ModuleLoaderPrototype.cpp:

+        (JSC::moduleLoaderPrototypeParseModule):

+        (JSC::moduleLoaderPrototypeRequestedModules):

+        (JSC::moduleLoaderPrototypeModuleDeclarationInstantiation):

+        (JSC::moduleLoaderPrototypeResolve):

+        (JSC::moduleLoaderPrototypeFetch):

+        (JSC::moduleLoaderPrototypeInstantiate):

+        (JSC::moduleLoaderPrototypeGetModuleNamespaceObject):

+        (JSC::moduleLoaderPrototypeEvaluate):

+        * runtime/NativeErrorConstructor.cpp:

+        (JSC::NativeErrorConstructor::finishCreation):

+        * runtime/NumberConstructor.cpp:

+        (JSC::NumberConstructor::finishCreation):

+        * runtime/NumberObject.cpp:

+        (JSC::NumberObject::finishCreation):

+        * runtime/NumberPrototype.cpp:

+        (JSC::NumberPrototype::finishCreation):

+        * runtime/ObjectConstructor.cpp:

+        (JSC::ObjectConstructor::finishCreation):

+        * runtime/ObjectPrototype.cpp:

+        (JSC::ObjectPrototype::finishCreation):

+        * runtime/ProxyObject.cpp:

+        (JSC::ProxyObject::toStringName):

+        (JSC::ProxyObject::finishCreation):

+        * runtime/ReflectObject.cpp:

+        (JSC::ReflectObject::finishCreation):

+        (JSC::reflectObjectConstruct):

+        * runtime/RegExpConstructor.cpp:

+        (JSC::RegExpConstructor::finishCreation):

+        (JSC::setRegExpConstructorInput):

+        (JSC::setRegExpConstructorMultiline):

+        (JSC::constructRegExp):

+        * runtime/RegExpConstructor.h:

+        (JSC::asRegExpConstructor):

+        (JSC::isRegExp):

+        * runtime/RegExpObject.cpp:

+        (JSC::RegExpObject::finishCreation):

+        * runtime/RegExpObject.h:

+        (JSC::asRegExpObject):

+        * runtime/RegExpPrototype.cpp:

+        (JSC::RegExpPrototype::finishCreation):

+        (JSC::regExpProtoFuncTestFast):

+        (JSC::regExpProtoFuncExec):

+        (JSC::regExpProtoFuncMatchFast):

+        (JSC::regExpProtoFuncCompile):

+        (JSC::regExpProtoGetterGlobal):

+        (JSC::regExpProtoGetterIgnoreCase):

+        (JSC::regExpProtoGetterMultiline):

+        (JSC::regExpProtoGetterSticky):

+        (JSC::regExpProtoGetterUnicode):

+        (JSC::regExpProtoGetterSource):

+        * runtime/SamplingProfiler.cpp:

+        (JSC::SamplingProfiler::processUnverifiedStackTraces):

+        * runtime/ScriptExecutable.cpp:

+        (JSC::ScriptExecutable::newCodeBlockFor):

+        (JSC::ScriptExecutable::newReplacementCodeBlockFor):

+        * runtime/SetConstructor.cpp:

+        (JSC::SetConstructor::finishCreation):

+        * runtime/SetIteratorPrototype.cpp:

+        (JSC::SetIteratorPrototype::finishCreation):

+        (JSC::SetIteratorPrototypeFuncNext):

+        * runtime/SetPrototype.cpp:

+        (JSC::SetPrototype::finishCreation):

+        (JSC::setProtoFuncValues):

+        (JSC::setProtoFuncEntries):

+        (JSC::privateFuncSetIterator):

+        (JSC::privateFuncSetIteratorNext):

+        * runtime/StackFrame.cpp:

+        (JSC::StackFrame::sourceURL):

+        (JSC::StackFrame::functionName):

+        * runtime/StringIteratorPrototype.cpp:

+        (JSC::StringIteratorPrototype::finishCreation):

+        * runtime/StringObject.cpp:

+        (JSC::StringObject::finishCreation):

+        * runtime/StringObject.h:

+        (JSC::asStringObject):

+        * runtime/StringPrototype.cpp:

+        (JSC::StringPrototype::finishCreation):

+        (JSC::replace):

+        (JSC::stringProtoFuncReplaceUsingRegExp):

+        (JSC::stringProtoFuncToString):

+        * runtime/StructureRareData.cpp:

+        (JSC::StructureRareData::setObjectToStringValue):

+        * runtime/Symbol.cpp:

+        (JSC::Symbol::finishCreation):

+        * runtime/SymbolConstructor.cpp:

+        (JSC::SymbolConstructor::finishCreation):

+        * runtime/SymbolObject.cpp:

+        (JSC::SymbolObject::finishCreation):

+        * runtime/SymbolPrototype.cpp:

+        (JSC::SymbolPrototype::finishCreation):

+        (JSC::symbolProtoFuncToString):

+        (JSC::symbolProtoFuncValueOf):

+        * runtime/TestRunnerUtils.cpp:

+        (JSC::getExecutableForFunction):

+        * runtime/ThrowScope.cpp:

+        (JSC::ThrowScope::throwException):

+        * runtime/VM.cpp:

+        (JSC::VM::throwException):

+        * runtime/WeakMapConstructor.cpp:

+        (JSC::WeakMapConstructor::finishCreation):

+        * runtime/WeakMapPrototype.cpp:

+        (JSC::WeakMapPrototype::finishCreation):

+        (JSC::getWeakMapData):

+        * runtime/WeakSetConstructor.cpp:

+        (JSC::WeakSetConstructor::finishCreation):

+        * runtime/WeakSetPrototype.cpp:

+        (JSC::WeakSetPrototype::finishCreation):

+        (JSC::getWeakMapData):

+        * tools/JSDollarVMPrototype.cpp:

+        (JSC::codeBlockFromArg):

+        * wasm/JSWebAssembly.cpp:

+        (JSC::JSWebAssembly::finishCreation):

+        * wasm/js/JSWebAssemblyHelpers.h:

+        (JSC::getWasmBufferFromValue):

+        * wasm/js/JSWebAssemblyInstance.cpp:

+        (JSC::JSWebAssemblyInstance::finishCreation):

+        * wasm/js/JSWebAssemblyMemory.cpp:

+        (JSC::JSWebAssemblyMemory::grow):

+        (JSC::JSWebAssemblyMemory::finishCreation):

+        (JSC::JSWebAssemblyMemory::destroy):

+        (JSC::JSWebAssemblyMemory::~JSWebAssemblyMemory): Deleted.

+        * wasm/js/JSWebAssemblyMemory.h:

+        * wasm/js/JSWebAssemblyModule.cpp:

+        (JSC::JSWebAssemblyModule::finishCreation):

+        * wasm/js/JSWebAssemblyTable.cpp:

+        (JSC::JSWebAssemblyTable::finishCreation):

+        * wasm/js/WebAssemblyFunction.cpp:

+        (JSC::callWebAssemblyFunction):

+        (JSC::WebAssemblyFunction::finishCreation):

+        * wasm/js/WebAssemblyInstanceConstructor.cpp:

+        (JSC::constructJSWebAssemblyInstance):

+        * wasm/js/WebAssemblyMemoryPrototype.cpp:

+        (JSC::getMemory):

+        * wasm/js/WebAssemblyModulePrototype.cpp:

+        (JSC::webAssemblyModuleProtoCustomSections):

+        * wasm/js/WebAssemblyModuleRecord.cpp:

+        (JSC::WebAssemblyModuleRecord::finishCreation):

+        * wasm/js/WebAssemblyTablePrototype.cpp:

+        (JSC::getTable):

+        (JSC::webAssemblyTableProtoFuncSet):

+

</ins><span class="cx"> 2017-01-26  Mark Lam  &lt;mark.lam@apple.com&gt;

</span><span class="cx"> 

<span class="cx">         Fix missing exception check in genericTypedArrayViewProtoFuncSet().

</span></span></pre></div>

<a id="trunkSourceJavaScriptCorebindingsScriptFunctionCallcpp"></a>

<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/bindings/ScriptFunctionCall.cpp (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/JavaScriptCore/bindings/ScriptFunctionCall.cpp        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/JavaScriptCore/bindings/ScriptFunctionCall.cpp        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -129,7 +129,7 @@

</span><span class="cx"> 

</span><span class="cx">     if (exception) {

<span class="cx">         // Do not treat a terminated execution exception as having an exception. Just treat it as an empty result.

</span><del>-        hadException = !isTerminatedExecutionException(exception);

</del><ins>+        hadException = !isTerminatedExecutionException(vm, exception);

</ins><span class="cx">         return { };

</span><span class="cx">     }

</span><span class="cx"> 

</span></span></pre></div>

<a id="trunkSourceJavaScriptCorebytecodeCallVarianth"></a>

<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/bytecode/CallVariant.h (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/JavaScriptCore/bytecode/CallVariant.h        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/JavaScriptCore/bytecode/CallVariant.h        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -85,21 +85,21 @@

</span><span class="cx">     

</span><span class="cx">     InternalFunction* internalFunction() const

</span><span class="cx">     {

</span><del>-        return jsDynamicCast&lt;InternalFunction*&gt;(m_callee);

</del><ins>+        return jsDynamicCast&lt;InternalFunction*&gt;(*m_callee-&gt;vm(), m_callee);

</ins><span class="cx">     }

</span><span class="cx">     

</span><span class="cx">     JSFunction* function() const

</span><span class="cx">     {

</span><del>-        return jsDynamicCast&lt;JSFunction*&gt;(m_callee);

</del><ins>+        return jsDynamicCast&lt;JSFunction*&gt;(*m_callee-&gt;vm(), m_callee);

</ins><span class="cx">     }

</span><span class="cx">     

</span><del>-    bool isClosureCall() const { return !!jsDynamicCast&lt;ExecutableBase*&gt;(m_callee); }

</del><ins>+    bool isClosureCall() const { return !!jsDynamicCast&lt;ExecutableBase*&gt;(*m_callee-&gt;vm(), m_callee); }

</ins><span class="cx">     

</span><span class="cx">     ExecutableBase* executable() const

</span><span class="cx">     {

</span><span class="cx">         if (JSFunction* function = this-&gt;function())

</span><span class="cx">             return function-&gt;executable();

</span><del>-        return jsDynamicCast&lt;ExecutableBase*&gt;(m_callee);

</del><ins>+        return jsDynamicCast&lt;ExecutableBase*&gt;(*m_callee-&gt;vm(), m_callee);

</ins><span class="cx">     }

</span><span class="cx">     

</span><span class="cx">     JSCell* nonExecutableCallee() const

</span><span class="lines">@@ -118,7 +118,7 @@

</span><span class="cx">     FunctionExecutable* functionExecutable() const

</span><span class="cx">     {

</span><span class="cx">         if (ExecutableBase* executable = this-&gt;executable())

</span><del>-            return jsDynamicCast&lt;FunctionExecutable*&gt;(executable);

</del><ins>+            return jsDynamicCast&lt;FunctionExecutable*&gt;(*m_callee-&gt;vm(), executable);

</ins><span class="cx">         return nullptr;

</span><span class="cx">     }

</span><span class="cx"> 

</span><span class="lines">@@ -125,7 +125,7 @@

</span><span class="cx">     NativeExecutable* nativeExecutable() const

</span><span class="cx">     {

</span><span class="cx">         if (ExecutableBase* executable = this-&gt;executable())

</span><del>-            return jsDynamicCast&lt;NativeExecutable*&gt;(executable);

</del><ins>+            return jsDynamicCast&lt;NativeExecutable*&gt;(*m_callee-&gt;vm(), executable);

</ins><span class="cx">         return nullptr;

</span><span class="cx">     }

</span><span class="cx"> 

</span></span></pre></div>

<a id="trunkSourceJavaScriptCorebytecodeCodeBlockcpp"></a>

<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/bytecode/CodeBlock.cpp (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/JavaScriptCore/bytecode/CodeBlock.cpp        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/JavaScriptCore/bytecode/CodeBlock.cpp        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -1948,7 +1948,7 @@

</span><span class="cx"> 

</span><span class="cx">     // We already have the cloned symbol table for the module environment since we need to instantiate

<span class="cx">     // the module environments before linking the code block. We replace the stored symbol table with the already cloned one.

</span><del>-    if (UnlinkedModuleProgramCodeBlock* unlinkedModuleProgramCodeBlock = jsDynamicCast&lt;UnlinkedModuleProgramCodeBlock*&gt;(unlinkedCodeBlock)) {

</del><ins>+    if (UnlinkedModuleProgramCodeBlock* unlinkedModuleProgramCodeBlock = jsDynamicCast&lt;UnlinkedModuleProgramCodeBlock*&gt;(vm, unlinkedCodeBlock)) {

</ins><span class="cx">         SymbolTable* clonedSymbolTable = jsCast&lt;ModuleProgramExecutable*&gt;(ownerExecutable)-&gt;moduleEnvironmentSymbolTable();

</span><span class="cx">         if (m_vm-&gt;typeProfiler()) {

</span><span class="cx">             ConcurrentJSLocker locker(clonedSymbolTable-&gt;m_lock);

</span><span class="lines">@@ -2405,7 +2405,7 @@

</span><span class="cx">         JSValue constant = constants[i].get();

</span><span class="cx"> 

</span><span class="cx">         if (!constant.isEmpty()) {

</span><del>-            if (SymbolTable* symbolTable = jsDynamicCast&lt;SymbolTable*&gt;(constant)) {

</del><ins>+            if (SymbolTable* symbolTable = jsDynamicCast&lt;SymbolTable*&gt;(*vm(), constant)) {

</ins><span class="cx">                 if (hasTypeProfiler) {

</span><span class="cx">                     ConcurrentJSLocker locker(symbolTable-&gt;m_lock);

</span><span class="cx">                     symbolTable-&gt;prepareForTypeProfiling(locker);

</span><span class="lines">@@ -2725,8 +2725,9 @@

<span class="cx">     // GC we still have not proved liveness, then this code block is toast.

</span><span class="cx">     bool allAreLiveSoFar = true;

</span><span class="cx">     for (unsigned i = 0; i &lt; dfgCommon-&gt;weakReferences.size(); ++i) {

</span><del>-        ASSERT(!jsDynamicCast&lt;CodeBlock*&gt;(dfgCommon-&gt;weakReferences[i].get()));

-        if (!Heap::isMarkedConcurrently(dfgCommon-&gt;weakReferences[i].get())) {

</del><ins>+        JSCell* reference = dfgCommon-&gt;weakReferences[i].get();

+        ASSERT(!jsDynamicCast&lt;CodeBlock*&gt;(*reference-&gt;vm(), reference));

+        if (!Heap::isMarkedConcurrently(reference)) {

</ins><span class="cx">             allAreLiveSoFar = false;

</span><span class="cx">             break;

</span><span class="cx">         }

</span><span class="lines">@@ -3308,7 +3309,7 @@

</span><span class="cx"> #if ENABLE(JIT)

</span><span class="cx"> CodeBlock* CodeBlock::replacement()

</span><span class="cx"> {

</span><del>-    const ClassInfo* classInfo = this-&gt;classInfo();

</del><ins>+    const ClassInfo* classInfo = this-&gt;classInfo(*vm());

</ins><span class="cx"> 

</span><span class="cx">     if (classInfo == FunctionCodeBlock::info())

</span><span class="cx">         return jsCast&lt;FunctionExecutable*&gt;(ownerExecutable())-&gt;codeBlockFor(m_isConstructor ? CodeForConstruct : CodeForCall);

</span><span class="lines">@@ -3328,7 +3329,7 @@

</span><span class="cx"> 

</span><span class="cx"> DFG::CapabilityLevel CodeBlock::computeCapabilityLevel()

</span><span class="cx"> {

</span><del>-    const ClassInfo* classInfo = this-&gt;classInfo();

</del><ins>+    const ClassInfo* classInfo = this-&gt;classInfo(*vm());

</ins><span class="cx"> 

</span><span class="cx">     if (classInfo == FunctionCodeBlock::info()) {

</span><span class="cx">         if (m_isConstructor)

</span><span class="lines">@@ -4206,7 +4207,7 @@

</span><span class="cx">     for (auto&amp; constantRegister : m_constantRegisters) {

</span><span class="cx">         if (constantRegister.get().isEmpty())

</span><span class="cx">             continue;

</span><del>-        if (SymbolTable* symbolTable = jsDynamicCast&lt;SymbolTable*&gt;(constantRegister.get())) {

</del><ins>+        if (SymbolTable* symbolTable = jsDynamicCast&lt;SymbolTable*&gt;(*vm(), constantRegister.get())) {

</ins><span class="cx">             ConcurrentJSLocker locker(symbolTable-&gt;m_lock);

</span><span class="cx">             auto end = symbolTable-&gt;end(locker);

</span><span class="cx">             for (auto ptr = symbolTable-&gt;begin(locker); ptr != end; ++ptr) {

</span></span></pre></div>

<a id="trunkSourceJavaScriptCorebytecodeObjectAllocationProfileh"></a>

<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/bytecode/ObjectAllocationProfile.h (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/JavaScriptCore/bytecode/ObjectAllocationProfile.h        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/JavaScriptCore/bytecode/ObjectAllocationProfile.h        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -139,7 +139,7 @@

</span><span class="cx">             JSValue value = prototype-&gt;getDirect(vm, propertyNameVector[i]);

</span><span class="cx"> 

<span class="cx">             // Functions are common, and are usually class-level objects that are not overridden.

</span><del>-            if (jsDynamicCast&lt;JSFunction*&gt;(value))

</del><ins>+            if (jsDynamicCast&lt;JSFunction*&gt;(vm, value))

</ins><span class="cx">                 continue;

</span><span class="cx"> 

</span><span class="cx">             ++count;

</span></span></pre></div>

<a id="trunkSourceJavaScriptCorebytecodeObjectPropertyConditioncpp"></a>

<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/bytecode/ObjectPropertyCondition.cpp (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/JavaScriptCore/bytecode/ObjectPropertyCondition.cpp        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/JavaScriptCore/bytecode/ObjectPropertyCondition.cpp        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -162,9 +162,9 @@

</span><span class="cx">     m_condition.validateReferences(tracked);

</span><span class="cx"> }

</span><span class="cx"> 

</span><del>-ObjectPropertyCondition ObjectPropertyCondition::attemptToMakeEquivalenceWithoutBarrier() const

</del><ins>+ObjectPropertyCondition ObjectPropertyCondition::attemptToMakeEquivalenceWithoutBarrier(VM&amp; vm) const

</ins><span class="cx"> {

</span><del>-    PropertyCondition result = condition().attemptToMakeEquivalenceWithoutBarrier(object());

</del><ins>+    PropertyCondition result = condition().attemptToMakeEquivalenceWithoutBarrier(vm, object());

</ins><span class="cx">     if (!result)

</span><span class="cx">         return ObjectPropertyCondition();

</span><span class="cx">     return ObjectPropertyCondition(object(), result);

</span></span></pre></div>

<a id="trunkSourceJavaScriptCorebytecodeObjectPropertyConditionh"></a>

<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/bytecode/ObjectPropertyCondition.h (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/JavaScriptCore/bytecode/ObjectPropertyCondition.h        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/JavaScriptCore/bytecode/ObjectPropertyCondition.h        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -232,12 +232,12 @@

</span><span class="cx">     

</span><span class="cx">     void validateReferences(const TrackedReferences&amp;) const;

</span><span class="cx"> 

</span><del>-    bool isValidValueForPresence(JSValue value) const

</del><ins>+    bool isValidValueForPresence(VM&amp; vm, JSValue value) const

</ins><span class="cx">     {

</span><del>-        return condition().isValidValueForPresence(value);

</del><ins>+        return condition().isValidValueForPresence(vm, value);

</ins><span class="cx">     }

</span><span class="cx"> 

</span><del>-    ObjectPropertyCondition attemptToMakeEquivalenceWithoutBarrier() const;

</del><ins>+    ObjectPropertyCondition attemptToMakeEquivalenceWithoutBarrier(VM&amp;) const;

</ins><span class="cx"> 

</span><span class="cx"> private:

</span><span class="cx">     JSObject* m_object;

</span></span></pre></div>

<a id="trunkSourceJavaScriptCorebytecodePropertyConditioncpp"></a>

<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/bytecode/PropertyCondition.cpp (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/JavaScriptCore/bytecode/PropertyCondition.cpp        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/JavaScriptCore/bytecode/PropertyCondition.cpp        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -315,25 +315,25 @@

</span><span class="cx">         tracked.check(requiredValue());

</span><span class="cx"> }

</span><span class="cx"> 

</span><del>-bool PropertyCondition::isValidValueForAttributes(JSValue value, unsigned attributes)

</del><ins>+bool PropertyCondition::isValidValueForAttributes(VM&amp; vm, JSValue value, unsigned attributes)

</ins><span class="cx"> {

</span><span class="cx">     bool attributesClaimAccessor = !!(attributes &amp; Accessor);

</span><del>-    bool valueClaimsAccessor = !!jsDynamicCast&lt;GetterSetter*&gt;(value);

</del><ins>+    bool valueClaimsAccessor = !!jsDynamicCast&lt;GetterSetter*&gt;(vm, value);

</ins><span class="cx">     return attributesClaimAccessor == valueClaimsAccessor;

</span><span class="cx"> }

</span><span class="cx"> 

</span><del>-bool PropertyCondition::isValidValueForPresence(JSValue value) const

</del><ins>+bool PropertyCondition::isValidValueForPresence(VM&amp; vm, JSValue value) const

</ins><span class="cx"> {

</span><del>-    return isValidValueForAttributes(value, attributes());

</del><ins>+    return isValidValueForAttributes(vm, value, attributes());

</ins><span class="cx"> }

</span><span class="cx"> 

</span><del>-PropertyCondition PropertyCondition::attemptToMakeEquivalenceWithoutBarrier(JSObject* base) const

</del><ins>+PropertyCondition PropertyCondition::attemptToMakeEquivalenceWithoutBarrier(VM&amp; vm, JSObject* base) const

</ins><span class="cx"> {

</span><span class="cx">     Structure* structure = base-&gt;structure();

</span><span class="cx">     if (!structure-&gt;isValidOffset(offset()))

</span><span class="cx">         return PropertyCondition();

</span><span class="cx">     JSValue value = base-&gt;getDirect(offset());

</span><del>-    if (!isValidValueForPresence(value))

</del><ins>+    if (!isValidValueForPresence(vm, value))

</ins><span class="cx">         return PropertyCondition();

</span><span class="cx">     return equivalenceWithoutBarrier(uid(), value);

</span><span class="cx"> }

</span></span></pre></div>

<a id="trunkSourceJavaScriptCorebytecodePropertyConditionh"></a>

<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/bytecode/PropertyCondition.h (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/JavaScriptCore/bytecode/PropertyCondition.h        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/JavaScriptCore/bytecode/PropertyCondition.h        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -282,11 +282,11 @@

</span><span class="cx">     

</span><span class="cx">     void validateReferences(const TrackedReferences&amp;) const;

</span><span class="cx"> 

</span><del>-    static bool isValidValueForAttributes(JSValue value, unsigned attributes);

</del><ins>+    static bool isValidValueForAttributes(VM&amp;, JSValue, unsigned attributes);

</ins><span class="cx"> 

</span><del>-    bool isValidValueForPresence(JSValue) const;

</del><ins>+    bool isValidValueForPresence(VM&amp;, JSValue) const;

</ins><span class="cx"> 

</span><del>-    PropertyCondition attemptToMakeEquivalenceWithoutBarrier(JSObject* base) const;

</del><ins>+    PropertyCondition attemptToMakeEquivalenceWithoutBarrier(VM&amp;, JSObject* base) const;

</ins><span class="cx"> 

</span><span class="cx"> private:

</span><span class="cx">     bool isWatchableWhenValid(Structure*, WatchabilityEffort) const;

</span></span></pre></div>

<a id="trunkSourceJavaScriptCorebytecodeSpeculatedTypecpp"></a>

<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/bytecode/SpeculatedType.cpp (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/JavaScriptCore/bytecode/SpeculatedType.cpp        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/JavaScriptCore/bytecode/SpeculatedType.cpp        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -414,7 +414,8 @@

</span><span class="cx"> 

</span><span class="cx"> SpeculatedType speculationFromCell(JSCell* cell)

</span><span class="cx"> {

</span><del>-    if (JSString* string = jsDynamicCast&lt;JSString*&gt;(cell)) {

</del><ins>+    if (cell-&gt;isString()) {

+        JSString* string = jsCast&lt;JSString*&gt;(cell);

</ins><span class="cx">         if (const StringImpl* impl = string-&gt;tryGetValueImpl()) {

</span><span class="cx">             if (impl-&gt;isAtomic())

</span><span class="cx">                 return SpecStringIdent;

</span></span></pre></div>

<a id="trunkSourceJavaScriptCoredebuggerDebuggercpp"></a>

<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/debugger/Debugger.cpp (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/JavaScriptCore/debugger/Debugger.cpp        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/JavaScriptCore/debugger/Debugger.cpp        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -55,7 +55,7 @@

</span><span class="cx">         

</span><span class="cx">         JSCell* cell = static_cast&lt;JSCell*&gt;(heapCell);

</span><span class="cx">         

</span><del>-        JSFunction* function = jsDynamicCast&lt;JSFunction*&gt;(cell);

</del><ins>+        JSFunction* function = jsDynamicCast&lt;JSFunction*&gt;(*cell-&gt;vm(), cell);

</ins><span class="cx">         if (!function)

</span><span class="cx">             return IterationStatus::Continue;

</span><span class="cx"> 

</span></span></pre></div>

<a id="trunkSourceJavaScriptCoredebuggerDebuggerCallFramecpp"></a>

<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/debugger/DebuggerCallFrame.cpp (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/JavaScriptCore/debugger/DebuggerCallFrame.cpp        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/JavaScriptCore/debugger/DebuggerCallFrame.cpp        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -136,9 +136,10 @@

</span><span class="cx">     if (!isValid())

</span><span class="cx">         return String();

</span><span class="cx"> 

</span><ins>+    VM&amp; vm = m_validMachineFrame-&gt;vm();

</ins><span class="cx">     if (isTailDeleted()) {

</span><del>-        if (JSFunction* func = jsDynamicCast&lt;JSFunction*&gt;(m_shadowChickenFrame.callee))

-            return func-&gt;calculatedDisplayName(m_validMachineFrame-&gt;vm());

</del><ins>+        if (JSFunction* func = jsDynamicCast&lt;JSFunction*&gt;(vm, m_shadowChickenFrame.callee))

+            return func-&gt;calculatedDisplayName(vm);

</ins><span class="cx">         return m_shadowChickenFrame.codeBlock-&gt;inferredName().data();

</span><span class="cx">     }

</span><span class="cx"> 

</span><span class="lines">@@ -159,7 +160,7 @@

</span><span class="cx">             scope = m_shadowChickenFrame.scope;

</span><span class="cx">         else if (codeBlock &amp;&amp; codeBlock-&gt;scopeRegister().isValid())

</span><span class="cx">             scope = m_validMachineFrame-&gt;scope(codeBlock-&gt;scopeRegister().offset());

</span><del>-        else if (JSCallee* callee = jsDynamicCast&lt;JSCallee*&gt;(m_validMachineFrame-&gt;jsCallee()))

</del><ins>+        else if (JSCallee* callee = jsDynamicCast&lt;JSCallee*&gt;(vm, m_validMachineFrame-&gt;jsCallee()))

</ins><span class="cx">             scope = callee-&gt;scope();

</span><span class="cx">         else

</span><span class="cx">             scope = m_validMachineFrame-&gt;lexicalGlobalObject()-&gt;globalLexicalEnvironment();

</span><span class="lines">@@ -178,7 +179,7 @@

</span><span class="cx">     if (isTailDeleted())

</span><span class="cx">         return FunctionType;

</span><span class="cx"> 

</span><del>-    if (jsDynamicCast&lt;JSFunction*&gt;(m_validMachineFrame-&gt;jsCallee()))

</del><ins>+    if (jsDynamicCast&lt;JSFunction*&gt;(m_validMachineFrame-&gt;vm(), m_validMachineFrame-&gt;jsCallee()))

</ins><span class="cx">         return FunctionType;

</span><span class="cx"> 

</span><span class="cx">     return ProgramType;

</span></span></pre></div>

<a id="trunkSourceJavaScriptCoredebuggerDebuggerScopecpp"></a>

<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/debugger/DebuggerScope.cpp (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/JavaScriptCore/debugger/DebuggerScope.cpp        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/JavaScriptCore/debugger/DebuggerScope.cpp        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -212,7 +212,7 @@

</span><span class="cx"> 

</span><span class="cx"> String DebuggerScope::name() const

</span><span class="cx"> {

</span><del>-    SymbolTable* symbolTable = m_scope-&gt;symbolTable();

</del><ins>+    SymbolTable* symbolTable = m_scope-&gt;symbolTable(*vm());

</ins><span class="cx">     if (!symbolTable)

</span><span class="cx">         return String();

</span><span class="cx"> 

</span><span class="lines">@@ -225,7 +225,7 @@

</span><span class="cx"> 

</span><span class="cx"> DebuggerLocation DebuggerScope::location() const

</span><span class="cx"> {

</span><del>-    SymbolTable* symbolTable = m_scope-&gt;symbolTable();

</del><ins>+    SymbolTable* symbolTable = m_scope-&gt;symbolTable(*vm());

</ins><span class="cx">     if (!symbolTable)

</span><span class="cx">         return DebuggerLocation();

</span><span class="cx"> 

</span></span></pre></div>

<a id="trunkSourceJavaScriptCoredfgDFGAbstractInterpreterh"></a>

<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGAbstractInterpreter.h (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGAbstractInterpreter.h        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/JavaScriptCore/dfg/DFGAbstractInterpreter.h        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -197,6 +197,7 @@

</span><span class="cx">     

</span><span class="cx">     CodeBlock* m_codeBlock;

</span><span class="cx">     Graph&amp; m_graph;

</span><ins>+    VM&amp; m_vm;

</ins><span class="cx">     AbstractStateType&amp; m_state;

</span><span class="cx">     std::unique_ptr&lt;PhiChildren&gt; m_phiChildren;

</span><span class="cx"> };

</span></span></pre></div>

<a id="trunkSourceJavaScriptCoredfgDFGAbstractInterpreterInlinesh"></a>

<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -46,6 +46,7 @@

</span><span class="cx"> AbstractInterpreter&lt;AbstractStateType&gt;::AbstractInterpreter(Graph&amp; graph, AbstractStateType&amp; state)

</span><span class="cx">     : m_codeBlock(graph.m_codeBlock)

</span><span class="cx">     , m_graph(graph)

</span><ins>+    , m_vm(m_graph.m_vm)

</ins><span class="cx">     , m_state(state)

</span><span class="cx"> {

</span><span class="cx">     if (m_graph.m_form == SSA)

</span><span class="lines">@@ -559,7 +560,7 @@

</span><span class="cx">     }

</span><span class="cx"> 

</span><span class="cx">     case MakeRope: {

</span><del>-        forNode(node).set(m_graph, m_graph.m_vm.stringStructure.get());

</del><ins>+        forNode(node).set(m_graph, m_vm.stringStructure.get());

</ins><span class="cx">         break;

</span><span class="cx">     }

</span><span class="cx">             

</span><span class="lines">@@ -1090,7 +1091,7 @@

</span><span class="cx">                 setConstant(node, jsBoolean(child.value().isEmpty()));

</span><span class="cx">                 break;

</span><span class="cx">             case IsTypedArrayView:

</span><del>-                setConstant(node, jsBoolean(child.value().isObject() &amp;&amp; isTypedView(child.value().getObject()-&gt;classInfo()-&gt;typedArrayStorageType)));

</del><ins>+                setConstant(node, jsBoolean(child.value().isObject() &amp;&amp; isTypedView(child.value().getObject()-&gt;classInfo(m_vm)-&gt;typedArrayStorageType)));

</ins><span class="cx">                 break;

</span><span class="cx">             default:

</span><span class="cx">                 constantWasSet = false;

</span><span class="lines">@@ -1257,22 +1258,21 @@

</span><span class="cx">     }

</span><span class="cx"> 

</span><span class="cx">     case TypeOf: {

</span><del>-        VM* vm = m_codeBlock-&gt;vm();

</del><span class="cx">         JSValue child = forNode(node-&gt;child1()).value();

</span><span class="cx">         AbstractValue&amp; abstractChild = forNode(node-&gt;child1());

</span><span class="cx">         if (child) {

</span><del>-            JSValue typeString = jsTypeStringForValue(*vm, m_codeBlock-&gt;globalObjectFor(node-&gt;origin.semantic), child);

</del><ins>+            JSValue typeString = jsTypeStringForValue(m_vm, m_codeBlock-&gt;globalObjectFor(node-&gt;origin.semantic), child);

</ins><span class="cx">             setConstant(node, *m_graph.freeze(typeString));

</span><span class="cx">             break;

</span><span class="cx">         }

</span><span class="cx">         

</span><span class="cx">         if (isFullNumberSpeculation(abstractChild.m_type)) {

</span><del>-            setConstant(node, *m_graph.freeze(vm-&gt;smallStrings.numberString()));

</del><ins>+            setConstant(node, *m_graph.freeze(m_vm.smallStrings.numberString()));

</ins><span class="cx">             break;

</span><span class="cx">         }

</span><span class="cx">         

</span><span class="cx">         if (isStringSpeculation(abstractChild.m_type)) {

</span><del>-            setConstant(node, *m_graph.freeze(vm-&gt;smallStrings.stringString()));

</del><ins>+            setConstant(node, *m_graph.freeze(m_vm.smallStrings.stringString()));

</ins><span class="cx">             break;

</span><span class="cx">         }

</span><span class="cx"> 

</span><span class="lines">@@ -1279,22 +1279,22 @@

<span class="cx">         // FIXME: We could use the masquerades-as-undefined watchpoint here.

</span><span class="cx">         // https://bugs.webkit.org/show_bug.cgi?id=144456

</span><span class="cx">         if (!(abstractChild.m_type &amp; ~(SpecObject - SpecObjectOther - SpecFunction))) {

</span><del>-            setConstant(node, *m_graph.freeze(vm-&gt;smallStrings.objectString()));

</del><ins>+            setConstant(node, *m_graph.freeze(m_vm.smallStrings.objectString()));

</ins><span class="cx">             break;

</span><span class="cx">         }

</span><span class="cx">         

</span><span class="cx">         if (isFunctionSpeculation(abstractChild.m_type)) {

</span><del>-            setConstant(node, *m_graph.freeze(vm-&gt;smallStrings.functionString()));

</del><ins>+            setConstant(node, *m_graph.freeze(m_vm.smallStrings.functionString()));

</ins><span class="cx">             break;

</span><span class="cx">         }

</span><span class="cx">         

</span><span class="cx">         if (isBooleanSpeculation(abstractChild.m_type)) {

</span><del>-            setConstant(node, *m_graph.freeze(vm-&gt;smallStrings.booleanString()));

</del><ins>+            setConstant(node, *m_graph.freeze(m_vm.smallStrings.booleanString()));

</ins><span class="cx">             break;

</span><span class="cx">         }

</span><span class="cx"> 

</span><span class="cx">         if (isSymbolSpeculation(abstractChild.m_type)) {

</span><del>-            setConstant(node, *m_graph.freeze(vm-&gt;smallStrings.symbolString()));

</del><ins>+            setConstant(node, *m_graph.freeze(m_vm.smallStrings.symbolString()));

</ins><span class="cx">             break;

</span><span class="cx">         }

</span><span class="cx"> 

</span><span class="lines">@@ -1504,7 +1504,7 @@

</span><span class="cx">         break;

</span><span class="cx"> 

</span><span class="cx">     case StringCharAt:

</span><del>-        forNode(node).set(m_graph, m_graph.m_vm.stringStructure.get());

</del><ins>+        forNode(node).set(m_graph, m_vm.stringStructure.get());

</ins><span class="cx">         break;

</span><span class="cx">             

</span><span class="cx">     case GetByVal: {

</span><span class="lines">@@ -1545,7 +1545,7 @@

</span><span class="cx">                 clobberWorld(node-&gt;origin.semantic, clobberLimit);

</span><span class="cx">                 forNode(node).makeHeapTop();

</span><span class="cx">             } else

</span><del>-                forNode(node).set(m_graph, m_graph.m_vm.stringStructure.get());

</del><ins>+                forNode(node).set(m_graph, m_vm.stringStructure.get());

</ins><span class="cx">             break;

</span><span class="cx">         case Array::DirectArguments:

</span><span class="cx">         case Array::ScopedArguments:

</span><span class="lines">@@ -1728,7 +1728,7 @@

</span><span class="cx">         } else

</span><span class="cx">             clobberWorld(node-&gt;origin.semantic, clobberLimit);

</span><span class="cx">         if (JSValue globalObjectValue = forNode(node-&gt;child1()).m_value) {

</span><del>-            if (JSGlobalObject* globalObject = jsDynamicCast&lt;JSGlobalObject*&gt;(globalObjectValue)) {

</del><ins>+            if (JSGlobalObject* globalObject = jsDynamicCast&lt;JSGlobalObject*&gt;(m_vm, globalObjectValue)) {

</ins><span class="cx">                 if (!globalObject-&gt;isHavingABadTime()) {

</span><span class="cx">                     m_graph.watchpoints().addLazily(globalObject-&gt;havingABadTimeWatchpoint());

</span><span class="cx">                     Structure* structure = globalObject-&gt;regExpMatchesArrayStructure();

</span><span class="lines">@@ -1759,7 +1759,7 @@

<span class="cx">             // This doesn't clobber the world. It just reads and writes regexp state.

</span><span class="cx">         } else

</span><span class="cx">             clobberWorld(node-&gt;origin.semantic, clobberLimit);

</span><del>-        forNode(node).set(m_graph, m_graph.m_vm.stringStructure.get());

</del><ins>+        forNode(node).set(m_graph, m_vm.stringStructure.get());

</ins><span class="cx">         break;

</span><span class="cx"> 

</span><span class="cx">     case Jump:

</span><span class="lines">@@ -1868,7 +1868,7 @@

</span><span class="cx">             RELEASE_ASSERT_NOT_REACHED();

</span><span class="cx">             break;

</span><span class="cx">         }

</span><del>-        forNode(node).set(m_graph, m_graph.m_vm.stringStructure.get());

</del><ins>+        forNode(node).set(m_graph, m_vm.stringStructure.get());

</ins><span class="cx">         break;

</span><span class="cx">     }

</span><span class="cx">         

</span><span class="lines">@@ -1902,7 +1902,7 @@

</span><span class="cx"> 

</span><span class="cx">     case Spread:

</span><span class="cx">         forNode(node).set(

</span><del>-            m_graph, m_graph.m_vm.fixedArrayStructure.get());

</del><ins>+            m_graph, m_vm.fixedArrayStructure.get());

</ins><span class="cx">         break;

</span><span class="cx">         

</span><span class="cx">     case NewArrayBuffer:

</span><span class="lines">@@ -2042,7 +2042,7 @@

</span><span class="cx">         break;

</span><span class="cx">         

</span><span class="cx">     case GetCallee:

</span><del>-        if (FunctionExecutable* executable = jsDynamicCast&lt;FunctionExecutable*&gt;(m_codeBlock-&gt;ownerExecutable())) {

</del><ins>+        if (FunctionExecutable* executable = jsDynamicCast&lt;FunctionExecutable*&gt;(m_vm, m_codeBlock-&gt;ownerExecutable())) {

</ins><span class="cx">             InferredValue* singleton = executable-&gt;singletonFunction();

</span><span class="cx">             if (JSValue value = singleton-&gt;inferredValue()) {

</span><span class="cx">                 m_graph.watchpoints().addLazily(singleton);

</span><span class="lines">@@ -2092,7 +2092,7 @@

</span><span class="cx">         

</span><span class="cx">     case GetScope:

</span><span class="cx">         if (JSValue base = forNode(node-&gt;child1()).m_value) {

</span><del>-            if (JSFunction* function = jsDynamicCast&lt;JSFunction*&gt;(base)) {

</del><ins>+            if (JSFunction* function = jsDynamicCast&lt;JSFunction*&gt;(m_vm, base)) {

</ins><span class="cx">                 setConstant(node, *m_graph.freeze(function-&gt;scope()));

</span><span class="cx">                 break;

</span><span class="cx">             }

</span><span class="lines">@@ -2273,7 +2273,7 @@

</span><span class="cx">         const RegisteredStructureSet&amp; set = node-&gt;structureSet();

</span><span class="cx">         

</span><span class="cx">         if (value.value()) {

</span><del>-            if (Structure* structure = jsDynamicCast&lt;Structure*&gt;(value.value())) {

</del><ins>+            if (Structure* structure = jsDynamicCast&lt;Structure*&gt;(m_vm, value.value())) {

</ins><span class="cx">                 if (set.contains(m_graph.registerStructure(structure))) {

</span><span class="cx">                     m_state.setFoundConstants(true);

</span><span class="cx">                     break;

</span><span class="lines">@@ -2288,7 +2288,7 @@

</span><span class="cx">             m_phiChildren-&gt;forAllTransitiveIncomingValues(

</span><span class="cx">                 node,

</span><span class="cx">                 [&amp;] (Node* incoming) {

</span><del>-                    if (Structure* structure = incoming-&gt;dynamicCastConstant&lt;Structure*&gt;()) {

</del><ins>+                    if (Structure* structure = incoming-&gt;dynamicCastConstant&lt;Structure*&gt;(m_vm)) {

</ins><span class="cx">                         if (set.contains(m_graph.registerStructure(structure)))

</span><span class="cx">                             return;

</span><span class="cx">                     }

</span><span class="lines">@@ -2331,7 +2331,7 @@

</span><span class="cx">     case CheckDOM: {

</span><span class="cx">         JSValue constant = forNode(node-&gt;child1()).value();

</span><span class="cx">         if (constant) {

</span><del>-            if (constant.isCell() &amp;&amp; constant.asCell()-&gt;inherits(node-&gt;classInfo())) {

</del><ins>+            if (constant.isCell() &amp;&amp; constant.asCell()-&gt;inherits(m_vm, node-&gt;classInfo())) {

</ins><span class="cx">                 m_state.setFoundConstants(true);

</span><span class="cx">                 ASSERT(constant);

</span><span class="cx">                 break;

</span><span class="lines">@@ -2520,7 +2520,7 @@

</span><span class="cx">     case GetGetterSetterByOffset: {

</span><span class="cx">         StorageAccessData&amp; data = node-&gt;storageAccessData();

</span><span class="cx">         JSValue result = m_graph.tryGetConstantProperty(forNode(node-&gt;child2()), data.offset);

</span><del>-        if (result &amp;&amp; jsDynamicCast&lt;GetterSetter*&gt;(result)) {

</del><ins>+        if (result &amp;&amp; jsDynamicCast&lt;GetterSetter*&gt;(m_vm, result)) {

</ins><span class="cx">             setConstant(node, *m_graph.freeze(result));

</span><span class="cx">             break;

</span><span class="cx">         }

</span><span class="lines">@@ -2638,7 +2638,7 @@

</span><span class="cx">     case GetExecutable: {

</span><span class="cx">         JSValue value = forNode(node-&gt;child1()).value();

</span><span class="cx">         if (value) {

</span><del>-            JSFunction* function = jsDynamicCast&lt;JSFunction*&gt;(value);

</del><ins>+            JSFunction* function = jsDynamicCast&lt;JSFunction*&gt;(m_vm, value);

</ins><span class="cx">             if (function) {

</span><span class="cx">                 setConstant(node, *m_graph.freeze(function-&gt;executable()));

</span><span class="cx">                 break;

</span></span></pre></div>

<a id="trunkSourceJavaScriptCoredfgDFGByteCodeParsercpp"></a>

<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -341,7 +341,7 @@

</span><span class="cx">             // We have to do some constant-folding here because this enables CreateThis folding. Note

</span><span class="cx">             // that we don't have such watchpoint-based folding for inlined uses of Callee, since in that

<span class="cx">             // case if the function is a singleton then we already know it.

</span><del>-            if (FunctionExecutable* executable = jsDynamicCast&lt;FunctionExecutable*&gt;(m_codeBlock-&gt;ownerExecutable())) {

</del><ins>+            if (FunctionExecutable* executable = jsDynamicCast&lt;FunctionExecutable*&gt;(*m_vm, m_codeBlock-&gt;ownerExecutable())) {

</ins><span class="cx">                 InferredValue* singleton = executable-&gt;singletonFunction();

</span><span class="cx">                 if (JSValue value = singleton-&gt;inferredValue()) {

</span><span class="cx">                     m_graph.watchpoints().addLazily(singleton);

</span><span class="lines">@@ -2431,7 +2431,7 @@

</span><span class="cx">             Structure* regExpStructure = globalObject-&gt;regExpStructure();

</span><span class="cx">             m_graph.registerStructure(regExpStructure);

</span><span class="cx">             ASSERT(regExpStructure-&gt;storedPrototype().isObject());

</span><del>-            ASSERT(regExpStructure-&gt;storedPrototype().asCell()-&gt;classInfo() == RegExpPrototype::info());

</del><ins>+            ASSERT(regExpStructure-&gt;storedPrototype().asCell()-&gt;classInfo(*m_vm) == RegExpPrototype::info());

</ins><span class="cx"> 

</span><span class="cx">             FrozenValue* regExpPrototypeObjectValue = m_graph.freeze(regExpStructure-&gt;storedPrototype());

</span><span class="cx">             Structure* regExpPrototypeStructure = regExpPrototypeObjectValue-&gt;structure();

</span><span class="lines">@@ -2492,7 +2492,7 @@

</span><span class="cx">         Structure* regExpStructure = globalObject-&gt;regExpStructure();

</span><span class="cx">         m_graph.registerStructure(regExpStructure);

</span><span class="cx">         ASSERT(regExpStructure-&gt;storedPrototype().isObject());

</span><del>-        ASSERT(regExpStructure-&gt;storedPrototype().asCell()-&gt;classInfo() == RegExpPrototype::info());

</del><ins>+        ASSERT(regExpStructure-&gt;storedPrototype().asCell()-&gt;classInfo(*m_vm) == RegExpPrototype::info());

</ins><span class="cx"> 

</span><span class="cx">         FrozenValue* regExpPrototypeObjectValue = m_graph.freeze(regExpStructure-&gt;storedPrototype());

</span><span class="cx">         Structure* regExpPrototypeStructure = regExpPrototypeObjectValue-&gt;structure();

</span><span class="lines">@@ -3153,7 +3153,7 @@

</span><span class="cx">     // because it's the most profitable. Also, there are cases where the presence is watchable but

</span><span class="cx">     // we don't want to watch it unless it became an equivalence (see the relationship between

</span><span class="cx">     // (1), (2), and (3) above).

</span><del>-    ObjectPropertyCondition equivalenceCondition = condition.attemptToMakeEquivalenceWithoutBarrier();

</del><ins>+    ObjectPropertyCondition equivalenceCondition = condition.attemptToMakeEquivalenceWithoutBarrier(*m_vm);

</ins><span class="cx">     if (m_graph.watchCondition(equivalenceCondition))

</span><span class="cx">         return GetByOffsetMethod::constant(m_graph.freeze(equivalenceCondition.requiredValue()));

</span><span class="cx">     

</span><span class="lines">@@ -3292,7 +3292,7 @@

</span><span class="cx"> void ByteCodeParser::checkPresenceLike(

</span><span class="cx">     Node* base, UniquedStringImpl* uid, PropertyOffset offset, const StructureSet&amp; set)

</span><span class="cx"> {

</span><del>-    if (JSObject* knownBase = base-&gt;dynamicCastConstant&lt;JSObject*&gt;()) {

</del><ins>+    if (JSObject* knownBase = base-&gt;dynamicCastConstant&lt;JSObject*&gt;(*m_vm)) {

</ins><span class="cx">         if (checkPresenceLike(knownBase, uid, offset, set))

</span><span class="cx">             return;

</span><span class="cx">     }

</span><span class="lines">@@ -3311,7 +3311,7 @@

</span><span class="cx">     

</span><span class="cx">     UniquedStringImpl* uid = m_graph.identifiers()[identifierNumber];

</span><span class="cx">     

</span><del>-    if (JSObject* knownBase = base-&gt;dynamicCastConstant&lt;JSObject*&gt;()) {

</del><ins>+    if (JSObject* knownBase = base-&gt;dynamicCastConstant&lt;JSObject*&gt;(*m_vm)) {

</ins><span class="cx">         // Try to optimize away the structure check. Note that it's not worth doing anything about this

<span class="cx">         // if the base's structure is watched.

</span><span class="cx">         Structure* structure = base-&gt;constant()-&gt;structure();

</span><span class="lines">@@ -3345,7 +3345,7 @@

</span><span class="cx">                     presenceLike(knownBase, uid, variant.offset(), variant.structureSet());

</span><span class="cx">                 if (presenceCondition) {

</span><span class="cx">                     ObjectPropertyCondition equivalenceCondition =

</span><del>-                        presenceCondition.attemptToMakeEquivalenceWithoutBarrier();

</del><ins>+                        presenceCondition.attemptToMakeEquivalenceWithoutBarrier(*m_vm);

</ins><span class="cx">                     if (m_graph.watchCondition(equivalenceCondition))

</span><span class="cx">                         return weakJSConstant(equivalenceCondition.requiredValue());

</span><span class="cx">                     

</span><span class="lines">@@ -3882,13 +3882,13 @@

</span><span class="cx">             int calleeOperand = currentInstruction[2].u.operand;

</span><span class="cx">             Node* callee = get(VirtualRegister(calleeOperand));

</span><span class="cx"> 

</span><del>-            JSFunction* function = callee-&gt;dynamicCastConstant&lt;JSFunction*&gt;();

</del><ins>+            JSFunction* function = callee-&gt;dynamicCastConstant&lt;JSFunction*&gt;(*m_vm);

</ins><span class="cx">             if (!function) {

</span><span class="cx">                 JSCell* cachedFunction = currentInstruction[4].u.jsCell.unvalidatedGet();

</span><span class="cx">                 if (cachedFunction

</span><span class="cx">                     &amp;&amp; cachedFunction != JSCell::seenMultipleCalleeObjects()

</span><span class="cx">                     &amp;&amp; !m_inlineStackTop-&gt;m_exitProfile.hasExitSite(m_currentIndex, BadCell)) {

</span><del>-                    ASSERT(cachedFunction-&gt;inherits(JSFunction::info()));

</del><ins>+                    ASSERT(cachedFunction-&gt;inherits(*m_vm, JSFunction::info()));

</ins><span class="cx"> 

</span><span class="cx">                     FrozenValue* frozen = m_graph.freeze(cachedFunction);

</span><span class="cx">                     addToGraph(CheckCell, OpInfo(frozen), callee);

</span><span class="lines">@@ -5012,7 +5012,7 @@

</span><span class="cx">                         break;

</span><span class="cx">                     }

</span><span class="cx">                 }

</span><del>-                if (JSScope* scope = localBase-&gt;dynamicCastConstant&lt;JSScope*&gt;()) {

</del><ins>+                if (JSScope* scope = localBase-&gt;dynamicCastConstant&lt;JSScope*&gt;(*m_vm)) {

</ins><span class="cx">                     for (unsigned n = depth; n--;)

</span><span class="cx">                         scope = scope-&gt;next();

</span><span class="cx">                     set(VirtualRegister(dst), weakJSConstant(scope));

</span><span class="lines">@@ -5356,7 +5356,7 @@

<span class="cx">             // bytecode-level liveness of the scope register.

</span><span class="cx">             Node* callee = get(VirtualRegister(CallFrameSlot::callee));

</span><span class="cx">             Node* result;

</span><del>-            if (JSFunction* function = callee-&gt;dynamicCastConstant&lt;JSFunction*&gt;())

</del><ins>+            if (JSFunction* function = callee-&gt;dynamicCastConstant&lt;JSFunction*&gt;(*m_vm))

</ins><span class="cx">                 result = weakJSConstant(function-&gt;scope());

</span><span class="cx">             else

</span><span class="cx">                 result = addToGraph(GetScope, callee);

</span></span></pre></div>

<a id="trunkSourceJavaScriptCoredfgDFGConstantFoldingPhasecpp"></a>

<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGConstantFoldingPhase.cpp (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGConstantFoldingPhase.cpp        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/JavaScriptCore/dfg/DFGConstantFoldingPhase.cpp        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -162,7 +162,7 @@

</span><span class="cx">             case CheckDOM: {

</span><span class="cx">                 JSValue constant = m_state.forNode(node-&gt;child1()).value();

</span><span class="cx">                 if (constant) {

</span><del>-                    if (constant.isCell() &amp;&amp; constant.asCell()-&gt;inherits(node-&gt;classInfo())) {

</del><ins>+                    if (constant.isCell() &amp;&amp; constant.asCell()-&gt;inherits(m_graph.m_vm, node-&gt;classInfo())) {

</ins><span class="cx">                         m_interpreter.execute(indexInBlock);

</span><span class="cx">                         node-&gt;remove();

</span><span class="cx">                         eliminated = true;

</span><span class="lines">@@ -209,7 +209,7 @@

</span><span class="cx">                 const RegisteredStructureSet&amp; set = node-&gt;structureSet();

</span><span class="cx">                 

</span><span class="cx">                 if (value.value()) {

</span><del>-                    if (Structure* structure = jsDynamicCast&lt;Structure*&gt;(value.value())) {

</del><ins>+                    if (Structure* structure = jsDynamicCast&lt;Structure*&gt;(m_graph.m_vm, value.value())) {

</ins><span class="cx">                         if (set.contains(m_graph.registerStructure(structure))) {

</span><span class="cx">                             m_interpreter.execute(indexInBlock);

</span><span class="cx">                             node-&gt;remove();

</span><span class="lines">@@ -224,7 +224,7 @@

</span><span class="cx">                     phiChildren-&gt;forAllTransitiveIncomingValues(

</span><span class="cx">                         node,

</span><span class="cx">                         [&amp;] (Node* incoming) {

</span><del>-                            if (Structure* structure = incoming-&gt;dynamicCastConstant&lt;Structure*&gt;()) {

</del><ins>+                            if (Structure* structure = incoming-&gt;dynamicCastConstant&lt;Structure*&gt;(m_graph.m_vm)) {

</ins><span class="cx">                                 if (set.contains(m_graph.registerStructure(structure)))

</span><span class="cx">                                     return;

</span><span class="cx">                             }

</span></span></pre></div>

<a id="trunkSourceJavaScriptCoredfgDFGDesiredWeakReferencescpp"></a>

<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGDesiredWeakReferences.cpp (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGDesiredWeakReferences.cpp        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/JavaScriptCore/dfg/DFGDesiredWeakReferences.cpp        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -68,7 +68,7 @@

</span><span class="cx"> void DesiredWeakReferences::reallyAdd(VM&amp; vm, CommonData* common)

</span><span class="cx"> {

</span><span class="cx">     for (JSCell* target : m_references) {

</span><del>-        if (Structure* structure = jsDynamicCast&lt;Structure*&gt;(target)) {

</del><ins>+        if (Structure* structure = jsDynamicCast&lt;Structure*&gt;(vm, target)) {

</ins><span class="cx">             common-&gt;weakStructureReferences.append(

</span><span class="cx">                 WriteBarrier&lt;Structure&gt;(vm, m_codeBlock, structure));

</span><span class="cx">         } else {

</span><span class="lines">@@ -76,7 +76,7 @@

</span><span class="cx">             // point to other CodeBlocks. We don't want to have them be

</span><span class="cx">             // part of the weak pointer set. For example, an optimized CodeBlock

<span class="cx">             // having a weak pointer to itself will cause it to get collected.

</span><del>-            RELEASE_ASSERT(!jsDynamicCast&lt;CodeBlock*&gt;(target));

</del><ins>+            RELEASE_ASSERT(!jsDynamicCast&lt;CodeBlock*&gt;(vm, target));

</ins><span class="cx"> 

</span><span class="cx">             common-&gt;weakReferences.append(

</span><span class="cx">                 WriteBarrier&lt;JSCell&gt;(vm, m_codeBlock, target));

</span></span></pre></div>

<a id="trunkSourceJavaScriptCoredfgDFGFixupPhasecpp"></a>

<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGFixupPhase.cpp (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGFixupPhase.cpp        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/JavaScriptCore/dfg/DFGFixupPhase.cpp        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -1947,7 +1947,7 @@

</span><span class="cx">             if (!edge)

</span><span class="cx">                 break;

</span><span class="cx">             edge.setUseKind(KnownStringUse);

</span><del>-            JSString* string = edge-&gt;dynamicCastConstant&lt;JSString*&gt;();

</del><ins>+            JSString* string = edge-&gt;dynamicCastConstant&lt;JSString*&gt;(vm());

</ins><span class="cx">             if (!string)

</span><span class="cx">                 continue;

</span><span class="cx">             if (string-&gt;length())

</span></span></pre></div>

<a id="trunkSourceJavaScriptCoredfgDFGFrozenValueh"></a>

<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGFrozenValue.h (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGFrozenValue.h        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/JavaScriptCore/dfg/DFGFrozenValue.h        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -58,7 +58,7 @@

</span><span class="cx">         , m_strength(strength)

</span><span class="cx">     {

</span><span class="cx">         ASSERT((!!value &amp;&amp; value.isCell()) == !!structure);

</span><del>-        ASSERT(!value || !value.isCell() || value.asCell()-&gt;classInfo() == structure-&gt;classInfo());

</del><ins>+        ASSERT(!value || !value.isCell() || value.asCell()-&gt;classInfo(*value.asCell()-&gt;vm()) == structure-&gt;classInfo());

</ins><span class="cx">         ASSERT(!!structure || (strength == WeakValue));

</span><span class="cx">     }

</span><span class="cx">     

</span><span class="lines">@@ -70,12 +70,12 @@

</span><span class="cx">     JSCell* cell() const { return m_value.asCell(); }

</span><span class="cx">     

</span><span class="cx">     template&lt;typename T&gt;

</span><del>-    T dynamicCast()

</del><ins>+    T dynamicCast(VM&amp; vm)

</ins><span class="cx">     {

</span><span class="cx">         JSValue theValue = value();

</span><span class="cx">         if (!theValue)

</span><span class="cx">             return nullptr;

</span><del>-        return jsDynamicCast&lt;T&gt;(theValue);

</del><ins>+        return jsDynamicCast&lt;T&gt;(vm, theValue);

</ins><span class="cx">     }

</span><span class="cx">     template&lt;typename T&gt;

</span><span class="cx">     T cast()

</span></span></pre></div>

<a id="trunkSourceJavaScriptCoredfgDFGGraphcpp"></a>

<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGGraph.cpp (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGGraph.cpp        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/JavaScriptCore/dfg/DFGGraph.cpp        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -270,7 +270,7 @@

</span><span class="cx">                 if (ExecutableBase* executable = variant.executable()) {

</span><span class="cx">                     if (executable-&gt;isHostFunction())

</span><span class="cx">                         out.print(comma, &quot;&lt;host function&gt;&quot;);

</span><del>-                    else if (FunctionExecutable* functionExecutable = jsDynamicCast&lt;FunctionExecutable*&gt;(executable))

</del><ins>+                    else if (FunctionExecutable* functionExecutable = jsDynamicCast&lt;FunctionExecutable*&gt;(m_vm, executable))

</ins><span class="cx">                         out.print(comma, FunctionExecutableDump(functionExecutable));

</span><span class="cx">                     else

</span><span class="cx">                         out.print(comma, &quot;&lt;non-function executable&gt;&quot;);

</span><span class="lines">@@ -1318,7 +1318,7 @@

</span><span class="cx">     if (!base)

</span><span class="cx">         return JSValue();

</span><span class="cx">     

</span><del>-    JSLexicalEnvironment* activation = jsDynamicCast&lt;JSLexicalEnvironment*&gt;(base);

</del><ins>+    JSLexicalEnvironment* activation = jsDynamicCast&lt;JSLexicalEnvironment*&gt;(m_vm, base);

</ins><span class="cx">     if (!activation)

</span><span class="cx">         return JSValue();

</span><span class="cx">     

</span><span class="lines">@@ -1366,7 +1366,7 @@

</span><span class="cx"> {

</span><span class="cx">     if (!value)

</span><span class="cx">         return nullptr;

</span><del>-    JSArrayBufferView* view = jsDynamicCast&lt;JSArrayBufferView*&gt;(value);

</del><ins>+    JSArrayBufferView* view = jsDynamicCast&lt;JSArrayBufferView*&gt;(m_vm, value);

</ins><span class="cx">     if (!value)

</span><span class="cx">         return nullptr;

</span><span class="cx">     if (!view-&gt;length())

</span><span class="lines">@@ -1427,7 +1427,7 @@

</span><span class="cx">     // point to other CodeBlocks. We don't want to have them be

</span><span class="cx">     // part of the weak pointer set. For example, an optimized CodeBlock

<span class="cx">     // having a weak pointer to itself will cause it to get collected.

</span><del>-    RELEASE_ASSERT(!jsDynamicCast&lt;CodeBlock*&gt;(value));

</del><ins>+    RELEASE_ASSERT(!jsDynamicCast&lt;CodeBlock*&gt;(m_vm, value));

</ins><span class="cx">     

</span><span class="cx">     auto result = m_frozenValueMap.add(JSValue::encode(value), nullptr);

</span><span class="cx">     if (LIKELY(!result.isNewEntry))

</span><span class="lines">@@ -1639,9 +1639,9 @@

</span><span class="cx"> 

</span><span class="cx">     // We only care about functions and getters at this point. If you want to access other properties

<span class="cx">     // you'll have to add code for those types.

</span><del>-    JSFunction* function = jsDynamicCast&lt;JSFunction*&gt;(value);

</del><ins>+    JSFunction* function = jsDynamicCast&lt;JSFunction*&gt;(m_vm, value);

</ins><span class="cx">     if (!function) {

</span><del>-        GetterSetter* getterSetter = jsDynamicCast&lt;GetterSetter*&gt;(value);

</del><ins>+        GetterSetter* getterSetter = jsDynamicCast&lt;GetterSetter*&gt;(m_vm, value);

</ins><span class="cx"> 

</span><span class="cx">         if (!getterSetter)

</span><span class="cx">             return false;

</span><span class="lines">@@ -1663,7 +1663,7 @@

</span><span class="cx"> 

</span><span class="cx">     ObjectPropertyCondition equivalenceCondition = conditions.slotBaseCondition();

</span><span class="cx">     RELEASE_ASSERT(equivalenceCondition.hasRequiredValue());

</span><del>-    JSFunction* function = jsDynamicCast&lt;JSFunction*&gt;(equivalenceCondition.condition().requiredValue());

</del><ins>+    JSFunction* function = jsDynamicCast&lt;JSFunction*&gt;(m_vm, equivalenceCondition.condition().requiredValue());

</ins><span class="cx">     if (!function)

</span><span class="cx">         return false;

</span><span class="cx"> 

</span><span class="lines">@@ -1683,7 +1683,7 @@

</span><span class="cx">     Structure* stringObjectStructure = globalObjectFor(codeOrigin)-&gt;stringObjectStructure();

</span><span class="cx">     registerStructure(stringObjectStructure);

</span><span class="cx">     ASSERT(stringObjectStructure-&gt;storedPrototype().isObject());

</span><del>-    ASSERT(stringObjectStructure-&gt;storedPrototype().asCell()-&gt;classInfo() == StringPrototype::info());

</del><ins>+    ASSERT(stringObjectStructure-&gt;storedPrototype().asCell()-&gt;classInfo(*stringObjectStructure-&gt;storedPrototype().asCell()-&gt;vm()) == StringPrototype::info());

</ins><span class="cx"> 

</span><span class="cx">     if (!watchConditions(generateConditionsForPropertyMissConcurrently(m_vm, globalObject, stringObjectStructure, m_vm.propertyNames-&gt;toPrimitiveSymbol.impl())))

</span><span class="cx">         return false;

</span></span></pre></div>

<a id="trunkSourceJavaScriptCoredfgDFGLazyJSValuecpp"></a>

<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGLazyJSValue.cpp (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGLazyJSValue.cpp        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/JavaScriptCore/dfg/DFGLazyJSValue.cpp        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -88,7 +88,7 @@

</span><span class="cx">     return triState(WTF::equal(stringImpl, string));

</span><span class="cx"> }

</span><span class="cx"> 

</span><del>-const StringImpl* LazyJSValue::tryGetStringImpl() const

</del><ins>+const StringImpl* LazyJSValue::tryGetStringImpl(VM&amp; vm) const

</ins><span class="cx"> {

</span><span class="cx">     switch (m_kind) {

</span><span class="cx">     case KnownStringImpl:

</span><span class="lines">@@ -96,7 +96,7 @@

</span><span class="cx">         return u.stringImpl;

</span><span class="cx"> 

</span><span class="cx">     case KnownValue:

</span><del>-        if (JSString* string = value()-&gt;dynamicCast&lt;JSString*&gt;())

</del><ins>+        if (JSString* string = value()-&gt;dynamicCast&lt;JSString*&gt;(vm))

</ins><span class="cx">             return string-&gt;tryGetValueImpl();

</span><span class="cx">         return nullptr;

</span><span class="cx"> 

</span><span class="lines">@@ -115,7 +115,7 @@

</span><span class="cx">         return String(&amp;u.character, 1);

</span><span class="cx"> 

</span><span class="cx">     default:

</span><del>-        if (const StringImpl* string = tryGetStringImpl()) {

</del><ins>+        if (const StringImpl* string = tryGetStringImpl(graph.m_vm)) {

</ins><span class="cx">             unsigned ginormousStringLength = 10000;

</span><span class="cx">             if (string-&gt;length() &gt; ginormousStringLength)

</span><span class="cx">                 return String();

</span></span></pre></div>

<a id="trunkSourceJavaScriptCoredfgDFGLazyJSValueh"></a>

<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGLazyJSValue.h (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGLazyJSValue.h        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/JavaScriptCore/dfg/DFGLazyJSValue.h        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -98,7 +98,7 @@

</span><span class="cx">         return u.character;

</span><span class="cx">     }

</span><span class="cx"> 

</span><del>-    const StringImpl* tryGetStringImpl() const;

</del><ins>+    const StringImpl* tryGetStringImpl(VM&amp;) const;

</ins><span class="cx">     

</span><span class="cx">     String tryGetString(Graph&amp;) const;

</span><span class="cx">     

</span></span></pre></div>

<a id="trunkSourceJavaScriptCoredfgDFGNodecpp"></a>

<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGNode.cpp (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGNode.cpp        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/JavaScriptCore/dfg/DFGNode.cpp        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -175,7 +175,7 @@

</span><span class="cx"> void Node::convertToPutStructureHint(Node* structure)

</span><span class="cx"> {

</span><span class="cx">     ASSERT(m_op == PutStructure);

</span><del>-    ASSERT(structure-&gt;castConstant&lt;Structure*&gt;() == transition()-&gt;next.get());

</del><ins>+    ASSERT(structure-&gt;castConstant&lt;Structure*&gt;(*structure-&gt;asCell()-&gt;vm()) == transition()-&gt;next.get());

</ins><span class="cx">     convertToPutHint(StructurePLoc, child1().node(), structure);

</span><span class="cx"> }

</span><span class="cx"> 

</span></span></pre></div>

<a id="trunkSourceJavaScriptCoredfgDFGNodeh"></a>

<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGNode.h (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGNode.h        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/JavaScriptCore/dfg/DFGNode.h        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -738,17 +738,17 @@

</span><span class="cx">     }

</span><span class="cx">      

</span><span class="cx">     template&lt;typename T&gt;

</span><del>-    T dynamicCastConstant()

</del><ins>+    T dynamicCastConstant(VM&amp; vm)

</ins><span class="cx">     {

</span><span class="cx">         if (!isCellConstant())

</span><span class="cx">             return nullptr;

</span><del>-        return jsDynamicCast&lt;T&gt;(asCell());

</del><ins>+        return jsDynamicCast&lt;T&gt;(vm, asCell());

</ins><span class="cx">     }

</span><span class="cx">     

</span><span class="cx">     template&lt;typename T&gt;

</span><del>-    T castConstant()

</del><ins>+    T castConstant(VM&amp; vm)

</ins><span class="cx">     {

</span><del>-        T result = dynamicCastConstant&lt;T&gt;();

</del><ins>+        T result = dynamicCastConstant&lt;T&gt;(vm);

</ins><span class="cx">         RELEASE_ASSERT(result);

</span><span class="cx">         return result;

</span><span class="cx">     }

</span></span></pre></div>

<a id="trunkSourceJavaScriptCoredfgDFGOperationscpp"></a>

<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGOperations.cpp (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGOperations.cpp        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/JavaScriptCore/dfg/DFGOperations.cpp        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -838,7 +838,7 @@

</span><span class="cx">     JSValue base = JSValue::decode(encodedBase);

</span><span class="cx">     JSValue argument = JSValue::decode(encodedArgument);

</span><span class="cx">     

</span><del>-    if (!base.inherits(RegExpObject::info()))

</del><ins>+    if (!base.inherits(vm, RegExpObject::info()))

</ins><span class="cx">         return throwVMTypeError(exec, scope);

</span><span class="cx"> 

</span><span class="cx">     JSString* input = argument.toStringOrNull(exec);

</span><span class="lines">@@ -885,7 +885,7 @@

</span><span class="cx">     JSValue base = JSValue::decode(encodedBase);

</span><span class="cx">     JSValue argument = JSValue::decode(encodedArgument);

</span><span class="cx"> 

</span><del>-    if (!base.inherits(RegExpObject::info())) {

</del><ins>+    if (!base.inherits(vm, RegExpObject::info())) {

</ins><span class="cx">         throwTypeError(exec, scope);

</span><span class="cx">         return false;

</span><span class="cx">     }

</span><span class="lines">@@ -1406,7 +1406,7 @@

</span><span class="cx">     VM&amp; vm = exec-&gt;vm();

</span><span class="cx">     NativeCallFrameTracer tracer(&amp;vm, exec);

</span><span class="cx"> 

</span><del>-    ASSERT(jsDynamicCast&lt;JSObject*&gt;(object));

</del><ins>+    ASSERT(jsDynamicCast&lt;JSObject*&gt;(vm, object));

</ins><span class="cx">     

</span><span class="cx">     if (object-&gt;structure(vm)-&gt;masqueradesAsUndefined(globalObject))

</span><span class="cx">         return false;

</span><span class="lines">@@ -1426,7 +1426,7 @@

</span><span class="cx">     VM&amp; vm = exec-&gt;vm();

</span><span class="cx">     NativeCallFrameTracer tracer(&amp;vm, exec);

</span><span class="cx"> 

</span><del>-    ASSERT(jsDynamicCast&lt;JSObject*&gt;(object));

</del><ins>+    ASSERT(jsDynamicCast&lt;JSObject*&gt;(vm, object));

</ins><span class="cx">     

</span><span class="cx">     if (object-&gt;structure(vm)-&gt;masqueradesAsUndefined(globalObject))

</span><span class="cx">         return false;

</span><span class="lines">@@ -1446,7 +1446,7 @@

</span><span class="cx">     VM&amp; vm = exec-&gt;vm();

</span><span class="cx">     NativeCallFrameTracer tracer(&amp;vm, exec);

</span><span class="cx"> 

</span><del>-    ASSERT(jsDynamicCast&lt;JSObject*&gt;(object));

</del><ins>+    ASSERT(jsDynamicCast&lt;JSObject*&gt;(vm, object));

</ins><span class="cx">     

</span><span class="cx">     if (object-&gt;structure(vm)-&gt;masqueradesAsUndefined(globalObject))

</span><span class="cx">         return vm.smallStrings.undefinedString();

</span><span class="lines">@@ -1466,7 +1466,7 @@

</span><span class="cx">     VM&amp; vm = exec-&gt;vm();

</span><span class="cx">     NativeCallFrameTracer tracer(&amp;vm, exec);

</span><span class="cx"> 

</span><del>-    ASSERT(jsDynamicCast&lt;JSObject*&gt;(object));

</del><ins>+    ASSERT(jsDynamicCast&lt;JSObject*&gt;(vm, object));

</ins><span class="cx">     

</span><span class="cx">     if (object-&gt;structure(vm)-&gt;masqueradesAsUndefined(globalObject))

</span><span class="cx">         return static_cast&lt;int32_t&gt;(TypeofType::Undefined);

</span><span class="lines">@@ -1946,7 +1946,7 @@

</span><span class="cx">     unsigned length = 0;

</span><span class="cx">     for (unsigned i = 0; i &lt; numItems; i++) {

</span><span class="cx">         JSValue value = JSValue::decode(values[i]);

</span><del>-        if (JSFixedArray* array = jsDynamicCast&lt;JSFixedArray*&gt;(value))

</del><ins>+        if (JSFixedArray* array = jsDynamicCast&lt;JSFixedArray*&gt;(vm, value))

</ins><span class="cx">             length += array-&gt;size();

</span><span class="cx">         else

</span><span class="cx">             ++length;

</span><span class="lines">@@ -1962,7 +1962,7 @@

</span><span class="cx">     unsigned index = 0;

</span><span class="cx">     for (unsigned i = 0; i &lt; numItems; i++) {

</span><span class="cx">         JSValue value = JSValue::decode(values[i]);

</span><del>-        if (JSFixedArray* array = jsDynamicCast&lt;JSFixedArray*&gt;(value)) {

</del><ins>+        if (JSFixedArray* array = jsDynamicCast&lt;JSFixedArray*&gt;(vm, value)) {

</ins><span class="cx">             // We are spreading.

</span><span class="cx">             for (unsigned i = 0; i &lt; array-&gt;size(); i++) {

</span><span class="cx">                 result-&gt;initializeIndex(vm, index, array-&gt;get(i));

</span></span></pre></div>

<a id="trunkSourceJavaScriptCoredfgDFGSafeToExecuteh"></a>

<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGSafeToExecute.h (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGSafeToExecute.h        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/JavaScriptCore/dfg/DFGSafeToExecute.h        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -433,7 +433,7 @@

</span><span class="cx">         PropertyOffset offset = node-&gt;storageAccessData().offset;

</span><span class="cx"> 

</span><span class="cx">         if (state.structureClobberState() == StructuresAreWatched) {

</span><del>-            if (JSObject* knownBase = node-&gt;child1()-&gt;dynamicCastConstant&lt;JSObject*&gt;()) {

</del><ins>+            if (JSObject* knownBase = node-&gt;child1()-&gt;dynamicCastConstant&lt;JSObject*&gt;(graph.m_vm)) {

</ins><span class="cx">                 if (graph.isSafeToLoad(knownBase, offset))

</span><span class="cx">                     return true;

</span><span class="cx">             }

</span></span></pre></div>

<a id="trunkSourceJavaScriptCoredfgDFGSpeculativeJITcpp"></a>

<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -1040,7 +1040,7 @@

</span><span class="cx">     SpeculateCellOperand base(this, node-&gt;child2());

</span><span class="cx">     GPRReg baseGPR = base.gpr();

</span><span class="cx">     

</span><del>-    if (JSString* string = node-&gt;child1()-&gt;dynamicCastConstant&lt;JSString*&gt;()) {

</del><ins>+    if (JSString* string = node-&gt;child1()-&gt;dynamicCastConstant&lt;JSString*&gt;(*m_jit.vm())) {

</ins><span class="cx">         if (string-&gt;tryGetValueImpl() &amp;&amp; string-&gt;tryGetValueImpl()-&gt;isAtomic()) {

</span><span class="cx">             StructureStubInfo* stubInfo = m_jit.codeBlock()-&gt;addStubInfo(AccessType::In);

</span><span class="cx">             

</span><span class="lines">@@ -9269,7 +9269,7 @@

</span><span class="cx"> void SpeculativeJIT::compileMaterializeNewObject(Node* node)

</span><span class="cx"> {

</span><span class="cx">     RegisteredStructure structure = node-&gt;structureSet().at(0);

</span><del>-    ASSERT(m_jit.graph().varArgChild(node, 0)-&gt;dynamicCastConstant&lt;Structure*&gt;() == structure.get());

</del><ins>+    ASSERT(m_jit.graph().varArgChild(node, 0)-&gt;dynamicCastConstant&lt;Structure*&gt;(*m_jit.vm()) == structure.get());

</ins><span class="cx"> 

</span><span class="cx">     ObjectMaterializationData&amp; data = node-&gt;objectMaterializationData();

</span><span class="cx">         

</span></span></pre></div>

<a id="trunkSourceJavaScriptCoredfgDFGSpeculativeJITh"></a>

<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -152,7 +152,7 @@

</span><span class="cx">             // point to other CodeBlocks. We don't want to have them be

</span><span class="cx">             // part of the weak pointer set. For example, an optimized CodeBlock

<span class="cx">             // having a weak pointer to itself will cause it to get collected.

</span><del>-            ASSERT(!jsDynamicCast&lt;CodeBlock*&gt;(cell));

</del><ins>+            ASSERT(!jsDynamicCast&lt;CodeBlock*&gt;(graph.m_vm, cell));

</ins><span class="cx"> 

</span><span class="cx">             graph.m_plan.weakReferences.addLazily(cell);

</span><span class="cx">             return TrustedImmPtr(bitwise_cast&lt;size_t&gt;(cell));

</span></span></pre></div>

<a id="trunkSourceJavaScriptCoredfgDFGSpeculativeJIT32_64cpp"></a>

<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -743,7 +743,7 @@

</span><span class="cx">     FunctionExecutable* functionExecutable = nullptr;

</span><span class="cx">     if (isDirect) {

</span><span class="cx">         executable = node-&gt;castOperand&lt;ExecutableBase*&gt;();

</span><del>-        functionExecutable = jsDynamicCast&lt;FunctionExecutable*&gt;(executable);

</del><ins>+        functionExecutable = jsDynamicCast&lt;FunctionExecutable*&gt;(*m_jit.vm(), executable);

</ins><span class="cx">     }

</span><span class="cx">     

</span><span class="cx">     unsigned numPassedArgs = 0;

</span><span class="lines">@@ -3221,7 +3221,7 @@

</span><span class="cx">         if (node-&gt;child1().useKind() == StringUse

</span><span class="cx">             &amp;&amp; node-&gt;child2().useKind() == RegExpObjectUse

</span><span class="cx">             &amp;&amp; node-&gt;child3().useKind() == StringUse) {

</span><del>-            if (JSString* replace = node-&gt;child3()-&gt;dynamicCastConstant&lt;JSString*&gt;()) {

</del><ins>+            if (JSString* replace = node-&gt;child3()-&gt;dynamicCastConstant&lt;JSString*&gt;(*m_jit.vm())) {

</ins><span class="cx">                 if (!replace-&gt;length()) {

</span><span class="cx">                     SpeculateCellOperand string(this, node-&gt;child1());

</span><span class="cx">                     SpeculateCellOperand regExp(this, node-&gt;child2());

</span></span></pre></div>

<a id="trunkSourceJavaScriptCoredfgDFGSpeculativeJIT64cpp"></a>

<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -719,7 +719,7 @@

</span><span class="cx">     FunctionExecutable* functionExecutable = nullptr;

</span><span class="cx">     if (isDirect) {

</span><span class="cx">         executable = node-&gt;castOperand&lt;ExecutableBase*&gt;();

</span><del>-        functionExecutable = jsDynamicCast&lt;FunctionExecutable*&gt;(executable);

</del><ins>+        functionExecutable = jsDynamicCast&lt;FunctionExecutable*&gt;(*m_jit.vm(), executable);

</ins><span class="cx">     }

</span><span class="cx">     

</span><span class="cx">     unsigned numPassedArgs = 0;

</span><span class="lines">@@ -3281,7 +3281,7 @@

</span><span class="cx">         if (node-&gt;child1().useKind() == StringUse

</span><span class="cx">             &amp;&amp; node-&gt;child2().useKind() == RegExpObjectUse

</span><span class="cx">             &amp;&amp; node-&gt;child3().useKind() == StringUse) {

</span><del>-            if (JSString* replace = node-&gt;child3()-&gt;dynamicCastConstant&lt;JSString*&gt;()) {

</del><ins>+            if (JSString* replace = node-&gt;child3()-&gt;dynamicCastConstant&lt;JSString*&gt;(*m_jit.vm())) {

</ins><span class="cx">                 if (!replace-&gt;length()) {

</span><span class="cx">                     SpeculateCellOperand string(this, node-&gt;child1());

</span><span class="cx">                     SpeculateCellOperand regExp(this, node-&gt;child2());

</span></span></pre></div>

<a id="trunkSourceJavaScriptCoredfgDFGStrengthReductionPhasecpp"></a>

<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGStrengthReductionPhase.cpp (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGStrengthReductionPhase.cpp        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/JavaScriptCore/dfg/DFGStrengthReductionPhase.cpp        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -404,7 +404,7 @@

</span><span class="cx">         }

</span><span class="cx"> 

</span><span class="cx">         case GetGlobalObject: {

</span><del>-            if (JSObject* object = m_node-&gt;child1()-&gt;dynamicCastConstant&lt;JSObject*&gt;()) {

</del><ins>+            if (JSObject* object = m_node-&gt;child1()-&gt;dynamicCastConstant&lt;JSObject*&gt;(vm())) {

</ins><span class="cx">                 m_graph.convertToConstant(m_node, object-&gt;globalObject());

</span><span class="cx">                 m_changed = true;

</span><span class="cx">                 break;

</span><span class="lines">@@ -414,7 +414,7 @@

</span><span class="cx"> 

</span><span class="cx">         case RegExpExec:

</span><span class="cx">         case RegExpTest: {

</span><del>-            JSGlobalObject* globalObject = m_node-&gt;child1()-&gt;dynamicCastConstant&lt;JSGlobalObject*&gt;();

</del><ins>+            JSGlobalObject* globalObject = m_node-&gt;child1()-&gt;dynamicCastConstant&lt;JSGlobalObject*&gt;(vm());

</ins><span class="cx">             if (!globalObject) {

</span><span class="cx">                 if (verbose)

</span><span class="cx">                     dataLog(&quot;Giving up because no global object.\n&quot;);

</span><span class="lines">@@ -429,7 +429,7 @@

</span><span class="cx"> 

</span><span class="cx">             Node* regExpObjectNode = m_node-&gt;child2().node();

</span><span class="cx">             RegExp* regExp;

</span><del>-            if (RegExpObject* regExpObject = regExpObjectNode-&gt;dynamicCastConstant&lt;RegExpObject*&gt;())

</del><ins>+            if (RegExpObject* regExpObject = regExpObjectNode-&gt;dynamicCastConstant&lt;RegExpObject*&gt;(vm()))

</ins><span class="cx">                 regExp = regExpObject-&gt;regExp();

</span><span class="cx">             else if (regExpObjectNode-&gt;op() == NewRegexp)

</span><span class="cx">                 regExp = regExpObjectNode-&gt;castOperand&lt;RegExp*&gt;();

</span><span class="lines">@@ -670,7 +670,7 @@

</span><span class="cx">             

</span><span class="cx">             Node* regExpObjectNode = m_node-&gt;child2().node();

</span><span class="cx">             RegExp* regExp;

</span><del>-            if (RegExpObject* regExpObject = regExpObjectNode-&gt;dynamicCastConstant&lt;RegExpObject*&gt;())

</del><ins>+            if (RegExpObject* regExpObject = regExpObjectNode-&gt;dynamicCastConstant&lt;RegExpObject*&gt;(vm()))

</ins><span class="cx">                 regExp = regExpObject-&gt;regExp();

</span><span class="cx">             else if (regExpObjectNode-&gt;op() == NewRegexp)

</span><span class="cx">                 regExp = regExpObjectNode-&gt;castOperand&lt;RegExp*&gt;();

</span><span class="lines">@@ -767,7 +767,7 @@

</span><span class="cx">         case TailCall: {

</span><span class="cx">             ExecutableBase* executable = nullptr;

</span><span class="cx">             Edge callee = m_graph.varArgChild(m_node, 0);

</span><del>-            if (JSFunction* function = callee-&gt;dynamicCastConstant&lt;JSFunction*&gt;())

</del><ins>+            if (JSFunction* function = callee-&gt;dynamicCastConstant&lt;JSFunction*&gt;(vm()))

</ins><span class="cx">                 executable = function-&gt;executable();

</span><span class="cx">             else if (callee-&gt;isFunctionAllocation())

</span><span class="cx">                 executable = callee-&gt;castOperand&lt;FunctionExecutable*&gt;();

</span><span class="lines">@@ -775,7 +775,7 @@

</span><span class="cx">             if (!executable)

</span><span class="cx">                 break;

</span><span class="cx">             

</span><del>-            if (FunctionExecutable* functionExecutable = jsDynamicCast&lt;FunctionExecutable*&gt;(executable)) {

</del><ins>+            if (FunctionExecutable* functionExecutable = jsDynamicCast&lt;FunctionExecutable*&gt;(vm(), executable)) {

</ins><span class="cx">                 // We need to update m_parameterSlots before we get to the backend, but we don't

<span class="cx">                 // want to do too much of this.

</span><span class="cx">                 unsigned numAllocatedArgs =

</span></span></pre></div>

<a id="trunkSourceJavaScriptCoreftlFTLLowerDFGToB3cpp"></a>

<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -5972,7 +5972,7 @@

</span><span class="cx">         bool isConstruct = node-&gt;op() == DirectConstruct;

</span><span class="cx">         

</span><span class="cx">         ExecutableBase* executable = node-&gt;castOperand&lt;ExecutableBase*&gt;();

</span><del>-        FunctionExecutable* functionExecutable = jsDynamicCast&lt;FunctionExecutable*&gt;(executable);

</del><ins>+        FunctionExecutable* functionExecutable = jsDynamicCast&lt;FunctionExecutable*&gt;(vm(), executable);

</ins><span class="cx">         

</span><span class="cx">         unsigned numPassedArgs = node-&gt;numChildren() - 1;

</span><span class="cx">         unsigned numAllocatedArgs = numPassedArgs;

</span><span class="lines">@@ -8044,7 +8044,7 @@

</span><span class="cx">         Node* node = m_node;

</span><span class="cx">         Edge base = node-&gt;child2();

</span><span class="cx">         LValue cell = lowCell(base);

</span><del>-        if (JSString* string = node-&gt;child1()-&gt;dynamicCastConstant&lt;JSString*&gt;()) {

</del><ins>+        if (JSString* string = node-&gt;child1()-&gt;dynamicCastConstant&lt;JSString*&gt;(vm())) {

</ins><span class="cx">             if (string-&gt;tryGetValueImpl() &amp;&amp; string-&gt;tryGetValueImpl()-&gt;isAtomic()) {

</span><span class="cx">                 UniquedStringImpl* str = bitwise_cast&lt;UniquedStringImpl*&gt;(string-&gt;tryGetValueImpl());

</span><span class="cx">                 B3::PatchpointValue* patchpoint = m_out.patchpoint(Int64);

</span><span class="lines">@@ -8224,7 +8224,7 @@

</span><span class="cx">     void compileOverridesHasInstance()

</span><span class="cx">     {

</span><span class="cx">         FrozenValue* defaultHasInstanceFunction = m_node-&gt;cellOperand();

</span><del>-        ASSERT(defaultHasInstanceFunction-&gt;cell()-&gt;inherits(JSFunction::info()));

</del><ins>+        ASSERT(defaultHasInstanceFunction-&gt;cell()-&gt;inherits(vm(), JSFunction::info()));

</ins><span class="cx"> 

</span><span class="cx">         LValue constructor = lowCell(m_node-&gt;child1());

</span><span class="cx">         LValue hasInstance = lowJSValue(m_node-&gt;child2());

</span><span class="lines">@@ -8892,7 +8892,7 @@

</span><span class="cx"> 

</span><span class="cx">         LValue scope = lowCell(m_graph.varArgChild(m_node, 1));

</span><span class="cx">         SymbolTable* table = m_node-&gt;castOperand&lt;SymbolTable*&gt;();

</span><del>-        ASSERT(table == m_graph.varArgChild(m_node, 0)-&gt;castConstant&lt;SymbolTable*&gt;());

</del><ins>+        ASSERT(table == m_graph.varArgChild(m_node, 0)-&gt;castConstant&lt;SymbolTable*&gt;(vm()));

</ins><span class="cx">         RegisteredStructure structure = m_graph.registerStructure(m_graph.globalObjectFor(m_node-&gt;origin.semantic)-&gt;activationStructure());

</span><span class="cx"> 

</span><span class="cx">         LBasicBlock slowPath = m_out.newBlock();

</span><span class="lines">@@ -9046,7 +9046,7 @@

</span><span class="cx">     void compileNewRegexp()

</span><span class="cx">     {

</span><span class="cx">         FrozenValue* regexp = m_node-&gt;cellOperand();

</span><del>-        ASSERT(regexp-&gt;cell()-&gt;inherits(RegExp::info()));

</del><ins>+        ASSERT(regexp-&gt;cell()-&gt;inherits(vm(), RegExp::info()));

</ins><span class="cx">         LValue result = vmCall(

</span><span class="cx">             pointerType(),

</span><span class="cx">             m_out.operation(operationNewRegexp), m_callFrame,

</span><span class="lines">@@ -9067,7 +9067,7 @@

</span><span class="cx">             &amp;&amp; m_node-&gt;child2().useKind() == RegExpObjectUse

</span><span class="cx">             &amp;&amp; m_node-&gt;child3().useKind() == StringUse) {

</span><span class="cx"> 

</span><del>-            if (JSString* replace = m_node-&gt;child3()-&gt;dynamicCastConstant&lt;JSString*&gt;()) {

</del><ins>+            if (JSString* replace = m_node-&gt;child3()-&gt;dynamicCastConstant&lt;JSString*&gt;(vm())) {

</ins><span class="cx">                 if (!replace-&gt;length()) {

</span><span class="cx">                     LValue string = lowString(m_node-&gt;child1());

</span><span class="cx">                     LValue regExp = lowRegExpObject(m_node-&gt;child2());

</span><span class="lines">@@ -13700,7 +13700,7 @@

</span><span class="cx">         // point to other CodeBlocks. We don't want to have them be

</span><span class="cx">         // part of the weak pointer set. For example, an optimized CodeBlock

<span class="cx">         // having a weak pointer to itself will cause it to get collected.

</span><del>-        RELEASE_ASSERT(!jsDynamicCast&lt;CodeBlock*&gt;(pointer));

</del><ins>+        RELEASE_ASSERT(!jsDynamicCast&lt;CodeBlock*&gt;(vm(), pointer));

</ins><span class="cx"> 

</span><span class="cx">         addWeakReference(pointer);

</span><span class="cx">         return m_out.weakPointer(m_graph, pointer);

</span></span></pre></div>

<a id="trunkSourceJavaScriptCoreftlFTLOperationscpp"></a>

<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/ftl/FTLOperations.cpp (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/JavaScriptCore/ftl/FTLOperations.cpp        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/JavaScriptCore/ftl/FTLOperations.cpp        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -437,7 +437,7 @@

</span><span class="cx">             if (property.location().kind() == NewArrayWithSpreadArgumentPLoc) {

</span><span class="cx">                 ++numProperties;

</span><span class="cx">                 JSValue value = JSValue::decode(values[i]);

</span><del>-                if (JSFixedArray* fixedArray = jsDynamicCast&lt;JSFixedArray*&gt;(value))

</del><ins>+                if (JSFixedArray* fixedArray = jsDynamicCast&lt;JSFixedArray*&gt;(vm, value))

</ins><span class="cx">                     arraySize += fixedArray-&gt;size();

</span><span class="cx">                 else

</span><span class="cx">                     arraySize += 1;

</span><span class="lines">@@ -476,7 +476,7 @@

</span><span class="cx"> 

</span><span class="cx">         unsigned arrayIndex = 0;

</span><span class="cx">         for (JSValue value : arguments) {

</span><del>-            if (JSFixedArray* fixedArray = jsDynamicCast&lt;JSFixedArray*&gt;(value)) {

</del><ins>+            if (JSFixedArray* fixedArray = jsDynamicCast&lt;JSFixedArray*&gt;(vm, value)) {

</ins><span class="cx">                 for (unsigned i = 0; i &lt; fixedArray-&gt;size(); i++) {

</span><span class="cx">                     ASSERT(fixedArray-&gt;get(i));

</span><span class="cx">                     result-&gt;initializeIndex(vm, arrayIndex, fixedArray-&gt;get(i));

</span></span></pre></div>

<a id="trunkSourceJavaScriptCoreheapCodeBlockSetcpp"></a>

<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/heap/CodeBlockSet.cpp (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/JavaScriptCore/heap/CodeBlockSet.cpp        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/JavaScriptCore/heap/CodeBlockSet.cpp        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -61,17 +61,17 @@

</span><span class="cx">         codeBlock-&gt;clearVisitWeaklyHasBeenCalled();

</span><span class="cx"> }

</span><span class="cx"> 

</span><del>-void CodeBlockSet::lastChanceToFinalize()

</del><ins>+void CodeBlockSet::lastChanceToFinalize(VM&amp; vm)

</ins><span class="cx"> {

</span><span class="cx">     LockHolder locker(&amp;m_lock);

</span><span class="cx">     for (CodeBlock* codeBlock : m_newCodeBlocks)

</span><del>-        codeBlock-&gt;structure()-&gt;classInfo()-&gt;methodTable.destroy(codeBlock);

</del><ins>+        codeBlock-&gt;structure(vm)-&gt;classInfo()-&gt;methodTable.destroy(codeBlock);

</ins><span class="cx"> 

</span><span class="cx">     for (CodeBlock* codeBlock : m_oldCodeBlocks)

</span><del>-        codeBlock-&gt;structure()-&gt;classInfo()-&gt;methodTable.destroy(codeBlock);

</del><ins>+        codeBlock-&gt;structure(vm)-&gt;classInfo()-&gt;methodTable.destroy(codeBlock);

</ins><span class="cx"> }

</span><span class="cx"> 

</span><del>-void CodeBlockSet::deleteUnmarkedAndUnreferenced(CollectionScope scope)

</del><ins>+void CodeBlockSet::deleteUnmarkedAndUnreferenced(VM&amp; vm, CollectionScope scope)

</ins><span class="cx"> {

</span><span class="cx">     LockHolder locker(&amp;m_lock);

</span><span class="cx">     Vector&lt;CodeBlock*&gt; unmarked;

</span><span class="lines">@@ -83,7 +83,7 @@

</span><span class="cx">             unmarked.append(codeBlock);

</span><span class="cx">         }

</span><span class="cx">         for (CodeBlock* codeBlock : unmarked) {

</span><del>-            codeBlock-&gt;structure()-&gt;classInfo()-&gt;methodTable.destroy(codeBlock);

</del><ins>+            codeBlock-&gt;structure(vm)-&gt;classInfo()-&gt;methodTable.destroy(codeBlock);

</ins><span class="cx">             set.remove(codeBlock);

</span><span class="cx">         }

</span><span class="cx">         unmarked.resize(0);

</span></span></pre></div>

<a id="trunkSourceJavaScriptCoreheapCodeBlockSeth"></a>

<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/heap/CodeBlockSet.h (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/JavaScriptCore/heap/CodeBlockSet.h        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/JavaScriptCore/heap/CodeBlockSet.h        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -38,6 +38,7 @@

</span><span class="cx"> class CodeBlock;

</span><span class="cx"> class Heap;

</span><span class="cx"> class JSCell;

</span><ins>+class VM;

</ins><span class="cx"> 

</span><span class="cx"> // CodeBlockSet tracks all CodeBlocks. Every CodeBlock starts out with one

</span><span class="cx"> // reference coming in from GC. The GC is responsible for freeing CodeBlocks

</span><span class="lines">@@ -50,7 +51,7 @@

</span><span class="cx">     CodeBlockSet();

</span><span class="cx">     ~CodeBlockSet();

</span><span class="cx"> 

</span><del>-    void lastChanceToFinalize();

</del><ins>+    void lastChanceToFinalize(VM&amp;);

</ins><span class="cx">     

<span class="cx">     // Add a CodeBlock. This is only called by CodeBlock constructors.

</span><span class="cx">     void add(CodeBlock*);

</span><span class="lines">@@ -67,7 +68,7 @@

</span><span class="cx">     

</span><span class="cx">     // Delete all code blocks that are only referenced by this set (i.e. owned

<span class="cx">     // by this set), and that have not been marked.

</span><del>-    void deleteUnmarkedAndUnreferenced(CollectionScope);

</del><ins>+    void deleteUnmarkedAndUnreferenced(VM&amp;, CollectionScope);

</ins><span class="cx">     

</span><span class="cx">     void clearCurrentlyExecuting();

</span><span class="cx"> 

</span></span></pre></div>

<a id="trunkSourceJavaScriptCoreheapGCAssertionsh"></a>

<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/heap/GCAssertions.h (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/JavaScriptCore/heap/GCAssertions.h        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/JavaScriptCore/heap/GCAssertions.h        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -37,7 +37,7 @@

</span><span class="cx"> 

</span><span class="cx"> #define ASSERT_GC_OBJECT_INHERITS(object, classInfo) do {\

</span><span class="cx">     ASSERT_GC_OBJECT_LOOKS_VALID(object); \

</span><del>-    RELEASE_ASSERT(object-&gt;inherits(classInfo)); \

</del><ins>+    RELEASE_ASSERT(object-&gt;inherits(*object-&gt;JSCell::vm(), classInfo)); \

</ins><span class="cx"> } while (0)

</span><span class="cx"> 

<span class="cx"> // Used to avoid triggering -Wundefined-bool-conversion.

</span><span class="lines">@@ -47,7 +47,7 @@

</span><span class="cx"> 

</span><span class="cx"> #define ASSERT_THIS_GC_OBJECT_INHERITS(classInfo) do {\

</span><span class="cx">     ASSERT_THIS_GC_OBJECT_LOOKS_VALID(); \

</span><del>-    RELEASE_ASSERT(this-&gt;inherits(classInfo)); \

</del><ins>+    RELEASE_ASSERT(this-&gt;inherits(*this-&gt;vm(), classInfo)); \

</ins><span class="cx"> } while (0)

</span><span class="cx"> 

</span><span class="cx"> #else

</span></span></pre></div>

<a id="trunkSourceJavaScriptCoreheapHeapcpp"></a>

<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/heap/Heap.cpp (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/JavaScriptCore/heap/Heap.cpp        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/JavaScriptCore/heap/Heap.cpp        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -130,10 +130,10 @@

</span><span class="cx">     return true;

</span><span class="cx"> }

</span><span class="cx"> 

</span><del>-void recordType(TypeCountSet&amp; set, JSCell* cell)

</del><ins>+void recordType(VM&amp; vm, TypeCountSet&amp; set, JSCell* cell)

</ins><span class="cx"> {

</span><span class="cx">     const char* typeName = &quot;[unknown]&quot;;

</span><del>-    const ClassInfo* info = cell-&gt;classInfo();

</del><ins>+    const ClassInfo* info = cell-&gt;classInfo(vm);

</ins><span class="cx">     if (info &amp;&amp; info-&gt;className)

</span><span class="cx">         typeName = info-&gt;className;

</span><span class="cx">     set.add(typeName);

</span><span class="lines">@@ -364,7 +364,7 @@

</span><span class="cx">     }

</span><span class="cx">     

</span><span class="cx">     m_arrayBuffers.lastChanceToFinalize();

</span><del>-    m_codeBlocks-&gt;lastChanceToFinalize();

</del><ins>+    m_codeBlocks-&gt;lastChanceToFinalize(*m_vm);

</ins><span class="cx">     m_objectSpace.stopAllocating();

</span><span class="cx">     m_objectSpace.lastChanceToFinalize();

</span><span class="cx">     releaseDelayedReleasedObjects();

</span><span class="lines">@@ -887,7 +887,7 @@

</span><span class="cx">     std::unique_ptr&lt;TypeCountSet&gt; result = std::make_unique&lt;TypeCountSet&gt;();

</span><span class="cx">     forEachProtectedCell(

</span><span class="cx">         [&amp;] (JSCell* cell) {

</span><del>-            recordType(*result, cell);

</del><ins>+            recordType(*vm(), *result, cell);

</ins><span class="cx">         });

</span><span class="cx">     return result;

</span><span class="cx"> }

</span><span class="lines">@@ -900,7 +900,7 @@

</span><span class="cx">         iterationScope,

</span><span class="cx">         [&amp;] (HeapCell* cell, HeapCell::Kind kind) -&gt; IterationStatus {

</span><span class="cx">             if (kind == HeapCell::JSCell)

</span><del>-                recordType(*result, static_cast&lt;JSCell*&gt;(cell));

</del><ins>+                recordType(*vm(), *result, static_cast&lt;JSCell*&gt;(cell));

</ins><span class="cx">             return IterationStatus::Continue;

</span><span class="cx">         });

</span><span class="cx">     return result;

</span><span class="lines">@@ -960,7 +960,7 @@

</span><span class="cx"> void Heap::deleteUnmarkedCompiledCode()

</span><span class="cx"> {

</span><span class="cx">     clearUnmarkedExecutables();

</span><del>-    m_codeBlocks-&gt;deleteUnmarkedAndUnreferenced(*m_lastCollectionScope);

</del><ins>+    m_codeBlocks-&gt;deleteUnmarkedAndUnreferenced(*m_vm, *m_lastCollectionScope);

</ins><span class="cx">     m_jitStubRoutines-&gt;deleteUnmarkedJettisonedStubRoutines();

</span><span class="cx"> }

</span><span class="cx"> 

</span></span></pre></div>

<a id="trunkSourceJavaScriptCoreheapHeapSnapshotBuildercpp"></a>

<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/heap/HeapSnapshotBuilder.cpp (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/JavaScriptCore/heap/HeapSnapshotBuilder.cpp        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/JavaScriptCore/heap/HeapSnapshotBuilder.cpp        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -225,7 +225,7 @@

</span><span class="cx"> 

</span><span class="cx">         allowedNodeIdentifiers.set(node.cell, node.identifier);

</span><span class="cx"> 

</span><del>-        auto result = classNameIndexes.add(node.cell-&gt;classInfo()-&gt;className, nextClassNameIndex);

</del><ins>+        auto result = classNameIndexes.add(node.cell-&gt;classInfo(vm)-&gt;className, nextClassNameIndex);

</ins><span class="cx">         if (result.isNewEntry)

</span><span class="cx">             nextClassNameIndex++;

</span><span class="cx">         unsigned classNameIndex = result.iterator-&gt;value;

</span></span></pre></div>

<a id="trunkSourceJavaScriptCoreheapSlotVisitorcpp"></a>

<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/heap/SlotVisitor.cpp (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/JavaScriptCore/heap/SlotVisitor.cpp        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/JavaScriptCore/heap/SlotVisitor.cpp        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -56,13 +56,14 @@

</span><span class="cx"> 

<span class="cx">     // Both the cell's structure, and the cell's structure's structure should be the Structure Structure.

<span class="cx">     // I hate this sentence.

</span><del>-    if (cell-&gt;structure()-&gt;structure()-&gt;JSCell::classInfo() != cell-&gt;structure()-&gt;JSCell::classInfo()) {

</del><ins>+    VM&amp; vm = *cell-&gt;vm();

+    if (cell-&gt;structure()-&gt;structure()-&gt;JSCell::classInfo(vm) != cell-&gt;structure()-&gt;JSCell::classInfo(vm)) {

</ins><span class="cx">         const char* parentClassName = 0;

</span><span class="cx">         const char* ourClassName = 0;

</span><del>-        if (cell-&gt;structure()-&gt;structure() &amp;&amp; cell-&gt;structure()-&gt;structure()-&gt;JSCell::classInfo())

-            parentClassName = cell-&gt;structure()-&gt;structure()-&gt;JSCell::classInfo()-&gt;className;

-        if (cell-&gt;structure()-&gt;JSCell::classInfo())

-            ourClassName = cell-&gt;structure()-&gt;JSCell::classInfo()-&gt;className;

</del><ins>+        if (cell-&gt;structure()-&gt;structure() &amp;&amp; cell-&gt;structure()-&gt;structure()-&gt;JSCell::classInfo(vm))

+            parentClassName = cell-&gt;structure()-&gt;structure()-&gt;JSCell::classInfo(vm)-&gt;className;

+        if (cell-&gt;structure()-&gt;JSCell::classInfo(vm))

+            ourClassName = cell-&gt;structure()-&gt;JSCell::classInfo(vm)-&gt;className;

</ins><span class="cx">         dataLogF(&quot;parent structure (%p &lt;%s&gt;) of cell at %p doesn't match cell's structure (%p &lt;%s&gt;)\n&quot;,

</span><span class="cx">             cell-&gt;structure()-&gt;structure(), parentClassName, cell, cell-&gt;structure(), ourClassName);

</span><span class="cx">         CRASH();

</span><span class="lines">@@ -69,7 +70,7 @@

</span><span class="cx">     }

</span><span class="cx"> 

</span><span class="cx">     // Make sure we can walk the ClassInfo chain

</span><del>-    const ClassInfo* info = cell-&gt;classInfo();

</del><ins>+    const ClassInfo* info = cell-&gt;classInfo(vm);

</ins><span class="cx">     do { } while ((info = info-&gt;parentClass));

</span><span class="cx"> }

</span><span class="cx"> #endif

</span></span></pre></div>

<a id="trunkSourceJavaScriptCoreinspectorInjectedScriptHosth"></a>

<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/inspector/InjectedScriptHost.h (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/JavaScriptCore/inspector/InjectedScriptHost.h        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/JavaScriptCore/inspector/InjectedScriptHost.h        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -38,7 +38,7 @@

</span><span class="cx">     virtual ~InjectedScriptHost();

</span><span class="cx"> 

</span><span class="cx">     virtual JSC::JSValue subtype(JSC::ExecState*, JSC::JSValue) { return JSC::jsUndefined(); }

</span><del>-    virtual bool isHTMLAllCollection(JSC::JSValue) { return false; }

</del><ins>+    virtual bool isHTMLAllCollection(JSC::VM&amp;, JSC::JSValue) { return false; }

</ins><span class="cx"> 

</span><span class="cx">     JSC::JSValue wrapper(JSC::ExecState*, JSC::JSGlobalObject*);

</span><span class="cx">     void clearAllWrappers();

</span></span></pre></div>

<a id="trunkSourceJavaScriptCoreinspectorJSGlobalObjectInspectorControllercpp"></a>

<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/inspector/JSGlobalObjectInspectorController.cpp (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/JavaScriptCore/inspector/JSGlobalObjectInspectorController.cpp        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/JavaScriptCore/inspector/JSGlobalObjectInspectorController.cpp        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -220,10 +220,10 @@

</span><span class="cx"> 

</span><span class="cx"> void JSGlobalObjectInspectorController::reportAPIException(ExecState* exec, Exception* exception)

</span><span class="cx"> {

</span><del>-    if (isTerminatedExecutionException(exception))

</del><ins>+    VM&amp; vm = exec-&gt;vm();

+    if (isTerminatedExecutionException(vm, exception))

</ins><span class="cx">         return;

</span><span class="cx"> 

</span><del>-    VM&amp; vm = exec-&gt;vm();

</del><span class="cx">     auto scope = DECLARE_CATCH_SCOPE(vm);

</span><span class="cx">     ErrorHandlingScope errorScope(vm);

</span><span class="cx"> 

</span></span></pre></div>

<a id="trunkSourceJavaScriptCoreinspectorJSInjectedScriptHostcpp"></a>

<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/inspector/JSInjectedScriptHost.cpp (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/JavaScriptCore/inspector/JSInjectedScriptHost.cpp        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/JavaScriptCore/inspector/JSInjectedScriptHost.cpp        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -73,7 +73,7 @@

</span><span class="cx"> void JSInjectedScriptHost::finishCreation(VM&amp; vm)

</span><span class="cx"> {

</span><span class="cx">     Base::finishCreation(vm);

</span><del>-    ASSERT(inherits(info()));

</del><ins>+    ASSERT(inherits(vm, info()));

</ins><span class="cx"> }

</span><span class="cx"> 

</span><span class="cx"> JSObject* JSInjectedScriptHost::createPrototype(VM&amp; vm, JSGlobalObject* globalObject)

</span><span class="lines">@@ -128,12 +128,14 @@

</span><span class="cx">     if (exec-&gt;argumentCount() &lt; 1)

</span><span class="cx">         return jsUndefined();

</span><span class="cx"> 

</span><ins>+    VM&amp; vm = exec-&gt;vm();

</ins><span class="cx">     JSValue value = exec-&gt;uncheckedArgument(0);

</span><del>-    return jsBoolean(impl().isHTMLAllCollection(value));

</del><ins>+    return jsBoolean(impl().isHTMLAllCollection(vm, value));

</ins><span class="cx"> }

</span><span class="cx"> 

</span><span class="cx"> JSValue JSInjectedScriptHost::subtype(ExecState* exec)

</span><span class="cx"> {

</span><ins>+    VM&amp; vm = exec-&gt;vm();

</ins><span class="cx">     if (exec-&gt;argumentCount() &lt; 1)

</span><span class="cx">         return jsUndefined();

</span><span class="cx"> 

</span><span class="lines">@@ -153,46 +155,46 @@

</span><span class="cx">             return jsNontrivialString(exec, ASCIILiteral(&quot;error&quot;));

</span><span class="cx"> 

<span class="cx">         // Consider class constructor functions class objects.

</span><del>-        JSFunction* function = jsDynamicCast&lt;JSFunction*&gt;(value);

</del><ins>+        JSFunction* function = jsDynamicCast&lt;JSFunction*&gt;(vm, value);

</ins><span class="cx">         if (function &amp;&amp; function-&gt;isClassConstructorFunction())

</span><span class="cx">             return jsNontrivialString(exec, ASCIILiteral(&quot;class&quot;));

</span><span class="cx">     }

</span><span class="cx"> 

</span><del>-    if (value.inherits(JSArray::info()))

</del><ins>+    if (value.inherits(vm, JSArray::info()))

</ins><span class="cx">         return jsNontrivialString(exec, ASCIILiteral(&quot;array&quot;));

</span><del>-    if (value.inherits(DirectArguments::info()) || value.inherits(ScopedArguments::info()))

</del><ins>+    if (value.inherits(vm, DirectArguments::info()) || value.inherits(vm, ScopedArguments::info()))

</ins><span class="cx">         return jsNontrivialString(exec, ASCIILiteral(&quot;array&quot;));

</span><span class="cx"> 

</span><del>-    if (value.inherits(DateInstance::info()))

</del><ins>+    if (value.inherits(vm, DateInstance::info()))

</ins><span class="cx">         return jsNontrivialString(exec, ASCIILiteral(&quot;date&quot;));

</span><del>-    if (value.inherits(RegExpObject::info()))

</del><ins>+    if (value.inherits(vm, RegExpObject::info()))

</ins><span class="cx">         return jsNontrivialString(exec, ASCIILiteral(&quot;regexp&quot;));

</span><del>-    if (value.inherits(ProxyObject::info()))

</del><ins>+    if (value.inherits(vm, ProxyObject::info()))

</ins><span class="cx">         return jsNontrivialString(exec, ASCIILiteral(&quot;proxy&quot;));

</span><span class="cx"> 

</span><del>-    if (value.inherits(JSMap::info()))

</del><ins>+    if (value.inherits(vm, JSMap::info()))

</ins><span class="cx">         return jsNontrivialString(exec, ASCIILiteral(&quot;map&quot;));

</span><del>-    if (value.inherits(JSSet::info()))

</del><ins>+    if (value.inherits(vm, JSSet::info()))

</ins><span class="cx">         return jsNontrivialString(exec, ASCIILiteral(&quot;set&quot;));

</span><del>-    if (value.inherits(JSWeakMap::info()))

</del><ins>+    if (value.inherits(vm, JSWeakMap::info()))

</ins><span class="cx">         return jsNontrivialString(exec, ASCIILiteral(&quot;weakmap&quot;));

</span><del>-    if (value.inherits(JSWeakSet::info()))

</del><ins>+    if (value.inherits(vm, JSWeakSet::info()))

</ins><span class="cx">         return jsNontrivialString(exec, ASCIILiteral(&quot;weakset&quot;));

</span><span class="cx"> 

</span><del>-    if (value.inherits(JSMapIterator::info())

-        || value.inherits(JSSetIterator::info())

-        || value.inherits(JSStringIterator::info())

-        || value.inherits(JSPropertyNameIterator::info()))

</del><ins>+    if (value.inherits(vm, JSMapIterator::info())

+        || value.inherits(vm, JSSetIterator::info())

+        || value.inherits(vm, JSStringIterator::info())

+        || value.inherits(vm, JSPropertyNameIterator::info()))

</ins><span class="cx">         return jsNontrivialString(exec, ASCIILiteral(&quot;iterator&quot;));

</span><span class="cx"> 

</span><span class="cx">     if (object &amp;&amp; object-&gt;getDirect(exec-&gt;vm(), exec-&gt;vm().propertyNames-&gt;builtinNames().arrayIteratorNextIndexPrivateName()))

</span><span class="cx">         return jsNontrivialString(exec, ASCIILiteral(&quot;iterator&quot;));

</span><span class="cx"> 

</span><del>-    if (value.inherits(JSInt8Array::info()) || value.inherits(JSInt16Array::info()) || value.inherits(JSInt32Array::info()))

</del><ins>+    if (value.inherits(vm, JSInt8Array::info()) || value.inherits(vm, JSInt16Array::info()) || value.inherits(vm, JSInt32Array::info()))

</ins><span class="cx">         return jsNontrivialString(exec, ASCIILiteral(&quot;array&quot;));

</span><del>-    if (value.inherits(JSUint8Array::info()) || value.inherits(JSUint16Array::info()) || value.inherits(JSUint32Array::info()))

</del><ins>+    if (value.inherits(vm, JSUint8Array::info()) || value.inherits(vm, JSUint16Array::info()) || value.inherits(vm, JSUint32Array::info()))

</ins><span class="cx">         return jsNontrivialString(exec, ASCIILiteral(&quot;array&quot;));

</span><del>-    if (value.inherits(JSFloat32Array::info()) || value.inherits(JSFloat64Array::info()))

</del><ins>+    if (value.inherits(vm, JSFloat32Array::info()) || value.inherits(vm, JSFloat64Array::info()))

</ins><span class="cx">         return jsNontrivialString(exec, ASCIILiteral(&quot;array&quot;));

</span><span class="cx"> 

</span><span class="cx">     return impl().subtype(exec, value);

</span><span class="lines">@@ -203,8 +205,9 @@

</span><span class="cx">     if (exec-&gt;argumentCount() &lt; 1)

</span><span class="cx">         return jsUndefined();

</span><span class="cx"> 

</span><ins>+    VM&amp; vm = exec-&gt;vm();

</ins><span class="cx">     JSValue value = exec-&gt;uncheckedArgument(0);

</span><del>-    if (!value.asCell()-&gt;inherits(JSFunction::info()))

</del><ins>+    if (!value.asCell()-&gt;inherits(vm, JSFunction::info()))

</ins><span class="cx">         return jsUndefined();

</span><span class="cx"> 

<span class="cx">     // FIXME: This should provide better details for JSBoundFunctions.

</span><span class="lines">@@ -222,7 +225,6 @@

</span><span class="cx">     if (columnNumber)

</span><span class="cx">         columnNumber -= 1;

</span><span class="cx"> 

</span><del>-    VM&amp; vm = exec-&gt;vm();

</del><span class="cx">     String scriptID = String::number(sourceCode-&gt;provider()-&gt;asID());

</span><span class="cx">     JSObject* location = constructEmptyObject(exec);

</span><span class="cx">     location-&gt;putDirect(vm, Identifier::fromString(exec, &quot;scriptId&quot;), jsString(exec, scriptID));

</span><span class="lines">@@ -263,7 +265,7 @@

</span><span class="cx">     auto scope = DECLARE_THROW_SCOPE(vm);

</span><span class="cx">     JSValue value = exec-&gt;uncheckedArgument(0);

</span><span class="cx"> 

</span><del>-    if (JSPromise* promise = jsDynamicCast&lt;JSPromise*&gt;(value)) {

</del><ins>+    if (JSPromise* promise = jsDynamicCast&lt;JSPromise*&gt;(vm, value)) {

</ins><span class="cx">         unsigned index = 0;

</span><span class="cx">         JSArray* array = constructEmptyArray(exec, nullptr);

</span><span class="cx">         RETURN_IF_EXCEPTION(scope, JSValue());

</span><span class="lines">@@ -289,7 +291,7 @@

</span><span class="cx">         RELEASE_ASSERT_NOT_REACHED();

</span><span class="cx">     }

</span><span class="cx"> 

</span><del>-    if (JSBoundFunction* boundFunction = jsDynamicCast&lt;JSBoundFunction*&gt;(value)) {

</del><ins>+    if (JSBoundFunction* boundFunction = jsDynamicCast&lt;JSBoundFunction*&gt;(vm, value)) {

</ins><span class="cx">         unsigned index = 0;

</span><span class="cx">         JSArray* array = constructEmptyArray(exec, nullptr);

</span><span class="cx">         RETURN_IF_EXCEPTION(scope, JSValue());

</span><span class="lines">@@ -305,7 +307,7 @@

</span><span class="cx">         return array;

</span><span class="cx">     }

</span><span class="cx"> 

</span><del>-    if (ProxyObject* proxy = jsDynamicCast&lt;ProxyObject*&gt;(value)) {

</del><ins>+    if (ProxyObject* proxy = jsDynamicCast&lt;ProxyObject*&gt;(vm, value)) {

</ins><span class="cx">         unsigned index = 0;

</span><span class="cx">         JSArray* array = constructEmptyArray(exec, nullptr, 2);

</span><span class="cx">         RETURN_IF_EXCEPTION(scope, JSValue());

</span><span class="lines">@@ -316,7 +318,7 @@

</span><span class="cx">         return array;

</span><span class="cx">     }

</span><span class="cx"> 

</span><del>-    if (JSObject* iteratorObject = jsDynamicCast&lt;JSObject*&gt;(value)) {

</del><ins>+    if (JSObject* iteratorObject = jsDynamicCast&lt;JSObject*&gt;(vm, value)) {

</ins><span class="cx">         if (iteratorObject-&gt;getDirect(exec-&gt;vm(), exec-&gt;vm().propertyNames-&gt;builtinNames().arrayIteratorNextIndexPrivateName())) {

</span><span class="cx">             JSValue iteratedValue = iteratorObject-&gt;getDirect(exec-&gt;vm(), exec-&gt;vm().propertyNames-&gt;builtinNames().iteratedObjectPrivateName());

</span><span class="cx">             JSValue kind = iteratorObject-&gt;getDirect(exec-&gt;vm(), exec-&gt;vm().propertyNames-&gt;builtinNames().arrayIteratorKindPrivateName());

</span><span class="lines">@@ -332,7 +334,7 @@

</span><span class="cx">         }

</span><span class="cx">     }

</span><span class="cx"> 

</span><del>-    if (JSMapIterator* mapIterator = jsDynamicCast&lt;JSMapIterator*&gt;(value)) {

</del><ins>+    if (JSMapIterator* mapIterator = jsDynamicCast&lt;JSMapIterator*&gt;(vm, value)) {

</ins><span class="cx">         String kind;

</span><span class="cx">         switch (mapIterator-&gt;kind()) {

</span><span class="cx">         case IterateKey:

</span><span class="lines">@@ -355,7 +357,7 @@

</span><span class="cx">         return array;

</span><span class="cx">     }

</span><span class="cx">         

</span><del>-    if (JSSetIterator* setIterator = jsDynamicCast&lt;JSSetIterator*&gt;(value)) {

</del><ins>+    if (JSSetIterator* setIterator = jsDynamicCast&lt;JSSetIterator*&gt;(vm, value)) {

</ins><span class="cx">         String kind;

</span><span class="cx">         switch (setIterator-&gt;kind()) {

</span><span class="cx">         case IterateKey:

</span><span class="lines">@@ -378,7 +380,7 @@

</span><span class="cx">         return array;

</span><span class="cx">     }

</span><span class="cx"> 

</span><del>-    if (JSStringIterator* stringIterator = jsDynamicCast&lt;JSStringIterator*&gt;(value)) {

</del><ins>+    if (JSStringIterator* stringIterator = jsDynamicCast&lt;JSStringIterator*&gt;(vm, value)) {

</ins><span class="cx">         unsigned index = 0;

</span><span class="cx">         JSArray* array = constructEmptyArray(exec, nullptr, 1);

</span><span class="cx">         RETURN_IF_EXCEPTION(scope, JSValue());

</span><span class="lines">@@ -387,7 +389,7 @@

</span><span class="cx">         return array;

</span><span class="cx">     }

</span><span class="cx"> 

</span><del>-    if (JSPropertyNameIterator* propertyNameIterator = jsDynamicCast&lt;JSPropertyNameIterator*&gt;(value)) {

</del><ins>+    if (JSPropertyNameIterator* propertyNameIterator = jsDynamicCast&lt;JSPropertyNameIterator*&gt;(vm, value)) {

</ins><span class="cx">         unsigned index = 0;

</span><span class="cx">         JSArray* array = constructEmptyArray(exec, nullptr, 1);

</span><span class="cx">         RETURN_IF_EXCEPTION(scope, JSValue());

</span><span class="lines">@@ -404,13 +406,14 @@

</span><span class="cx">     if (exec-&gt;argumentCount() &lt; 1)

</span><span class="cx">         return jsUndefined();

</span><span class="cx"> 

</span><ins>+    VM&amp; vm = exec-&gt;vm();

</ins><span class="cx">     JSValue value = exec-&gt;uncheckedArgument(0);

</span><del>-    ProxyObject* proxy = jsDynamicCast&lt;ProxyObject*&gt;(value);

</del><ins>+    ProxyObject* proxy = jsDynamicCast&lt;ProxyObject*&gt;(vm, value);

</ins><span class="cx">     if (!proxy)

</span><span class="cx">         return jsUndefined();

</span><span class="cx"> 

</span><span class="cx">     JSObject* target = proxy-&gt;target();

</span><del>-    while (ProxyObject* proxy = jsDynamicCast&lt;ProxyObject*&gt;(target))

</del><ins>+    while (ProxyObject* proxy = jsDynamicCast&lt;ProxyObject*&gt;(vm, target))

</ins><span class="cx">         target = proxy-&gt;target();

</span><span class="cx"> 

</span><span class="cx">     return target;

</span><span class="lines">@@ -421,8 +424,9 @@

</span><span class="cx">     if (exec-&gt;argumentCount() &lt; 1)

</span><span class="cx">         return jsUndefined();

</span><span class="cx"> 

</span><ins>+    VM&amp; vm = exec-&gt;vm();

</ins><span class="cx">     JSValue value = exec-&gt;uncheckedArgument(0);

</span><del>-    JSWeakMap* weakMap = jsDynamicCast&lt;JSWeakMap*&gt;(value);

</del><ins>+    JSWeakMap* weakMap = jsDynamicCast&lt;JSWeakMap*&gt;(vm, value);

</ins><span class="cx">     if (!weakMap)

</span><span class="cx">         return jsUndefined();

</span><span class="cx"> 

</span><span class="lines">@@ -437,7 +441,7 @@

</span><span class="cx">     VM&amp; vm = exec-&gt;vm();

</span><span class="cx">     auto scope = DECLARE_THROW_SCOPE(vm);

</span><span class="cx">     JSValue value = exec-&gt;uncheckedArgument(0);

</span><del>-    JSWeakMap* weakMap = jsDynamicCast&lt;JSWeakMap*&gt;(value);

</del><ins>+    JSWeakMap* weakMap = jsDynamicCast&lt;JSWeakMap*&gt;(vm, value);

</ins><span class="cx">     if (!weakMap)

</span><span class="cx">         return jsUndefined();

</span><span class="cx"> 

</span><span class="lines">@@ -469,8 +473,9 @@

</span><span class="cx">     if (exec-&gt;argumentCount() &lt; 1)

</span><span class="cx">         return jsUndefined();

</span><span class="cx"> 

</span><ins>+    VM&amp; vm = exec-&gt;vm();

</ins><span class="cx">     JSValue value = exec-&gt;uncheckedArgument(0);

</span><del>-    JSWeakSet* weakSet = jsDynamicCast&lt;JSWeakSet*&gt;(value);

</del><ins>+    JSWeakSet* weakSet = jsDynamicCast&lt;JSWeakSet*&gt;(vm, value);

</ins><span class="cx">     if (!weakSet)

</span><span class="cx">         return jsUndefined();

</span><span class="cx"> 

</span><span class="lines">@@ -485,7 +490,7 @@

</span><span class="cx">     VM&amp; vm = exec-&gt;vm();

</span><span class="cx">     auto scope = DECLARE_THROW_SCOPE(vm);

</span><span class="cx">     JSValue value = exec-&gt;uncheckedArgument(0);

</span><del>-    JSWeakSet* weakSet = jsDynamicCast&lt;JSWeakSet*&gt;(value);

</del><ins>+    JSWeakSet* weakSet = jsDynamicCast&lt;JSWeakSet*&gt;(vm, value);

</ins><span class="cx">     if (!weakSet)

</span><span class="cx">         return jsUndefined();

</span><span class="cx"> 

</span><span class="lines">@@ -531,17 +536,17 @@

</span><span class="cx">     auto scope = DECLARE_THROW_SCOPE(vm);

</span><span class="cx">     JSValue iterator;

</span><span class="cx">     JSValue value = exec-&gt;uncheckedArgument(0);

</span><del>-    if (JSMapIterator* mapIterator = jsDynamicCast&lt;JSMapIterator*&gt;(value))

</del><ins>+    if (JSMapIterator* mapIterator = jsDynamicCast&lt;JSMapIterator*&gt;(vm, value))

</ins><span class="cx">         iterator = mapIterator-&gt;clone(exec);

</span><del>-    else if (JSSetIterator* setIterator = jsDynamicCast&lt;JSSetIterator*&gt;(value))

</del><ins>+    else if (JSSetIterator* setIterator = jsDynamicCast&lt;JSSetIterator*&gt;(vm, value))

</ins><span class="cx">         iterator = setIterator-&gt;clone(exec);

</span><del>-    else if (JSStringIterator* stringIterator = jsDynamicCast&lt;JSStringIterator*&gt;(value))

</del><ins>+    else if (JSStringIterator* stringIterator = jsDynamicCast&lt;JSStringIterator*&gt;(vm, value))

</ins><span class="cx">         iterator = stringIterator-&gt;clone(exec);

</span><del>-    else if (JSPropertyNameIterator* propertyNameIterator = jsDynamicCast&lt;JSPropertyNameIterator*&gt;(value)) {

</del><ins>+    else if (JSPropertyNameIterator* propertyNameIterator = jsDynamicCast&lt;JSPropertyNameIterator*&gt;(vm, value)) {

</ins><span class="cx">         iterator = propertyNameIterator-&gt;clone(exec);

</span><span class="cx">         RETURN_IF_EXCEPTION(scope, JSValue());

</span><span class="cx">     } else {

</span><del>-        if (JSObject* iteratorObject = jsDynamicCast&lt;JSObject*&gt;(value)) {

</del><ins>+        if (JSObject* iteratorObject = jsDynamicCast&lt;JSObject*&gt;(vm, value)) {

</ins><span class="cx">             // Array Iterators are created in JS for performance reasons. Thus the only way to know we have one is to

<span class="cx">             // look for a property that is unique to them.

</span><span class="cx">             if (JSValue nextIndex = iteratorObject-&gt;getDirect(vm, vm.propertyNames-&gt;builtinNames().arrayIteratorNextIndexPrivateName()))

</span></span></pre></div>

<a id="trunkSourceJavaScriptCoreinspectorJSInjectedScriptHostPrototypecpp"></a>

<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/inspector/JSInjectedScriptHostPrototype.cpp (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/JavaScriptCore/inspector/JSInjectedScriptHostPrototype.cpp        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/JavaScriptCore/inspector/JSInjectedScriptHostPrototype.cpp        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -58,7 +58,7 @@

</span><span class="cx"> void JSInjectedScriptHostPrototype::finishCreation(VM&amp; vm, JSGlobalObject* globalObject)

</span><span class="cx"> {

</span><span class="cx">     Base::finishCreation(vm);

</span><del>-    ASSERT(inherits(info()));

</del><ins>+    ASSERT(inherits(vm, info()));

</ins><span class="cx">     vm.prototypeMap.addPrototype(this);

</span><span class="cx"> 

</span><span class="cx">     JSC_NATIVE_FUNCTION_WITHOUT_TRANSITION(&quot;subtype&quot;, jsInjectedScriptHostPrototypeFunctionSubtype, DontEnum, 1);

</span><span class="lines">@@ -83,7 +83,7 @@

</span><span class="cx">     auto scope = DECLARE_THROW_SCOPE(vm);

</span><span class="cx"> 

</span><span class="cx">     JSValue thisValue = exec-&gt;thisValue();

</span><del>-    JSInjectedScriptHost* castedThis = jsDynamicCast&lt;JSInjectedScriptHost*&gt;(thisValue);

</del><ins>+    JSInjectedScriptHost* castedThis = jsDynamicCast&lt;JSInjectedScriptHost*&gt;(vm, thisValue);

</ins><span class="cx">     if (!castedThis)

</span><span class="cx">         return throwVMTypeError(exec, scope);

</span><span class="cx"> 

</span><span class="lines">@@ -96,7 +96,7 @@

</span><span class="cx">     auto scope = DECLARE_THROW_SCOPE(vm);

</span><span class="cx"> 

</span><span class="cx">     JSValue thisValue = exec-&gt;thisValue();

</span><del>-    JSInjectedScriptHost* castedThis = jsDynamicCast&lt;JSInjectedScriptHost*&gt;(thisValue);

</del><ins>+    JSInjectedScriptHost* castedThis = jsDynamicCast&lt;JSInjectedScriptHost*&gt;(vm, thisValue);

</ins><span class="cx">     if (!castedThis)

</span><span class="cx">         return throwVMTypeError(exec, scope);

</span><span class="cx"> 

</span><span class="lines">@@ -109,7 +109,7 @@

</span><span class="cx">     auto scope = DECLARE_THROW_SCOPE(vm);

</span><span class="cx"> 

</span><span class="cx">     JSValue thisValue = exec-&gt;thisValue();

</span><del>-    JSInjectedScriptHost* castedThis = jsDynamicCast&lt;JSInjectedScriptHost*&gt;(thisValue);

</del><ins>+    JSInjectedScriptHost* castedThis = jsDynamicCast&lt;JSInjectedScriptHost*&gt;(vm, thisValue);

</ins><span class="cx">     if (!castedThis)

</span><span class="cx">         return throwVMTypeError(exec, scope);

</span><span class="cx"> 

</span><span class="lines">@@ -122,7 +122,7 @@

</span><span class="cx">     auto scope = DECLARE_THROW_SCOPE(vm);

</span><span class="cx"> 

</span><span class="cx">     JSValue thisValue = exec-&gt;thisValue();

</span><del>-    JSInjectedScriptHost* castedThis = jsDynamicCast&lt;JSInjectedScriptHost*&gt;(thisValue);

</del><ins>+    JSInjectedScriptHost* castedThis = jsDynamicCast&lt;JSInjectedScriptHost*&gt;(vm, thisValue);

</ins><span class="cx">     if (!castedThis)

</span><span class="cx">         return throwVMTypeError(exec, scope);

</span><span class="cx"> 

</span><span class="lines">@@ -135,7 +135,7 @@

</span><span class="cx">     auto scope = DECLARE_THROW_SCOPE(vm);

</span><span class="cx"> 

</span><span class="cx">     JSValue thisValue = exec-&gt;thisValue();

</span><del>-    JSInjectedScriptHost* castedThis = jsDynamicCast&lt;JSInjectedScriptHost*&gt;(thisValue);

</del><ins>+    JSInjectedScriptHost* castedThis = jsDynamicCast&lt;JSInjectedScriptHost*&gt;(vm, thisValue);

</ins><span class="cx">     if (!castedThis)

</span><span class="cx">         return throwVMTypeError(exec, scope);

</span><span class="cx"> 

</span><span class="lines">@@ -148,7 +148,7 @@

</span><span class="cx">     auto scope = DECLARE_THROW_SCOPE(vm);

</span><span class="cx"> 

</span><span class="cx">     JSValue thisValue = exec-&gt;thisValue();

</span><del>-    JSInjectedScriptHost* castedThis = jsDynamicCast&lt;JSInjectedScriptHost*&gt;(thisValue);

</del><ins>+    JSInjectedScriptHost* castedThis = jsDynamicCast&lt;JSInjectedScriptHost*&gt;(vm, thisValue);

</ins><span class="cx">     if (!castedThis)

</span><span class="cx">         return throwVMTypeError(exec, scope);

</span><span class="cx"> 

</span><span class="lines">@@ -161,7 +161,7 @@

</span><span class="cx">     auto scope = DECLARE_THROW_SCOPE(vm);

</span><span class="cx"> 

</span><span class="cx">     JSValue thisValue = exec-&gt;thisValue();

</span><del>-    JSInjectedScriptHost* castedThis = jsDynamicCast&lt;JSInjectedScriptHost*&gt;(thisValue);

</del><ins>+    JSInjectedScriptHost* castedThis = jsDynamicCast&lt;JSInjectedScriptHost*&gt;(vm, thisValue);

</ins><span class="cx">     if (!castedThis)

</span><span class="cx">         return throwVMTypeError(exec, scope);

</span><span class="cx"> 

</span><span class="lines">@@ -174,7 +174,7 @@

</span><span class="cx">     auto scope = DECLARE_THROW_SCOPE(vm);

</span><span class="cx"> 

</span><span class="cx">     JSValue thisValue = exec-&gt;thisValue();

</span><del>-    JSInjectedScriptHost* castedThis = jsDynamicCast&lt;JSInjectedScriptHost*&gt;(thisValue);

</del><ins>+    JSInjectedScriptHost* castedThis = jsDynamicCast&lt;JSInjectedScriptHost*&gt;(vm, thisValue);

</ins><span class="cx">     if (!castedThis)

</span><span class="cx">         return throwVMTypeError(exec, scope);

</span><span class="cx"> 

</span><span class="lines">@@ -187,7 +187,7 @@

</span><span class="cx">     auto scope = DECLARE_THROW_SCOPE(vm);

</span><span class="cx"> 

</span><span class="cx">     JSValue thisValue = exec-&gt;thisValue();

</span><del>-    JSInjectedScriptHost* castedThis = jsDynamicCast&lt;JSInjectedScriptHost*&gt;(thisValue);

</del><ins>+    JSInjectedScriptHost* castedThis = jsDynamicCast&lt;JSInjectedScriptHost*&gt;(vm, thisValue);

</ins><span class="cx">     if (!castedThis)

</span><span class="cx">         return throwVMTypeError(exec, scope);

</span><span class="cx"> 

</span><span class="lines">@@ -200,7 +200,7 @@

</span><span class="cx">     auto scope = DECLARE_THROW_SCOPE(vm);

</span><span class="cx"> 

</span><span class="cx">     JSValue thisValue = exec-&gt;thisValue();

</span><del>-    JSInjectedScriptHost* castedThis = jsDynamicCast&lt;JSInjectedScriptHost*&gt;(thisValue);

</del><ins>+    JSInjectedScriptHost* castedThis = jsDynamicCast&lt;JSInjectedScriptHost*&gt;(vm, thisValue);

</ins><span class="cx">     if (!castedThis)

</span><span class="cx">         return throwVMTypeError(exec, scope);

</span><span class="cx"> 

</span><span class="lines">@@ -213,7 +213,7 @@

</span><span class="cx">     auto scope = DECLARE_THROW_SCOPE(vm);

</span><span class="cx"> 

</span><span class="cx">     JSValue thisValue = exec-&gt;thisValue();

</span><del>-    JSInjectedScriptHost* castedThis = jsDynamicCast&lt;JSInjectedScriptHost*&gt;(thisValue);

</del><ins>+    JSInjectedScriptHost* castedThis = jsDynamicCast&lt;JSInjectedScriptHost*&gt;(vm, thisValue);

</ins><span class="cx">     if (!castedThis)

</span><span class="cx">         return throwVMTypeError(exec, scope);

</span><span class="cx"> 

</span><span class="lines">@@ -226,7 +226,7 @@

</span><span class="cx">     auto scope = DECLARE_THROW_SCOPE(vm);

</span><span class="cx"> 

</span><span class="cx">     JSValue thisValue = exec-&gt;thisValue();

</span><del>-    JSInjectedScriptHost* castedThis = jsDynamicCast&lt;JSInjectedScriptHost*&gt;(thisValue);

</del><ins>+    JSInjectedScriptHost* castedThis = jsDynamicCast&lt;JSInjectedScriptHost*&gt;(vm, thisValue);

</ins><span class="cx">     if (!castedThis)

</span><span class="cx">         return throwVMTypeError(exec, scope);

</span><span class="cx"> 

</span><span class="lines">@@ -239,7 +239,7 @@

</span><span class="cx">     auto scope = DECLARE_THROW_SCOPE(vm);

</span><span class="cx"> 

</span><span class="cx">     JSValue thisValue = exec-&gt;thisValue();

</span><del>-    JSInjectedScriptHost* castedThis = jsDynamicCast&lt;JSInjectedScriptHost*&gt;(thisValue);

</del><ins>+    JSInjectedScriptHost* castedThis = jsDynamicCast&lt;JSInjectedScriptHost*&gt;(vm, thisValue);

</ins><span class="cx">     if (!castedThis)

</span><span class="cx">         return throwVMTypeError(exec, scope);

</span><span class="cx"> 

</span></span></pre></div>

<a id="trunkSourceJavaScriptCoreinspectorJSJavaScriptCallFramecpp"></a>

<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/inspector/JSJavaScriptCallFrame.cpp (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/JavaScriptCore/inspector/JSJavaScriptCallFrame.cpp        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/JavaScriptCore/inspector/JSJavaScriptCallFrame.cpp        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -48,7 +48,7 @@

</span><span class="cx"> void JSJavaScriptCallFrame::finishCreation(VM&amp; vm)

</span><span class="cx"> {

</span><span class="cx">     Base::finishCreation(vm);

</span><del>-    ASSERT(inherits(info()));

</del><ins>+    ASSERT(inherits(vm, info()));

</ins><span class="cx"> }

</span><span class="cx"> 

</span><span class="cx"> JSObject* JSJavaScriptCallFrame::createPrototype(VM&amp; vm, JSGlobalObject* globalObject)

</span><span class="lines">@@ -233,10 +233,5 @@

</span><span class="cx">     return javaScriptCallFrame;

</span><span class="cx"> }

</span><span class="cx"> 

</span><del>-JSJavaScriptCallFrame* toJSJavaScriptCallFrame(JSValue value)

-{

-    return value.inherits(JSJavaScriptCallFrame::info()) ? jsCast&lt;JSJavaScriptCallFrame*&gt;(value) : nullptr;

-}

-

</del><span class="cx"> } // namespace Inspector

</span><span class="cx"> 

</span></span></pre></div>

<a id="trunkSourceJavaScriptCoreinspectorJSJavaScriptCallFrameh"></a>

<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/inspector/JSJavaScriptCallFrame.h (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/JavaScriptCore/inspector/JSJavaScriptCallFrame.h        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/JavaScriptCore/inspector/JSJavaScriptCallFrame.h        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -90,6 +90,5 @@

</span><span class="cx"> };

</span><span class="cx"> 

</span><span class="cx"> JSC::JSValue toJS(JSC::ExecState*, JSC::JSGlobalObject*, JavaScriptCallFrame*);

</span><del>-JSJavaScriptCallFrame* toJSJavaScriptCallFrame(JSC::JSValue);

</del><span class="cx"> 

</span><span class="cx"> } // namespace Inspector

</span></span></pre></div>

<a id="trunkSourceJavaScriptCoreinspectorJSJavaScriptCallFramePrototypecpp"></a>

<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/inspector/JSJavaScriptCallFramePrototype.cpp (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/JavaScriptCore/inspector/JSJavaScriptCallFramePrototype.cpp        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/JavaScriptCore/inspector/JSJavaScriptCallFramePrototype.cpp        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -56,7 +56,7 @@

</span><span class="cx"> void JSJavaScriptCallFramePrototype::finishCreation(VM&amp; vm, JSGlobalObject* globalObject)

</span><span class="cx"> {

</span><span class="cx">     Base::finishCreation(vm);

</span><del>-    ASSERT(inherits(info()));

</del><ins>+    ASSERT(inherits(vm, info()));

</ins><span class="cx">     vm.prototypeMap.addPrototype(this);

</span><span class="cx"> 

</span><span class="cx">     JSC_NATIVE_FUNCTION_WITHOUT_TRANSITION(&quot;evaluateWithScopeExtension&quot;, jsJavaScriptCallFramePrototypeFunctionEvaluateWithScopeExtension, DontEnum, 1);

</span><span class="lines">@@ -79,7 +79,7 @@

</span><span class="cx">     auto scope = DECLARE_THROW_SCOPE(vm);

</span><span class="cx"> 

</span><span class="cx">     JSValue thisValue = exec-&gt;thisValue();

</span><del>-    JSJavaScriptCallFrame* castedThis = jsDynamicCast&lt;JSJavaScriptCallFrame*&gt;(thisValue);

</del><ins>+    JSJavaScriptCallFrame* castedThis = jsDynamicCast&lt;JSJavaScriptCallFrame*&gt;(vm, thisValue);

</ins><span class="cx">     if (!castedThis)

</span><span class="cx">         return throwVMTypeError(exec, scope);

</span><span class="cx"> 

</span><span class="lines">@@ -92,7 +92,7 @@

</span><span class="cx">     auto scope = DECLARE_THROW_SCOPE(vm);

</span><span class="cx"> 

</span><span class="cx">     JSValue thisValue = exec-&gt;thisValue();

</span><del>-    JSJavaScriptCallFrame* castedThis = jsDynamicCast&lt;JSJavaScriptCallFrame*&gt;(thisValue);

</del><ins>+    JSJavaScriptCallFrame* castedThis = jsDynamicCast&lt;JSJavaScriptCallFrame*&gt;(vm, thisValue);

</ins><span class="cx">     if (!castedThis)

</span><span class="cx">         return throwVMTypeError(exec, scope);

</span><span class="cx"> 

</span><span class="lines">@@ -105,7 +105,7 @@

</span><span class="cx">     auto scope = DECLARE_THROW_SCOPE(vm);

</span><span class="cx"> 

</span><span class="cx">     JSValue thisValue = exec-&gt;thisValue();

</span><del>-    JSJavaScriptCallFrame* castedThis = jsDynamicCast&lt;JSJavaScriptCallFrame*&gt;(thisValue);

</del><ins>+    JSJavaScriptCallFrame* castedThis = jsDynamicCast&lt;JSJavaScriptCallFrame*&gt;(vm, thisValue);

</ins><span class="cx">     if (!castedThis)

</span><span class="cx">         return throwVMTypeError(exec, scope);

</span><span class="cx"> 

</span><span class="lines">@@ -118,7 +118,7 @@

</span><span class="cx">     auto scope = DECLARE_THROW_SCOPE(vm);

</span><span class="cx"> 

</span><span class="cx">     JSValue thisValue = exec-&gt;thisValue();

</span><del>-    JSJavaScriptCallFrame* castedThis = jsDynamicCast&lt;JSJavaScriptCallFrame*&gt;(thisValue);

</del><ins>+    JSJavaScriptCallFrame* castedThis = jsDynamicCast&lt;JSJavaScriptCallFrame*&gt;(vm, thisValue);

</ins><span class="cx">     if (!castedThis)

</span><span class="cx">         return throwVMTypeError(exec, scope);

</span><span class="cx"> 

</span><span class="lines">@@ -131,7 +131,7 @@

</span><span class="cx">     auto scope = DECLARE_THROW_SCOPE(vm);

</span><span class="cx"> 

</span><span class="cx">     JSValue thisValue = exec-&gt;thisValue();

</span><del>-    JSJavaScriptCallFrame* castedThis = jsDynamicCast&lt;JSJavaScriptCallFrame*&gt;(thisValue);

</del><ins>+    JSJavaScriptCallFrame* castedThis = jsDynamicCast&lt;JSJavaScriptCallFrame*&gt;(vm, thisValue);

</ins><span class="cx">     if (!castedThis)

</span><span class="cx">         return throwVMTypeError(exec, scope);

</span><span class="cx"> 

</span><span class="lines">@@ -144,7 +144,7 @@

</span><span class="cx">     auto scope = DECLARE_THROW_SCOPE(vm);

</span><span class="cx"> 

</span><span class="cx">     JSValue thisValue = exec-&gt;thisValue();

</span><del>-    JSJavaScriptCallFrame* castedThis = jsDynamicCast&lt;JSJavaScriptCallFrame*&gt;(thisValue);

</del><ins>+    JSJavaScriptCallFrame* castedThis = jsDynamicCast&lt;JSJavaScriptCallFrame*&gt;(vm, thisValue);

</ins><span class="cx">     if (!castedThis)

</span><span class="cx">         return throwVMTypeError(exec, scope);

</span><span class="cx"> 

</span><span class="lines">@@ -157,7 +157,7 @@

</span><span class="cx">     auto scope = DECLARE_THROW_SCOPE(vm);

</span><span class="cx"> 

</span><span class="cx">     JSValue thisValue = exec-&gt;thisValue();

</span><del>-    JSJavaScriptCallFrame* castedThis = jsDynamicCast&lt;JSJavaScriptCallFrame*&gt;(thisValue);

</del><ins>+    JSJavaScriptCallFrame* castedThis = jsDynamicCast&lt;JSJavaScriptCallFrame*&gt;(vm, thisValue);

</ins><span class="cx">     if (!castedThis)

</span><span class="cx">         return throwVMTypeError(exec, scope);

</span><span class="cx"> 

</span><span class="lines">@@ -170,7 +170,7 @@

</span><span class="cx">     auto scope = DECLARE_THROW_SCOPE(vm);

</span><span class="cx"> 

</span><span class="cx">     JSValue thisValue = exec-&gt;thisValue();

</span><del>-    JSJavaScriptCallFrame* castedThis = jsDynamicCast&lt;JSJavaScriptCallFrame*&gt;(thisValue);

</del><ins>+    JSJavaScriptCallFrame* castedThis = jsDynamicCast&lt;JSJavaScriptCallFrame*&gt;(vm, thisValue);

</ins><span class="cx">     if (!castedThis)

</span><span class="cx">         return throwVMTypeError(exec, scope);

</span><span class="cx"> 

</span><span class="lines">@@ -183,7 +183,7 @@

</span><span class="cx">     auto scope = DECLARE_THROW_SCOPE(vm);

</span><span class="cx"> 

</span><span class="cx">     JSValue thisValue = exec-&gt;thisValue();

</span><del>-    JSJavaScriptCallFrame* castedThis = jsDynamicCast&lt;JSJavaScriptCallFrame*&gt;(thisValue);

</del><ins>+    JSJavaScriptCallFrame* castedThis = jsDynamicCast&lt;JSJavaScriptCallFrame*&gt;(vm, thisValue);

</ins><span class="cx">     if (!castedThis)

</span><span class="cx">         return throwVMTypeError(exec, scope);

</span><span class="cx"> 

</span><span class="lines">@@ -196,7 +196,7 @@

</span><span class="cx">     auto scope = DECLARE_THROW_SCOPE(vm);

</span><span class="cx"> 

</span><span class="cx">     JSValue thisValue = exec-&gt;thisValue();

</span><del>-    JSJavaScriptCallFrame* castedThis = jsDynamicCast&lt;JSJavaScriptCallFrame*&gt;(thisValue);

</del><ins>+    JSJavaScriptCallFrame* castedThis = jsDynamicCast&lt;JSJavaScriptCallFrame*&gt;(vm, thisValue);

</ins><span class="cx">     if (!castedThis)

</span><span class="cx">         return throwVMTypeError(exec, scope);

</span><span class="cx"> 

</span><span class="lines">@@ -209,7 +209,7 @@

</span><span class="cx">     auto scope = DECLARE_THROW_SCOPE(vm);

</span><span class="cx"> 

</span><span class="cx">     JSValue thisValue = exec-&gt;thisValue();

</span><del>-    JSJavaScriptCallFrame* castedThis = jsDynamicCast&lt;JSJavaScriptCallFrame*&gt;(thisValue);

</del><ins>+    JSJavaScriptCallFrame* castedThis = jsDynamicCast&lt;JSJavaScriptCallFrame*&gt;(vm, thisValue);

</ins><span class="cx">     if (!castedThis)

</span><span class="cx">         return throwVMTypeError(exec, scope);

</span><span class="cx"> 

</span></span></pre></div>

<a id="trunkSourceJavaScriptCoreinspectorScriptArgumentscpp"></a>

<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/inspector/ScriptArguments.cpp (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/JavaScriptCore/inspector/ScriptArguments.cpp        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/JavaScriptCore/inspector/ScriptArguments.cpp        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -88,7 +88,7 @@

</span><span class="cx">     }

</span><span class="cx"> 

</span><span class="cx">     JSC::JSValue value = argumentAt(0).jsValue();

</span><del>-    if (JSC::jsDynamicCast&lt;JSC::ProxyObject*&gt;(value)) {

</del><ins>+    if (JSC::jsDynamicCast&lt;JSC::ProxyObject*&gt;(globalState()-&gt;vm(), value)) {

</ins><span class="cx">         result = ASCIILiteral(&quot;[object Proxy]&quot;);

</span><span class="cx">         return true;

</span><span class="cx">     }

</span></span></pre></div>

<a id="trunkSourceJavaScriptCoreinspectoragentsInspectorHeapAgentcpp"></a>

<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/inspector/agents/InspectorHeapAgent.cpp (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/JavaScriptCore/inspector/agents/InspectorHeapAgent.cpp        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/JavaScriptCore/inspector/agents/InspectorHeapAgent.cpp        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -276,7 +276,7 @@

</span><span class="cx">     }

</span><span class="cx"> 

<span class="cx">     // Function preview.

</span><del>-    if (cell-&gt;inherits(JSFunction::info())) {

</del><ins>+    if (cell-&gt;inherits(vm, JSFunction::info())) {

</ins><span class="cx">         injectedScript.functionDetails(errorString, cell, &amp;functionDetails);

</span><span class="cx">         return;

</span><span class="cx">     }

</span></span></pre></div>

<a id="trunkSourceJavaScriptCoreinterpreterInterpretercpp"></a>

<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/interpreter/Interpreter.cpp (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/JavaScriptCore/interpreter/Interpreter.cpp        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/JavaScriptCore/interpreter/Interpreter.cpp        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -576,7 +576,7 @@

</span><span class="cx">     auto catchScope = DECLARE_CATCH_SCOPE(vm);

</span><span class="cx">     if (Debugger* debugger = callFrame-&gt;vmEntryGlobalObject()-&gt;debugger()) {

</span><span class="cx">         SuspendExceptionScope scope(&amp;vm);

</span><del>-        if (jsDynamicCast&lt;JSFunction*&gt;(callFrame-&gt;jsCallee()))

</del><ins>+        if (jsDynamicCast&lt;JSFunction*&gt;(vm, callFrame-&gt;jsCallee()))

</ins><span class="cx">             debugger-&gt;unwindEvent(callFrame);

</span><span class="cx">         else

</span><span class="cx">             debugger-&gt;didExecuteProgram(callFrame);

</span><span class="lines">@@ -681,7 +681,7 @@

</span><span class="cx"> 

<span class="cx">     // Calculate an exception handler vPC, unwinding call frames as necessary.

</span><span class="cx">     HandlerInfo* handler = nullptr;

</span><del>-    UnwindFunctor functor(callFrame, isTerminatedExecutionException(exception), codeBlock, handler);

</del><ins>+    UnwindFunctor functor(callFrame, isTerminatedExecutionException(vm, exception), codeBlock, handler);

</ins><span class="cx">     callFrame-&gt;iterate(functor);

</span><span class="cx">     if (!handler)

</span><span class="cx">         return nullptr;

</span><span class="lines">@@ -691,6 +691,7 @@

</span><span class="cx"> 

</span><span class="cx"> void Interpreter::notifyDebuggerOfExceptionToBeThrown(CallFrame* callFrame, Exception* exception)

</span><span class="cx"> {

</span><ins>+    VM&amp; vm = callFrame-&gt;vm();

</ins><span class="cx">     Debugger* debugger = callFrame-&gt;vmEntryGlobalObject()-&gt;debugger();

</span><span class="cx">     if (debugger &amp;&amp; debugger-&gt;needsExceptionCallbacks() &amp;&amp; !exception-&gt;didNotifyInspectorOfThrow()) {

<span class="cx">         // This code assumes that if the debugger is enabled then there is no inlining.

</span><span class="lines">@@ -699,7 +700,7 @@

</span><span class="cx">         // https://bugs.webkit.org/show_bug.cgi?id=121754

</span><span class="cx"> 

</span><span class="cx">         bool hasCatchHandler;

</span><del>-        bool isTermination = isTerminatedExecutionException(exception);

</del><ins>+        bool isTermination = isTerminatedExecutionException(vm, exception);

</ins><span class="cx">         if (isTermination)

</span><span class="cx">             hasCatchHandler = false;

</span><span class="cx">         else {

</span><span class="lines">@@ -850,7 +851,7 @@

</span><span class="cx">     {

</span><span class="cx">         CodeBlock* tempCodeBlock;

</span><span class="cx">         JSObject* error = program-&gt;prepareForExecution&lt;ProgramExecutable&gt;(vm, nullptr, scope, CodeForCall, tempCodeBlock);

</span><del>-        ASSERT(!throwScope.exception() || throwScope.exception() == jsDynamicCast&lt;Exception*&gt;(error));

</del><ins>+        ASSERT(!throwScope.exception() || throwScope.exception() == jsDynamicCast&lt;Exception*&gt;(vm, error));

</ins><span class="cx">         if (error)

</span><span class="cx">             return checkedReturn(throwException(callFrame, throwScope, error));

</span><span class="cx">         codeBlock = jsCast&lt;ProgramCodeBlock*&gt;(tempCodeBlock);

</span></span></pre></div>

<a id="trunkSourceJavaScriptCoreinterpreterShadowChickencpp"></a>

<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/interpreter/ShadowChicken.cpp (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/JavaScriptCore/interpreter/ShadowChicken.cpp        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/JavaScriptCore/interpreter/ShadowChicken.cpp        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -84,7 +84,7 @@

</span><span class="cx">     *m_logCursor++ = packet;

</span><span class="cx"> }

</span><span class="cx"> 

</span><del>-void ShadowChicken::update(VM&amp;, ExecState* exec)

</del><ins>+void ShadowChicken::update(VM&amp; vm, ExecState* exec)

</ins><span class="cx"> {

</span><span class="cx">     if (verbose) {

</span><span class="cx">         dataLog(&quot;Running update on: &quot;, *this, &quot;\n&quot;);

</span><span class="lines">@@ -300,11 +300,11 @@

</span><span class="cx">             CodeBlock* codeBlock = callFrame-&gt;codeBlock();

</span><span class="cx">             if (codeBlock &amp;&amp; codeBlock-&gt;wasCompiledWithDebuggingOpcodes() &amp;&amp; codeBlock-&gt;scopeRegister().isValid()) {

</span><span class="cx">                 scope = callFrame-&gt;scope(codeBlock-&gt;scopeRegister().offset());

</span><del>-                RELEASE_ASSERT(scope-&gt;inherits(JSScope::info()));

</del><ins>+                RELEASE_ASSERT(scope-&gt;inherits(vm, JSScope::info()));

</ins><span class="cx">             } else if (foundFrame) {

</span><span class="cx">                 scope = m_log[indexInLog].scope;

</span><span class="cx">                 if (scope)

</span><del>-                    RELEASE_ASSERT(scope-&gt;inherits(JSScope::info()));

</del><ins>+                    RELEASE_ASSERT(scope-&gt;inherits(vm, JSScope::info()));

</ins><span class="cx">             }

</span><span class="cx">             toPush.append(Frame(jsCast&lt;JSObject*&gt;(visitor-&gt;callee()), callFrame, isTailDeleted, callFrame-&gt;thisValue(), scope, codeBlock, callFrame-&gt;callSiteIndex()));

</span><span class="cx"> 

</span><span class="lines">@@ -349,7 +349,7 @@

</span><span class="cx">                     }

</span><span class="cx">                     Packet packet = m_log[indexInLog];

</span><span class="cx">                     bool isTailDeleted = true;

</span><del>-                    RELEASE_ASSERT(tailPacket.scope-&gt;inherits(JSScope::info()));

</del><ins>+                    RELEASE_ASSERT(tailPacket.scope-&gt;inherits(vm, JSScope::info()));

</ins><span class="cx">                     toPush.append(Frame(packet.callee, packet.frame, isTailDeleted, tailPacket.thisValue, tailPacket.scope, tailPacket.codeBlock, tailPacket.callSiteIndex));

</span><span class="cx">                 }

</span><span class="cx">             }

</span></span></pre></div>

<a id="trunkSourceJavaScriptCoreinterpreterStackVisitorcpp"></a>

<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/interpreter/StackVisitor.cpp (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/JavaScriptCore/interpreter/StackVisitor.cpp        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/JavaScriptCore/interpreter/StackVisitor.cpp        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -103,7 +103,7 @@

</span><span class="cx">         return;

</span><span class="cx">     }

</span><span class="cx"> 

</span><del>-    if (callFrame-&gt;callee()-&gt;isAnyWasmCallee()) {

</del><ins>+    if (callFrame-&gt;callee()-&gt;isAnyWasmCallee(callFrame-&gt;vm())) {

</ins><span class="cx">         readNonInlinedFrame(callFrame);

</span><span class="cx">         return;

</span><span class="cx">     }

</span><span class="lines">@@ -158,7 +158,7 @@

</span><span class="cx">     JSCell* callee = callFrame-&gt;callee();

</span><span class="cx">     m_frame.m_callee = callee;

</span><span class="cx"> 

</span><del>-    if (callee-&gt;isAnyWasmCallee()) {

</del><ins>+    if (callee-&gt;isAnyWasmCallee(*callee-&gt;vm())) {

</ins><span class="cx">         m_frame.m_isWasmFrame = true;

</span><span class="cx">         m_frame.m_codeBlock = nullptr;

</span><span class="cx">         m_frame.m_bytecodeOffset = 0;

</span><span class="lines">@@ -255,7 +255,7 @@

</span><span class="cx"> #if ENABLE(WEBASSEMBLY)

</span><span class="cx">     if (isWasmFrame()) {

</span><span class="cx">         if (JSCell* callee = this-&gt;callee()) {

</span><del>-            if (JSWebAssemblyCallee* wasmCallee = jsDynamicCast&lt;JSWebAssemblyCallee*&gt;(callee))

</del><ins>+            if (JSWebAssemblyCallee* wasmCallee = jsDynamicCast&lt;JSWebAssemblyCallee*&gt;(*callee-&gt;vm(), callee))

</ins><span class="cx">                 return wasmCallee-&gt;calleeSaveRegisters();

</span><span class="cx">             // Other wasm callees (e.g, stubs) don't use callee save registers, so nothing needs

<span class="cx">             // to be restored for them.

</span></span></pre></div>

<a id="trunkSourceJavaScriptCorejitJITCodecpp"></a>

<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/jit/JITCode.cpp (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/JavaScriptCore/jit/JITCode.cpp        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/JavaScriptCore/jit/JITCode.cpp        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -71,7 +71,7 @@

</span><span class="cx"> {

</span><span class="cx">     auto scope = DECLARE_THROW_SCOPE(*vm);

</span><span class="cx">     void* entryAddress;

</span><del>-    JSFunction* function = jsDynamicCast&lt;JSFunction*&gt;(protoCallFrame-&gt;callee());

</del><ins>+    JSFunction* function = jsDynamicCast&lt;JSFunction*&gt;(*vm, protoCallFrame-&gt;callee());

</ins><span class="cx"> 

</span><span class="cx">     if (!function || !protoCallFrame-&gt;needArityCheck()) {

</span><span class="cx">         ASSERT(!protoCallFrame-&gt;needArityCheck());

</span></span></pre></div>

<a id="trunkSourceJavaScriptCorejitJITOperationscpp"></a>

<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/jit/JITOperations.cpp (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/JavaScriptCore/jit/JITOperations.cpp        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/JavaScriptCore/jit/JITOperations.cpp        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -229,7 +229,7 @@

</span><span class="cx">     PropertySlot slot(baseValue, PropertySlot::InternalMethodType::Get);

</span><span class="cx">     Identifier ident = Identifier::fromUid(vm, uid);

</span><span class="cx">     

</span><del>-    LOG_IC((ICEvent::OperationGetById, baseValue.classInfoOrNull(), ident));

</del><ins>+    LOG_IC((ICEvent::OperationGetById, baseValue.classInfoOrNull(*vm), ident));

</ins><span class="cx">     return JSValue::encode(baseValue.get(exec, ident, slot));

</span><span class="cx"> }

</span><span class="cx"> 

</span><span class="lines">@@ -243,7 +243,7 @@

</span><span class="cx">     JSValue baseValue = JSValue::decode(base);

</span><span class="cx">     PropertySlot slot(baseValue, PropertySlot::InternalMethodType::Get);

</span><span class="cx">     Identifier ident = Identifier::fromUid(vm, uid);

</span><del>-    LOG_IC((ICEvent::OperationGetByIdGeneric, baseValue.classInfoOrNull(), ident));

</del><ins>+    LOG_IC((ICEvent::OperationGetByIdGeneric, baseValue.classInfoOrNull(*vm), ident));

</ins><span class="cx">     return JSValue::encode(baseValue.get(exec, ident, slot));

</span><span class="cx"> }

</span><span class="cx"> 

</span><span class="lines">@@ -256,7 +256,7 @@

</span><span class="cx">     Identifier ident = Identifier::fromUid(vm, uid);

</span><span class="cx"> 

</span><span class="cx">     JSValue baseValue = JSValue::decode(base);

</span><del>-    LOG_IC((ICEvent::OperationGetByIdOptimize, baseValue.classInfoOrNull(), ident));

</del><ins>+    LOG_IC((ICEvent::OperationGetByIdOptimize, baseValue.classInfoOrNull(*vm), ident));

</ins><span class="cx"> 

</span><span class="cx">     return JSValue::encode(baseValue.getPropertySlot(exec, ident, [&amp;] (bool found, PropertySlot&amp; slot) -&gt; JSValue {

</span><span class="cx">         if (stubInfo-&gt;considerCaching(baseValue.structureOrNull()))

</span><span class="lines">@@ -281,7 +281,7 @@

</span><span class="cx">     AccessType accessType = static_cast&lt;AccessType&gt;(stubInfo-&gt;accessType);

</span><span class="cx"> 

</span><span class="cx">     Identifier ident = Identifier::fromUid(vm, key);

</span><del>-    LOG_IC((ICEvent::OperationInOptimize, base-&gt;classInfo(), ident));

</del><ins>+    LOG_IC((ICEvent::OperationInOptimize, base-&gt;classInfo(*vm), ident));

</ins><span class="cx">     PropertySlot slot(base, PropertySlot::InternalMethodType::HasProperty);

</span><span class="cx">     bool result = asObject(base)-&gt;getPropertySlot(exec, ident, slot);

</span><span class="cx">     RETURN_IF_EXCEPTION(scope, encodedJSValue());

</span><span class="lines">@@ -310,7 +310,7 @@

</span><span class="cx">     }

</span><span class="cx"> 

</span><span class="cx">     Identifier ident = Identifier::fromUid(vm, key);

</span><del>-    LOG_IC((ICEvent::OperationIn, base-&gt;classInfo(), ident));

</del><ins>+    LOG_IC((ICEvent::OperationIn, base-&gt;classInfo(*vm), ident));

</ins><span class="cx">     return JSValue::encode(jsBoolean(asObject(base)-&gt;hasProperty(exec, ident)));

</span><span class="cx"> }

</span><span class="cx"> 

</span><span class="lines">@@ -335,7 +335,7 @@

</span><span class="cx">     

</span><span class="cx">     JSValue baseValue = JSValue::decode(encodedBase);

</span><span class="cx">     Identifier ident = Identifier::fromUid(vm, uid);

</span><del>-    LOG_IC((ICEvent::OperationPutByIdStrict, baseValue.classInfoOrNull(), ident));

</del><ins>+    LOG_IC((ICEvent::OperationPutByIdStrict, baseValue.classInfoOrNull(*vm), ident));

</ins><span class="cx"> 

</span><span class="cx">     PutPropertySlot slot(baseValue, true, exec-&gt;codeBlock()-&gt;putByIdContext());

</span><span class="cx">     baseValue.putInline(exec, ident, JSValue::decode(encodedValue), slot);

</span><span class="lines">@@ -352,7 +352,7 @@

</span><span class="cx">     

</span><span class="cx">     JSValue baseValue = JSValue::decode(encodedBase);

</span><span class="cx">     Identifier ident = Identifier::fromUid(vm, uid);

</span><del>-    LOG_IC((ICEvent::OperationPutByIdNonStrict, baseValue.classInfoOrNull(), ident));

</del><ins>+    LOG_IC((ICEvent::OperationPutByIdNonStrict, baseValue.classInfoOrNull(*vm), ident));

</ins><span class="cx">     PutPropertySlot slot(baseValue, false, exec-&gt;codeBlock()-&gt;putByIdContext());

</span><span class="cx">     baseValue.putInline(exec, ident, JSValue::decode(encodedValue), slot);

</span><span class="cx"> }

</span><span class="lines">@@ -368,7 +368,7 @@

</span><span class="cx">     

</span><span class="cx">     JSValue baseValue = JSValue::decode(encodedBase);

</span><span class="cx">     Identifier ident = Identifier::fromUid(vm, uid);

</span><del>-    LOG_IC((ICEvent::OperationPutByIdDirectStrict, baseValue.classInfoOrNull(), ident));

</del><ins>+    LOG_IC((ICEvent::OperationPutByIdDirectStrict, baseValue.classInfoOrNull(*vm), ident));

</ins><span class="cx">     PutPropertySlot slot(baseValue, true, exec-&gt;codeBlock()-&gt;putByIdContext());

</span><span class="cx">     asObject(baseValue)-&gt;putDirect(exec-&gt;vm(), ident, JSValue::decode(encodedValue), slot);

</span><span class="cx"> }

</span><span class="lines">@@ -384,7 +384,7 @@

</span><span class="cx">     

</span><span class="cx">     JSValue baseValue = JSValue::decode(encodedBase);

</span><span class="cx">     Identifier ident = Identifier::fromUid(vm, uid);

</span><del>-    LOG_IC((ICEvent::OperationPutByIdDirectNonStrict, baseValue.classInfoOrNull(), ident));

</del><ins>+    LOG_IC((ICEvent::OperationPutByIdDirectNonStrict, baseValue.classInfoOrNull(*vm), ident));

</ins><span class="cx">     PutPropertySlot slot(baseValue, false, exec-&gt;codeBlock()-&gt;putByIdContext());

</span><span class="cx">     asObject(baseValue)-&gt;putDirect(exec-&gt;vm(), ident, JSValue::decode(encodedValue), slot);

</span><span class="cx"> }

</span><span class="lines">@@ -402,7 +402,7 @@

</span><span class="cx"> 

</span><span class="cx">     JSValue value = JSValue::decode(encodedValue);

</span><span class="cx">     JSValue baseValue = JSValue::decode(encodedBase);

</span><del>-    LOG_IC((ICEvent::OperationPutByIdStrictOptimize, baseValue.classInfoOrNull(), ident));

</del><ins>+    LOG_IC((ICEvent::OperationPutByIdStrictOptimize, baseValue.classInfoOrNull(*vm), ident));

</ins><span class="cx">     PutPropertySlot slot(baseValue, true, exec-&gt;codeBlock()-&gt;putByIdContext());

</span><span class="cx"> 

</span><span class="cx">     Structure* structure = baseValue.isCell() ? baseValue.asCell()-&gt;structure(*vm) : nullptr;

</span><span class="lines">@@ -429,7 +429,7 @@

</span><span class="cx"> 

</span><span class="cx">     JSValue value = JSValue::decode(encodedValue);

</span><span class="cx">     JSValue baseValue = JSValue::decode(encodedBase);

</span><del>-    LOG_IC((ICEvent::OperationPutByIdNonStrictOptimize, baseValue.classInfoOrNull(), ident));

</del><ins>+    LOG_IC((ICEvent::OperationPutByIdNonStrictOptimize, baseValue.classInfoOrNull(*vm), ident));

</ins><span class="cx">     PutPropertySlot slot(baseValue, false, exec-&gt;codeBlock()-&gt;putByIdContext());

</span><span class="cx"> 

</span><span class="cx">     Structure* structure = baseValue.isCell() ? baseValue.asCell()-&gt;structure(*vm) : nullptr;    

</span><span class="lines">@@ -455,7 +455,7 @@

</span><span class="cx"> 

</span><span class="cx">     JSValue value = JSValue::decode(encodedValue);

</span><span class="cx">     JSObject* baseObject = asObject(JSValue::decode(encodedBase));

</span><del>-    LOG_IC((ICEvent::OperationPutByIdDirectStrictOptimize, baseObject-&gt;classInfo(), ident));

</del><ins>+    LOG_IC((ICEvent::OperationPutByIdDirectStrictOptimize, baseObject-&gt;classInfo(*vm), ident));

</ins><span class="cx">     PutPropertySlot slot(baseObject, true, exec-&gt;codeBlock()-&gt;putByIdContext());

</span><span class="cx">     

</span><span class="cx">     Structure* structure = baseObject-&gt;structure(*vm);

</span><span class="lines">@@ -480,7 +480,7 @@

</span><span class="cx"> 

</span><span class="cx">     JSValue value = JSValue::decode(encodedValue);

</span><span class="cx">     JSObject* baseObject = asObject(JSValue::decode(encodedBase));

</span><del>-    LOG_IC((ICEvent::OperationPutByIdDirectNonStrictOptimize, baseObject-&gt;classInfo(), ident));

</del><ins>+    LOG_IC((ICEvent::OperationPutByIdDirectNonStrictOptimize, baseObject-&gt;classInfo(*vm), ident));

</ins><span class="cx">     PutPropertySlot slot(baseObject, false, exec-&gt;codeBlock()-&gt;putByIdContext());

</span><span class="cx">     

</span><span class="cx">     Structure* structure = baseObject-&gt;structure(*vm);

</span><span class="lines">@@ -1126,8 +1126,8 @@

</span><span class="cx"> template&lt;typename FunctionType&gt;

</span><span class="cx"> static EncodedJSValue operationNewFunctionCommon(ExecState* exec, JSScope* scope, JSCell* functionExecutable, bool isInvalidated)

</span><span class="cx"> {

</span><del>-    ASSERT(functionExecutable-&gt;inherits(FunctionExecutable::info()));

</del><span class="cx">     VM&amp; vm = exec-&gt;vm();

</span><ins>+    ASSERT(functionExecutable-&gt;inherits(vm, FunctionExecutable::info()));

</ins><span class="cx">     NativeCallFrameTracer tracer(&amp;vm, exec);

</span><span class="cx">     if (isInvalidated)

</span><span class="cx">         return JSValue::encode(FunctionType::createWithInvalidatedReallocationWatchpoint(vm, static_cast&lt;FunctionExecutable*&gt;(functionExecutable), scope));

</span><span class="lines">@@ -2703,7 +2703,7 @@

</span><span class="cx">     auto scope = DECLARE_THROW_SCOPE(vm);

</span><span class="cx">     RELEASE_ASSERT(!!scope.exception());

</span><span class="cx"> 

</span><del>-    if (isTerminatedExecutionException(scope.exception())) {

</del><ins>+    if (isTerminatedExecutionException(vm, scope.exception())) {

</ins><span class="cx">         genericUnwind(&amp;vm, exec);

</span><span class="cx">         return 1;

</span><span class="cx">     }

</span></span></pre></div>

<a id="trunkSourceJavaScriptCorejitRepatchcpp"></a>

<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/jit/Repatch.cpp (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/JavaScriptCore/jit/Repatch.cpp        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/JavaScriptCore/jit/Repatch.cpp        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -179,12 +179,12 @@

</span><span class="cx">             newCase = AccessCase::getLength(vm, codeBlock, AccessCase::ArrayLength);

</span><span class="cx">         } else if (isJSString(baseValue))

</span><span class="cx">             newCase = AccessCase::getLength(vm, codeBlock, AccessCase::StringLength);

</span><del>-        else if (DirectArguments* arguments = jsDynamicCast&lt;DirectArguments*&gt;(baseValue)) {

</del><ins>+        else if (DirectArguments* arguments = jsDynamicCast&lt;DirectArguments*&gt;(vm, baseValue)) {

</ins><span class="cx">             // If there were overrides, then we can handle this as a normal property load! Guarding

<span class="cx">             // this with such a check enables us to add an IC case for that load if needed.

</span><span class="cx">             if (!arguments-&gt;overrodeThings())

</span><span class="cx">                 newCase = AccessCase::getLength(vm, codeBlock, AccessCase::DirectArgumentsLength);

</span><del>-        } else if (ScopedArguments* arguments = jsDynamicCast&lt;ScopedArguments*&gt;(baseValue)) {

</del><ins>+        } else if (ScopedArguments* arguments = jsDynamicCast&lt;ScopedArguments*&gt;(vm, baseValue)) {

</ins><span class="cx">             // Ditto.

</span><span class="cx">             if (!arguments-&gt;overrodeThings())

</span><span class="cx">                 newCase = AccessCase::getLength(vm, codeBlock, AccessCase::ScopedArgumentsLength);

</span><span class="lines">@@ -261,7 +261,7 @@

</span><span class="cx"> 

</span><span class="cx">         JSFunction* getter = nullptr;

</span><span class="cx">         if (slot.isCacheableGetter())

</span><del>-            getter = jsDynamicCast&lt;JSFunction*&gt;(slot.getterSetter()-&gt;getter());

</del><ins>+            getter = jsDynamicCast&lt;JSFunction*&gt;(vm, slot.getterSetter()-&gt;getter());

</ins><span class="cx"> 

</span><span class="cx">         DOMJIT::GetterSetter* domJIT = nullptr;

</span><span class="cx">         if (slot.isCacheableCustom() &amp;&amp; slot.domJIT())

</span><span class="lines">@@ -302,12 +302,12 @@

</span><span class="cx">         }

</span><span class="cx">     }

</span><span class="cx"> 

</span><del>-    LOG_IC((ICEvent::GetByIdAddAccessCase, baseValue.classInfoOrNull(), propertyName));

</del><ins>+    LOG_IC((ICEvent::GetByIdAddAccessCase, baseValue.classInfoOrNull(vm), propertyName));

</ins><span class="cx"> 

</span><span class="cx">     AccessGenerationResult result = stubInfo.addAccessCase(codeBlock, propertyName, WTFMove(newCase));

</span><span class="cx"> 

</span><span class="cx">     if (result.generatedSomeCode()) {

</span><del>-        LOG_IC((ICEvent::GetByIdReplaceWithJump, baseValue.classInfoOrNull(), propertyName));

</del><ins>+        LOG_IC((ICEvent::GetByIdReplaceWithJump, baseValue.classInfoOrNull(vm), propertyName));

</ins><span class="cx">         

</span><span class="cx">         RELEASE_ASSERT(result.code());

</span><span class="cx">         InlineAccess::rewireStubAsJump(exec-&gt;vm(), stubInfo, CodeLocationLabel(result.code()));

</span></span></pre></div>

<a id="trunkSourceJavaScriptCorejsccpp"></a>

<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/jsc.cpp (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/JavaScriptCore/jsc.cpp        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/JavaScriptCore/jsc.cpp        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -383,7 +383,7 @@

</span><span class="cx">         VM&amp; vm = exec-&gt;vm();

</span><span class="cx">         auto scope = DECLARE_THROW_SCOPE(vm);

</span><span class="cx"> 

</span><del>-        CustomGetter* thisObject = jsDynamicCast&lt;CustomGetter*&gt;(JSValue::decode(thisValue));

</del><ins>+        CustomGetter* thisObject = jsDynamicCast&lt;CustomGetter*&gt;(vm, JSValue::decode(thisValue));

</ins><span class="cx">         if (!thisObject)

</span><span class="cx">             return throwVMTypeError(exec, scope);

</span><span class="cx">         bool shouldThrow = thisObject-&gt;get(exec, PropertyName(Identifier::fromString(exec, &quot;shouldThrow&quot;))).toBoolean(exec);

</span><span class="lines">@@ -473,8 +473,9 @@

</span><span class="cx"> protected:

</span><span class="cx">     void finishCreation(ExecState* exec)

</span><span class="cx">     {

</span><del>-        Base::finishCreation(exec-&gt;vm());

-        ASSERT(inherits(info()));

</del><ins>+        VM&amp; vm = exec-&gt;vm();

+        Base::finishCreation(vm);

+        ASSERT(inherits(vm, info()));

</ins><span class="cx"> 

</span><span class="cx">         for (size_t i = 0; i &lt; exec-&gt;argumentCount(); i++)

</span><span class="cx">             m_vector.append(exec-&gt;argument(i).toInt32(exec));

</span><span class="lines">@@ -491,7 +492,7 @@

</span><span class="cx">         VM&amp; vm = exec-&gt;vm();

</span><span class="cx">         auto scope = DECLARE_THROW_SCOPE(vm);

</span><span class="cx"> 

</span><del>-        RuntimeArray* thisObject = jsDynamicCast&lt;RuntimeArray*&gt;(JSValue::decode(thisValue));

</del><ins>+        RuntimeArray* thisObject = jsDynamicCast&lt;RuntimeArray*&gt;(vm, JSValue::decode(thisValue));

</ins><span class="cx">         if (!thisObject)

</span><span class="cx">             return throwVMTypeError(exec, scope);

</span><span class="cx">         return JSValue::encode(jsNumber(thisObject-&gt;getLength()));

</span><span class="lines">@@ -676,7 +677,7 @@

</span><span class="cx">         VM&amp; vm = exec-&gt;vm();

</span><span class="cx">         auto scope = DECLARE_THROW_SCOPE(vm);

</span><span class="cx"> 

</span><del>-        DOMJITNode* thisObject = jsDynamicCast&lt;DOMJITNode*&gt;(JSValue::decode(thisValue));

</del><ins>+        DOMJITNode* thisObject = jsDynamicCast&lt;DOMJITNode*&gt;(vm, JSValue::decode(thisValue));

</ins><span class="cx">         if (!thisObject)

</span><span class="cx">             return throwVMTypeError(exec, scope);

</span><span class="cx">         return JSValue::encode(jsNumber(thisObject-&gt;value()));

</span><span class="lines">@@ -725,7 +726,7 @@

</span><span class="cx">             NativeCallFrameTracer tracer(&amp;vm, exec);

</span><span class="cx">             auto scope = DECLARE_THROW_SCOPE(vm);

</span><span class="cx">             auto* object = static_cast&lt;DOMJITNode*&gt;(pointer);

</span><del>-            auto* domjitGetterComplex = jsDynamicCast&lt;DOMJITGetterComplex*&gt;(object);

</del><ins>+            auto* domjitGetterComplex = jsDynamicCast&lt;DOMJITGetterComplex*&gt;(vm, object);

</ins><span class="cx">             if (domjitGetterComplex) {

</span><span class="cx">                 if (domjitGetterComplex-&gt;m_enableException)

</span><span class="cx">                     return JSValue::encode(throwException(exec, scope, createError(exec, ASCIILiteral(&quot;DOMJITGetterComplex slow call exception&quot;))));

</span><span class="lines">@@ -772,7 +773,8 @@

</span><span class="cx"> 

</span><span class="cx">     static EncodedJSValue JSC_HOST_CALL functionEnableException(ExecState* exec)

</span><span class="cx">     {

</span><del>-        auto* object = jsDynamicCast&lt;DOMJITGetterComplex*&gt;(exec-&gt;thisValue());

</del><ins>+        VM&amp; vm = exec-&gt;vm();

+        auto* object = jsDynamicCast&lt;DOMJITGetterComplex*&gt;(vm, exec-&gt;thisValue());

</ins><span class="cx">         if (object)

</span><span class="cx">             object-&gt;m_enableException = true;

</span><span class="cx">         return JSValue::encode(jsUndefined());

</span><span class="lines">@@ -783,10 +785,10 @@

</span><span class="cx">         VM&amp; vm = exec-&gt;vm();

</span><span class="cx">         auto scope = DECLARE_THROW_SCOPE(vm);

</span><span class="cx"> 

</span><del>-        auto* thisObject = jsDynamicCast&lt;DOMJITNode*&gt;(JSValue::decode(thisValue));

</del><ins>+        auto* thisObject = jsDynamicCast&lt;DOMJITNode*&gt;(vm, JSValue::decode(thisValue));

</ins><span class="cx">         if (!thisObject)

</span><span class="cx">             return throwVMTypeError(exec, scope);

</span><del>-        if (auto* domjitGetterComplex = jsDynamicCast&lt;DOMJITGetterComplex*&gt;(JSValue::decode(thisValue))) {

</del><ins>+        if (auto* domjitGetterComplex = jsDynamicCast&lt;DOMJITGetterComplex*&gt;(vm, JSValue::decode(thisValue))) {

</ins><span class="cx">             if (domjitGetterComplex-&gt;m_enableException)

</span><span class="cx">                 return JSValue::encode(throwException(exec, scope, createError(exec, ASCIILiteral(&quot;DOMJITGetterComplex slow call exception&quot;))));

</span><span class="cx">         }

</span><span class="lines">@@ -825,7 +827,7 @@

</span><span class="cx">         VM&amp; vm = exec-&gt;vm();

</span><span class="cx">         auto scope = DECLARE_THROW_SCOPE(vm);

</span><span class="cx"> 

</span><del>-        DOMJITNode* thisObject = jsDynamicCast&lt;DOMJITNode*&gt;(exec-&gt;thisValue());

</del><ins>+        DOMJITNode* thisObject = jsDynamicCast&lt;DOMJITNode*&gt;(vm, exec-&gt;thisValue());

</ins><span class="cx">         if (!thisObject)

</span><span class="cx">             return throwVMTypeError(exec, scope);

</span><span class="cx">         return JSValue::encode(jsNumber(thisObject-&gt;value()));

</span><span class="lines">@@ -1758,7 +1760,8 @@

</span><span class="cx"> {

</span><span class="cx">     if (exec-&gt;argumentCount() &lt; 1)

</span><span class="cx">         return JSValue::encode(jsUndefined());

</span><del>-    JSObject* object = jsDynamicCast&lt;JSObject*&gt;(exec-&gt;argument(0));

</del><ins>+    VM&amp; vm = exec-&gt;vm();

+    JSObject* object = jsDynamicCast&lt;JSObject*&gt;(vm, exec-&gt;argument(0));

</ins><span class="cx">     if (!object)

</span><span class="cx">         return JSValue::encode(jsNontrivialString(exec, ASCIILiteral(&quot;&lt;not object&gt;&quot;)));

</span><span class="cx">     return JSValue::encode(jsNontrivialString(exec, toString(&quot;&lt;Butterfly: &quot;, RawPointer(object-&gt;butterfly()), &quot;; public length: &quot;, object-&gt;getArrayLength(), &quot;; vector length: &quot;, object-&gt;getVectorLength(), &quot;&gt;&quot;)));

</span><span class="lines">@@ -1818,7 +1821,7 @@

</span><span class="cx">     JSLockHolder lock(vm);

</span><span class="cx">     auto scope = DECLARE_THROW_SCOPE(vm);

</span><span class="cx"> 

</span><del>-    Root* root = jsDynamicCast&lt;Root*&gt;(exec-&gt;argument(0));

</del><ins>+    Root* root = jsDynamicCast&lt;Root*&gt;(vm, exec-&gt;argument(0));

</ins><span class="cx">     if (!root)

</span><span class="cx">         return JSValue::encode(throwException(exec, scope, createError(exec, ASCIILiteral(&quot;Cannot create Element without a Root.&quot;))));

</span><span class="cx">     return JSValue::encode(Element::create(vm, exec-&gt;lexicalGlobalObject(), root));

</span><span class="lines">@@ -1827,7 +1830,8 @@

</span><span class="cx"> EncodedJSValue JSC_HOST_CALL functionGetElement(ExecState* exec)

</span><span class="cx"> {

</span><span class="cx">     JSLockHolder lock(exec);

</span><del>-    Root* root = jsDynamicCast&lt;Root*&gt;(exec-&gt;argument(0));

</del><ins>+    VM&amp; vm = exec-&gt;vm();

+    Root* root = jsDynamicCast&lt;Root*&gt;(vm, exec-&gt;argument(0));

</ins><span class="cx">     if (!root)

</span><span class="cx">         return JSValue::encode(jsUndefined());

</span><span class="cx">     Element* result = root-&gt;element();

</span><span class="lines">@@ -1837,8 +1841,9 @@

</span><span class="cx"> EncodedJSValue JSC_HOST_CALL functionSetElementRoot(ExecState* exec)

</span><span class="cx"> {

</span><span class="cx">     JSLockHolder lock(exec);

</span><del>-    Element* element = jsDynamicCast&lt;Element*&gt;(exec-&gt;argument(0));

-    Root* root = jsDynamicCast&lt;Root*&gt;(exec-&gt;argument(1));

</del><ins>+    VM&amp; vm = exec-&gt;vm();

+    Element* element = jsDynamicCast&lt;Element*&gt;(vm, exec-&gt;argument(0));

+    Root* root = jsDynamicCast&lt;Root*&gt;(vm, exec-&gt;argument(1));

</ins><span class="cx">     if (element &amp;&amp; root)

</span><span class="cx">         element-&gt;setRoot(exec-&gt;vm(), root);

</span><span class="cx">     return JSValue::encode(jsUndefined());

</span><span class="lines">@@ -1856,7 +1861,7 @@

</span><span class="cx">     JSLockHolder lock(vm);

</span><span class="cx">     auto scope = DECLARE_THROW_SCOPE(vm);

</span><span class="cx"> 

</span><del>-    SimpleObject* simpleObject = jsDynamicCast&lt;SimpleObject*&gt;(exec-&gt;argument(0));

</del><ins>+    SimpleObject* simpleObject = jsDynamicCast&lt;SimpleObject*&gt;(vm, exec-&gt;argument(0));

</ins><span class="cx">     if (UNLIKELY(!simpleObject)) {

</span><span class="cx">         throwTypeError(exec, scope, ASCIILiteral(&quot;Invalid use of getHiddenValue test function&quot;));

</span><span class="cx">         return encodedJSValue();

</span><span class="lines">@@ -1870,7 +1875,7 @@

</span><span class="cx">     JSLockHolder lock(vm);

</span><span class="cx">     auto scope = DECLARE_THROW_SCOPE(vm);

</span><span class="cx"> 

</span><del>-    SimpleObject* simpleObject = jsDynamicCast&lt;SimpleObject*&gt;(exec-&gt;argument(0));

</del><ins>+    SimpleObject* simpleObject = jsDynamicCast&lt;SimpleObject*&gt;(vm, exec-&gt;argument(0));

</ins><span class="cx">     if (UNLIKELY(!simpleObject)) {

</span><span class="cx">         throwTypeError(exec, scope, ASCIILiteral(&quot;Invalid use of setHiddenValue test function&quot;));

</span><span class="cx">         return encodedJSValue();

</span><span class="lines">@@ -1963,7 +1968,7 @@

</span><span class="cx">     JSValue delegate = exec-&gt;argument(1);

</span><span class="cx">     if (!delegate.isObject())

</span><span class="cx">         return JSValue::encode(jsUndefined());

</span><del>-    ImpureGetter* impureGetter = jsDynamicCast&lt;ImpureGetter*&gt;(asObject(base.asCell()));

</del><ins>+    ImpureGetter* impureGetter = jsDynamicCast&lt;ImpureGetter*&gt;(vm, asObject(base.asCell()));

</ins><span class="cx">     if (UNLIKELY(!impureGetter)) {

</span><span class="cx">         throwTypeError(exec, scope, ASCIILiteral(&quot;argument is not an ImpureGetter&quot;));

</span><span class="cx">         return encodedJSValue();

</span><span class="lines">@@ -2309,7 +2314,8 @@

</span><span class="cx"> 

</span><span class="cx"> EncodedJSValue JSC_HOST_CALL functionNoFTL(ExecState* exec)

</span><span class="cx"> {

</span><del>-    if (JSFunction* function = jsDynamicCast&lt;JSFunction*&gt;(exec-&gt;argument(0))) {

</del><ins>+    VM&amp; vm = exec-&gt;vm();

+    if (JSFunction* function = jsDynamicCast&lt;JSFunction*&gt;(vm, exec-&gt;argument(0))) {

</ins><span class="cx">         FunctionExecutable* executable = function-&gt;jsExecutable();

</span><span class="cx">         executable-&gt;setNeverFTLOptimize(true);

</span><span class="cx">     }

</span><span class="lines">@@ -2463,7 +2469,7 @@

</span><span class="cx">     String sourceCode = exec-&gt;argument(0).toWTFString(exec);

</span><span class="cx">     RETURN_IF_EXCEPTION(scope, encodedJSValue());

</span><span class="cx">     

</span><del>-    GlobalObject* globalObject = jsDynamicCast&lt;GlobalObject*&gt;(

</del><ins>+    GlobalObject* globalObject = jsDynamicCast&lt;GlobalObject*&gt;(vm,

</ins><span class="cx">         exec-&gt;thisValue().get(exec, Identifier::fromString(exec, &quot;global&quot;)));

</span><span class="cx">     RETURN_IF_EXCEPTION(scope, encodedJSValue());

</span><span class="cx">     if (!globalObject)

</span><span class="lines">@@ -2583,7 +2589,7 @@

</span><span class="cx">     VM&amp; vm = exec-&gt;vm();

</span><span class="cx">     auto scope = DECLARE_THROW_SCOPE(vm);

</span><span class="cx"> 

</span><del>-    JSArrayBuffer* jsBuffer = jsDynamicCast&lt;JSArrayBuffer*&gt;(exec-&gt;argument(0));

</del><ins>+    JSArrayBuffer* jsBuffer = jsDynamicCast&lt;JSArrayBuffer*&gt;(vm, exec-&gt;argument(0));

</ins><span class="cx">     if (!jsBuffer || !jsBuffer-&gt;isShared())

</span><span class="cx">         return JSValue::encode(throwException(exec, scope, createError(exec, ASCIILiteral(&quot;Expected SharedArrayBuffer&quot;))));

</span><span class="cx">     

</span><span class="lines">@@ -2594,7 +2600,7 @@

</span><span class="cx">         [&amp;] (const AbstractLocker&amp; locker, Worker&amp; worker) {

</span><span class="cx">             ArrayBuffer* nativeBuffer = jsBuffer-&gt;impl();

</span><span class="cx">             ArrayBufferContents contents;

<del>-            nativeBuffer-&gt;transferTo(contents); // &quot;transferTo&quot; means &quot;share&quot; if the buffer is shared.

</del><ins>+            nativeBuffer-&gt;transferTo(vm, contents); // &quot;transferTo&quot; means &quot;share&quot; if the buffer is shared.

</ins><span class="cx">             RefPtr&lt;Message&gt; message = adoptRef(new Message(WTFMove(contents), index));

</span><span class="cx">             worker.enqueue(locker, message);

</span><span class="cx">         });

</span><span class="lines">@@ -2672,12 +2678,12 @@

</span><span class="cx">     if (exec-&gt;argumentCount() &lt; 1)

</span><span class="cx">         return JSValue::encode(throwException(exec, scope, createError(exec, ASCIILiteral(&quot;Not enough arguments&quot;))));

</span><span class="cx">     

</span><del>-    JSArrayBuffer* buffer = jsDynamicCast&lt;JSArrayBuffer*&gt;(exec-&gt;argument(0));

</del><ins>+    JSArrayBuffer* buffer = jsDynamicCast&lt;JSArrayBuffer*&gt;(vm, exec-&gt;argument(0));

</ins><span class="cx">     if (!buffer)

</span><span class="cx">         return JSValue::encode(throwException(exec, scope, createError(exec, ASCIILiteral(&quot;Expected an array buffer&quot;))));

</span><span class="cx">     

</span><span class="cx">     ArrayBufferContents dummyContents;

</span><del>-    buffer-&gt;impl()-&gt;transferTo(dummyContents);

</del><ins>+    buffer-&gt;impl()-&gt;transferTo(vm, dummyContents);

</ins><span class="cx">     

</span><span class="cx">     return JSValue::encode(jsUndefined());

</span><span class="cx"> }

</span><span class="lines">@@ -2745,12 +2751,13 @@

</span><span class="cx"> 

</span><span class="cx"> EncodedJSValue JSC_HOST_CALL functionFindTypeForExpression(ExecState* exec)

</span><span class="cx"> {

</span><ins>+    VM&amp; vm = exec-&gt;vm();

</ins><span class="cx">     RELEASE_ASSERT(exec-&gt;vm().typeProfiler());

</span><del>-    exec-&gt;vm().typeProfilerLog()-&gt;processLogEntries(ASCIILiteral(&quot;jsc Testing API: functionFindTypeForExpression&quot;));

</del><ins>+    vm.typeProfilerLog()-&gt;processLogEntries(ASCIILiteral(&quot;jsc Testing API: functionFindTypeForExpression&quot;));

</ins><span class="cx"> 

</span><span class="cx">     JSValue functionValue = exec-&gt;argument(0);

</span><span class="cx">     RELEASE_ASSERT(functionValue.isFunction());

</span><del>-    FunctionExecutable* executable = (jsDynamicCast&lt;JSFunction*&gt;(functionValue.asCell()-&gt;getObject()))-&gt;jsExecutable();

</del><ins>+    FunctionExecutable* executable = (jsDynamicCast&lt;JSFunction*&gt;(vm, functionValue.asCell()-&gt;getObject()))-&gt;jsExecutable();

</ins><span class="cx"> 

</span><span class="cx">     RELEASE_ASSERT(exec-&gt;argument(1).isString());

</span><span class="cx">     String substring = asString(exec-&gt;argument(1))-&gt;value(exec);

</span><span class="lines">@@ -2763,12 +2770,13 @@

</span><span class="cx"> 

</span><span class="cx"> EncodedJSValue JSC_HOST_CALL functionReturnTypeFor(ExecState* exec)

</span><span class="cx"> {

</span><ins>+    VM&amp; vm = exec-&gt;vm();

</ins><span class="cx">     RELEASE_ASSERT(exec-&gt;vm().typeProfiler());

</span><del>-    exec-&gt;vm().typeProfilerLog()-&gt;processLogEntries(ASCIILiteral(&quot;jsc Testing API: functionReturnTypeFor&quot;));

</del><ins>+    vm.typeProfilerLog()-&gt;processLogEntries(ASCIILiteral(&quot;jsc Testing API: functionReturnTypeFor&quot;));

</ins><span class="cx"> 

</span><span class="cx">     JSValue functionValue = exec-&gt;argument(0);

</span><span class="cx">     RELEASE_ASSERT(functionValue.isFunction());

</span><del>-    FunctionExecutable* executable = (jsDynamicCast&lt;JSFunction*&gt;(functionValue.asCell()-&gt;getObject()))-&gt;jsExecutable();

</del><ins>+    FunctionExecutable* executable = (jsDynamicCast&lt;JSFunction*&gt;(vm, functionValue.asCell()-&gt;getObject()))-&gt;jsExecutable();

</ins><span class="cx"> 

</span><span class="cx">     unsigned offset = executable-&gt;typeProfilingStartOffset();

</span><span class="cx">     String jsonString = exec-&gt;vm().typeProfiler()-&gt;typeInformationForExpressionAtOffset(TypeProfilerSearchDescriptorFunctionReturn, offset, executable-&gt;sourceID(), exec-&gt;vm());

</span><span class="lines">@@ -2784,11 +2792,12 @@

</span><span class="cx"> 

</span><span class="cx"> EncodedJSValue JSC_HOST_CALL functionHasBasicBlockExecuted(ExecState* exec)

</span><span class="cx"> {

</span><del>-    RELEASE_ASSERT(exec-&gt;vm().controlFlowProfiler());

</del><ins>+    VM&amp; vm = exec-&gt;vm();

+    RELEASE_ASSERT(vm.controlFlowProfiler());

</ins><span class="cx"> 

</span><span class="cx">     JSValue functionValue = exec-&gt;argument(0);

</span><span class="cx">     RELEASE_ASSERT(functionValue.isFunction());

</span><del>-    FunctionExecutable* executable = (jsDynamicCast&lt;JSFunction*&gt;(functionValue.asCell()-&gt;getObject()))-&gt;jsExecutable();

</del><ins>+    FunctionExecutable* executable = (jsDynamicCast&lt;JSFunction*&gt;(vm, functionValue.asCell()-&gt;getObject()))-&gt;jsExecutable();

</ins><span class="cx"> 

</span><span class="cx">     RELEASE_ASSERT(exec-&gt;argument(1).isString());

</span><span class="cx">     String substring = asString(exec-&gt;argument(1))-&gt;value(exec);

</span><span class="lines">@@ -2796,17 +2805,18 @@

</span><span class="cx">     RELEASE_ASSERT(sourceCodeText.contains(substring));

</span><span class="cx">     int offset = sourceCodeText.find(substring) + executable-&gt;source().startOffset();

</span><span class="cx">     

</span><del>-    bool hasExecuted = exec-&gt;vm().controlFlowProfiler()-&gt;hasBasicBlockAtTextOffsetBeenExecuted(offset, executable-&gt;sourceID(), exec-&gt;vm());

</del><ins>+    bool hasExecuted = vm.controlFlowProfiler()-&gt;hasBasicBlockAtTextOffsetBeenExecuted(offset, executable-&gt;sourceID(), vm);

</ins><span class="cx">     return JSValue::encode(jsBoolean(hasExecuted));

</span><span class="cx"> }

</span><span class="cx"> 

</span><span class="cx"> EncodedJSValue JSC_HOST_CALL functionBasicBlockExecutionCount(ExecState* exec)

</span><span class="cx"> {

</span><del>-    RELEASE_ASSERT(exec-&gt;vm().controlFlowProfiler());

</del><ins>+    VM&amp; vm = exec-&gt;vm();

+    RELEASE_ASSERT(vm.controlFlowProfiler());

</ins><span class="cx"> 

</span><span class="cx">     JSValue functionValue = exec-&gt;argument(0);

</span><span class="cx">     RELEASE_ASSERT(functionValue.isFunction());

</span><del>-    FunctionExecutable* executable = (jsDynamicCast&lt;JSFunction*&gt;(functionValue.asCell()-&gt;getObject()))-&gt;jsExecutable();

</del><ins>+    FunctionExecutable* executable = (jsDynamicCast&lt;JSFunction*&gt;(vm, functionValue.asCell()-&gt;getObject()))-&gt;jsExecutable();

</ins><span class="cx"> 

</span><span class="cx">     RELEASE_ASSERT(exec-&gt;argument(1).isString());

</span><span class="cx">     String substring = asString(exec-&gt;argument(1))-&gt;value(exec);

</span><span class="lines">@@ -2814,7 +2824,7 @@

</span><span class="cx">     RELEASE_ASSERT(sourceCodeText.contains(substring));

</span><span class="cx">     int offset = sourceCodeText.find(substring) + executable-&gt;source().startOffset();

</span><span class="cx">     

</span><del>-    size_t executionCount = exec-&gt;vm().controlFlowProfiler()-&gt;basicBlockExecutionCountAtTextOffset(offset, executable-&gt;sourceID(), exec-&gt;vm());

</del><ins>+    size_t executionCount = vm.controlFlowProfiler()-&gt;basicBlockExecutionCountAtTextOffset(offset, executable-&gt;sourceID(), exec-&gt;vm());

</ins><span class="cx">     return JSValue::encode(JSValue(executionCount));

</span><span class="cx"> }

</span><span class="cx"> 

</span><span class="lines">@@ -2941,8 +2951,9 @@

</span><span class="cx"> 

</span><span class="cx"> EncodedJSValue JSC_HOST_CALL functionEnsureArrayStorage(ExecState* exec)

</span><span class="cx"> {

</span><ins>+    VM&amp; vm = exec-&gt;vm();

</ins><span class="cx">     for (unsigned i = 0; i &lt; exec-&gt;argumentCount(); ++i) {

</span><del>-        if (JSObject* object = jsDynamicCast&lt;JSObject*&gt;(exec-&gt;argument(0)))

</del><ins>+        if (JSObject* object = jsDynamicCast&lt;JSObject*&gt;(vm, exec-&gt;argument(0)))

</ins><span class="cx">             object-&gt;ensureArrayStorage(exec-&gt;vm());

</span><span class="cx">     }

</span><span class="cx">     return JSValue::encode(jsUndefined());

</span></span></pre></div>

<a id="trunkSourceJavaScriptCorellintLLIntSlowPathscpp"></a>

<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/llint/LLIntSlowPaths.cpp (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/JavaScriptCore/llint/LLIntSlowPaths.cpp        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/JavaScriptCore/llint/LLIntSlowPaths.cpp        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -1600,7 +1600,7 @@

</span><span class="cx">     LLINT_BEGIN();

</span><span class="cx">     RELEASE_ASSERT(!!throwScope.exception());

</span><span class="cx"> 

</span><del>-    if (isTerminatedExecutionException(throwScope.exception()))

</del><ins>+    if (isTerminatedExecutionException(vm, throwScope.exception()))

</ins><span class="cx">         LLINT_RETURN_TWO(pc, bitwise_cast&lt;void*&gt;(static_cast&lt;uintptr_t&gt;(1)));

</span><span class="cx">     LLINT_RETURN_TWO(pc, 0);

</span><span class="cx"> }

</span></span></pre></div>

<a id="trunkSourceJavaScriptCoreruntimeAbstractModuleRecordcpp"></a>

<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/AbstractModuleRecord.cpp (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/JavaScriptCore/runtime/AbstractModuleRecord.cpp        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/JavaScriptCore/runtime/AbstractModuleRecord.cpp        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -53,7 +53,7 @@

</span><span class="cx"> void AbstractModuleRecord::finishCreation(ExecState* exec, VM&amp; vm)

</span><span class="cx"> {

</span><span class="cx">     Base::finishCreation(vm);

</span><del>-    ASSERT(inherits(info()));

</del><ins>+    ASSERT(inherits(vm, info()));

</ins><span class="cx">     putDirect(vm, Identifier::fromString(&amp;vm, ASCIILiteral(&quot;registryEntry&quot;)), jsUndefined());

</span><span class="cx">     putDirect(vm, Identifier::fromString(&amp;vm, ASCIILiteral(&quot;evaluated&quot;)), jsBoolean(false));

</span><span class="cx"> 

</span></span></pre></div>

<a id="trunkSourceJavaScriptCoreruntimeArrayBuffercpp"></a>

<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/ArrayBuffer.cpp (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/JavaScriptCore/runtime/ArrayBuffer.cpp        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/JavaScriptCore/runtime/ArrayBuffer.cpp        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -284,7 +284,7 @@

</span><span class="cx">     makeShared();

</span><span class="cx"> }

</span><span class="cx"> 

</span><del>-bool ArrayBuffer::transferTo(ArrayBufferContents&amp; result)

</del><ins>+bool ArrayBuffer::transferTo(VM&amp; vm, ArrayBufferContents&amp; result)

</ins><span class="cx"> {

</span><span class="cx">     Ref&lt;ArrayBuffer&gt; protect(*this);

</span><span class="cx"> 

</span><span class="lines">@@ -310,9 +310,9 @@

</span><span class="cx">     m_contents.transferTo(result);

</span><span class="cx">     for (size_t i = numberOfIncomingReferences(); i--;) {

</span><span class="cx">         JSCell* cell = incomingReferenceAt(i);

</span><del>-        if (JSArrayBufferView* view = jsDynamicCast&lt;JSArrayBufferView*&gt;(cell))

</del><ins>+        if (JSArrayBufferView* view = jsDynamicCast&lt;JSArrayBufferView*&gt;(vm, cell))

</ins><span class="cx">             view-&gt;neuter();

</span><del>-        else if (ArrayBufferNeuteringWatchpoint* watchpoint = jsDynamicCast&lt;ArrayBufferNeuteringWatchpoint*&gt;(cell))

</del><ins>+        else if (ArrayBufferNeuteringWatchpoint* watchpoint = jsDynamicCast&lt;ArrayBufferNeuteringWatchpoint*&gt;(vm, cell))

</ins><span class="cx">             watchpoint-&gt;fireAll();

</span><span class="cx">     }

</span><span class="cx">     return true;

</span></span></pre></div>

<a id="trunkSourceJavaScriptCoreruntimeArrayBufferh"></a>

<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/ArrayBuffer.h (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/JavaScriptCore/runtime/ArrayBuffer.h        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/JavaScriptCore/runtime/ArrayBuffer.h        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -34,6 +34,7 @@

</span><span class="cx"> 

</span><span class="cx"> namespace JSC {

</span><span class="cx"> 

</span><ins>+class VM;

</ins><span class="cx"> class ArrayBuffer;

</span><span class="cx"> class ArrayBufferView;

</span><span class="cx"> class JSArrayBuffer;

</span><span class="lines">@@ -129,7 +130,7 @@

</span><span class="cx">     inline void unpin();

</span><span class="cx">     inline void pinAndLock();

</span><span class="cx"> 

</span><del>-    JS_EXPORT_PRIVATE bool transferTo(ArrayBufferContents&amp;);

</del><ins>+    JS_EXPORT_PRIVATE bool transferTo(VM&amp;, ArrayBufferContents&amp;);

</ins><span class="cx">     bool isNeutered() { return !m_contents.m_data; }

</span><span class="cx">     

</span><span class="cx">     static ptrdiff_t offsetOfData() { return OBJECT_OFFSETOF(ArrayBuffer, m_contents) + OBJECT_OFFSETOF(ArrayBufferContents, m_data); }

</span></span></pre></div>

<a id="trunkSourceJavaScriptCoreruntimeArrayConstructorcpp"></a>

<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/ArrayConstructor.cpp (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/JavaScriptCore/runtime/ArrayConstructor.cpp        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/JavaScriptCore/runtime/ArrayConstructor.cpp        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -57,7 +57,7 @@

</span><span class="cx"> 

</span><span class="cx"> void ArrayConstructor::finishCreation(VM&amp; vm, JSGlobalObject* globalObject, ArrayPrototype* arrayPrototype, GetterSetter* speciesSymbol)

</span><span class="cx"> {

</span><del>-    Base::finishCreation(vm, arrayPrototype-&gt;classInfo()-&gt;className);

</del><ins>+    Base::finishCreation(vm, arrayPrototype-&gt;classInfo(vm)-&gt;className);

</ins><span class="cx">     putDirectWithoutTransition(vm, vm.propertyNames-&gt;prototype, arrayPrototype, DontEnum | DontDelete | ReadOnly);

</span><span class="cx">     putDirectWithoutTransition(vm, vm.propertyNames-&gt;length, jsNumber(1), ReadOnly | DontEnum | DontDelete);

</span><span class="cx">     putDirectNonIndexAccessor(vm, vm.propertyNames-&gt;speciesSymbol, speciesSymbol, Accessor | ReadOnly | DontEnum);

</span><span class="lines">@@ -152,13 +152,14 @@

</span><span class="cx"> // https://tc39.github.io/ecma262/#sec-isarray

</span><span class="cx"> EncodedJSValue JSC_HOST_CALL arrayConstructorPrivateFuncIsArraySlow(ExecState* exec)

</span><span class="cx"> {

</span><del>-    ASSERT(jsDynamicCast&lt;ProxyObject*&gt;(exec-&gt;argument(0)));

</del><ins>+    ASSERT(jsDynamicCast&lt;ProxyObject*&gt;(exec-&gt;vm(), exec-&gt;argument(0)));

</ins><span class="cx">     return JSValue::encode(jsBoolean(isArraySlowInline(exec, jsCast&lt;ProxyObject*&gt;(exec-&gt;uncheckedArgument(0)))));

</span><span class="cx"> }

</span><span class="cx"> 

</span><span class="cx"> EncodedJSValue JSC_HOST_CALL arrayConstructorPrivateFuncIsArrayConstructor(ExecState* exec)

</span><span class="cx"> {

</span><del>-    return JSValue::encode(jsBoolean(jsDynamicCast&lt;ArrayConstructor*&gt;(exec-&gt;uncheckedArgument(0))));

</del><ins>+    VM&amp; vm = exec-&gt;vm();

+    return JSValue::encode(jsBoolean(jsDynamicCast&lt;ArrayConstructor*&gt;(vm, exec-&gt;uncheckedArgument(0))));

</ins><span class="cx"> }

</span><span class="cx"> 

</span><span class="cx"> } // namespace JSC

</span></span></pre></div>

<a id="trunkSourceJavaScriptCoreruntimeArrayConstructorh"></a>

<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/ArrayConstructor.h (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/JavaScriptCore/runtime/ArrayConstructor.h        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/JavaScriptCore/runtime/ArrayConstructor.h        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -82,12 +82,4 @@

</span><span class="cx">     return isArraySlow(exec, jsCast&lt;ProxyObject*&gt;(argument));

</span><span class="cx"> }

</span><span class="cx"> 

</span><del>-inline bool isArrayConstructor(JSValue argumentValue)

-{

-    if (!argumentValue.isObject())

-        return false;

-

-    return jsCast&lt;JSObject*&gt;(argumentValue)-&gt;classInfo() == ArrayConstructor::info();

-}

-

</del><span class="cx"> } // namespace JSC

</span></span></pre></div>

<a id="trunkSourceJavaScriptCoreruntimeArrayIteratorPrototypecpp"></a>

<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/ArrayIteratorPrototype.cpp (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/JavaScriptCore/runtime/ArrayIteratorPrototype.cpp        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/JavaScriptCore/runtime/ArrayIteratorPrototype.cpp        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -48,7 +48,7 @@

</span><span class="cx"> void ArrayIteratorPrototype::finishCreation(VM&amp; vm, JSGlobalObject*)

</span><span class="cx"> {

</span><span class="cx">     Base::finishCreation(vm);

</span><del>-    ASSERT(inherits(info()));

</del><ins>+    ASSERT(inherits(vm, info()));

</ins><span class="cx">     putDirectWithoutTransition(vm, vm.propertyNames-&gt;toStringTagSymbol, jsString(&amp;vm, &quot;Array Iterator&quot;), DontEnum | ReadOnly);

</span><span class="cx">     vm.prototypeMap.addPrototype(this);

</span><span class="cx"> }

</span></span></pre></div>

<a id="trunkSourceJavaScriptCoreruntimeArrayPrototypecpp"></a>

<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/ArrayPrototype.cpp (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/JavaScriptCore/runtime/ArrayPrototype.cpp        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/JavaScriptCore/runtime/ArrayPrototype.cpp        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -81,7 +81,7 @@

</span><span class="cx"> void ArrayPrototype::finishCreation(VM&amp; vm, JSGlobalObject* globalObject)

</span><span class="cx"> {

</span><span class="cx">     Base::finishCreation(vm);

</span><del>-    ASSERT(inherits(info()));

</del><ins>+    ASSERT(inherits(vm, info()));

</ins><span class="cx">     vm.prototypeMap.addPrototype(this);

</span><span class="cx"> 

</span><span class="cx">     putDirectWithoutTransition(vm, vm.propertyNames-&gt;toString, globalObject-&gt;arrayProtoToStringFunction(), DontEnum);

</span></span></pre></div>

<a id="trunkSourceJavaScriptCoreruntimeAsyncFunctionPrototypecpp"></a>

<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/AsyncFunctionPrototype.cpp (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/JavaScriptCore/runtime/AsyncFunctionPrototype.cpp        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/JavaScriptCore/runtime/AsyncFunctionPrototype.cpp        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -48,7 +48,7 @@

</span><span class="cx"> void AsyncFunctionPrototype::finishCreation(VM&amp; vm)

</span><span class="cx"> {

</span><span class="cx">     Base::finishCreation(vm);

</span><del>-    ASSERT(inherits(info()));

</del><ins>+    ASSERT(inherits(vm, info()));

</ins><span class="cx">     putDirectWithoutTransition(vm, vm.propertyNames-&gt;length, jsNumber(0), DontDelete | ReadOnly | DontEnum);

</span><span class="cx">     putDirectWithoutTransition(vm, vm.propertyNames-&gt;toStringTagSymbol, jsString(&amp;vm, &quot;AsyncFunction&quot;), DontEnum | ReadOnly);

</span><span class="cx">     vm.prototypeMap.addPrototype(this);

</span></span></pre></div>

<a id="trunkSourceJavaScriptCoreruntimeAtomicsObjectcpp"></a>

<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/AtomicsObject.cpp (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/JavaScriptCore/runtime/AtomicsObject.cpp        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/JavaScriptCore/runtime/AtomicsObject.cpp        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -77,7 +77,7 @@

</span><span class="cx"> void AtomicsObject::finishCreation(VM&amp; vm, JSGlobalObject* globalObject)

</span><span class="cx"> {

</span><span class="cx">     Base::finishCreation(vm);

</span><del>-    ASSERT(inherits(info()));

</del><ins>+    ASSERT(inherits(vm, info()));

</ins><span class="cx">     

</span><span class="cx"> #define PUT_DIRECT_NATIVE_FUNC(lowerName, upperName, count) \

</span><span class="cx">     putDirectNativeFunctionWithoutTransition(vm, globalObject, Identifier::fromString(&amp;vm, #lowerName), count, atomicsFunc ## upperName, Atomics ## upperName ## Intrinsic, DontEnum);

</span><span class="lines">@@ -287,7 +287,7 @@

</span><span class="cx">     VM&amp; vm = exec-&gt;vm();

</span><span class="cx">     auto scope = DECLARE_THROW_SCOPE(vm);

</span><span class="cx">     

</span><del>-    JSInt32Array* typedArray = jsDynamicCast&lt;JSInt32Array*&gt;(exec-&gt;argument(0));

</del><ins>+    JSInt32Array* typedArray = jsDynamicCast&lt;JSInt32Array*&gt;(vm, exec-&gt;argument(0));

</ins><span class="cx">     if (!typedArray) {

</span><span class="cx">         throwTypeError(exec, scope, ASCIILiteral(&quot;Typed array for wait/wake must be an Int32Array.&quot;));

</span><span class="cx">         return JSValue::encode(jsUndefined());

</span><span class="lines">@@ -357,7 +357,7 @@

</span><span class="cx">     VM&amp; vm = exec-&gt;vm();

</span><span class="cx">     auto scope = DECLARE_THROW_SCOPE(vm);

</span><span class="cx">     

</span><del>-    JSInt32Array* typedArray = jsDynamicCast&lt;JSInt32Array*&gt;(exec-&gt;argument(0));

</del><ins>+    JSInt32Array* typedArray = jsDynamicCast&lt;JSInt32Array*&gt;(vm, exec-&gt;argument(0));

</ins><span class="cx">     if (!typedArray) {

</span><span class="cx">         throwTypeError(exec, scope, ASCIILiteral(&quot;Typed array for wait/wake must be an Int32Array.&quot;));

</span><span class="cx">         return JSValue::encode(jsUndefined());

</span></span></pre></div>

<a id="trunkSourceJavaScriptCoreruntimeBooleanObjectcpp"></a>

<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/BooleanObject.cpp (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/JavaScriptCore/runtime/BooleanObject.cpp        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/JavaScriptCore/runtime/BooleanObject.cpp        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -38,7 +38,7 @@

</span><span class="cx"> void BooleanObject::finishCreation(VM&amp; vm)

</span><span class="cx"> {

</span><span class="cx">     Base::finishCreation(vm);

</span><del>-    ASSERT(inherits(info()));

</del><ins>+    ASSERT(inherits(vm, info()));

</ins><span class="cx"> }

</span><span class="cx"> 

</span><span class="cx"> } // namespace JSC

</span></span></pre></div>

<a id="trunkSourceJavaScriptCoreruntimeBooleanObjecth"></a>

<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/BooleanObject.h (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/JavaScriptCore/runtime/BooleanObject.h        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/JavaScriptCore/runtime/BooleanObject.h        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -51,7 +51,7 @@

</span><span class="cx"> 

</span><span class="cx"> inline BooleanObject* asBooleanObject(JSValue value)

</span><span class="cx"> {

</span><del>-    ASSERT(asObject(value)-&gt;inherits(BooleanObject::info()));

</del><ins>+    ASSERT(asObject(value)-&gt;inherits(*value.getObject()-&gt;vm(), BooleanObject::info()));

</ins><span class="cx">     return static_cast&lt;BooleanObject*&gt;(asObject(value));

</span><span class="cx"> }

</span><span class="cx"> 

</span></span></pre></div>

<a id="trunkSourceJavaScriptCoreruntimeBooleanPrototypecpp"></a>

<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/BooleanPrototype.cpp (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/JavaScriptCore/runtime/BooleanPrototype.cpp        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/JavaScriptCore/runtime/BooleanPrototype.cpp        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -60,7 +60,7 @@

</span><span class="cx">     Base::finishCreation(vm);

</span><span class="cx">     setInternalValue(vm, jsBoolean(false));

</span><span class="cx"> 

</span><del>-    ASSERT(inherits(info()));

</del><ins>+    ASSERT(inherits(vm, info()));

</ins><span class="cx"> }

</span><span class="cx"> 

</span><span class="cx"> // ------------------------------ Functions ---------------------------

</span><span class="lines">@@ -67,33 +67,34 @@

</span><span class="cx"> 

</span><span class="cx"> EncodedJSValue JSC_HOST_CALL booleanProtoFuncToString(ExecState* exec)

</span><span class="cx"> {

</span><del>-    VM* vm = &amp;exec-&gt;vm();

-    auto scope = DECLARE_THROW_SCOPE(*vm);

</del><ins>+    VM&amp; vm = exec-&gt;vm();

+    auto scope = DECLARE_THROW_SCOPE(vm);

</ins><span class="cx">     JSValue thisValue = exec-&gt;thisValue();

</span><span class="cx">     if (thisValue == jsBoolean(false))

</span><del>-        return JSValue::encode(vm-&gt;smallStrings.falseString());

</del><ins>+        return JSValue::encode(vm.smallStrings.falseString());

</ins><span class="cx"> 

</span><span class="cx">     if (thisValue == jsBoolean(true))

</span><del>-        return JSValue::encode(vm-&gt;smallStrings.trueString());

</del><ins>+        return JSValue::encode(vm.smallStrings.trueString());

</ins><span class="cx"> 

</span><del>-    if (!thisValue.inherits(BooleanObject::info()))

</del><ins>+    if (!thisValue.inherits(vm, BooleanObject::info()))

</ins><span class="cx">         return throwVMTypeError(exec, scope);

</span><span class="cx"> 

</span><span class="cx">     if (asBooleanObject(thisValue)-&gt;internalValue() == jsBoolean(false))

</span><del>-        return JSValue::encode(vm-&gt;smallStrings.falseString());

</del><ins>+        return JSValue::encode(vm.smallStrings.falseString());

</ins><span class="cx"> 

</span><span class="cx">     ASSERT(asBooleanObject(thisValue)-&gt;internalValue() == jsBoolean(true));

</span><del>-    return JSValue::encode(vm-&gt;smallStrings.trueString());

</del><ins>+    return JSValue::encode(vm.smallStrings.trueString());

</ins><span class="cx"> }

</span><span class="cx"> 

</span><span class="cx"> EncodedJSValue JSC_HOST_CALL booleanProtoFuncValueOf(ExecState* exec)

</span><span class="cx"> {

</span><del>-    auto scope = DECLARE_THROW_SCOPE(exec-&gt;vm());

</del><ins>+    VM&amp; vm = exec-&gt;vm();

+    auto scope = DECLARE_THROW_SCOPE(vm);

</ins><span class="cx">     JSValue thisValue = exec-&gt;thisValue();

</span><span class="cx">     if (thisValue.isBoolean())

</span><span class="cx">         return JSValue::encode(thisValue);

</span><span class="cx"> 

</span><del>-    if (!thisValue.inherits(BooleanObject::info()))

</del><ins>+    if (!thisValue.inherits(vm, BooleanObject::info()))

</ins><span class="cx">         return throwVMTypeError(exec, scope);

</span><span class="cx"> 

</span><span class="cx">     return JSValue::encode(asBooleanObject(thisValue)-&gt;internalValue());

</span></span></pre></div>

<a id="trunkSourceJavaScriptCoreruntimeConsoleObjectcpp"></a>

<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/ConsoleObject.cpp (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/JavaScriptCore/runtime/ConsoleObject.cpp        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/JavaScriptCore/runtime/ConsoleObject.cpp        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -68,7 +68,7 @@

</span><span class="cx"> void ConsoleObject::finishCreation(VM&amp; vm, JSGlobalObject* globalObject)

</span><span class="cx"> {

</span><span class="cx">     Base::finishCreation(vm);

</span><del>-    ASSERT(inherits(info()));

</del><ins>+    ASSERT(inherits(vm, info()));

</ins><span class="cx"> 

</span><span class="cx">     // For legacy reasons, console properties are enumerable, writable, deleteable,

<span class="cx">     // and all have a length of 0. This may change if Console is standardized.

</span></span></pre></div>

<a id="trunkSourceJavaScriptCoreruntimeDateConstructorcpp"></a>

<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/DateConstructor.cpp (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/JavaScriptCore/runtime/DateConstructor.cpp        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/JavaScriptCore/runtime/DateConstructor.cpp        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -154,7 +154,7 @@

</span><span class="cx">     if (numArgs == 0) // new Date() ECMA 15.9.3.3

</span><span class="cx">         value = NORMAL_OR_DETERMINISTIC_FUNCTION(jsCurrentTime(), deterministicCurrentTime(globalObject));

</span><span class="cx">     else if (numArgs == 1) {

</span><del>-        if (args.at(0).inherits(DateInstance::info()))

</del><ins>+        if (args.at(0).inherits(vm, DateInstance::info()))

</ins><span class="cx">             value = asDateInstance(args.at(0))-&gt;internalNumber();

</span><span class="cx">         else {

</span><span class="cx">             JSValue primitive = args.at(0).toPrimitive(exec);

</span></span></pre></div>

<a id="trunkSourceJavaScriptCoreruntimeDateInstancecpp"></a>

<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/DateInstance.cpp (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/JavaScriptCore/runtime/DateInstance.cpp        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/JavaScriptCore/runtime/DateInstance.cpp        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -42,7 +42,7 @@

</span><span class="cx"> void DateInstance::finishCreation(VM&amp; vm)

</span><span class="cx"> {

</span><span class="cx">     Base::finishCreation(vm);

</span><del>-    ASSERT(inherits(info()));

</del><ins>+    ASSERT(inherits(vm, info()));

</ins><span class="cx">     setInternalValue(vm, jsNaN());

</span><span class="cx"> }

</span><span class="cx"> 

</span><span class="lines">@@ -49,7 +49,7 @@

</span><span class="cx"> void DateInstance::finishCreation(VM&amp; vm, double time)

</span><span class="cx"> {

</span><span class="cx">     Base::finishCreation(vm);

</span><del>-    ASSERT(inherits(info()));

</del><ins>+    ASSERT(inherits(vm, info()));

</ins><span class="cx">     setInternalValue(vm, jsNumber(timeClip(time)));

</span><span class="cx"> }

</span><span class="cx"> 

</span></span></pre></div>

<a id="trunkSourceJavaScriptCoreruntimeDateInstanceh"></a>

<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/DateInstance.h (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/JavaScriptCore/runtime/DateInstance.h        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/JavaScriptCore/runtime/DateInstance.h        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -83,7 +83,7 @@

</span><span class="cx"> 

</span><span class="cx"> inline DateInstance* asDateInstance(JSValue value)

</span><span class="cx"> {

</span><del>-    ASSERT(asObject(value)-&gt;inherits(DateInstance::info()));

</del><ins>+    ASSERT(asObject(value)-&gt;inherits(*value.getObject()-&gt;vm(), DateInstance::info()));

</ins><span class="cx">     return static_cast&lt;DateInstance*&gt;(asObject(value));

</span><span class="cx"> }

</span><span class="cx"> 

</span></span></pre></div>

<a id="trunkSourceJavaScriptCoreruntimeDatePrototypecpp"></a>

<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/DatePrototype.cpp (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/JavaScriptCore/runtime/DatePrototype.cpp        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/JavaScriptCore/runtime/DatePrototype.cpp        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -320,9 +320,10 @@

</span><span class="cx"> 

</span><span class="cx"> static EncodedJSValue formateDateInstance(ExecState* exec, DateTimeFormat format, bool asUTCVariant)

</span><span class="cx"> {

</span><del>-    auto scope = DECLARE_THROW_SCOPE(exec-&gt;vm());

</del><ins>+    VM&amp; vm = exec-&gt;vm();

+    auto scope = DECLARE_THROW_SCOPE(vm);

</ins><span class="cx">     JSValue thisValue = exec-&gt;thisValue();

</span><del>-    if (!thisValue.inherits(DateInstance::info()))

</del><ins>+    if (!thisValue.inherits(vm, DateInstance::info()))

</ins><span class="cx">         return throwVMTypeError(exec, scope);

</span><span class="cx"> 

</span><span class="cx">     DateInstance* thisDateObj = asDateInstance(thisValue);

</span><span class="lines">@@ -488,7 +489,7 @@

</span><span class="cx"> void DatePrototype::finishCreation(VM&amp; vm, JSGlobalObject* globalObject)

</span><span class="cx"> {

</span><span class="cx">     Base::finishCreation(vm);

</span><del>-    ASSERT(inherits(info()));

</del><ins>+    ASSERT(inherits(vm, info()));

</ins><span class="cx"> 

</span><span class="cx">     Identifier toUTCStringName = Identifier::fromString(&amp;vm, ASCIILiteral(&quot;toUTCString&quot;));

</span><span class="cx">     JSFunction* toUTCStringFunction = JSFunction::create(vm, globalObject, 0, toUTCStringName.string(), dateProtoFuncToUTCString);

</span><span class="lines">@@ -523,9 +524,10 @@

</span><span class="cx"> 

</span><span class="cx"> EncodedJSValue JSC_HOST_CALL dateProtoFuncToISOString(ExecState* exec)

</span><span class="cx"> {

</span><del>-    auto scope = DECLARE_THROW_SCOPE(exec-&gt;vm());

</del><ins>+    VM&amp; vm = exec-&gt;vm();

+    auto scope = DECLARE_THROW_SCOPE(vm);

</ins><span class="cx">     JSValue thisValue = exec-&gt;thisValue();

</span><del>-    if (!thisValue.inherits(DateInstance::info()))

</del><ins>+    if (!thisValue.inherits(vm, DateInstance::info()))

</ins><span class="cx">         return throwVMTypeError(exec, scope);

</span><span class="cx">     

</span><span class="cx">     DateInstance* thisDateObj = asDateInstance(thisValue); 

</span><span class="lines">@@ -570,9 +572,10 @@

</span><span class="cx"> 

</span><span class="cx"> EncodedJSValue JSC_HOST_CALL dateProtoFuncToLocaleString(ExecState* exec)

</span><span class="cx"> {

</span><del>-    auto scope = DECLARE_THROW_SCOPE(exec-&gt;vm());

</del><ins>+    VM&amp; vm = exec-&gt;vm();

+    auto scope = DECLARE_THROW_SCOPE(vm);

</ins><span class="cx">     JSValue thisValue = exec-&gt;thisValue();

</span><del>-    if (!thisValue.inherits(DateInstance::info()))

</del><ins>+    if (!thisValue.inherits(vm, DateInstance::info()))

</ins><span class="cx">         return throwVMTypeError(exec, scope);

</span><span class="cx"> 

</span><span class="cx">     DateInstance* thisDateObj = asDateInstance(thisValue); 

</span><span class="lines">@@ -581,9 +584,10 @@

</span><span class="cx"> 

</span><span class="cx"> EncodedJSValue JSC_HOST_CALL dateProtoFuncToLocaleDateString(ExecState* exec)

</span><span class="cx"> {

</span><del>-    auto scope = DECLARE_THROW_SCOPE(exec-&gt;vm());

</del><ins>+    VM&amp; vm = exec-&gt;vm();

+    auto scope = DECLARE_THROW_SCOPE(vm);

</ins><span class="cx">     JSValue thisValue = exec-&gt;thisValue();

</span><del>-    if (!thisValue.inherits(DateInstance::info()))

</del><ins>+    if (!thisValue.inherits(vm, DateInstance::info()))

</ins><span class="cx">         return throwVMTypeError(exec, scope);

</span><span class="cx"> 

</span><span class="cx">     DateInstance* thisDateObj = asDateInstance(thisValue); 

</span><span class="lines">@@ -592,9 +596,10 @@

</span><span class="cx"> 

</span><span class="cx"> EncodedJSValue JSC_HOST_CALL dateProtoFuncToLocaleTimeString(ExecState* exec)

</span><span class="cx"> {

</span><del>-    auto scope = DECLARE_THROW_SCOPE(exec-&gt;vm());

</del><ins>+    VM&amp; vm = exec-&gt;vm();

+    auto scope = DECLARE_THROW_SCOPE(vm);

</ins><span class="cx">     JSValue thisValue = exec-&gt;thisValue();

</span><del>-    if (!thisValue.inherits(DateInstance::info()))

</del><ins>+    if (!thisValue.inherits(vm, DateInstance::info()))

</ins><span class="cx">         return throwVMTypeError(exec, scope);

</span><span class="cx"> 

</span><span class="cx">     DateInstance* thisDateObj = asDateInstance(thisValue); 

</span><span class="lines">@@ -626,9 +631,10 @@

</span><span class="cx"> 

</span><span class="cx"> EncodedJSValue JSC_HOST_CALL dateProtoFuncGetTime(ExecState* exec)

</span><span class="cx"> {

</span><del>-    auto scope = DECLARE_THROW_SCOPE(exec-&gt;vm());

</del><ins>+    VM&amp; vm = exec-&gt;vm();

+    auto scope = DECLARE_THROW_SCOPE(vm);

</ins><span class="cx">     JSValue thisValue = exec-&gt;thisValue();

</span><del>-    if (!thisValue.inherits(DateInstance::info()))

</del><ins>+    if (!thisValue.inherits(vm, DateInstance::info()))

</ins><span class="cx">         return throwVMTypeError(exec, scope);

</span><span class="cx"> 

</span><span class="cx">     return JSValue::encode(asDateInstance(thisValue)-&gt;internalValue());

</span><span class="lines">@@ -636,9 +642,10 @@

</span><span class="cx"> 

</span><span class="cx"> EncodedJSValue JSC_HOST_CALL dateProtoFuncGetFullYear(ExecState* exec)

</span><span class="cx"> {

</span><del>-    auto scope = DECLARE_THROW_SCOPE(exec-&gt;vm());

</del><ins>+    VM&amp; vm = exec-&gt;vm();

+    auto scope = DECLARE_THROW_SCOPE(vm);

</ins><span class="cx">     JSValue thisValue = exec-&gt;thisValue();

</span><del>-    if (!thisValue.inherits(DateInstance::info()))

</del><ins>+    if (!thisValue.inherits(vm, DateInstance::info()))

</ins><span class="cx">         return throwVMTypeError(exec, scope);

</span><span class="cx"> 

</span><span class="cx">     DateInstance* thisDateObj = asDateInstance(thisValue); 

</span><span class="lines">@@ -651,9 +658,10 @@

</span><span class="cx"> 

</span><span class="cx"> EncodedJSValue JSC_HOST_CALL dateProtoFuncGetUTCFullYear(ExecState* exec)

</span><span class="cx"> {

</span><del>-    auto scope = DECLARE_THROW_SCOPE(exec-&gt;vm());

</del><ins>+    VM&amp; vm = exec-&gt;vm();

+    auto scope = DECLARE_THROW_SCOPE(vm);

</ins><span class="cx">     JSValue thisValue = exec-&gt;thisValue();

</span><del>-    if (!thisValue.inherits(DateInstance::info()))

</del><ins>+    if (!thisValue.inherits(vm, DateInstance::info()))

</ins><span class="cx">         return throwVMTypeError(exec, scope);

</span><span class="cx"> 

</span><span class="cx">     DateInstance* thisDateObj = asDateInstance(thisValue); 

</span><span class="lines">@@ -666,9 +674,10 @@

</span><span class="cx"> 

</span><span class="cx"> EncodedJSValue JSC_HOST_CALL dateProtoFuncGetMonth(ExecState* exec)

</span><span class="cx"> {

</span><del>-    auto scope = DECLARE_THROW_SCOPE(exec-&gt;vm());

</del><ins>+    VM&amp; vm = exec-&gt;vm();

+    auto scope = DECLARE_THROW_SCOPE(vm);

</ins><span class="cx">     JSValue thisValue = exec-&gt;thisValue();

</span><del>-    if (!thisValue.inherits(DateInstance::info()))

</del><ins>+    if (!thisValue.inherits(vm, DateInstance::info()))

</ins><span class="cx">         return throwVMTypeError(exec, scope);

</span><span class="cx"> 

</span><span class="cx">     DateInstance* thisDateObj = asDateInstance(thisValue); 

</span><span class="lines">@@ -681,9 +690,10 @@

</span><span class="cx"> 

</span><span class="cx"> EncodedJSValue JSC_HOST_CALL dateProtoFuncGetUTCMonth(ExecState* exec)

</span><span class="cx"> {

</span><del>-    auto scope = DECLARE_THROW_SCOPE(exec-&gt;vm());

</del><ins>+    VM&amp; vm = exec-&gt;vm();

+    auto scope = DECLARE_THROW_SCOPE(vm);

</ins><span class="cx">     JSValue thisValue = exec-&gt;thisValue();

</span><del>-    if (!thisValue.inherits(DateInstance::info()))

</del><ins>+    if (!thisValue.inherits(vm, DateInstance::info()))

</ins><span class="cx">         return throwVMTypeError(exec, scope);

</span><span class="cx"> 

</span><span class="cx">     DateInstance* thisDateObj = asDateInstance(thisValue); 

</span><span class="lines">@@ -696,9 +706,10 @@

</span><span class="cx"> 

</span><span class="cx"> EncodedJSValue JSC_HOST_CALL dateProtoFuncGetDate(ExecState* exec)

</span><span class="cx"> {

</span><del>-    auto scope = DECLARE_THROW_SCOPE(exec-&gt;vm());

</del><ins>+    VM&amp; vm = exec-&gt;vm();

+    auto scope = DECLARE_THROW_SCOPE(vm);

</ins><span class="cx">     JSValue thisValue = exec-&gt;thisValue();

</span><del>-    if (!thisValue.inherits(DateInstance::info()))

</del><ins>+    if (!thisValue.inherits(vm, DateInstance::info()))

</ins><span class="cx">         return throwVMTypeError(exec, scope);

</span><span class="cx"> 

</span><span class="cx">     DateInstance* thisDateObj = asDateInstance(thisValue); 

</span><span class="lines">@@ -711,9 +722,10 @@

</span><span class="cx"> 

</span><span class="cx"> EncodedJSValue JSC_HOST_CALL dateProtoFuncGetUTCDate(ExecState* exec)

</span><span class="cx"> {

</span><del>-    auto scope = DECLARE_THROW_SCOPE(exec-&gt;vm());

</del><ins>+    VM&amp; vm = exec-&gt;vm();

+    auto scope = DECLARE_THROW_SCOPE(vm);

</ins><span class="cx">     JSValue thisValue = exec-&gt;thisValue();

</span><del>-    if (!thisValue.inherits(DateInstance::info()))

</del><ins>+    if (!thisValue.inherits(vm, DateInstance::info()))

</ins><span class="cx">         return throwVMTypeError(exec, scope);

</span><span class="cx"> 

</span><span class="cx">     DateInstance* thisDateObj = asDateInstance(thisValue); 

</span><span class="lines">@@ -726,9 +738,10 @@

</span><span class="cx"> 

</span><span class="cx"> EncodedJSValue JSC_HOST_CALL dateProtoFuncGetDay(ExecState* exec)

</span><span class="cx"> {

</span><del>-    auto scope = DECLARE_THROW_SCOPE(exec-&gt;vm());

</del><ins>+    VM&amp; vm = exec-&gt;vm();

+    auto scope = DECLARE_THROW_SCOPE(vm);

</ins><span class="cx">     JSValue thisValue = exec-&gt;thisValue();

</span><del>-    if (!thisValue.inherits(DateInstance::info()))

</del><ins>+    if (!thisValue.inherits(vm, DateInstance::info()))

</ins><span class="cx">         return throwVMTypeError(exec, scope);

</span><span class="cx"> 

</span><span class="cx">     DateInstance* thisDateObj = asDateInstance(thisValue); 

</span><span class="lines">@@ -741,9 +754,10 @@

</span><span class="cx"> 

</span><span class="cx"> EncodedJSValue JSC_HOST_CALL dateProtoFuncGetUTCDay(ExecState* exec)

</span><span class="cx"> {

</span><del>-    auto scope = DECLARE_THROW_SCOPE(exec-&gt;vm());

</del><ins>+    VM&amp; vm = exec-&gt;vm();

+    auto scope = DECLARE_THROW_SCOPE(vm);

</ins><span class="cx">     JSValue thisValue = exec-&gt;thisValue();

</span><del>-    if (!thisValue.inherits(DateInstance::info()))

</del><ins>+    if (!thisValue.inherits(vm, DateInstance::info()))

</ins><span class="cx">         return throwVMTypeError(exec, scope);

</span><span class="cx"> 

</span><span class="cx">     DateInstance* thisDateObj = asDateInstance(thisValue); 

</span><span class="lines">@@ -756,9 +770,10 @@

</span><span class="cx"> 

</span><span class="cx"> EncodedJSValue JSC_HOST_CALL dateProtoFuncGetHours(ExecState* exec)

</span><span class="cx"> {

</span><del>-    auto scope = DECLARE_THROW_SCOPE(exec-&gt;vm());

</del><ins>+    VM&amp; vm = exec-&gt;vm();

+    auto scope = DECLARE_THROW_SCOPE(vm);

</ins><span class="cx">     JSValue thisValue = exec-&gt;thisValue();

</span><del>-    if (!thisValue.inherits(DateInstance::info()))

</del><ins>+    if (!thisValue.inherits(vm, DateInstance::info()))

</ins><span class="cx">         return throwVMTypeError(exec, scope);

</span><span class="cx"> 

</span><span class="cx">     DateInstance* thisDateObj = asDateInstance(thisValue); 

</span><span class="lines">@@ -771,9 +786,10 @@

</span><span class="cx"> 

</span><span class="cx"> EncodedJSValue JSC_HOST_CALL dateProtoFuncGetUTCHours(ExecState* exec)

</span><span class="cx"> {

</span><del>-    auto scope = DECLARE_THROW_SCOPE(exec-&gt;vm());

</del><ins>+    VM&amp; vm = exec-&gt;vm();

+    auto scope = DECLARE_THROW_SCOPE(vm);

</ins><span class="cx">     JSValue thisValue = exec-&gt;thisValue();

</span><del>-    if (!thisValue.inherits(DateInstance::info()))

</del><ins>+    if (!thisValue.inherits(vm, DateInstance::info()))

</ins><span class="cx">         return throwVMTypeError(exec, scope);

</span><span class="cx"> 

</span><span class="cx">     DateInstance* thisDateObj = asDateInstance(thisValue); 

</span><span class="lines">@@ -786,9 +802,10 @@

</span><span class="cx"> 

</span><span class="cx"> EncodedJSValue JSC_HOST_CALL dateProtoFuncGetMinutes(ExecState* exec)

</span><span class="cx"> {

</span><del>-    auto scope = DECLARE_THROW_SCOPE(exec-&gt;vm());

</del><ins>+    VM&amp; vm = exec-&gt;vm();

+    auto scope = DECLARE_THROW_SCOPE(vm);

</ins><span class="cx">     JSValue thisValue = exec-&gt;thisValue();

</span><del>-    if (!thisValue.inherits(DateInstance::info()))

</del><ins>+    if (!thisValue.inherits(vm, DateInstance::info()))

</ins><span class="cx">         return throwVMTypeError(exec, scope);

</span><span class="cx"> 

</span><span class="cx">     DateInstance* thisDateObj = asDateInstance(thisValue); 

</span><span class="lines">@@ -801,9 +818,10 @@

</span><span class="cx"> 

</span><span class="cx"> EncodedJSValue JSC_HOST_CALL dateProtoFuncGetUTCMinutes(ExecState* exec)

</span><span class="cx"> {

</span><del>-    auto scope = DECLARE_THROW_SCOPE(exec-&gt;vm());

</del><ins>+    VM&amp; vm = exec-&gt;vm();

+    auto scope = DECLARE_THROW_SCOPE(vm);

</ins><span class="cx">     JSValue thisValue = exec-&gt;thisValue();

</span><del>-    if (!thisValue.inherits(DateInstance::info()))

</del><ins>+    if (!thisValue.inherits(vm, DateInstance::info()))

</ins><span class="cx">         return throwVMTypeError(exec, scope);

</span><span class="cx"> 

</span><span class="cx">     DateInstance* thisDateObj = asDateInstance(thisValue); 

</span><span class="lines">@@ -816,9 +834,10 @@

</span><span class="cx"> 

</span><span class="cx"> EncodedJSValue JSC_HOST_CALL dateProtoFuncGetSeconds(ExecState* exec)

</span><span class="cx"> {

</span><del>-    auto scope = DECLARE_THROW_SCOPE(exec-&gt;vm());

</del><ins>+    VM&amp; vm = exec-&gt;vm();

+    auto scope = DECLARE_THROW_SCOPE(vm);

</ins><span class="cx">     JSValue thisValue = exec-&gt;thisValue();

</span><del>-    if (!thisValue.inherits(DateInstance::info()))

</del><ins>+    if (!thisValue.inherits(vm, DateInstance::info()))

</ins><span class="cx">         return throwVMTypeError(exec, scope);

</span><span class="cx"> 

</span><span class="cx">     DateInstance* thisDateObj = asDateInstance(thisValue); 

</span><span class="lines">@@ -831,9 +850,10 @@

</span><span class="cx"> 

</span><span class="cx"> EncodedJSValue JSC_HOST_CALL dateProtoFuncGetUTCSeconds(ExecState* exec)

</span><span class="cx"> {

</span><del>-    auto scope = DECLARE_THROW_SCOPE(exec-&gt;vm());

</del><ins>+    VM&amp; vm = exec-&gt;vm();

+    auto scope = DECLARE_THROW_SCOPE(vm);

</ins><span class="cx">     JSValue thisValue = exec-&gt;thisValue();

</span><del>-    if (!thisValue.inherits(DateInstance::info()))

</del><ins>+    if (!thisValue.inherits(vm, DateInstance::info()))

</ins><span class="cx">         return throwVMTypeError(exec, scope);

</span><span class="cx"> 

</span><span class="cx">     DateInstance* thisDateObj = asDateInstance(thisValue); 

</span><span class="lines">@@ -846,9 +866,10 @@

</span><span class="cx"> 

</span><span class="cx"> EncodedJSValue JSC_HOST_CALL dateProtoFuncGetMilliSeconds(ExecState* exec)

</span><span class="cx"> {

</span><del>-    auto scope = DECLARE_THROW_SCOPE(exec-&gt;vm());

</del><ins>+    VM&amp; vm = exec-&gt;vm();

+    auto scope = DECLARE_THROW_SCOPE(vm);

</ins><span class="cx">     JSValue thisValue = exec-&gt;thisValue();

</span><del>-    if (!thisValue.inherits(DateInstance::info()))

</del><ins>+    if (!thisValue.inherits(vm, DateInstance::info()))

</ins><span class="cx">         return throwVMTypeError(exec, scope);

</span><span class="cx"> 

</span><span class="cx">     DateInstance* thisDateObj = asDateInstance(thisValue); 

</span><span class="lines">@@ -863,9 +884,10 @@

</span><span class="cx"> 

</span><span class="cx"> EncodedJSValue JSC_HOST_CALL dateProtoFuncGetUTCMilliseconds(ExecState* exec)

</span><span class="cx"> {

</span><del>-    auto scope = DECLARE_THROW_SCOPE(exec-&gt;vm());

</del><ins>+    VM&amp; vm = exec-&gt;vm();

+    auto scope = DECLARE_THROW_SCOPE(vm);

</ins><span class="cx">     JSValue thisValue = exec-&gt;thisValue();

</span><del>-    if (!thisValue.inherits(DateInstance::info()))

</del><ins>+    if (!thisValue.inherits(vm, DateInstance::info()))

</ins><span class="cx">         return throwVMTypeError(exec, scope);

</span><span class="cx"> 

</span><span class="cx">     DateInstance* thisDateObj = asDateInstance(thisValue); 

</span><span class="lines">@@ -880,9 +902,10 @@

</span><span class="cx"> 

</span><span class="cx"> EncodedJSValue JSC_HOST_CALL dateProtoFuncGetTimezoneOffset(ExecState* exec)

</span><span class="cx"> {

</span><del>-    auto scope = DECLARE_THROW_SCOPE(exec-&gt;vm());

</del><ins>+    VM&amp; vm = exec-&gt;vm();

+    auto scope = DECLARE_THROW_SCOPE(vm);

</ins><span class="cx">     JSValue thisValue = exec-&gt;thisValue();

</span><del>-    if (!thisValue.inherits(DateInstance::info()))

</del><ins>+    if (!thisValue.inherits(vm, DateInstance::info()))

</ins><span class="cx">         return throwVMTypeError(exec, scope);

</span><span class="cx"> 

</span><span class="cx">     DateInstance* thisDateObj = asDateInstance(thisValue); 

</span><span class="lines">@@ -895,9 +918,10 @@

</span><span class="cx"> 

</span><span class="cx"> EncodedJSValue JSC_HOST_CALL dateProtoFuncSetTime(ExecState* exec)

</span><span class="cx"> {

</span><del>-    auto scope = DECLARE_THROW_SCOPE(exec-&gt;vm());

</del><ins>+    VM&amp; vm = exec-&gt;vm();

+    auto scope = DECLARE_THROW_SCOPE(vm);

</ins><span class="cx">     JSValue thisValue = exec-&gt;thisValue();

</span><del>-    if (!thisValue.inherits(DateInstance::info()))

</del><ins>+    if (!thisValue.inherits(vm, DateInstance::info()))

</ins><span class="cx">         return throwVMTypeError(exec, scope);

</span><span class="cx"> 

</span><span class="cx">     DateInstance* thisDateObj = asDateInstance(thisValue); 

</span><span class="lines">@@ -904,21 +928,21 @@

</span><span class="cx"> 

</span><span class="cx">     double milli = timeClip(exec-&gt;argument(0).toNumber(exec));

</span><span class="cx">     JSValue result = jsNumber(milli);

</span><del>-    thisDateObj-&gt;setInternalValue(exec-&gt;vm(), result);

</del><ins>+    thisDateObj-&gt;setInternalValue(vm, result);

</ins><span class="cx">     return JSValue::encode(result);

</span><span class="cx"> }

</span><span class="cx"> 

</span><span class="cx"> static EncodedJSValue setNewValueFromTimeArgs(ExecState* exec, int numArgsToUse, WTF::TimeType inputTimeType)

</span><span class="cx"> {

</span><del>-    auto scope = DECLARE_THROW_SCOPE(exec-&gt;vm());

</del><ins>+    VM&amp; vm = exec-&gt;vm();

+    auto scope = DECLARE_THROW_SCOPE(vm);

</ins><span class="cx">     JSValue thisValue = exec-&gt;thisValue();

</span><del>-    if (!thisValue.inherits(DateInstance::info()))

</del><ins>+    if (!thisValue.inherits(vm, DateInstance::info()))

</ins><span class="cx">         return throwVMTypeError(exec, scope);

</span><span class="cx"> 

</span><span class="cx">     DateInstance* thisDateObj = asDateInstance(thisValue);

</span><span class="cx">     double milli = thisDateObj-&gt;internalNumber();

</span><del>-    VM&amp; vm = exec-&gt;vm();

-    

</del><ins>+

</ins><span class="cx">     if (!exec-&gt;argumentCount() || std::isnan(milli)) {

</span><span class="cx">         JSValue result = jsNaN();

</span><span class="cx">         thisDateObj-&gt;setInternalValue(vm, result);

</span><span class="lines">@@ -950,19 +974,19 @@

</span><span class="cx"> 

</span><span class="cx"> static EncodedJSValue setNewValueFromDateArgs(ExecState* exec, int numArgsToUse, WTF::TimeType inputTimeType)

</span><span class="cx"> {

</span><del>-    auto scope = DECLARE_THROW_SCOPE(exec-&gt;vm());

</del><ins>+    VM&amp; vm = exec-&gt;vm();

+    auto scope = DECLARE_THROW_SCOPE(vm);

</ins><span class="cx">     JSValue thisValue = exec-&gt;thisValue();

</span><del>-    if (!thisValue.inherits(DateInstance::info()))

</del><ins>+    if (!thisValue.inherits(vm, DateInstance::info()))

</ins><span class="cx">         return throwVMTypeError(exec, scope);

</span><span class="cx"> 

</span><span class="cx">     DateInstance* thisDateObj = asDateInstance(thisValue);

</span><span class="cx">     if (!exec-&gt;argumentCount()) {

</span><span class="cx">         JSValue result = jsNaN();

</span><del>-        thisDateObj-&gt;setInternalValue(exec-&gt;vm(), result);

</del><ins>+        thisDateObj-&gt;setInternalValue(vm, result);

</ins><span class="cx">         return JSValue::encode(result);

</span><span class="cx">     }

</span><span class="cx"> 

</span><del>-    VM&amp; vm = exec-&gt;vm();

</del><span class="cx">     double milli = thisDateObj-&gt;internalNumber();

</span><span class="cx">     double ms = 0; 

</span><span class="cx"> 

</span><span class="lines">@@ -1063,12 +1087,12 @@

</span><span class="cx"> 

</span><span class="cx"> EncodedJSValue JSC_HOST_CALL dateProtoFuncSetYear(ExecState* exec)

</span><span class="cx"> {

</span><del>-    auto scope = DECLARE_THROW_SCOPE(exec-&gt;vm());

</del><ins>+    VM&amp; vm = exec-&gt;vm();

+    auto scope = DECLARE_THROW_SCOPE(vm);

</ins><span class="cx">     JSValue thisValue = exec-&gt;thisValue();

</span><del>-    if (!thisValue.inherits(DateInstance::info()))

</del><ins>+    if (!thisValue.inherits(vm, DateInstance::info()))

</ins><span class="cx">         return throwVMTypeError(exec, scope);

</span><span class="cx"> 

</span><del>-    VM&amp; vm = exec-&gt;vm();

</del><span class="cx">     DateInstance* thisDateObj = asDateInstance(thisValue);

</span><span class="cx">     if (!exec-&gt;argumentCount()) { 

</span><span class="cx">         JSValue result = jsNaN();

</span><span class="lines">@@ -1107,9 +1131,10 @@

</span><span class="cx"> 

</span><span class="cx"> EncodedJSValue JSC_HOST_CALL dateProtoFuncGetYear(ExecState* exec)

</span><span class="cx"> {

</span><del>-    auto scope = DECLARE_THROW_SCOPE(exec-&gt;vm());

</del><ins>+    VM&amp; vm = exec-&gt;vm();

+    auto scope = DECLARE_THROW_SCOPE(vm);

</ins><span class="cx">     JSValue thisValue = exec-&gt;thisValue();

</span><del>-    if (!thisValue.inherits(DateInstance::info()))

</del><ins>+    if (!thisValue.inherits(vm, DateInstance::info()))

</ins><span class="cx">         return throwVMTypeError(exec, scope);

</span><span class="cx"> 

</span><span class="cx">     DateInstance* thisDateObj = asDateInstance(thisValue); 

</span></span></pre></div>

<a id="trunkSourceJavaScriptCoreruntimeErrorInstancecpp"></a>

<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/ErrorInstance.cpp (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/JavaScriptCore/runtime/ErrorInstance.cpp        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/JavaScriptCore/runtime/ErrorInstance.cpp        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -147,7 +147,7 @@

</span><span class="cx"> void ErrorInstance::finishCreation(ExecState* exec, VM&amp; vm, const String&amp; message, bool useCurrentFrame)

</span><span class="cx"> {

</span><span class="cx">     Base::finishCreation(vm);

</span><del>-    ASSERT(inherits(info()));

</del><ins>+    ASSERT(inherits(vm, info()));

</ins><span class="cx">     if (!message.isNull())

</span><span class="cx">         putDirect(vm, vm.propertyNames-&gt;message, jsString(&amp;vm, message), DontEnum);

</span><span class="cx"> 

</span></span></pre></div>

<a id="trunkSourceJavaScriptCoreruntimeErrorPrototypecpp"></a>

<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/ErrorPrototype.cpp (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/JavaScriptCore/runtime/ErrorPrototype.cpp        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/JavaScriptCore/runtime/ErrorPrototype.cpp        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -57,7 +57,7 @@

</span><span class="cx"> void ErrorPrototype::finishCreation(VM&amp; vm)

</span><span class="cx"> {

</span><span class="cx">     Base::finishCreation(vm);

</span><del>-    ASSERT(inherits(info()));

</del><ins>+    ASSERT(inherits(vm, info()));

</ins><span class="cx">     putDirect(vm, vm.propertyNames-&gt;name, jsNontrivialString(&amp;vm, String(ASCIILiteral(&quot;Error&quot;))), DontEnum);

</span><span class="cx">     putDirect(vm, vm.propertyNames-&gt;message, jsEmptyString(&amp;vm), DontEnum);

</span><span class="cx"> }

</span></span></pre></div>

<a id="trunkSourceJavaScriptCoreruntimeExceptionHelperscpp"></a>

<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/ExceptionHelpers.cpp (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/JavaScriptCore/runtime/ExceptionHelpers.cpp        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/JavaScriptCore/runtime/ExceptionHelpers.cpp        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -59,12 +59,12 @@

</span><span class="cx">     return TerminatedExecutionError::create(*vm);

</span><span class="cx"> }

</span><span class="cx"> 

</span><del>-bool isTerminatedExecutionException(Exception* exception)

</del><ins>+bool isTerminatedExecutionException(VM&amp; vm, Exception* exception)

</ins><span class="cx"> {

</span><span class="cx">     if (!exception-&gt;value().isObject())

</span><span class="cx">         return false;

</span><span class="cx"> 

</span><del>-    return exception-&gt;value().inherits(TerminatedExecutionError::info());

</del><ins>+    return exception-&gt;value().inherits(vm, TerminatedExecutionError::info());

</ins><span class="cx"> }

</span><span class="cx"> 

</span><span class="cx"> JSObject* createStackOverflowError(ExecState* exec)

</span></span></pre></div>

<a id="trunkSourceJavaScriptCoreruntimeExceptionHelpersh"></a>

<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/ExceptionHelpers.h (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/JavaScriptCore/runtime/ExceptionHelpers.h        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/JavaScriptCore/runtime/ExceptionHelpers.h        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -40,7 +40,7 @@

</span><span class="cx"> String defaultSourceAppender(const String&amp;, const String&amp;, RuntimeType, ErrorInstance::SourceTextWhereErrorOccurred);

</span><span class="cx"> 

</span><span class="cx"> JSObject* createTerminatedExecutionException(VM*);

</span><del>-JS_EXPORT_PRIVATE bool isTerminatedExecutionException(Exception*);

</del><ins>+JS_EXPORT_PRIVATE bool isTerminatedExecutionException(VM&amp;, Exception*);

</ins><span class="cx"> JS_EXPORT_PRIVATE JSObject* createError(ExecState*, JSValue, const String&amp;, ErrorInstance::SourceAppender);

</span><span class="cx"> JS_EXPORT_PRIVATE JSObject* createStackOverflowError(ExecState*);

</span><span class="cx"> JSObject* createUndefinedVariableError(ExecState*, const Identifier&amp;);

</span></span></pre></div>

<a id="trunkSourceJavaScriptCoreruntimeExecutableBasecpp"></a>

<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/ExecutableBase.cpp (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/JavaScriptCore/runtime/ExecutableBase.cpp        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/JavaScriptCore/runtime/ExecutableBase.cpp        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -59,8 +59,10 @@

</span><span class="cx"> #endif

</span><span class="cx">     m_numParametersForCall = NUM_PARAMETERS_NOT_COMPILED;

</span><span class="cx">     m_numParametersForConstruct = NUM_PARAMETERS_NOT_COMPILED;

</span><ins>+    VM&amp; vm = *this-&gt;vm();

</ins><span class="cx"> 

</span><del>-    if (structure()-&gt;classInfo() == FunctionExecutable::info()) {

</del><ins>+

+    if (structure(vm)-&gt;classInfo() == FunctionExecutable::info()) {

</ins><span class="cx">         FunctionExecutable* executable = static_cast&lt;FunctionExecutable*&gt;(this);

</span><span class="cx">         executable-&gt;m_codeBlockForCall.clear();

</span><span class="cx">         executable-&gt;m_codeBlockForConstruct.clear();

</span><span class="lines">@@ -67,7 +69,7 @@

</span><span class="cx">         return;

</span><span class="cx">     }

</span><span class="cx"> 

</span><del>-    if (structure()-&gt;classInfo() == EvalExecutable::info()) {

</del><ins>+    if (structure(vm)-&gt;classInfo() == EvalExecutable::info()) {

</ins><span class="cx">         EvalExecutable* executable = static_cast&lt;EvalExecutable*&gt;(this);

</span><span class="cx">         executable-&gt;m_evalCodeBlock.clear();

</span><span class="cx">         executable-&gt;m_unlinkedEvalCodeBlock.clear();

</span><span class="lines">@@ -74,7 +76,7 @@

</span><span class="cx">         return;

</span><span class="cx">     }

</span><span class="cx">     

</span><del>-    if (structure()-&gt;classInfo() == ProgramExecutable::info()) {

</del><ins>+    if (structure(vm)-&gt;classInfo() == ProgramExecutable::info()) {

</ins><span class="cx">         ProgramExecutable* executable = static_cast&lt;ProgramExecutable*&gt;(this);

</span><span class="cx">         executable-&gt;m_programCodeBlock.clear();

</span><span class="cx">         executable-&gt;m_unlinkedProgramCodeBlock.clear();

</span><span class="lines">@@ -81,7 +83,7 @@

</span><span class="cx">         return;

</span><span class="cx">     }

</span><span class="cx"> 

</span><del>-    if (structure()-&gt;classInfo() == ModuleProgramExecutable::info()) {

</del><ins>+    if (structure(vm)-&gt;classInfo() == ModuleProgramExecutable::info()) {

</ins><span class="cx">         ModuleProgramExecutable* executable = static_cast&lt;ModuleProgramExecutable*&gt;(this);

</span><span class="cx">         executable-&gt;m_moduleProgramCodeBlock.clear();

</span><span class="cx">         executable-&gt;m_unlinkedModuleProgramCodeBlock.clear();

</span><span class="lines">@@ -89,20 +91,21 @@

</span><span class="cx">         return;

</span><span class="cx">     }

</span><span class="cx">     

</span><del>-    ASSERT(structure()-&gt;classInfo() == NativeExecutable::info());

</del><ins>+    ASSERT(structure(vm)-&gt;classInfo() == NativeExecutable::info());

</ins><span class="cx"> }

</span><span class="cx"> 

</span><span class="cx"> void ExecutableBase::dump(PrintStream&amp; out) const

</span><span class="cx"> {

</span><ins>+    VM&amp; vm = *this-&gt;vm();

</ins><span class="cx">     ExecutableBase* realThis = const_cast&lt;ExecutableBase*&gt;(this);

</span><del>-    

-    if (classInfo() == NativeExecutable::info()) {

</del><ins>+

+    if (classInfo(vm) == NativeExecutable::info()) {

</ins><span class="cx">         NativeExecutable* native = jsCast&lt;NativeExecutable*&gt;(realThis);

</span><span class="cx">         out.print(&quot;NativeExecutable:&quot;, RawPointer(bitwise_cast&lt;void*&gt;(native-&gt;function())), &quot;/&quot;, RawPointer(bitwise_cast&lt;void*&gt;(native-&gt;constructor())));

</span><span class="cx">         return;

</span><span class="cx">     }

</span><span class="cx">     

</span><del>-    if (classInfo() == EvalExecutable::info()) {

</del><ins>+    if (classInfo(vm) == EvalExecutable::info()) {

</ins><span class="cx">         EvalExecutable* eval = jsCast&lt;EvalExecutable*&gt;(realThis);

</span><span class="cx">         if (CodeBlock* codeBlock = eval-&gt;codeBlock())

</span><span class="cx">             out.print(*codeBlock);

</span><span class="lines">@@ -111,7 +114,7 @@

</span><span class="cx">         return;

</span><span class="cx">     }

</span><span class="cx">     

</span><del>-    if (classInfo() == ProgramExecutable::info()) {

</del><ins>+    if (classInfo(vm) == ProgramExecutable::info()) {

</ins><span class="cx">         ProgramExecutable* eval = jsCast&lt;ProgramExecutable*&gt;(realThis);

</span><span class="cx">         if (CodeBlock* codeBlock = eval-&gt;codeBlock())

</span><span class="cx">             out.print(*codeBlock);

</span><span class="lines">@@ -120,7 +123,7 @@

</span><span class="cx">         return;

</span><span class="cx">     }

</span><span class="cx"> 

</span><del>-    if (classInfo() == ModuleProgramExecutable::info()) {

</del><ins>+    if (classInfo(vm) == ModuleProgramExecutable::info()) {

</ins><span class="cx">         ModuleProgramExecutable* executable = jsCast&lt;ModuleProgramExecutable*&gt;(realThis);

</span><span class="cx">         if (CodeBlock* codeBlock = executable-&gt;codeBlock())

</span><span class="cx">             out.print(*codeBlock);

</span><span class="lines">@@ -143,7 +146,7 @@

</span><span class="cx"> 

</span><span class="cx"> CodeBlockHash ExecutableBase::hashFor(CodeSpecializationKind kind) const

</span><span class="cx"> {

</span><del>-    if (this-&gt;classInfo() == NativeExecutable::info())

</del><ins>+    if (this-&gt;classInfo(*this-&gt;vm()) == NativeExecutable::info())

</ins><span class="cx">         return jsCast&lt;const NativeExecutable*&gt;(this)-&gt;hashFor(kind);

</span><span class="cx">     

</span><span class="cx">     return jsCast&lt;const ScriptExecutable*&gt;(this)-&gt;hashFor(kind);

</span></span></pre></div>

<a id="trunkSourceJavaScriptCoreruntimeFunctionPrototypecpp"></a>

<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/FunctionPrototype.cpp (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/JavaScriptCore/runtime/FunctionPrototype.cpp        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/JavaScriptCore/runtime/FunctionPrototype.cpp        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -93,7 +93,7 @@

</span><span class="cx">     auto scope = DECLARE_THROW_SCOPE(vm);

</span><span class="cx"> 

</span><span class="cx">     JSValue thisValue = exec-&gt;thisValue();

</span><del>-    if (thisValue.inherits(JSFunction::info())) {

</del><ins>+    if (thisValue.inherits(vm, JSFunction::info())) {

</ins><span class="cx">         JSFunction* function = jsCast&lt;JSFunction*&gt;(thisValue);

</span><span class="cx">         if (function-&gt;isHostOrBuiltinFunction()) {

</span><span class="cx">             scope.release();

</span><span class="lines">@@ -106,7 +106,7 @@

</span><span class="cx">             return JSValue::encode(jsString(exec, classSource.toStringWithoutCopying()));

</span><span class="cx">         }

</span><span class="cx"> 

</span><del>-        if (thisValue.inherits(JSAsyncFunction::info())) {

</del><ins>+        if (thisValue.inherits(vm, JSAsyncFunction::info())) {

</ins><span class="cx">             String functionHeader = executable-&gt;isArrowFunction() ? &quot;async &quot; : &quot;async function &quot;;

</span><span class="cx"> 

</span><span class="cx">             StringView source = executable-&gt;source().provider()-&gt;getRange(

</span><span class="lines">@@ -124,7 +124,7 @@

</span><span class="cx">         return JSValue::encode(jsMakeNontrivialString(exec, functionHeader, function-&gt;name(vm), source));

</span><span class="cx">     }

</span><span class="cx"> 

</span><del>-    if (thisValue.inherits(InternalFunction::info())) {

</del><ins>+    if (thisValue.inherits(vm, InternalFunction::info())) {

</ins><span class="cx">         InternalFunction* function = asInternalFunction(thisValue);

</span><span class="cx">         scope.release();

</span><span class="cx">         return JSValue::encode(jsMakeNontrivialString(exec, &quot;function &quot;, function-&gt;name(), &quot;() {\n    [native code]\n}&quot;));

</span><span class="lines">@@ -135,7 +135,7 @@

</span><span class="cx">         if (object-&gt;inlineTypeFlags() &amp; TypeOfShouldCallGetCallData) {

</span><span class="cx">             CallData callData;

</span><span class="cx">             if (object-&gt;methodTable(vm)-&gt;getCallData(object, callData) != CallType::None) {

</span><del>-                if (auto* classInfo = object-&gt;classInfo()) {

</del><ins>+                if (auto* classInfo = object-&gt;classInfo(vm)) {

</ins><span class="cx">                     scope.release();

</span><span class="cx">                     return JSValue::encode(jsMakeNontrivialString(exec, &quot;function &quot;, classInfo-&gt;className, &quot;() {\n    [native code]\n}&quot;));

</span><span class="cx">                 }

</span></span></pre></div>

<a id="trunkSourceJavaScriptCoreruntimeGeneratorFunctionPrototypecpp"></a>

<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/GeneratorFunctionPrototype.cpp (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/JavaScriptCore/runtime/GeneratorFunctionPrototype.cpp        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/JavaScriptCore/runtime/GeneratorFunctionPrototype.cpp        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -50,7 +50,7 @@

</span><span class="cx"> void GeneratorFunctionPrototype::finishCreation(VM&amp; vm)

</span><span class="cx"> {

</span><span class="cx">     Base::finishCreation(vm);

</span><del>-    ASSERT(inherits(info()));

</del><ins>+    ASSERT(inherits(vm, info()));

</ins><span class="cx">     putDirectWithoutTransition(vm, vm.propertyNames-&gt;length, jsNumber(0), ReadOnly | DontEnum);

</span><span class="cx">     putDirectWithoutTransition(vm, vm.propertyNames-&gt;toStringTagSymbol, jsString(&amp;vm, &quot;GeneratorFunction&quot;), DontEnum | ReadOnly);

</span><span class="cx">     vm.prototypeMap.addPrototype(this);

</span></span></pre></div>

<a id="trunkSourceJavaScriptCoreruntimeGeneratorPrototypecpp"></a>

<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/GeneratorPrototype.cpp (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/JavaScriptCore/runtime/GeneratorPrototype.cpp        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/JavaScriptCore/runtime/GeneratorPrototype.cpp        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -47,7 +47,7 @@

</span><span class="cx"> void GeneratorPrototype::finishCreation(VM&amp; vm)

</span><span class="cx"> {

</span><span class="cx">     Base::finishCreation(vm);

</span><del>-    ASSERT(inherits(info()));

</del><ins>+    ASSERT(inherits(vm, info()));

</ins><span class="cx">     putDirectWithoutTransition(vm, vm.propertyNames-&gt;toStringTagSymbol, jsString(&amp;vm, &quot;Generator&quot;), DontEnum | ReadOnly);

</span><span class="cx">     vm.prototypeMap.addPrototype(this);

</span><span class="cx"> }

</span></span></pre></div>

<a id="trunkSourceJavaScriptCoreruntimeGetterSetterh"></a>

<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/GetterSetter.h (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/JavaScriptCore/runtime/GetterSetter.h        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/JavaScriptCore/runtime/GetterSetter.h        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -73,8 +73,8 @@

</span><span class="cx">         return result;

</span><span class="cx">     }

</span><span class="cx"> 

</span><del>-    bool isGetterNull() const { return !!jsDynamicCast&lt;NullGetterFunction*&gt;(m_getter.get()); }

-    bool isSetterNull() const { return !!jsDynamicCast&lt;NullSetterFunction*&gt;(m_setter.get()); }

</del><ins>+    bool isGetterNull() const { return !!jsDynamicCast&lt;NullGetterFunction*&gt;(*m_getter.get()-&gt;vm(), m_getter.get()); }

+    bool isSetterNull() const { return !!jsDynamicCast&lt;NullSetterFunction*&gt;(*m_setter.get()-&gt;vm(), m_setter.get()); }

</ins><span class="cx"> 

</span><span class="cx">     // Set the getter. It's only valid to call this if you've never set the getter on this

<span class="cx">     // object.

</span></span></pre></div>

<a id="trunkSourceJavaScriptCoreruntimeInspectorInstrumentationObjectcpp"></a>

<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/InspectorInstrumentationObject.cpp (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/JavaScriptCore/runtime/InspectorInstrumentationObject.cpp        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/JavaScriptCore/runtime/InspectorInstrumentationObject.cpp        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -60,7 +60,7 @@

</span><span class="cx"> void InspectorInstrumentationObject::finishCreation(VM&amp; vm, JSGlobalObject*)

</span><span class="cx"> {

</span><span class="cx">     Base::finishCreation(vm);

</span><del>-    ASSERT(inherits(info()));

</del><ins>+    ASSERT(inherits(vm, info()));

</ins><span class="cx">     putDirectWithoutTransition(vm, vm.propertyNames-&gt;isEnabled, jsBoolean(false));

</span><span class="cx"> }

</span><span class="cx"> 

</span></span></pre></div>

<a id="trunkSourceJavaScriptCoreruntimeInternalFunctioncpp"></a>

<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/InternalFunction.cpp (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/JavaScriptCore/runtime/InternalFunction.cpp        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/JavaScriptCore/runtime/InternalFunction.cpp        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -44,7 +44,7 @@

</span><span class="cx"> void InternalFunction::finishCreation(VM&amp; vm, const String&amp; name)

</span><span class="cx"> {

</span><span class="cx">     Base::finishCreation(vm);

</span><del>-    ASSERT(inherits(info()));

</del><ins>+    ASSERT(inherits(vm, info()));

</ins><span class="cx">     ASSERT(methodTable()-&gt;getCallData != InternalFunction::info()-&gt;methodTable.getCallData);

</span><span class="cx">     JSString* nameString = jsString(&amp;vm, name);

</span><span class="cx">     m_originalName.set(vm, this, nameString);

</span><span class="lines">@@ -104,7 +104,7 @@

</span><span class="cx"> 

</span><span class="cx">     if (newTarget &amp;&amp; newTarget != exec-&gt;jsCallee()) {

<span class="cx">         // newTarget may be an InternalFunction if we were called from Reflect.construct.

</span><del>-        JSFunction* targetFunction = jsDynamicCast&lt;JSFunction*&gt;(newTarget);

</del><ins>+        JSFunction* targetFunction = jsDynamicCast&lt;JSFunction*&gt;(vm, newTarget);

</ins><span class="cx"> 

</span><span class="cx">         if (LIKELY(targetFunction)) {

</span><span class="cx">             Structure* structure = targetFunction-&gt;rareData(vm)-&gt;internalFunctionAllocationStructure();

</span><span class="lines">@@ -114,12 +114,12 @@

<span class="cx">             // Note, Reflect.construct might cause the profile to churn but we don't care.

</span><span class="cx">             JSValue prototypeValue = newTarget.get(exec, exec-&gt;propertyNames().prototype);

</span><span class="cx">             RETURN_IF_EXCEPTION(scope, nullptr);

</span><del>-            if (JSObject* prototype = jsDynamicCast&lt;JSObject*&gt;(prototypeValue))

</del><ins>+            if (JSObject* prototype = jsDynamicCast&lt;JSObject*&gt;(vm, prototypeValue))

</ins><span class="cx">                 return targetFunction-&gt;rareData(vm)-&gt;createInternalFunctionAllocationStructureFromBase(vm, prototype, baseClass);

</span><span class="cx">         } else {

</span><span class="cx">             JSValue prototypeValue = newTarget.get(exec, exec-&gt;propertyNames().prototype);

</span><span class="cx">             RETURN_IF_EXCEPTION(scope, nullptr);

</span><del>-            if (JSObject* prototype = jsDynamicCast&lt;JSObject*&gt;(prototypeValue)) {

</del><ins>+            if (JSObject* prototype = jsDynamicCast&lt;JSObject*&gt;(vm, prototypeValue)) {

</ins><span class="cx">                 // This only happens if someone Reflect.constructs our builtin constructor with another builtin constructor as the new.target.

<span class="cx">                 // Thus, we don't care about the cost of looking up the structure from our hash table every time.

</span><span class="cx">                 return vm.prototypeMap.emptyStructureForPrototypeFromBaseStructure(prototype, baseClass);

</span></span></pre></div>

<a id="trunkSourceJavaScriptCoreruntimeInternalFunctionh"></a>

<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/InternalFunction.h (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/JavaScriptCore/runtime/InternalFunction.h        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/JavaScriptCore/runtime/InternalFunction.h        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -63,7 +63,7 @@

</span><span class="cx"> 

</span><span class="cx"> inline InternalFunction* asInternalFunction(JSValue value)

</span><span class="cx"> {

</span><del>-    ASSERT(asObject(value)-&gt;inherits(InternalFunction::info()));

</del><ins>+    ASSERT(asObject(value)-&gt;inherits(*value.getObject()-&gt;vm(), InternalFunction::info()));

</ins><span class="cx">     return static_cast&lt;InternalFunction*&gt;(asObject(value));

</span><span class="cx"> }

</span><span class="cx"> 

</span></span></pre></div>

<a id="trunkSourceJavaScriptCoreruntimeIntlCollatorcpp"></a>

<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/IntlCollator.cpp (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/JavaScriptCore/runtime/IntlCollator.cpp        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/JavaScriptCore/runtime/IntlCollator.cpp        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -76,7 +76,7 @@

</span><span class="cx"> void IntlCollator::finishCreation(VM&amp; vm)

</span><span class="cx"> {

</span><span class="cx">     Base::finishCreation(vm);

</span><del>-    ASSERT(inherits(info()));

</del><ins>+    ASSERT(inherits(vm, info()));

</ins><span class="cx"> }

</span><span class="cx"> 

</span><span class="cx"> void IntlCollator::destroy(JSCell* cell)

</span></span></pre></div>

<a id="trunkSourceJavaScriptCoreruntimeIntlCollatorPrototypecpp"></a>

<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/IntlCollatorPrototype.cpp (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/JavaScriptCore/runtime/IntlCollatorPrototype.cpp        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/JavaScriptCore/runtime/IntlCollatorPrototype.cpp        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -113,7 +113,7 @@

</span><span class="cx"> 

</span><span class="cx">     // 10.3.3 Intl.Collator.prototype.compare (ECMA-402 2.0)

<span class="cx">     // 1. Let collator be this Collator object.

</span><del>-    IntlCollator* collator = jsDynamicCast&lt;IntlCollator*&gt;(state-&gt;thisValue());

</del><ins>+    IntlCollator* collator = jsDynamicCast&lt;IntlCollator*&gt;(vm, state-&gt;thisValue());

</ins><span class="cx">     if (!collator)

</span><span class="cx">         return JSValue::encode(throwTypeError(state, scope, ASCIILiteral(&quot;Intl.Collator.prototype.compare called on value that's not an object initialized as a Collator&quot;)));

</span><span class="cx"> 

</span><span class="lines">@@ -141,7 +141,7 @@

</span><span class="cx">     auto scope = DECLARE_THROW_SCOPE(vm);

</span><span class="cx"> 

</span><span class="cx">     // 10.3.5 Intl.Collator.prototype.resolvedOptions() (ECMA-402 2.0)

</span><del>-    IntlCollator* collator = jsDynamicCast&lt;IntlCollator*&gt;(state-&gt;thisValue());

</del><ins>+    IntlCollator* collator = jsDynamicCast&lt;IntlCollator*&gt;(vm, state-&gt;thisValue());

</ins><span class="cx">     if (!collator)

</span><span class="cx">         return JSValue::encode(throwTypeError(state, scope, ASCIILiteral(&quot;Intl.Collator.prototype.resolvedOptions called on value that's not an object initialized as a Collator&quot;)));

</span><span class="cx"> 

</span></span></pre></div>

<a id="trunkSourceJavaScriptCoreruntimeIntlDateTimeFormatcpp"></a>

<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/IntlDateTimeFormat.cpp (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/JavaScriptCore/runtime/IntlDateTimeFormat.cpp        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/JavaScriptCore/runtime/IntlDateTimeFormat.cpp        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -75,7 +75,7 @@

</span><span class="cx"> void IntlDateTimeFormat::finishCreation(VM&amp; vm)

</span><span class="cx"> {

</span><span class="cx">     Base::finishCreation(vm);

</span><del>-    ASSERT(inherits(info()));

</del><ins>+    ASSERT(inherits(vm, info()));

</ins><span class="cx"> }

</span><span class="cx"> 

</span><span class="cx"> void IntlDateTimeFormat::destroy(JSCell* cell)

</span></span></pre></div>

<a id="trunkSourceJavaScriptCoreruntimeIntlDateTimeFormatPrototypecpp"></a>

<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/IntlDateTimeFormatPrototype.cpp (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/JavaScriptCore/runtime/IntlDateTimeFormatPrototype.cpp        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/JavaScriptCore/runtime/IntlDateTimeFormatPrototype.cpp        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -116,7 +116,7 @@

</span><span class="cx"> 

</span><span class="cx">     // 12.3.3 Intl.DateTimeFormat.prototype.format (ECMA-402 2.0)

<span class="cx">     // 1. Let dtf be this DateTimeFormat object.

</span><del>-    IntlDateTimeFormat* dtf = jsDynamicCast&lt;IntlDateTimeFormat*&gt;(state-&gt;thisValue());

</del><ins>+    IntlDateTimeFormat* dtf = jsDynamicCast&lt;IntlDateTimeFormat*&gt;(vm, state-&gt;thisValue());

</ins><span class="cx"> 

<span class="cx">     // FIXME: Workaround to provide compatibility with ECMA-402 1.0 call/apply patterns.

</span><span class="cx">     // https://bugs.webkit.org/show_bug.cgi?id=153679

</span><span class="lines">@@ -123,7 +123,7 @@

</span><span class="cx">     if (!dtf) {

</span><span class="cx">         JSValue value = state-&gt;thisValue().get(state, vm.propertyNames-&gt;builtinNames().intlSubstituteValuePrivateName());

</span><span class="cx">         RETURN_IF_EXCEPTION(scope, encodedJSValue());

</span><del>-        dtf = jsDynamicCast&lt;IntlDateTimeFormat*&gt;(value);

</del><ins>+        dtf = jsDynamicCast&lt;IntlDateTimeFormat*&gt;(vm, value);

</ins><span class="cx">     }

</span><span class="cx"> 

</span><span class="cx">     // 2. ReturnIfAbrupt(dtf).

</span><span class="lines">@@ -153,7 +153,7 @@

</span><span class="cx">     auto scope = DECLARE_THROW_SCOPE(vm);

</span><span class="cx"> 

</span><span class="cx">     // 12.3.5 Intl.DateTimeFormat.prototype.resolvedOptions() (ECMA-402 2.0)

</span><del>-    IntlDateTimeFormat* dateTimeFormat = jsDynamicCast&lt;IntlDateTimeFormat*&gt;(state-&gt;thisValue());

</del><ins>+    IntlDateTimeFormat* dateTimeFormat = jsDynamicCast&lt;IntlDateTimeFormat*&gt;(vm, state-&gt;thisValue());

</ins><span class="cx"> 

<span class="cx">     // FIXME: Workaround to provide compatibility with ECMA-402 1.0 call/apply patterns.

</span><span class="cx">     // https://bugs.webkit.org/show_bug.cgi?id=153679

</span><span class="lines">@@ -160,7 +160,7 @@

</span><span class="cx">     if (!dateTimeFormat) {

</span><span class="cx">         JSValue value = state-&gt;thisValue().get(state, vm.propertyNames-&gt;builtinNames().intlSubstituteValuePrivateName());

</span><span class="cx">         RETURN_IF_EXCEPTION(scope, encodedJSValue());

</span><del>-        dateTimeFormat = jsDynamicCast&lt;IntlDateTimeFormat*&gt;(value);

</del><ins>+        dateTimeFormat = jsDynamicCast&lt;IntlDateTimeFormat*&gt;(vm, value);

</ins><span class="cx">     }

</span><span class="cx"> 

</span><span class="cx">     if (!dateTimeFormat)

</span></span></pre></div>

<a id="trunkSourceJavaScriptCoreruntimeIntlNumberFormatcpp"></a>

<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/IntlNumberFormat.cpp (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/JavaScriptCore/runtime/IntlNumberFormat.cpp        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/JavaScriptCore/runtime/IntlNumberFormat.cpp        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -69,7 +69,7 @@

</span><span class="cx"> void IntlNumberFormat::finishCreation(VM&amp; vm)

</span><span class="cx"> {

</span><span class="cx">     Base::finishCreation(vm);

</span><del>-    ASSERT(inherits(info()));

</del><ins>+    ASSERT(inherits(vm, info()));

</ins><span class="cx"> }

</span><span class="cx"> 

</span><span class="cx"> void IntlNumberFormat::destroy(JSCell* cell)

</span></span></pre></div>

<a id="trunkSourceJavaScriptCoreruntimeIntlNumberFormatPrototypecpp"></a>

<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/IntlNumberFormatPrototype.cpp (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/JavaScriptCore/runtime/IntlNumberFormatPrototype.cpp        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/JavaScriptCore/runtime/IntlNumberFormatPrototype.cpp        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -105,7 +105,7 @@

</span><span class="cx"> 

</span><span class="cx">     // 11.3.3 Intl.NumberFormat.prototype.format (ECMA-402 2.0)

<span class="cx">     // 1. Let nf be this NumberFormat object.

</span><del>-    IntlNumberFormat* nf = jsDynamicCast&lt;IntlNumberFormat*&gt;(state-&gt;thisValue());

</del><ins>+    IntlNumberFormat* nf = jsDynamicCast&lt;IntlNumberFormat*&gt;(vm, state-&gt;thisValue());

</ins><span class="cx"> 

<span class="cx">     // FIXME: Workaround to provide compatibility with ECMA-402 1.0 call/apply patterns.

</span><span class="cx">     // https://bugs.webkit.org/show_bug.cgi?id=153679

</span><span class="lines">@@ -112,7 +112,7 @@

</span><span class="cx">     if (!nf) {

</span><span class="cx">         JSValue value = state-&gt;thisValue().get(state, vm.propertyNames-&gt;builtinNames().intlSubstituteValuePrivateName());

</span><span class="cx">         RETURN_IF_EXCEPTION(scope, encodedJSValue());

</span><del>-        nf = jsDynamicCast&lt;IntlNumberFormat*&gt;(value);

</del><ins>+        nf = jsDynamicCast&lt;IntlNumberFormat*&gt;(vm, value);

</ins><span class="cx">     }

</span><span class="cx"> 

</span><span class="cx">     if (!nf)

</span><span class="lines">@@ -141,7 +141,7 @@

</span><span class="cx">     auto scope = DECLARE_THROW_SCOPE(vm);

</span><span class="cx"> 

</span><span class="cx">     // 11.3.5 Intl.NumberFormat.prototype.resolvedOptions() (ECMA-402 2.0)

</span><del>-    IntlNumberFormat* numberFormat = jsDynamicCast&lt;IntlNumberFormat*&gt;(state-&gt;thisValue());

</del><ins>+    IntlNumberFormat* numberFormat = jsDynamicCast&lt;IntlNumberFormat*&gt;(vm, state-&gt;thisValue());

</ins><span class="cx"> 

<span class="cx">     // FIXME: Workaround to provide compatibility with ECMA-402 1.0 call/apply patterns.

</span><span class="cx">     // https://bugs.webkit.org/show_bug.cgi?id=153679

</span><span class="lines">@@ -148,7 +148,7 @@

</span><span class="cx">     if (!numberFormat) {

</span><span class="cx">         JSValue value = state-&gt;thisValue().get(state, vm.propertyNames-&gt;builtinNames().intlSubstituteValuePrivateName());

</span><span class="cx">         RETURN_IF_EXCEPTION(scope, encodedJSValue());

</span><del>-        numberFormat = jsDynamicCast&lt;IntlNumberFormat*&gt;(value);

</del><ins>+        numberFormat = jsDynamicCast&lt;IntlNumberFormat*&gt;(vm, value);

</ins><span class="cx">     }

</span><span class="cx"> 

</span><span class="cx">     if (!numberFormat)

</span></span></pre></div>

<a id="trunkSourceJavaScriptCoreruntimeIntlObjectcpp"></a>

<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/IntlObject.cpp (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/JavaScriptCore/runtime/IntlObject.cpp        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/JavaScriptCore/runtime/IntlObject.cpp        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -85,7 +85,7 @@

</span><span class="cx"> void IntlObject::finishCreation(VM&amp; vm, JSGlobalObject* globalObject)

</span><span class="cx"> {

</span><span class="cx">     Base::finishCreation(vm);

</span><del>-    ASSERT(inherits(info()));

</del><ins>+    ASSERT(inherits(vm, info()));

</ins><span class="cx"> 

<span class="cx">     // Set up Collator.

</span><span class="cx">     IntlCollatorPrototype* collatorPrototype = IntlCollatorPrototype::create(vm, globalObject, IntlCollatorPrototype::createStructure(vm, globalObject, globalObject-&gt;objectPrototype()));

</span></span></pre></div>

<a id="trunkSourceJavaScriptCoreruntimeIntlObjectInlinesh"></a>

<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/IntlObjectInlines.h (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/JavaScriptCore/runtime/IntlObjectInlines.h        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/JavaScriptCore/runtime/IntlObjectInlines.h        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -42,7 +42,7 @@

</span><span class="cx">     VM&amp; vm = state.vm();

</span><span class="cx">     auto scope = DECLARE_THROW_SCOPE(vm);

</span><span class="cx"> 

</span><del>-    if (!jsDynamicCast&lt;IntlInstance*&gt;(thisValue)) {

</del><ins>+    if (!jsDynamicCast&lt;IntlInstance*&gt;(vm, thisValue)) {

</ins><span class="cx">         JSValue prototype = callee-&gt;getDirect(vm, vm.propertyNames-&gt;prototype);

</span><span class="cx">         bool hasInstance = JSObject::defaultHasInstance(&amp;state, thisValue, prototype);

</span><span class="cx">         RETURN_IF_EXCEPTION(scope, JSValue());

</span></span></pre></div>

<a id="trunkSourceJavaScriptCoreruntimeIteratorPrototypecpp"></a>

<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/IteratorPrototype.cpp (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/JavaScriptCore/runtime/IteratorPrototype.cpp        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/JavaScriptCore/runtime/IteratorPrototype.cpp        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -38,7 +38,7 @@

</span><span class="cx"> void IteratorPrototype::finishCreation(VM&amp; vm, JSGlobalObject* globalObject)

</span><span class="cx"> {

</span><span class="cx">     Base::finishCreation(vm);

</span><del>-    ASSERT(inherits(info()));

</del><ins>+    ASSERT(inherits(vm, info()));

</ins><span class="cx">     vm.prototypeMap.addPrototype(this);

</span><span class="cx"> 

</span><span class="cx">     JSFunction* iteratorPrototypeFunction = JSFunction::createBuiltinFunction(vm, iteratorPrototypeSymbolIteratorGetterCodeGenerator(vm), globalObject, &quot;[Symbol.iterator]&quot;);

</span></span></pre></div>

<a id="trunkSourceJavaScriptCoreruntimeJSArrayh"></a>

<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/JSArray.h (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/JavaScriptCore/runtime/JSArray.h        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/JavaScriptCore/runtime/JSArray.h        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -274,7 +274,7 @@

</span><span class="cx"> 

</span><span class="cx"> inline JSArray* asArray(JSCell* cell)

</span><span class="cx"> {

</span><del>-    ASSERT(cell-&gt;inherits(JSArray::info()));

</del><ins>+    ASSERT(cell-&gt;inherits(*cell-&gt;vm(), JSArray::info()));

</ins><span class="cx">     return jsCast&lt;JSArray*&gt;(cell);

</span><span class="cx"> }

</span><span class="cx"> 

</span><span class="lines">@@ -285,7 +285,7 @@

</span><span class="cx"> 

</span><span class="cx"> inline bool isJSArray(JSCell* cell)

</span><span class="cx"> {

</span><del>-    ASSERT((cell-&gt;classInfo() == JSArray::info()) == (cell-&gt;type() == ArrayType));

</del><ins>+    ASSERT((cell-&gt;classInfo(*cell-&gt;vm()) == JSArray::info()) == (cell-&gt;type() == ArrayType));

</ins><span class="cx">     return cell-&gt;type() == ArrayType;

</span><span class="cx"> }

</span><span class="cx"> 

</span></span></pre></div>

<a id="trunkSourceJavaScriptCoreruntimeJSArrayBufferh"></a>

<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/JSArrayBuffer.h (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/JavaScriptCore/runtime/JSArrayBuffer.h        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/JavaScriptCore/runtime/JSArrayBuffer.h        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -53,7 +53,7 @@

</span><span class="cx">     DECLARE_EXPORT_INFO;

</span><span class="cx">     

<span class="cx">     // This is the default DOM unwrapping. It calls toUnsharedArrayBuffer().

</span><del>-    static ArrayBuffer* toWrapped(JSValue);

</del><ins>+    static ArrayBuffer* toWrapped(VM&amp;, JSValue);

</ins><span class="cx">     

</span><span class="cx"> protected:

</span><span class="cx"> 

</span><span class="lines">@@ -69,25 +69,25 @@

</span><span class="cx">     ArrayBuffer* m_impl;

</span><span class="cx"> };

</span><span class="cx"> 

</span><del>-inline ArrayBuffer* toPossiblySharedArrayBuffer(JSValue value)

</del><ins>+inline ArrayBuffer* toPossiblySharedArrayBuffer(VM&amp; vm, JSValue value)

</ins><span class="cx"> {

</span><del>-    JSArrayBuffer* wrapper = jsDynamicCast&lt;JSArrayBuffer*&gt;(value);

</del><ins>+    JSArrayBuffer* wrapper = jsDynamicCast&lt;JSArrayBuffer*&gt;(vm, value);

</ins><span class="cx">     if (!wrapper)

</span><span class="cx">         return nullptr;

</span><span class="cx">     return wrapper-&gt;impl();

</span><span class="cx"> }

</span><span class="cx"> 

</span><del>-inline ArrayBuffer* toUnsharedArrayBuffer(JSValue value)

</del><ins>+inline ArrayBuffer* toUnsharedArrayBuffer(VM&amp; vm, JSValue value)

</ins><span class="cx"> {

</span><del>-    ArrayBuffer* result = toPossiblySharedArrayBuffer(value);

</del><ins>+    ArrayBuffer* result = toPossiblySharedArrayBuffer(vm, value);

</ins><span class="cx">     if (!result || result-&gt;isShared())

</span><span class="cx">         return nullptr;

</span><span class="cx">     return result;

</span><span class="cx"> }

</span><span class="cx"> 

</span><del>-inline ArrayBuffer* JSArrayBuffer::toWrapped(JSValue value)

</del><ins>+inline ArrayBuffer* JSArrayBuffer::toWrapped(VM&amp; vm, JSValue value)

</ins><span class="cx"> {

</span><del>-    return toUnsharedArrayBuffer(value);

</del><ins>+    return toUnsharedArrayBuffer(vm, value);

</ins><span class="cx"> }

</span><span class="cx"> 

</span><span class="cx"> } // namespace JSC

</span></span></pre></div>

<a id="trunkSourceJavaScriptCoreruntimeJSArrayBufferConstructorcpp"></a>

<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/JSArrayBufferConstructor.cpp (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/JavaScriptCore/runtime/JSArrayBufferConstructor.cpp        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/JavaScriptCore/runtime/JSArrayBufferConstructor.cpp        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -140,7 +140,7 @@

</span><span class="cx"> // ECMA 24.1.3.1

</span><span class="cx"> EncodedJSValue JSC_HOST_CALL arrayBufferFuncIsView(ExecState* exec)

</span><span class="cx"> {

</span><del>-    return JSValue::encode(jsBoolean(jsDynamicCast&lt;JSArrayBufferView*&gt;(exec-&gt;argument(0))));

</del><ins>+    return JSValue::encode(jsBoolean(jsDynamicCast&lt;JSArrayBufferView*&gt;(exec-&gt;vm(), exec-&gt;argument(0))));

</ins><span class="cx"> }

</span><span class="cx">     

</span><span class="cx"> 

</span></span></pre></div>

<a id="trunkSourceJavaScriptCoreruntimeJSArrayBufferPrototypecpp"></a>

<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/JSArrayBufferPrototype.cpp (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/JavaScriptCore/runtime/JSArrayBufferPrototype.cpp        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/JavaScriptCore/runtime/JSArrayBufferPrototype.cpp        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -42,7 +42,7 @@

</span><span class="cx"> 

</span><span class="cx">     JSFunction* callee = jsCast&lt;JSFunction*&gt;(exec-&gt;jsCallee());

</span><span class="cx">     

</span><del>-    JSArrayBuffer* thisObject = jsDynamicCast&lt;JSArrayBuffer*&gt;(exec-&gt;thisValue());

</del><ins>+    JSArrayBuffer* thisObject = jsDynamicCast&lt;JSArrayBuffer*&gt;(vm, exec-&gt;thisValue());

</ins><span class="cx">     if (!thisObject)

</span><span class="cx">         return throwVMTypeError(exec, scope, ASCIILiteral(&quot;Receiver of slice must be an array buffer.&quot;));

</span><span class="cx">     

</span></span></pre></div>

<a id="trunkSourceJavaScriptCoreruntimeJSArrayBufferViewh"></a>

<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/JSArrayBufferView.h (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/JavaScriptCore/runtime/JSArrayBufferView.h        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/JavaScriptCore/runtime/JSArrayBufferView.h        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -178,7 +178,7 @@

</span><span class="cx">     static ptrdiff_t offsetOfLength() { return OBJECT_OFFSETOF(JSArrayBufferView, m_length); }

</span><span class="cx">     static ptrdiff_t offsetOfMode() { return OBJECT_OFFSETOF(JSArrayBufferView, m_mode); }

</span><span class="cx">     

</span><del>-    static RefPtr&lt;ArrayBufferView&gt; toWrapped(JSValue);

</del><ins>+    static RefPtr&lt;ArrayBufferView&gt; toWrapped(VM&amp;, JSValue);

</ins><span class="cx"> 

</span><span class="cx"> private:

</span><span class="cx">     static void finalize(JSCell*);

</span></span></pre></div>

<a id="trunkSourceJavaScriptCoreruntimeJSArrayBufferViewInlinesh"></a>

<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/JSArrayBufferViewInlines.h (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/JavaScriptCore/runtime/JSArrayBufferViewInlines.h        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/JavaScriptCore/runtime/JSArrayBufferViewInlines.h        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -89,9 +89,9 @@

</span><span class="cx">     return result;

</span><span class="cx"> }

</span><span class="cx"> 

</span><del>-inline RefPtr&lt;ArrayBufferView&gt; JSArrayBufferView::toWrapped(JSValue value)

</del><ins>+inline RefPtr&lt;ArrayBufferView&gt; JSArrayBufferView::toWrapped(VM&amp; vm, JSValue value)

</ins><span class="cx"> {

</span><del>-    if (JSArrayBufferView* view = jsDynamicCast&lt;JSArrayBufferView*&gt;(value)) {

</del><ins>+    if (JSArrayBufferView* view = jsDynamicCast&lt;JSArrayBufferView*&gt;(vm, value)) {

</ins><span class="cx">         if (!view-&gt;isShared())

</span><span class="cx">             return view-&gt;unsharedImpl();

</span><span class="cx">     }

</span></span></pre></div>

<a id="trunkSourceJavaScriptCoreruntimeJSBoundFunctioncpp"></a>

<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/JSBoundFunction.cpp (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/JavaScriptCore/runtime/JSBoundFunction.cpp        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/JavaScriptCore/runtime/JSBoundFunction.cpp        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -113,7 +113,7 @@

</span><span class="cx"> 

</span><span class="cx"> EncodedJSValue JSC_HOST_CALL isBoundFunction(ExecState* exec)

</span><span class="cx"> {

</span><del>-    return JSValue::encode(JSValue(static_cast&lt;bool&gt;(jsDynamicCast&lt;JSBoundFunction*&gt;(exec-&gt;uncheckedArgument(0)))));

</del><ins>+    return JSValue::encode(JSValue(static_cast&lt;bool&gt;(jsDynamicCast&lt;JSBoundFunction*&gt;(exec-&gt;vm(), exec-&gt;uncheckedArgument(0)))));

</ins><span class="cx"> }

</span><span class="cx"> 

</span><span class="cx"> EncodedJSValue JSC_HOST_CALL hasInstanceBoundFunction(ExecState* exec)

</span><span class="lines">@@ -129,7 +129,7 @@

</span><span class="cx">     auto scope = DECLARE_THROW_SCOPE(vm);

</span><span class="cx">     JSValue prototype = targetFunction-&gt;getPrototype(vm, exec);

</span><span class="cx">     RETURN_IF_EXCEPTION(scope, nullptr);

</span><del>-    JSFunction* targetJSFunction = jsDynamicCast&lt;JSFunction*&gt;(targetFunction);

</del><ins>+    JSFunction* targetJSFunction = jsDynamicCast&lt;JSFunction*&gt;(vm, targetFunction);

</ins><span class="cx"> 

</span><span class="cx">     // We only cache the structure of the bound function if the bindee is a JSFunction since there

<span class="cx">     // isn't any good place to put the structure on Internal Functions.

</span><span class="lines">@@ -195,7 +195,7 @@

</span><span class="cx"> {

<span class="cx">     String name; // We lazily create our 'name' string property.

</span><span class="cx">     Base::finishCreation(vm, executable, length, name);

</span><del>-    ASSERT(inherits(info()));

</del><ins>+    ASSERT(inherits(vm, info()));

</ins><span class="cx"> 

</span><span class="cx">     putDirectNonIndexAccessor(vm, vm.propertyNames-&gt;arguments, globalObject()-&gt;throwTypeErrorArgumentsCalleeAndCallerGetterSetter(), DontDelete | DontEnum | Accessor);

</span><span class="cx">     putDirectNonIndexAccessor(vm, vm.propertyNames-&gt;caller, globalObject()-&gt;throwTypeErrorArgumentsCalleeAndCallerGetterSetter(), DontDelete | DontEnum | Accessor);

</span></span></pre></div>

<a id="trunkSourceJavaScriptCoreruntimeJSCJSValuecpp"></a>

<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/JSCJSValue.cpp (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/JavaScriptCore/runtime/JSCJSValue.cpp        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/JavaScriptCore/runtime/JSCJSValue.cpp        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -298,7 +298,7 @@

</span><span class="cx">     else if (isDouble())

</span><span class="cx">         out.printf(&quot;%lf&quot;, asDouble());

</span><span class="cx">     else if (isCell()) {

</span><del>-        if (asCell()-&gt;inherits(JSString::info())) {

</del><ins>+        if (asCell()-&gt;inherits(*asCell()-&gt;vm(), JSString::info())) {

</ins><span class="cx">             JSString* string = asString(asCell());

</span><span class="cx">             const StringImpl* impl = string-&gt;tryGetValueImpl();

</span><span class="cx">             if (impl)

</span><span class="lines">@@ -305,7 +305,7 @@

</span><span class="cx">                 out.print(&quot;\&quot;&quot;, impl, &quot;\&quot;&quot;);

</span><span class="cx">             else

</span><span class="cx">                 out.print(&quot;(unresolved string)&quot;);

</span><del>-        } else if (asCell()-&gt;inherits(Structure::info())) {

</del><ins>+        } else if (asCell()-&gt;inherits(*asCell()-&gt;vm(), Structure::info())) {

</ins><span class="cx">             out.print(&quot;Structure[ &quot;, asCell()-&gt;structure()-&gt;classInfo()-&gt;className);

</span><span class="cx"> #if USE(JSVALUE64)

</span><span class="cx">             out.print(&quot; ID: &quot;, asCell()-&gt;structureID());

</span></span></pre></div>

<a id="trunkSourceJavaScriptCoreruntimeJSCJSValueh"></a>

<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/JSCJSValue.h (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/JavaScriptCore/runtime/JSCJSValue.h        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/JavaScriptCore/runtime/JSCJSValue.h        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -228,8 +228,8 @@

</span><span class="cx">     bool isGetterSetter() const;

</span><span class="cx">     bool isCustomGetterSetter() const;

</span><span class="cx">     bool isObject() const;

</span><del>-    bool inherits(const ClassInfo*) const;

-    const ClassInfo* classInfoOrNull() const;

</del><ins>+    bool inherits(VM&amp;, const ClassInfo*) const;

+    const ClassInfo* classInfoOrNull(VM&amp;) const;

</ins><span class="cx">         

<span class="cx">     // Extracting the value.

</span><span class="cx">     bool getString(ExecState*, WTF::String&amp;) const;

</span></span></pre></div>

<a id="trunkSourceJavaScriptCoreruntimeJSCJSValueInlinesh"></a>

<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/JSCJSValueInlines.h (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/JavaScriptCore/runtime/JSCJSValueInlines.h        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/JavaScriptCore/runtime/JSCJSValueInlines.h        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -767,14 +767,14 @@

</span><span class="cx"> }

</span><span class="cx"> 

</span><span class="cx"> // this method is here to be after the inline declaration of JSCell::inherits

</span><del>-inline bool JSValue::inherits(const ClassInfo* classInfo) const

</del><ins>+inline bool JSValue::inherits(VM&amp; vm, const ClassInfo* classInfo) const

</ins><span class="cx"> {

</span><del>-    return isCell() &amp;&amp; asCell()-&gt;inherits(classInfo);

</del><ins>+    return isCell() &amp;&amp; asCell()-&gt;inherits(vm, classInfo);

</ins><span class="cx"> }

</span><span class="cx"> 

</span><del>-inline const ClassInfo* JSValue::classInfoOrNull() const

</del><ins>+inline const ClassInfo* JSValue::classInfoOrNull(VM&amp; vm) const

</ins><span class="cx"> {

</span><del>-    return isCell() ? asCell()-&gt;classInfo() : nullptr;

</del><ins>+    return isCell() ? asCell()-&gt;classInfo(vm) : nullptr;

</ins><span class="cx"> }

</span><span class="cx"> 

</span><span class="cx"> inline JSValue JSValue::toThis(ExecState* exec, ECMAMode ecmaMode) const

</span></span></pre></div>

<a id="trunkSourceJavaScriptCoreruntimeJSCalleecpp"></a>

<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/JSCallee.cpp (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/JavaScriptCore/runtime/JSCallee.cpp        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/JavaScriptCore/runtime/JSCallee.cpp        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -51,7 +51,7 @@

</span><span class="cx"> void JSCallee::finishCreation(VM&amp; vm)

</span><span class="cx"> {

</span><span class="cx">     Base::finishCreation(vm);

</span><del>-    ASSERT(inherits(info()));

</del><ins>+    ASSERT(inherits(vm, info()));

</ins><span class="cx"> }

</span><span class="cx"> 

</span><span class="cx"> void JSCallee::visitChildren(JSCell* cell, SlotVisitor&amp; visitor)

</span></span></pre></div>

<a id="trunkSourceJavaScriptCoreruntimeJSCellcpp"></a>

<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/JSCell.cpp (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/JavaScriptCore/runtime/JSCell.cpp        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/JavaScriptCore/runtime/JSCell.cpp        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -50,7 +50,7 @@

</span><span class="cx"> 

</span><span class="cx"> void JSCell::dumpToStream(const JSCell* cell, PrintStream&amp; out)

</span><span class="cx"> {

</span><del>-    out.printf(&quot;&lt;%p, %s&gt;&quot;, cell, cell-&gt;className());

</del><ins>+    out.printf(&quot;&lt;%p, %s&gt;&quot;, cell, cell-&gt;className(*cell-&gt;vm()));

</ins><span class="cx"> }

</span><span class="cx"> 

</span><span class="cx"> size_t JSCell::estimatedSizeInBytes() const

</span><span class="lines">@@ -225,9 +225,9 @@

</span><span class="cx">     return String();

</span><span class="cx"> }

</span><span class="cx"> 

</span><del>-const char* JSCell::className() const

</del><ins>+const char* JSCell::className(VM&amp; vm) const

</ins><span class="cx"> {

</span><del>-    return classInfo()-&gt;className;

</del><ins>+    return classInfo(vm)-&gt;className;

</ins><span class="cx"> }

</span><span class="cx"> 

</span><span class="cx"> void JSCell::getPropertyNames(JSObject*, ExecState*, PropertyNameArray&amp;, EnumerationMode)

</span><span class="lines">@@ -295,11 +295,12 @@

</span><span class="cx">     RELEASE_ASSERT_NOT_REACHED();

</span><span class="cx"> }

</span><span class="cx"> 

</span><del>-bool JSCell::isAnyWasmCallee() const

</del><ins>+bool JSCell::isAnyWasmCallee(VM&amp; vm) const

</ins><span class="cx"> {

</span><span class="cx"> #if ENABLE(WEBASSEMBLY)

</span><del>-    return inherits(JSWebAssemblyCallee::info()) || inherits(WebAssemblyToJSCallee::info());

</del><ins>+    return inherits(vm, JSWebAssemblyCallee::info()) || inherits(vm, WebAssemblyToJSCallee::info());

</ins><span class="cx"> #else

</span><ins>+    UNUSED_PARAM(vm);

</ins><span class="cx">     return false;

</span><span class="cx"> #endif

</span><span class="cx"> 

</span></span></pre></div>

<a id="trunkSourceJavaScriptCoreruntimeJSCellh"></a>

<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/JSCell.h (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/JavaScriptCore/runtime/JSCell.h        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/JavaScriptCore/runtime/JSCell.h        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -101,11 +101,11 @@

</span><span class="cx">     bool isString() const;

</span><span class="cx">     bool isSymbol() const;

</span><span class="cx">     bool isObject() const;

</span><del>-    bool isAnyWasmCallee() const;

</del><ins>+    bool isAnyWasmCallee(VM&amp;) const;

</ins><span class="cx">     bool isGetterSetter() const;

</span><span class="cx">     bool isCustomGetterSetter() const;

</span><span class="cx">     bool isProxy() const;

</span><del>-    bool inherits(const ClassInfo*) const;

</del><ins>+    bool inherits(VM&amp;, const ClassInfo*) const;

</ins><span class="cx">     bool isAPIValueWrapper() const;

</span><span class="cx">     

</span><span class="cx">     // Each cell has a built-in lock. Currently it's simply available for use if you need it. It's

</span><span class="lines">@@ -128,7 +128,7 @@

</span><span class="cx"> 

</span><span class="cx">     TypeInfo::InlineTypeFlags inlineTypeFlags() const { return m_flags; }

</span><span class="cx"> 

</span><del>-    const char* className() const;

</del><ins>+    const char* className(VM&amp;) const;

</ins><span class="cx"> 

<span class="cx">     // Extracting the value.

</span><span class="cx">     JS_EXPORT_PRIVATE bool getString(ExecState*, String&amp;) const;

</span><span class="lines">@@ -165,7 +165,7 @@

</span><span class="cx">     JS_EXPORT_PRIVATE static void heapSnapshot(JSCell*, HeapSnapshotBuilder&amp;);

</span><span class="cx"> 

<span class="cx">     // Object operations, with the toObject operation included.

</span><del>-    const ClassInfo* classInfo() const;

</del><ins>+    const ClassInfo* classInfo(VM&amp;) const;

</ins><span class="cx">     const MethodTable* methodTable() const;

</span><span class="cx">     const MethodTable* methodTable(VM&amp;) const;

</span><span class="cx">     static bool put(JSCell*, ExecState*, PropertyName, JSValue, PutPropertySlot&amp;);

</span><span class="lines">@@ -270,7 +270,7 @@

</span><span class="cx"> template&lt;typename To, typename From&gt;

</span><span class="cx"> inline To jsCast(From* from)

</span><span class="cx"> {

</span><del>-    ASSERT_WITH_SECURITY_IMPLICATION(!from || from-&gt;JSCell::inherits(std::remove_pointer&lt;To&gt;::type::info()));

</del><ins>+    ASSERT_WITH_SECURITY_IMPLICATION(!from || from-&gt;JSCell::inherits(*from-&gt;JSCell::vm(), std::remove_pointer&lt;To&gt;::type::info()));

</ins><span class="cx">     return static_cast&lt;To&gt;(from);

</span><span class="cx"> }

</span><span class="cx">     

</span><span class="lines">@@ -277,22 +277,22 @@

</span><span class="cx"> template&lt;typename To&gt;

</span><span class="cx"> inline To jsCast(JSValue from)

</span><span class="cx"> {

</span><del>-    ASSERT_WITH_SECURITY_IMPLICATION(from.isCell() &amp;&amp; from.asCell()-&gt;JSCell::inherits(std::remove_pointer&lt;To&gt;::type::info()));

</del><ins>+    ASSERT_WITH_SECURITY_IMPLICATION(from.isCell() &amp;&amp; from.asCell()-&gt;JSCell::inherits(*from.asCell()-&gt;vm(), std::remove_pointer&lt;To&gt;::type::info()));

</ins><span class="cx">     return static_cast&lt;To&gt;(from.asCell());

</span><span class="cx"> }

</span><span class="cx"> 

</span><span class="cx"> template&lt;typename To, typename From&gt;

</span><del>-inline To jsDynamicCast(From* from)

</del><ins>+inline To jsDynamicCast(VM&amp; vm, From* from)

</ins><span class="cx"> {

</span><del>-    if (LIKELY(from-&gt;inherits(std::remove_pointer&lt;To&gt;::type::info())))

</del><ins>+    if (LIKELY(from-&gt;JSCell::inherits(vm, std::remove_pointer&lt;To&gt;::type::info())))

</ins><span class="cx">         return static_cast&lt;To&gt;(from);

</span><span class="cx">     return nullptr;

</span><span class="cx"> }

</span><span class="cx"> 

</span><span class="cx"> template&lt;typename To&gt;

</span><del>-inline To jsDynamicCast(JSValue from)

</del><ins>+inline To jsDynamicCast(VM&amp; vm, JSValue from)

</ins><span class="cx"> {

</span><del>-    if (LIKELY(from.isCell() &amp;&amp; from.asCell()-&gt;inherits(std::remove_pointer&lt;To&gt;::type::info())))

</del><ins>+    if (LIKELY(from.isCell() &amp;&amp; from.asCell()-&gt;inherits(vm, std::remove_pointer&lt;To&gt;::type::info())))

</ins><span class="cx">         return static_cast&lt;To&gt;(from.asCell());

</span><span class="cx">     return nullptr;

</span><span class="cx"> }

</span></span></pre></div>

<a id="trunkSourceJavaScriptCoreruntimeJSCellInlinesh"></a>

<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/JSCellInlines.h (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/JavaScriptCore/runtime/JSCellInlines.h        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/JavaScriptCore/runtime/JSCellInlines.h        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -240,11 +240,7 @@

</span><span class="cx"> inline const MethodTable* JSCell::methodTable() const

</span><span class="cx"> {

</span><span class="cx">     VM&amp; vm = *Heap::heap(this)-&gt;vm();

</span><del>-    Structure* structure = this-&gt;structure(vm);

-    if (Structure* rootStructure = structure-&gt;structure(vm))

-        RELEASE_ASSERT(rootStructure == rootStructure-&gt;structure(vm));

-

-    return &amp;structure-&gt;classInfo()-&gt;methodTable;

</del><ins>+    return methodTable(vm);

</ins><span class="cx"> }

</span><span class="cx"> 

</span><span class="cx"> inline const MethodTable* JSCell::methodTable(VM&amp; vm) const

</span><span class="lines">@@ -251,14 +247,14 @@

</span><span class="cx"> {

</span><span class="cx">     Structure* structure = this-&gt;structure(vm);

</span><span class="cx">     if (Structure* rootStructure = structure-&gt;structure(vm))

</span><del>-        RELEASE_ASSERT(rootStructure == rootStructure-&gt;structure(vm));

</del><ins>+        ASSERT_UNUSED(rootStructure, rootStructure == rootStructure-&gt;structure(vm));

</ins><span class="cx"> 

</span><span class="cx">     return &amp;structure-&gt;classInfo()-&gt;methodTable;

</span><span class="cx"> }

</span><span class="cx"> 

</span><del>-inline bool JSCell::inherits(const ClassInfo* info) const

</del><ins>+inline bool JSCell::inherits(VM&amp; vm, const ClassInfo* info) const

</ins><span class="cx"> {

</span><del>-    return classInfo()-&gt;isSubClassOf(info);

</del><ins>+    return classInfo(vm)-&gt;isSubClassOf(info);

</ins><span class="cx"> }

</span><span class="cx"> 

</span><span class="cx"> ALWAYS_INLINE JSValue JSCell::fastGetOwnProperty(VM&amp; vm, Structure&amp; structure, PropertyName name)

</span><span class="lines">@@ -277,21 +273,15 @@

</span><span class="cx">         &amp;&amp; !structure.typeInfo().overridesGetOwnPropertySlot();

</span><span class="cx"> }

</span><span class="cx"> 

</span><del>-ALWAYS_INLINE const ClassInfo* JSCell::classInfo() const

</del><ins>+ALWAYS_INLINE const ClassInfo* JSCell::classInfo(VM&amp; vm) const

</ins><span class="cx"> {

</span><del>-    VM* vm;

-    if (isLargeAllocation())

-        vm = largeAllocation().vm();

-    else

-        vm = markedBlock().vm();

-

</del><span class="cx">     // What we really want to assert here is that we're not currently destructing this object (which makes its classInfo

</span><span class="cx">     // invalid). If mutatorState() == MutatorState::Running, then we're not currently sweeping, and therefore cannot be

</span><span class="cx">     // destructing the object. The GC thread or JIT threads, unlike the mutator thread, are able to access classInfo

</span><span class="cx">     // independent of whether the mutator thread is sweeping or not. Hence, we also check for ownerThread() !=

<span class="cx">     // std::this_thread::get_id() to allow the GC thread or JIT threads to pass this assertion.

</span><del>-    ASSERT(vm-&gt;heap.mutatorState() == MutatorState::Running || vm-&gt;apiLock().ownerThread() != std::this_thread::get_id());

-    return structure(*vm)-&gt;classInfo();

</del><ins>+    ASSERT(vm.heap.mutatorState() == MutatorState::Running || vm.apiLock().ownerThread() != std::this_thread::get_id());

+    return structure(vm)-&gt;classInfo();

</ins><span class="cx"> }

</span><span class="cx"> 

</span><span class="cx"> inline bool JSCell::toBoolean(ExecState* exec) const

</span></span></pre></div>

<a id="trunkSourceJavaScriptCoreruntimeJSCustomGetterSetterFunctioncpp"></a>

<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/JSCustomGetterSetterFunction.cpp (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/JavaScriptCore/runtime/JSCustomGetterSetterFunction.cpp        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/JavaScriptCore/runtime/JSCustomGetterSetterFunction.cpp        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -88,7 +88,7 @@

</span><span class="cx"> void JSCustomGetterSetterFunction::finishCreation(VM&amp; vm, NativeExecutable* executable, CustomGetterSetter* getterSetter, const String&amp; name)

</span><span class="cx"> {

</span><span class="cx">     Base::finishCreation(vm, executable, isSetter(), name);

</span><del>-    ASSERT(inherits(info()));

</del><ins>+    ASSERT(inherits(vm, info()));

</ins><span class="cx">     ASSERT(getterSetter);

</span><span class="cx">     m_getterSetter.set(vm, this, getterSetter);

</span><span class="cx"> }

</span></span></pre></div>

<a id="trunkSourceJavaScriptCoreruntimeJSDataViewPrototypecpp"></a>

<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/JSDataViewPrototype.cpp (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/JavaScriptCore/runtime/JSDataViewPrototype.cpp        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/JavaScriptCore/runtime/JSDataViewPrototype.cpp        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -125,7 +125,7 @@

</span><span class="cx">     VM&amp; vm = exec-&gt;vm();

</span><span class="cx">     auto scope = DECLARE_THROW_SCOPE(vm);

</span><span class="cx"> 

</span><del>-    JSDataView* dataView = jsDynamicCast&lt;JSDataView*&gt;(exec-&gt;thisValue());

</del><ins>+    JSDataView* dataView = jsDynamicCast&lt;JSDataView*&gt;(vm, exec-&gt;thisValue());

</ins><span class="cx">     if (!dataView)

</span><span class="cx">         return throwVMTypeError(exec, scope, ASCIILiteral(&quot;Receiver of DataView method must be a DataView&quot;));

</span><span class="cx">     

</span><span class="lines">@@ -168,7 +168,7 @@

</span><span class="cx">     VM&amp; vm = exec-&gt;vm();

</span><span class="cx">     auto scope = DECLARE_THROW_SCOPE(vm);

</span><span class="cx"> 

</span><del>-    JSDataView* dataView = jsDynamicCast&lt;JSDataView*&gt;(exec-&gt;thisValue());

</del><ins>+    JSDataView* dataView = jsDynamicCast&lt;JSDataView*&gt;(vm, exec-&gt;thisValue());

</ins><span class="cx">     if (!dataView)

</span><span class="cx">         return throwVMTypeError(exec, scope, ASCIILiteral(&quot;Receiver of DataView method must be a DataView&quot;));

</span><span class="cx">     

</span><span class="lines">@@ -218,7 +218,7 @@

</span><span class="cx">     VM&amp; vm = exec-&gt;vm();

</span><span class="cx">     auto scope = DECLARE_THROW_SCOPE(vm);

</span><span class="cx"> 

</span><del>-    JSDataView* view = jsDynamicCast&lt;JSDataView*&gt;(exec-&gt;thisValue());

</del><ins>+    JSDataView* view = jsDynamicCast&lt;JSDataView*&gt;(vm, exec-&gt;thisValue());

</ins><span class="cx">     if (!view)

</span><span class="cx">         return throwVMTypeError(exec, scope, &quot;DataView.prototype.buffer expects |this| to be a DataView object&quot;);

</span><span class="cx"> 

</span><span class="lines">@@ -230,7 +230,7 @@

</span><span class="cx">     VM&amp; vm = exec-&gt;vm();

</span><span class="cx">     auto scope = DECLARE_THROW_SCOPE(vm);

</span><span class="cx"> 

</span><del>-    JSDataView* view = jsDynamicCast&lt;JSDataView*&gt;(exec-&gt;thisValue());

</del><ins>+    JSDataView* view = jsDynamicCast&lt;JSDataView*&gt;(vm, exec-&gt;thisValue());

</ins><span class="cx">     if (!view)

</span><span class="cx">         return throwVMTypeError(exec, scope, &quot;DataView.prototype.buffer expects |this| to be a DataView object&quot;);

</span><span class="cx"> 

</span><span class="lines">@@ -242,7 +242,7 @@

</span><span class="cx">     VM&amp; vm = exec-&gt;vm();

</span><span class="cx">     auto scope = DECLARE_THROW_SCOPE(vm);

</span><span class="cx"> 

</span><del>-    JSDataView* view = jsDynamicCast&lt;JSDataView*&gt;(exec-&gt;thisValue());

</del><ins>+    JSDataView* view = jsDynamicCast&lt;JSDataView*&gt;(vm, exec-&gt;thisValue());

</ins><span class="cx">     if (!view)

</span><span class="cx">         return throwVMTypeError(exec, scope, &quot;DataView.prototype.buffer expects |this| to be a DataView object&quot;);

</span><span class="cx"> 

</span></span></pre></div>

<a id="trunkSourceJavaScriptCoreruntimeJSFunctioncpp"></a>

<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/JSFunction.cpp (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/JavaScriptCore/runtime/JSFunction.cpp        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/JavaScriptCore/runtime/JSFunction.cpp        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -92,7 +92,7 @@

</span><span class="cx"> void JSFunction::finishCreation(VM&amp; vm, NativeExecutable* executable, int length, const String&amp; name)

</span><span class="cx"> {

</span><span class="cx">     Base::finishCreation(vm);

</span><del>-    ASSERT(inherits(info()));

</del><ins>+    ASSERT(inherits(vm, info()));

</ins><span class="cx">     m_executable.set(vm, this, executable);

<span class="cx">     // Some NativeExecutable functions, like JSBoundFunction, decide to lazily allocate their name string.

</span><span class="cx">     if (!name.isNull())

</span><span class="lines">@@ -133,7 +133,7 @@

</span><span class="cx"> {

</span><span class="cx">     ASSERT(!m_rareData);

</span><span class="cx">     VM&amp; vm = exec-&gt;vm();

</span><del>-    JSObject* prototype = jsDynamicCast&lt;JSObject*&gt;(get(exec, vm.propertyNames-&gt;prototype));

</del><ins>+    JSObject* prototype = jsDynamicCast&lt;JSObject*&gt;(vm, get(exec, vm.propertyNames-&gt;prototype));

</ins><span class="cx">     if (!prototype)

</span><span class="cx">         prototype = globalObject(vm)-&gt;objectPrototype();

</span><span class="cx">     FunctionRareData* rareData = FunctionRareData::create(vm);

</span><span class="lines">@@ -151,7 +151,7 @@

</span><span class="cx"> {

</span><span class="cx">     ASSERT(!!m_rareData);

</span><span class="cx">     VM&amp; vm = exec-&gt;vm();

</span><del>-    JSObject* prototype = jsDynamicCast&lt;JSObject*&gt;(get(exec, vm.propertyNames-&gt;prototype));

</del><ins>+    JSObject* prototype = jsDynamicCast&lt;JSObject*&gt;(vm, get(exec, vm.propertyNames-&gt;prototype));

</ins><span class="cx">     if (!prototype)

</span><span class="cx">         prototype = globalObject(vm)-&gt;objectPrototype();

</span><span class="cx">     m_rareData-&gt;initializeObjectAllocationProfile(vm, prototype, inlineCapacity);

</span><span class="lines">@@ -226,7 +226,7 @@

</span><span class="cx"> class RetrieveArgumentsFunctor {

</span><span class="cx"> public:

</span><span class="cx">     RetrieveArgumentsFunctor(JSFunction* functionObj)

</span><del>-        : m_targetCallee(jsDynamicCast&lt;JSObject*&gt;(functionObj))

</del><ins>+        : m_targetCallee(functionObj)

</ins><span class="cx">         , m_result(jsNull())

</span><span class="cx">     {

</span><span class="cx">     }

</span><span class="lines">@@ -266,7 +266,7 @@

</span><span class="cx"> class RetrieveCallerFunctionFunctor {

</span><span class="cx"> public:

</span><span class="cx">     RetrieveCallerFunctionFunctor(JSFunction* functionObj)

</span><del>-        : m_targetCallee(jsDynamicCast&lt;JSObject*&gt;(functionObj))

</del><ins>+        : m_targetCallee(functionObj)

</ins><span class="cx">         , m_hasFoundFrame(false)

</span><span class="cx">         , m_hasSkippedToCallerFrame(false)

</span><span class="cx">         , m_result(jsNull())

</span><span class="lines">@@ -279,7 +279,7 @@

</span><span class="cx">     {

</span><span class="cx">         JSCell* callee = visitor-&gt;callee();

</span><span class="cx"> 

</span><del>-        if (callee &amp;&amp; callee-&gt;inherits(JSBoundFunction::info()))

</del><ins>+        if (callee &amp;&amp; callee-&gt;inherits(*callee-&gt;vm(), JSBoundFunction::info()))

</ins><span class="cx">             return StackVisitor::Continue;

</span><span class="cx"> 

</span><span class="cx">         if (!m_hasFoundFrame &amp;&amp; (callee != m_targetCallee))

</span><span class="lines">@@ -320,9 +320,9 @@

</span><span class="cx">     JSValue caller = retrieveCallerFunction(exec, thisObj);

</span><span class="cx"> 

<span class="cx">     // See ES5.1 15.3.5.4 - Function.caller may not be used to retrieve a strict caller.

</span><del>-    if (!caller.isObject() || !asObject(caller)-&gt;inherits(JSFunction::info())) {

</del><ins>+    if (!caller.isObject() || !asObject(caller)-&gt;inherits(vm, JSFunction::info())) {

</ins><span class="cx">         // It isn't a JSFunction, but if it is a JSCallee from a program or call eval, return null.

</span><del>-        if (jsDynamicCast&lt;JSCallee*&gt;(caller))

</del><ins>+        if (jsDynamicCast&lt;JSCallee*&gt;(vm, caller))

</ins><span class="cx">             return JSValue::encode(jsNull());

</span><span class="cx">         return JSValue::encode(caller);

</span><span class="cx">     }

</span><span class="lines">@@ -388,8 +388,8 @@

</span><span class="cx"> void JSFunction::getOwnNonIndexPropertyNames(JSObject* object, ExecState* exec, PropertyNameArray&amp; propertyNames, EnumerationMode mode)

</span><span class="cx"> {

</span><span class="cx">     JSFunction* thisObject = jsCast&lt;JSFunction*&gt;(object);

</span><ins>+    VM&amp; vm = exec-&gt;vm();

</ins><span class="cx">     if (!thisObject-&gt;isHostOrBuiltinFunction() &amp;&amp; mode.includeDontEnumProperties()) {

</span><del>-        VM&amp; vm = exec-&gt;vm();

</del><span class="cx">         // Make sure prototype has been reified.

</span><span class="cx">         PropertySlot slot(thisObject, PropertySlot::InternalMethodType::VMInquiry);

</span><span class="cx">         thisObject-&gt;methodTable(vm)-&gt;getOwnPropertySlot(thisObject, exec, vm.propertyNames-&gt;prototype, slot);

</span><span class="lines">@@ -402,7 +402,7 @@

</span><span class="cx">             propertyNames.add(vm.propertyNames-&gt;length);

</span><span class="cx">         if (!thisObject-&gt;hasReifiedName())

</span><span class="cx">             propertyNames.add(vm.propertyNames-&gt;name);

</span><del>-    } else if (thisObject-&gt;isHostOrBuiltinFunction() &amp;&amp; mode.includeDontEnumProperties() &amp;&amp; thisObject-&gt;inherits(JSBoundFunction::info()) &amp;&amp; !thisObject-&gt;hasReifiedName())

</del><ins>+    } else if (thisObject-&gt;isHostOrBuiltinFunction() &amp;&amp; mode.includeDontEnumProperties() &amp;&amp; thisObject-&gt;inherits(vm, JSBoundFunction::info()) &amp;&amp; !thisObject-&gt;hasReifiedName())

</ins><span class="cx">         propertyNames.add(exec-&gt;vm().propertyNames-&gt;name);

</span><span class="cx">     Base::getOwnNonIndexPropertyNames(thisObject, exec, propertyNames, mode);

</span><span class="cx"> }

</span><span class="lines">@@ -576,9 +576,9 @@

</span><span class="cx"> 

</span><span class="cx"> String getCalculatedDisplayName(VM&amp; vm, JSObject* object)

</span><span class="cx"> {

</span><del>-    if (JSFunction* function = jsDynamicCast&lt;JSFunction*&gt;(object))

</del><ins>+    if (JSFunction* function = jsDynamicCast&lt;JSFunction*&gt;(vm, object))

</ins><span class="cx">         return function-&gt;calculatedDisplayName(vm);

</span><del>-    if (InternalFunction* function = jsDynamicCast&lt;InternalFunction*&gt;(object))

</del><ins>+    if (InternalFunction* function = jsDynamicCast&lt;InternalFunction*&gt;(vm, object))

</ins><span class="cx">         return function-&gt;calculatedDisplayName(vm);

</span><span class="cx">     return emptyString();

</span><span class="cx"> }

</span><span class="lines">@@ -688,7 +688,7 @@

</span><span class="cx">     if (hasReifiedName())

</span><span class="cx">         return LazyPropertyType::IsLazyProperty;

</span><span class="cx"> 

</span><del>-    if (this-&gt;inherits(JSBoundFunction::info())) {

</del><ins>+    if (this-&gt;inherits(vm, JSBoundFunction::info())) {

</ins><span class="cx">         FunctionRareData* rareData = this-&gt;rareData(vm);

</span><span class="cx">         String name = makeString(&quot;bound &quot;, static_cast&lt;NativeExecutable*&gt;(m_executable.get())-&gt;name());

</span><span class="cx">         unsigned initialAttributes = DontEnum | ReadOnly;

</span></span></pre></div>

<a id="trunkSourceJavaScriptCoreruntimeJSGenericTypedArrayViewh"></a>

<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/JSGenericTypedArrayView.h (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/JavaScriptCore/runtime/JSGenericTypedArrayView.h        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/JavaScriptCore/runtime/JSGenericTypedArrayView.h        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -267,7 +267,7 @@

</span><span class="cx">     static const TypedArrayType TypedArrayStorageType = Adaptor::typeValue;

</span><span class="cx"> 

<span class="cx">     // This is the default DOM unwrapping. It calls toUnsharedNativeTypedView().

</span><del>-    static RefPtr&lt;typename Adaptor::ViewType&gt; toWrapped(JSValue);

</del><ins>+    static RefPtr&lt;typename Adaptor::ViewType&gt; toWrapped(VM&amp;, JSValue);

</ins><span class="cx">     

</span><span class="cx"> protected:

</span><span class="cx">     friend struct TypedArrayClassInfos;

</span><span class="lines">@@ -360,9 +360,9 @@

</span><span class="cx"> };

</span><span class="cx"> 

</span><span class="cx"> template&lt;typename Adaptor&gt;

</span><del>-inline RefPtr&lt;typename Adaptor::ViewType&gt; toPossiblySharedNativeTypedView(JSValue value)

</del><ins>+inline RefPtr&lt;typename Adaptor::ViewType&gt; toPossiblySharedNativeTypedView(VM&amp; vm, JSValue value)

</ins><span class="cx"> {

</span><del>-    typename Adaptor::JSViewType* wrapper = jsDynamicCast&lt;typename Adaptor::JSViewType*&gt;(value);

</del><ins>+    typename Adaptor::JSViewType* wrapper = jsDynamicCast&lt;typename Adaptor::JSViewType*&gt;(vm, value);

</ins><span class="cx">     if (!wrapper)

</span><span class="cx">         return nullptr;

</span><span class="cx">     return wrapper-&gt;possiblySharedTypedImpl();

</span><span class="lines">@@ -369,9 +369,9 @@

</span><span class="cx"> }

</span><span class="cx"> 

</span><span class="cx"> template&lt;typename Adaptor&gt;

</span><del>-inline RefPtr&lt;typename Adaptor::ViewType&gt; toUnsharedNativeTypedView(JSValue value)

</del><ins>+inline RefPtr&lt;typename Adaptor::ViewType&gt; toUnsharedNativeTypedView(VM&amp; vm, JSValue value)

</ins><span class="cx"> {

</span><del>-    RefPtr&lt;typename Adaptor::ViewType&gt; result = toPossiblySharedNativeTypedView&lt;Adaptor&gt;(value);

</del><ins>+    RefPtr&lt;typename Adaptor::ViewType&gt; result = toPossiblySharedNativeTypedView&lt;Adaptor&gt;(vm, value);

</ins><span class="cx">     if (!result || result-&gt;isShared())

</span><span class="cx">         return nullptr;

</span><span class="cx">     return result;

</span><span class="lines">@@ -378,9 +378,9 @@

</span><span class="cx"> }

</span><span class="cx"> 

</span><span class="cx"> template&lt;typename Adaptor&gt;

</span><del>-RefPtr&lt;typename Adaptor::ViewType&gt; JSGenericTypedArrayView&lt;Adaptor&gt;::toWrapped(JSValue value)

</del><ins>+RefPtr&lt;typename Adaptor::ViewType&gt; JSGenericTypedArrayView&lt;Adaptor&gt;::toWrapped(VM&amp; vm, JSValue value)

</ins><span class="cx"> {

</span><del>-    return JSC::toUnsharedNativeTypedView&lt;Adaptor&gt;(value);

</del><ins>+    return JSC::toUnsharedNativeTypedView&lt;Adaptor&gt;(vm, value);

</ins><span class="cx"> }

</span><span class="cx"> 

</span><span class="cx"> } // namespace JSC

</span></span></pre></div>

<a id="trunkSourceJavaScriptCoreruntimeJSGenericTypedArrayViewConstructorInlinesh"></a>

<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/JSGenericTypedArrayViewConstructorInlines.h (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/JavaScriptCore/runtime/JSGenericTypedArrayViewConstructorInlines.h        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/JavaScriptCore/runtime/JSGenericTypedArrayViewConstructorInlines.h        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -122,7 +122,7 @@

</span><span class="cx"> 

</span><span class="cx">     JSValue firstValue = JSValue::decode(firstArgument);

</span><span class="cx"> 

</span><del>-    if (JSArrayBuffer* jsBuffer = jsDynamicCast&lt;JSArrayBuffer*&gt;(firstValue)) {

</del><ins>+    if (JSArrayBuffer* jsBuffer = jsDynamicCast&lt;JSArrayBuffer*&gt;(vm, firstValue)) {

</ins><span class="cx">         RefPtr&lt;ArrayBuffer&gt; buffer = jsBuffer-&gt;impl();

</span><span class="cx">         unsigned length = 0;

</span><span class="cx"> 

</span><span class="lines">@@ -146,10 +146,10 @@

<span class="cx">     // - Another array. This creates a copy of the of that array.

<span class="cx">     // - An integer. This creates a new typed array of that length and zero-initializes it.

</span><span class="cx"> 

</span><del>-    if (JSObject* object = jsDynamicCast&lt;JSObject*&gt;(firstValue)) {

</del><ins>+    if (JSObject* object = jsDynamicCast&lt;JSObject*&gt;(vm, firstValue)) {

</ins><span class="cx">         unsigned length;

</span><span class="cx"> 

</span><del>-        if (isTypedView(object-&gt;classInfo()-&gt;typedArrayStorageType))

</del><ins>+        if (isTypedView(object-&gt;classInfo(vm)-&gt;typedArrayStorageType))

</ins><span class="cx">             length = jsCast&lt;JSArrayBufferView*&gt;(object)-&gt;length();

</span><span class="cx">         else {

<span class="cx">             // This getPropertySlot operation should not be observed by the Proxy.

</span><span class="lines">@@ -238,7 +238,7 @@

</span><span class="cx">     JSValue firstValue = exec-&gt;uncheckedArgument(0);

</span><span class="cx">     unsigned offset = 0;

</span><span class="cx">     std::optional&lt;unsigned&gt; length = std::nullopt;

</span><del>-    if (jsDynamicCast&lt;JSArrayBuffer*&gt;(firstValue) &amp;&amp; argCount &gt; 1) {

</del><ins>+    if (jsDynamicCast&lt;JSArrayBuffer*&gt;(vm, firstValue) &amp;&amp; argCount &gt; 1) {

</ins><span class="cx">         offset = exec-&gt;uncheckedArgument(1).toIndex(exec, &quot;byteOffset&quot;);

</span><span class="cx">         RETURN_IF_EXCEPTION(scope, encodedJSValue());

</span><span class="cx"> 

</span></span></pre></div>

<a id="trunkSourceJavaScriptCoreruntimeJSGenericTypedArrayViewInlinesh"></a>

<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/JSGenericTypedArrayViewInlines.h (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/JavaScriptCore/runtime/JSGenericTypedArrayViewInlines.h        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/JavaScriptCore/runtime/JSGenericTypedArrayViewInlines.h        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -245,7 +245,7 @@

</span><span class="cx">     VM&amp; vm = exec-&gt;vm();

</span><span class="cx">     auto scope = DECLARE_THROW_SCOPE(vm);

</span><span class="cx"> 

</span><del>-    const ClassInfo* ci = object-&gt;classInfo();

</del><ins>+    const ClassInfo* ci = object-&gt;classInfo(vm);

</ins><span class="cx">     if (ci-&gt;typedArrayStorageType == Adaptor::typeValue) {

<span class="cx">         // The super fast case: we can just memcpy since we're the same type.

</span><span class="cx">         JSGenericTypedArrayView* other = jsCast&lt;JSGenericTypedArrayView*&gt;(object);

</span></span></pre></div>

<a id="trunkSourceJavaScriptCoreruntimeJSGenericTypedArrayViewPrototypeFunctionsh"></a>

<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/JSGenericTypedArrayViewPrototypeFunctions.h (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/JavaScriptCore/runtime/JSGenericTypedArrayViewPrototypeFunctions.h        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/JavaScriptCore/runtime/JSGenericTypedArrayViewPrototypeFunctions.h        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -73,7 +73,7 @@

</span><span class="cx">     JSValue result = construct(exec, species, args, &quot;species is not a constructor&quot;);

</span><span class="cx">     RETURN_IF_EXCEPTION(scope, nullptr);

</span><span class="cx"> 

</span><del>-    if (JSArrayBufferView* view = jsDynamicCast&lt;JSArrayBufferView*&gt;(result)) {

</del><ins>+    if (JSArrayBufferView* view = jsDynamicCast&lt;JSArrayBufferView*&gt;(vm, result)) {

</ins><span class="cx">         if (!view-&gt;isNeutered())

</span><span class="cx">             return view;

</span><span class="cx"> 

</span><span class="lines">@@ -123,12 +123,12 @@

</span><span class="cx">     if (UNLIKELY(thisObject-&gt;isNeutered()))

</span><span class="cx">         return throwVMTypeError(exec, scope, typedArrayBufferHasBeenDetachedErrorMessage);

</span><span class="cx"> 

</span><del>-    JSObject* sourceArray = jsDynamicCast&lt;JSObject*&gt;(exec-&gt;uncheckedArgument(0));

</del><ins>+    JSObject* sourceArray = jsDynamicCast&lt;JSObject*&gt;(vm, exec-&gt;uncheckedArgument(0));

</ins><span class="cx">     if (UNLIKELY(!sourceArray))

</span><span class="cx">         return throwVMTypeError(exec, scope, ASCIILiteral(&quot;First argument should be an object&quot;));

</span><span class="cx"> 

</span><span class="cx">     unsigned length;

</span><del>-    if (isTypedView(sourceArray-&gt;classInfo()-&gt;typedArrayStorageType)) {

</del><ins>+    if (isTypedView(sourceArray-&gt;classInfo(vm)-&gt;typedArrayStorageType)) {

</ins><span class="cx">         JSArrayBufferView* sourceView = jsCast&lt;JSArrayBufferView*&gt;(sourceArray);

</span><span class="cx">         if (UNLIKELY(sourceView-&gt;isNeutered()))

</span><span class="cx">             return throwVMTypeError(exec, scope, typedArrayBufferHasBeenDetachedErrorMessage);

</span><span class="lines">@@ -468,7 +468,7 @@

</span><span class="cx"> 

<span class="cx">     // The species constructor may return an array with any arbitrary length.

</span><span class="cx">     length = std::min(length, result-&gt;length());

</span><del>-    switch (result-&gt;classInfo()-&gt;typedArrayStorageType) {

</del><ins>+    switch (result-&gt;classInfo(vm)-&gt;typedArrayStorageType) {

</ins><span class="cx">     case TypeInt8:

</span><span class="cx">         scope.release();

</span><span class="cx">         jsCast&lt;JSInt8Array*&gt;(result)-&gt;set(exec, 0, thisObject, begin, length, CopyType::LeftToRight);

</span><span class="lines">@@ -569,7 +569,7 @@

</span><span class="cx">     JSObject* result = construct(exec, species, args, &quot;species is not a constructor&quot;);

</span><span class="cx">     RETURN_IF_EXCEPTION(scope, encodedJSValue());

</span><span class="cx"> 

</span><del>-    if (jsDynamicCast&lt;JSArrayBufferView*&gt;(result))

</del><ins>+    if (jsDynamicCast&lt;JSArrayBufferView*&gt;(vm, result))

</ins><span class="cx">         return JSValue::encode(result);

</span><span class="cx"> 

</span><span class="cx">     throwTypeError(exec, scope, ASCIILiteral(&quot;species constructor did not return a TypedArray View&quot;));

</span></span></pre></div>

<a id="trunkSourceJavaScriptCoreruntimeJSGenericTypedArrayViewPrototypeInlinesh"></a>

<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/JSGenericTypedArrayViewPrototypeInlines.h (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/JavaScriptCore/runtime/JSGenericTypedArrayViewPrototypeInlines.h        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/JavaScriptCore/runtime/JSGenericTypedArrayViewPrototypeInlines.h        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -41,7 +41,7 @@

</span><span class="cx"> {

</span><span class="cx">     Base::finishCreation(vm);

</span><span class="cx">     

</span><del>-    ASSERT(inherits(info()));

</del><ins>+    ASSERT(inherits(vm, info()));

</ins><span class="cx"> 

</span><span class="cx">     putDirect(vm, vm.propertyNames-&gt;BYTES_PER_ELEMENT, jsNumber(ViewClass::elementSize), DontEnum | ReadOnly | DontDelete);

</span><span class="cx"> 

</span></span></pre></div>

<a id="trunkSourceJavaScriptCoreruntimeJSGlobalObjectcpp"></a>

<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/JSGlobalObject.cpp (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/JavaScriptCore/runtime/JSGlobalObject.cpp        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/JavaScriptCore/runtime/JSGlobalObject.cpp        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -302,7 +302,7 @@

</span><span class="cx"> static EncodedJSValue JSC_HOST_CALL getTemplateObject(ExecState* exec)

</span><span class="cx"> {

</span><span class="cx">     JSValue thisValue = exec-&gt;thisValue();

</span><del>-    ASSERT(thisValue.inherits(JSTemplateRegistryKey::info()));

</del><ins>+    ASSERT(thisValue.inherits(exec-&gt;vm(), JSTemplateRegistryKey::info()));

</ins><span class="cx">     return JSValue::encode(exec-&gt;lexicalGlobalObject()-&gt;templateRegistry().getTemplateObject(exec, jsCast&lt;JSTemplateRegistryKey*&gt;(thisValue)));

</span><span class="cx"> }

</span><span class="cx"> 

</span><span class="lines">@@ -314,7 +314,7 @@

</span><span class="cx"> 

</span><span class="cx">     JSValue job = exec-&gt;argument(0);

</span><span class="cx">     JSValue arguments = exec-&gt;argument(1);

</span><del>-    ASSERT(arguments.inherits(JSArray::info()));

</del><ins>+    ASSERT(arguments.inherits(vm, JSArray::info()));

</ins><span class="cx"> 

</span><span class="cx">     globalObject-&gt;queueMicrotask(createJSJob(vm, job, jsCast&lt;JSArray*&gt;(arguments)));

</span><span class="cx"> 

</span><span class="lines">@@ -924,7 +924,7 @@

</span><span class="cx">             RELEASE_ASSERT(slot.isCacheableValue());

</span><span class="cx">             JSValue functionValue = slot.getValue(exec, ident);

</span><span class="cx">             ASSERT(!catchScope.exception());

</span><del>-            ASSERT(jsDynamicCast&lt;JSFunction*&gt;(functionValue));

</del><ins>+            ASSERT(jsDynamicCast&lt;JSFunction*&gt;(vm, functionValue));

</ins><span class="cx"> 

</span><span class="cx">             ObjectPropertyCondition condition = generateConditionForSelfEquivalence(m_vm, nullptr, base, ident.impl());

</span><span class="cx">             RELEASE_ASSERT(condition.requiredValue() == functionValue);

</span></span></pre></div>

<a id="trunkSourceJavaScriptCoreruntimeJSGlobalObjectFunctionscpp"></a>

<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/JSGlobalObjectFunctions.cpp (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/JavaScriptCore/runtime/JSGlobalObjectFunctions.cpp        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/JavaScriptCore/runtime/JSGlobalObjectFunctions.cpp        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -890,7 +890,7 @@

</span><span class="cx">     if (thisValue.isUndefinedOrNull())

</span><span class="cx">         return throwVMTypeError(exec, scope, ASCIILiteral(ObjectProtoCalledOnNullOrUndefinedError));

</span><span class="cx"> 

</span><del>-    JSObject* thisObject = jsDynamicCast&lt;JSObject*&gt;(thisValue);

</del><ins>+    JSObject* thisObject = jsDynamicCast&lt;JSObject*&gt;(vm, thisValue);

</ins><span class="cx">     if (!thisObject) {

</span><span class="cx">         JSObject* prototype = exec-&gt;thisValue().synthesizePrototype(exec);

</span><span class="cx">         if (UNLIKELY(!prototype))

</span><span class="lines">@@ -912,7 +912,7 @@

</span><span class="cx"> 

</span><span class="cx">     JSValue value = exec-&gt;argument(0);

</span><span class="cx"> 

</span><del>-    JSObject* thisObject = jsDynamicCast&lt;JSObject*&gt;(thisValue);

</del><ins>+    JSObject* thisObject = jsDynamicCast&lt;JSObject*&gt;(vm, thisValue);

</ins><span class="cx"> 

<span class="cx">     // Setting __proto__ of a primitive should have no effect.

</span><span class="cx">     if (!thisObject)

</span></span></pre></div>

<a id="trunkSourceJavaScriptCoreruntimeJSInternalPromiseDeferredcpp"></a>

<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/JSInternalPromiseDeferred.cpp (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/JavaScriptCore/runtime/JSInternalPromiseDeferred.cpp        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/JavaScriptCore/runtime/JSInternalPromiseDeferred.cpp        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -44,7 +44,7 @@

</span><span class="cx">     JSValue deferred = newPromiseCapability(exec, globalObject, globalObject-&gt;internalPromiseConstructor());

</span><span class="cx"> 

</span><span class="cx">     JSValue promise = deferred.get(exec, vm.propertyNames-&gt;builtinNames().promisePrivateName());

</span><del>-    ASSERT(promise.inherits(JSInternalPromise::info()));

</del><ins>+    ASSERT(promise.inherits(vm, JSInternalPromise::info()));

</ins><span class="cx">     JSValue resolve = deferred.get(exec, vm.propertyNames-&gt;builtinNames().resolvePrivateName());

</span><span class="cx">     JSValue reject = deferred.get(exec, vm.propertyNames-&gt;builtinNames().rejectPrivateName());

</span><span class="cx"> 

</span></span></pre></div>

<a id="trunkSourceJavaScriptCoreruntimeJSLexicalEnvironmenth"></a>

<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/JSLexicalEnvironment.h (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/JavaScriptCore/runtime/JSLexicalEnvironment.h        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/JavaScriptCore/runtime/JSLexicalEnvironment.h        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -81,7 +81,7 @@

</span><span class="cx"> 

</span><span class="cx"> inline JSLexicalEnvironment* asActivation(JSValue value)

</span><span class="cx"> {

</span><del>-    ASSERT(asObject(value)-&gt;inherits(JSLexicalEnvironment::info()));

</del><ins>+    ASSERT(asObject(value)-&gt;inherits(*value.getObject()-&gt;vm(), JSLexicalEnvironment::info()));

</ins><span class="cx">     return jsCast&lt;JSLexicalEnvironment*&gt;(asObject(value));

</span><span class="cx"> }

</span><span class="cx">     

</span></span></pre></div>

<a id="trunkSourceJavaScriptCoreruntimeJSModuleLoadercpp"></a>

<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/JSModuleLoader.cpp (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/JavaScriptCore/runtime/JSModuleLoader.cpp        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/JavaScriptCore/runtime/JSModuleLoader.cpp        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -61,7 +61,7 @@

</span><span class="cx">     auto scope = DECLARE_CATCH_SCOPE(vm);

</span><span class="cx"> 

</span><span class="cx">     Base::finishCreation(vm);

</span><del>-    ASSERT(inherits(info()));

</del><ins>+    ASSERT(inherits(vm, info()));

</ins><span class="cx">     JSMap* map = JSMap::create(exec, vm, globalObject-&gt;mapStructure());

</span><span class="cx">     RELEASE_ASSERT(!scope.exception());

</span><span class="cx">     putDirect(vm, Identifier::fromString(&amp;vm, &quot;registry&quot;), map);

</span><span class="lines">@@ -232,7 +232,7 @@

</span><span class="cx">     if (globalObject-&gt;globalObjectMethodTable()-&gt;moduleLoaderEvaluate)

</span><span class="cx">         return globalObject-&gt;globalObjectMethodTable()-&gt;moduleLoaderEvaluate(globalObject, exec, this, key, moduleRecordValue, scriptFetcher);

</span><span class="cx"> 

</span><del>-    JSModuleRecord* moduleRecord = jsDynamicCast&lt;JSModuleRecord*&gt;(moduleRecordValue);

</del><ins>+    JSModuleRecord* moduleRecord = jsDynamicCast&lt;JSModuleRecord*&gt;(exec-&gt;vm(), moduleRecordValue);

</ins><span class="cx">     if (!moduleRecord)

</span><span class="cx">         return jsUndefined();

</span><span class="cx">     return moduleRecord-&gt;evaluate(exec);

</span><span class="lines">@@ -243,7 +243,7 @@

</span><span class="cx">     VM&amp; vm = exec-&gt;vm();

</span><span class="cx">     auto scope = DECLARE_THROW_SCOPE(vm);

</span><span class="cx"> 

</span><del>-    auto* moduleRecord = jsDynamicCast&lt;AbstractModuleRecord*&gt;(moduleRecordValue);

</del><ins>+    auto* moduleRecord = jsDynamicCast&lt;AbstractModuleRecord*&gt;(vm, moduleRecordValue);

</ins><span class="cx">     if (!moduleRecord) {

</span><span class="cx">         throwTypeError(exec, scope);

</span><span class="cx">         return nullptr;

</span></span></pre></div>

<a id="trunkSourceJavaScriptCoreruntimeJSModuleNamespaceObjectcpp"></a>

<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/JSModuleNamespaceObject.cpp (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/JavaScriptCore/runtime/JSModuleNamespaceObject.cpp        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/JavaScriptCore/runtime/JSModuleNamespaceObject.cpp        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -50,7 +50,7 @@

</span><span class="cx">     VM&amp; vm = exec-&gt;vm();

</span><span class="cx">     auto scope = DECLARE_THROW_SCOPE(vm);

</span><span class="cx">     Base::finishCreation(vm);

</span><del>-    ASSERT(inherits(info()));

</del><ins>+    ASSERT(inherits(vm, info()));

</ins><span class="cx"> 

</span><span class="cx">     // http://www.ecma-international.org/ecma-262/6.0/#sec-module-namespace-exotic-objects

</span><span class="cx">     // Quoted from the spec:

</span><span class="lines">@@ -213,7 +213,7 @@

</span><span class="cx">     VM&amp; vm = exec-&gt;vm();

</span><span class="cx">     auto scope = DECLARE_THROW_SCOPE(vm);

</span><span class="cx"> 

</span><del>-    JSModuleNamespaceObject* object = jsDynamicCast&lt;JSModuleNamespaceObject*&gt;(exec-&gt;thisValue());

</del><ins>+    JSModuleNamespaceObject* object = jsDynamicCast&lt;JSModuleNamespaceObject*&gt;(vm, exec-&gt;thisValue());

</ins><span class="cx">     if (!object)

</span><span class="cx">         return throwVMTypeError(exec, scope, ASCIILiteral(&quot;|this| should be a module namespace object&quot;));

</span><span class="cx">     return JSValue::encode(JSPropertyNameIterator::create(exec, exec-&gt;lexicalGlobalObject()-&gt;propertyNameIteratorStructure(), object));

</span></span></pre></div>

<a id="trunkSourceJavaScriptCoreruntimeJSModuleRecordcpp"></a>

<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/JSModuleRecord.cpp (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/JavaScriptCore/runtime/JSModuleRecord.cpp        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/JavaScriptCore/runtime/JSModuleRecord.cpp        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -66,7 +66,7 @@

</span><span class="cx"> void JSModuleRecord::finishCreation(ExecState* exec, VM&amp; vm)

</span><span class="cx"> {

</span><span class="cx">     Base::finishCreation(exec, vm);

</span><del>-    ASSERT(inherits(info()));

</del><ins>+    ASSERT(inherits(vm, info()));

</ins><span class="cx"> }

</span><span class="cx"> 

</span><span class="cx"> void JSModuleRecord::visitChildren(JSCell* cell, SlotVisitor&amp; visitor)

</span></span></pre></div>

<a id="trunkSourceJavaScriptCoreruntimeJSNativeStdFunctioncpp"></a>

<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/JSNativeStdFunction.cpp (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/JavaScriptCore/runtime/JSNativeStdFunction.cpp        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/JavaScriptCore/runtime/JSNativeStdFunction.cpp        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -53,7 +53,7 @@

</span><span class="cx"> void JSNativeStdFunction::finishCreation(VM&amp; vm, NativeExecutable* executable, int length, const String&amp; name, NativeStdFunctionCell* functionCell)

</span><span class="cx"> {

</span><span class="cx">     Base::finishCreation(vm, executable, length, name);

</span><del>-    ASSERT(inherits(info()));

</del><ins>+    ASSERT(inherits(vm, info()));

</ins><span class="cx">     m_functionCell.set(vm, this, functionCell);

</span><span class="cx"> }

</span><span class="cx"> 

</span></span></pre></div>

<a id="trunkSourceJavaScriptCoreruntimeJSONObjectcpp"></a>

<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/JSONObject.cpp (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/JavaScriptCore/runtime/JSONObject.cpp        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/JavaScriptCore/runtime/JSONObject.cpp        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -63,7 +63,7 @@

</span><span class="cx"> void JSONObject::finishCreation(VM&amp; vm)

</span><span class="cx"> {

</span><span class="cx">     Base::finishCreation(vm);

</span><del>-    ASSERT(inherits(info()));

</del><ins>+    ASSERT(inherits(vm, info()));

</ins><span class="cx"> 

</span><span class="cx">     putDirectWithoutTransition(vm, vm.propertyNames-&gt;toStringTagSymbol, jsString(&amp;vm, &quot;JSON&quot;), DontEnum | ReadOnly);

</span><span class="cx"> }

</span><span class="lines">@@ -141,14 +141,15 @@

</span><span class="cx"> 

</span><span class="cx"> static inline JSValue unwrapBoxedPrimitive(ExecState* exec, JSValue value)

</span><span class="cx"> {

</span><ins>+    VM&amp; vm = exec-&gt;vm();

</ins><span class="cx">     if (!value.isObject())

</span><span class="cx">         return value;

</span><span class="cx">     JSObject* object = asObject(value);

</span><del>-    if (object-&gt;inherits(NumberObject::info()))

</del><ins>+    if (object-&gt;inherits(vm, NumberObject::info()))

</ins><span class="cx">         return jsNumber(object-&gt;toNumber(exec));

</span><del>-    if (object-&gt;inherits(StringObject::info()))

</del><ins>+    if (object-&gt;inherits(vm, StringObject::info()))

</ins><span class="cx">         return object-&gt;toString(exec);

</span><del>-    if (object-&gt;inherits(BooleanObject::info()))

</del><ins>+    if (object-&gt;inherits(vm, BooleanObject::info()))

</ins><span class="cx">         return object-&gt;toPrimitive(exec);

</span><span class="cx"> 

<span class="cx">     // Do not unwrap SymbolObject to Symbol. It is not performed in the spec.

</span><span class="lines">@@ -236,7 +237,7 @@

</span><span class="cx">     if (!m_replacer.isObject())

</span><span class="cx">         return;

</span><span class="cx"> 

</span><del>-    if (m_replacer.asObject()-&gt;inherits(JSArray::info())) {

</del><ins>+    if (m_replacer.asObject()-&gt;inherits(vm, JSArray::info())) {

</ins><span class="cx">         m_usingArrayReplacer = true;

</span><span class="cx">         Handle&lt;JSObject&gt; array = m_replacer.asObject();

</span><span class="cx">         unsigned length = array-&gt;get(exec, vm.propertyNames-&gt;length).toUInt32(exec);

</span><span class="lines">@@ -248,7 +249,7 @@

</span><span class="cx">                 break;

</span><span class="cx"> 

</span><span class="cx">             if (name.isObject()) {

</span><del>-                if (!asObject(name)-&gt;inherits(NumberObject::info()) &amp;&amp; !asObject(name)-&gt;inherits(StringObject::info()))

</del><ins>+                if (!asObject(name)-&gt;inherits(vm, NumberObject::info()) &amp;&amp; !asObject(name)-&gt;inherits(vm, StringObject::info()))

</ins><span class="cx">                     continue;

</span><span class="cx">             } else if (!name.isNumber() &amp;&amp; !name.isString())

</span><span class="cx">                 continue;

</span><span class="lines">@@ -642,7 +643,7 @@

</span><span class="cx">             arrayStartState:

</span><span class="cx">             case ArrayStartState: {

</span><span class="cx">                 ASSERT(inValue.isObject());

</span><del>-                ASSERT(isJSArray(asObject(inValue)) || asObject(inValue)-&gt;inherits(JSArray::info()));

</del><ins>+                ASSERT(isJSArray(asObject(inValue)) || asObject(inValue)-&gt;inherits(vm, JSArray::info()));

</ins><span class="cx">                 if (objectStack.size() + arrayStack.size() &gt; maximumFilterRecursion)

</span><span class="cx">                     return throwStackOverflowError(m_exec, scope);

</span><span class="cx"> 

</span><span class="lines">@@ -697,7 +698,7 @@

</span><span class="cx">             objectStartState:

</span><span class="cx">             case ObjectStartState: {

</span><span class="cx">                 ASSERT(inValue.isObject());

</span><del>-                ASSERT(!isJSArray(asObject(inValue)) &amp;&amp; !asObject(inValue)-&gt;inherits(JSArray::info()));

</del><ins>+                ASSERT(!isJSArray(asObject(inValue)) &amp;&amp; !asObject(inValue)-&gt;inherits(vm, JSArray::info()));

</ins><span class="cx">                 if (objectStack.size() + arrayStack.size() &gt; maximumFilterRecursion)

</span><span class="cx">                     return throwStackOverflowError(m_exec, scope);

</span><span class="cx"> 

</span><span class="lines">@@ -758,7 +759,7 @@

</span><span class="cx">                     break;

</span><span class="cx">                 }

</span><span class="cx">                 JSObject* object = asObject(inValue);

</span><del>-                if (isJSArray(object) || object-&gt;inherits(JSArray::info()))

</del><ins>+                if (isJSArray(object) || object-&gt;inherits(vm, JSArray::info()))

</ins><span class="cx">                     goto arrayStartState;

</span><span class="cx">                 goto objectStartState;

</span><span class="cx">         }

</span></span></pre></div>

<a id="trunkSourceJavaScriptCoreruntimeJSObjectcpp"></a>

<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/JSObject.cpp (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/JavaScriptCore/runtime/JSObject.cpp        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/JavaScriptCore/runtime/JSObject.cpp        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -511,7 +511,7 @@

</span><span class="cx"> 

</span><span class="cx"> String JSObject::className(const JSObject* object)

</span><span class="cx"> {

</span><del>-    const ClassInfo* info = object-&gt;classInfo();

</del><ins>+    const ClassInfo* info = object-&gt;classInfo(*object-&gt;vm());

</ins><span class="cx">     ASSERT(info);

</span><span class="cx">     return info-&gt;className;

</span><span class="cx"> }

</span><span class="lines">@@ -518,7 +518,7 @@

</span><span class="cx"> 

</span><span class="cx"> String JSObject::toStringName(const JSObject* object, ExecState*)

</span><span class="cx"> {

</span><del>-    const ClassInfo* info = object-&gt;classInfo();

</del><ins>+    const ClassInfo* info = object-&gt;classInfo(*object-&gt;vm());

</ins><span class="cx">     ASSERT(info);

</span><span class="cx">     return info-&gt;methodTable.className(object);

</span><span class="cx"> }

</span><span class="lines">@@ -539,9 +539,9 @@

</span><span class="cx">             if (constructorValue.isCell()) {

</span><span class="cx">                 if (JSCell* constructorCell = constructorValue.asCell()) {

</span><span class="cx">                     if (JSObject* ctorObject = constructorCell-&gt;getObject()) {

</span><del>-                        if (JSFunction* constructorFunction = jsDynamicCast&lt;JSFunction*&gt;(ctorObject))

</del><ins>+                        if (JSFunction* constructorFunction = jsDynamicCast&lt;JSFunction*&gt;(vm, ctorObject))

</ins><span class="cx">                             prototypeFunctionName = constructorFunction-&gt;calculatedDisplayName(vm);

</span><del>-                        else if (InternalFunction* constructorFunction = jsDynamicCast&lt;InternalFunction*&gt;(ctorObject))

</del><ins>+                        else if (InternalFunction* constructorFunction = jsDynamicCast&lt;InternalFunction*&gt;(vm, ctorObject))

</ins><span class="cx">                             prototypeFunctionName = constructorFunction-&gt;calculatedDisplayName(vm);

</span><span class="cx">                     }

</span><span class="cx">                 }

</span><span class="lines">@@ -557,7 +557,7 @@

</span><span class="cx">         if (!tableClassName.isNull() &amp;&amp; tableClassName != &quot;Object&quot;)

</span><span class="cx">             return tableClassName;

</span><span class="cx"> 

</span><del>-        String classInfoName = object-&gt;classInfo()-&gt;className;

</del><ins>+        String classInfoName = object-&gt;classInfo(vm)-&gt;className;

</ins><span class="cx">         if (!classInfoName.isNull())

</span><span class="cx">             return classInfoName;

</span><span class="cx"> 

</span><span class="lines">@@ -790,8 +790,8 @@

</span><span class="cx">             break;

</span><span class="cx">         }

</span><span class="cx">         if (!obj-&gt;staticPropertiesReified()) {

</span><del>-            if (obj-&gt;classInfo()-&gt;hasStaticSetterOrReadonlyProperties()) {

-                if (auto* entry = obj-&gt;findPropertyHashEntry(propertyName))

</del><ins>+            if (obj-&gt;classInfo(vm)-&gt;hasStaticSetterOrReadonlyProperties()) {

+                if (auto* entry = obj-&gt;findPropertyHashEntry(vm, propertyName))

</ins><span class="cx">                     return putEntry(exec, entry, obj, this, propertyName, value, slot);

</span><span class="cx">             }

</span><span class="cx">         }

</span><span class="lines">@@ -1426,7 +1426,7 @@

</span><span class="cx"> 

</span><span class="cx"> ContiguousJSValues JSObject::ensureInt32Slow(VM&amp; vm)

</span><span class="cx"> {

</span><del>-    ASSERT(inherits(info()));

</del><ins>+    ASSERT(inherits(vm, info()));

</ins><span class="cx">     

</span><span class="cx">     if (structure(vm)-&gt;hijacksIndexingHeader())

</span><span class="cx">         return ContiguousJSValues();

</span><span class="lines">@@ -1453,7 +1453,7 @@

</span><span class="cx"> 

</span><span class="cx"> ContiguousDoubles JSObject::ensureDoubleSlow(VM&amp; vm)

</span><span class="cx"> {

</span><del>-    ASSERT(inherits(info()));

</del><ins>+    ASSERT(inherits(vm, info()));

</ins><span class="cx">     

</span><span class="cx">     if (structure(vm)-&gt;hijacksIndexingHeader())

</span><span class="cx">         return ContiguousDoubles();

</span><span class="lines">@@ -1482,7 +1482,7 @@

</span><span class="cx"> 

</span><span class="cx"> ContiguousJSValues JSObject::ensureContiguousSlow(VM&amp; vm)

</span><span class="cx"> {

</span><del>-    ASSERT(inherits(info()));

</del><ins>+    ASSERT(inherits(vm, info()));

</ins><span class="cx">     

</span><span class="cx">     if (structure(vm)-&gt;hijacksIndexingHeader())

</span><span class="cx">         return ContiguousJSValues();

</span><span class="lines">@@ -1513,7 +1513,7 @@

</span><span class="cx"> 

</span><span class="cx"> ArrayStorage* JSObject::ensureArrayStorageSlow(VM&amp; vm)

</span><span class="cx"> {

</span><del>-    ASSERT(inherits(info()));

</del><ins>+    ASSERT(inherits(vm, info()));

</ins><span class="cx"> 

</span><span class="cx">     if (structure(vm)-&gt;hijacksIndexingHeader())

</span><span class="cx">         return nullptr;

</span><span class="lines">@@ -1790,7 +1790,7 @@

</span><span class="cx">     unsigned attributes;

</span><span class="cx"> 

</span><span class="cx">     if (!thisObject-&gt;staticPropertiesReified()) {

</span><del>-        if (auto* entry = thisObject-&gt;findPropertyHashEntry(propertyName)) {

</del><ins>+        if (auto* entry = thisObject-&gt;findPropertyHashEntry(vm, propertyName)) {

</ins><span class="cx">             // If the static table contains a non-configurable (DontDelete) property then we can return early;

</span><span class="cx">             // if there is a property in the storage array it too must be non-configurable (the language does

<span class="cx">             // not allow repacement of a non-configurable property with a configurable one).

</span><span class="lines">@@ -1979,7 +1979,7 @@

</span><span class="cx"> 

</span><span class="cx"> bool JSObject::getOwnStaticPropertySlot(VM&amp; vm, PropertyName propertyName, PropertySlot&amp; slot)

</span><span class="cx"> {

</span><del>-    for (auto* info = classInfo(); info; info = info-&gt;parentClass) {

</del><ins>+    for (auto* info = classInfo(vm); info; info = info-&gt;parentClass) {

</ins><span class="cx">         if (auto* table = info-&gt;staticPropHashTable) {

</span><span class="cx">             if (getStaticPropertySlotFromTable(vm, *table, this, propertyName, slot))

</span><span class="cx">                 return true;

</span><span class="lines">@@ -1988,9 +1988,9 @@

</span><span class="cx">     return false;

</span><span class="cx"> }

</span><span class="cx"> 

</span><del>-const HashTableValue* JSObject::findPropertyHashEntry(PropertyName propertyName) const

</del><ins>+const HashTableValue* JSObject::findPropertyHashEntry(VM&amp; vm, PropertyName propertyName) const

</ins><span class="cx"> {

</span><del>-    for (const ClassInfo* info = classInfo(); info; info = info-&gt;parentClass) {

</del><ins>+    for (const ClassInfo* info = classInfo(vm); info; info = info-&gt;parentClass) {

</ins><span class="cx">         if (const HashTable* propHashTable = info-&gt;staticPropHashTable) {

</span><span class="cx">             if (const HashTableValue* entry = propHashTable-&gt;entry(propertyName))

</span><span class="cx">                 return entry;

</span><span class="lines">@@ -2175,13 +2175,13 @@

</span><span class="cx"> 

</span><span class="cx"> void JSObject::getOwnNonIndexPropertyNames(JSObject* object, ExecState* exec, PropertyNameArray&amp; propertyNames, EnumerationMode mode)

</span><span class="cx"> {

</span><ins>+    VM&amp; vm = exec-&gt;vm();

</ins><span class="cx">     if (!object-&gt;staticPropertiesReified())

</span><del>-        getClassPropertyNames(exec, object-&gt;classInfo(), propertyNames, mode);

</del><ins>+        getClassPropertyNames(exec, object-&gt;classInfo(vm), propertyNames, mode);

</ins><span class="cx"> 

</span><span class="cx">     if (!mode.includeJSObjectProperties())

</span><span class="cx">         return;

</span><span class="cx">     

</span><del>-    VM&amp; vm = exec-&gt;vm();

</del><span class="cx">     object-&gt;structure(vm)-&gt;getPropertyNamesFromStructure(vm, propertyNames, mode);

</span><span class="cx"> }

</span><span class="cx"> 

</span><span class="lines">@@ -2265,7 +2265,7 @@

</span><span class="cx">     if (!structure(vm)-&gt;isDictionary())

</span><span class="cx">         setStructure(vm, Structure::toCacheableDictionaryTransition(vm, structure(vm)));

</span><span class="cx"> 

</span><del>-    for (const ClassInfo* info = classInfo(); info; info = info-&gt;parentClass) {

</del><ins>+    for (const ClassInfo* info = classInfo(vm); info; info = info-&gt;parentClass) {

</ins><span class="cx">         const HashTable* hashTable = info-&gt;staticPropHashTable;

</span><span class="cx">         if (!hashTable)

</span><span class="cx">             continue;

</span><span class="lines">@@ -3182,8 +3182,9 @@

</span><span class="cx"> 

</span><span class="cx"> bool JSObject::getOwnPropertyDescriptor(ExecState* exec, PropertyName propertyName, PropertyDescriptor&amp; descriptor)

</span><span class="cx"> {

</span><ins>+    VM&amp; vm = exec-&gt;vm();

</ins><span class="cx">     JSC::PropertySlot slot(this, PropertySlot::InternalMethodType::GetOwnProperty);

</span><del>-    if (!methodTable(exec-&gt;vm())-&gt;getOwnPropertySlot(this, exec, propertyName, slot))

</del><ins>+    if (!methodTable(vm)-&gt;getOwnPropertySlot(this, exec, propertyName, slot))

</ins><span class="cx">         return false;

</span><span class="cx"> 

</span><span class="cx">     // DebuggerScope::getOwnPropertySlot() (and possibly others) may return attributes from the prototype chain

</span><span class="lines">@@ -3190,10 +3191,10 @@

</span><span class="cx">     // but getOwnPropertyDescriptor() should only work for 'own' properties so we exit early if we detect that

<span class="cx">     // the property is not an own property.

</span><span class="cx">     if (slot.slotBase() != this &amp;&amp; slot.slotBase()) {

</span><del>-        JSProxy* jsProxy = jsDynamicCast&lt;JSProxy*&gt;(this);

</del><ins>+        JSProxy* jsProxy = jsDynamicCast&lt;JSProxy*&gt;(vm, this);

</ins><span class="cx">         if (!jsProxy || jsProxy-&gt;target() != slot.slotBase()) {

<span class="cx">             // Try ProxyObject.

</span><del>-            ProxyObject* proxyObject = jsDynamicCast&lt;ProxyObject*&gt;(this);

</del><ins>+            ProxyObject* proxyObject = jsDynamicCast&lt;ProxyObject*&gt;(vm, this);

</ins><span class="cx">             if (!proxyObject || proxyObject-&gt;target() != slot.slotBase())

</span><span class="cx">                 return false;

</span><span class="cx">         }

</span><span class="lines">@@ -3205,7 +3206,7 @@

</span><span class="cx">         descriptor.setCustomDescriptor(slot.attributes());

</span><span class="cx"> 

</span><span class="cx">         JSObject* thisObject = this;

</span><del>-        if (auto* proxy = jsDynamicCast&lt;JSProxy*&gt;(this))

</del><ins>+        if (auto* proxy = jsDynamicCast&lt;JSProxy*&gt;(vm, this))

</ins><span class="cx">             thisObject = proxy-&gt;target();

</span><span class="cx"> 

</span><span class="cx">         CustomGetterSetter* getterSetter;

</span><span class="lines">@@ -3219,7 +3220,7 @@

</span><span class="cx">             }

</span><span class="cx"> 

</span><span class="cx">             ASSERT(maybeGetterSetter);

</span><del>-            getterSetter = jsDynamicCast&lt;CustomGetterSetter*&gt;(maybeGetterSetter);

</del><ins>+            getterSetter = jsDynamicCast&lt;CustomGetterSetter*&gt;(vm, maybeGetterSetter);

</ins><span class="cx">         }

</span><span class="cx">         ASSERT(getterSetter);

</span><span class="cx">         if (!getterSetter)

</span></span></pre></div>

<a id="trunkSourceJavaScriptCoreruntimeJSObjecth"></a>

<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/JSObject.h (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/JavaScriptCore/runtime/JSObject.h        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/JavaScriptCore/runtime/JSObject.h        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -858,10 +858,10 @@

</span><span class="cx">     void finishCreation(VM&amp; vm)

</span><span class="cx">     {

</span><span class="cx">         Base::finishCreation(vm);

</span><del>-        ASSERT(inherits(info()));

</del><ins>+        ASSERT(inherits(vm, info()));

</ins><span class="cx">         ASSERT(getPrototypeDirect().isNull() || Heap::heap(this) == Heap::heap(getPrototypeDirect()));

</span><span class="cx">         ASSERT(structure()-&gt;isObject());

</span><del>-        ASSERT(classInfo());

</del><ins>+        ASSERT(classInfo(vm));

</ins><span class="cx">     }

</span><span class="cx"> 

</span><span class="cx">     static Structure* createStructure(VM&amp; vm, JSGlobalObject* globalObject, JSValue prototype)

</span><span class="lines">@@ -1006,7 +1006,7 @@

</span><span class="cx">     void fillCustomGetterPropertySlot(PropertySlot&amp;, JSValue, unsigned, Structure*);

</span><span class="cx"> 

</span><span class="cx">     JS_EXPORT_PRIVATE bool getOwnStaticPropertySlot(VM&amp;, PropertyName, PropertySlot&amp;);

</span><del>-    JS_EXPORT_PRIVATE const HashTableValue* findPropertyHashEntry(PropertyName) const;

</del><ins>+    JS_EXPORT_PRIVATE const HashTableValue* findPropertyHashEntry(VM&amp;, PropertyName) const;

</ins><span class="cx">         

</span><span class="cx">     bool putIndexedDescriptor(ExecState*, SparseArrayEntry*, const PropertyDescriptor&amp;, PropertyDescriptor&amp; old);

</span><span class="cx">         

</span><span class="lines">@@ -1064,7 +1064,7 @@

</span><span class="cx">     {

</span><span class="cx">         Base::finishCreation(vm);

</span><span class="cx">         ASSERT(!this-&gt;structure()-&gt;hasInlineStorage());

</span><del>-        ASSERT(classInfo());

</del><ins>+        ASSERT(classInfo(vm));

</ins><span class="cx">     }

</span><span class="cx"> };

</span><span class="cx"> 

</span><span class="lines">@@ -1117,7 +1117,7 @@

</span><span class="cx">     {

</span><span class="cx">         Base::finishCreation(vm);

</span><span class="cx">         ASSERT(structure()-&gt;totalStorageCapacity() == structure()-&gt;inlineCapacity());

</span><del>-        ASSERT(classInfo());

</del><ins>+        ASSERT(classInfo(vm));

</ins><span class="cx">     }

</span><span class="cx"> 

</span><span class="cx"> private:

</span></span></pre></div>

<a id="trunkSourceJavaScriptCoreruntimeJSPromiseDeferredcpp"></a>

<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/JSPromiseDeferred.cpp (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/JavaScriptCore/runtime/JSPromiseDeferred.cpp        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/JavaScriptCore/runtime/JSPromiseDeferred.cpp        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -60,7 +60,7 @@

</span><span class="cx">     RETURN_IF_EXCEPTION(scope, nullptr);

</span><span class="cx"> 

</span><span class="cx">     JSValue promise = deferred.get(exec, vm.propertyNames-&gt;builtinNames().promisePrivateName());

</span><del>-    ASSERT(promise.inherits(JSPromise::info()));

</del><ins>+    ASSERT(promise.inherits(vm, JSPromise::info()));

</ins><span class="cx">     JSValue resolve = deferred.get(exec, vm.propertyNames-&gt;builtinNames().resolvePrivateName());

</span><span class="cx">     JSValue reject = deferred.get(exec, vm.propertyNames-&gt;builtinNames().rejectPrivateName());

</span><span class="cx"> 

</span></span></pre></div>

<a id="trunkSourceJavaScriptCoreruntimeJSPropertyNameIteratorcpp"></a>

<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/JSPropertyNameIterator.cpp (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/JavaScriptCore/runtime/JSPropertyNameIterator.cpp        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/JavaScriptCore/runtime/JSPropertyNameIterator.cpp        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -73,7 +73,7 @@

</span><span class="cx"> void JSPropertyNameIterator::finishCreation(VM&amp; vm, JSGlobalObject* globalObject)

</span><span class="cx"> {

</span><span class="cx">     Base::finishCreation(vm);

</span><del>-    ASSERT(inherits(info()));

</del><ins>+    ASSERT(inherits(vm, info()));

</ins><span class="cx">     JSC_NATIVE_FUNCTION(vm.propertyNames-&gt;next, propertyNameIteratorFuncNext, DontEnum, 0);

</span><span class="cx"> }

</span><span class="cx"> 

</span><span class="lines">@@ -143,7 +143,7 @@

</span><span class="cx">     VM&amp; vm = exec-&gt;vm();

</span><span class="cx">     auto scope = DECLARE_THROW_SCOPE(vm);

</span><span class="cx"> 

</span><del>-    JSPropertyNameIterator* iterator = jsDynamicCast&lt;JSPropertyNameIterator*&gt;(exec-&gt;thisValue());

</del><ins>+    JSPropertyNameIterator* iterator = jsDynamicCast&lt;JSPropertyNameIterator*&gt;(vm, exec-&gt;thisValue());

</ins><span class="cx">     if (!iterator)

</span><span class="cx">         return JSValue::encode(throwTypeError(exec, scope, ASCIILiteral(&quot;Cannot call PropertyNameIterator.next() on a non-PropertyNameIterator object&quot;)));

</span><span class="cx"> 

</span></span></pre></div>

<a id="trunkSourceJavaScriptCoreruntimeJSScopecpp"></a>

<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/JSScope.cpp (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/JavaScriptCore/runtime/JSScope.cpp        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/JavaScriptCore/runtime/JSScope.cpp        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -350,9 +350,9 @@

</span><span class="cx">     return nullptr;

</span><span class="cx"> }

</span><span class="cx"> 

</span><del>-SymbolTable* JSScope::symbolTable()

</del><ins>+SymbolTable* JSScope::symbolTable(VM&amp; vm)

</ins><span class="cx"> {

</span><del>-    if (JSSymbolTableObject* symbolTableObject = jsDynamicCast&lt;JSSymbolTableObject*&gt;(this))

</del><ins>+    if (JSSymbolTableObject* symbolTableObject = jsDynamicCast&lt;JSSymbolTableObject*&gt;(vm, this))

</ins><span class="cx">         return symbolTableObject-&gt;symbolTable();

</span><span class="cx"> 

</span><span class="cx">     return nullptr;

</span></span></pre></div>

<a id="trunkSourceJavaScriptCoreruntimeJSScopeh"></a>

<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/JSScope.h (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/JavaScriptCore/runtime/JSScope.h        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/JavaScriptCore/runtime/JSScope.h        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -71,7 +71,7 @@

</span><span class="cx">     JSGlobalObject* globalObject(VM&amp;);

</span><span class="cx">     JSObject* globalThis();

</span><span class="cx"> 

</span><del>-    SymbolTable* symbolTable();

</del><ins>+    SymbolTable* symbolTable(VM&amp;);

</ins><span class="cx"> 

</span><span class="cx"> protected:

</span><span class="cx">     JSScope(VM&amp;, Structure*, JSScope* next);

</span></span></pre></div>

<a id="trunkSourceJavaScriptCoreruntimeJSStringcpp"></a>

<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/JSString.cpp (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/JavaScriptCore/runtime/JSString.cpp        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/JavaScriptCore/runtime/JSString.cpp        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -57,8 +57,9 @@

</span><span class="cx"> 

</span><span class="cx"> void JSString::dumpToStream(const JSCell* cell, PrintStream&amp; out)

</span><span class="cx"> {

</span><ins>+    VM&amp; vm = *cell-&gt;vm();

</ins><span class="cx">     const JSString* thisObject = jsCast&lt;const JSString*&gt;(cell);

</span><del>-    out.printf(&quot;&lt;%p, %s, [%u], &quot;, thisObject, thisObject-&gt;className(), thisObject-&gt;length());

</del><ins>+    out.printf(&quot;&lt;%p, %s, [%u], &quot;, thisObject, thisObject-&gt;className(vm), thisObject-&gt;length());

</ins><span class="cx">     if (thisObject-&gt;isRope())

</span><span class="cx">         out.printf(&quot;[rope]&quot;);

</span><span class="cx">     else {

</span></span></pre></div>

<a id="trunkSourceJavaScriptCoreruntimeJSStringIteratorcpp"></a>

<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/JSStringIterator.cpp (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/JavaScriptCore/runtime/JSStringIterator.cpp        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/JavaScriptCore/runtime/JSStringIterator.cpp        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -37,7 +37,7 @@

</span><span class="cx"> void JSStringIterator::finishCreation(VM&amp; vm, JSGlobalObject*, JSString* iteratedString)

</span><span class="cx"> {

</span><span class="cx">     Base::finishCreation(vm);

</span><del>-    ASSERT(inherits(info()));

</del><ins>+    ASSERT(inherits(vm, info()));

</ins><span class="cx">     putDirect(vm, vm.propertyNames-&gt;builtinNames().iteratedStringPrivateName(), iteratedString);

</span><span class="cx">     putDirect(vm, vm.propertyNames-&gt;builtinNames().stringIteratorNextIndexPrivateName(), jsNumber(0));

</span><span class="cx"> }

</span></span></pre></div>

<a id="trunkSourceJavaScriptCoreruntimeJSTypedArrayViewPrototypecpp"></a>

<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/JSTypedArrayViewPrototype.cpp (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/JavaScriptCore/runtime/JSTypedArrayViewPrototype.cpp        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/JavaScriptCore/runtime/JSTypedArrayViewPrototype.cpp        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -38,7 +38,7 @@

</span><span class="cx"> namespace JSC {

</span><span class="cx"> 

</span><span class="cx"> #define CALL_GENERIC_TYPEDARRAY_PROTOTYPE_FUNCTION(functionName) do {                           \

</span><del>-    switch (thisValue.getObject()-&gt;classInfo()-&gt;typedArrayStorageType) {                        \

</del><ins>+    switch (thisValue.getObject()-&gt;classInfo(vm)-&gt;typedArrayStorageType) {                        \

</ins><span class="cx">     case TypeUint8Clamped:                                                                      \

</span><span class="cx">         return functionName&lt;JSUint8ClampedArray&gt;(vm, exec);                                     \

</span><span class="cx">     case TypeInt32:                                                                             \

</span><span class="lines">@@ -68,7 +68,7 @@

</span><span class="cx"> EncodedJSValue JSC_HOST_CALL typedArrayViewPrivateFuncIsTypedArrayView(ExecState* exec)

</span><span class="cx"> {

</span><span class="cx">     JSValue value = exec-&gt;uncheckedArgument(0);

</span><del>-    return JSValue::encode(jsBoolean(value.isCell() &amp;&amp; isTypedView(value.asCell()-&gt;classInfo()-&gt;typedArrayStorageType)));

</del><ins>+    return JSValue::encode(jsBoolean(value.isCell() &amp;&amp; isTypedView(value.asCell()-&gt;classInfo(exec-&gt;vm())-&gt;typedArrayStorageType)));

</ins><span class="cx"> }

</span><span class="cx"> 

</span><span class="cx"> EncodedJSValue JSC_HOST_CALL typedArrayViewPrivateFuncLength(ExecState* exec)

</span><span class="lines">@@ -76,7 +76,7 @@

</span><span class="cx">     VM&amp; vm = exec-&gt;vm();

</span><span class="cx">     auto scope = DECLARE_THROW_SCOPE(vm);

</span><span class="cx">     JSValue argument = exec-&gt;argument(0);

</span><del>-    if (!argument.isCell() || !isTypedView(argument.asCell()-&gt;classInfo()-&gt;typedArrayStorageType))

</del><ins>+    if (!argument.isCell() || !isTypedView(argument.asCell()-&gt;classInfo(vm)-&gt;typedArrayStorageType))

</ins><span class="cx">         return throwVMTypeError(exec, scope, ASCIILiteral(&quot;Receiver should be a typed array view&quot;));

</span><span class="cx"> 

</span><span class="cx">     JSArrayBufferView* thisObject = jsCast&lt;JSArrayBufferView*&gt;(argument);

</span><span class="lines">@@ -89,8 +89,9 @@

</span><span class="cx"> 

</span><span class="cx"> EncodedJSValue JSC_HOST_CALL typedArrayViewPrivateFuncGetOriginalConstructor(ExecState* exec)

</span><span class="cx"> {

</span><ins>+    VM&amp; vm = exec-&gt;vm();

</ins><span class="cx">     JSGlobalObject* globalObject = exec-&gt;lexicalGlobalObject();

</span><del>-    TypedArrayType type = exec-&gt;uncheckedArgument(0).getObject()-&gt;classInfo()-&gt;typedArrayStorageType;

</del><ins>+    TypedArrayType type = exec-&gt;uncheckedArgument(0).getObject()-&gt;classInfo(vm)-&gt;typedArrayStorageType;

</ins><span class="cx">     ASSERT(isTypedView(type));

</span><span class="cx">     return JSValue::encode(globalObject-&gt;typedArrayConstructor(type));

</span><span class="cx"> }

</span><span class="lines">@@ -254,7 +255,7 @@

</span><span class="cx">         return JSValue::encode(jsUndefined());

</span><span class="cx"> 

</span><span class="cx">     VM&amp; vm = exec-&gt;vm();

</span><del>-    switch (thisValue.getObject()-&gt;classInfo()-&gt;typedArrayStorageType) {

</del><ins>+    switch (thisValue.getObject()-&gt;classInfo(vm)-&gt;typedArrayStorageType) {

</ins><span class="cx">     case TypeUint8Clamped:

</span><span class="cx">         return JSValue::encode(jsString(&amp;vm, &quot;Uint8ClampedArray&quot;));

</span><span class="cx">     case TypeInt32:

</span><span class="lines">@@ -292,7 +293,7 @@

</span><span class="cx"> {

</span><span class="cx">     Base::finishCreation(vm);

</span><span class="cx"> 

</span><del>-    ASSERT(inherits(info()));

</del><ins>+    ASSERT(inherits(vm, info()));

</ins><span class="cx"> 

</span><span class="cx">     putDirectWithoutTransition(vm, vm.propertyNames-&gt;toString, globalObject-&gt;arrayProtoToStringFunction(), DontEnum);

</span><span class="cx"> 

</span></span></pre></div>

<a id="trunkSourceJavaScriptCoreruntimeLazyClassStructurecpp"></a>

<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/LazyClassStructure.cpp (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/JavaScriptCore/runtime/LazyClassStructure.cpp        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/JavaScriptCore/runtime/LazyClassStructure.cpp        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -77,9 +77,9 @@

</span><span class="cx"> void LazyClassStructure::Initializer::setConstructor(JSObject* constructor)

</span><span class="cx"> {

</span><span class="cx">     String name;

</span><del>-    if (InternalFunction* internalFunction = jsDynamicCast&lt;InternalFunction*&gt;(constructor))

</del><ins>+    if (InternalFunction* internalFunction = jsDynamicCast&lt;InternalFunction*&gt;(vm, constructor))

</ins><span class="cx">         name = internalFunction-&gt;name();

</span><del>-    else if (JSFunction* function = jsDynamicCast&lt;JSFunction*&gt;(constructor))

</del><ins>+    else if (JSFunction* function = jsDynamicCast&lt;JSFunction*&gt;(vm, constructor))

</ins><span class="cx">         name = function-&gt;name(vm);

</span><span class="cx">     else

</span><span class="cx">         RELEASE_ASSERT_NOT_REACHED();

</span></span></pre></div>

<a id="trunkSourceJavaScriptCoreruntimeLookuph"></a>

<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/Lookup.h (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/JavaScriptCore/runtime/Lookup.h        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/JavaScriptCore/runtime/Lookup.h        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -269,7 +269,7 @@

</span><span class="cx">         if (!(entry-&gt;attributes() &amp; ReadOnly)) {

</span><span class="cx">             // If this is a function or lazy property put then we just do the put because

<span class="cx">             // logically the object already had the property, so this is just a replace.

</span><del>-            if (JSObject* thisObject = jsDynamicCast&lt;JSObject*&gt;(thisValue))

</del><ins>+            if (JSObject* thisObject = jsDynamicCast&lt;JSObject*&gt;(vm, thisValue))

</ins><span class="cx">                 thisObject-&gt;putDirect(vm, propertyName, value);

</span><span class="cx">             return true;

</span><span class="cx">         }

</span></span></pre></div>

<a id="trunkSourceJavaScriptCoreruntimeMapConstructorcpp"></a>

<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/MapConstructor.cpp (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/JavaScriptCore/runtime/MapConstructor.cpp        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/JavaScriptCore/runtime/MapConstructor.cpp        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -41,7 +41,7 @@

</span><span class="cx"> 

</span><span class="cx"> void MapConstructor::finishCreation(VM&amp; vm, MapPrototype* mapPrototype, GetterSetter* speciesSymbol)

</span><span class="cx"> {

</span><del>-    Base::finishCreation(vm, mapPrototype-&gt;classInfo()-&gt;className);

</del><ins>+    Base::finishCreation(vm, mapPrototype-&gt;classInfo(vm)-&gt;className);

</ins><span class="cx">     putDirectWithoutTransition(vm, vm.propertyNames-&gt;prototype, mapPrototype, DontEnum | DontDelete | ReadOnly);

</span><span class="cx">     putDirectWithoutTransition(vm, vm.propertyNames-&gt;length, jsNumber(0), DontEnum | ReadOnly);

</span><span class="cx">     putDirectNonIndexAccessor(vm, vm.propertyNames-&gt;speciesSymbol, speciesSymbol, Accessor | ReadOnly | DontEnum);

</span></span></pre></div>

<a id="trunkSourceJavaScriptCoreruntimeMapIteratorPrototypecpp"></a>

<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/MapIteratorPrototype.cpp (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/JavaScriptCore/runtime/MapIteratorPrototype.cpp        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/JavaScriptCore/runtime/MapIteratorPrototype.cpp        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -39,7 +39,7 @@

</span><span class="cx"> void MapIteratorPrototype::finishCreation(VM&amp; vm, JSGlobalObject* globalObject)

</span><span class="cx"> {

</span><span class="cx">     Base::finishCreation(vm);

</span><del>-    ASSERT(inherits(info()));

</del><ins>+    ASSERT(inherits(vm, info()));

</ins><span class="cx">     vm.prototypeMap.addPrototype(this);

</span><span class="cx"> 

</span><span class="cx">     JSC_NATIVE_FUNCTION_WITHOUT_TRANSITION(vm.propertyNames-&gt;next, MapIteratorPrototypeFuncNext, DontEnum, 0);

</span><span class="lines">@@ -51,7 +51,7 @@

</span><span class="cx">     VM&amp; vm = callFrame-&gt;vm();

</span><span class="cx">     auto scope = DECLARE_THROW_SCOPE(vm);

</span><span class="cx"> 

</span><del>-    JSMapIterator* iterator = jsDynamicCast&lt;JSMapIterator*&gt;(callFrame-&gt;thisValue());

</del><ins>+    JSMapIterator* iterator = jsDynamicCast&lt;JSMapIterator*&gt;(vm, callFrame-&gt;thisValue());

</ins><span class="cx">     if (!iterator)

</span><span class="cx">         return JSValue::encode(throwTypeError(callFrame, scope, ASCIILiteral(&quot;Cannot call MapIterator.next() on a non-MapIterator object&quot;)));

</span><span class="cx"> 

</span></span></pre></div>

<a id="trunkSourceJavaScriptCoreruntimeMapPrototypecpp"></a>

<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/MapPrototype.cpp (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/JavaScriptCore/runtime/MapPrototype.cpp        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/JavaScriptCore/runtime/MapPrototype.cpp        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -61,7 +61,7 @@

</span><span class="cx"> void MapPrototype::finishCreation(VM&amp; vm, JSGlobalObject* globalObject)

</span><span class="cx"> {

</span><span class="cx">     Base::finishCreation(vm);

</span><del>-    ASSERT(inherits(info()));

</del><ins>+    ASSERT(inherits(vm, info()));

</ins><span class="cx">     vm.prototypeMap.addPrototype(this);

</span><span class="cx"> 

</span><span class="cx">     JSC_NATIVE_FUNCTION_WITHOUT_TRANSITION(vm.propertyNames-&gt;clear, mapProtoFuncClear, DontEnum, 0);

</span><span class="lines">@@ -155,7 +155,7 @@

</span><span class="cx">     VM&amp; vm = callFrame-&gt;vm();

</span><span class="cx">     auto scope = DECLARE_THROW_SCOPE(vm);

</span><span class="cx"> 

</span><del>-    JSMap* thisObj = jsDynamicCast&lt;JSMap*&gt;(callFrame-&gt;thisValue());

</del><ins>+    JSMap* thisObj = jsDynamicCast&lt;JSMap*&gt;(vm, callFrame-&gt;thisValue());

</ins><span class="cx">     if (!thisObj)

</span><span class="cx">         return JSValue::encode(throwTypeError(callFrame, scope, ASCIILiteral(&quot;Cannot create a Map value iterator for a non-Map object.&quot;)));

</span><span class="cx">     return JSValue::encode(JSMapIterator::create(vm, callFrame-&gt;jsCallee()-&gt;globalObject()-&gt;mapIteratorStructure(), thisObj, IterateValue));

</span><span class="lines">@@ -166,7 +166,7 @@

</span><span class="cx">     VM&amp; vm = callFrame-&gt;vm();

</span><span class="cx">     auto scope = DECLARE_THROW_SCOPE(vm);

</span><span class="cx"> 

</span><del>-    JSMap* thisObj = jsDynamicCast&lt;JSMap*&gt;(callFrame-&gt;thisValue());

</del><ins>+    JSMap* thisObj = jsDynamicCast&lt;JSMap*&gt;(vm, callFrame-&gt;thisValue());

</ins><span class="cx">     if (!thisObj)

</span><span class="cx">         return JSValue::encode(throwTypeError(callFrame, scope, ASCIILiteral(&quot;Cannot create a Map entry iterator for a non-Map object.&quot;)));

</span><span class="cx">     return JSValue::encode(JSMapIterator::create(vm, callFrame-&gt;jsCallee()-&gt;globalObject()-&gt;mapIteratorStructure(), thisObj, IterateKeyValue));

</span><span class="lines">@@ -177,7 +177,7 @@

</span><span class="cx">     VM&amp; vm = callFrame-&gt;vm();

</span><span class="cx">     auto scope = DECLARE_THROW_SCOPE(vm);

</span><span class="cx"> 

</span><del>-    JSMap* thisObj = jsDynamicCast&lt;JSMap*&gt;(callFrame-&gt;thisValue());

</del><ins>+    JSMap* thisObj = jsDynamicCast&lt;JSMap*&gt;(vm, callFrame-&gt;thisValue());

</ins><span class="cx">     if (!thisObj)

</span><span class="cx">         return JSValue::encode(throwTypeError(callFrame, scope, ASCIILiteral(&quot;Cannot create a Map key iterator for a non-Map object.&quot;)));

</span><span class="cx">     return JSValue::encode(JSMapIterator::create(vm, callFrame-&gt;jsCallee()-&gt;globalObject()-&gt;mapIteratorStructure(), thisObj, IterateKey));

</span><span class="lines">@@ -185,7 +185,7 @@

</span><span class="cx"> 

</span><span class="cx"> EncodedJSValue JSC_HOST_CALL privateFuncMapIterator(ExecState* exec)

</span><span class="cx"> {

</span><del>-    ASSERT(jsDynamicCast&lt;JSMap*&gt;(exec-&gt;uncheckedArgument(0)));

</del><ins>+    ASSERT(jsDynamicCast&lt;JSMap*&gt;(exec-&gt;vm(), exec-&gt;uncheckedArgument(0)));

</ins><span class="cx">     JSMap* map = jsCast&lt;JSMap*&gt;(exec-&gt;uncheckedArgument(0));

</span><span class="cx">     return JSValue::encode(JSMapIterator::create(exec-&gt;vm(), exec-&gt;jsCallee()-&gt;globalObject()-&gt;mapIteratorStructure(), map, IterateKeyValue));

</span><span class="cx"> }

</span><span class="lines">@@ -194,7 +194,7 @@

</span><span class="cx"> {

</span><span class="cx">     VM&amp; vm = exec-&gt;vm();

</span><span class="cx">     auto scope = DECLARE_THROW_SCOPE(vm);

</span><del>-    ASSERT(jsDynamicCast&lt;JSMapIterator*&gt;(exec-&gt;thisValue()));

</del><ins>+    ASSERT(jsDynamicCast&lt;JSMapIterator*&gt;(vm, exec-&gt;thisValue()));

</ins><span class="cx">     JSMapIterator* iterator = jsCast&lt;JSMapIterator*&gt;(exec-&gt;thisValue());

</span><span class="cx">     JSValue key, value;

</span><span class="cx">     if (iterator-&gt;nextKeyValue(exec, key, value)) {

</span></span></pre></div>

<a id="trunkSourceJavaScriptCoreruntimeMathObjectcpp"></a>

<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/MathObject.cpp (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/JavaScriptCore/runtime/MathObject.cpp        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/JavaScriptCore/runtime/MathObject.cpp        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -76,7 +76,7 @@

</span><span class="cx"> void MathObject::finishCreation(VM&amp; vm, JSGlobalObject* globalObject)

</span><span class="cx"> {

</span><span class="cx">     Base::finishCreation(vm);

</span><del>-    ASSERT(inherits(info()));

</del><ins>+    ASSERT(inherits(vm, info()));

</ins><span class="cx"> 

</span><span class="cx">     putDirectWithoutTransition(vm, Identifier::fromString(&amp;vm, &quot;E&quot;), jsNumber(exp(1.0)), DontDelete | DontEnum | ReadOnly);

</span><span class="cx">     putDirectWithoutTransition(vm, Identifier::fromString(&amp;vm, &quot;LN2&quot;), jsNumber(log(2.0)), DontDelete | DontEnum | ReadOnly);

</span></span></pre></div>

<a id="trunkSourceJavaScriptCoreruntimeModuleLoaderPrototypecpp"></a>

<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/ModuleLoaderPrototype.cpp (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/JavaScriptCore/runtime/ModuleLoaderPrototype.cpp        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/JavaScriptCore/runtime/ModuleLoaderPrototype.cpp        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -112,7 +112,7 @@

</span><span class="cx">     const Identifier moduleKey = exec-&gt;argument(0).toPropertyKey(exec);

</span><span class="cx">     RETURN_IF_EXCEPTION(scope, encodedJSValue());

</span><span class="cx"> 

</span><del>-    auto* jsSourceCode = jsDynamicCast&lt;JSSourceCode*&gt;(exec-&gt;argument(1));

</del><ins>+    auto* jsSourceCode = jsDynamicCast&lt;JSSourceCode*&gt;(vm, exec-&gt;argument(1));

</ins><span class="cx">     if (!jsSourceCode)

</span><span class="cx">         return throwVMTypeError(exec, scope);

</span><span class="cx">     SourceCode sourceCode = jsSourceCode-&gt;sourceCode();

</span><span class="lines">@@ -141,7 +141,7 @@

</span><span class="cx"> {

</span><span class="cx">     VM&amp; vm = exec-&gt;vm();

</span><span class="cx">     auto scope = DECLARE_THROW_SCOPE(vm);

</span><del>-    JSModuleRecord* moduleRecord = jsDynamicCast&lt;JSModuleRecord*&gt;(exec-&gt;argument(0));

</del><ins>+    JSModuleRecord* moduleRecord = jsDynamicCast&lt;JSModuleRecord*&gt;(vm, exec-&gt;argument(0));

</ins><span class="cx">     if (!moduleRecord) {

</span><span class="cx">         scope.release();

</span><span class="cx">         return JSValue::encode(constructEmptyArray(exec, nullptr));

</span><span class="lines">@@ -161,7 +161,7 @@

</span><span class="cx"> {

</span><span class="cx">     VM&amp; vm = exec-&gt;vm();

</span><span class="cx">     auto scope = DECLARE_THROW_SCOPE(vm);

</span><del>-    JSModuleRecord* moduleRecord = jsDynamicCast&lt;JSModuleRecord*&gt;(exec-&gt;argument(0));

</del><ins>+    JSModuleRecord* moduleRecord = jsDynamicCast&lt;JSModuleRecord*&gt;(vm, exec-&gt;argument(0));

</ins><span class="cx">     if (!moduleRecord)

</span><span class="cx">         return JSValue::encode(jsUndefined());

</span><span class="cx"> 

</span><span class="lines">@@ -178,11 +178,12 @@

</span><span class="cx"> 

</span><span class="cx"> EncodedJSValue JSC_HOST_CALL moduleLoaderPrototypeResolve(ExecState* exec)

</span><span class="cx"> {

</span><ins>+    VM&amp; vm = exec-&gt;vm();

</ins><span class="cx">     // Hook point, Loader.resolve.

</span><span class="cx">     // https://whatwg.github.io/loader/#browser-resolve

<span class="cx">     // Take the name and resolve it to the unique identifier for the resource location.

<span class="cx">     // For example, take the &quot;jquery&quot; and return the URL for the resource.

</span><del>-    JSModuleLoader* loader = jsDynamicCast&lt;JSModuleLoader*&gt;(exec-&gt;thisValue());

</del><ins>+    JSModuleLoader* loader = jsDynamicCast&lt;JSModuleLoader*&gt;(vm, exec-&gt;thisValue());

</ins><span class="cx">     if (!loader)

</span><span class="cx">         return JSValue::encode(jsUndefined());

</span><span class="cx">     return JSValue::encode(loader-&gt;resolve(exec, exec-&gt;argument(0), exec-&gt;argument(1), exec-&gt;argument(2)));

</span><span class="lines">@@ -190,12 +191,13 @@

</span><span class="cx"> 

</span><span class="cx"> EncodedJSValue JSC_HOST_CALL moduleLoaderPrototypeFetch(ExecState* exec)

</span><span class="cx"> {

</span><ins>+    VM&amp; vm = exec-&gt;vm();

</ins><span class="cx">     // Hook point, Loader.fetch

</span><span class="cx">     // https://whatwg.github.io/loader/#browser-fetch

<span class="cx">     // Take the key and fetch the resource actually.

</span><span class="cx">     // For example, JavaScriptCore shell can provide the hook fetching the resource

<span class="cx">     // from the local file system.

</span><del>-    JSModuleLoader* loader = jsDynamicCast&lt;JSModuleLoader*&gt;(exec-&gt;thisValue());

</del><ins>+    JSModuleLoader* loader = jsDynamicCast&lt;JSModuleLoader*&gt;(vm, exec-&gt;thisValue());

</ins><span class="cx">     if (!loader)

</span><span class="cx">         return JSValue::encode(jsUndefined());

</span><span class="cx">     return JSValue::encode(loader-&gt;fetch(exec, exec-&gt;argument(0), exec-&gt;argument(1)));

</span><span class="lines">@@ -203,6 +205,7 @@

</span><span class="cx"> 

</span><span class="cx"> EncodedJSValue JSC_HOST_CALL moduleLoaderPrototypeInstantiate(ExecState* exec)

</span><span class="cx"> {

</span><ins>+    VM&amp; vm = exec-&gt;vm();

</ins><span class="cx">     // Hook point, Loader.instantiate

</span><span class="cx">     // https://whatwg.github.io/loader/#browser-instantiate

</span><span class="cx">     // Take the key and the fetched source code, and instantiate the module record

</span><span class="lines">@@ -209,7 +212,7 @@

<span class="cx">     // by parsing the module source code.

</span><span class="cx">     // It has the chance to provide the optional module instance that is different from

<span class="cx">     // the ordinary one.

</span><del>-    JSModuleLoader* loader = jsDynamicCast&lt;JSModuleLoader*&gt;(exec-&gt;thisValue());

</del><ins>+    JSModuleLoader* loader = jsDynamicCast&lt;JSModuleLoader*&gt;(vm, exec-&gt;thisValue());

</ins><span class="cx">     if (!loader)

</span><span class="cx">         return JSValue::encode(jsUndefined());

</span><span class="cx">     return JSValue::encode(loader-&gt;instantiate(exec, exec-&gt;argument(0), exec-&gt;argument(1), exec-&gt;argument(2)));

</span><span class="lines">@@ -220,7 +223,7 @@

</span><span class="cx">     VM&amp; vm = exec-&gt;vm();

</span><span class="cx">     auto scope = DECLARE_THROW_SCOPE(vm);

</span><span class="cx"> 

</span><del>-    auto* loader = jsDynamicCast&lt;JSModuleLoader*&gt;(exec-&gt;thisValue());

</del><ins>+    auto* loader = jsDynamicCast&lt;JSModuleLoader*&gt;(vm, exec-&gt;thisValue());

</ins><span class="cx">     if (!loader)

</span><span class="cx">         return JSValue::encode(jsUndefined());

</span><span class="cx">     auto* moduleNamespaceObject = loader-&gt;getModuleNamespaceObject(exec, exec-&gt;argument(0));

</span><span class="lines">@@ -235,7 +238,8 @@

</span><span class="cx">     // To instrument and retrieve the errors raised from the module execution,

<span class="cx">     // we inserted the hook point here.

</span><span class="cx"> 

</span><del>-    JSModuleLoader* loader = jsDynamicCast&lt;JSModuleLoader*&gt;(exec-&gt;thisValue());

</del><ins>+    VM&amp; vm = exec-&gt;vm();

+    JSModuleLoader* loader = jsDynamicCast&lt;JSModuleLoader*&gt;(vm, exec-&gt;thisValue());

</ins><span class="cx">     if (!loader)

</span><span class="cx">         return JSValue::encode(jsUndefined());

</span><span class="cx">     return JSValue::encode(loader-&gt;evaluate(exec, exec-&gt;argument(0), exec-&gt;argument(1), exec-&gt;argument(2)));

</span></span></pre></div>

<a id="trunkSourceJavaScriptCoreruntimeNativeErrorConstructorcpp"></a>

<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/NativeErrorConstructor.cpp (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/JavaScriptCore/runtime/NativeErrorConstructor.cpp        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/JavaScriptCore/runtime/NativeErrorConstructor.cpp        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -42,7 +42,7 @@

</span><span class="cx"> void NativeErrorConstructor::finishCreation(VM&amp; vm, JSGlobalObject* globalObject, Structure* prototypeStructure, const String&amp; name)

</span><span class="cx"> {

</span><span class="cx">     Base::finishCreation(vm, name);

</span><del>-    ASSERT(inherits(info()));

</del><ins>+    ASSERT(inherits(vm, info()));

</ins><span class="cx">     

</span><span class="cx">     NativeErrorPrototype* prototype = NativeErrorPrototype::create(vm, prototypeStructure, name, this);

</span><span class="cx">     

</span></span></pre></div>

<a id="trunkSourceJavaScriptCoreruntimeNumberConstructorcpp"></a>

<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/NumberConstructor.cpp (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/JavaScriptCore/runtime/NumberConstructor.cpp        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/JavaScriptCore/runtime/NumberConstructor.cpp        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -62,7 +62,7 @@

</span><span class="cx"> void NumberConstructor::finishCreation(VM&amp; vm, NumberPrototype* numberPrototype)

</span><span class="cx"> {

</span><span class="cx">     Base::finishCreation(vm, NumberPrototype::info()-&gt;className);

</span><del>-    ASSERT(inherits(info()));

</del><ins>+    ASSERT(inherits(vm, info()));

</ins><span class="cx"> 

</span><span class="cx">     // Number.Prototype

</span><span class="cx">     putDirectWithoutTransition(vm, vm.propertyNames-&gt;prototype, numberPrototype, DontEnum | DontDelete | ReadOnly);

</span></span></pre></div>

<a id="trunkSourceJavaScriptCoreruntimeNumberObjectcpp"></a>

<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/NumberObject.cpp (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/JavaScriptCore/runtime/NumberObject.cpp        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/JavaScriptCore/runtime/NumberObject.cpp        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -40,7 +40,7 @@

</span><span class="cx"> void NumberObject::finishCreation(VM&amp; vm)

</span><span class="cx"> {

</span><span class="cx">     Base::finishCreation(vm);

</span><del>-    ASSERT(inherits(info()));

</del><ins>+    ASSERT(inherits(vm, info()));

</ins><span class="cx"> }

</span><span class="cx"> 

</span><span class="cx"> NumberObject* constructNumber(ExecState* exec, JSGlobalObject* globalObject, JSValue number)

</span></span></pre></div>

<a id="trunkSourceJavaScriptCoreruntimeNumberPrototypecpp"></a>

<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/NumberPrototype.cpp (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/JavaScriptCore/runtime/NumberPrototype.cpp        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/JavaScriptCore/runtime/NumberPrototype.cpp        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -85,7 +85,7 @@

</span><span class="cx">     UNUSED_PARAM(globalObject);

</span><span class="cx"> #endif // ENABLE(INTL)

</span><span class="cx"> 

</span><del>-    ASSERT(inherits(info()));

</del><ins>+    ASSERT(inherits(vm, info()));

</ins><span class="cx"> }

</span><span class="cx"> 

</span><span class="cx"> // ------------------------------ Functions ---------------------------

</span></span></pre></div>

<a id="trunkSourceJavaScriptCoreruntimeObjectConstructorcpp"></a>

<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/ObjectConstructor.cpp (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/JavaScriptCore/runtime/ObjectConstructor.cpp        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/JavaScriptCore/runtime/ObjectConstructor.cpp        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -95,7 +95,7 @@

</span><span class="cx"> 

</span><span class="cx"> void ObjectConstructor::finishCreation(VM&amp; vm, JSGlobalObject* globalObject, ObjectPrototype* objectPrototype)

</span><span class="cx"> {

</span><del>-    Base::finishCreation(vm, objectPrototype-&gt;classInfo()-&gt;className);

</del><ins>+    Base::finishCreation(vm, objectPrototype-&gt;classInfo(vm)-&gt;className);

</ins><span class="cx">     // ECMA 15.2.3.1

</span><span class="cx">     putDirectWithoutTransition(vm, vm.propertyNames-&gt;prototype, objectPrototype, DontEnum | DontDelete | ReadOnly);

</span><span class="cx">     // no. of arguments for constructor

</span></span></pre></div>

<a id="trunkSourceJavaScriptCoreruntimeObjectPrototypecpp"></a>

<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/ObjectPrototype.cpp (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/JavaScriptCore/runtime/ObjectPrototype.cpp        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/JavaScriptCore/runtime/ObjectPrototype.cpp        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -55,7 +55,7 @@

</span><span class="cx"> void ObjectPrototype::finishCreation(VM&amp; vm, JSGlobalObject* globalObject)

</span><span class="cx"> {

</span><span class="cx">     Base::finishCreation(vm);

</span><del>-    ASSERT(inherits(info()));

</del><ins>+    ASSERT(inherits(vm, info()));

</ins><span class="cx">     vm.prototypeMap.addPrototype(this);

</span><span class="cx">     

</span><span class="cx">     JSC_NATIVE_FUNCTION_WITHOUT_TRANSITION(vm.propertyNames-&gt;toString, objectProtoFuncToString, DontEnum, 0);

</span></span></pre></div>

<a id="trunkSourceJavaScriptCoreruntimeProxyObjectcpp"></a>

<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/ProxyObject.cpp (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/JavaScriptCore/runtime/ProxyObject.cpp        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/JavaScriptCore/runtime/ProxyObject.cpp        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -58,11 +58,11 @@

</span><span class="cx">     while (proxy) {

</span><span class="cx">         const JSObject* target = proxy-&gt;target();

</span><span class="cx">         if (isArray(exec, target))

</span><del>-            return target-&gt;classInfo()-&gt;methodTable.toStringName(target, exec);

</del><ins>+            return target-&gt;classInfo(vm)-&gt;methodTable.toStringName(target, exec);

</ins><span class="cx">         if (UNLIKELY(scope.exception()))

</span><span class="cx">             break;

</span><span class="cx"> 

</span><del>-        proxy = jsDynamicCast&lt;const ProxyObject*&gt;(target);

</del><ins>+        proxy = jsDynamicCast&lt;const ProxyObject*&gt;(vm, target);

</ins><span class="cx">     }

</span><span class="cx">     return ASCIILiteral(&quot;Object&quot;);

</span><span class="cx"> }

</span><span class="lines">@@ -87,7 +87,7 @@

</span><span class="cx">         throwTypeError(exec, scope, ASCIILiteral(&quot;A Proxy's 'target' should be an Object&quot;));

</span><span class="cx">         return;

</span><span class="cx">     }

</span><del>-    if (ProxyObject* targetAsProxy = jsDynamicCast&lt;ProxyObject*&gt;(target)) {

</del><ins>+    if (ProxyObject* targetAsProxy = jsDynamicCast&lt;ProxyObject*&gt;(vm, target)) {

</ins><span class="cx">         if (targetAsProxy-&gt;handler().isNull()) {

</span><span class="cx">             throwTypeError(exec, scope, ASCIILiteral(&quot;If a Proxy's handler is another Proxy object, the other Proxy should not have been revoked&quot;));

</span><span class="cx">             return;

</span></span></pre></div>

<a id="trunkSourceJavaScriptCoreruntimeReflectObjectcpp"></a>

<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/ReflectObject.cpp (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/JavaScriptCore/runtime/ReflectObject.cpp        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/JavaScriptCore/runtime/ReflectObject.cpp        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -84,7 +84,7 @@

</span><span class="cx"> void ReflectObject::finishCreation(VM&amp; vm, JSGlobalObject* globalObject)

</span><span class="cx"> {

</span><span class="cx">     Base::finishCreation(vm);

</span><del>-    ASSERT(inherits(info()));

</del><ins>+    ASSERT(inherits(vm, info()));

</ins><span class="cx"> 

</span><span class="cx">     JSC_NATIVE_FUNCTION_WITHOUT_TRANSITION(vm.propertyNames-&gt;builtinNames().ownKeysPrivateName(), reflectObjectOwnKeys, DontEnum | DontDelete | ReadOnly, 1);

</span><span class="cx">     JSC_NATIVE_FUNCTION_WITHOUT_TRANSITION(vm.propertyNames-&gt;builtinNames().getOwnPropertyDescriptorPrivateName(), reflectObjectGetOwnPropertyDescriptor, DontEnum | DontDelete | ReadOnly, 2);

</span><span class="lines">@@ -115,7 +115,7 @@

</span><span class="cx">     }

</span><span class="cx"> 

</span><span class="cx">     MarkedArgumentBuffer arguments;

</span><del>-    JSObject* argumentsObject = jsDynamicCast&lt;JSObject*&gt;(exec-&gt;argument(1));

</del><ins>+    JSObject* argumentsObject = jsDynamicCast&lt;JSObject*&gt;(vm, exec-&gt;argument(1));

</ins><span class="cx">     if (!argumentsObject)

</span><span class="cx">         return JSValue::encode(throwTypeError(exec, scope, ASCIILiteral(&quot;Reflect.construct requires the second argument be an object&quot;)));

</span><span class="cx"> 

</span></span></pre></div>

<a id="trunkSourceJavaScriptCoreruntimeRegExpConstructorcpp"></a>

<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/RegExpConstructor.cpp (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/JavaScriptCore/runtime/RegExpConstructor.cpp        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/JavaScriptCore/runtime/RegExpConstructor.cpp        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -86,7 +86,7 @@

</span><span class="cx"> void RegExpConstructor::finishCreation(VM&amp; vm, RegExpPrototype* regExpPrototype, GetterSetter* speciesSymbol)

</span><span class="cx"> {

</span><span class="cx">     Base::finishCreation(vm, ASCIILiteral(&quot;RegExp&quot;));

</span><del>-    ASSERT(inherits(info()));

</del><ins>+    ASSERT(inherits(vm, info()));

</ins><span class="cx"> 

</span><span class="cx">     putDirectWithoutTransition(vm, vm.propertyNames-&gt;prototype, regExpPrototype, DontEnum | DontDelete | ReadOnly);

</span><span class="cx"> 

</span><span class="lines">@@ -183,7 +183,7 @@

</span><span class="cx"> 

</span><span class="cx"> bool setRegExpConstructorInput(ExecState* exec, EncodedJSValue thisValue, EncodedJSValue value)

</span><span class="cx"> {

</span><del>-    if (auto constructor = jsDynamicCast&lt;RegExpConstructor*&gt;(JSValue::decode(thisValue))) {

</del><ins>+    if (auto constructor = jsDynamicCast&lt;RegExpConstructor*&gt;(exec-&gt;vm(), JSValue::decode(thisValue))) {

</ins><span class="cx">         constructor-&gt;setInput(exec, JSValue::decode(value).toString(exec));

</span><span class="cx">         return true;

</span><span class="cx">     }

</span><span class="lines">@@ -192,7 +192,7 @@

</span><span class="cx"> 

</span><span class="cx"> bool setRegExpConstructorMultiline(ExecState* exec, EncodedJSValue thisValue, EncodedJSValue value)

</span><span class="cx"> {

</span><del>-    if (auto constructor = jsDynamicCast&lt;RegExpConstructor*&gt;(JSValue::decode(thisValue))) {

</del><ins>+    if (auto constructor = jsDynamicCast&lt;RegExpConstructor*&gt;(exec-&gt;vm(), JSValue::decode(thisValue))) {

</ins><span class="cx">         constructor-&gt;setMultiline(JSValue::decode(value).toBoolean(exec));

</span><span class="cx">         return true;

</span><span class="cx">     }

</span><span class="lines">@@ -255,7 +255,7 @@

</span><span class="cx">     JSValue patternArg = args.at(0);

</span><span class="cx">     JSValue flagsArg = args.at(1);

</span><span class="cx"> 

</span><del>-    bool isPatternRegExp = patternArg.inherits(RegExpObject::info());

</del><ins>+    bool isPatternRegExp = patternArg.inherits(vm, RegExpObject::info());

</ins><span class="cx">     bool constructAsRegexp = isRegExp(vm, exec, patternArg);

</span><span class="cx">     RETURN_IF_EXCEPTION(scope, nullptr);

</span><span class="cx"> 

</span></span></pre></div>

<a id="trunkSourceJavaScriptCoreruntimeRegExpConstructorh"></a>

<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/RegExpConstructor.h (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/JavaScriptCore/runtime/RegExpConstructor.h        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/JavaScriptCore/runtime/RegExpConstructor.h        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -88,7 +88,7 @@

</span><span class="cx"> 

</span><span class="cx"> inline RegExpConstructor* asRegExpConstructor(JSValue value)

</span><span class="cx"> {

</span><del>-    ASSERT(asObject(value)-&gt;inherits(RegExpConstructor::info()));

</del><ins>+    ASSERT(asObject(value)-&gt;inherits(*value.getObject()-&gt;vm(), RegExpConstructor::info()));

</ins><span class="cx">     return static_cast&lt;RegExpConstructor*&gt;(asObject(value));

</span><span class="cx"> }

</span><span class="cx"> 

</span><span class="lines">@@ -142,7 +142,7 @@

</span><span class="cx">     if (!matchValue.isUndefined())

</span><span class="cx">         return matchValue.toBoolean(exec);

</span><span class="cx"> 

</span><del>-    return object-&gt;inherits(RegExpObject::info());

</del><ins>+    return object-&gt;inherits(vm, RegExpObject::info());

</ins><span class="cx"> }

</span><span class="cx"> 

</span><span class="cx"> EncodedJSValue JSC_HOST_CALL esSpecRegExpCreate(ExecState*);

</span></span></pre></div>

<a id="trunkSourceJavaScriptCoreruntimeRegExpObjectcpp"></a>

<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/RegExpObject.cpp (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/JavaScriptCore/runtime/RegExpObject.cpp        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/JavaScriptCore/runtime/RegExpObject.cpp        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -48,7 +48,7 @@

</span><span class="cx"> void RegExpObject::finishCreation(VM&amp; vm)

</span><span class="cx"> {

</span><span class="cx">     Base::finishCreation(vm);

</span><del>-    ASSERT(inherits(info()));

</del><ins>+    ASSERT(inherits(vm, info()));

</ins><span class="cx"> }

</span><span class="cx"> 

</span><span class="cx"> void RegExpObject::visitChildren(JSCell* cell, SlotVisitor&amp; visitor)

</span></span></pre></div>

<a id="trunkSourceJavaScriptCoreruntimeRegExpObjecth"></a>

<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/RegExpObject.h (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/JavaScriptCore/runtime/RegExpObject.h        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/JavaScriptCore/runtime/RegExpObject.h        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -124,7 +124,7 @@

</span><span class="cx"> 

</span><span class="cx"> inline RegExpObject* asRegExpObject(JSValue value)

</span><span class="cx"> {

</span><del>-    ASSERT(asObject(value)-&gt;inherits(RegExpObject::info()));

</del><ins>+    ASSERT(asObject(value)-&gt;inherits(*value.getObject()-&gt;vm(), RegExpObject::info()));

</ins><span class="cx">     return static_cast&lt;RegExpObject*&gt;(asObject(value));

</span><span class="cx"> }

</span><span class="cx"> 

</span></span></pre></div>

<a id="trunkSourceJavaScriptCoreruntimeRegExpPrototypecpp"></a>

<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/RegExpPrototype.cpp (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/JavaScriptCore/runtime/RegExpPrototype.cpp        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/JavaScriptCore/runtime/RegExpPrototype.cpp        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -65,7 +65,7 @@

</span><span class="cx"> void RegExpPrototype::finishCreation(VM&amp; vm, JSGlobalObject* globalObject)

</span><span class="cx"> {

</span><span class="cx">     Base::finishCreation(vm);

</span><del>-    ASSERT(inherits(info()));

</del><ins>+    ASSERT(inherits(vm, info()));

</ins><span class="cx">     JSC_NATIVE_FUNCTION_WITHOUT_TRANSITION(vm.propertyNames-&gt;compile, regExpProtoFuncCompile, DontEnum, 2);

</span><span class="cx">     JSC_NATIVE_INTRINSIC_FUNCTION_WITHOUT_TRANSITION(vm.propertyNames-&gt;exec, regExpProtoFuncExec, DontEnum, 1, RegExpExecIntrinsic);

</span><span class="cx">     JSC_NATIVE_FUNCTION_WITHOUT_TRANSITION(vm.propertyNames-&gt;toString, regExpProtoFuncToString, DontEnum, 0);

</span><span class="lines">@@ -102,7 +102,7 @@

</span><span class="cx">     auto scope = DECLARE_THROW_SCOPE(vm);

</span><span class="cx"> 

</span><span class="cx">     JSValue thisValue = exec-&gt;thisValue();

</span><del>-    if (!thisValue.inherits(RegExpObject::info()))

</del><ins>+    if (!thisValue.inherits(vm, RegExpObject::info()))

</ins><span class="cx">         return throwVMTypeError(exec, scope);

</span><span class="cx">     JSString* string = exec-&gt;argument(0).toStringOrNull(exec);

</span><span class="cx">     ASSERT(!!scope.exception() == !string);

</span><span class="lines">@@ -118,7 +118,7 @@

</span><span class="cx">     auto scope = DECLARE_THROW_SCOPE(vm);

</span><span class="cx"> 

</span><span class="cx">     JSValue thisValue = exec-&gt;thisValue();

</span><del>-    if (!thisValue.inherits(RegExpObject::info()))

</del><ins>+    if (!thisValue.inherits(vm, RegExpObject::info()))

</ins><span class="cx">         return throwVMTypeError(exec, scope, &quot;Builtin RegExp exec can only be called on a RegExp object&quot;);

</span><span class="cx">     JSString* string = exec-&gt;argument(0).toStringOrNull(exec);

</span><span class="cx">     ASSERT(!!scope.exception() == !string);

</span><span class="lines">@@ -134,7 +134,7 @@

</span><span class="cx">     auto scope = DECLARE_THROW_SCOPE(vm);

</span><span class="cx"> 

</span><span class="cx">     JSValue thisValue = exec-&gt;thisValue();

</span><del>-    if (!thisValue.inherits(RegExpObject::info()))

</del><ins>+    if (!thisValue.inherits(vm, RegExpObject::info()))

</ins><span class="cx">         return throwVMTypeError(exec, scope);

</span><span class="cx">     JSString* string = exec-&gt;argument(0).toStringOrNull(exec);

</span><span class="cx">     ASSERT(!!scope.exception() == !string);

</span><span class="lines">@@ -154,7 +154,7 @@

</span><span class="cx">     auto scope = DECLARE_THROW_SCOPE(vm);

</span><span class="cx"> 

</span><span class="cx">     JSValue thisValue = exec-&gt;thisValue();

</span><del>-    if (!thisValue.inherits(RegExpObject::info()))

</del><ins>+    if (!thisValue.inherits(vm, RegExpObject::info()))

</ins><span class="cx">         return throwVMTypeError(exec, scope);

</span><span class="cx"> 

</span><span class="cx">     RegExp* regExp;

</span><span class="lines">@@ -161,7 +161,7 @@

</span><span class="cx">     JSValue arg0 = exec-&gt;argument(0);

</span><span class="cx">     JSValue arg1 = exec-&gt;argument(1);

</span><span class="cx">     

</span><del>-    if (arg0.inherits(RegExpObject::info())) {

</del><ins>+    if (arg0.inherits(vm, RegExpObject::info())) {

</ins><span class="cx">         if (!arg1.isUndefined())

</span><span class="cx">             return throwVMTypeError(exec, scope, ASCIILiteral(&quot;Cannot supply flags when constructing one RegExp from another.&quot;));

</span><span class="cx">         regExp = asRegExpObject(arg0)-&gt;regExp();

</span><span class="lines">@@ -261,8 +261,8 @@

</span><span class="cx">     auto scope = DECLARE_THROW_SCOPE(vm);

</span><span class="cx"> 

</span><span class="cx">     JSValue thisValue = exec-&gt;thisValue();

</span><del>-    if (UNLIKELY(!thisValue.inherits(RegExpObject::info()))) {

-        if (thisValue.inherits(RegExpPrototype::info()))

</del><ins>+    if (UNLIKELY(!thisValue.inherits(vm, RegExpObject::info()))) {

+        if (thisValue.inherits(vm, RegExpPrototype::info()))

</ins><span class="cx">             return JSValue::encode(jsUndefined());

</span><span class="cx">         return throwVMTypeError(exec, scope, ASCIILiteral(&quot;The RegExp.prototype.global getter can only be called on a RegExp object&quot;));

</span><span class="cx">     }

</span><span class="lines">@@ -276,8 +276,8 @@

</span><span class="cx">     auto scope = DECLARE_THROW_SCOPE(vm);

</span><span class="cx"> 

</span><span class="cx">     JSValue thisValue = exec-&gt;thisValue();

</span><del>-    if (UNLIKELY(!thisValue.inherits(RegExpObject::info()))) {

-        if (thisValue.inherits(RegExpPrototype::info()))

</del><ins>+    if (UNLIKELY(!thisValue.inherits(vm, RegExpObject::info()))) {

+        if (thisValue.inherits(vm, RegExpPrototype::info()))

</ins><span class="cx">             return JSValue::encode(jsUndefined());

</span><span class="cx">         return throwVMTypeError(exec, scope, ASCIILiteral(&quot;The RegExp.prototype.ignoreCase getter can only be called on a RegExp object&quot;));

</span><span class="cx">     }

</span><span class="lines">@@ -291,8 +291,8 @@

</span><span class="cx">     auto scope = DECLARE_THROW_SCOPE(vm);

</span><span class="cx"> 

</span><span class="cx">     JSValue thisValue = exec-&gt;thisValue();

</span><del>-    if (UNLIKELY(!thisValue.inherits(RegExpObject::info()))) {

-        if (thisValue.inherits(RegExpPrototype::info()))

</del><ins>+    if (UNLIKELY(!thisValue.inherits(vm, RegExpObject::info()))) {

+        if (thisValue.inherits(vm, RegExpPrototype::info()))

</ins><span class="cx">             return JSValue::encode(jsUndefined());

</span><span class="cx">         return throwVMTypeError(exec, scope, ASCIILiteral(&quot;The RegExp.prototype.multiline getter can only be called on a RegExp object&quot;));

</span><span class="cx">     }

</span><span class="lines">@@ -306,8 +306,8 @@

</span><span class="cx">     auto scope = DECLARE_THROW_SCOPE(vm);

</span><span class="cx"> 

</span><span class="cx">     JSValue thisValue = exec-&gt;thisValue();

</span><del>-    if (UNLIKELY(!thisValue.inherits(RegExpObject::info()))) {

-        if (thisValue.inherits(RegExpPrototype::info()))

</del><ins>+    if (UNLIKELY(!thisValue.inherits(vm, RegExpObject::info()))) {

+        if (thisValue.inherits(vm, RegExpPrototype::info()))

</ins><span class="cx">             return JSValue::encode(jsUndefined());

</span><span class="cx">         return throwVMTypeError(exec, scope, ASCIILiteral(&quot;The RegExp.prototype.sticky getter can only be called on a RegExp object&quot;));

</span><span class="cx">     }

</span><span class="lines">@@ -321,8 +321,8 @@

</span><span class="cx">     auto scope = DECLARE_THROW_SCOPE(vm);

</span><span class="cx"> 

</span><span class="cx">     JSValue thisValue = exec-&gt;thisValue();

</span><del>-    if (UNLIKELY(!thisValue.inherits(RegExpObject::info()))) {

-        if (thisValue.inherits(RegExpPrototype::info()))

</del><ins>+    if (UNLIKELY(!thisValue.inherits(vm, RegExpObject::info()))) {

+        if (thisValue.inherits(vm, RegExpPrototype::info()))

</ins><span class="cx">             return JSValue::encode(jsUndefined());

</span><span class="cx">         return throwVMTypeError(exec, scope, ASCIILiteral(&quot;The RegExp.prototype.unicode getter can only be called on a RegExp object&quot;));

</span><span class="cx">     }

</span><span class="lines">@@ -457,8 +457,8 @@

</span><span class="cx">     auto scope = DECLARE_THROW_SCOPE(vm);

</span><span class="cx"> 

</span><span class="cx">     JSValue thisValue = exec-&gt;thisValue();

</span><del>-    if (UNLIKELY(!thisValue.inherits(RegExpObject::info()))) {

-        if (thisValue.inherits(RegExpPrototype::info()))

</del><ins>+    if (UNLIKELY(!thisValue.inherits(vm, RegExpObject::info()))) {

+        if (thisValue.inherits(vm, RegExpPrototype::info()))

</ins><span class="cx">             return JSValue::encode(jsString(exec, ASCIILiteral(&quot;(?:)&quot;)));

</span><span class="cx">         return throwVMTypeError(exec, scope, ASCIILiteral(&quot;The RegExp.prototype.source getter can only be called on a RegExp object&quot;));

</span><span class="cx">     }

</span></span></pre></div>

<a id="trunkSourceJavaScriptCoreruntimeSamplingProfilercpp"></a>

<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/SamplingProfiler.cpp (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/JavaScriptCore/runtime/SamplingProfiler.cpp        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/JavaScriptCore/runtime/SamplingProfiler.cpp        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -415,7 +415,7 @@

</span><span class="cx">             };

</span><span class="cx"> 

</span><span class="cx">             if (calleeCell-&gt;type() != JSFunctionType) {

</span><del>-                if (JSObject* object = jsDynamicCast&lt;JSObject*&gt;(calleeCell))

</del><ins>+                if (JSObject* object = jsDynamicCast&lt;JSObject*&gt;(*calleeCell-&gt;vm(), calleeCell))

</ins><span class="cx">                     addCallee(object);

</span><span class="cx"> 

</span><span class="cx">                 if (!alreadyHasExecutable)

</span></span></pre></div>

<a id="trunkSourceJavaScriptCoreruntimeScriptExecutablecpp"></a>

<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/ScriptExecutable.cpp (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/JavaScriptCore/runtime/ScriptExecutable.cpp        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/JavaScriptCore/runtime/ScriptExecutable.cpp        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -176,7 +176,7 @@

</span><span class="cx">     ASSERT(vm-&gt;heap.isDeferred());

</span><span class="cx">     ASSERT(endColumn() != UINT_MAX);

</span><span class="cx"> 

</span><del>-    if (classInfo() == EvalExecutable::info()) {

</del><ins>+    if (classInfo(*vm) == EvalExecutable::info()) {

</ins><span class="cx">         EvalExecutable* executable = jsCast&lt;EvalExecutable*&gt;(this);

</span><span class="cx">         RELEASE_ASSERT(kind == CodeForCall);

</span><span class="cx">         RELEASE_ASSERT(!executable-&gt;m_evalCodeBlock);

</span><span class="lines">@@ -186,7 +186,7 @@

</span><span class="cx">             executable-&gt;source().provider());

</span><span class="cx">     }

</span><span class="cx">     

</span><del>-    if (classInfo() == ProgramExecutable::info()) {

</del><ins>+    if (classInfo(*vm) == ProgramExecutable::info()) {

</ins><span class="cx">         ProgramExecutable* executable = jsCast&lt;ProgramExecutable*&gt;(this);

</span><span class="cx">         RELEASE_ASSERT(kind == CodeForCall);

</span><span class="cx">         RELEASE_ASSERT(!executable-&gt;m_programCodeBlock);

</span><span class="lines">@@ -196,7 +196,7 @@

</span><span class="cx">             executable-&gt;source().provider(), startColumn());

</span><span class="cx">     }

</span><span class="cx"> 

</span><del>-    if (classInfo() == ModuleProgramExecutable::info()) {

</del><ins>+    if (classInfo(*vm) == ModuleProgramExecutable::info()) {

</ins><span class="cx">         ModuleProgramExecutable* executable = jsCast&lt;ModuleProgramExecutable*&gt;(this);

</span><span class="cx">         RELEASE_ASSERT(kind == CodeForCall);

</span><span class="cx">         RELEASE_ASSERT(!executable-&gt;m_moduleProgramCodeBlock);

</span><span class="lines">@@ -206,7 +206,7 @@

</span><span class="cx">             executable-&gt;source().provider(), startColumn());

</span><span class="cx">     }

</span><span class="cx"> 

</span><del>-    RELEASE_ASSERT(classInfo() == FunctionExecutable::info());

</del><ins>+    RELEASE_ASSERT(classInfo(*vm) == FunctionExecutable::info());

</ins><span class="cx">     RELEASE_ASSERT(function);

</span><span class="cx">     FunctionExecutable* executable = jsCast&lt;FunctionExecutable*&gt;(this);

</span><span class="cx">     RELEASE_ASSERT(!executable-&gt;codeBlockFor(kind));

</span><span class="lines">@@ -235,46 +235,47 @@

</span><span class="cx"> CodeBlock* ScriptExecutable::newReplacementCodeBlockFor(

</span><span class="cx">     CodeSpecializationKind kind)

</span><span class="cx"> {

</span><del>-    if (classInfo() == EvalExecutable::info()) {

</del><ins>+    VM&amp; vm = *this-&gt;vm();

+    if (classInfo(vm) == EvalExecutable::info()) {

</ins><span class="cx">         RELEASE_ASSERT(kind == CodeForCall);

</span><span class="cx">         EvalExecutable* executable = jsCast&lt;EvalExecutable*&gt;(this);

</span><span class="cx">         EvalCodeBlock* baseline = static_cast&lt;EvalCodeBlock*&gt;(

</span><span class="cx">             executable-&gt;m_evalCodeBlock-&gt;baselineVersion());

</span><del>-        EvalCodeBlock* result = EvalCodeBlock::create(vm(),

</del><ins>+        EvalCodeBlock* result = EvalCodeBlock::create(&amp;vm,

</ins><span class="cx">             CodeBlock::CopyParsedBlock, *baseline);

</span><del>-        result-&gt;setAlternative(*vm(), baseline);

</del><ins>+        result-&gt;setAlternative(vm, baseline);

</ins><span class="cx">         return result;

</span><span class="cx">     }

</span><span class="cx">     

</span><del>-    if (classInfo() == ProgramExecutable::info()) {

</del><ins>+    if (classInfo(vm) == ProgramExecutable::info()) {

</ins><span class="cx">         RELEASE_ASSERT(kind == CodeForCall);

</span><span class="cx">         ProgramExecutable* executable = jsCast&lt;ProgramExecutable*&gt;(this);

</span><span class="cx">         ProgramCodeBlock* baseline = static_cast&lt;ProgramCodeBlock*&gt;(

</span><span class="cx">             executable-&gt;m_programCodeBlock-&gt;baselineVersion());

</span><del>-        ProgramCodeBlock* result = ProgramCodeBlock::create(vm(),

</del><ins>+        ProgramCodeBlock* result = ProgramCodeBlock::create(&amp;vm,

</ins><span class="cx">             CodeBlock::CopyParsedBlock, *baseline);

</span><del>-        result-&gt;setAlternative(*vm(), baseline);

</del><ins>+        result-&gt;setAlternative(vm, baseline);

</ins><span class="cx">         return result;

</span><span class="cx">     }

</span><span class="cx"> 

</span><del>-    if (classInfo() == ModuleProgramExecutable::info()) {

</del><ins>+    if (classInfo(vm) == ModuleProgramExecutable::info()) {

</ins><span class="cx">         RELEASE_ASSERT(kind == CodeForCall);

</span><span class="cx">         ModuleProgramExecutable* executable = jsCast&lt;ModuleProgramExecutable*&gt;(this);

</span><span class="cx">         ModuleProgramCodeBlock* baseline = static_cast&lt;ModuleProgramCodeBlock*&gt;(

</span><span class="cx">             executable-&gt;m_moduleProgramCodeBlock-&gt;baselineVersion());

</span><del>-        ModuleProgramCodeBlock* result = ModuleProgramCodeBlock::create(vm(),

</del><ins>+        ModuleProgramCodeBlock* result = ModuleProgramCodeBlock::create(&amp;vm,

</ins><span class="cx">             CodeBlock::CopyParsedBlock, *baseline);

</span><del>-        result-&gt;setAlternative(*vm(), baseline);

</del><ins>+        result-&gt;setAlternative(vm, baseline);

</ins><span class="cx">         return result;

</span><span class="cx">     }

</span><span class="cx"> 

</span><del>-    RELEASE_ASSERT(classInfo() == FunctionExecutable::info());

</del><ins>+    RELEASE_ASSERT(classInfo(vm) == FunctionExecutable::info());

</ins><span class="cx">     FunctionExecutable* executable = jsCast&lt;FunctionExecutable*&gt;(this);

</span><span class="cx">     FunctionCodeBlock* baseline = static_cast&lt;FunctionCodeBlock*&gt;(

</span><span class="cx">         executable-&gt;codeBlockFor(kind)-&gt;baselineVersion());

</span><del>-    FunctionCodeBlock* result = FunctionCodeBlock::create(vm(),

</del><ins>+    FunctionCodeBlock* result = FunctionCodeBlock::create(&amp;vm,

</ins><span class="cx">         CodeBlock::CopyParsedBlock, *baseline);

</span><del>-    result-&gt;setAlternative(*vm(), baseline);

</del><ins>+    result-&gt;setAlternative(vm, baseline);

</ins><span class="cx">     return result;

</span><span class="cx"> }

</span><span class="cx"> 

</span></span></pre></div>

<a id="trunkSourceJavaScriptCoreruntimeSetConstructorcpp"></a>

<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/SetConstructor.cpp (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/JavaScriptCore/runtime/SetConstructor.cpp        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/JavaScriptCore/runtime/SetConstructor.cpp        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -41,7 +41,7 @@

</span><span class="cx"> 

</span><span class="cx"> void SetConstructor::finishCreation(VM&amp; vm, SetPrototype* setPrototype, GetterSetter* speciesSymbol)

</span><span class="cx"> {

</span><del>-    Base::finishCreation(vm, setPrototype-&gt;classInfo()-&gt;className);

</del><ins>+    Base::finishCreation(vm, setPrototype-&gt;classInfo(vm)-&gt;className);

</ins><span class="cx">     putDirectWithoutTransition(vm, vm.propertyNames-&gt;prototype, setPrototype, DontEnum | DontDelete | ReadOnly);

</span><span class="cx">     putDirectWithoutTransition(vm, vm.propertyNames-&gt;length, jsNumber(0), DontEnum | ReadOnly);

</span><span class="cx">     putDirectNonIndexAccessor(vm, vm.propertyNames-&gt;speciesSymbol, speciesSymbol, Accessor | ReadOnly | DontEnum);

</span></span></pre></div>

<a id="trunkSourceJavaScriptCoreruntimeSetIteratorPrototypecpp"></a>

<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/SetIteratorPrototype.cpp (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/JavaScriptCore/runtime/SetIteratorPrototype.cpp        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/JavaScriptCore/runtime/SetIteratorPrototype.cpp        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -39,7 +39,7 @@

</span><span class="cx"> void SetIteratorPrototype::finishCreation(VM&amp; vm, JSGlobalObject* globalObject)

</span><span class="cx"> {

</span><span class="cx">     Base::finishCreation(vm);

</span><del>-    ASSERT(inherits(info()));

</del><ins>+    ASSERT(inherits(vm, info()));

</ins><span class="cx">     vm.prototypeMap.addPrototype(this);

</span><span class="cx"> 

</span><span class="cx">     JSC_NATIVE_FUNCTION_WITHOUT_TRANSITION(vm.propertyNames-&gt;next, SetIteratorPrototypeFuncNext, DontEnum, 0);

</span><span class="lines">@@ -52,7 +52,7 @@

</span><span class="cx">     auto scope = DECLARE_THROW_SCOPE(vm);

</span><span class="cx"> 

</span><span class="cx">     JSValue result;

</span><del>-    JSSetIterator* iterator = jsDynamicCast&lt;JSSetIterator*&gt;(callFrame-&gt;thisValue());

</del><ins>+    JSSetIterator* iterator = jsDynamicCast&lt;JSSetIterator*&gt;(vm, callFrame-&gt;thisValue());

</ins><span class="cx">     if (!iterator)

</span><span class="cx">         return JSValue::encode(throwTypeError(callFrame, scope, ASCIILiteral(&quot;Cannot call SetIterator.next() on a non-SetIterator object&quot;)));

</span><span class="cx"> 

</span></span></pre></div>

<a id="trunkSourceJavaScriptCoreruntimeSetPrototypecpp"></a>

<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/SetPrototype.cpp (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/JavaScriptCore/runtime/SetPrototype.cpp        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/JavaScriptCore/runtime/SetPrototype.cpp        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -60,7 +60,7 @@

</span><span class="cx"> void SetPrototype::finishCreation(VM&amp; vm, JSGlobalObject* globalObject)

</span><span class="cx"> {

</span><span class="cx">     Base::finishCreation(vm);

</span><del>-    ASSERT(inherits(info()));

</del><ins>+    ASSERT(inherits(vm, info()));

</ins><span class="cx">     vm.prototypeMap.addPrototype(this);

</span><span class="cx"> 

</span><span class="cx">     JSC_NATIVE_FUNCTION_WITHOUT_TRANSITION(vm.propertyNames-&gt;add, setProtoFuncAdd, DontEnum, 1);

</span><span class="lines">@@ -141,7 +141,7 @@

</span><span class="cx">     VM&amp; vm = callFrame-&gt;vm();

</span><span class="cx">     auto scope = DECLARE_THROW_SCOPE(vm);

</span><span class="cx"> 

</span><del>-    JSSet* thisObj = jsDynamicCast&lt;JSSet*&gt;(callFrame-&gt;thisValue());

</del><ins>+    JSSet* thisObj = jsDynamicCast&lt;JSSet*&gt;(vm, callFrame-&gt;thisValue());

</ins><span class="cx">     if (!thisObj)

</span><span class="cx">         return JSValue::encode(throwTypeError(callFrame, scope, ASCIILiteral(&quot;Cannot create a Set value iterator for a non-Set object.&quot;)));

</span><span class="cx">     return JSValue::encode(JSSetIterator::create(vm, callFrame-&gt;jsCallee()-&gt;globalObject()-&gt;setIteratorStructure(), thisObj, IterateValue));

</span><span class="lines">@@ -152,7 +152,7 @@

</span><span class="cx">     VM&amp; vm = callFrame-&gt;vm();

</span><span class="cx">     auto scope = DECLARE_THROW_SCOPE(vm);

</span><span class="cx"> 

</span><del>-    JSSet* thisObj = jsDynamicCast&lt;JSSet*&gt;(callFrame-&gt;thisValue());

</del><ins>+    JSSet* thisObj = jsDynamicCast&lt;JSSet*&gt;(vm, callFrame-&gt;thisValue());

</ins><span class="cx">     if (!thisObj)

</span><span class="cx">         return JSValue::encode(throwTypeError(callFrame, scope, ASCIILiteral(&quot;Cannot create a Set entry iterator for a non-Set object.&quot;)));

</span><span class="cx">     return JSValue::encode(JSSetIterator::create(vm, callFrame-&gt;jsCallee()-&gt;globalObject()-&gt;setIteratorStructure(), thisObj, IterateKeyValue));

</span><span class="lines">@@ -160,7 +160,8 @@

</span><span class="cx"> 

</span><span class="cx"> EncodedJSValue JSC_HOST_CALL privateFuncSetIterator(ExecState* exec)

</span><span class="cx"> {

</span><del>-    ASSERT(jsDynamicCast&lt;JSSet*&gt;(exec-&gt;uncheckedArgument(0)));

</del><ins>+

+    ASSERT(jsDynamicCast&lt;JSSet*&gt;(exec-&gt;vm(), exec-&gt;uncheckedArgument(0)));

</ins><span class="cx">     JSSet* set = jsCast&lt;JSSet*&gt;(exec-&gt;uncheckedArgument(0));

</span><span class="cx">     return JSValue::encode(JSSetIterator::create(exec-&gt;vm(), exec-&gt;jsCallee()-&gt;globalObject()-&gt;setIteratorStructure(), set, IterateKey));

</span><span class="cx"> }

</span><span class="lines">@@ -167,7 +168,7 @@

</span><span class="cx"> 

</span><span class="cx"> EncodedJSValue JSC_HOST_CALL privateFuncSetIteratorNext(ExecState* exec)

</span><span class="cx"> {

</span><del>-    ASSERT(jsDynamicCast&lt;JSSetIterator*&gt;(exec-&gt;thisValue()));

</del><ins>+    ASSERT(jsDynamicCast&lt;JSSetIterator*&gt;(exec-&gt;vm(), exec-&gt;thisValue()));

</ins><span class="cx">     JSSetIterator* iterator = jsCast&lt;JSSetIterator*&gt;(exec-&gt;thisValue());

</span><span class="cx">     JSValue result;

</span><span class="cx">     if (iterator-&gt;next(exec, result)) {

</span></span></pre></div>

<a id="trunkSourceJavaScriptCoreruntimeStackFramecpp"></a>

<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/StackFrame.cpp (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/JavaScriptCore/runtime/StackFrame.cpp        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/JavaScriptCore/runtime/StackFrame.cpp        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -43,7 +43,7 @@

</span><span class="cx"> String StackFrame::sourceURL() const

</span><span class="cx"> {

</span><span class="cx">     if (!m_codeBlock) {

</span><del>-        if (m_callee &amp;&amp; m_callee-&gt;isAnyWasmCallee())

</del><ins>+        if (m_callee &amp;&amp; m_callee-&gt;isAnyWasmCallee(*m_callee-&gt;vm()))

</ins><span class="cx">             return ASCIILiteral(&quot;[wasm code]&quot;);

</span><span class="cx">         return ASCIILiteral(&quot;[native code]&quot;);

</span><span class="cx">     }

</span><span class="lines">@@ -74,7 +74,7 @@

</span><span class="cx">     if (m_callee) {

</span><span class="cx">         if (m_callee-&gt;isObject())

</span><span class="cx">             name = getCalculatedDisplayName(vm, jsCast&lt;JSObject*&gt;(m_callee.get())).impl();

</span><del>-        else if (m_callee-&gt;isAnyWasmCallee())

</del><ins>+        else if (m_callee-&gt;isAnyWasmCallee(*m_callee-&gt;vm()))

</ins><span class="cx">             return ASCIILiteral(&quot;&lt;wasm&gt;&quot;);

</span><span class="cx">     }

</span><span class="cx">     return name.isNull() ? emptyString() : name;

</span></span></pre></div>

<a id="trunkSourceJavaScriptCoreruntimeStringIteratorPrototypecpp"></a>

<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/StringIteratorPrototype.cpp (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/JavaScriptCore/runtime/StringIteratorPrototype.cpp        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/JavaScriptCore/runtime/StringIteratorPrototype.cpp        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -47,7 +47,7 @@

</span><span class="cx"> void StringIteratorPrototype::finishCreation(VM&amp; vm, JSGlobalObject*)

</span><span class="cx"> {

</span><span class="cx">     Base::finishCreation(vm);

</span><del>-    ASSERT(inherits(info()));

</del><ins>+    ASSERT(inherits(vm, info()));

</ins><span class="cx">     putDirectWithoutTransition(vm, vm.propertyNames-&gt;toStringTagSymbol, jsString(&amp;vm, &quot;String Iterator&quot;), DontEnum | ReadOnly);

</span><span class="cx">     vm.prototypeMap.addPrototype(this);

</span><span class="cx"> }

</span></span></pre></div>

<a id="trunkSourceJavaScriptCoreruntimeStringObjectcpp"></a>

<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/StringObject.cpp (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/JavaScriptCore/runtime/StringObject.cpp        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/JavaScriptCore/runtime/StringObject.cpp        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -40,7 +40,7 @@

</span><span class="cx"> void StringObject::finishCreation(VM&amp; vm, JSString* string)

</span><span class="cx"> {

</span><span class="cx">     Base::finishCreation(vm);

</span><del>-    ASSERT(inherits(info()));

</del><ins>+    ASSERT(inherits(vm, info()));

</ins><span class="cx">     setInternalValue(vm, string);

</span><span class="cx"> }

</span><span class="cx"> 

</span></span></pre></div>

<a id="trunkSourceJavaScriptCoreruntimeStringObjecth"></a>

<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/StringObject.h (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/JavaScriptCore/runtime/StringObject.h        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/JavaScriptCore/runtime/StringObject.h        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -74,7 +74,7 @@

</span><span class="cx"> 

</span><span class="cx"> inline StringObject* asStringObject(JSValue value)

</span><span class="cx"> {

</span><del>-    ASSERT(asObject(value)-&gt;inherits(StringObject::info()));

</del><ins>+    ASSERT(asObject(value)-&gt;inherits(*value.getObject()-&gt;vm(), StringObject::info()));

</ins><span class="cx">     return static_cast&lt;StringObject*&gt;(asObject(value));

</span><span class="cx"> }

</span><span class="cx"> 

</span></span></pre></div>

<a id="trunkSourceJavaScriptCoreruntimeStringPrototypecpp"></a>

<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/StringPrototype.cpp (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/JavaScriptCore/runtime/StringPrototype.cpp        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/JavaScriptCore/runtime/StringPrototype.cpp        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -126,7 +126,7 @@

</span><span class="cx"> void StringPrototype::finishCreation(VM&amp; vm, JSGlobalObject* globalObject, JSString* nameAndMessage)

</span><span class="cx"> {

</span><span class="cx">     Base::finishCreation(vm, nameAndMessage);

</span><del>-    ASSERT(inherits(info()));

</del><ins>+    ASSERT(inherits(vm, info()));

</ins><span class="cx"> 

</span><span class="cx">     JSC_NATIVE_INTRINSIC_FUNCTION_WITHOUT_TRANSITION(vm.propertyNames-&gt;toString, stringProtoFuncToString, DontEnum, 0, StringPrototypeValueOfIntrinsic);

</span><span class="cx">     JSC_NATIVE_INTRINSIC_FUNCTION_WITHOUT_TRANSITION(vm.propertyNames-&gt;valueOf, stringProtoFuncToString, DontEnum, 0, StringPrototypeValueOfIntrinsic);

</span><span class="lines">@@ -836,7 +836,7 @@

</span><span class="cx"> ALWAYS_INLINE EncodedJSValue replace(

</span><span class="cx">     VM&amp; vm, ExecState* exec, JSString* string, JSValue searchValue, JSValue replaceValue)

</span><span class="cx"> {

</span><del>-    if (searchValue.inherits(RegExpObject::info()))

</del><ins>+    if (searchValue.inherits(vm, RegExpObject::info()))

</ins><span class="cx">         return replaceUsingRegExpSearch(vm, exec, string, searchValue, replaceValue);

</span><span class="cx">     return replaceUsingStringSearch(vm, exec, string, searchValue, replaceValue);

</span><span class="cx"> }

</span><span class="lines">@@ -863,7 +863,7 @@

</span><span class="cx">     RETURN_IF_EXCEPTION(scope, encodedJSValue());

</span><span class="cx"> 

</span><span class="cx">     JSValue searchValue = exec-&gt;argument(0);

</span><del>-    if (!searchValue.inherits(RegExpObject::info()))

</del><ins>+    if (!searchValue.inherits(vm, RegExpObject::info()))

</ins><span class="cx">         return JSValue::encode(jsUndefined());

</span><span class="cx"> 

</span><span class="cx">     scope.release();

</span><span class="lines">@@ -905,7 +905,7 @@

</span><span class="cx">     if (thisValue.isString())

</span><span class="cx">         return JSValue::encode(thisValue);

</span><span class="cx"> 

</span><del>-    if (thisValue.inherits(StringObject::info()))

</del><ins>+    if (thisValue.inherits(vm, StringObject::info()))

</ins><span class="cx">         return JSValue::encode(asStringObject(thisValue)-&gt;internalValue());

</span><span class="cx"> 

</span><span class="cx">     return throwVMTypeError(exec, scope);

</span></span></pre></div>

<a id="trunkSourceJavaScriptCoreruntimeStructureRareDatacpp"></a>

<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/StructureRareData.cpp (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/JavaScriptCore/runtime/StructureRareData.cpp        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/JavaScriptCore/runtime/StructureRareData.cpp        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -142,7 +142,7 @@

</span><span class="cx">         if (condition.condition().kind() == PropertyCondition::Presence) {

</span><span class="cx">             ASSERT(isValidOffset(condition.offset()));

</span><span class="cx">             condition.object()-&gt;structure(vm)-&gt;startWatchingPropertyForReplacements(vm, condition.offset());

</span><del>-            equivCondition = condition.attemptToMakeEquivalenceWithoutBarrier();

</del><ins>+            equivCondition = condition.attemptToMakeEquivalenceWithoutBarrier(vm);

</ins><span class="cx"> 

<span class="cx">             // The equivalence condition won't be watchable if we have already seen a replacement.

</span><span class="cx">             if (!equivCondition.isWatchable()) {

</span></span></pre></div>

<a id="trunkSourceJavaScriptCoreruntimeSymbolcpp"></a>

<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/Symbol.cpp (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/JavaScriptCore/runtime/Symbol.cpp        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/JavaScriptCore/runtime/Symbol.cpp        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -56,7 +56,7 @@

</span><span class="cx"> void Symbol::finishCreation(VM&amp; vm)

</span><span class="cx"> {

</span><span class="cx">     Base::finishCreation(vm);

</span><del>-    ASSERT(inherits(info()));

</del><ins>+    ASSERT(inherits(vm, info()));

</ins><span class="cx"> 

</span><span class="cx">     vm.symbolImplToSymbolMap.set(&amp;m_privateName.uid(), this);

</span><span class="cx"> }

</span></span></pre></div>

<a id="trunkSourceJavaScriptCoreruntimeSymbolConstructorcpp"></a>

<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/SymbolConstructor.cpp (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/JavaScriptCore/runtime/SymbolConstructor.cpp        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/JavaScriptCore/runtime/SymbolConstructor.cpp        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -66,7 +66,7 @@

</span><span class="cx"> 

</span><span class="cx"> void SymbolConstructor::finishCreation(VM&amp; vm, SymbolPrototype* prototype)

</span><span class="cx"> {

</span><del>-    Base::finishCreation(vm, prototype-&gt;classInfo()-&gt;className);

</del><ins>+    Base::finishCreation(vm, prototype-&gt;classInfo(vm)-&gt;className);

</ins><span class="cx">     putDirectWithoutTransition(vm, vm.propertyNames-&gt;prototype, prototype, DontEnum | DontDelete | ReadOnly);

</span><span class="cx">     putDirectWithoutTransition(vm, vm.propertyNames-&gt;length, jsNumber(0), DontDelete | ReadOnly | DontEnum);

</span><span class="cx"> 

</span></span></pre></div>

<a id="trunkSourceJavaScriptCoreruntimeSymbolObjectcpp"></a>

<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/SymbolObject.cpp (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/JavaScriptCore/runtime/SymbolObject.cpp        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/JavaScriptCore/runtime/SymbolObject.cpp        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -43,7 +43,7 @@

</span><span class="cx"> void SymbolObject::finishCreation(VM&amp; vm, Symbol* symbol)

</span><span class="cx"> {

</span><span class="cx">     Base::finishCreation(vm);

</span><del>-    ASSERT(inherits(info()));

</del><ins>+    ASSERT(inherits(vm, info()));

</ins><span class="cx">     setInternalValue(vm, symbol);

</span><span class="cx"> }

</span><span class="cx"> 

</span></span></pre></div>

<a id="trunkSourceJavaScriptCoreruntimeSymbolPrototypecpp"></a>

<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/SymbolPrototype.cpp (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/JavaScriptCore/runtime/SymbolPrototype.cpp        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/JavaScriptCore/runtime/SymbolPrototype.cpp        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -60,7 +60,7 @@

</span><span class="cx"> {

</span><span class="cx">     Base::finishCreation(vm);

</span><span class="cx">     putDirectWithoutTransition(vm, vm.propertyNames-&gt;toStringTagSymbol, jsString(&amp;vm, &quot;Symbol&quot;), DontEnum | ReadOnly);

</span><del>-    ASSERT(inherits(info()));

</del><ins>+    ASSERT(inherits(vm, info()));

</ins><span class="cx"> 

</span><span class="cx">     JSC_NATIVE_FUNCTION(vm.propertyNames-&gt;toPrimitiveSymbol, symbolProtoFuncValueOf, DontEnum | ReadOnly, 1);

</span><span class="cx"> }

</span><span class="lines">@@ -83,7 +83,7 @@

</span><span class="cx">         if (!thisValue.isObject())

</span><span class="cx">             return throwVMTypeError(exec, scope, SymbolToStringTypeError);

</span><span class="cx">         JSObject* thisObject = asObject(thisValue);

</span><del>-        if (!thisObject-&gt;inherits(SymbolObject::info()))

</del><ins>+        if (!thisObject-&gt;inherits(vm, SymbolObject::info()))

</ins><span class="cx">             return throwVMTypeError(exec, scope, SymbolToStringTypeError);

</span><span class="cx">         symbol = asSymbol(jsCast&lt;SymbolObject*&gt;(thisObject)-&gt;internalValue());

</span><span class="cx">     }

</span><span class="lines">@@ -104,7 +104,7 @@

</span><span class="cx">         return throwVMTypeError(exec, scope, SymbolValueOfTypeError);

</span><span class="cx"> 

</span><span class="cx">     JSObject* thisObject = asObject(thisValue);

</span><del>-    if (!thisObject-&gt;inherits(SymbolObject::info()))

</del><ins>+    if (!thisObject-&gt;inherits(vm, SymbolObject::info()))

</ins><span class="cx">         return throwVMTypeError(exec, scope, SymbolValueOfTypeError);

</span><span class="cx"> 

</span><span class="cx">     return JSValue::encode(jsCast&lt;SymbolObject*&gt;(thisObject)-&gt;internalValue());

</span></span></pre></div>

<a id="trunkSourceJavaScriptCoreruntimeTestRunnerUtilscpp"></a>

<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/TestRunnerUtils.cpp (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/JavaScriptCore/runtime/TestRunnerUtils.cpp        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/JavaScriptCore/runtime/TestRunnerUtils.cpp        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -36,11 +36,15 @@

</span><span class="cx"> 

</span><span class="cx"> FunctionExecutable* getExecutableForFunction(JSValue theFunctionValue)

</span><span class="cx"> {

</span><del>-    JSFunction* theFunction = jsDynamicCast&lt;JSFunction*&gt;(theFunctionValue);

</del><ins>+    if (!theFunctionValue.isCell())

+        return nullptr;

+

+    VM&amp; vm = *theFunctionValue.asCell()-&gt;vm();

+    JSFunction* theFunction = jsDynamicCast&lt;JSFunction*&gt;(vm, theFunctionValue);

</ins><span class="cx">     if (!theFunction)

</span><del>-        return 0;

</del><ins>+        return nullptr;

</ins><span class="cx">     

</span><del>-    FunctionExecutable* executable = jsDynamicCast&lt;FunctionExecutable*&gt;(

</del><ins>+    FunctionExecutable* executable = jsDynamicCast&lt;FunctionExecutable*&gt;(vm, 

</ins><span class="cx">         theFunction-&gt;executable());

</span><span class="cx">     return executable;

</span><span class="cx"> }

</span></span></pre></div>

<a id="trunkSourceJavaScriptCoreruntimeThrowScopecpp"></a>

<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/ThrowScope.cpp (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/JavaScriptCore/runtime/ThrowScope.cpp        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/JavaScriptCore/runtime/ThrowScope.cpp        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -80,7 +80,7 @@

</span><span class="cx"> 

</span><span class="cx"> JSValue ThrowScope::throwException(ExecState* exec, JSValue error)

</span><span class="cx"> {

</span><del>-    if (!error.isCell() || !jsDynamicCast&lt;Exception*&gt;(error.asCell()))

</del><ins>+    if (!error.isCell() || !jsDynamicCast&lt;Exception*&gt;(m_vm, error.asCell()))

</ins><span class="cx">         m_vm.verifyExceptionCheckNeedIsSatisfied(m_recursionDepth, m_location);

</span><span class="cx">     

</span><span class="cx">     return m_vm.throwException(exec, error);

</span><span class="lines">@@ -88,7 +88,7 @@

</span><span class="cx"> 

</span><span class="cx"> JSObject* ThrowScope::throwException(ExecState* exec, JSObject* obj)

</span><span class="cx"> {

</span><del>-    if (!jsDynamicCast&lt;Exception*&gt;(obj))

</del><ins>+    if (!jsDynamicCast&lt;Exception*&gt;(m_vm, obj))

</ins><span class="cx">         m_vm.verifyExceptionCheckNeedIsSatisfied(m_recursionDepth, m_location);

</span><span class="cx">     

</span><span class="cx">     return m_vm.throwException(exec, obj);

</span></span></pre></div>

<a id="trunkSourceJavaScriptCoreruntimeVMcpp"></a>

<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/VM.cpp (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/JavaScriptCore/runtime/VM.cpp        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/JavaScriptCore/runtime/VM.cpp        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -623,7 +623,8 @@

</span><span class="cx"> 

</span><span class="cx"> JSValue VM::throwException(ExecState* exec, JSValue thrownValue)

</span><span class="cx"> {

</span><del>-    Exception* exception = jsDynamicCast&lt;Exception*&gt;(thrownValue);

</del><ins>+    VM&amp; vm = exec-&gt;vm();

+    Exception* exception = jsDynamicCast&lt;Exception*&gt;(vm, thrownValue);

</ins><span class="cx">     if (!exception)

</span><span class="cx">         exception = Exception::create(*this, thrownValue);

</span><span class="cx"> 

</span></span></pre></div>

<a id="trunkSourceJavaScriptCoreruntimeWeakMapConstructorcpp"></a>

<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/WeakMapConstructor.cpp (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/JavaScriptCore/runtime/WeakMapConstructor.cpp        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/JavaScriptCore/runtime/WeakMapConstructor.cpp        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -40,7 +40,7 @@

</span><span class="cx"> 

</span><span class="cx"> void WeakMapConstructor::finishCreation(VM&amp; vm, WeakMapPrototype* prototype)

</span><span class="cx"> {

</span><del>-    Base::finishCreation(vm, prototype-&gt;classInfo()-&gt;className);

</del><ins>+    Base::finishCreation(vm, prototype-&gt;classInfo(vm)-&gt;className);

</ins><span class="cx">     putDirectWithoutTransition(vm, vm.propertyNames-&gt;prototype, prototype, DontEnum | DontDelete | ReadOnly);

</span><span class="cx">     putDirectWithoutTransition(vm, vm.propertyNames-&gt;length, jsNumber(0), DontEnum | ReadOnly);

</span><span class="cx"> }

</span></span></pre></div>

<a id="trunkSourceJavaScriptCoreruntimeWeakMapPrototypecpp"></a>

<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/WeakMapPrototype.cpp (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/JavaScriptCore/runtime/WeakMapPrototype.cpp        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/JavaScriptCore/runtime/WeakMapPrototype.cpp        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -42,7 +42,7 @@

</span><span class="cx"> void WeakMapPrototype::finishCreation(VM&amp; vm, JSGlobalObject* globalObject)

</span><span class="cx"> {

</span><span class="cx">     Base::finishCreation(vm);

</span><del>-    ASSERT(inherits(info()));

</del><ins>+    ASSERT(inherits(vm, info()));

</ins><span class="cx">     vm.prototypeMap.addPrototype(this);

</span><span class="cx"> 

</span><span class="cx">     JSC_NATIVE_FUNCTION_WITHOUT_TRANSITION(vm.propertyNames-&gt;deleteKeyword, protoFuncWeakMapDelete, DontEnum, 1);

</span><span class="lines">@@ -63,7 +63,7 @@

</span><span class="cx">         return nullptr;

</span><span class="cx">     }

</span><span class="cx"> 

</span><del>-    if (JSWeakMap* weakMap = jsDynamicCast&lt;JSWeakMap*&gt;(value))

</del><ins>+    if (JSWeakMap* weakMap = jsDynamicCast&lt;JSWeakMap*&gt;(vm, value))

</ins><span class="cx">         return weakMap-&gt;weakMapData();

</span><span class="cx"> 

</span><span class="cx">     throwTypeError(callFrame, scope, WTF::ASCIILiteral(&quot;Called WeakMap function on a non-WeakMap object&quot;));

</span></span></pre></div>

<a id="trunkSourceJavaScriptCoreruntimeWeakSetConstructorcpp"></a>

<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/WeakSetConstructor.cpp (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/JavaScriptCore/runtime/WeakSetConstructor.cpp        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/JavaScriptCore/runtime/WeakSetConstructor.cpp        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -40,7 +40,7 @@

</span><span class="cx"> 

</span><span class="cx"> void WeakSetConstructor::finishCreation(VM&amp; vm, WeakSetPrototype* prototype)

</span><span class="cx"> {

</span><del>-    Base::finishCreation(vm, prototype-&gt;classInfo()-&gt;className);

</del><ins>+    Base::finishCreation(vm, prototype-&gt;classInfo(vm)-&gt;className);

</ins><span class="cx">     putDirectWithoutTransition(vm, vm.propertyNames-&gt;prototype, prototype, DontEnum | DontDelete | ReadOnly);

</span><span class="cx">     putDirectWithoutTransition(vm, vm.propertyNames-&gt;length, jsNumber(0), DontEnum | ReadOnly);

</span><span class="cx"> }

</span></span></pre></div>

<a id="trunkSourceJavaScriptCoreruntimeWeakSetPrototypecpp"></a>

<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/WeakSetPrototype.cpp (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/JavaScriptCore/runtime/WeakSetPrototype.cpp        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/JavaScriptCore/runtime/WeakSetPrototype.cpp        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -41,7 +41,7 @@

</span><span class="cx"> void WeakSetPrototype::finishCreation(VM&amp; vm, JSGlobalObject* globalObject)

</span><span class="cx"> {

</span><span class="cx">     Base::finishCreation(vm);

</span><del>-    ASSERT(inherits(info()));

</del><ins>+    ASSERT(inherits(vm, info()));

</ins><span class="cx">     vm.prototypeMap.addPrototype(this);

</span><span class="cx"> 

</span><span class="cx">     JSC_NATIVE_FUNCTION_WITHOUT_TRANSITION(vm.propertyNames-&gt;deleteKeyword, protoFuncWeakSetDelete, DontEnum, 1);

</span><span class="lines">@@ -61,7 +61,7 @@

</span><span class="cx">         return nullptr;

</span><span class="cx">     }

</span><span class="cx"> 

</span><del>-    if (JSWeakSet* weakSet = jsDynamicCast&lt;JSWeakSet*&gt;(value))

</del><ins>+    if (JSWeakSet* weakSet = jsDynamicCast&lt;JSWeakSet*&gt;(vm, value))

</ins><span class="cx">         return weakSet-&gt;weakMapData();

</span><span class="cx"> 

</span><span class="cx">     throwTypeError(callFrame, scope, WTF::ASCIILiteral(&quot;Called WeakSet function on a non-WeakSet object&quot;));

</span></span></pre></div>

<a id="trunkSourceJavaScriptCoretoolsJSDollarVMPrototypecpp"></a>

<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/tools/JSDollarVMPrototype.cpp (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/JavaScriptCore/tools/JSDollarVMPrototype.cpp        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/JavaScriptCore/tools/JSDollarVMPrototype.cpp        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -276,6 +276,7 @@

</span><span class="cx"> 

</span><span class="cx"> static CodeBlock* codeBlockFromArg(ExecState* exec)

</span><span class="cx"> {

</span><ins>+    VM&amp; vm = exec-&gt;vm();

</ins><span class="cx">     if (exec-&gt;argumentCount() &lt; 1)

</span><span class="cx">         return nullptr;

</span><span class="cx"> 

</span><span class="lines">@@ -282,7 +283,7 @@

</span><span class="cx">     JSValue value = exec-&gt;uncheckedArgument(0);

</span><span class="cx">     CodeBlock* candidateCodeBlock = nullptr;

</span><span class="cx">     if (value.isCell()) {

</span><del>-        JSFunction* func = jsDynamicCast&lt;JSFunction*&gt;(value.asCell());

</del><ins>+        JSFunction* func = jsDynamicCast&lt;JSFunction*&gt;(vm, value.asCell());

</ins><span class="cx">         if (func) {

</span><span class="cx">             if (func-&gt;isHostFunction())

</span><span class="cx">                 candidateCodeBlock = nullptr;

</span></span></pre></div>

<a id="trunkSourceJavaScriptCorewasmJSWebAssemblycpp"></a>

<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/wasm/JSWebAssembly.cpp (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/JavaScriptCore/wasm/JSWebAssembly.cpp        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/JavaScriptCore/wasm/JSWebAssembly.cpp        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -96,7 +96,7 @@

</span><span class="cx"> void JSWebAssembly::finishCreation(VM&amp; vm, JSGlobalObject* globalObject)

</span><span class="cx"> {

</span><span class="cx">     Base::finishCreation(vm);

</span><del>-    ASSERT(inherits(info()));

</del><ins>+    ASSERT(inherits(vm, info()));

</ins><span class="cx">     JSC_NATIVE_FUNCTION_WITHOUT_TRANSITION(&quot;validate&quot;, webAssemblyValidateFunc, DontEnum, 1);

</span><span class="cx">     JSC_NATIVE_FUNCTION_WITHOUT_TRANSITION(&quot;compile&quot;, webAssemblyCompileFunc, DontEnum, 1);

</span><span class="cx"> }

</span></span></pre></div>

<a id="trunkSourceJavaScriptCorewasmjsJSWebAssemblyHelpersh"></a>

<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/wasm/js/JSWebAssemblyHelpers.h (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/JavaScriptCore/wasm/js/JSWebAssemblyHelpers.h        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/JavaScriptCore/wasm/js/JSWebAssemblyHelpers.h        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -52,8 +52,8 @@

</span><span class="cx">     VM&amp; vm = exec-&gt;vm();

</span><span class="cx">     auto throwScope = DECLARE_THROW_SCOPE(vm);

<span class="cx">     // If the given bytes argument is not a BufferSource, a TypeError exception is thrown.

</span><del>-    JSArrayBuffer* arrayBuffer = value.getObject() ? jsDynamicCast&lt;JSArrayBuffer*&gt;(value.getObject()) : nullptr;

-    JSArrayBufferView* arrayBufferView = value.getObject() ? jsDynamicCast&lt;JSArrayBufferView*&gt;(value.getObject()) : nullptr;

</del><ins>+    JSArrayBuffer* arrayBuffer = value.getObject() ? jsDynamicCast&lt;JSArrayBuffer*&gt;(vm, value.getObject()) : nullptr;

+    JSArrayBufferView* arrayBufferView = value.getObject() ? jsDynamicCast&lt;JSArrayBufferView*&gt;(vm, value.getObject()) : nullptr;

</ins><span class="cx">     if (!(arrayBuffer || arrayBufferView)) {

</span><span class="cx">         throwException(exec, throwScope, createTypeError(exec,

</span><span class="cx">             ASCIILiteral(&quot;first argument must be an ArrayBufferView or an ArrayBuffer&quot;), defaultSourceAppender, runtimeTypeForValue(value)));

</span></span></pre></div>

<a id="trunkSourceJavaScriptCorewasmjsJSWebAssemblyInstancecpp"></a>

<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/wasm/js/JSWebAssemblyInstance.cpp (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/JavaScriptCore/wasm/js/JSWebAssemblyInstance.cpp        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/JavaScriptCore/wasm/js/JSWebAssemblyInstance.cpp        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -61,7 +61,7 @@

</span><span class="cx"> void JSWebAssemblyInstance::finishCreation(VM&amp; vm, JSWebAssemblyModule* module, JSModuleNamespaceObject* moduleNamespaceObject)

</span><span class="cx"> {

</span><span class="cx">     Base::finishCreation(vm);

</span><del>-    ASSERT(inherits(info()));

</del><ins>+    ASSERT(inherits(vm, info()));

</ins><span class="cx"> 

</span><span class="cx">     const size_t extraMemorySize = module-&gt;moduleInformation().globals.size() * sizeof(Register);

</span><span class="cx">     m_globals = MallocPtr&lt;uint64_t&gt;::malloc(extraMemorySize);

</span></span></pre></div>

<a id="trunkSourceJavaScriptCorewasmjsJSWebAssemblyMemorycpp"></a>

<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/wasm/js/JSWebAssemblyMemory.cpp (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/JavaScriptCore/wasm/js/JSWebAssemblyMemory.cpp        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/JavaScriptCore/wasm/js/JSWebAssemblyMemory.cpp        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -55,15 +55,6 @@

</span><span class="cx"> {

</span><span class="cx"> }

</span><span class="cx"> 

</span><del>-JSWebAssemblyMemory::~JSWebAssemblyMemory()

-{

-    if (m_buffer) {

-        ArrayBufferContents dummyContents;

-        m_buffer-&gt;transferTo(dummyContents);

-        m_buffer = nullptr;

-    }

-}

-

</del><span class="cx"> JSArrayBuffer* JSWebAssemblyMemory::buffer(VM&amp; vm, JSGlobalObject* globalObject)

</span><span class="cx"> {

</span><span class="cx">     if (m_bufferWrapper)

</span><span class="lines">@@ -114,7 +105,7 @@

<span class="cx">     // Neuter the old array.

</span><span class="cx">     if (m_buffer) {

</span><span class="cx">         ArrayBufferContents dummyContents;

</span><del>-        m_buffer-&gt;transferTo(dummyContents);

</del><ins>+        m_buffer-&gt;transferTo(vm, dummyContents);

</ins><span class="cx">         m_buffer = nullptr;

</span><span class="cx">         m_bufferWrapper.clear();

</span><span class="cx">     }

</span><span class="lines">@@ -125,12 +116,22 @@

</span><span class="cx"> void JSWebAssemblyMemory::finishCreation(VM&amp; vm)

</span><span class="cx"> {

</span><span class="cx">     Base::finishCreation(vm);

</span><del>-    ASSERT(inherits(info()));

</del><ins>+    ASSERT(inherits(vm, info()));

</ins><span class="cx"> }

</span><span class="cx"> 

</span><span class="cx"> void JSWebAssemblyMemory::destroy(JSCell* cell)

</span><span class="cx"> {

</span><del>-    static_cast&lt;JSWebAssemblyMemory*&gt;(cell)-&gt;JSWebAssemblyMemory::~JSWebAssemblyMemory();

</del><ins>+    auto memory = static_cast&lt;JSWebAssemblyMemory*&gt;(cell);

+    ASSERT(memory-&gt;classInfo() == info());

+    VM&amp; vm = *memory-&gt;vm();

+

+    if (memory-&gt;m_buffer) {

+        ArrayBufferContents dummyContents;

+        memory-&gt;m_buffer-&gt;transferTo(vm, dummyContents);

+        memory-&gt;m_buffer = nullptr;

+    }

+

+    memory-&gt;JSWebAssemblyMemory::~JSWebAssemblyMemory();

</ins><span class="cx"> }

</span><span class="cx"> 

</span><span class="cx"> void JSWebAssemblyMemory::visitChildren(JSCell* cell, SlotVisitor&amp; visitor)

</span></span></pre></div>

<a id="trunkSourceJavaScriptCorewasmjsJSWebAssemblyMemoryh"></a>

<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/wasm/js/JSWebAssemblyMemory.h (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/JavaScriptCore/wasm/js/JSWebAssemblyMemory.h        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/JavaScriptCore/wasm/js/JSWebAssemblyMemory.h        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -55,7 +55,6 @@

</span><span class="cx"> 

</span><span class="cx"> protected:

</span><span class="cx">     JSWebAssemblyMemory(VM&amp;, Structure*, Wasm::Memory&amp;&amp;);

</span><del>-    ~JSWebAssemblyMemory();

</del><span class="cx">     void finishCreation(VM&amp;);

</span><span class="cx">     static void destroy(JSCell*);

</span><span class="cx">     static void visitChildren(JSCell*, SlotVisitor&amp;);

</span></span></pre></div>

<a id="trunkSourceJavaScriptCorewasmjsJSWebAssemblyModulecpp"></a>

<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/wasm/js/JSWebAssemblyModule.cpp (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/JavaScriptCore/wasm/js/JSWebAssemblyModule.cpp        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/JavaScriptCore/wasm/js/JSWebAssemblyModule.cpp        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -63,7 +63,7 @@

</span><span class="cx"> void JSWebAssemblyModule::finishCreation(VM&amp; vm, SymbolTable* exportSymbolTable)

</span><span class="cx"> {

</span><span class="cx">     Base::finishCreation(vm);

</span><del>-    ASSERT(inherits(info()));

</del><ins>+    ASSERT(inherits(vm, info()));

</ins><span class="cx">     m_exportSymbolTable.set(vm, this, exportSymbolTable);

</span><span class="cx"> }

</span><span class="cx"> 

</span></span></pre></div>

<a id="trunkSourceJavaScriptCorewasmjsJSWebAssemblyTablecpp"></a>

<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/wasm/js/JSWebAssemblyTable.cpp (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/JavaScriptCore/wasm/js/JSWebAssemblyTable.cpp        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/JavaScriptCore/wasm/js/JSWebAssemblyTable.cpp        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -75,7 +75,7 @@

</span><span class="cx"> void JSWebAssemblyTable::finishCreation(VM&amp; vm)

</span><span class="cx"> {

</span><span class="cx">     Base::finishCreation(vm);

</span><del>-    ASSERT(inherits(info()));

</del><ins>+    ASSERT(inherits(vm, info()));

</ins><span class="cx"> }

</span><span class="cx"> 

</span><span class="cx"> void JSWebAssemblyTable::destroy(JSCell* cell)

</span></span></pre></div>

<a id="trunkSourceJavaScriptCorewasmjsWebAssemblyFunctioncpp"></a>

<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/wasm/js/WebAssemblyFunction.cpp (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/JavaScriptCore/wasm/js/WebAssemblyFunction.cpp        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/JavaScriptCore/wasm/js/WebAssemblyFunction.cpp        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -50,7 +50,7 @@

</span><span class="cx"> {

</span><span class="cx">     VM&amp; vm = exec-&gt;vm();

</span><span class="cx">     auto scope = DECLARE_THROW_SCOPE(vm);

</span><del>-    WebAssemblyFunction* wasmFunction = jsDynamicCast&lt;WebAssemblyFunction*&gt;(exec-&gt;jsCallee());

</del><ins>+    WebAssemblyFunction* wasmFunction = jsDynamicCast&lt;WebAssemblyFunction*&gt;(vm, exec-&gt;jsCallee());

</ins><span class="cx">     if (!wasmFunction)

</span><span class="cx">         return JSValue::encode(throwException(exec, scope, createTypeError(exec, &quot;expected a WebAssembly function&quot;, defaultSourceAppender, runtimeTypeForValue(exec-&gt;jsCallee()))));

</span><span class="cx">     Wasm::SignatureIndex signatureIndex = wasmFunction-&gt;signatureIndex();

</span><span class="lines">@@ -174,7 +174,7 @@

</span><span class="cx"> void WebAssemblyFunction::finishCreation(VM&amp; vm, NativeExecutable* executable, unsigned length, const String&amp; name, JSWebAssemblyInstance* instance, JSWebAssemblyCallee* jsEntrypoint, JSWebAssemblyCallee* wasmEntrypoint)

</span><span class="cx"> {

</span><span class="cx">     Base::finishCreation(vm, executable, length, name);

</span><del>-    ASSERT(inherits(info()));

</del><ins>+    ASSERT(inherits(vm, info()));

</ins><span class="cx">     m_instance.set(vm, this, instance);

</span><span class="cx">     ASSERT(jsEntrypoint != wasmEntrypoint);

</span><span class="cx">     m_jsEntrypoint.set(vm, this, jsEntrypoint);

</span></span></pre></div>

<a id="trunkSourceJavaScriptCorewasmjsWebAssemblyInstanceConstructorcpp"></a>

<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/wasm/js/WebAssemblyInstanceConstructor.cpp (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/JavaScriptCore/wasm/js/WebAssemblyInstanceConstructor.cpp        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/JavaScriptCore/wasm/js/WebAssemblyInstanceConstructor.cpp        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -60,7 +60,7 @@

</span><span class="cx">     auto* globalObject = exec-&gt;lexicalGlobalObject();

</span><span class="cx"> 

<span class="cx">     // If moduleObject is not a WebAssembly.Module instance, a TypeError is thrown.

</span><del>-    JSWebAssemblyModule* jsModule = jsDynamicCast&lt;JSWebAssemblyModule*&gt;(exec-&gt;argument(0));

</del><ins>+    JSWebAssemblyModule* jsModule = jsDynamicCast&lt;JSWebAssemblyModule*&gt;(vm, exec-&gt;argument(0));

</ins><span class="cx">     if (!jsModule)

</span><span class="cx">         return JSValue::encode(throwException(exec, throwScope, createTypeError(exec, ASCIILiteral(&quot;first argument to WebAssembly.Instance must be a WebAssembly.Module&quot;), defaultSourceAppender, runtimeTypeForValue(exec-&gt;argument(0)))));

</span><span class="cx">     const Wasm::ModuleInformation&amp; moduleInformation = jsModule-&gt;moduleInformation();

</span><span class="lines">@@ -119,7 +119,7 @@

</span><span class="cx">                 return JSValue::encode(throwException(exec, throwScope, createJSWebAssemblyLinkError(exec, vm, ASCIILiteral(&quot;import function must be callable&quot;))));

</span><span class="cx">             JSCell* cell = value.asCell();

</span><span class="cx">             // ii. If v is an Exported Function Exotic Object:

</span><del>-            if (WebAssemblyFunction* importedExport = jsDynamicCast&lt;WebAssemblyFunction*&gt;(cell)) {

</del><ins>+            if (WebAssemblyFunction* importedExport = jsDynamicCast&lt;WebAssemblyFunction*&gt;(vm, cell)) {

</ins><span class="cx">                 // a. If the signature of v does not match the signature of i, throw a WebAssembly.LinkError.

</span><span class="cx">                 Wasm::SignatureIndex importedSignatureIndex = importedExport-&gt;signatureIndex();

</span><span class="cx">                 Wasm::SignatureIndex expectedSignatureIndex = moduleInformation.importFunctionSignatureIndices[import.kindIndex];

</span><span class="lines">@@ -140,7 +140,7 @@

<span class="cx">             RELEASE_ASSERT(!hasTableImport); // This should be guaranteed by a validation failure.

</span><span class="cx">             // 7. Otherwise (i is a table import):

</span><span class="cx">             hasTableImport = true;

</span><del>-            JSWebAssemblyTable* table = jsDynamicCast&lt;JSWebAssemblyTable*&gt;(value);

</del><ins>+            JSWebAssemblyTable* table = jsDynamicCast&lt;JSWebAssemblyTable*&gt;(vm, value);

</ins><span class="cx">             // i. If v is not a WebAssembly.Table object, throw a WebAssembly.LinkError.

</span><span class="cx">             if (!table)

</span><span class="cx">                 return JSValue::encode(throwException(exec, throwScope, createJSWebAssemblyLinkError(exec, vm, ASCIILiteral(&quot;Table import is not an instance of WebAssembly.Table&quot;))));

</span><span class="lines">@@ -172,7 +172,7 @@

<span class="cx">             RELEASE_ASSERT(!hasMemoryImport); // This should be guaranteed by a validation failure.

</span><span class="cx">             RELEASE_ASSERT(moduleInformation.memory);

</span><span class="cx">             hasMemoryImport = true;

</span><del>-            JSWebAssemblyMemory* memory = jsDynamicCast&lt;JSWebAssemblyMemory*&gt;(value);

</del><ins>+            JSWebAssemblyMemory* memory = jsDynamicCast&lt;JSWebAssemblyMemory*&gt;(vm, value);

</ins><span class="cx">             // i. If v is not a WebAssembly.Memory object, throw a WebAssembly.LinkError.

</span><span class="cx">             if (!memory)

</span><span class="cx">                 return JSValue::encode(throwException(exec, throwScope, createJSWebAssemblyLinkError(exec, vm, ASCIILiteral(&quot;Memory import is not an instance of WebAssembly.Memory&quot;))));

</span></span></pre></div>

<a id="trunkSourceJavaScriptCorewasmjsWebAssemblyMemoryPrototypecpp"></a>

<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/wasm/js/WebAssemblyMemoryPrototype.cpp (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/JavaScriptCore/wasm/js/WebAssemblyMemoryPrototype.cpp        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/JavaScriptCore/wasm/js/WebAssemblyMemoryPrototype.cpp        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -58,7 +58,7 @@

</span><span class="cx">     VM&amp; vm = exec-&gt;vm();

</span><span class="cx">     auto throwScope = DECLARE_THROW_SCOPE(vm);

</span><span class="cx"> 

</span><del>-    JSWebAssemblyMemory* memory = jsDynamicCast&lt;JSWebAssemblyMemory*&gt;(value); 

</del><ins>+    JSWebAssemblyMemory* memory = jsDynamicCast&lt;JSWebAssemblyMemory*&gt;(vm, value); 

</ins><span class="cx">     if (!memory) {

</span><span class="cx">         throwException(exec, throwScope, 

</span><span class="cx">             createTypeError(exec, ASCIILiteral(&quot;WebAssembly.Memory.prototype.buffer getter called with non WebAssembly.Memory |this| value&quot;)));

</span></span></pre></div>

<a id="trunkSourceJavaScriptCorewasmjsWebAssemblyModulePrototypecpp"></a>

<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/wasm/js/WebAssemblyModulePrototype.cpp (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/JavaScriptCore/wasm/js/WebAssemblyModulePrototype.cpp        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/JavaScriptCore/wasm/js/WebAssemblyModulePrototype.cpp        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -56,7 +56,7 @@

</span><span class="cx">     auto* globalObject = exec-&gt;lexicalGlobalObject();

</span><span class="cx">     auto throwScope = DECLARE_THROW_SCOPE(vm);

</span><span class="cx"> 

</span><del>-    JSWebAssemblyModule* module = jsDynamicCast&lt;JSWebAssemblyModule*&gt;(exec-&gt;thisValue());

</del><ins>+    JSWebAssemblyModule* module = jsDynamicCast&lt;JSWebAssemblyModule*&gt;(vm, exec-&gt;thisValue());

</ins><span class="cx">     if (!module)

</span><span class="cx">         throwException(exec, throwScope, createTypeError(exec, ASCIILiteral(&quot;WebAssembly.Module.prototype.customSections called with non WebAssembly.Module |this| value&quot;)));

</span><span class="cx">     RETURN_IF_EXCEPTION(throwScope, { });

</span></span></pre></div>

<a id="trunkSourceJavaScriptCorewasmjsWebAssemblyModuleRecordcpp"></a>

<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/wasm/js/WebAssemblyModuleRecord.cpp (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/JavaScriptCore/wasm/js/WebAssemblyModuleRecord.cpp        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/JavaScriptCore/wasm/js/WebAssemblyModuleRecord.cpp        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -71,7 +71,7 @@

</span><span class="cx"> void WebAssemblyModuleRecord::finishCreation(ExecState* exec, VM&amp; vm, const Wasm::ModuleInformation&amp; moduleInformation)

</span><span class="cx"> {

</span><span class="cx">     Base::finishCreation(exec, vm);

</span><del>-    ASSERT(inherits(info()));

</del><ins>+    ASSERT(inherits(vm, info()));

</ins><span class="cx">     for (const auto&amp; exp : moduleInformation.exports)

</span><span class="cx">         addExportEntry(ExportEntry::createLocal(exp.field, exp.field));

</span><span class="cx"> }

</span></span></pre></div>

<a id="trunkSourceJavaScriptCorewasmjsWebAssemblyTablePrototypecpp"></a>

<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/wasm/js/WebAssemblyTablePrototype.cpp (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/JavaScriptCore/wasm/js/WebAssemblyTablePrototype.cpp        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/JavaScriptCore/wasm/js/WebAssemblyTablePrototype.cpp        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -47,7 +47,7 @@

</span><span class="cx"> static ALWAYS_INLINE JSWebAssemblyTable* getTable(ExecState* exec, VM&amp; vm, JSValue v)

</span><span class="cx"> {

</span><span class="cx">     auto throwScope = DECLARE_THROW_SCOPE(vm);

</span><del>-    JSWebAssemblyTable* result = jsDynamicCast&lt;JSWebAssemblyTable*&gt;(v);

</del><ins>+    JSWebAssemblyTable* result = jsDynamicCast&lt;JSWebAssemblyTable*&gt;(vm, v);

</ins><span class="cx">     if (!result) {

</span><span class="cx">         throwException(exec, throwScope, 

</span><span class="cx">             createTypeError(exec, ASCIILiteral(&quot;expected |this| value to be an instance of WebAssembly.Table&quot;)));

</span><span class="lines">@@ -120,7 +120,7 @@

</span><span class="cx">     RETURN_IF_EXCEPTION(throwScope, encodedJSValue());

</span><span class="cx"> 

</span><span class="cx">     JSValue value = exec-&gt;argument(1);

</span><del>-    WebAssemblyFunction* function = jsDynamicCast&lt;WebAssemblyFunction*&gt;(value);

</del><ins>+    WebAssemblyFunction* function = jsDynamicCast&lt;WebAssemblyFunction*&gt;(vm, value);

</ins><span class="cx">     if (!value.isNull() &amp;&amp; !function) {

</span><span class="cx">         throwException(exec, throwScope,

</span><span class="cx">             createTypeError(exec, ASCIILiteral(&quot;WebAssembly.Table.prototype.set expects the second argument to be null or an instance of WebAssembly.Function&quot;)));

</span></span></pre></div>

<a id="trunkSourceWebCoreChangeLog"></a>

<div class="modfile"><h4>Modified: trunk/Source/WebCore/ChangeLog (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/WebCore/ChangeLog        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/WebCore/ChangeLog        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -1,3 +1,423 @@

</span><ins>+2017-01-26  Keith Miller  &lt;keith_miller@apple.com&gt;

+

+        classInfo should take a VM so it is not materialized from the object on each call

+        https://bugs.webkit.org/show_bug.cgi?id=167424

+

+        Rubber Stamped by Michael Saboff.

+

+        Previously, classInfo() would get the VM from the target's

+        MarkedBlock.  Most callers already have a VM on hand, so it is

+        wasteful to compute the VM from the marked block every time. This

+        patch refactors some of the most common callers of classInfo(),

+        jsDynamicCast and inherits to take a VM as well.

+

+        * Modules/fetch/FetchBody.cpp:

+        (WebCore::FetchBody::extract):

+        * Modules/plugins/QuickTimePluginReplacement.mm:

+        (WebCore::QuickTimePluginReplacement::installReplacement):

+        * bindings/js/IDBBindingUtilities.cpp:

+        (WebCore::createIDBKeyFromValue):

+        * bindings/js/JSCommandLineAPIHostCustom.cpp:

+        (WebCore::JSCommandLineAPIHost::getEventListeners):

+        (WebCore::JSCommandLineAPIHost::databaseId):

+        (WebCore::JSCommandLineAPIHost::storageId):

+        * bindings/js/JSCryptoAlgorithmDictionary.cpp:

+        (WebCore::JSCryptoAlgorithmDictionary::parseAlgorithmIdentifier):

+        (WebCore::createRsaKeyGenParams):

+        * bindings/js/JSCryptoCustom.cpp:

+        (WebCore::JSCrypto::getRandomValues):

+        * bindings/js/JSCryptoOperationData.cpp:

+        (WebCore::cryptoOperationDataFromJSValue):

+        * bindings/js/JSCustomElementInterface.cpp:

+        (WebCore::constructCustomElementSynchronously):

+        (WebCore::JSCustomElementInterface::upgradeElement):

+        * bindings/js/JSDOMBinding.cpp:

+        (WebCore::valueToDate):

+        (WebCore::reportException):

+        (WebCore::retrieveErrorMessage):

+        * bindings/js/JSDOMBinding.h:

+        (WebCore::castThisValue):

+        (WebCore::toPossiblySharedArrayBufferView):

+        (WebCore::toUnsharedArrayBufferView):

+        (WebCore::toPossiblySharedInt8Array):

+        (WebCore::toPossiblySharedInt16Array):

+        (WebCore::toPossiblySharedInt32Array):

+        (WebCore::toPossiblySharedUint8Array):

+        (WebCore::toPossiblySharedUint8ClampedArray):

+        (WebCore::toPossiblySharedUint16Array):

+        (WebCore::toPossiblySharedUint32Array):

+        (WebCore::toPossiblySharedFloat32Array):

+        (WebCore::toPossiblySharedFloat64Array):

+        (WebCore::toUnsharedInt8Array):

+        (WebCore::toUnsharedInt16Array):

+        (WebCore::toUnsharedInt32Array):

+        (WebCore::toUnsharedUint8Array):

+        (WebCore::toUnsharedUint8ClampedArray):

+        (WebCore::toUnsharedUint16Array):

+        (WebCore::toUnsharedUint32Array):

+        (WebCore::toUnsharedFloat32Array):

+        (WebCore::toUnsharedFloat64Array):

+        (WebCore::toRefNativeArray):

+        * bindings/js/JSDOMConstructor.h:

+        (WebCore::JSDOMConstructorNotConstructable&lt;JSClass&gt;::finishCreation):

+        (WebCore::JSDOMConstructor&lt;JSClass&gt;::finishCreation):

+        (WebCore::JSDOMNamedConstructor&lt;JSClass&gt;::finishCreation):

+        (WebCore::JSBuiltinConstructor&lt;JSClass&gt;::finishCreation):

+        * bindings/js/JSDOMConvert.h:

+        (WebCore::Converter&lt;IDLInterface&lt;T&gt;&gt;::convert):

+        (WebCore::Converter&lt;IDLXPathNSResolver&lt;T&gt;&gt;::convert):

+        * bindings/js/JSDOMGlobalObject.cpp:

+        (WebCore::JSDOMGlobalObject::finishCreation):

+        (WebCore::JSDOMGlobalObject::scriptExecutionContext):

+        * bindings/js/JSDOMIterator.h:

+        (WebCore::IteratorTraits&gt;::next):

+        (WebCore::IteratorTraits&gt;::finishCreation):

+        * bindings/js/JSDOMWindowBase.cpp:

+        (WebCore::JSDOMWindowBase::finishCreation):

+        (WebCore::toJSDOMWindow):

+        * bindings/js/JSDOMWindowBase.h:

+        * bindings/js/JSDOMWindowCustom.cpp:

+        (WebCore::jsDOMWindowWebKit):

+        (WebCore::JSDOMWindow::toWrapped):

+        * bindings/js/JSDOMWindowShell.cpp:

+        (WebCore::JSDOMWindowShell::finishCreation):

+        (WebCore::JSDOMWindowShell::toWrapped):

+        * bindings/js/JSDOMWindowShell.h:

+        * bindings/js/JSDocumentCustom.cpp:

+        (WebCore::cachedDocumentWrapper):

+        (WebCore::JSDocument::createTouchList):

+        * bindings/js/JSDynamicDowncast.h:

+        (WebCore::JSDynamicCastTrait::cast):

+        (WebCore::JSDynamicCastTrait&lt;JSNode&gt;::cast):

+        (WebCore::JSDynamicCastTrait&lt;JSElement&gt;::cast):

+        (WebCore::JSDynamicCastTrait&lt;JSDocument&gt;::cast):

+        (WebCore::JSDynamicCastTrait&lt;JSEvent&gt;::cast):

+        (WebCore::jsDynamicDowncast):

+        * bindings/js/JSEventListener.cpp:

+        (WebCore::JSEventListener::handleEvent):

+        * bindings/js/JSEventTargetCustom.cpp:

+        (WebCore::JSEventTarget::toWrapped):

+        (WebCore::jsEventTargetCast):

+        * bindings/js/JSEventTargetCustom.h:

+        (WebCore::BindingCaller&lt;JSEventTarget&gt;::callOperation):

+        * bindings/js/JSExceptionBase.cpp:

+        (WebCore::toExceptionBase):

+        * bindings/js/JSExceptionBase.h:

+        * bindings/js/JSInspectorFrontendHostCustom.cpp:

+        (WebCore::populateContextMenuItems):

+        (WebCore::JSInspectorFrontendHost::showContextMenu):

+        * bindings/js/JSNodeCustom.cpp:

+        (WebCore::JSNode::insertBefore):

+        (WebCore::JSNode::replaceChild):

+        (WebCore::JSNode::removeChild):

+        (WebCore::JSNode::appendChild):

+        (WebCore::JSNode::pushEventHandlerScope):

+        * bindings/js/JSPluginElementFunctions.cpp:

+        (WebCore::pluginElementPropertyGetter):

+        * bindings/js/JSReadableStreamPrivateConstructors.cpp:

+        (WebCore::constructJSReadableStreamDefaultReader):

+        * bindings/js/JSReadableStreamSourceCustom.cpp:

+        (WebCore::startReadableStream):

+        (WebCore::JSReadableStreamSource::start):

+        (WebCore::pullReadableStream):

+        * bindings/js/JSSubtleCryptoCustom.cpp:

+        (WebCore::toCryptoKey):

+        (WebCore::jsSubtleCryptoFunctionEncryptPromise):

+        (WebCore::jsSubtleCryptoFunctionDecryptPromise):

+        (WebCore::jsSubtleCryptoFunctionSignPromise):

+        (WebCore::jsSubtleCryptoFunctionVerifyPromise):

+        (WebCore::jsSubtleCryptoFunctionDigestPromise):

+        (WebCore::jsSubtleCryptoFunctionWrapKeyPromise):

+        (WebCore::jsSubtleCryptoFunctionUnwrapKeyPromise):

+        * bindings/js/JSTrackCustom.cpp:

+        (WebCore::toTrack): Deleted.

+        * bindings/js/JSTrackCustom.h:

+        * bindings/js/JSWebKitSubtleCryptoCustom.cpp:

+        (WebCore::JSWebKitSubtleCrypto::encrypt):

+        (WebCore::JSWebKitSubtleCrypto::decrypt):

+        (WebCore::JSWebKitSubtleCrypto::sign):

+        (WebCore::JSWebKitSubtleCrypto::verify):

+        (WebCore::JSWebKitSubtleCrypto::exportKey):

+        (WebCore::JSWebKitSubtleCrypto::wrapKey):

+        (WebCore::JSWebKitSubtleCrypto::unwrapKey):

+        * bindings/js/JSWorkerGlobalScopeBase.cpp:

+        (WebCore::JSWorkerGlobalScopeBase::finishCreation):

+        (WebCore::toJSDedicatedWorkerGlobalScope):

+        (WebCore::toJSWorkerGlobalScope):

+        * bindings/js/JSWorkerGlobalScopeBase.h:

+        * bindings/js/JSXMLHttpRequestCustom.cpp:

+        (WebCore::JSXMLHttpRequest::send):

+        * bindings/js/JSXPathNSResolverCustom.cpp:

+        (WebCore::JSXPathNSResolver::toWrapped):

+        * bindings/js/ScriptController.cpp:

+        (WebCore::ScriptController::setupModuleScriptHandlers):

+        * bindings/js/ScriptModuleLoader.cpp:

+        (WebCore::ScriptModuleLoader::fetch):

+        (WebCore::ScriptModuleLoader::evaluate):

+        * bindings/js/ScriptState.cpp:

+        (WebCore::domWindowFromExecState):

+        (WebCore::scriptExecutionContextFromExecState):

+        * bindings/js/SerializedScriptValue.cpp:

+        (WebCore::CloneSerializer::isArray):

+        (WebCore::CloneSerializer::isMap):

+        (WebCore::CloneSerializer::isSet):

+        (WebCore::CloneSerializer::dumpArrayBufferView):

+        (WebCore::CloneSerializer::dumpIfTerminal):

+        (WebCore::CloneSerializer::serialize):

+        (WebCore::CloneDeserializer::CloneDeserializer):

+        (WebCore::CloneDeserializer::readArrayBufferView):

+        (WebCore::CloneDeserializer::readTerminal):

+        (WebCore::transferArrayBuffers):

+        (WebCore::SerializedScriptValue::create):

+        * bindings/js/StructuredClone.cpp:

+        (WebCore::structuredCloneArrayBuffer):

+        (WebCore::structuredCloneArrayBufferView):

+        * bindings/js/WorkerScriptController.cpp:

+        (WebCore::WorkerScriptController::evaluate):

+        * bindings/scripts/CodeGeneratorJS.pm:

+        (GenerateHeader):

+        (GenerateOverloadedFunctionOrConstructor):

+        (GenerateImplementation):

+        * bindings/scripts/test/JS/JSInterfaceName.cpp:

+        (WebCore::JSInterfaceName::finishCreation):

+        (WebCore::jsInterfaceNameConstructor):

+        (WebCore::setJSInterfaceNameConstructor):

+        (WebCore::JSInterfaceName::toWrapped):

+        * bindings/scripts/test/JS/JSInterfaceName.h:

+        * bindings/scripts/test/JS/JSTestActiveDOMObject.cpp:

+        (WebCore::JSTestActiveDOMObject::finishCreation):

+        (WebCore::BindingCaller&lt;JSTestActiveDOMObject&gt;::castForAttribute):

+        (WebCore::BindingCaller&lt;JSTestActiveDOMObject&gt;::castForOperation):

+        (WebCore::jsTestActiveDOMObjectConstructor):

+        (WebCore::setJSTestActiveDOMObjectConstructor):

+        (WebCore::JSTestActiveDOMObject::toWrapped):

+        * bindings/scripts/test/JS/JSTestActiveDOMObject.h:

+        * bindings/scripts/test/JS/JSTestCEReactions.cpp:

+        (WebCore::JSTestCEReactions::finishCreation):

+        (WebCore::BindingCaller&lt;JSTestCEReactions&gt;::castForAttribute):

+        (WebCore::BindingCaller&lt;JSTestCEReactions&gt;::castForOperation):

+        (WebCore::jsTestCEReactionsConstructor):

+        (WebCore::setJSTestCEReactionsConstructor):

+        (WebCore::JSTestCEReactions::toWrapped):

+        * bindings/scripts/test/JS/JSTestCEReactions.h:

+        * bindings/scripts/test/JS/JSTestCEReactionsStringifier.cpp:

+        (WebCore::JSTestCEReactionsStringifier::finishCreation):

+        (WebCore::BindingCaller&lt;JSTestCEReactionsStringifier&gt;::castForAttribute):

+        (WebCore::BindingCaller&lt;JSTestCEReactionsStringifier&gt;::castForOperation):

+        (WebCore::jsTestCEReactionsStringifierConstructor):

+        (WebCore::setJSTestCEReactionsStringifierConstructor):

+        (WebCore::JSTestCEReactionsStringifier::toWrapped):

+        * bindings/scripts/test/JS/JSTestCEReactionsStringifier.h:

+        * bindings/scripts/test/JS/JSTestClassWithJSBuiltinConstructor.cpp:

+        (WebCore::JSTestClassWithJSBuiltinConstructor::finishCreation):

+        (WebCore::jsTestClassWithJSBuiltinConstructorConstructor):

+        (WebCore::setJSTestClassWithJSBuiltinConstructorConstructor):

+        (WebCore::JSTestClassWithJSBuiltinConstructor::toWrapped):

+        * bindings/scripts/test/JS/JSTestClassWithJSBuiltinConstructor.h:

+        * bindings/scripts/test/JS/JSTestCustomConstructorWithNoInterfaceObject.cpp:

+        (WebCore::JSTestCustomConstructorWithNoInterfaceObject::finishCreation):

+        (WebCore::jsTestCustomConstructorWithNoInterfaceObjectConstructor):

+        (WebCore::setJSTestCustomConstructorWithNoInterfaceObjectConstructor):

+        (WebCore::JSTestCustomConstructorWithNoInterfaceObject::toWrapped):

+        * bindings/scripts/test/JS/JSTestCustomConstructorWithNoInterfaceObject.h:

+        * bindings/scripts/test/JS/JSTestCustomNamedGetter.cpp:

+        (WebCore::JSTestCustomNamedGetter::finishCreation):

+        (WebCore::BindingCaller&lt;JSTestCustomNamedGetter&gt;::castForOperation):

+        (WebCore::jsTestCustomNamedGetterConstructor):

+        (WebCore::setJSTestCustomNamedGetterConstructor):

+        (WebCore::JSTestCustomNamedGetter::toWrapped):

+        * bindings/scripts/test/JS/JSTestCustomNamedGetter.h:

+        * bindings/scripts/test/JS/JSTestDOMJIT.cpp:

+        (WebCore::JSTestDOMJIT::finishCreation):

+        (WebCore::BindingCaller&lt;JSTestDOMJIT&gt;::castForAttribute):

+        (WebCore::BindingCaller&lt;JSTestDOMJIT&gt;::castForOperation):

+        (WebCore::jsTestDOMJITConstructor):

+        (WebCore::setJSTestDOMJITConstructor):

+        * bindings/scripts/test/JS/JSTestEventConstructor.cpp:

+        (WebCore::JSTestEventConstructor::finishCreation):

+        (WebCore::BindingCaller&lt;JSTestEventConstructor&gt;::castForAttribute):

+        (WebCore::jsTestEventConstructorConstructor):

+        (WebCore::setJSTestEventConstructorConstructor):

+        * bindings/scripts/test/JS/JSTestEventTarget.cpp:

+        (WebCore::JSTestEventTarget::finishCreation):

+        (WebCore::BindingCaller&lt;JSTestEventTarget&gt;::castForOperation):

+        (WebCore::jsTestEventTargetConstructor):

+        (WebCore::setJSTestEventTargetConstructor):

+        (WebCore::JSTestEventTarget::toWrapped):

+        * bindings/scripts/test/JS/JSTestEventTarget.h:

+        * bindings/scripts/test/JS/JSTestException.cpp:

+        (WebCore::JSTestException::finishCreation):

+        (WebCore::BindingCaller&lt;JSTestException&gt;::castForAttribute):

+        (WebCore::jsTestExceptionConstructor):

+        (WebCore::setJSTestExceptionConstructor):

+        (WebCore::JSTestException::toWrapped):

+        * bindings/scripts/test/JS/JSTestException.h:

+        * bindings/scripts/test/JS/JSTestGenerateIsReachable.cpp:

+        (WebCore::JSTestGenerateIsReachable::finishCreation):

+        (WebCore::jsTestGenerateIsReachableConstructor):

+        (WebCore::setJSTestGenerateIsReachableConstructor):

+        (WebCore::JSTestGenerateIsReachable::toWrapped):

+        * bindings/scripts/test/JS/JSTestGenerateIsReachable.h:

+        * bindings/scripts/test/JS/JSTestGlobalObject.cpp:

+        (WebCore::JSTestGlobalObject::finishCreation):

+        (WebCore::BindingCaller&lt;JSTestGlobalObject&gt;::castForAttribute):

+        (WebCore::BindingCaller&lt;JSTestGlobalObject&gt;::castForOperation):

+        (WebCore::jsTestGlobalObjectConstructor):

+        (WebCore::setJSTestGlobalObjectConstructor):

+        (WebCore::JSTestGlobalObject::toWrapped):

+        * bindings/scripts/test/JS/JSTestGlobalObject.h:

+        * bindings/scripts/test/JS/JSTestInterface.cpp:

+        (WebCore::JSTestInterface::finishCreation):

+        (WebCore::BindingCaller&lt;JSTestInterface&gt;::castForAttribute):

+        (WebCore::BindingCaller&lt;JSTestInterface&gt;::castForOperation):

+        (WebCore::jsTestInterfaceConstructor):

+        (WebCore::setJSTestInterfaceConstructor):

+        (WebCore::JSTestInterface::toWrapped):

+        * bindings/scripts/test/JS/JSTestInterface.h:

+        * bindings/scripts/test/JS/JSTestInterfaceLeadingUnderscore.cpp:

+        (WebCore::JSTestInterfaceLeadingUnderscore::finishCreation):

+        (WebCore::BindingCaller&lt;JSTestInterfaceLeadingUnderscore&gt;::castForAttribute):

+        (WebCore::jsTestInterfaceLeadingUnderscoreConstructor):

+        (WebCore::setJSTestInterfaceLeadingUnderscoreConstructor):

+        (WebCore::JSTestInterfaceLeadingUnderscore::toWrapped):

+        * bindings/scripts/test/JS/JSTestInterfaceLeadingUnderscore.h:

+        * bindings/scripts/test/JS/JSTestIterable.cpp:

+        (WebCore::JSTestIterable::finishCreation):

+        (WebCore::BindingCaller&lt;JSTestIterable&gt;::castForOperation):

+        (WebCore::jsTestIterableConstructor):

+        (WebCore::setJSTestIterableConstructor):

+        (WebCore::JSTestIterable::toWrapped):

+        * bindings/scripts/test/JS/JSTestIterable.h:

+        * bindings/scripts/test/JS/JSTestJSBuiltinConstructor.cpp:

+        (WebCore::JSTestJSBuiltinConstructor::finishCreation):

+        (WebCore::BindingCaller&lt;JSTestJSBuiltinConstructor&gt;::castForAttribute):

+        (WebCore::BindingCaller&lt;JSTestJSBuiltinConstructor&gt;::castForOperation):

+        (WebCore::jsTestJSBuiltinConstructorConstructor):

+        (WebCore::setJSTestJSBuiltinConstructorConstructor):

+        * bindings/scripts/test/JS/JSTestMediaQueryListListener.cpp:

+        (WebCore::JSTestMediaQueryListListener::finishCreation):

+        (WebCore::BindingCaller&lt;JSTestMediaQueryListListener&gt;::castForOperation):

+        (WebCore::jsTestMediaQueryListListenerConstructor):

+        (WebCore::setJSTestMediaQueryListListenerConstructor):

+        (WebCore::JSTestMediaQueryListListener::toWrapped):

+        * bindings/scripts/test/JS/JSTestMediaQueryListListener.h:

+        * bindings/scripts/test/JS/JSTestNamedConstructor.cpp:

+        (WebCore::JSTestNamedConstructor::finishCreation):

+        (WebCore::jsTestNamedConstructorConstructor):

+        (WebCore::setJSTestNamedConstructorConstructor):

+        (WebCore::JSTestNamedConstructor::toWrapped):

+        * bindings/scripts/test/JS/JSTestNamedConstructor.h:

+        * bindings/scripts/test/JS/JSTestNode.cpp:

+        (WebCore::JSTestNode::finishCreation):

+        (WebCore::BindingCaller&lt;JSTestNode&gt;::castForAttribute):

+        (WebCore::BindingCaller&lt;JSTestNode&gt;::castForOperation):

+        (WebCore::jsTestNodeConstructor):

+        (WebCore::setJSTestNodeConstructor):

+        * bindings/scripts/test/JS/JSTestObj.cpp:

+        (WebCore::JSTestObj::finishCreation):

+        (WebCore::BindingCaller&lt;JSTestObj&gt;::castForAttribute):

+        (WebCore::BindingCaller&lt;JSTestObj&gt;::castForOperation):

+        (WebCore::jsTestObjConstructor):

+        (WebCore::setJSTestObjConstructor):

+        (WebCore::jsTestObjPrototypeFunctionOverloadedMethod):

+        (WebCore::jsTestObjPrototypeFunctionOverloadedMethodWithOptionalParameter):

+        (WebCore::jsTestObjPrototypeFunctionOverloadedMethodWithDistinguishingUnion):

+        (WebCore::jsTestObjPrototypeFunctionOverloadedMethodWith2DistinguishingUnions):

+        (WebCore::jsTestObjPrototypeFunctionOverloadedMethodWithNonDistinguishingUnion):

+        (WebCore::jsTestObjPrototypeFunctionOverloadWithNullableUnion):

+        (WebCore::jsTestObjPrototypeFunctionOverloadWithNullableNonDistinguishingParameter):

+        (WebCore::jsTestObjPrototypeFunctionTestPromiseOverloadedFunction):

+        (WebCore::JSTestObj::toWrapped):

+        * bindings/scripts/test/JS/JSTestObj.h:

+        * bindings/scripts/test/JS/JSTestOverloadedConstructors.cpp:

+        (WebCore::JSTestOverloadedConstructorsConstructor::construct):

+        (WebCore::JSTestOverloadedConstructors::finishCreation):

+        (WebCore::jsTestOverloadedConstructorsConstructor):

+        (WebCore::setJSTestOverloadedConstructorsConstructor):

+        (WebCore::JSTestOverloadedConstructors::toWrapped):

+        * bindings/scripts/test/JS/JSTestOverloadedConstructors.h:

+        * bindings/scripts/test/JS/JSTestOverloadedConstructorsWithSequence.cpp:

+        (WebCore::JSTestOverloadedConstructorsWithSequence::finishCreation):

+        (WebCore::jsTestOverloadedConstructorsWithSequenceConstructor):

+        (WebCore::setJSTestOverloadedConstructorsWithSequenceConstructor):

+        (WebCore::JSTestOverloadedConstructorsWithSequence::toWrapped):

+        * bindings/scripts/test/JS/JSTestOverloadedConstructorsWithSequence.h:

+        * bindings/scripts/test/JS/JSTestOverrideBuiltins.cpp:

+        (WebCore::JSTestOverrideBuiltins::finishCreation):

+        (WebCore::BindingCaller&lt;JSTestOverrideBuiltins&gt;::castForOperation):

+        (WebCore::jsTestOverrideBuiltinsConstructor):

+        (WebCore::setJSTestOverrideBuiltinsConstructor):

+        (WebCore::JSTestOverrideBuiltins::toWrapped):

+        * bindings/scripts/test/JS/JSTestOverrideBuiltins.h:

+        * bindings/scripts/test/JS/JSTestSerialization.cpp:

+        (WebCore::JSTestSerialization::finishCreation):

+        (WebCore::BindingCaller&lt;JSTestSerialization&gt;::castForAttribute):

+        (WebCore::BindingCaller&lt;JSTestSerialization&gt;::castForOperation):

+        (WebCore::jsTestSerializationConstructor):

+        (WebCore::setJSTestSerializationConstructor):

+        (WebCore::JSTestSerialization::toWrapped):

+        * bindings/scripts/test/JS/JSTestSerialization.h:

+        * bindings/scripts/test/JS/JSTestSerializedScriptValueInterface.cpp:

+        (WebCore::JSTestSerializedScriptValueInterface::finishCreation):

+        (WebCore::BindingCaller&lt;JSTestSerializedScriptValueInterface&gt;::castForAttribute):

+        (WebCore::BindingCaller&lt;JSTestSerializedScriptValueInterface&gt;::castForOperation):

+        (WebCore::jsTestSerializedScriptValueInterfaceConstructor):

+        (WebCore::setJSTestSerializedScriptValueInterfaceConstructor):

+        (WebCore::JSTestSerializedScriptValueInterface::toWrapped):

+        * bindings/scripts/test/JS/JSTestSerializedScriptValueInterface.h:

+        * bindings/scripts/test/JS/JSTestTypedefs.cpp:

+        (WebCore::JSTestTypedefs::finishCreation):

+        (WebCore::BindingCaller&lt;JSTestTypedefs&gt;::castForAttribute):

+        (WebCore::BindingCaller&lt;JSTestTypedefs&gt;::castForOperation):

+        (WebCore::jsTestTypedefsConstructor):

+        (WebCore::setJSTestTypedefsConstructor):

+        (WebCore::JSTestTypedefs::toWrapped):

+        * bindings/scripts/test/JS/JSTestTypedefs.h:

+        * bridge/c/CRuntimeObject.cpp:

+        (JSC::Bindings::CRuntimeObject::finishCreation):

+        * bridge/c/c_instance.cpp:

+        (JSC::Bindings::CRuntimeMethod::finishCreation):

+        (JSC::Bindings::CInstance::invokeMethod):

+        * bridge/c/c_utility.cpp:

+        (JSC::Bindings::convertValueToNPVariant):

+        * bridge/objc/ObjCRuntimeObject.mm:

+        (JSC::Bindings::ObjCRuntimeObject::finishCreation):

+        * bridge/objc/WebScriptObject.mm:

+        (-[WebScriptObject setValue:forKey:]):

+        (+[WebScriptObject _convertValueToObjcValue:originRootObject:rootObject:]):

+        * bridge/objc/objc_instance.mm:

+        (ObjCRuntimeMethod::finishCreation):

+        (ObjcInstance::invokeMethod):

+        * bridge/objc/objc_runtime.mm:

+        (JSC::Bindings::ObjcFallbackObjectImp::finishCreation):

+        (JSC::Bindings::callObjCFallbackObject):

+        * bridge/runtime_array.cpp:

+        (JSC::RuntimeArray::finishCreation):

+        (JSC::RuntimeArray::lengthGetter):

+        * bridge/runtime_method.cpp:

+        (JSC::RuntimeMethod::finishCreation):

+        (JSC::RuntimeMethod::lengthGetter):

+        (JSC::callRuntimeMethod):

+        * bridge/runtime_object.cpp:

+        (JSC::Bindings::RuntimeObject::finishCreation):

+        (JSC::Bindings::callRuntimeObject):

+        (JSC::Bindings::callRuntimeConstructor):

+        * css/FontFace.cpp:

+        (WebCore::FontFace::create):

+        * html/HTMLMediaElement.cpp:

+        (WebCore::controllerJSValue):

+        (WebCore::HTMLMediaElement::updateCaptionContainer):

+        (WebCore::HTMLMediaElement::didAddUserAgentShadowRoot):

+        * inspector/InspectorController.cpp:

+        (WebCore::InspectorController::canAccessInspectedScriptState):

+        * inspector/InspectorDOMAgent.cpp:

+        (WebCore::InspectorDOMAgent::buildObjectForEventListener):

+        (WebCore::InspectorDOMAgent::scriptValueAsNode):

+        * inspector/WebInjectedScriptHost.cpp:

+        (WebCore::WebInjectedScriptHost::subtype):

+        (WebCore::WebInjectedScriptHost::isHTMLAllCollection):

+        * inspector/WebInjectedScriptHost.h:

+

</ins><span class="cx"> 2017-01-26  Dean Jackson  &lt;dino@apple.com&gt;

</span><span class="cx"> 

</span><span class="cx">         WebGL content in Safari sticks to GPU that it was started on, sometimes causing extra battery drain and difficulty interacting with UI

</span></span></pre></div>

<a id="trunkSourceWebCoreModulesfetchFetchBodycpp"></a>

<div class="modfile"><h4>Modified: trunk/Source/WebCore/Modules/fetch/FetchBody.cpp (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/WebCore/Modules/fetch/FetchBody.cpp        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/WebCore/Modules/fetch/FetchBody.cpp        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -48,14 +48,15 @@

</span><span class="cx"> 

</span><span class="cx"> std::optional&lt;FetchBody&gt; FetchBody::extract(ScriptExecutionContext&amp; context, JSC::ExecState&amp; state, JSC::JSValue value, String&amp; contentType)

</span><span class="cx"> {

</span><del>-    if (value.inherits(JSBlob::info())) {

-        auto&amp; blob = *JSBlob::toWrapped(value);

</del><ins>+    JSC::VM&amp; vm = state.vm();

+    if (value.inherits(vm, JSBlob::info())) {

+        auto&amp; blob = *JSBlob::toWrapped(vm, value);

</ins><span class="cx">         contentType = blob.type();

</span><span class="cx">         return FetchBody(blob);

</span><span class="cx">     }

</span><del>-    if (value.inherits(JSDOMFormData::info())) {

</del><ins>+    if (value.inherits(vm, JSDOMFormData::info())) {

</ins><span class="cx">         ASSERT(!context.isWorkerGlobalScope());

</span><del>-        auto&amp; domFormData = *JSDOMFormData::toWrapped(value);

</del><ins>+        auto&amp; domFormData = *JSDOMFormData::toWrapped(vm, value);

</ins><span class="cx">         auto formData = FormData::createMultiPart(domFormData, domFormData.encoding(), &amp;static_cast&lt;Document&amp;&gt;(context));

</span><span class="cx">         contentType = makeString(&quot;multipart/form-data; boundary=&quot;, formData-&gt;boundary().data());

</span><span class="cx">         return FetchBody(WTFMove(formData));

</span><span class="lines">@@ -64,22 +65,22 @@

</span><span class="cx">         contentType = HTTPHeaderValues::textPlainContentType();

</span><span class="cx">         return FetchBody(String { asString(value)-&gt;value(&amp;state) });

</span><span class="cx">     }

</span><del>-    if (value.inherits(JSURLSearchParams::info())) {

</del><ins>+    if (value.inherits(vm, JSURLSearchParams::info())) {

</ins><span class="cx">         contentType = HTTPHeaderValues::formURLEncodedContentType();

</span><del>-        return FetchBody(*JSURLSearchParams::toWrapped(value));

</del><ins>+        return FetchBody(*JSURLSearchParams::toWrapped(vm, value));

</ins><span class="cx">     }

</span><del>-    if (value.inherits(JSReadableStream::info())) {

</del><ins>+    if (value.inherits(vm, JSReadableStream::info())) {

</ins><span class="cx">         FetchBody body;

</span><span class="cx">         body.m_isReadableStream = true;

</span><span class="cx">         return WTFMove(body);

</span><span class="cx">     }

</span><del>-    if (value.inherits(JSC::JSArrayBuffer::info())) {

-        ArrayBuffer* data = toUnsharedArrayBuffer(value);

</del><ins>+    if (value.inherits(vm, JSC::JSArrayBuffer::info())) {

+        ArrayBuffer* data = toUnsharedArrayBuffer(vm, value);

</ins><span class="cx">         ASSERT(data);

</span><span class="cx">         return FetchBody(*data);

</span><span class="cx">     }

</span><del>-    if (value.inherits(JSC::JSArrayBufferView::info()))

-        return FetchBody(toUnsharedArrayBufferView(value).releaseConstNonNull());

</del><ins>+    if (value.inherits(vm, JSC::JSArrayBufferView::info()))

+        return FetchBody(toUnsharedArrayBufferView(vm, value).releaseConstNonNull());

</ins><span class="cx"> 

</span><span class="cx">     return std::nullopt;

</span><span class="cx"> }

</span></span></pre></div>

<a id="trunkSourceWebCoreModulespluginsQuickTimePluginReplacementmm"></a>

<div class="modfile"><h4>Modified: trunk/Source/WebCore/Modules/plugins/QuickTimePluginReplacement.mm (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/WebCore/Modules/plugins/QuickTimePluginReplacement.mm        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/WebCore/Modules/plugins/QuickTimePluginReplacement.mm        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -221,7 +221,7 @@

<span class="cx">     // Get the &lt;video&gt; created to replace the plug-in.

</span><span class="cx">     JSC::JSValue value = replacement.get(exec, JSC::Identifier::fromString(exec, &quot;video&quot;));

</span><span class="cx">     if (!scope.exception() &amp;&amp; !value.isUndefinedOrNull())

</span><del>-        m_mediaElement = JSHTMLVideoElement::toWrapped(value);

</del><ins>+        m_mediaElement = JSHTMLVideoElement::toWrapped(vm, value);

</ins><span class="cx"> 

</span><span class="cx">     if (!m_mediaElement) {

</span><span class="cx">         LOG(Plugins, &quot;%p - Failed to find &lt;video&gt; element created by QuickTime plugin replacement script.&quot;, this);

</span></span></pre></div>

<a id="trunkSourceWebCorebindingsjsIDBBindingUtilitiescpp"></a>

<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/js/IDBBindingUtilities.cpp (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/WebCore/bindings/js/IDBBindingUtilities.cpp        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/WebCore/bindings/js/IDBBindingUtilities.cpp        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -144,6 +144,7 @@

</span><span class="cx"> 

</span><span class="cx"> static RefPtr&lt;IDBKey&gt; createIDBKeyFromValue(ExecState&amp; exec, JSValue value, Vector&lt;JSArray*&gt;&amp; stack)

</span><span class="cx"> {

</span><ins>+    VM&amp; vm = exec.vm();

</ins><span class="cx">     if (value.isNumber() &amp;&amp; !std::isnan(value.toNumber(&amp;exec)))

</span><span class="cx">         return IDBKey::createNumber(value.toNumber(&amp;exec));

</span><span class="cx"> 

</span><span class="lines">@@ -150,12 +151,12 @@

</span><span class="cx">     if (value.isString())

</span><span class="cx">         return IDBKey::createString(asString(value)-&gt;value(&amp;exec));

</span><span class="cx"> 

</span><del>-    if (value.inherits(DateInstance::info()) &amp;&amp; !std::isnan(valueToDate(&amp;exec, value)))

</del><ins>+    if (value.inherits(vm, DateInstance::info()) &amp;&amp; !std::isnan(valueToDate(&amp;exec, value)))

</ins><span class="cx">         return IDBKey::createDate(valueToDate(&amp;exec, value));

</span><span class="cx"> 

</span><span class="cx">     if (value.isObject()) {

</span><span class="cx">         JSObject* object = asObject(value);

</span><del>-        if (isJSArray(object) || object-&gt;inherits(JSArray::info())) {

</del><ins>+        if (isJSArray(object) || object-&gt;inherits(vm, JSArray::info())) {

</ins><span class="cx">             JSArray* array = asArray(object);

</span><span class="cx">             size_t length = array-&gt;length();

</span><span class="cx"> 

</span><span class="lines">@@ -181,10 +182,10 @@

</span><span class="cx">             return IDBKey::createArray(subkeys);

</span><span class="cx">         }

</span><span class="cx"> 

</span><del>-        if (auto* arrayBuffer = jsDynamicCast&lt;JSArrayBuffer*&gt;(value))

</del><ins>+        if (auto* arrayBuffer = jsDynamicCast&lt;JSArrayBuffer*&gt;(vm, value))

</ins><span class="cx">             return IDBKey::createBinary(*arrayBuffer);

</span><span class="cx"> 

</span><del>-        if (auto* arrayBufferView = jsDynamicCast&lt;JSArrayBufferView*&gt;(value))

</del><ins>+        if (auto* arrayBufferView = jsDynamicCast&lt;JSArrayBufferView*&gt;(vm, value))

</ins><span class="cx">             return IDBKey::createBinary(*arrayBufferView);

</span><span class="cx">     }

</span><span class="cx">     return nullptr;

</span></span></pre></div>

<a id="trunkSourceWebCorebindingsjsJSCommandLineAPIHostCustomcpp"></a>

<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/js/JSCommandLineAPIHostCustom.cpp (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/WebCore/bindings/js/JSCommandLineAPIHostCustom.cpp        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/WebCore/bindings/js/JSCommandLineAPIHostCustom.cpp        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -101,11 +101,12 @@

</span><span class="cx">     if (state.argumentCount() &lt; 1)

</span><span class="cx">         return jsUndefined();

</span><span class="cx"> 

</span><ins>+    VM&amp; vm = state.vm();

</ins><span class="cx">     JSValue value = state.uncheckedArgument(0);

</span><span class="cx">     if (!value.isObject() || value.isNull())

</span><span class="cx">         return jsUndefined();

</span><span class="cx"> 

</span><del>-    Node* node = JSNode::toWrapped(value);

</del><ins>+    Node* node = JSNode::toWrapped(vm, value);

</ins><span class="cx">     if (!node)

</span><span class="cx">         return jsUndefined();

</span><span class="cx"> 

</span><span class="lines">@@ -138,7 +139,8 @@

</span><span class="cx">     if (state.argumentCount() &lt; 1)

</span><span class="cx">         return jsUndefined();

</span><span class="cx"> 

</span><del>-    Database* database = JSDatabase::toWrapped(state.uncheckedArgument(0));

</del><ins>+    VM&amp; vm = state.vm();

+    Database* database = JSDatabase::toWrapped(vm, state.uncheckedArgument(0));

</ins><span class="cx">     if (database)

</span><span class="cx">         return jsStringWithCache(&amp;state, wrapped().databaseIdImpl(database));

</span><span class="cx"> 

</span><span class="lines">@@ -150,7 +152,8 @@

</span><span class="cx">     if (state.argumentCount() &lt; 1)

</span><span class="cx">         return jsUndefined();

</span><span class="cx"> 

</span><del>-    Storage* storage = JSStorage::toWrapped(state.uncheckedArgument(0));

</del><ins>+    VM&amp; vm = state.vm();

+    Storage* storage = JSStorage::toWrapped(vm, state.uncheckedArgument(0));

</ins><span class="cx">     if (storage)

</span><span class="cx">         return jsStringWithCache(&amp;state, wrapped().storageIdImpl(storage));

</span><span class="cx"> 

</span></span></pre></div>

<a id="trunkSourceWebCorebindingsjsJSCryptoAlgorithmDictionarycpp"></a>

<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/js/JSCryptoAlgorithmDictionary.cpp (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/WebCore/bindings/js/JSCryptoAlgorithmDictionary.cpp        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/WebCore/bindings/js/JSCryptoAlgorithmDictionary.cpp        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -57,12 +57,13 @@

</span><span class="cx">     // typedef (Algorithm or DOMString) AlgorithmIdentifier;

</span><span class="cx"> 

</span><span class="cx">     String algorithmName;

</span><ins>+    VM&amp; vm = state.vm();

</ins><span class="cx"> 

</span><span class="cx">     if (value.isString()) {

</span><span class="cx">         algorithmName = asString(value)-&gt;value(&amp;state);

</span><span class="cx">         RETURN_IF_EXCEPTION(scope, { });

</span><span class="cx">     } else if (value.isObject()) {

</span><del>-        if (asObject(value)-&gt;inherits(StringObject::info())) {

</del><ins>+        if (asObject(value)-&gt;inherits(vm, StringObject::info())) {

</ins><span class="cx">             algorithmName = asStringObject(value)-&gt;internalValue()-&gt;value(&amp;state);

</span><span class="cx">             RETURN_IF_EXCEPTION(scope, { });

</span><span class="cx">         } else {

</span><span class="lines">@@ -210,7 +211,8 @@

</span><span class="cx"> 

</span><span class="cx"> static RefPtr&lt;CryptoAlgorithmParametersDeprecated&gt; createRsaKeyGenParams(ExecState&amp; state, JSValue value)

</span><span class="cx"> {

</span><del>-    auto scope = DECLARE_THROW_SCOPE(state.vm());

</del><ins>+    VM&amp; vm = state.vm();

+    auto scope = DECLARE_THROW_SCOPE(vm);

</ins><span class="cx"> 

</span><span class="cx">     if (!value.isObject()) {

</span><span class="cx">         throwTypeError(&amp;state, scope);

</span><span class="lines">@@ -229,7 +231,7 @@

</span><span class="cx">     auto publicExponentValue = getProperty(state, asObject(value), &quot;publicExponent&quot;);

</span><span class="cx">     RETURN_IF_EXCEPTION(scope, nullptr);

</span><span class="cx"> 

</span><del>-    auto publicExponentArray = toUnsharedUint8Array(publicExponentValue);

</del><ins>+    auto publicExponentArray = toUnsharedUint8Array(vm, publicExponentValue);

</ins><span class="cx">     if (!publicExponentArray) {

</span><span class="cx">         throwTypeError(&amp;state, scope, ASCIILiteral(&quot;Expected a Uint8Array in publicExponent&quot;));

</span><span class="cx">         return nullptr;

</span></span></pre></div>

<a id="trunkSourceWebCorebindingsjsJSCryptoCustomcpp"></a>

<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/js/JSCryptoCustom.cpp (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/WebCore/bindings/js/JSCryptoCustom.cpp        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/WebCore/bindings/js/JSCryptoCustom.cpp        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -45,7 +45,7 @@

</span><span class="cx">         return throwException(&amp;state, scope, createNotEnoughArgumentsError(&amp;state));

</span><span class="cx"> 

</span><span class="cx">     JSValue buffer = state.argument(0);

</span><del>-    auto arrayBufferView = toUnsharedArrayBufferView(buffer);

</del><ins>+    auto arrayBufferView = toUnsharedArrayBufferView(vm, buffer);

</ins><span class="cx">     if (!arrayBufferView)

</span><span class="cx">         return throwTypeError(&amp;state, scope);

</span><span class="cx"> 

</span></span></pre></div>

<a id="trunkSourceWebCorebindingsjsJSCryptoOperationDatacpp"></a>

<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/js/JSCryptoOperationData.cpp (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/WebCore/bindings/js/JSCryptoOperationData.cpp        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/WebCore/bindings/js/JSCryptoOperationData.cpp        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -36,10 +36,11 @@

</span><span class="cx"> 

</span><span class="cx"> CryptoOperationData cryptoOperationDataFromJSValue(ExecState&amp; state, ThrowScope&amp; scope, JSValue value)

</span><span class="cx"> {

</span><del>-    if (auto* buffer = toUnsharedArrayBuffer(value))

</del><ins>+    VM&amp; vm = state.vm();

+    if (auto* buffer = toUnsharedArrayBuffer(vm, value))

</ins><span class="cx">         return { static_cast&lt;uint8_t*&gt;(buffer-&gt;data()), buffer-&gt;byteLength() };

</span><span class="cx"> 

</span><del>-    if (auto bufferView = toUnsharedArrayBufferView(value))

</del><ins>+    if (auto bufferView = toUnsharedArrayBufferView(vm, value))

</ins><span class="cx">         return { static_cast&lt;uint8_t*&gt;(bufferView-&gt;baseAddress()), bufferView-&gt;byteLength() };

</span><span class="cx"> 

</span><span class="cx">     throwTypeError(&amp;state, scope, ASCIILiteral(&quot;Only ArrayBuffer and ArrayBufferView objects can be passed as CryptoOperationData&quot;));

</span></span></pre></div>

<a id="trunkSourceWebCorebindingsjsJSCustomElementInterfacecpp"></a>

<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/js/JSCustomElementInterface.cpp (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/WebCore/bindings/js/JSCustomElementInterface.cpp        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/WebCore/bindings/js/JSCustomElementInterface.cpp        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -132,7 +132,7 @@

</span><span class="cx">     RETURN_IF_EXCEPTION(scope, nullptr);

</span><span class="cx"> 

</span><span class="cx">     ASSERT(!newElement.isEmpty());

</span><del>-    HTMLElement* wrappedElement = JSHTMLElement::toWrapped(newElement);

</del><ins>+    HTMLElement* wrappedElement = JSHTMLElement::toWrapped(vm, newElement);

</ins><span class="cx">     if (!wrappedElement) {

</span><span class="cx">         throwTypeError(&amp;state, scope, ASCIILiteral(&quot;The result of constructing a custom element must be a HTMLElement&quot;));

</span><span class="cx">         return nullptr;

</span><span class="lines">@@ -210,7 +210,7 @@

</span><span class="cx">         return;

</span><span class="cx">     }

</span><span class="cx"> 

</span><del>-    Element* wrappedElement = JSElement::toWrapped(returnedElement);

</del><ins>+    Element* wrappedElement = JSElement::toWrapped(vm, returnedElement);

</ins><span class="cx">     if (!wrappedElement || wrappedElement != &amp;element) {

</span><span class="cx">         element.setIsFailedCustomElement(*this);

</span><span class="cx">         reportException(state, createDOMException(state, INVALID_STATE_ERR, &quot;Custom element constructor failed to upgrade an element&quot;));

</span></span></pre></div>

<a id="trunkSourceWebCorebindingsjsJSDOMBindingcpp"></a>

<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/js/JSDOMBinding.cpp (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/WebCore/bindings/js/JSDOMBinding.cpp        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/WebCore/bindings/js/JSDOMBinding.cpp        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -179,7 +179,7 @@

</span><span class="cx"> {

</span><span class="cx">     if (value.isNumber())

</span><span class="cx">         return value.asNumber();

</span><del>-    if (!value.inherits(DateInstance::info()))

</del><ins>+    if (!value.inherits(exec-&gt;vm(), DateInstance::info()))

</ins><span class="cx">         return std::numeric_limits&lt;double&gt;::quiet_NaN();

</span><span class="cx">     return static_cast&lt;DateInstance*&gt;(value.toObject(exec))-&gt;internalNumber();

</span><span class="cx"> }

</span><span class="lines">@@ -188,7 +188,7 @@

</span><span class="cx"> {

</span><span class="cx">     VM&amp; vm = exec-&gt;vm();

</span><span class="cx">     RELEASE_ASSERT(vm.currentThreadIsHoldingAPILock());

</span><del>-    auto* exception = jsDynamicDowncast&lt;JSC::Exception*&gt;(exceptionValue);

</del><ins>+    auto* exception = jsDynamicDowncast&lt;JSC::Exception*&gt;(vm, exceptionValue);

</ins><span class="cx">     if (!exception) {

</span><span class="cx">         exception = vm.lastException();

</span><span class="cx">         if (!exception)

</span><span class="lines">@@ -200,13 +200,13 @@

</span><span class="cx"> 

</span><span class="cx"> String retrieveErrorMessage(ExecState&amp; state, VM&amp; vm, JSValue exception, CatchScope&amp; catchScope)

</span><span class="cx"> {

</span><del>-    if (auto* exceptionBase = toExceptionBase(exception))

</del><ins>+    if (auto* exceptionBase = toExceptionBase(vm, exception))

</ins><span class="cx">         return exceptionBase-&gt;toString();

</span><span class="cx"> 

</span><span class="cx">     // FIXME: &lt;http://webkit.org/b/115087&gt; Web Inspector: WebCore::reportException should not evaluate JavaScript handling exceptions

<span class="cx">     // If this is a custom exception object, call toString on it to try and get a nice string representation for the exception.

</span><span class="cx">     String errorMessage;

</span><del>-    if (auto* error = jsDynamicDowncast&lt;ErrorInstance*&gt;(exception))

</del><ins>+    if (auto* error = jsDynamicDowncast&lt;ErrorInstance*&gt;(vm, exception))

</ins><span class="cx">         errorMessage = error-&gt;sanitizedToString(&amp;state);

</span><span class="cx">     else

</span><span class="cx">         errorMessage = exception.toWTFString(&amp;state);

</span><span class="lines">@@ -224,7 +224,7 @@

</span><span class="cx">     auto scope = DECLARE_CATCH_SCOPE(vm);

</span><span class="cx"> 

</span><span class="cx">     RELEASE_ASSERT(vm.currentThreadIsHoldingAPILock());

</span><del>-    if (isTerminatedExecutionException(exception))

</del><ins>+    if (isTerminatedExecutionException(vm, exception))

</ins><span class="cx">         return;

</span><span class="cx"> 

</span><span class="cx">     ErrorHandlingScope errorScope(exec-&gt;vm());

</span><span class="lines">@@ -234,7 +234,7 @@

</span><span class="cx">     vm.clearLastException();

</span><span class="cx"> 

</span><span class="cx">     JSDOMGlobalObject* globalObject = jsCast&lt;JSDOMGlobalObject*&gt;(exec-&gt;lexicalGlobalObject());

</span><del>-    if (JSDOMWindow* window = jsDynamicDowncast&lt;JSDOMWindow*&gt;(globalObject)) {

</del><ins>+    if (JSDOMWindow* window = jsDynamicDowncast&lt;JSDOMWindow*&gt;(vm, globalObject)) {

</ins><span class="cx">         if (!window-&gt;wrapped().isCurrentlyDisplayedInFrame())

</span><span class="cx">             return;

</span><span class="cx">     }

</span></span></pre></div>

<a id="trunkSourceWebCorebindingsjsJSDOMBindingh"></a>

<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/js/JSDOMBinding.h (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/WebCore/bindings/js/JSDOMBinding.h        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/WebCore/bindings/js/JSDOMBinding.h        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -271,27 +271,27 @@

</span><span class="cx"> template&lt;typename T&gt; JSC::JSValue toJSIterator(JSC::ExecState&amp;, JSDOMGlobalObject&amp;, const T&amp;);

</span><span class="cx"> JSC::JSValue toJSIteratorEnd(JSC::ExecState&amp;);

</span><span class="cx"> 

</span><del>-RefPtr&lt;JSC::ArrayBufferView&gt; toPossiblySharedArrayBufferView(JSC::JSValue);

-RefPtr&lt;JSC::Int8Array&gt; toPossiblySharedInt8Array(JSC::JSValue);

-RefPtr&lt;JSC::Int16Array&gt; toPossiblySharedInt16Array(JSC::JSValue);

-RefPtr&lt;JSC::Int32Array&gt; toPossiblySharedInt32Array(JSC::JSValue);

-RefPtr&lt;JSC::Uint8Array&gt; toPossiblySharedUint8Array(JSC::JSValue);

-RefPtr&lt;JSC::Uint8ClampedArray&gt; toPossiblySharedUint8ClampedArray(JSC::JSValue);

-RefPtr&lt;JSC::Uint16Array&gt; toPossiblySharedUint16Array(JSC::JSValue);

-RefPtr&lt;JSC::Uint32Array&gt; toPossiblySharedUint32Array(JSC::JSValue);

-RefPtr&lt;JSC::Float32Array&gt; toPossiblySharedFloat32Array(JSC::JSValue);

-RefPtr&lt;JSC::Float64Array&gt; toPossiblySharedFloat64Array(JSC::JSValue);

</del><ins>+RefPtr&lt;JSC::ArrayBufferView&gt; toPossiblySharedArrayBufferView(JSC::VM&amp;, JSC::JSValue);

+RefPtr&lt;JSC::Int8Array&gt; toPossiblySharedInt8Array(JSC::VM&amp;, JSC::JSValue);

+RefPtr&lt;JSC::Int16Array&gt; toPossiblySharedInt16Array(JSC::VM&amp;, JSC::JSValue);

+RefPtr&lt;JSC::Int32Array&gt; toPossiblySharedInt32Array(JSC::VM&amp;, JSC::JSValue);

+RefPtr&lt;JSC::Uint8Array&gt; toPossiblySharedUint8Array(JSC::VM&amp;, JSC::JSValue);

+RefPtr&lt;JSC::Uint8ClampedArray&gt; toPossiblySharedUint8ClampedArray(JSC::VM&amp;, JSC::JSValue);

+RefPtr&lt;JSC::Uint16Array&gt; toPossiblySharedUint16Array(JSC::VM&amp;, JSC::JSValue);

+RefPtr&lt;JSC::Uint32Array&gt; toPossiblySharedUint32Array(JSC::VM&amp;, JSC::JSValue);

+RefPtr&lt;JSC::Float32Array&gt; toPossiblySharedFloat32Array(JSC::VM&amp;, JSC::JSValue);

+RefPtr&lt;JSC::Float64Array&gt; toPossiblySharedFloat64Array(JSC::VM&amp;, JSC::JSValue);

</ins><span class="cx"> 

</span><del>-RefPtr&lt;JSC::ArrayBufferView&gt; toUnsharedArrayBufferView(JSC::JSValue);

-RefPtr&lt;JSC::Int8Array&gt; toUnsharedInt8Array(JSC::JSValue);

-RefPtr&lt;JSC::Int16Array&gt; toUnsharedInt16Array(JSC::JSValue);

-RefPtr&lt;JSC::Int32Array&gt; toUnsharedInt32Array(JSC::JSValue);

-RefPtr&lt;JSC::Uint8Array&gt; toUnsharedUint8Array(JSC::JSValue);

-RefPtr&lt;JSC::Uint8ClampedArray&gt; toUnsharedUint8ClampedArray(JSC::JSValue);

-RefPtr&lt;JSC::Uint16Array&gt; toUnsharedUint16Array(JSC::JSValue);

-RefPtr&lt;JSC::Uint32Array&gt; toUnsharedUint32Array(JSC::JSValue);

-RefPtr&lt;JSC::Float32Array&gt; toUnsharedFloat32Array(JSC::JSValue);

-RefPtr&lt;JSC::Float64Array&gt; toUnsharedFloat64Array(JSC::JSValue);

</del><ins>+RefPtr&lt;JSC::ArrayBufferView&gt; toUnsharedArrayBufferView(JSC::VM&amp;, JSC::JSValue);

+RefPtr&lt;JSC::Int8Array&gt; toUnsharedInt8Array(JSC::VM&amp;, JSC::JSValue);

+RefPtr&lt;JSC::Int16Array&gt; toUnsharedInt16Array(JSC::VM&amp;, JSC::JSValue);

+RefPtr&lt;JSC::Int32Array&gt; toUnsharedInt32Array(JSC::VM&amp;, JSC::JSValue);

+RefPtr&lt;JSC::Uint8Array&gt; toUnsharedUint8Array(JSC::VM&amp;, JSC::JSValue);

+RefPtr&lt;JSC::Uint8ClampedArray&gt; toUnsharedUint8ClampedArray(JSC::VM&amp;, JSC::JSValue);

+RefPtr&lt;JSC::Uint16Array&gt; toUnsharedUint16Array(JSC::VM&amp;, JSC::JSValue);

+RefPtr&lt;JSC::Uint32Array&gt; toUnsharedUint32Array(JSC::VM&amp;, JSC::JSValue);

+RefPtr&lt;JSC::Float32Array&gt; toUnsharedFloat32Array(JSC::VM&amp;, JSC::JSValue);

+RefPtr&lt;JSC::Float64Array&gt; toUnsharedFloat64Array(JSC::VM&amp;, JSC::JSValue);

</ins><span class="cx"> 

</span><span class="cx"> template&lt;typename T, typename JSType&gt; Vector&lt;Ref&lt;T&gt;&gt; toRefNativeArray(JSC::ExecState&amp;, JSC::JSValue);

</span><span class="cx"> WEBCORE_EXPORT bool hasIteratorMethod(JSC::ExecState&amp;, JSC::JSValue);

</span><span class="lines">@@ -567,7 +567,7 @@

</span><span class="cx"> template&lt;typename JSClass&gt; inline JSClass&amp; castThisValue(JSC::ExecState&amp; state)

</span><span class="cx"> {

</span><span class="cx">     auto thisValue = state.thisValue();

</span><del>-    auto castedThis = jsDynamicDowncast&lt;JSClass*&gt;(thisValue);

</del><ins>+    auto castedThis = jsDynamicDowncast&lt;JSClass*&gt;(state.vm(), thisValue);

</ins><span class="cx">     ASSERT(castedThis);

</span><span class="cx">     return *castedThis;

</span><span class="cx"> }

</span><span class="lines">@@ -691,41 +691,41 @@

</span><span class="cx">     return createIteratorResultObject(&amp;state, JSC::jsUndefined(), true);

</span><span class="cx"> }

</span><span class="cx"> 

</span><del>-inline RefPtr&lt;JSC::ArrayBufferView&gt; toPossiblySharedArrayBufferView(JSC::JSValue value)

</del><ins>+inline RefPtr&lt;JSC::ArrayBufferView&gt; toPossiblySharedArrayBufferView(JSC::VM&amp; vm, JSC::JSValue value)

</ins><span class="cx"> {

</span><del>-    auto* wrapper = jsDynamicDowncast&lt;JSC::JSArrayBufferView*&gt;(value);

</del><ins>+    auto* wrapper = jsDynamicDowncast&lt;JSC::JSArrayBufferView*&gt;(vm, value);

</ins><span class="cx">     if (!wrapper)

</span><span class="cx">         return nullptr;

</span><span class="cx">     return wrapper-&gt;possiblySharedImpl();

</span><span class="cx"> }

</span><span class="cx"> 

</span><del>-inline RefPtr&lt;JSC::ArrayBufferView&gt; toUnsharedArrayBufferView(JSC::JSValue value)

</del><ins>+inline RefPtr&lt;JSC::ArrayBufferView&gt; toUnsharedArrayBufferView(JSC::VM&amp; vm, JSC::JSValue value)

</ins><span class="cx"> {

</span><del>-    auto result = toPossiblySharedArrayBufferView(value);

</del><ins>+    auto result = toPossiblySharedArrayBufferView(vm, value);

</ins><span class="cx">     if (!result || result-&gt;isShared())

</span><span class="cx">         return nullptr;

</span><span class="cx">     return result;

</span><span class="cx"> }

</span><span class="cx"> 

</span><del>-inline RefPtr&lt;JSC::Int8Array&gt; toPossiblySharedInt8Array(JSC::JSValue value) { return JSC::toPossiblySharedNativeTypedView&lt;JSC::Int8Adaptor&gt;(value); }

-inline RefPtr&lt;JSC::Int16Array&gt; toPossiblySharedInt16Array(JSC::JSValue value) { return JSC::toPossiblySharedNativeTypedView&lt;JSC::Int16Adaptor&gt;(value); }

-inline RefPtr&lt;JSC::Int32Array&gt; toPossiblySharedInt32Array(JSC::JSValue value) { return JSC::toPossiblySharedNativeTypedView&lt;JSC::Int32Adaptor&gt;(value); }

-inline RefPtr&lt;JSC::Uint8Array&gt; toPossiblySharedUint8Array(JSC::JSValue value) { return JSC::toPossiblySharedNativeTypedView&lt;JSC::Uint8Adaptor&gt;(value); }

-inline RefPtr&lt;JSC::Uint8ClampedArray&gt; toPossiblySharedUint8ClampedArray(JSC::JSValue value) { return JSC::toPossiblySharedNativeTypedView&lt;JSC::Uint8ClampedAdaptor&gt;(value); }

-inline RefPtr&lt;JSC::Uint16Array&gt; toPossiblySharedUint16Array(JSC::JSValue value) { return JSC::toPossiblySharedNativeTypedView&lt;JSC::Uint16Adaptor&gt;(value); }

-inline RefPtr&lt;JSC::Uint32Array&gt; toPossiblySharedUint32Array(JSC::JSValue value) { return JSC::toPossiblySharedNativeTypedView&lt;JSC::Uint32Adaptor&gt;(value); }

-inline RefPtr&lt;JSC::Float32Array&gt; toPossiblySharedFloat32Array(JSC::JSValue value) { return JSC::toPossiblySharedNativeTypedView&lt;JSC::Float32Adaptor&gt;(value); }

-inline RefPtr&lt;JSC::Float64Array&gt; toPossiblySharedFloat64Array(JSC::JSValue value) { return JSC::toPossiblySharedNativeTypedView&lt;JSC::Float64Adaptor&gt;(value); }

</del><ins>+inline RefPtr&lt;JSC::Int8Array&gt; toPossiblySharedInt8Array(JSC::VM&amp; vm, JSC::JSValue value) { return JSC::toPossiblySharedNativeTypedView&lt;JSC::Int8Adaptor&gt;(vm, value); }

+inline RefPtr&lt;JSC::Int16Array&gt; toPossiblySharedInt16Array(JSC::VM&amp; vm, JSC::JSValue value) { return JSC::toPossiblySharedNativeTypedView&lt;JSC::Int16Adaptor&gt;(vm, value); }

+inline RefPtr&lt;JSC::Int32Array&gt; toPossiblySharedInt32Array(JSC::VM&amp; vm, JSC::JSValue value) { return JSC::toPossiblySharedNativeTypedView&lt;JSC::Int32Adaptor&gt;(vm, value); }

+inline RefPtr&lt;JSC::Uint8Array&gt; toPossiblySharedUint8Array(JSC::VM&amp; vm, JSC::JSValue value) { return JSC::toPossiblySharedNativeTypedView&lt;JSC::Uint8Adaptor&gt;(vm, value); }

+inline RefPtr&lt;JSC::Uint8ClampedArray&gt; toPossiblySharedUint8ClampedArray(JSC::VM&amp; vm, JSC::JSValue value) { return JSC::toPossiblySharedNativeTypedView&lt;JSC::Uint8ClampedAdaptor&gt;(vm, value); }

+inline RefPtr&lt;JSC::Uint16Array&gt; toPossiblySharedUint16Array(JSC::VM&amp; vm, JSC::JSValue value) { return JSC::toPossiblySharedNativeTypedView&lt;JSC::Uint16Adaptor&gt;(vm, value); }

+inline RefPtr&lt;JSC::Uint32Array&gt; toPossiblySharedUint32Array(JSC::VM&amp; vm, JSC::JSValue value) { return JSC::toPossiblySharedNativeTypedView&lt;JSC::Uint32Adaptor&gt;(vm, value); }

+inline RefPtr&lt;JSC::Float32Array&gt; toPossiblySharedFloat32Array(JSC::VM&amp; vm, JSC::JSValue value) { return JSC::toPossiblySharedNativeTypedView&lt;JSC::Float32Adaptor&gt;(vm, value); }

+inline RefPtr&lt;JSC::Float64Array&gt; toPossiblySharedFloat64Array(JSC::VM&amp; vm, JSC::JSValue value) { return JSC::toPossiblySharedNativeTypedView&lt;JSC::Float64Adaptor&gt;(vm, value); }

</ins><span class="cx"> 

</span><del>-inline RefPtr&lt;JSC::Int8Array&gt; toUnsharedInt8Array(JSC::JSValue value) { return JSC::toUnsharedNativeTypedView&lt;JSC::Int8Adaptor&gt;(value); }

-inline RefPtr&lt;JSC::Int16Array&gt; toUnsharedInt16Array(JSC::JSValue value) { return JSC::toUnsharedNativeTypedView&lt;JSC::Int16Adaptor&gt;(value); }

-inline RefPtr&lt;JSC::Int32Array&gt; toUnsharedInt32Array(JSC::JSValue value) { return JSC::toUnsharedNativeTypedView&lt;JSC::Int32Adaptor&gt;(value); }

-inline RefPtr&lt;JSC::Uint8Array&gt; toUnsharedUint8Array(JSC::JSValue value) { return JSC::toUnsharedNativeTypedView&lt;JSC::Uint8Adaptor&gt;(value); }

-inline RefPtr&lt;JSC::Uint8ClampedArray&gt; toUnsharedUint8ClampedArray(JSC::JSValue value) { return JSC::toUnsharedNativeTypedView&lt;JSC::Uint8ClampedAdaptor&gt;(value); }

-inline RefPtr&lt;JSC::Uint16Array&gt; toUnsharedUint16Array(JSC::JSValue value) { return JSC::toUnsharedNativeTypedView&lt;JSC::Uint16Adaptor&gt;(value); }

-inline RefPtr&lt;JSC::Uint32Array&gt; toUnsharedUint32Array(JSC::JSValue value) { return JSC::toUnsharedNativeTypedView&lt;JSC::Uint32Adaptor&gt;(value); }

-inline RefPtr&lt;JSC::Float32Array&gt; toUnsharedFloat32Array(JSC::JSValue value) { return JSC::toUnsharedNativeTypedView&lt;JSC::Float32Adaptor&gt;(value); }

-inline RefPtr&lt;JSC::Float64Array&gt; toUnsharedFloat64Array(JSC::JSValue value) { return JSC::toUnsharedNativeTypedView&lt;JSC::Float64Adaptor&gt;(value); }

</del><ins>+inline RefPtr&lt;JSC::Int8Array&gt; toUnsharedInt8Array(JSC::VM&amp; vm, JSC::JSValue value) { return JSC::toUnsharedNativeTypedView&lt;JSC::Int8Adaptor&gt;(vm, value); }

+inline RefPtr&lt;JSC::Int16Array&gt; toUnsharedInt16Array(JSC::VM&amp; vm, JSC::JSValue value) { return JSC::toUnsharedNativeTypedView&lt;JSC::Int16Adaptor&gt;(vm, value); }

+inline RefPtr&lt;JSC::Int32Array&gt; toUnsharedInt32Array(JSC::VM&amp; vm, JSC::JSValue value) { return JSC::toUnsharedNativeTypedView&lt;JSC::Int32Adaptor&gt;(vm, value); }

+inline RefPtr&lt;JSC::Uint8Array&gt; toUnsharedUint8Array(JSC::VM&amp; vm, JSC::JSValue value) { return JSC::toUnsharedNativeTypedView&lt;JSC::Uint8Adaptor&gt;(vm, value); }

+inline RefPtr&lt;JSC::Uint8ClampedArray&gt; toUnsharedUint8ClampedArray(JSC::VM&amp; vm, JSC::JSValue value) { return JSC::toUnsharedNativeTypedView&lt;JSC::Uint8ClampedAdaptor&gt;(vm, value); }

+inline RefPtr&lt;JSC::Uint16Array&gt; toUnsharedUint16Array(JSC::VM&amp; vm, JSC::JSValue value) { return JSC::toUnsharedNativeTypedView&lt;JSC::Uint16Adaptor&gt;(vm, value); }

+inline RefPtr&lt;JSC::Uint32Array&gt; toUnsharedUint32Array(JSC::VM&amp; vm, JSC::JSValue value) { return JSC::toUnsharedNativeTypedView&lt;JSC::Uint32Adaptor&gt;(vm, value); }

+inline RefPtr&lt;JSC::Float32Array&gt; toUnsharedFloat32Array(JSC::VM&amp; vm, JSC::JSValue value) { return JSC::toUnsharedNativeTypedView&lt;JSC::Float32Adaptor&gt;(vm, value); }

+inline RefPtr&lt;JSC::Float64Array&gt; toUnsharedFloat64Array(JSC::VM&amp; vm, JSC::JSValue value) { return JSC::toUnsharedNativeTypedView&lt;JSC::Float64Adaptor&gt;(vm, value); }

</ins><span class="cx"> 

</span><span class="cx"> template&lt;typename T, typename JST&gt; inline Vector&lt;Ref&lt;T&gt;&gt; toRefNativeArray(JSC::ExecState&amp; state, JSC::JSValue value)

</span><span class="cx"> {

</span><span class="lines">@@ -741,8 +741,8 @@

</span><span class="cx">     forEachInIterable(&amp;state, value, [&amp;result](JSC::VM&amp; vm, JSC::ExecState* state, JSC::JSValue jsValue) {

</span><span class="cx">         auto scope = DECLARE_THROW_SCOPE(vm);

</span><span class="cx"> 

</span><del>-        if (jsValue.inherits(JST::info())) {

-            auto* object = JST::toWrapped(jsValue);

</del><ins>+        if (jsValue.inherits(vm, JST::info())) {

+            auto* object = JST::toWrapped(vm, jsValue);

</ins><span class="cx">             ASSERT(object);

</span><span class="cx">             result.append(*object);

</span><span class="cx">         } else

</span></span></pre></div>

<a id="trunkSourceWebCorebindingsjsJSDOMConstructorh"></a>

<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/js/JSDOMConstructor.h (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/WebCore/bindings/js/JSDOMConstructor.h        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/WebCore/bindings/js/JSDOMConstructor.h        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -146,7 +146,7 @@

</span><span class="cx"> template&lt;typename JSClass&gt; inline void JSDOMConstructorNotConstructable&lt;JSClass&gt;::finishCreation(JSC::VM&amp; vm, JSDOMGlobalObject&amp; globalObject)

</span><span class="cx"> {

</span><span class="cx">     Base::finishCreation(vm);

</span><del>-    ASSERT(inherits(info()));

</del><ins>+    ASSERT(inherits(vm, info()));

</ins><span class="cx">     initializeProperties(vm, globalObject);

</span><span class="cx"> }

</span><span class="cx"> 

</span><span class="lines">@@ -165,7 +165,7 @@

</span><span class="cx"> template&lt;typename JSClass&gt; inline void JSDOMConstructor&lt;JSClass&gt;::finishCreation(JSC::VM&amp; vm, JSDOMGlobalObject&amp; globalObject)

</span><span class="cx"> {

</span><span class="cx">     Base::finishCreation(vm);

</span><del>-    ASSERT(inherits(info()));

</del><ins>+    ASSERT(inherits(vm, info()));

</ins><span class="cx">     initializeProperties(vm, globalObject);

</span><span class="cx"> }

</span><span class="cx"> 

</span><span class="lines">@@ -190,7 +190,7 @@

</span><span class="cx"> template&lt;typename JSClass&gt; inline void JSDOMNamedConstructor&lt;JSClass&gt;::finishCreation(JSC::VM&amp; vm, JSDOMGlobalObject&amp; globalObject)

</span><span class="cx"> {

</span><span class="cx">     Base::finishCreation(globalObject);

</span><del>-    ASSERT(inherits(info()));

</del><ins>+    ASSERT(inherits(vm, info()));

</ins><span class="cx">     initializeProperties(vm, globalObject);

</span><span class="cx"> }

</span><span class="cx"> 

</span><span class="lines">@@ -215,7 +215,7 @@

</span><span class="cx"> template&lt;typename JSClass&gt; inline void JSBuiltinConstructor&lt;JSClass&gt;::finishCreation(JSC::VM&amp; vm, JSDOMGlobalObject&amp; globalObject)

</span><span class="cx"> {

</span><span class="cx">     Base::finishCreation(vm);

</span><del>-    ASSERT(inherits(info()));

</del><ins>+    ASSERT(inherits(vm, info()));

</ins><span class="cx">     setInitializeFunction(vm, *JSC::JSFunction::createBuiltinFunction(vm, initializeExecutable(vm), &amp;globalObject));

</span><span class="cx">     initializeProperties(vm, globalObject);

</span><span class="cx"> }

</span></span></pre></div>

<a id="trunkSourceWebCorebindingsjsJSDOMConverth"></a>

<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/js/JSDOMConvert.h (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/WebCore/bindings/js/JSDOMConvert.h        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/WebCore/bindings/js/JSDOMConvert.h        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -439,7 +439,7 @@

</span><span class="cx">     {

</span><span class="cx">         JSC::VM&amp; vm = state.vm();

</span><span class="cx">         auto scope = DECLARE_THROW_SCOPE(vm);

</span><del>-        ReturnType object = WrapperType::toWrapped(value);

</del><ins>+        ReturnType object = WrapperType::toWrapped(vm, value);

</ins><span class="cx">         if (UNLIKELY(!object))

</span><span class="cx">             exceptionThrower(state, scope);

</span><span class="cx">         return object;

</span><span class="lines">@@ -1516,7 +1516,8 @@

</span><span class="cx"> 

</span><span class="cx">     static ReturnType convert(JSC::ExecState&amp; state, JSC::JSValue value)

</span><span class="cx">     {

</span><del>-        auto scope = DECLARE_THROW_SCOPE(state.vm());

</del><ins>+        JSC::VM&amp; vm = state.vm();

+        auto scope = DECLARE_THROW_SCOPE(vm);

</ins><span class="cx"> 

<span class="cx">         // 1. If the union type includes a nullable type and V is null or undefined, then return the IDL value null.

</span><span class="cx">         constexpr bool hasNullType = brigand::any&lt;TypeList, std::is_same&lt;IDLNull, brigand::_1&gt;&gt;::value;

</span><span class="lines">@@ -1556,7 +1557,7 @@

</span><span class="cx">                 using RawType = typename Type::RawType;

</span><span class="cx">                 using WrapperType = typename JSDOMWrapperConverterTraits&lt;RawType&gt;::WrapperClass;

</span><span class="cx"> 

</span><del>-                auto castedValue = WrapperType::toWrapped(value);

</del><ins>+                auto castedValue = WrapperType::toWrapped(vm, value);

</ins><span class="cx">                 if (!castedValue)

</span><span class="cx">                     return;

</span><span class="cx">                 

</span><span class="lines">@@ -1773,7 +1774,7 @@

</span><span class="cx">     {

</span><span class="cx">         JSC::VM&amp; vm = state.vm();

</span><span class="cx">         auto scope = DECLARE_THROW_SCOPE(vm);

</span><del>-        ReturnType object = WrapperType::toWrapped(state, value);

</del><ins>+        ReturnType object = WrapperType::toWrapped(vm, state, value);

</ins><span class="cx">         if (UNLIKELY(!object))

</span><span class="cx">             exceptionThrower(state, scope);

</span><span class="cx">         return object;

</span></span></pre></div>

<a id="trunkSourceWebCorebindingsjsJSDOMGlobalObjectcpp"></a>

<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/js/JSDOMGlobalObject.cpp (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/WebCore/bindings/js/JSDOMGlobalObject.cpp        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/WebCore/bindings/js/JSDOMGlobalObject.cpp        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -158,7 +158,7 @@

</span><span class="cx"> void JSDOMGlobalObject::finishCreation(VM&amp; vm)

</span><span class="cx"> {

</span><span class="cx">     Base::finishCreation(vm);

</span><del>-    ASSERT(inherits(info()));

</del><ins>+    ASSERT(inherits(vm, info()));

</ins><span class="cx"> 

</span><span class="cx">     addBuiltinGlobals(vm);

</span><span class="cx">     

</span><span class="lines">@@ -168,7 +168,7 @@

</span><span class="cx"> void JSDOMGlobalObject::finishCreation(VM&amp; vm, JSObject* thisValue)

</span><span class="cx"> {

</span><span class="cx">     Base::finishCreation(vm, thisValue);

</span><del>-    ASSERT(inherits(info()));

</del><ins>+    ASSERT(inherits(vm, info()));

</ins><span class="cx"> 

</span><span class="cx">     addBuiltinGlobals(vm);

</span><span class="cx">     

</span><span class="lines">@@ -177,9 +177,9 @@

</span><span class="cx"> 

</span><span class="cx"> ScriptExecutionContext* JSDOMGlobalObject::scriptExecutionContext() const

</span><span class="cx"> {

</span><del>-    if (inherits(JSDOMWindowBase::info()))

</del><ins>+    if (inherits(vm(), JSDOMWindowBase::info()))

</ins><span class="cx">         return jsCast&lt;const JSDOMWindowBase*&gt;(this)-&gt;scriptExecutionContext();

</span><del>-    if (inherits(JSWorkerGlobalScopeBase::info()))

</del><ins>+    if (inherits(vm(), JSWorkerGlobalScopeBase::info()))

</ins><span class="cx">         return jsCast&lt;const JSWorkerGlobalScopeBase*&gt;(this)-&gt;scriptExecutionContext();

</span><span class="cx">     dataLog(&quot;Unexpected global object: &quot;, JSValue(this), &quot;\n&quot;);

</span><span class="cx">     RELEASE_ASSERT_NOT_REACHED();

</span></span></pre></div>

<a id="trunkSourceWebCorebindingsjsJSDOMIteratorh"></a>

<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/js/JSDOMIterator.h (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/WebCore/bindings/js/JSDOMIterator.h        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/WebCore/bindings/js/JSDOMIterator.h        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -247,7 +247,7 @@

</span><span class="cx">     JSC::VM&amp; vm = state-&gt;vm();

</span><span class="cx">     auto scope = DECLARE_THROW_SCOPE(vm);

</span><span class="cx"> 

</span><del>-    auto iterator = jsDynamicDowncast&lt;JSDOMIterator&lt;JSWrapper, IteratorTraits&gt;*&gt;(state-&gt;thisValue());

</del><ins>+    auto iterator = jsDynamicDowncast&lt;JSDOMIterator&lt;JSWrapper, IteratorTraits&gt;*&gt;(vm, state-&gt;thisValue());

</ins><span class="cx">     if (!iterator)

</span><span class="cx">         return JSC::JSValue::encode(throwTypeError(state, scope, ASCIILiteral(&quot;Cannot call next() on a non-Iterator object&quot;)));

</span><span class="cx"> 

</span><span class="lines">@@ -258,7 +258,7 @@

</span><span class="cx"> void JSDOMIteratorPrototype&lt;JSWrapper, IteratorTraits&gt;::finishCreation(JSC::VM&amp; vm, JSC::JSGlobalObject* globalObject)

</span><span class="cx"> {

</span><span class="cx">     Base::finishCreation(vm);

</span><del>-    ASSERT(inherits(info()));

</del><ins>+    ASSERT(inherits(vm, info()));

</ins><span class="cx"> 

</span><span class="cx">     JSC_NATIVE_INTRINSIC_FUNCTION_WITHOUT_TRANSITION(vm.propertyNames-&gt;next, next, 0, 0, JSC::NoIntrinsic);

</span><span class="cx"> }

</span></span></pre></div>

<a id="trunkSourceWebCorebindingsjsJSDOMWindowBasecpp"></a>

<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/js/JSDOMWindowBase.cpp (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/WebCore/bindings/js/JSDOMWindowBase.cpp        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/WebCore/bindings/js/JSDOMWindowBase.cpp        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -83,7 +83,7 @@

</span><span class="cx"> void JSDOMWindowBase::finishCreation(VM&amp; vm, JSDOMWindowShell* shell)

</span><span class="cx"> {

</span><span class="cx">     Base::finishCreation(vm, shell);

</span><del>-    ASSERT(inherits(info()));

</del><ins>+    ASSERT(inherits(vm, info()));

</ins><span class="cx"> 

</span><span class="cx">     GlobalPropertyInfo staticGlobals[] = {

</span><span class="cx">         GlobalPropertyInfo(vm.propertyNames-&gt;document, jsNull(), DontDelete | ReadOnly),

</span><span class="lines">@@ -269,13 +269,14 @@

</span><span class="cx">     return frame-&gt;script().windowShell(world)-&gt;window();

</span><span class="cx"> }

</span><span class="cx"> 

</span><del>-JSDOMWindow* toJSDOMWindow(JSValue value)

</del><ins>+JSDOMWindow* toJSDOMWindow(JSC::VM&amp; vm, JSValue value)

</ins><span class="cx"> {

</span><span class="cx">     if (!value.isObject())

</span><span class="cx">         return 0;

</span><ins>+

</ins><span class="cx">     while (!value.isNull()) {

</span><span class="cx">         JSObject* object = asObject(value);

</span><del>-        const ClassInfo* classInfo = object-&gt;classInfo();

</del><ins>+        const ClassInfo* classInfo = object-&gt;classInfo(vm);

</ins><span class="cx">         if (classInfo == JSDOMWindow::info())

</span><span class="cx">             return jsCast&lt;JSDOMWindow*&gt;(object);

</span><span class="cx">         if (classInfo == JSDOMWindowShell::info())

</span></span></pre></div>

<a id="trunkSourceWebCorebindingsjsJSDOMWindowBaseh"></a>

<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/js/JSDOMWindowBase.h (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/WebCore/bindings/js/JSDOMWindowBase.h        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/WebCore/bindings/js/JSDOMWindowBase.h        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -94,6 +94,6 @@

</span><span class="cx"> 

</span><span class="cx">     // Returns JSDOMWindow or 0

</span><span class="cx">     JSDOMWindow* toJSDOMWindow(Frame*, DOMWrapperWorld&amp;);

</span><del>-    WEBCORE_EXPORT JSDOMWindow* toJSDOMWindow(JSC::JSValue);

</del><ins>+    WEBCORE_EXPORT JSDOMWindow* toJSDOMWindow(JSC::VM&amp;, JSC::JSValue);

</ins><span class="cx"> 

</span><span class="cx"> } // namespace WebCore

</span></span></pre></div>

<a id="trunkSourceWebCorebindingsjsJSDOMWindowCustomcpp"></a>

<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/js/JSDOMWindowCustom.cpp (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/WebCore/bindings/js/JSDOMWindowCustom.cpp        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/WebCore/bindings/js/JSDOMWindowCustom.cpp        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -62,7 +62,8 @@

</span><span class="cx"> #if ENABLE(USER_MESSAGE_HANDLERS)

</span><span class="cx"> static EncodedJSValue jsDOMWindowWebKit(ExecState* exec, EncodedJSValue thisValue, PropertyName)

</span><span class="cx"> {

</span><del>-    JSDOMWindow* castedThis = toJSDOMWindow(JSValue::decode(thisValue));

</del><ins>+    VM&amp; vm = exec-&gt;vm();

+    JSDOMWindow* castedThis = toJSDOMWindow(vm, JSValue::decode(thisValue));

</ins><span class="cx">     if (!BindingSecurity::shouldAllowAccessToDOMWindow(exec, castedThis-&gt;wrapped()))

</span><span class="cx">         return JSValue::encode(jsUndefined());

</span><span class="cx">     return JSValue::encode(toJS(exec, castedThis-&gt;globalObject(), castedThis-&gt;wrapped().webkitNamespace()));

</span><span class="lines">@@ -524,14 +525,14 @@

</span><span class="cx">     return toJS&lt;IDLLong&gt;(state, scope, wrapped().setInterval(WTFMove(action), delay));

</span><span class="cx"> }

</span><span class="cx"> 

</span><del>-DOMWindow* JSDOMWindow::toWrapped(JSValue value)

</del><ins>+DOMWindow* JSDOMWindow::toWrapped(VM&amp; vm, JSValue value)

</ins><span class="cx"> {

</span><span class="cx">     if (!value.isObject())

</span><span class="cx">         return nullptr;

</span><span class="cx">     JSObject* object = asObject(value);

</span><del>-    if (object-&gt;inherits(JSDOMWindow::info()))

</del><ins>+    if (object-&gt;inherits(vm, JSDOMWindow::info()))

</ins><span class="cx">         return &amp;jsCast&lt;JSDOMWindow*&gt;(object)-&gt;wrapped();

</span><del>-    if (object-&gt;inherits(JSDOMWindowShell::info()))

</del><ins>+    if (object-&gt;inherits(vm, JSDOMWindowShell::info()))

</ins><span class="cx">         return &amp;jsCast&lt;JSDOMWindowShell*&gt;(object)-&gt;wrapped();

</span><span class="cx">     return nullptr;

</span><span class="cx"> }

</span></span></pre></div>

<a id="trunkSourceWebCorebindingsjsJSDOMWindowShellcpp"></a>

<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/js/JSDOMWindowShell.cpp (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/WebCore/bindings/js/JSDOMWindowShell.cpp        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/WebCore/bindings/js/JSDOMWindowShell.cpp        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -54,7 +54,7 @@

</span><span class="cx"> void JSDOMWindowShell::finishCreation(VM&amp; vm, RefPtr&lt;DOMWindow&gt;&amp;&amp; window)

</span><span class="cx"> {

</span><span class="cx">     Base::finishCreation(vm);

</span><del>-    ASSERT(inherits(info()));

</del><ins>+    ASSERT(inherits(vm, info()));

</ins><span class="cx">     setWindow(WTFMove(window));

</span><span class="cx"> }

</span><span class="cx"> 

</span><span class="lines">@@ -106,9 +106,9 @@

</span><span class="cx">     return window()-&gt;wrapped();

</span><span class="cx"> }

</span><span class="cx"> 

</span><del>-DOMWindow* JSDOMWindowShell::toWrapped(JSObject* value)

</del><ins>+DOMWindow* JSDOMWindowShell::toWrapped(VM&amp; vm, JSObject* value)

</ins><span class="cx"> {

</span><del>-    auto* wrapper = jsDynamicDowncast&lt;JSDOMWindowShell*&gt;(value);

</del><ins>+    auto* wrapper = jsDynamicDowncast&lt;JSDOMWindowShell*&gt;(vm, value);

</ins><span class="cx">     if (!wrapper)

</span><span class="cx">         return nullptr;

</span><span class="cx">     return &amp;wrapper-&gt;window()-&gt;wrapped();

</span></span></pre></div>

<a id="trunkSourceWebCorebindingsjsJSDOMWindowShellh"></a>

<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/js/JSDOMWindowShell.h (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/WebCore/bindings/js/JSDOMWindowShell.h        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/WebCore/bindings/js/JSDOMWindowShell.h        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -48,7 +48,7 @@

</span><span class="cx">         DECLARE_INFO;

</span><span class="cx"> 

</span><span class="cx">         DOMWindow&amp; wrapped() const;

</span><del>-        static WEBCORE_EXPORT DOMWindow* toWrapped(JSC::JSObject*);

</del><ins>+        static WEBCORE_EXPORT DOMWindow* toWrapped(JSC::VM&amp;, JSC::JSObject*);

</ins><span class="cx"> 

</span><span class="cx">         static JSDOMWindowShell* create(JSC::VM&amp; vm, RefPtr&lt;DOMWindow&gt;&amp;&amp; window, JSC::Structure* structure, DOMWrapperWorld&amp; world)

</span><span class="cx">         {

</span></span></pre></div>

<a id="trunkSourceWebCorebindingsjsJSDocumentCustomcpp"></a>

<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/js/JSDocumentCustom.cpp (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/WebCore/bindings/js/JSDocumentCustom.cpp        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/WebCore/bindings/js/JSDocumentCustom.cpp        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -77,7 +77,7 @@

</span><span class="cx">         return nullptr;

</span><span class="cx"> 

<span class="cx">     // Creating a wrapper for domWindow might have created a wrapper for document as well.

</span><del>-    return getCachedWrapper(toJSDOMWindow(toJS(&amp;state, *window))-&gt;world(), document);

</del><ins>+    return getCachedWrapper(toJSDOMWindow(state.vm(), toJS(&amp;state, *window))-&gt;world(), document);

</ins><span class="cx"> }

</span><span class="cx"> 

</span><span class="cx"> void reportMemoryForDocumentIfFrameless(ExecState&amp; state, Document&amp; document)

</span><span class="lines">@@ -116,7 +116,7 @@

</span><span class="cx">     auto touchList = TouchList::create();

</span><span class="cx"> 

</span><span class="cx">     for (size_t i = 0; i &lt; state.argumentCount(); ++i) {

</span><del>-        auto* item = JSTouch::toWrapped(state.uncheckedArgument(i));

</del><ins>+        auto* item = JSTouch::toWrapped(vm, state.uncheckedArgument(i));

</ins><span class="cx">         if (!item)

</span><span class="cx">             return JSValue::decode(throwArgumentTypeError(state, scope, i, &quot;touches&quot;, &quot;Document&quot;, &quot;createTouchList&quot;, &quot;Touch&quot;));

</span><span class="cx"> 

</span></span></pre></div>

<a id="trunkSourceWebCorebindingsjsJSDynamicDowncasth"></a>

<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/js/JSDynamicDowncast.h (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/WebCore/bindings/js/JSDynamicDowncast.h        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/WebCore/bindings/js/JSDynamicDowncast.h        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -50,9 +50,9 @@

</span><span class="cx"> template&lt;typename Select&gt;

</span><span class="cx"> struct JSDynamicCastTrait {

</span><span class="cx">     template&lt;typename To, typename From&gt;

</span><del>-    ALWAYS_INLINE static To cast(From* from)

</del><ins>+    ALWAYS_INLINE static To cast(JSC::VM&amp; vm, From* from)

</ins><span class="cx">     {

</span><del>-        return JSC::jsDynamicCast&lt;To&gt;(from);

</del><ins>+        return JSC::jsDynamicCast&lt;To&gt;(vm, from);

</ins><span class="cx">     }

</span><span class="cx"> };

</span><span class="cx"> 

</span><span class="lines">@@ -59,7 +59,7 @@

</span><span class="cx"> template&lt;&gt;

</span><span class="cx"> struct JSDynamicCastTrait&lt;JSNode&gt; {

</span><span class="cx">     template&lt;typename To, typename From&gt;

</span><del>-    ALWAYS_INLINE static To cast(From* from)

</del><ins>+    ALWAYS_INLINE static To cast(JSC::VM&amp;, From* from)

</ins><span class="cx">     {

</span><span class="cx">         return jsNodeCast(from);

</span><span class="cx">     }

</span><span class="lines">@@ -68,7 +68,7 @@

</span><span class="cx"> template&lt;&gt;

</span><span class="cx"> struct JSDynamicCastTrait&lt;JSElement&gt; {

</span><span class="cx">     template&lt;typename To, typename From&gt;

</span><del>-    ALWAYS_INLINE static To cast(From* from)

</del><ins>+    ALWAYS_INLINE static To cast(JSC::VM&amp;, From* from)

</ins><span class="cx">     {

</span><span class="cx">         return jsElementCast(from);

</span><span class="cx">     }

</span><span class="lines">@@ -77,7 +77,7 @@

</span><span class="cx"> template&lt;&gt;

</span><span class="cx"> struct JSDynamicCastTrait&lt;JSDocument&gt; {

</span><span class="cx">     template&lt;typename To, typename From&gt;

</span><del>-    ALWAYS_INLINE static To cast(From* from)

</del><ins>+    ALWAYS_INLINE static To cast(JSC::VM&amp;, From* from)

</ins><span class="cx">     {

</span><span class="cx">         return jsDocumentCast(from);

</span><span class="cx">     }

</span><span class="lines">@@ -86,7 +86,7 @@

</span><span class="cx"> template&lt;&gt;

</span><span class="cx"> struct JSDynamicCastTrait&lt;JSEvent&gt; {

</span><span class="cx">     template&lt;typename To, typename From&gt;

</span><del>-    ALWAYS_INLINE static To cast(From* from)

</del><ins>+    ALWAYS_INLINE static To cast(JSC::VM&amp;, From* from)

</ins><span class="cx">     {

</span><span class="cx">         return jsEventCast(from);

</span><span class="cx">     }

</span><span class="lines">@@ -93,18 +93,18 @@

</span><span class="cx"> };

</span><span class="cx"> 

</span><span class="cx"> template&lt;typename To, typename From&gt;

</span><del>-ALWAYS_INLINE To jsDynamicDowncast(From* from)

</del><ins>+ALWAYS_INLINE To jsDynamicDowncast(JSC::VM&amp; vm, From* from)

</ins><span class="cx"> {

</span><span class="cx">     typedef JSDynamicCastTrait&lt;typename std::remove_cv&lt;typename std::remove_pointer&lt;To&gt;::type&gt;::type&gt; Dispatcher;

</span><del>-    return Dispatcher::template cast&lt;To&gt;(from);

</del><ins>+    return Dispatcher::template cast&lt;To&gt;(vm, from);

</ins><span class="cx"> }

</span><span class="cx"> 

</span><span class="cx"> template&lt;typename To&gt;

</span><del>-ALWAYS_INLINE To jsDynamicDowncast(JSC::JSValue from)

</del><ins>+ALWAYS_INLINE To jsDynamicDowncast(JSC::VM&amp; vm, JSC::JSValue from)

</ins><span class="cx"> {

</span><span class="cx">     if (UNLIKELY(!from.isCell()))

</span><span class="cx">         return nullptr;

</span><del>-    return jsDynamicDowncast&lt;To&gt;(from.asCell());

</del><ins>+    return jsDynamicDowncast&lt;To&gt;(vm, from.asCell());

</ins><span class="cx"> }

</span><span class="cx"> 

</span><span class="cx"> }

</span></span></pre></div>

<a id="trunkSourceWebCorebindingsjsJSEventListenercpp"></a>

<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/js/JSEventListener.cpp (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/WebCore/bindings/js/JSEventListener.cpp        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/WebCore/bindings/js/JSEventListener.cpp        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -150,7 +150,7 @@

</span><span class="cx"> 

</span><span class="cx">         if (is&lt;WorkerGlobalScope&gt;(*scriptExecutionContext)) {

</span><span class="cx">             auto scriptController = downcast&lt;WorkerGlobalScope&gt;(*scriptExecutionContext).script();

</span><del>-            bool terminatorCausedException = (scope.exception() &amp;&amp; isTerminatedExecutionException(scope.exception()));

</del><ins>+            bool terminatorCausedException = (scope.exception() &amp;&amp; isTerminatedExecutionException(vm, scope.exception()));

</ins><span class="cx">             if (terminatorCausedException || scriptController-&gt;isTerminatingExecution())

</span><span class="cx">                 scriptController-&gt;forbidExecution();

</span><span class="cx">         }

</span></span></pre></div>

<a id="trunkSourceWebCorebindingsjsJSEventTargetCustomcpp"></a>

<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/js/JSEventTargetCustom.cpp (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/WebCore/bindings/js/JSEventTargetCustom.cpp        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/WebCore/bindings/js/JSEventTargetCustom.cpp        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -57,10 +57,10 @@

</span><span class="cx"> #undef TRY_TO_WRAP_WITH_INTERFACE

</span><span class="cx"> 

</span><span class="cx"> #define TRY_TO_UNWRAP_WITH_INTERFACE(interfaceName) \

</span><del>-    if (value.inherits(JS##interfaceName::info()))                      \

</del><ins>+    if (value.inherits(vm, JS##interfaceName::info()))                      \

</ins><span class="cx">         return &amp;jsCast&lt;JS##interfaceName*&gt;(asObject(value))-&gt;wrapped();

</span><span class="cx"> 

</span><del>-EventTarget* JSEventTarget::toWrapped(JSValue value)

</del><ins>+EventTarget* JSEventTarget::toWrapped(VM&amp; vm, JSValue value)

</ins><span class="cx"> {

</span><span class="cx">     TRY_TO_UNWRAP_WITH_INTERFACE(DOMWindowShell)

</span><span class="cx">     TRY_TO_UNWRAP_WITH_INTERFACE(DOMWindow)

</span><span class="lines">@@ -71,13 +71,13 @@

</span><span class="cx"> 

</span><span class="cx"> #undef TRY_TO_UNWRAP_WITH_INTERFACE

</span><span class="cx"> 

</span><del>-std::unique_ptr&lt;JSEventTargetWrapper&gt; jsEventTargetCast(JSValue thisValue)

</del><ins>+std::unique_ptr&lt;JSEventTargetWrapper&gt; jsEventTargetCast(VM&amp; vm, JSValue thisValue)

</ins><span class="cx"> {

</span><del>-    if (auto* target = jsDynamicDowncast&lt;JSEventTarget*&gt;(thisValue))

</del><ins>+    if (auto* target = jsDynamicDowncast&lt;JSEventTarget*&gt;(vm, thisValue))

</ins><span class="cx">         return std::make_unique&lt;JSEventTargetWrapper&gt;(target-&gt;wrapped(), *target);

</span><del>-    if (auto* window = toJSDOMWindow(thisValue))

</del><ins>+    if (auto* window = toJSDOMWindow(vm, thisValue))

</ins><span class="cx">         return std::make_unique&lt;JSEventTargetWrapper&gt;(window-&gt;wrapped(), *window);

</span><del>-    if (auto* scope = toJSWorkerGlobalScope(thisValue))

</del><ins>+    if (auto* scope = toJSWorkerGlobalScope(vm, thisValue))

</ins><span class="cx">         return std::make_unique&lt;JSEventTargetWrapper&gt;(scope-&gt;wrapped(), *scope);

</span><span class="cx">     return nullptr;

</span><span class="cx"> }

</span></span></pre></div>

<a id="trunkSourceWebCorebindingsjsJSEventTargetCustomh"></a>

<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/js/JSEventTargetCustom.h (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/WebCore/bindings/js/JSEventTargetCustom.h        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/WebCore/bindings/js/JSEventTargetCustom.h        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -48,7 +48,7 @@

</span><span class="cx">     JSC::JSObject&amp; m_wrapper;

</span><span class="cx"> };

</span><span class="cx"> 

</span><del>-std::unique_ptr&lt;JSEventTargetWrapper&gt; jsEventTargetCast(JSC::JSValue thisValue);

</del><ins>+std::unique_ptr&lt;JSEventTargetWrapper&gt; jsEventTargetCast(JSC::VM&amp;, JSC::JSValue thisValue);

</ins><span class="cx"> 

</span><span class="cx"> template&lt;&gt; struct BindingCaller&lt;JSEventTarget&gt; {

</span><span class="cx">     using OperationCallerFunction = JSC::EncodedJSValue(JSC::ExecState*, JSEventTargetWrapper*, JSC::ThrowScope&amp;);

</span><span class="lines">@@ -57,9 +57,10 @@

</span><span class="cx">     static JSC::EncodedJSValue callOperation(JSC::ExecState* state, const char* operationName)

</span><span class="cx">     {

</span><span class="cx">         ASSERT(state);

</span><del>-        auto throwScope = DECLARE_THROW_SCOPE(state-&gt;vm());

</del><ins>+        JSC::VM&amp; vm = state-&gt;vm();

+        auto throwScope = DECLARE_THROW_SCOPE(vm);

</ins><span class="cx"> 

</span><del>-        auto thisObject = jsEventTargetCast(state-&gt;thisValue().toThis(state, JSC::NotStrictMode));

</del><ins>+        auto thisObject = jsEventTargetCast(vm, state-&gt;thisValue().toThis(state, JSC::NotStrictMode));

</ins><span class="cx">         if (UNLIKELY(!thisObject))

</span><span class="cx">             return throwThisTypeError(*state, throwScope, &quot;EventTarget&quot;, operationName);

</span><span class="cx"> 

</span></span></pre></div>

<a id="trunkSourceWebCorebindingsjsJSExceptionBasecpp"></a>

<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/js/JSExceptionBase.cpp (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/WebCore/bindings/js/JSExceptionBase.cpp        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/WebCore/bindings/js/JSExceptionBase.cpp        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -34,15 +34,15 @@

</span><span class="cx"> 

</span><span class="cx"> namespace WebCore {

</span><span class="cx"> 

</span><del>-ExceptionBase* toExceptionBase(JSC::JSValue value)

</del><ins>+ExceptionBase* toExceptionBase(JSC::VM&amp; vm, JSC::JSValue value)

</ins><span class="cx"> {

</span><del>-    if (DOMCoreException* domException = JSDOMCoreException::toWrapped(value))

</del><ins>+    if (DOMCoreException* domException = JSDOMCoreException::toWrapped(vm, value))

</ins><span class="cx">         return reinterpret_cast&lt;ExceptionBase*&gt;(domException);

</span><del>-    if (SVGException* svgException = JSSVGException::toWrapped(value))

</del><ins>+    if (SVGException* svgException = JSSVGException::toWrapped(vm, value))

</ins><span class="cx">         return reinterpret_cast&lt;ExceptionBase*&gt;(svgException);

</span><del>-    if (XPathException* pathException = JSXPathException::toWrapped(value))

</del><ins>+    if (XPathException* pathException = JSXPathException::toWrapped(vm, value))

</ins><span class="cx">         return reinterpret_cast&lt;ExceptionBase*&gt;(pathException);

</span><del>-    if (SQLException* pathException = JSSQLException::toWrapped(value))

</del><ins>+    if (SQLException* pathException = JSSQLException::toWrapped(vm, value))

</ins><span class="cx">         return reinterpret_cast&lt;ExceptionBase*&gt;(pathException);

</span><span class="cx"> 

</span><span class="cx">     return 0;

</span></span></pre></div>

<a id="trunkSourceWebCorebindingsjsJSExceptionBaseh"></a>

<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/js/JSExceptionBase.h (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/WebCore/bindings/js/JSExceptionBase.h        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/WebCore/bindings/js/JSExceptionBase.h        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -27,6 +27,7 @@

</span><span class="cx"> 

</span><span class="cx"> namespace JSC {

</span><span class="cx"> class JSValue;

</span><ins>+class VM;

</ins><span class="cx"> }

</span><span class="cx"> 

</span><span class="cx"> namespace WebCore {

</span><span class="lines">@@ -33,6 +34,6 @@

</span><span class="cx"> 

</span><span class="cx"> class ExceptionBase;

</span><span class="cx"> 

</span><del>-ExceptionBase* toExceptionBase(JSC::JSValue);

</del><ins>+ExceptionBase* toExceptionBase(JSC::VM&amp;, JSC::JSValue);

</ins><span class="cx"> 

</span><span class="cx"> } // namespace WebCore

</span></span></pre></div>

<a id="trunkSourceWebCorebindingsjsJSInspectorFrontendHostCustomcpp"></a>

<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/js/JSInspectorFrontendHostCustom.cpp (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/WebCore/bindings/js/JSInspectorFrontendHostCustom.cpp        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/WebCore/bindings/js/JSInspectorFrontendHostCustom.cpp        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -51,6 +51,7 @@

</span><span class="cx"> #if ENABLE(CONTEXT_MENUS)

</span><span class="cx"> static void populateContextMenuItems(ExecState* exec, JSArray* array, ContextMenu&amp; menu)

</span><span class="cx"> {

</span><ins>+    VM&amp; vm = exec-&gt;vm();

</ins><span class="cx">     for (size_t i = 0; i &lt; array-&gt;length(); ++i) {

</span><span class="cx">         JSObject* item = asObject(array-&gt;getIndex(exec, i));

</span><span class="cx">         JSValue label = item-&gt;get(exec, Identifier::fromString(exec, &quot;label&quot;));

</span><span class="lines">@@ -66,7 +67,7 @@

</span><span class="cx">         if (typeString == &quot;separator&quot;) {

</span><span class="cx">             ContextMenuItem item(SeparatorType, ContextMenuItemTagNoAction, String());

</span><span class="cx">             menu.appendItem(item);

</span><del>-        } else if (typeString == &quot;subMenu&quot; &amp;&amp; subItems.inherits(JSArray::info())) {

</del><ins>+        } else if (typeString == &quot;subMenu&quot; &amp;&amp; subItems.inherits(vm, JSArray::info())) {

</ins><span class="cx">             ContextMenu subMenu;

</span><span class="cx">             JSArray* subItemsArray = asArray(subItems);

</span><span class="cx">             populateContextMenuItems(exec, subItemsArray, subMenu);

</span><span class="lines">@@ -90,7 +91,8 @@

</span><span class="cx"> #if ENABLE(CONTEXT_MENUS)

</span><span class="cx">     if (state.argumentCount() &lt; 2)

</span><span class="cx">         return jsUndefined();

</span><del>-    Event* event = JSEvent::toWrapped(state.argument(0));

</del><ins>+    VM&amp; vm = state.vm();

+    Event* event = JSEvent::toWrapped(vm, state.argument(0));

</ins><span class="cx"> 

</span><span class="cx">     JSArray* array = asArray(state.argument(1));

</span><span class="cx">     ContextMenu menu;

</span></span></pre></div>

<a id="trunkSourceWebCorebindingsjsJSNodeCustomcpp"></a>

<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/js/JSNodeCustom.cpp (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/WebCore/bindings/js/JSNodeCustom.cpp        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/WebCore/bindings/js/JSNodeCustom.cpp        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -119,11 +119,11 @@

</span><span class="cx">         return throwException(&amp;state, scope, createNotEnoughArgumentsError(&amp;state));

</span><span class="cx"> 

</span><span class="cx">     JSValue newChildValue = state.uncheckedArgument(0);

</span><del>-    auto* newChild = JSNode::toWrapped(newChildValue);

</del><ins>+    auto* newChild = JSNode::toWrapped(vm, newChildValue);

</ins><span class="cx">     if (UNLIKELY(!newChild))

</span><span class="cx">         return JSValue::decode(throwArgumentTypeError(state, scope, 0, &quot;node&quot;, &quot;Node&quot;, &quot;insertBefore&quot;, &quot;Node&quot;));

</span><span class="cx"> 

</span><del>-    propagateException(state, scope, wrapped().insertBefore(*newChild, JSNode::toWrapped(state.uncheckedArgument(1))));

</del><ins>+    propagateException(state, scope, wrapped().insertBefore(*newChild, JSNode::toWrapped(vm, state.uncheckedArgument(1))));

</ins><span class="cx">     return newChildValue;

</span><span class="cx"> }

</span><span class="cx"> 

</span><span class="lines">@@ -135,9 +135,9 @@

</span><span class="cx">     if (UNLIKELY(state.argumentCount() &lt; 2))

</span><span class="cx">         return throwException(&amp;state, scope, createNotEnoughArgumentsError(&amp;state));

</span><span class="cx"> 

</span><del>-    auto* newChild = JSNode::toWrapped(state.uncheckedArgument(0));

</del><ins>+    auto* newChild = JSNode::toWrapped(vm, state.uncheckedArgument(0));

</ins><span class="cx">     JSValue oldChildValue = state.uncheckedArgument(1);

</span><del>-    auto* oldChild = JSNode::toWrapped(oldChildValue);

</del><ins>+    auto* oldChild = JSNode::toWrapped(vm, oldChildValue);

</ins><span class="cx">     if (UNLIKELY(!newChild || !oldChild)) {

</span><span class="cx">         if (!newChild)

</span><span class="cx">             return JSValue::decode(throwArgumentTypeError(state, scope, 0, &quot;node&quot;, &quot;Node&quot;, &quot;replaceChild&quot;, &quot;Node&quot;));

</span><span class="lines">@@ -154,7 +154,7 @@

</span><span class="cx">     auto scope = DECLARE_THROW_SCOPE(vm);

</span><span class="cx"> 

</span><span class="cx">     JSValue childValue = state.argument(0);

</span><del>-    auto* child = JSNode::toWrapped(childValue);

</del><ins>+    auto* child = JSNode::toWrapped(vm, childValue);

</ins><span class="cx">     if (UNLIKELY(!child))

</span><span class="cx">         return JSValue::decode(throwArgumentTypeError(state, scope, 0, &quot;child&quot;, &quot;Node&quot;, &quot;removeChild&quot;, &quot;Node&quot;));

</span><span class="cx"> 

</span><span class="lines">@@ -168,7 +168,7 @@

</span><span class="cx">     auto scope = DECLARE_THROW_SCOPE(vm);

</span><span class="cx"> 

</span><span class="cx">     JSValue newChildValue = state.argument(0);

</span><del>-    auto newChild = JSNode::toWrapped(newChildValue);

</del><ins>+    auto newChild = JSNode::toWrapped(vm, newChildValue);

</ins><span class="cx">     if (UNLIKELY(!newChild))

</span><span class="cx">         return JSValue::decode(throwArgumentTypeError(state, scope, 0, &quot;node&quot;, &quot;Node&quot;, &quot;appendChild&quot;, &quot;Node&quot;));

</span><span class="cx"> 

</span><span class="lines">@@ -178,7 +178,7 @@

</span><span class="cx"> 

</span><span class="cx"> JSScope* JSNode::pushEventHandlerScope(ExecState* exec, JSScope* node) const

</span><span class="cx"> {

</span><del>-    if (inherits(JSHTMLElement::info()))

</del><ins>+    if (inherits(exec-&gt;vm(), JSHTMLElement::info()))

</ins><span class="cx">         return jsCast&lt;const JSHTMLElement*&gt;(this)-&gt;pushEventHandlerScope(exec, node);

</span><span class="cx">     return node;

</span><span class="cx"> }

</span></span></pre></div>

<a id="trunkSourceWebCorebindingsjsJSPluginElementFunctionscpp"></a>

<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/js/JSPluginElementFunctions.cpp (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/WebCore/bindings/js/JSPluginElementFunctions.cpp        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/WebCore/bindings/js/JSPluginElementFunctions.cpp        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -99,7 +99,7 @@

</span><span class="cx">     VM&amp; vm = exec-&gt;vm();

</span><span class="cx">     auto scope = DECLARE_THROW_SCOPE(vm);

</span><span class="cx"> 

</span><del>-    JSHTMLElement* thisObject = jsDynamicDowncast&lt;JSHTMLElement*&gt;(JSValue::decode(thisValue));

</del><ins>+    JSHTMLElement* thisObject = jsDynamicDowncast&lt;JSHTMLElement*&gt;(vm, JSValue::decode(thisValue));

</ins><span class="cx">     if (!thisObject)

</span><span class="cx">         return throwVMTypeError(exec, scope);

</span><span class="cx">     JSObject* scriptObject = pluginScriptObject(exec, thisObject);

</span></span></pre></div>

<a id="trunkSourceWebCorebindingsjsJSReadableStreamPrivateConstructorscpp"></a>

<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/js/JSReadableStreamPrivateConstructors.cpp (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/WebCore/bindings/js/JSReadableStreamPrivateConstructors.cpp        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/WebCore/bindings/js/JSReadableStreamPrivateConstructors.cpp        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -56,12 +56,13 @@

</span><span class="cx"> 

</span><span class="cx"> EncodedJSValue JSC_HOST_CALL constructJSReadableStreamDefaultReader(ExecState&amp; exec)

</span><span class="cx"> {

</span><del>-    JSVMClientData&amp; clientData = *static_cast&lt;JSVMClientData*&gt;(exec.vm().clientData);

</del><ins>+    VM&amp; vm = exec.vm();

+    JSVMClientData&amp; clientData = *static_cast&lt;JSVMClientData*&gt;(vm.clientData);

</ins><span class="cx">     JSDOMGlobalObject&amp; globalObject = *static_cast&lt;JSDOMGlobalObject*&gt;(exec.lexicalGlobalObject());

</span><span class="cx"> 

</span><span class="cx">     JSC::JSObject* constructor = JSC::asObject(globalObject.get(&amp;exec, clientData.builtinNames().ReadableStreamDefaultReaderPrivateName()));

</span><span class="cx">     ConstructData constructData;

</span><del>-    ConstructType constructType = constructor-&gt;methodTable()-&gt;getConstructData(constructor, constructData);

</del><ins>+    ConstructType constructType = constructor-&gt;methodTable(vm)-&gt;getConstructData(constructor, constructData);

</ins><span class="cx">     ASSERT(constructType != ConstructType::None);

</span><span class="cx"> 

</span><span class="cx">     MarkedArgumentBuffer args;

</span></span></pre></div>

<a id="trunkSourceWebCorebindingsjsJSReadableStreamSourceCustomcpp"></a>

<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/js/JSReadableStreamSourceCustom.cpp (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/WebCore/bindings/js/JSReadableStreamSourceCustom.cpp        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/WebCore/bindings/js/JSReadableStreamSourceCustom.cpp        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -37,11 +37,12 @@

</span><span class="cx"> 

</span><span class="cx"> static void startReadableStream(JSC::ExecState&amp; state, Ref&lt;DeferredPromise&gt;&amp;&amp; promise)

</span><span class="cx"> {

</span><del>-    JSReadableStreamSource* source = jsDynamicDowncast&lt;JSReadableStreamSource*&gt;(state.thisValue());

</del><ins>+    VM&amp; vm = state.vm();

+    JSReadableStreamSource* source = jsDynamicDowncast&lt;JSReadableStreamSource*&gt;(vm, state.thisValue());

</ins><span class="cx">     ASSERT(source);

</span><span class="cx"> 

</span><span class="cx">     ASSERT(state.argumentCount());

</span><del>-    JSReadableStreamDefaultController* controller = jsDynamicDowncast&lt;JSReadableStreamDefaultController*&gt;(state.uncheckedArgument(0));

</del><ins>+    JSReadableStreamDefaultController* controller = jsDynamicDowncast&lt;JSReadableStreamDefaultController*&gt;(vm, state.uncheckedArgument(0));

</ins><span class="cx">     ASSERT(controller);

</span><span class="cx"> 

</span><span class="cx">     source-&gt;wrapped().start(ReadableStreamDefaultController(controller), WTFMove(promise));

</span><span class="lines">@@ -49,11 +50,12 @@

</span><span class="cx"> 

</span><span class="cx"> JSValue JSReadableStreamSource::start(ExecState&amp; state)

</span><span class="cx"> {

</span><ins>+    VM&amp; vm = state.vm();

</ins><span class="cx">     ASSERT(state.argumentCount());

</span><del>-    JSReadableStreamDefaultController* controller = jsDynamicDowncast&lt;JSReadableStreamDefaultController*&gt;(state.uncheckedArgument(0));

</del><ins>+    JSReadableStreamDefaultController* controller = jsDynamicDowncast&lt;JSReadableStreamDefaultController*&gt;(vm, state.uncheckedArgument(0));

</ins><span class="cx">     ASSERT(controller);

</span><span class="cx"> 

</span><del>-    m_controller.set(state.vm(), this, controller);

</del><ins>+    m_controller.set(vm, this, controller);

</ins><span class="cx"> 

</span><span class="cx">     return callPromiseFunction&lt;startReadableStream, PromiseExecutionScope::WindowOrWorker&gt;(state);

</span><span class="cx"> }

</span><span class="lines">@@ -60,7 +62,8 @@

</span><span class="cx"> 

</span><span class="cx"> static void pullReadableStream(JSC::ExecState&amp; state, Ref&lt;DeferredPromise&gt;&amp;&amp; promise)

</span><span class="cx"> {

</span><del>-    JSReadableStreamSource* source = jsDynamicDowncast&lt;JSReadableStreamSource*&gt;(state.thisValue());

</del><ins>+    VM&amp; vm = state.vm();

+    JSReadableStreamSource* source = jsDynamicDowncast&lt;JSReadableStreamSource*&gt;(vm, state.thisValue());

</ins><span class="cx">     ASSERT(source);

</span><span class="cx"> 

</span><span class="cx">     source-&gt;wrapped().pull(WTFMove(promise));

</span></span></pre></div>

<a id="trunkSourceWebCorebindingsjsJSSubtleCryptoCustomcpp"></a>

<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/js/JSSubtleCryptoCustom.cpp (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/WebCore/bindings/js/JSSubtleCryptoCustom.cpp        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/WebCore/bindings/js/JSSubtleCryptoCustom.cpp        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -420,7 +420,7 @@

</span><span class="cx">     VM&amp; vm = state.vm();

</span><span class="cx">     auto scope = DECLARE_THROW_SCOPE(vm);

</span><span class="cx"> 

</span><del>-    RefPtr&lt;CryptoKey&gt; result = JSCryptoKey::toWrapped(value);

</del><ins>+    RefPtr&lt;CryptoKey&gt; result = JSCryptoKey::toWrapped(vm, value);

</ins><span class="cx">     if (!result) {

</span><span class="cx">         throwTypeError(&amp;state, scope, ASCIILiteral(&quot;Invalid CryptoKey&quot;));

</span><span class="cx">         return nullptr;

</span><span class="lines">@@ -504,7 +504,7 @@

</span><span class="cx">         rejectWithException(WTFMove(capturedPromise), ec);

</span><span class="cx">     };

</span><span class="cx"> 

</span><del>-    auto subtle = jsDynamicDowncast&lt;JSSubtleCrypto*&gt;(state.thisValue());

</del><ins>+    auto subtle = jsDynamicDowncast&lt;JSSubtleCrypto*&gt;(vm, state.thisValue());

</ins><span class="cx">     ASSERT(subtle);

</span><span class="cx">     algorithm-&gt;encrypt(WTFMove(params), key.releaseNonNull(), WTFMove(data), WTFMove(callback), WTFMove(exceptionCallback), *scriptExecutionContextFromExecState(&amp;state), subtle-&gt;wrapped().workQueue());

</span><span class="cx"> }

</span><span class="lines">@@ -552,7 +552,7 @@

</span><span class="cx">         rejectWithException(WTFMove(capturedPromise), ec);

</span><span class="cx">     };

</span><span class="cx"> 

</span><del>-    auto subtle = jsDynamicDowncast&lt;JSSubtleCrypto*&gt;(state.thisValue());

</del><ins>+    auto subtle = jsDynamicDowncast&lt;JSSubtleCrypto*&gt;(vm, state.thisValue());

</ins><span class="cx">     ASSERT(subtle);

</span><span class="cx">     algorithm-&gt;decrypt(WTFMove(params), key.releaseNonNull(), WTFMove(data), WTFMove(callback), WTFMove(exceptionCallback), *scriptExecutionContextFromExecState(&amp;state), subtle-&gt;wrapped().workQueue());

</span><span class="cx"> }

</span><span class="lines">@@ -600,7 +600,7 @@

</span><span class="cx">         rejectWithException(WTFMove(capturedPromise), ec);

</span><span class="cx">     };

</span><span class="cx"> 

</span><del>-    JSSubtleCrypto* subtle = jsDynamicDowncast&lt;JSSubtleCrypto*&gt;(state.thisValue());

</del><ins>+    JSSubtleCrypto* subtle = jsDynamicDowncast&lt;JSSubtleCrypto*&gt;(vm, state.thisValue());

</ins><span class="cx">     ASSERT(subtle);

</span><span class="cx">     algorithm-&gt;sign(key.releaseNonNull(), WTFMove(data), WTFMove(callback), WTFMove(exceptionCallback), *scriptExecutionContextFromExecState(&amp;state), subtle-&gt;wrapped().workQueue());

</span><span class="cx"> }

</span><span class="lines">@@ -651,7 +651,7 @@

</span><span class="cx">         rejectWithException(WTFMove(capturedPromise), ec);

</span><span class="cx">     };

</span><span class="cx"> 

</span><del>-    auto subtle = jsDynamicDowncast&lt;JSSubtleCrypto*&gt;(state.thisValue());

</del><ins>+    auto subtle = jsDynamicDowncast&lt;JSSubtleCrypto*&gt;(vm, state.thisValue());

</ins><span class="cx">     ASSERT(subtle);

</span><span class="cx">     algorithm-&gt;verify(key.releaseNonNull(), WTFMove(signature), WTFMove(data), WTFMove(callback), WTFMove(exceptionCallback), *scriptExecutionContextFromExecState(&amp;state), subtle-&gt;wrapped().workQueue());

</span><span class="cx"> }

</span><span class="lines">@@ -686,7 +686,7 @@

</span><span class="cx">         rejectWithException(WTFMove(capturedPromise), ec);

</span><span class="cx">     };

</span><span class="cx"> 

</span><del>-    auto subtle = jsDynamicDowncast&lt;JSSubtleCrypto*&gt;(state.thisValue());

</del><ins>+    auto subtle = jsDynamicDowncast&lt;JSSubtleCrypto*&gt;(vm, state.thisValue());

</ins><span class="cx">     ASSERT(subtle);

</span><span class="cx">     algorithm-&gt;digest(WTFMove(data), WTFMove(callback), WTFMove(exceptionCallback), *scriptExecutionContextFromExecState(&amp;state), subtle-&gt;wrapped().workQueue());

</span><span class="cx"> }

</span><span class="lines">@@ -942,7 +942,7 @@

</span><span class="cx"> 

</span><span class="cx">     auto context = scriptExecutionContextFromExecState(&amp;state);

</span><span class="cx"> 

</span><del>-    auto subtle = jsDynamicDowncast&lt;JSSubtleCrypto*&gt;(state.thisValue());

</del><ins>+    auto subtle = jsDynamicDowncast&lt;JSSubtleCrypto*&gt;(vm, state.thisValue());

</ins><span class="cx">     ASSERT(subtle);

</span><span class="cx">     auto&amp; workQueue = subtle-&gt;wrapped().workQueue();

</span><span class="cx"> 

</span><span class="lines">@@ -1098,7 +1098,7 @@

</span><span class="cx">         unwrapAlgorithm-&gt;unwrapKey(unwrappingKey.releaseNonNull(), WTFMove(wrappedKey), WTFMove(callback), WTFMove(exceptionCallback));

</span><span class="cx">         return;

</span><span class="cx">     }

</span><del>-    auto subtle = jsDynamicDowncast&lt;JSSubtleCrypto*&gt;(state.thisValue());

</del><ins>+    auto subtle = jsDynamicDowncast&lt;JSSubtleCrypto*&gt;(vm, state.thisValue());

</ins><span class="cx">     ASSERT(subtle);

<span class="cx">     // The following operation should be performed asynchronously.

</span><span class="cx">     unwrapAlgorithm-&gt;decrypt(WTFMove(unwrapParams), unwrappingKey.releaseNonNull(), WTFMove(wrappedKey), WTFMove(callback), WTFMove(exceptionCallback), *scriptExecutionContextFromExecState(&amp;state), subtle-&gt;wrapped().workQueue());

</span></span></pre></div>

<a id="trunkSourceWebCorebindingsjsJSTrackCustomcpp"></a>

<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/js/JSTrackCustom.cpp (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/WebCore/bindings/js/JSTrackCustom.cpp        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/WebCore/bindings/js/JSTrackCustom.cpp        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -37,22 +37,6 @@

</span><span class="cx"> 

</span><span class="cx"> namespace WebCore {

</span><span class="cx"> 

</span><del>-TrackBase* toTrack(JSValue value)

-{

-    if (!value.isObject())

-        return nullptr;

-

-    JSObject* object = asObject(value);

-    if (object-&gt;inherits(JSTextTrack::info()))

-        return &amp;jsCast&lt;JSTextTrack*&gt;(object)-&gt;wrapped();

-    if (object-&gt;inherits(JSAudioTrack::info()))

-        return &amp;jsCast&lt;JSAudioTrack*&gt;(object)-&gt;wrapped();

-    if (object-&gt;inherits(JSVideoTrack::info()))

-        return &amp;jsCast&lt;JSVideoTrack*&gt;(object)-&gt;wrapped();

-

-    return nullptr;

-}

-

</del><span class="cx"> JSC::JSValue toJS(JSC::ExecState* state, JSDOMGlobalObject* globalObject, TrackBase&amp; track)

</span><span class="cx"> {

</span><span class="cx">     switch (track.type()) {

</span></span></pre></div>

<a id="trunkSourceWebCorebindingsjsJSTrackCustomh"></a>

<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/js/JSTrackCustom.h (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/WebCore/bindings/js/JSTrackCustom.h        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/WebCore/bindings/js/JSTrackCustom.h        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -34,7 +34,6 @@

</span><span class="cx"> 

</span><span class="cx"> namespace WebCore {

</span><span class="cx"> 

</span><del>-TrackBase* toTrack(JSC::JSValue);

</del><span class="cx"> JSC::JSValue toJS(JSC::ExecState*, JSDOMGlobalObject*, TrackBase&amp;);

</span><span class="cx"> 

</span><span class="cx"> inline void* root(TrackBase* track)

</span></span></pre></div>

<a id="trunkSourceWebCorebindingsjsJSWebKitSubtleCryptoCustomcpp"></a>

<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/js/JSWebKitSubtleCryptoCustom.cpp (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/WebCore/bindings/js/JSWebKitSubtleCryptoCustom.cpp        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/WebCore/bindings/js/JSWebKitSubtleCryptoCustom.cpp        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -138,7 +138,7 @@

</span><span class="cx">     auto parameters = JSCryptoAlgorithmDictionary::createParametersForEncrypt(state, scope, algorithm-&gt;identifier(), state.uncheckedArgument(0));

</span><span class="cx">     RETURN_IF_EXCEPTION(scope, { });

</span><span class="cx"> 

</span><del>-    RefPtr&lt;CryptoKey&gt; key = JSCryptoKey::toWrapped(state.uncheckedArgument(1));

</del><ins>+    RefPtr&lt;CryptoKey&gt; key = JSCryptoKey::toWrapped(vm, state.uncheckedArgument(1));

</ins><span class="cx">     if (!key)

</span><span class="cx">         return throwTypeError(&amp;state, scope);

</span><span class="cx"> 

</span><span class="lines">@@ -183,7 +183,7 @@

</span><span class="cx">     auto parameters = JSCryptoAlgorithmDictionary::createParametersForDecrypt(state, scope, algorithm-&gt;identifier(), state.uncheckedArgument(0));

</span><span class="cx">     RETURN_IF_EXCEPTION(scope, { });

</span><span class="cx"> 

</span><del>-    RefPtr&lt;CryptoKey&gt; key = JSCryptoKey::toWrapped(state.uncheckedArgument(1));

</del><ins>+    RefPtr&lt;CryptoKey&gt; key = JSCryptoKey::toWrapped(vm, state.uncheckedArgument(1));

</ins><span class="cx">     if (!key)

</span><span class="cx">         return throwTypeError(&amp;state, scope);

</span><span class="cx"> 

</span><span class="lines">@@ -228,7 +228,7 @@

</span><span class="cx">     auto parameters = JSCryptoAlgorithmDictionary::createParametersForSign(state, scope, algorithm-&gt;identifier(), state.uncheckedArgument(0));

</span><span class="cx">     RETURN_IF_EXCEPTION(scope, { });

</span><span class="cx"> 

</span><del>-    RefPtr&lt;CryptoKey&gt; key = JSCryptoKey::toWrapped(state.uncheckedArgument(1));

</del><ins>+    RefPtr&lt;CryptoKey&gt; key = JSCryptoKey::toWrapped(vm, state.uncheckedArgument(1));

</ins><span class="cx">     if (!key)

</span><span class="cx">         return throwTypeError(&amp;state, scope);

</span><span class="cx"> 

</span><span class="lines">@@ -273,7 +273,7 @@

</span><span class="cx">     auto parameters = JSCryptoAlgorithmDictionary::createParametersForVerify(state, scope, algorithm-&gt;identifier(), state.uncheckedArgument(0));

</span><span class="cx">     RETURN_IF_EXCEPTION(scope, { });

</span><span class="cx"> 

</span><del>-    RefPtr&lt;CryptoKey&gt; key = JSCryptoKey::toWrapped(state.uncheckedArgument(1));

</del><ins>+    RefPtr&lt;CryptoKey&gt; key = JSCryptoKey::toWrapped(vm, state.uncheckedArgument(1));

</ins><span class="cx">     if (!key)

</span><span class="cx">         return throwTypeError(&amp;state, scope);

</span><span class="cx"> 

</span><span class="lines">@@ -538,7 +538,7 @@

</span><span class="cx">     auto keyFormat = cryptoKeyFormatFromJSValue(state, scope, state.uncheckedArgument(0));

</span><span class="cx">     RETURN_IF_EXCEPTION(scope, { });

</span><span class="cx"> 

</span><del>-    RefPtr&lt;CryptoKey&gt; key = JSCryptoKey::toWrapped(state.uncheckedArgument(1));

</del><ins>+    RefPtr&lt;CryptoKey&gt; key = JSCryptoKey::toWrapped(vm, state.uncheckedArgument(1));

</ins><span class="cx">     if (!key)

</span><span class="cx">         return throwTypeError(&amp;state, scope);

</span><span class="cx"> 

</span><span class="lines">@@ -568,11 +568,11 @@

</span><span class="cx">     auto keyFormat = cryptoKeyFormatFromJSValue(state, scope, state.uncheckedArgument(0));

</span><span class="cx">     RETURN_IF_EXCEPTION(scope, { });

</span><span class="cx"> 

</span><del>-    RefPtr&lt;CryptoKey&gt; key = JSCryptoKey::toWrapped(state.uncheckedArgument(1));

</del><ins>+    RefPtr&lt;CryptoKey&gt; key = JSCryptoKey::toWrapped(vm, state.uncheckedArgument(1));

</ins><span class="cx">     if (!key)

</span><span class="cx">         return throwTypeError(&amp;state, scope);

</span><span class="cx"> 

</span><del>-    RefPtr&lt;CryptoKey&gt; wrappingKey = JSCryptoKey::toWrapped(state.uncheckedArgument(2));

</del><ins>+    RefPtr&lt;CryptoKey&gt; wrappingKey = JSCryptoKey::toWrapped(vm, state.uncheckedArgument(2));

</ins><span class="cx">     if (!key)

</span><span class="cx">         return throwTypeError(&amp;state, scope);

</span><span class="cx"> 

</span><span class="lines">@@ -628,7 +628,7 @@

</span><span class="cx">     auto wrappedKeyData = cryptoOperationDataFromJSValue(state, scope, state.uncheckedArgument(1));

</span><span class="cx">     RETURN_IF_EXCEPTION(scope, { });

</span><span class="cx"> 

</span><del>-    RefPtr&lt;CryptoKey&gt; unwrappingKey = JSCryptoKey::toWrapped(state.uncheckedArgument(2));

</del><ins>+    RefPtr&lt;CryptoKey&gt; unwrappingKey = JSCryptoKey::toWrapped(vm, state.uncheckedArgument(2));

</ins><span class="cx">     if (!unwrappingKey)

</span><span class="cx">         return throwTypeError(&amp;state, scope);

</span><span class="cx"> 

</span></span></pre></div>

<a id="trunkSourceWebCorebindingsjsJSWorkerGlobalScopeBasecpp"></a>

<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/js/JSWorkerGlobalScopeBase.cpp (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/WebCore/bindings/js/JSWorkerGlobalScopeBase.cpp        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/WebCore/bindings/js/JSWorkerGlobalScopeBase.cpp        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -26,7 +26,6 @@

</span><span class="cx">  */

</span><span class="cx"> 

</span><span class="cx"> #include &quot;config.h&quot;

</span><del>-

</del><span class="cx"> #include &quot;JSWorkerGlobalScopeBase.h&quot;

</span><span class="cx"> 

</span><span class="cx"> #include &quot;DOMWrapperWorld.h&quot;

</span><span class="lines">@@ -72,7 +71,7 @@

</span><span class="cx">     m_proxy.set(vm, this, proxy);

</span><span class="cx"> 

</span><span class="cx">     Base::finishCreation(vm, m_proxy.get());

</span><del>-    ASSERT(inherits(info()));

</del><ins>+    ASSERT(inherits(vm, info()));

</ins><span class="cx"> }

</span><span class="cx"> 

</span><span class="cx"> void JSWorkerGlobalScopeBase::visitChildren(JSCell* cell, SlotVisitor&amp; visitor)

</span><span class="lines">@@ -135,22 +134,22 @@

</span><span class="cx">     return contextWrapper-&gt;proxy();

</span><span class="cx"> }

</span><span class="cx"> 

</span><del>-JSDedicatedWorkerGlobalScope* toJSDedicatedWorkerGlobalScope(JSValue value)

</del><ins>+JSDedicatedWorkerGlobalScope* toJSDedicatedWorkerGlobalScope(VM&amp; vm, JSValue value)

</ins><span class="cx"> {

</span><span class="cx">     if (!value.isObject())

</span><span class="cx">         return 0;

</span><del>-    const ClassInfo* classInfo = asObject(value)-&gt;classInfo();

</del><ins>+    const ClassInfo* classInfo = asObject(value)-&gt;classInfo(vm);

</ins><span class="cx">     if (classInfo == JSDedicatedWorkerGlobalScope::info())

</span><span class="cx">         return jsCast&lt;JSDedicatedWorkerGlobalScope*&gt;(asObject(value));

</span><span class="cx">     if (classInfo == JSProxy::info())

</span><del>-        return jsDynamicDowncast&lt;JSDedicatedWorkerGlobalScope*&gt;(jsCast&lt;JSProxy*&gt;(asObject(value))-&gt;target());

</del><ins>+        return jsDynamicDowncast&lt;JSDedicatedWorkerGlobalScope*&gt;(vm, jsCast&lt;JSProxy*&gt;(asObject(value))-&gt;target());

</ins><span class="cx">     return 0;

</span><span class="cx"> }

</span><span class="cx"> 

</span><span class="cx"> 

</span><del>-JSWorkerGlobalScope* toJSWorkerGlobalScope(JSValue value)

</del><ins>+JSWorkerGlobalScope* toJSWorkerGlobalScope(VM&amp; vm, JSValue value)

</ins><span class="cx"> {

</span><del>-    return toJSDedicatedWorkerGlobalScope(value);

</del><ins>+    return toJSDedicatedWorkerGlobalScope(vm, value);

</ins><span class="cx"> }

</span><span class="cx"> 

</span><span class="cx"> } // namespace WebCore

</span></span></pre></div>

<a id="trunkSourceWebCorebindingsjsJSWorkerGlobalScopeBaseh"></a>

<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/js/JSWorkerGlobalScopeBase.h (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/WebCore/bindings/js/JSWorkerGlobalScopeBase.h        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/WebCore/bindings/js/JSWorkerGlobalScopeBase.h        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -77,7 +77,7 @@

</span><span class="cx">     JSC::JSValue toJS(JSC::ExecState*, WorkerGlobalScope&amp;);

</span><span class="cx">     inline JSC::JSValue toJS(JSC::ExecState* exec, WorkerGlobalScope* scope) { return scope ? toJS(exec, *scope) : JSC::jsNull(); }

</span><span class="cx"> 

</span><del>-    JSDedicatedWorkerGlobalScope* toJSDedicatedWorkerGlobalScope(JSC::JSValue);

-    JSWorkerGlobalScope* toJSWorkerGlobalScope(JSC::JSValue);

</del><ins>+    JSDedicatedWorkerGlobalScope* toJSDedicatedWorkerGlobalScope(JSC::VM&amp;, JSC::JSValue);

+    JSWorkerGlobalScope* toJSWorkerGlobalScope(JSC::VM&amp;, JSC::JSValue);

</ins><span class="cx"> 

</span><span class="cx"> } // namespace WebCore

</span></span></pre></div>

<a id="trunkSourceWebCorebindingsjsJSXMLHttpRequestCustomcpp"></a>

<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/js/JSXMLHttpRequestCustom.cpp (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/WebCore/bindings/js/JSXMLHttpRequestCustom.cpp        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/WebCore/bindings/js/JSXMLHttpRequestCustom.cpp        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -105,19 +105,20 @@

</span><span class="cx"> {

</span><span class="cx">     InspectorInstrumentation::willSendXMLHttpRequest(wrapped().scriptExecutionContext(), wrapped().url());

</span><span class="cx"> 

</span><ins>+    VM&amp; vm = state.vm();

</ins><span class="cx">     JSValue value = state.argument(0);

</span><span class="cx">     ExceptionOr&lt;void&gt; result;

</span><span class="cx">     if (value.isUndefinedOrNull())

</span><span class="cx">         result = wrapped().send();

</span><del>-    else if (value.inherits(JSDocument::info()))

-        result = wrapped().send(*JSDocument::toWrapped(value));

-    else if (value.inherits(JSBlob::info()))

-        result = wrapped().send(*JSBlob::toWrapped(value));

-    else if (value.inherits(JSDOMFormData::info()))

-        result = wrapped().send(*JSDOMFormData::toWrapped(value));

-    else if (RefPtr&lt;ArrayBuffer&gt; arrayBuffer = toUnsharedArrayBuffer(value))

</del><ins>+    else if (value.inherits(vm, JSDocument::info()))

+        result = wrapped().send(*JSDocument::toWrapped(vm, value));

+    else if (value.inherits(vm, JSBlob::info()))

+        result = wrapped().send(*JSBlob::toWrapped(vm, value));

+    else if (value.inherits(vm, JSDOMFormData::info()))

+        result = wrapped().send(*JSDOMFormData::toWrapped(vm, value));

+    else if (RefPtr&lt;ArrayBuffer&gt; arrayBuffer = toUnsharedArrayBuffer(vm, value))

</ins><span class="cx">         result = wrapped().send(*arrayBuffer);

</span><del>-    else if (RefPtr&lt;ArrayBufferView&gt; arrayBufferView = toUnsharedArrayBufferView(value))

</del><ins>+    else if (RefPtr&lt;ArrayBufferView&gt; arrayBufferView = toUnsharedArrayBufferView(vm, value))

</ins><span class="cx">         result = wrapped().send(*arrayBufferView);

</span><span class="cx">     else {

<span class="cx">         // FIXME: If toString raises an exception, should we exit before calling willSendXMLHttpRequest?

</span></span></pre></div>

<a id="trunkSourceWebCorebindingsjsJSXPathNSResolverCustomcpp"></a>

<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/js/JSXPathNSResolverCustom.cpp (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/WebCore/bindings/js/JSXPathNSResolverCustom.cpp        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/WebCore/bindings/js/JSXPathNSResolverCustom.cpp        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -33,14 +33,13 @@

</span><span class="cx"> 

</span><span class="cx"> namespace WebCore {

</span><span class="cx"> 

</span><del>-RefPtr&lt;XPathNSResolver&gt; JSXPathNSResolver::toWrapped(ExecState&amp; state, JSValue value)

</del><ins>+RefPtr&lt;XPathNSResolver&gt; JSXPathNSResolver::toWrapped(VM&amp; vm, ExecState&amp; state, JSValue value)

</ins><span class="cx"> {

</span><del>-    if (value.inherits(JSXPathNSResolver::info()))

</del><ins>+    if (value.inherits(vm, JSXPathNSResolver::info()))

</ins><span class="cx">         return &amp;jsCast&lt;JSXPathNSResolver*&gt;(asObject(value))-&gt;wrapped();

</span><span class="cx"> 

</span><span class="cx">     auto result = JSCustomXPathNSResolver::create(state, value);

</span><span class="cx">     if (UNLIKELY(result.hasException())) {

</span><del>-        VM&amp; vm = state.vm();

</del><span class="cx">         auto scope = DECLARE_THROW_SCOPE(vm);

</span><span class="cx">         propagateException(state, scope, result.releaseException());

</span><span class="cx">         return nullptr;

</span></span></pre></div>

<a id="trunkSourceWebCorebindingsjsScriptControllercpp"></a>

<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/js/ScriptController.cpp (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/WebCore/bindings/js/ScriptController.cpp        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/WebCore/bindings/js/ScriptController.cpp        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -390,7 +390,8 @@

</span><span class="cx"> 

</span><span class="cx">     auto&amp; rejectHandler = *JSNativeStdFunction::create(state.vm(), shell.window(), 1, String(), [moduleScript, moduleLoaderAlreadyReportedErrorSymbol, moduleLoaderFetchingIsCanceledSymbol](ExecState* exec) {

</span><span class="cx">         JSValue error = exec-&gt;argument(0);

</span><del>-        if (auto* symbol = jsDynamicCast&lt;Symbol*&gt;(error)) {

</del><ins>+        VM&amp; vm = exec-&gt;vm();

+        if (auto* symbol = jsDynamicCast&lt;Symbol*&gt;(vm, error)) {

</ins><span class="cx">             if (symbol-&gt;privateName() == moduleLoaderAlreadyReportedErrorSymbol) {

</span><span class="cx">                 moduleScript-&gt;notifyLoadFailed(LoadableScript::Error {

</span><span class="cx">                     LoadableScript::ErrorType::CachedScript,

</span><span class="lines">@@ -405,7 +406,6 @@

</span><span class="cx">             }

</span><span class="cx">         }

</span><span class="cx"> 

</span><del>-        VM&amp; vm = exec-&gt;vm();

</del><span class="cx">         auto scope = DECLARE_CATCH_SCOPE(vm);

</span><span class="cx">         moduleScript-&gt;notifyLoadFailed(LoadableScript::Error {

</span><span class="cx">             LoadableScript::ErrorType::CachedScript,

</span></span></pre></div>

<a id="trunkSourceWebCorebindingsjsScriptModuleLoadercpp"></a>

<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/js/ScriptModuleLoader.cpp (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/WebCore/bindings/js/ScriptModuleLoader.cpp        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/WebCore/bindings/js/ScriptModuleLoader.cpp        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -134,7 +134,7 @@

</span><span class="cx"> 

</span><span class="cx"> JSC::JSInternalPromise* ScriptModuleLoader::fetch(JSC::JSGlobalObject* jsGlobalObject, JSC::ExecState* exec, JSC::JSModuleLoader*, JSC::JSValue moduleKeyValue, JSC::JSValue scriptFetcher)

</span><span class="cx"> {

</span><del>-    ASSERT(JSC::jsDynamicCast&lt;JSC::JSScriptFetcher*&gt;(scriptFetcher));

</del><ins>+    ASSERT(JSC::jsDynamicCast&lt;JSC::JSScriptFetcher*&gt;(exec-&gt;vm(), scriptFetcher));

</ins><span class="cx"> 

</span><span class="cx">     auto&amp; globalObject = *JSC::jsCast&lt;JSDOMGlobalObject*&gt;(jsGlobalObject);

</span><span class="cx">     auto&amp; jsPromise = *JSC::JSInternalPromiseDeferred::create(exec, &amp;globalObject);

</span><span class="lines">@@ -179,7 +179,7 @@

<span class="cx">     // FIXME: Currently, we only support JSModuleRecord.

<span class="cx">     // Once the reflective part of the module loader is supported, we will handle arbitrary values.

</span><span class="cx">     // https://whatwg.github.io/loader/#registry-prototype-provide

</span><del>-    auto* moduleRecord = jsDynamicDowncast&lt;JSC::JSModuleRecord*&gt;(moduleRecordValue);

</del><ins>+    auto* moduleRecord = jsDynamicDowncast&lt;JSC::JSModuleRecord*&gt;(vm, moduleRecordValue);

</ins><span class="cx">     if (!moduleRecord)

</span><span class="cx">         return JSC::jsUndefined();

</span><span class="cx"> 

</span></span></pre></div>

<a id="trunkSourceWebCorebindingsjsScriptStatecpp"></a>

<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/js/ScriptState.cpp (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/WebCore/bindings/js/ScriptState.cpp        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/WebCore/bindings/js/ScriptState.cpp        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -50,7 +50,8 @@

</span><span class="cx"> DOMWindow* domWindowFromExecState(JSC::ExecState* scriptState)

</span><span class="cx"> {

</span><span class="cx">     JSC::JSGlobalObject* globalObject = scriptState-&gt;lexicalGlobalObject();

</span><del>-    if (!globalObject-&gt;inherits(JSDOMWindowBase::info()))

</del><ins>+    JSC::VM&amp; vm = globalObject-&gt;vm();

+    if (!globalObject-&gt;inherits(vm, JSDOMWindowBase::info()))

</ins><span class="cx">         return nullptr;

</span><span class="cx">     return &amp;JSC::jsCast&lt;JSDOMWindowBase*&gt;(globalObject)-&gt;wrapped();

</span><span class="cx"> }

</span><span class="lines">@@ -65,7 +66,8 @@

</span><span class="cx"> ScriptExecutionContext* scriptExecutionContextFromExecState(JSC::ExecState* scriptState)

</span><span class="cx"> {

</span><span class="cx">     JSC::JSGlobalObject* globalObject = scriptState-&gt;lexicalGlobalObject();

</span><del>-    if (!globalObject-&gt;inherits(JSDOMGlobalObject::info()))

</del><ins>+    JSC::VM&amp; vm = globalObject-&gt;vm();

+    if (!globalObject-&gt;inherits(vm, JSDOMGlobalObject::info()))

</ins><span class="cx">         return nullptr;

</span><span class="cx">     return JSC::jsCast&lt;JSDOMGlobalObject*&gt;(globalObject)-&gt;scriptExecutionContext();

</span><span class="cx"> }

</span></span></pre></div>

<a id="trunkSourceWebCorebindingsjsSerializedScriptValuecpp"></a>

<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/js/SerializedScriptValue.cpp (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/WebCore/bindings/js/SerializedScriptValue.cpp        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/WebCore/bindings/js/SerializedScriptValue.cpp        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -552,27 +552,27 @@

</span><span class="cx"> 

</span><span class="cx">     SerializationReturnCode serialize(JSValue in);

</span><span class="cx"> 

</span><del>-    bool isArray(JSValue value)

</del><ins>+    bool isArray(VM&amp; vm, JSValue value)

</ins><span class="cx">     {

</span><span class="cx">         if (!value.isObject())

</span><span class="cx">             return false;

</span><span class="cx">         JSObject* object = asObject(value);

</span><del>-        return isJSArray(object) || object-&gt;inherits(JSArray::info());

</del><ins>+        return isJSArray(object) || object-&gt;inherits(vm, JSArray::info());

</ins><span class="cx">     }

</span><span class="cx"> 

</span><del>-    bool isMap(JSValue value)

</del><ins>+    bool isMap(VM&amp; vm, JSValue value)

</ins><span class="cx">     {

</span><span class="cx">         if (!value.isObject())

</span><span class="cx">             return false;

</span><span class="cx">         JSObject* object = asObject(value);

</span><del>-        return object-&gt;inherits(JSMap::info());

</del><ins>+        return object-&gt;inherits(vm, JSMap::info());

</ins><span class="cx">     }

</span><del>-    bool isSet(JSValue value)

</del><ins>+    bool isSet(VM&amp; vm, JSValue value)

</ins><span class="cx">     {

</span><span class="cx">         if (!value.isObject())

</span><span class="cx">             return false;

</span><span class="cx">         JSObject* object = asObject(value);

</span><del>-        return object-&gt;inherits(JSSet::info());

</del><ins>+        return object-&gt;inherits(vm, JSSet::info());

</ins><span class="cx">     }

</span><span class="cx"> 

</span><span class="cx">     bool checkForDuplicate(JSObject* object)

</span><span class="lines">@@ -705,31 +705,32 @@

</span><span class="cx"> 

</span><span class="cx">     bool dumpArrayBufferView(JSObject* obj, SerializationReturnCode&amp; code)

</span><span class="cx">     {

</span><ins>+        VM&amp; vm = m_exec-&gt;vm();

</ins><span class="cx">         write(ArrayBufferViewTag);

</span><del>-        if (obj-&gt;inherits(JSDataView::info()))

</del><ins>+        if (obj-&gt;inherits(vm, JSDataView::info()))

</ins><span class="cx">             write(DataViewTag);

</span><del>-        else if (obj-&gt;inherits(JSUint8ClampedArray::info()))

</del><ins>+        else if (obj-&gt;inherits(vm, JSUint8ClampedArray::info()))

</ins><span class="cx">             write(Uint8ClampedArrayTag);

</span><del>-        else if (obj-&gt;inherits(JSInt8Array::info()))

</del><ins>+        else if (obj-&gt;inherits(vm, JSInt8Array::info()))

</ins><span class="cx">             write(Int8ArrayTag);

</span><del>-        else if (obj-&gt;inherits(JSUint8Array::info()))

</del><ins>+        else if (obj-&gt;inherits(vm, JSUint8Array::info()))

</ins><span class="cx">             write(Uint8ArrayTag);

</span><del>-        else if (obj-&gt;inherits(JSInt16Array::info()))

</del><ins>+        else if (obj-&gt;inherits(vm, JSInt16Array::info()))

</ins><span class="cx">             write(Int16ArrayTag);

</span><del>-        else if (obj-&gt;inherits(JSUint16Array::info()))

</del><ins>+        else if (obj-&gt;inherits(vm, JSUint16Array::info()))

</ins><span class="cx">             write(Uint16ArrayTag);

</span><del>-        else if (obj-&gt;inherits(JSInt32Array::info()))

</del><ins>+        else if (obj-&gt;inherits(vm, JSInt32Array::info()))

</ins><span class="cx">             write(Int32ArrayTag);

</span><del>-        else if (obj-&gt;inherits(JSUint32Array::info()))

</del><ins>+        else if (obj-&gt;inherits(vm, JSUint32Array::info()))

</ins><span class="cx">             write(Uint32ArrayTag);

</span><del>-        else if (obj-&gt;inherits(JSFloat32Array::info()))

</del><ins>+        else if (obj-&gt;inherits(vm, JSFloat32Array::info()))

</ins><span class="cx">             write(Float32ArrayTag);

</span><del>-        else if (obj-&gt;inherits(JSFloat64Array::info()))

</del><ins>+        else if (obj-&gt;inherits(vm, JSFloat64Array::info()))

</ins><span class="cx">             write(Float64ArrayTag);

</span><span class="cx">         else

</span><span class="cx">             return false;

</span><span class="cx"> 

</span><del>-        RefPtr&lt;ArrayBufferView&gt; arrayBufferView = toPossiblySharedArrayBufferView(obj);

</del><ins>+        RefPtr&lt;ArrayBufferView&gt; arrayBufferView = toPossiblySharedArrayBufferView(vm, obj);

</ins><span class="cx">         write(static_cast&lt;uint32_t&gt;(arrayBufferView-&gt;byteOffset()));

</span><span class="cx">         write(static_cast&lt;uint32_t&gt;(arrayBufferView-&gt;byteLength()));

</span><span class="cx">         RefPtr&lt;ArrayBuffer&gt; arrayBuffer = arrayBufferView-&gt;possiblySharedBuffer();

</span><span class="lines">@@ -759,24 +760,25 @@

</span><span class="cx">             return true;

</span><span class="cx">         }

</span><span class="cx"> 

</span><del>-        if (value.isObject() &amp;&amp; asObject(value)-&gt;inherits(DateInstance::info())) {

</del><ins>+        VM&amp; vm = m_exec-&gt;vm();

+        if (value.isObject() &amp;&amp; asObject(value)-&gt;inherits(vm, DateInstance::info())) {

</ins><span class="cx">             write(DateTag);

</span><span class="cx">             write(asDateInstance(value)-&gt;internalNumber());

</span><span class="cx">             return true;

</span><span class="cx">         }

</span><span class="cx"> 

</span><del>-        if (isArray(value))

</del><ins>+        if (isArray(vm, value))

</ins><span class="cx">             return false;

</span><span class="cx"> 

</span><span class="cx">         if (value.isObject()) {

</span><span class="cx">             JSObject* obj = asObject(value);

</span><del>-            if (obj-&gt;inherits(BooleanObject::info())) {

</del><ins>+            if (obj-&gt;inherits(vm, BooleanObject::info())) {

</ins><span class="cx">                 if (!startObjectInternal(obj)) // handle duplicates

</span><span class="cx">                     return true;

</span><span class="cx">                 write(asBooleanObject(value)-&gt;internalValue().toBoolean(m_exec) ? TrueObjectTag : FalseObjectTag);

</span><span class="cx">                 return true;

</span><span class="cx">             }

</span><del>-            if (obj-&gt;inherits(StringObject::info())) {

</del><ins>+            if (obj-&gt;inherits(vm, StringObject::info())) {

</ins><span class="cx">                 if (!startObjectInternal(obj)) // handle duplicates

</span><span class="cx">                     return true;

</span><span class="cx">                 String str = asString(asStringObject(value)-&gt;internalValue())-&gt;value(m_exec);

</span><span class="lines">@@ -783,7 +785,7 @@

</span><span class="cx">                 dumpStringObject(str);

</span><span class="cx">                 return true;

</span><span class="cx">             }

</span><del>-            if (obj-&gt;inherits(NumberObject::info())) {

</del><ins>+            if (obj-&gt;inherits(vm, NumberObject::info())) {

</ins><span class="cx">                 if (!startObjectInternal(obj)) // handle duplicates

</span><span class="cx">                     return true;

</span><span class="cx">                 write(NumberObjectTag);

</span><span class="lines">@@ -791,12 +793,12 @@

</span><span class="cx">                 write(obj-&gt;internalValue().asNumber());

</span><span class="cx">                 return true;

</span><span class="cx">             }

</span><del>-            if (File* file = JSFile::toWrapped(obj)) {

</del><ins>+            if (File* file = JSFile::toWrapped(vm, obj)) {

</ins><span class="cx">                 write(FileTag);

</span><span class="cx">                 write(file);

</span><span class="cx">                 return true;

</span><span class="cx">             }

</span><del>-            if (FileList* list = JSFileList::toWrapped(obj)) {

</del><ins>+            if (FileList* list = JSFileList::toWrapped(vm, obj)) {

</ins><span class="cx">                 write(FileListTag);

</span><span class="cx">                 unsigned length = list-&gt;length();

</span><span class="cx">                 write(length);

</span><span class="lines">@@ -804,7 +806,7 @@

</span><span class="cx">                     write(list-&gt;item(i));

</span><span class="cx">                 return true;

</span><span class="cx">             }

</span><del>-            if (Blob* blob = JSBlob::toWrapped(obj)) {

</del><ins>+            if (Blob* blob = JSBlob::toWrapped(vm, obj)) {

</ins><span class="cx">                 write(BlobTag);

</span><span class="cx">                 m_blobURLs.append(blob-&gt;url());

</span><span class="cx">                 write(blob-&gt;url());

</span><span class="lines">@@ -812,7 +814,7 @@

</span><span class="cx">                 write(blob-&gt;size());

</span><span class="cx">                 return true;

</span><span class="cx">             }

</span><del>-            if (ImageData* data = JSImageData::toWrapped(obj)) {

</del><ins>+            if (ImageData* data = JSImageData::toWrapped(vm, obj)) {

</ins><span class="cx">                 write(ImageDataTag);

</span><span class="cx">                 write(data-&gt;width());

</span><span class="cx">                 write(data-&gt;height());

</span><span class="lines">@@ -820,7 +822,7 @@

</span><span class="cx">                 write(data-&gt;data()-&gt;data(), data-&gt;data()-&gt;length());

</span><span class="cx">                 return true;

</span><span class="cx">             }

</span><del>-            if (obj-&gt;inherits(RegExpObject::info())) {

</del><ins>+            if (obj-&gt;inherits(vm, RegExpObject::info())) {

</ins><span class="cx">                 RegExpObject* regExp = asRegExpObject(obj);

</span><span class="cx">                 char flags[3];

</span><span class="cx">                 int flagCount = 0;

</span><span class="lines">@@ -835,7 +837,7 @@

</span><span class="cx">                 write(String(flags, flagCount));

</span><span class="cx">                 return true;

</span><span class="cx">             }

</span><del>-            if (obj-&gt;inherits(JSMessagePort::info())) {

</del><ins>+            if (obj-&gt;inherits(vm, JSMessagePort::info())) {

</ins><span class="cx">                 ObjectPool::iterator index = m_transferredMessagePorts.find(obj);

</span><span class="cx">                 if (index != m_transferredMessagePorts.end()) {

</span><span class="cx">                     write(MessagePortReferenceTag);

</span><span class="lines">@@ -846,7 +848,7 @@

</span><span class="cx">                 code = SerializationReturnCode::ValidationError;

</span><span class="cx">                 return true;

</span><span class="cx">             }

</span><del>-            if (ArrayBuffer* arrayBuffer = toPossiblySharedArrayBuffer(obj)) {

</del><ins>+            if (ArrayBuffer* arrayBuffer = toPossiblySharedArrayBuffer(vm, obj)) {

</ins><span class="cx">                 if (arrayBuffer-&gt;isNeutered()) {

</span><span class="cx">                     code = SerializationReturnCode::ValidationError;

</span><span class="cx">                     return true;

</span><span class="lines">@@ -864,7 +866,7 @@

</span><span class="cx">                 write(static_cast&lt;const uint8_t*&gt;(arrayBuffer-&gt;data()), arrayBuffer-&gt;byteLength());

</span><span class="cx">                 return true;

</span><span class="cx">             }

</span><del>-            if (obj-&gt;inherits(JSArrayBufferView::info())) {

</del><ins>+            if (obj-&gt;inherits(vm, JSArrayBufferView::info())) {

</ins><span class="cx">                 if (checkForDuplicate(obj))

</span><span class="cx">                     return true;

</span><span class="cx">                 bool success = dumpArrayBufferView(obj, code);

</span><span class="lines">@@ -872,7 +874,7 @@

</span><span class="cx">                 return success;

</span><span class="cx">             }

</span><span class="cx"> #if ENABLE(SUBTLE_CRYPTO)

</span><del>-            if (CryptoKey* key = JSCryptoKey::toWrapped(obj)) {

</del><ins>+            if (CryptoKey* key = JSCryptoKey::toWrapped(vm, obj)) {

</ins><span class="cx">                 write(CryptoKeyTag);

</span><span class="cx">                 Vector&lt;uint8_t&gt; serializedKey;

</span><span class="cx">                 Vector&lt;String&gt; dummyBlobURLs;

</span><span class="lines">@@ -1220,6 +1222,7 @@

</span><span class="cx"> 

</span><span class="cx"> SerializationReturnCode CloneSerializer::serialize(JSValue in)

</span><span class="cx"> {

</span><ins>+    VM&amp; vm = m_exec-&gt;vm();

</ins><span class="cx">     Vector&lt;uint32_t, 16&gt; indexStack;

</span><span class="cx">     Vector&lt;uint32_t, 16&gt; lengthStack;

</span><span class="cx">     Vector&lt;PropertyNameArray, 16&gt; propertyStack;

</span><span class="lines">@@ -1234,7 +1237,7 @@

</span><span class="cx">         switch (state) {

</span><span class="cx">             arrayStartState:

</span><span class="cx">             case ArrayStartState: {

</span><del>-                ASSERT(isArray(inValue));

</del><ins>+                ASSERT(isArray(vm, inValue));

</ins><span class="cx">                 if (inputObjectStack.size() &gt; maximumFilterRecursion)

</span><span class="cx">                     return SerializationReturnCode::StackOverflowError;

</span><span class="cx"> 

</span><span class="lines">@@ -1301,7 +1304,7 @@

</span><span class="cx">                 // objects have been handled. If we reach this point and

</span><span class="cx">                 // the input is not an Object object then we should throw

<span class="cx">                 // a DataCloneError.

</span><del>-                if (inObject-&gt;classInfo() != JSFinalObject::info())

</del><ins>+                if (inObject-&gt;classInfo(vm) != JSFinalObject::info())

</ins><span class="cx">                     return SerializationReturnCode::DataCloneError;

</span><span class="cx">                 inputObjectStack.append(inObject);

</span><span class="cx">                 indexStack.append(0);

</span><span class="lines">@@ -1358,7 +1361,7 @@

</span><span class="cx">                 JSMap* inMap = jsCast&lt;JSMap*&gt;(inValue);

</span><span class="cx">                 if (!startMap(inMap))

</span><span class="cx">                     break;

</span><del>-                JSMapIterator* iterator = JSMapIterator::create(m_exec-&gt;vm(), m_exec-&gt;lexicalGlobalObject()-&gt;mapIteratorStructure(), inMap, IterateKeyValue);

</del><ins>+                JSMapIterator* iterator = JSMapIterator::create(vm, m_exec-&gt;lexicalGlobalObject()-&gt;mapIteratorStructure(), inMap, IterateKeyValue);

</ins><span class="cx">                 m_gcBuffer.append(inMap);

</span><span class="cx">                 m_gcBuffer.append(iterator);

</span><span class="cx">                 mapIteratorStack.append(iterator);

</span><span class="lines">@@ -1372,7 +1375,7 @@

</span><span class="cx">                 if (!iterator-&gt;nextKeyValue(m_exec, key, value)) {

</span><span class="cx">                     mapIteratorStack.removeLast();

</span><span class="cx">                     JSObject* object = inputObjectStack.last();

</span><del>-                    ASSERT(jsDynamicDowncast&lt;JSMap*&gt;(object));

</del><ins>+                    ASSERT(jsDynamicDowncast&lt;JSMap*&gt;(vm, object));

</ins><span class="cx">                     propertyStack.append(PropertyNameArray(m_exec, PropertyNameMode::Strings));

</span><span class="cx">                     object-&gt;methodTable()-&gt;getOwnPropertyNames(object, m_exec, propertyStack.last(), EnumerationMode());

</span><span class="cx">                     write(NonMapPropertiesTag);

</span><span class="lines">@@ -1402,7 +1405,7 @@

</span><span class="cx">                 JSSet* inSet = jsCast&lt;JSSet*&gt;(inValue);

</span><span class="cx">                 if (!startSet(inSet))

</span><span class="cx">                     break;

</span><del>-                JSSetIterator* iterator = JSSetIterator::create(m_exec-&gt;vm(), m_exec-&gt;lexicalGlobalObject()-&gt;setIteratorStructure(), inSet, IterateKey);

</del><ins>+                JSSetIterator* iterator = JSSetIterator::create(vm, m_exec-&gt;lexicalGlobalObject()-&gt;setIteratorStructure(), inSet, IterateKey);

</ins><span class="cx">                 m_gcBuffer.append(inSet);

</span><span class="cx">                 m_gcBuffer.append(iterator);

</span><span class="cx">                 setIteratorStack.append(iterator);

</span><span class="lines">@@ -1416,7 +1419,7 @@

</span><span class="cx">                 if (!iterator-&gt;next(m_exec, key)) {

</span><span class="cx">                     setIteratorStack.removeLast();

</span><span class="cx">                     JSObject* object = inputObjectStack.last();

</span><del>-                    ASSERT(jsDynamicDowncast&lt;JSSet*&gt;(object));

</del><ins>+                    ASSERT(jsDynamicDowncast&lt;JSSet*&gt;(vm, object));

</ins><span class="cx">                     propertyStack.append(PropertyNameArray(m_exec, PropertyNameMode::Strings));

</span><span class="cx">                     object-&gt;methodTable()-&gt;getOwnPropertyNames(object, m_exec, propertyStack.last(), EnumerationMode());

</span><span class="cx">                     write(NonSetPropertiesTag);

</span><span class="lines">@@ -1440,11 +1443,11 @@

</span><span class="cx">                     break;

</span><span class="cx">                 }

</span><span class="cx"> 

</span><del>-                if (isArray(inValue))

</del><ins>+                if (isArray(vm, inValue))

</ins><span class="cx">                     goto arrayStartState;

</span><del>-                if (isMap(inValue))

</del><ins>+                if (isMap(vm, inValue))

</ins><span class="cx">                     goto mapStartState;

</span><del>-                if (isSet(inValue))

</del><ins>+                if (isSet(vm, inValue))

</ins><span class="cx">                     goto setStartState;

</span><span class="cx">                 goto objectStartState;

</span><span class="cx">             }

</span><span class="lines">@@ -1538,7 +1541,7 @@

</span><span class="cx">     CloneDeserializer(ExecState* exec, JSGlobalObject* globalObject, Vector&lt;RefPtr&lt;MessagePort&gt;&gt;&amp; messagePorts, ArrayBufferContentsArray* arrayBufferContents, const Vector&lt;uint8_t&gt;&amp; buffer)

</span><span class="cx">         : CloneBase(exec)

</span><span class="cx">         , m_globalObject(globalObject)

</span><del>-        , m_isDOMGlobalObject(globalObject-&gt;inherits(JSDOMGlobalObject::info()))

</del><ins>+        , m_isDOMGlobalObject(globalObject-&gt;inherits(globalObject-&gt;vm(), JSDOMGlobalObject::info()))

</ins><span class="cx">         , m_ptr(buffer.data())

</span><span class="cx">         , m_end(buffer.data() + buffer.size())

</span><span class="cx">         , m_version(0xFFFFFFFF)

</span><span class="lines">@@ -1553,7 +1556,7 @@

</span><span class="cx">     CloneDeserializer(ExecState* exec, JSGlobalObject* globalObject, Vector&lt;RefPtr&lt;MessagePort&gt;&gt;&amp; messagePorts, ArrayBufferContentsArray* arrayBufferContents, const Vector&lt;uint8_t&gt;&amp; buffer, const Vector&lt;String&gt;&amp; blobURLs, const Vector&lt;String&gt; blobFilePaths)

</span><span class="cx">         : CloneBase(exec)

</span><span class="cx">         , m_globalObject(globalObject)

</span><del>-        , m_isDOMGlobalObject(globalObject-&gt;inherits(JSDOMGlobalObject::info()))

</del><ins>+        , m_isDOMGlobalObject(globalObject-&gt;inherits(globalObject-&gt;vm(), JSDOMGlobalObject::info()))

</ins><span class="cx">         , m_ptr(buffer.data())

</span><span class="cx">         , m_end(buffer.data() + buffer.size())

</span><span class="cx">         , m_version(0xFFFFFFFF)

</span><span class="lines">@@ -1808,7 +1811,7 @@

</span><span class="cx">         return true;

</span><span class="cx">     }

</span><span class="cx"> 

</span><del>-    bool readArrayBufferView(JSValue&amp; arrayBufferView)

</del><ins>+    bool readArrayBufferView(VM&amp; vm, JSValue&amp; arrayBufferView)

</ins><span class="cx">     {

</span><span class="cx">         ArrayBufferViewSubtag arrayBufferViewSubtag;

</span><span class="cx">         if (!readArrayBufferViewSubtag(arrayBufferViewSubtag))

</span><span class="lines">@@ -1820,7 +1823,7 @@

</span><span class="cx">         if (!read(byteLength))

</span><span class="cx">             return false;

</span><span class="cx">         JSObject* arrayBufferObj = asObject(readTerminal());

</span><del>-        if (!arrayBufferObj || !arrayBufferObj-&gt;inherits(JSArrayBuffer::info()))

</del><ins>+        if (!arrayBufferObj || !arrayBufferObj-&gt;inherits(vm, JSArrayBuffer::info()))

</ins><span class="cx">             return false;

</span><span class="cx"> 

</span><span class="cx">         unsigned elementSize = typedArrayElementSize(arrayBufferViewSubtag);

</span><span class="lines">@@ -1830,7 +1833,7 @@

</span><span class="cx">         if (length * elementSize != byteLength)

</span><span class="cx">             return false;

</span><span class="cx"> 

</span><del>-        RefPtr&lt;ArrayBuffer&gt; arrayBuffer = toPossiblySharedArrayBuffer(arrayBufferObj);

</del><ins>+        RefPtr&lt;ArrayBuffer&gt; arrayBuffer = toPossiblySharedArrayBuffer(vm, arrayBufferObj);

</ins><span class="cx">         switch (arrayBufferViewSubtag) {

</span><span class="cx">         case DataViewTag:

</span><span class="cx">             arrayBufferView = getJSValue(DataView::create(arrayBuffer, byteOffset, length).get());

</span><span class="lines">@@ -2386,7 +2389,7 @@

</span><span class="cx">         }

</span><span class="cx">         case ArrayBufferViewTag: {

</span><span class="cx">             JSValue arrayBufferView;

</span><del>-            if (!readArrayBufferView(arrayBufferView)) {

</del><ins>+            if (!readArrayBufferView(m_exec-&gt;vm(), arrayBufferView)) {

</ins><span class="cx">                 fail();

</span><span class="cx">                 return JSValue();

</span><span class="cx">             }

</span><span class="lines">@@ -2662,7 +2665,7 @@

</span><span class="cx">         m_blobURLs.uncheckedAppend(url.isolatedCopy());

</span><span class="cx"> }

</span><span class="cx"> 

</span><del>-static ExceptionOr&lt;std::unique_ptr&lt;ArrayBufferContentsArray&gt;&gt; transferArrayBuffers(const Vector&lt;RefPtr&lt;JSC::ArrayBuffer&gt;&gt;&amp; arrayBuffers)

</del><ins>+static ExceptionOr&lt;std::unique_ptr&lt;ArrayBufferContentsArray&gt;&gt; transferArrayBuffers(VM&amp; vm, const Vector&lt;RefPtr&lt;JSC::ArrayBuffer&gt;&gt;&amp; arrayBuffers)

</ins><span class="cx"> {

</span><span class="cx">     if (arrayBuffers.isEmpty())

</span><span class="cx">         return nullptr;

</span><span class="lines">@@ -2675,7 +2678,7 @@

</span><span class="cx">             continue;

</span><span class="cx">         visited.add(arrayBuffers[arrayBufferIndex].get());

</span><span class="cx"> 

</span><del>-        bool result = arrayBuffers[arrayBufferIndex]-&gt;transferTo(contents-&gt;at(arrayBufferIndex));

</del><ins>+        bool result = arrayBuffers[arrayBufferIndex]-&gt;transferTo(vm, contents-&gt;at(arrayBufferIndex));

</ins><span class="cx">         if (!result)

</span><span class="cx">             return Exception { TypeError };

</span><span class="cx">     }

</span><span class="lines">@@ -2751,15 +2754,16 @@

</span><span class="cx"> 

</span><span class="cx"> ExceptionOr&lt;Ref&lt;SerializedScriptValue&gt;&gt; SerializedScriptValue::create(ExecState&amp; state, JSValue value, Vector&lt;JSC::Strong&lt;JSC::JSObject&gt;&gt;&amp;&amp; transferList, Vector&lt;RefPtr&lt;MessagePort&gt;&gt;&amp; messagePorts)

</span><span class="cx"> {

</span><ins>+    VM&amp; vm = state.vm();

</ins><span class="cx">     Vector&lt;RefPtr&lt;JSC::ArrayBuffer&gt;&gt; arrayBuffers;

</span><span class="cx">     for (auto&amp; transferable : transferList) {

</span><del>-        if (auto arrayBuffer = toPossiblySharedArrayBuffer(transferable.get())) {

</del><ins>+        if (auto arrayBuffer = toPossiblySharedArrayBuffer(vm, transferable.get())) {

</ins><span class="cx">             if (arrayBuffer-&gt;isNeutered())

</span><span class="cx">                 return Exception { DATA_CLONE_ERR };

</span><span class="cx">             arrayBuffers.append(WTFMove(arrayBuffer));

</span><span class="cx">             continue;

</span><span class="cx">         }

</span><del>-        if (auto port = JSMessagePort::toWrapped(transferable.get())) {

</del><ins>+        if (auto port = JSMessagePort::toWrapped(vm, transferable.get())) {

</ins><span class="cx">             // FIXME: This should check if the port is detached as per https://html.spec.whatwg.org/multipage/infrastructure.html#istransferable.

</span><span class="cx">             messagePorts.append(WTFMove(port));

</span><span class="cx">             continue;

</span><span class="lines">@@ -2775,7 +2779,7 @@

</span><span class="cx">     if (code != SerializationReturnCode::SuccessfullyCompleted)

</span><span class="cx">         return exceptionForSerializationFailure(code);

</span><span class="cx"> 

</span><del>-    auto arrayBufferContentsArray = transferArrayBuffers(arrayBuffers);

</del><ins>+    auto arrayBufferContentsArray = transferArrayBuffers(vm, arrayBuffers);

</ins><span class="cx">     if (arrayBufferContentsArray.hasException())

</span><span class="cx">         return arrayBufferContentsArray.releaseException();

</span><span class="cx"> 

</span></span></pre></div>

<a id="trunkSourceWebCorebindingsjsStructuredClonecpp"></a>

<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/js/StructuredClone.cpp (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/WebCore/bindings/js/StructuredClone.cpp        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/WebCore/bindings/js/StructuredClone.cpp        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -40,9 +40,9 @@

</span><span class="cx">     ASSERT(state-&gt;argumentCount());

</span><span class="cx">     ASSERT(state-&gt;lexicalGlobalObject());

</span><span class="cx"> 

</span><del>-    auto* buffer = toUnsharedArrayBuffer(state-&gt;uncheckedArgument(0));

</del><ins>+    VM&amp; vm = state-&gt;vm();

+    auto* buffer = toUnsharedArrayBuffer(vm, state-&gt;uncheckedArgument(0));

</ins><span class="cx">     if (!buffer) {

</span><del>-        VM&amp; vm = state-&gt;vm();

</del><span class="cx">         auto scope = DECLARE_THROW_SCOPE(vm);

</span><span class="cx">         throwDataCloneError(*state, scope);

</span><span class="cx">         return { };

</span><span class="lines">@@ -56,12 +56,12 @@

</span><span class="cx">     ASSERT(state-&gt;argumentCount());

</span><span class="cx"> 

</span><span class="cx">     JSValue value = state-&gt;uncheckedArgument(0);

</span><del>-    auto* bufferView = jsDynamicDowncast&lt;JSArrayBufferView*&gt;(value);

</del><ins>+    VM&amp; vm = state-&gt;vm();

+    auto* bufferView = jsDynamicDowncast&lt;JSArrayBufferView*&gt;(vm, value);

</ins><span class="cx">     ASSERT(bufferView);

</span><span class="cx"> 

</span><span class="cx">     auto* buffer = bufferView-&gt;unsharedBuffer();

</span><span class="cx">     if (!buffer) {

</span><del>-        VM&amp; vm = state-&gt;vm();

</del><span class="cx">         auto scope = DECLARE_THROW_SCOPE(vm);

</span><span class="cx">         throwDataCloneError(*state, scope);

</span><span class="cx">         return { };

</span><span class="lines">@@ -68,25 +68,25 @@

</span><span class="cx">     }

</span><span class="cx">     auto bufferClone = ArrayBuffer::tryCreate(buffer-&gt;data(), buffer-&gt;byteLength());

</span><span class="cx"> 

</span><del>-    if (jsDynamicDowncast&lt;JSInt8Array*&gt;(value))

</del><ins>+    if (jsDynamicDowncast&lt;JSInt8Array*&gt;(vm, value))

</ins><span class="cx">         return JSValue::encode(JSInt8Array::create(state, bufferView-&gt;structure(), WTFMove(bufferClone), bufferView-&gt;byteOffset(), bufferView-&gt;length()));

</span><del>-    if (jsDynamicDowncast&lt;JSInt16Array*&gt;(value))

</del><ins>+    if (jsDynamicDowncast&lt;JSInt16Array*&gt;(vm, value))

</ins><span class="cx">         return JSValue::encode(JSInt16Array::create(state, bufferView-&gt;structure(), WTFMove(bufferClone), bufferView-&gt;byteOffset(), bufferView-&gt;length()));

</span><del>-    if (jsDynamicDowncast&lt;JSInt32Array*&gt;(value))

</del><ins>+    if (jsDynamicDowncast&lt;JSInt32Array*&gt;(vm, value))

</ins><span class="cx">         return JSValue::encode(JSInt32Array::create(state, bufferView-&gt;structure(), WTFMove(bufferClone), bufferView-&gt;byteOffset(), bufferView-&gt;length()));

</span><del>-    if (jsDynamicDowncast&lt;JSUint8Array*&gt;(value))

</del><ins>+    if (jsDynamicDowncast&lt;JSUint8Array*&gt;(vm, value))

</ins><span class="cx">         return JSValue::encode(JSUint8Array::create(state, bufferView-&gt;structure(), WTFMove(bufferClone), bufferView-&gt;byteOffset(), bufferView-&gt;length()));

</span><del>-    if (jsDynamicDowncast&lt;JSUint8ClampedArray*&gt;(value))

</del><ins>+    if (jsDynamicDowncast&lt;JSUint8ClampedArray*&gt;(vm, value))

</ins><span class="cx">         return JSValue::encode(JSUint8ClampedArray::create(state, bufferView-&gt;structure(), WTFMove(bufferClone), bufferView-&gt;byteOffset(), bufferView-&gt;length()));

</span><del>-    if (jsDynamicDowncast&lt;JSUint16Array*&gt;(value))

</del><ins>+    if (jsDynamicDowncast&lt;JSUint16Array*&gt;(vm, value))

</ins><span class="cx">         return JSValue::encode(JSUint16Array::create(state, bufferView-&gt;structure(), WTFMove(bufferClone), bufferView-&gt;byteOffset(), bufferView-&gt;length()));

</span><del>-    if (jsDynamicDowncast&lt;JSUint32Array*&gt;(value))

</del><ins>+    if (jsDynamicDowncast&lt;JSUint32Array*&gt;(vm, value))

</ins><span class="cx">         return JSValue::encode(JSUint32Array::create(state, bufferView-&gt;structure(), WTFMove(bufferClone), bufferView-&gt;byteOffset(), bufferView-&gt;length()));

</span><del>-    if (jsDynamicDowncast&lt;JSFloat32Array*&gt;(value))

</del><ins>+    if (jsDynamicDowncast&lt;JSFloat32Array*&gt;(vm, value))

</ins><span class="cx">         return JSValue::encode(JSFloat32Array::create(state, bufferView-&gt;structure(), WTFMove(bufferClone), bufferView-&gt;byteOffset(), bufferView-&gt;length()));

</span><del>-    if (jsDynamicDowncast&lt;JSFloat64Array*&gt;(value))

</del><ins>+    if (jsDynamicDowncast&lt;JSFloat64Array*&gt;(vm, value))

</ins><span class="cx">         return JSValue::encode(JSFloat64Array::create(state, bufferView-&gt;structure(), WTFMove(bufferClone), bufferView-&gt;byteOffset(), bufferView-&gt;length()));

</span><del>-    if (jsDynamicDowncast&lt;JSDataView*&gt;(value))

</del><ins>+    if (jsDynamicDowncast&lt;JSDataView*&gt;(vm, value))

</ins><span class="cx">         return JSValue::encode(JSDataView::create(state, bufferView-&gt;structure(), WTFMove(bufferClone), bufferView-&gt;byteOffset(), bufferView-&gt;length()));

</span><span class="cx"> 

</span><span class="cx">     ASSERT_NOT_REACHED();

</span></span></pre></div>

<a id="trunkSourceWebCorebindingsjsWorkerScriptControllercpp"></a>

<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/js/WorkerScriptController.cpp (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/WebCore/bindings/js/WorkerScriptController.cpp        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/WebCore/bindings/js/WorkerScriptController.cpp        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -126,7 +126,7 @@

</span><span class="cx"> 

</span><span class="cx">     JSC::evaluate(exec, sourceCode.jsSourceCode(), m_workerGlobalScopeWrapper-&gt;globalThis(), returnedException);

</span><span class="cx"> 

</span><del>-    if ((returnedException &amp;&amp; isTerminatedExecutionException(returnedException)) || isTerminatingExecution()) {

</del><ins>+    if ((returnedException &amp;&amp; isTerminatedExecutionException(vm, returnedException)) || isTerminatingExecution()) {

</ins><span class="cx">         forbidExecution();

</span><span class="cx">         return;

</span><span class="cx">     }

</span></span></pre></div>

<a id="trunkSourceWebCorebindingsscriptsCodeGeneratorJSpm"></a>

<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/scripts/CodeGeneratorJS.pm (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/WebCore/bindings/scripts/CodeGeneratorJS.pm        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/WebCore/bindings/scripts/CodeGeneratorJS.pm        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -1802,6 +1802,7 @@

</span><span class="cx"> 

<span class="cx">         # FIXME: Add extended attribute for this.

</span><span class="cx">         my @toWrappedArguments = ();

</span><ins>+        push(@toWrappedArguments, &quot;JSC::VM&amp;&quot;);

</ins><span class="cx">         push(@toWrappedArguments, &quot;JSC::ExecState&amp;&quot;) if $interface-&gt;type-&gt;name eq &quot;XPathNSResolver&quot;;

</span><span class="cx">         push(@toWrappedArguments, &quot;JSC::JSValue&quot;);

</span><span class="cx"> 

</span><span class="lines">@@ -2669,9 +2670,9 @@

</span><span class="cx">                     if ($codeGenerator-&gt;IsWrapperType($subtype) || $codeGenerator-&gt;IsTypedArrayType($subtype)) {

</span><span class="cx">                         if ($subtype-&gt;name eq &quot;DOMWindow&quot;) {

</span><span class="cx">                             AddToImplIncludes(&quot;JSDOMWindowShell.h&quot;);

</span><del>-                            &amp;$generateOverloadCallIfNecessary($overload, &quot;distinguishingArg.isObject() &amp;&amp; (asObject(distinguishingArg)-&gt;inherits(JSDOMWindowShell::info()) || asObject(distinguishingArg)-&gt;inherits(JSDOMWindow::info()))&quot;);

</del><ins>+                            &amp;$generateOverloadCallIfNecessary($overload, &quot;distinguishingArg.isObject() &amp;&amp; (asObject(distinguishingArg)-&gt;inherits(vm, JSDOMWindowShell::info()) || asObject(distinguishingArg)-&gt;inherits(vm, JSDOMWindow::info()))&quot;);

</ins><span class="cx">                         } else {

</span><del>-                            &amp;$generateOverloadCallIfNecessary($overload, &quot;distinguishingArg.isObject() &amp;&amp; asObject(distinguishingArg)-&gt;inherits(JS&quot; . $subtype-&gt;name . &quot;::info())&quot;);

</del><ins>+                            &amp;$generateOverloadCallIfNecessary($overload, &quot;distinguishingArg.isObject() &amp;&amp; asObject(distinguishingArg)-&gt;inherits(vm, JS&quot; . $subtype-&gt;name . &quot;::info())&quot;);

</ins><span class="cx">                         }

</span><span class="cx">                     }

</span><span class="cx">                 }

</span><span class="lines">@@ -2681,7 +2682,7 @@

</span><span class="cx">             &amp;$generateOverloadCallIfNecessary($overload, &quot;distinguishingArg.isObject() &amp;&amp; asObject(distinguishingArg)-&gt;type() == RegExpObjectType&quot;);

</span><span class="cx"> 

</span><span class="cx">             $overload = GetOverloadThatMatches($S, $d, \&amp;$isObjectOrErrorOrDOMExceptionParameter);

</span><del>-            &amp;$generateOverloadCallIfNecessary($overload, &quot;distinguishingArg.isObject() &amp;&amp; asObject(distinguishingArg)-&gt;inherits(JSDOMCoreException::info())&quot;);

</del><ins>+            &amp;$generateOverloadCallIfNecessary($overload, &quot;distinguishingArg.isObject() &amp;&amp; asObject(distinguishingArg)-&gt;inherits(vm, JSDOMCoreException::info())&quot;);

</ins><span class="cx"> 

</span><span class="cx">             $overload = GetOverloadThatMatches($S, $d, \&amp;$isObjectOrErrorParameter);

</span><span class="cx">             &amp;$generateOverloadCallIfNecessary($overload, &quot;distinguishingArg.isObject() &amp;&amp; asObject(distinguishingArg)-&gt;type() == ErrorInstanceType&quot;);

</span><span class="lines">@@ -3415,7 +3416,7 @@

</span><span class="cx">         push(@implContent, &quot;void ${className}::finishCreation(VM&amp; vm)\n&quot;);

</span><span class="cx">         push(@implContent, &quot;{\n&quot;);

</span><span class="cx">         push(@implContent, &quot;    Base::finishCreation(vm);\n&quot;);

</span><del>-        push(@implContent, &quot;    ASSERT(inherits(info()));\n\n&quot;);

</del><ins>+        push(@implContent, &quot;    ASSERT(inherits(vm, info()));\n\n&quot;);

</ins><span class="cx">     }

</span><span class="cx"> 

<span class="cx">     # Support for RuntimeEnabled attributes on instances.

</span><span class="lines">@@ -3548,12 +3549,12 @@

</span><span class="cx">             push(@implContent, &quot;    auto decodedThisValue = JSValue::decode(thisValue);\n&quot;);

</span><span class="cx">             push(@implContent, &quot;    if (decodedThisValue.isUndefinedOrNull())\n&quot;);

</span><span class="cx">             push(@implContent, &quot;        decodedThisValue = state.thisValue().toThis(&amp;state, NotStrictMode);\n&quot;);

</span><del>-            push(@implContent, &quot;    return $castingFunction(decodedThisValue);&quot;);

</del><ins>+            push(@implContent, &quot;    return $castingFunction(state.vm(), decodedThisValue);&quot;);

</ins><span class="cx">             push(@implContent, &quot;}\n\n&quot;);

</span><span class="cx">         } else {

</span><del>-            push(@implContent, &quot;template&lt;&gt; inline ${className}* BindingCaller&lt;${className}&gt;::castForAttribute(ExecState&amp;, EncodedJSValue thisValue)\n&quot;);

</del><ins>+            push(@implContent, &quot;template&lt;&gt; inline ${className}* BindingCaller&lt;${className}&gt;::castForAttribute(ExecState&amp; state, EncodedJSValue thisValue)\n&quot;);

</ins><span class="cx">             push(@implContent, &quot;{\n&quot;);

</span><del>-            push(@implContent, &quot;    return $castingFunction(JSValue::decode(thisValue));\n&quot;);

</del><ins>+            push(@implContent, &quot;    return $castingFunction(state.vm(), JSValue::decode(thisValue));\n&quot;);

</ins><span class="cx">             push(@implContent, &quot;}\n\n&quot;);

</span><span class="cx">         }

</span><span class="cx">     }

</span><span class="lines">@@ -3564,7 +3565,7 @@

</span><span class="cx">         my $thisValue = $interface-&gt;extendedAttributes-&gt;{&quot;CustomProxyToJSObject&quot;} ? &quot;state.thisValue().toThis(&amp;state, NotStrictMode)&quot; : &quot;state.thisValue()&quot;;

</span><span class="cx">         push(@implContent, &quot;template&lt;&gt; inline ${className}* BindingCaller&lt;${className}&gt;::castForOperation(ExecState&amp; state)\n&quot;);

</span><span class="cx">         push(@implContent, &quot;{\n&quot;);

</span><del>-        push(@implContent, &quot;    return $castingFunction($thisValue);\n&quot;);

</del><ins>+        push(@implContent, &quot;    return $castingFunction(state.vm(), $thisValue);\n&quot;);

</ins><span class="cx">         push(@implContent, &quot;}\n\n&quot;);

</span><span class="cx">     }

</span><span class="cx"> 

</span><span class="lines">@@ -3725,7 +3726,7 @@

</span><span class="cx">             push(@implContent, &quot;{\n&quot;);

</span><span class="cx">             push(@implContent, &quot;    VM&amp; vm = state-&gt;vm();\n&quot;);

</span><span class="cx">             push(@implContent, &quot;    auto throwScope = DECLARE_THROW_SCOPE(vm);\n&quot;);

</span><del>-            push(@implContent, &quot;    ${className}Prototype* domObject = jsDynamicDowncast&lt;${className}Prototype*&gt;(JSValue::decode(thisValue));\n&quot;);

</del><ins>+            push(@implContent, &quot;    ${className}Prototype* domObject = jsDynamicDowncast&lt;${className}Prototype*&gt;(vm, JSValue::decode(thisValue));\n&quot;);

</ins><span class="cx">             push(@implContent, &quot;    if (UNLIKELY(!domObject))\n&quot;);

</span><span class="cx">             push(@implContent, &quot;        return throwVMTypeError(state, throwScope);\n&quot;);

</span><span class="cx"> 

</span><span class="lines">@@ -3747,7 +3748,7 @@

</span><span class="cx">         push(@implContent, &quot;    VM&amp; vm = state-&gt;vm();\n&quot;);

</span><span class="cx">         push(@implContent, &quot;    auto throwScope = DECLARE_THROW_SCOPE(vm);\n&quot;);

</span><span class="cx">         push(@implContent, &quot;    JSValue value = JSValue::decode(encodedValue);\n&quot;);

</span><del>-        push(@implContent, &quot;    ${className}Prototype* domObject = jsDynamicDowncast&lt;${className}Prototype*&gt;(JSValue::decode(thisValue));\n&quot;);

</del><ins>+        push(@implContent, &quot;    ${className}Prototype* domObject = jsDynamicDowncast&lt;${className}Prototype*&gt;(vm, JSValue::decode(thisValue));\n&quot;);

</ins><span class="cx">         push(@implContent, &quot;    if (UNLIKELY(!domObject)) {\n&quot;);

</span><span class="cx">         push(@implContent, &quot;        throwVMTypeError(state, throwScope);\n&quot;);

</span><span class="cx">         push(@implContent, &quot;        return false;\n&quot;);

</span><span class="lines">@@ -4363,9 +4364,9 @@

</span><span class="cx">     }

</span><span class="cx"> 

</span><span class="cx">     if (ShouldGenerateToWrapped($hasParent, $interface) and !$interface-&gt;extendedAttributes-&gt;{JSCustomToNativeObject}) {

</span><del>-        push(@implContent, &quot;$implType* ${className}::toWrapped(JSC::JSValue value)\n&quot;);

</del><ins>+        push(@implContent, &quot;$implType* ${className}::toWrapped(JSC::VM&amp; vm, JSC::JSValue value)\n&quot;);

</ins><span class="cx">         push(@implContent, &quot;{\n&quot;);

</span><del>-        push(@implContent, &quot;    if (auto* wrapper = &quot; . GetCastingHelperForThisObject($interface) . &quot;(value))\n&quot;);

</del><ins>+        push(@implContent, &quot;    if (auto* wrapper = &quot; . GetCastingHelperForThisObject($interface) . &quot;(vm, value))\n&quot;);

</ins><span class="cx">         push(@implContent, &quot;        return &amp;wrapper-&gt;wrapped();\n&quot;);

</span><span class="cx">         push(@implContent, &quot;    return nullptr;\n&quot;);

</span><span class="cx">         push(@implContent, &quot;}\n&quot;);

</span></span></pre></div>

<a id="trunkSourceWebCorebindingsscriptstestJSJSInterfaceNamecpp"></a>

<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/scripts/test/JS/JSInterfaceName.cpp (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/WebCore/bindings/scripts/test/JS/JSInterfaceName.cpp        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/WebCore/bindings/scripts/test/JS/JSInterfaceName.cpp        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -102,7 +102,7 @@

</span><span class="cx"> void JSInterfaceName::finishCreation(VM&amp; vm)

</span><span class="cx"> {

</span><span class="cx">     Base::finishCreation(vm);

</span><del>-    ASSERT(inherits(info()));

</del><ins>+    ASSERT(inherits(vm, info()));

</ins><span class="cx"> 

</span><span class="cx"> }

</span><span class="cx"> 

</span><span class="lines">@@ -126,7 +126,7 @@

</span><span class="cx"> {

</span><span class="cx">     VM&amp; vm = state-&gt;vm();

</span><span class="cx">     auto throwScope = DECLARE_THROW_SCOPE(vm);

</span><del>-    JSInterfaceNamePrototype* domObject = jsDynamicDowncast&lt;JSInterfaceNamePrototype*&gt;(JSValue::decode(thisValue));

</del><ins>+    JSInterfaceNamePrototype* domObject = jsDynamicDowncast&lt;JSInterfaceNamePrototype*&gt;(vm, JSValue::decode(thisValue));

</ins><span class="cx">     if (UNLIKELY(!domObject))

</span><span class="cx">         return throwVMTypeError(state, throwScope);

</span><span class="cx">     return JSValue::encode(JSInterfaceName::getConstructor(state-&gt;vm(), domObject-&gt;globalObject()));

</span><span class="lines">@@ -137,7 +137,7 @@

</span><span class="cx">     VM&amp; vm = state-&gt;vm();

</span><span class="cx">     auto throwScope = DECLARE_THROW_SCOPE(vm);

</span><span class="cx">     JSValue value = JSValue::decode(encodedValue);

</span><del>-    JSInterfaceNamePrototype* domObject = jsDynamicDowncast&lt;JSInterfaceNamePrototype*&gt;(JSValue::decode(thisValue));

</del><ins>+    JSInterfaceNamePrototype* domObject = jsDynamicDowncast&lt;JSInterfaceNamePrototype*&gt;(vm, JSValue::decode(thisValue));

</ins><span class="cx">     if (UNLIKELY(!domObject)) {

</span><span class="cx">         throwVMTypeError(state, throwScope);

</span><span class="cx">         return false;

</span><span class="lines">@@ -218,9 +218,9 @@

</span><span class="cx">     return wrap(state, globalObject, impl);

</span><span class="cx"> }

</span><span class="cx"> 

</span><del>-InterfaceName* JSInterfaceName::toWrapped(JSC::JSValue value)

</del><ins>+InterfaceName* JSInterfaceName::toWrapped(JSC::VM&amp; vm, JSC::JSValue value)

</ins><span class="cx"> {

</span><del>-    if (auto* wrapper = jsDynamicDowncast&lt;JSInterfaceName*&gt;(value))

</del><ins>+    if (auto* wrapper = jsDynamicDowncast&lt;JSInterfaceName*&gt;(vm, value))

</ins><span class="cx">         return &amp;wrapper-&gt;wrapped();

</span><span class="cx">     return nullptr;

</span><span class="cx"> }

</span></span></pre></div>

<a id="trunkSourceWebCorebindingsscriptstestJSJSInterfaceNameh"></a>

<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/scripts/test/JS/JSInterfaceName.h (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/WebCore/bindings/scripts/test/JS/JSInterfaceName.h        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/WebCore/bindings/scripts/test/JS/JSInterfaceName.h        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -38,7 +38,7 @@

</span><span class="cx"> 

</span><span class="cx">     static JSC::JSObject* createPrototype(JSC::VM&amp;, JSC::JSGlobalObject*);

</span><span class="cx">     static JSC::JSObject* prototype(JSC::VM&amp;, JSC::JSGlobalObject*);

</span><del>-    static InterfaceName* toWrapped(JSC::JSValue);

</del><ins>+    static InterfaceName* toWrapped(JSC::VM&amp;, JSC::JSValue);

</ins><span class="cx">     static void destroy(JSC::JSCell*);

</span><span class="cx"> 

</span><span class="cx">     DECLARE_INFO;

</span></span></pre></div>

<a id="trunkSourceWebCorebindingsscriptstestJSJSTestActiveDOMObjectcpp"></a>

<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/scripts/test/JS/JSTestActiveDOMObject.cpp (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/WebCore/bindings/scripts/test/JS/JSTestActiveDOMObject.cpp        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/WebCore/bindings/scripts/test/JS/JSTestActiveDOMObject.cpp        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -127,7 +127,7 @@

</span><span class="cx"> void JSTestActiveDOMObject::finishCreation(VM&amp; vm)

</span><span class="cx"> {

</span><span class="cx">     Base::finishCreation(vm);

</span><del>-    ASSERT(inherits(info()));

</del><ins>+    ASSERT(inherits(vm, info()));

</ins><span class="cx"> 

</span><span class="cx"> }

</span><span class="cx"> 

</span><span class="lines">@@ -147,14 +147,14 @@

</span><span class="cx">     thisObject-&gt;JSTestActiveDOMObject::~JSTestActiveDOMObject();

</span><span class="cx"> }

</span><span class="cx"> 

</span><del>-template&lt;&gt; inline JSTestActiveDOMObject* BindingCaller&lt;JSTestActiveDOMObject&gt;::castForAttribute(ExecState&amp;, EncodedJSValue thisValue)

</del><ins>+template&lt;&gt; inline JSTestActiveDOMObject* BindingCaller&lt;JSTestActiveDOMObject&gt;::castForAttribute(ExecState&amp; state, EncodedJSValue thisValue)

</ins><span class="cx"> {

</span><del>-    return jsDynamicDowncast&lt;JSTestActiveDOMObject*&gt;(JSValue::decode(thisValue));

</del><ins>+    return jsDynamicDowncast&lt;JSTestActiveDOMObject*&gt;(state.vm(), JSValue::decode(thisValue));

</ins><span class="cx"> }

</span><span class="cx"> 

</span><span class="cx"> template&lt;&gt; inline JSTestActiveDOMObject* BindingCaller&lt;JSTestActiveDOMObject&gt;::castForOperation(ExecState&amp; state)

</span><span class="cx"> {

</span><del>-    return jsDynamicDowncast&lt;JSTestActiveDOMObject*&gt;(state.thisValue());

</del><ins>+    return jsDynamicDowncast&lt;JSTestActiveDOMObject*&gt;(state.vm(), state.thisValue());

</ins><span class="cx"> }

</span><span class="cx"> 

</span><span class="cx"> static inline JSValue jsTestActiveDOMObjectExcitingAttrGetter(ExecState&amp;, JSTestActiveDOMObject&amp;, ThrowScope&amp; throwScope);

</span><span class="lines">@@ -179,7 +179,7 @@

</span><span class="cx"> {

</span><span class="cx">     VM&amp; vm = state-&gt;vm();

</span><span class="cx">     auto throwScope = DECLARE_THROW_SCOPE(vm);

</span><del>-    JSTestActiveDOMObjectPrototype* domObject = jsDynamicDowncast&lt;JSTestActiveDOMObjectPrototype*&gt;(JSValue::decode(thisValue));

</del><ins>+    JSTestActiveDOMObjectPrototype* domObject = jsDynamicDowncast&lt;JSTestActiveDOMObjectPrototype*&gt;(vm, JSValue::decode(thisValue));

</ins><span class="cx">     if (UNLIKELY(!domObject))

</span><span class="cx">         return throwVMTypeError(state, throwScope);

</span><span class="cx">     return JSValue::encode(JSTestActiveDOMObject::getConstructor(state-&gt;vm(), domObject-&gt;globalObject()));

</span><span class="lines">@@ -190,7 +190,7 @@

</span><span class="cx">     VM&amp; vm = state-&gt;vm();

</span><span class="cx">     auto throwScope = DECLARE_THROW_SCOPE(vm);

</span><span class="cx">     JSValue value = JSValue::decode(encodedValue);

</span><del>-    JSTestActiveDOMObjectPrototype* domObject = jsDynamicDowncast&lt;JSTestActiveDOMObjectPrototype*&gt;(JSValue::decode(thisValue));

</del><ins>+    JSTestActiveDOMObjectPrototype* domObject = jsDynamicDowncast&lt;JSTestActiveDOMObjectPrototype*&gt;(vm, JSValue::decode(thisValue));

</ins><span class="cx">     if (UNLIKELY(!domObject)) {

</span><span class="cx">         throwVMTypeError(state, throwScope);

</span><span class="cx">         return false;

</span><span class="lines">@@ -298,9 +298,9 @@

</span><span class="cx">     return wrap(state, globalObject, impl);

</span><span class="cx"> }

</span><span class="cx"> 

</span><del>-TestActiveDOMObject* JSTestActiveDOMObject::toWrapped(JSC::JSValue value)

</del><ins>+TestActiveDOMObject* JSTestActiveDOMObject::toWrapped(JSC::VM&amp; vm, JSC::JSValue value)

</ins><span class="cx"> {

</span><del>-    if (auto* wrapper = jsDynamicDowncast&lt;JSTestActiveDOMObject*&gt;(value))

</del><ins>+    if (auto* wrapper = jsDynamicDowncast&lt;JSTestActiveDOMObject*&gt;(vm, value))

</ins><span class="cx">         return &amp;wrapper-&gt;wrapped();

</span><span class="cx">     return nullptr;

</span><span class="cx"> }

</span></span></pre></div>

<a id="trunkSourceWebCorebindingsscriptstestJSJSTestActiveDOMObjecth"></a>

<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/scripts/test/JS/JSTestActiveDOMObject.h (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/WebCore/bindings/scripts/test/JS/JSTestActiveDOMObject.h        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/WebCore/bindings/scripts/test/JS/JSTestActiveDOMObject.h        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -38,7 +38,7 @@

</span><span class="cx"> 

</span><span class="cx">     static JSC::JSObject* createPrototype(JSC::VM&amp;, JSC::JSGlobalObject*);

</span><span class="cx">     static JSC::JSObject* prototype(JSC::VM&amp;, JSC::JSGlobalObject*);

</span><del>-    static TestActiveDOMObject* toWrapped(JSC::JSValue);

</del><ins>+    static TestActiveDOMObject* toWrapped(JSC::VM&amp;, JSC::JSValue);

</ins><span class="cx">     static void destroy(JSC::JSCell*);

</span><span class="cx"> 

</span><span class="cx">     DECLARE_INFO;

</span></span></pre></div>

<a id="trunkSourceWebCorebindingsscriptstestJSJSTestCEReactionscpp"></a>

<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/scripts/test/JS/JSTestCEReactions.cpp (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/WebCore/bindings/scripts/test/JS/JSTestCEReactions.cpp        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/WebCore/bindings/scripts/test/JS/JSTestCEReactions.cpp        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -121,7 +121,7 @@

</span><span class="cx"> void JSTestCEReactions::finishCreation(VM&amp; vm)

</span><span class="cx"> {

</span><span class="cx">     Base::finishCreation(vm);

</span><del>-    ASSERT(inherits(info()));

</del><ins>+    ASSERT(inherits(vm, info()));

</ins><span class="cx"> 

</span><span class="cx"> }

</span><span class="cx"> 

</span><span class="lines">@@ -141,14 +141,14 @@

</span><span class="cx">     thisObject-&gt;JSTestCEReactions::~JSTestCEReactions();

</span><span class="cx"> }

</span><span class="cx"> 

</span><del>-template&lt;&gt; inline JSTestCEReactions* BindingCaller&lt;JSTestCEReactions&gt;::castForAttribute(ExecState&amp;, EncodedJSValue thisValue)

</del><ins>+template&lt;&gt; inline JSTestCEReactions* BindingCaller&lt;JSTestCEReactions&gt;::castForAttribute(ExecState&amp; state, EncodedJSValue thisValue)

</ins><span class="cx"> {

</span><del>-    return jsDynamicDowncast&lt;JSTestCEReactions*&gt;(JSValue::decode(thisValue));

</del><ins>+    return jsDynamicDowncast&lt;JSTestCEReactions*&gt;(state.vm(), JSValue::decode(thisValue));

</ins><span class="cx"> }

</span><span class="cx"> 

</span><span class="cx"> template&lt;&gt; inline JSTestCEReactions* BindingCaller&lt;JSTestCEReactions&gt;::castForOperation(ExecState&amp; state)

</span><span class="cx"> {

</span><del>-    return jsDynamicDowncast&lt;JSTestCEReactions*&gt;(state.thisValue());

</del><ins>+    return jsDynamicDowncast&lt;JSTestCEReactions*&gt;(state.vm(), state.thisValue());

</ins><span class="cx"> }

</span><span class="cx"> 

</span><span class="cx"> static inline JSValue jsTestCEReactionsAttributeWithCEReactionsGetter(ExecState&amp;, JSTestCEReactions&amp;, ThrowScope&amp; throwScope);

</span><span class="lines">@@ -203,7 +203,7 @@

</span><span class="cx"> {

</span><span class="cx">     VM&amp; vm = state-&gt;vm();

</span><span class="cx">     auto throwScope = DECLARE_THROW_SCOPE(vm);

</span><del>-    JSTestCEReactionsPrototype* domObject = jsDynamicDowncast&lt;JSTestCEReactionsPrototype*&gt;(JSValue::decode(thisValue));

</del><ins>+    JSTestCEReactionsPrototype* domObject = jsDynamicDowncast&lt;JSTestCEReactionsPrototype*&gt;(vm, JSValue::decode(thisValue));

</ins><span class="cx">     if (UNLIKELY(!domObject))

</span><span class="cx">         return throwVMTypeError(state, throwScope);

</span><span class="cx">     return JSValue::encode(JSTestCEReactions::getConstructor(state-&gt;vm(), domObject-&gt;globalObject()));

</span><span class="lines">@@ -214,7 +214,7 @@

</span><span class="cx">     VM&amp; vm = state-&gt;vm();

</span><span class="cx">     auto throwScope = DECLARE_THROW_SCOPE(vm);

</span><span class="cx">     JSValue value = JSValue::decode(encodedValue);

</span><del>-    JSTestCEReactionsPrototype* domObject = jsDynamicDowncast&lt;JSTestCEReactionsPrototype*&gt;(JSValue::decode(thisValue));

</del><ins>+    JSTestCEReactionsPrototype* domObject = jsDynamicDowncast&lt;JSTestCEReactionsPrototype*&gt;(vm, JSValue::decode(thisValue));

</ins><span class="cx">     if (UNLIKELY(!domObject)) {

</span><span class="cx">         throwVMTypeError(state, throwScope);

</span><span class="cx">         return false;

</span><span class="lines">@@ -358,9 +358,9 @@

</span><span class="cx">     return wrap(state, globalObject, impl);

</span><span class="cx"> }

</span><span class="cx"> 

</span><del>-TestCEReactions* JSTestCEReactions::toWrapped(JSC::JSValue value)

</del><ins>+TestCEReactions* JSTestCEReactions::toWrapped(JSC::VM&amp; vm, JSC::JSValue value)

</ins><span class="cx"> {

</span><del>-    if (auto* wrapper = jsDynamicDowncast&lt;JSTestCEReactions*&gt;(value))

</del><ins>+    if (auto* wrapper = jsDynamicDowncast&lt;JSTestCEReactions*&gt;(vm, value))

</ins><span class="cx">         return &amp;wrapper-&gt;wrapped();

</span><span class="cx">     return nullptr;

</span><span class="cx"> }

</span></span></pre></div>

<a id="trunkSourceWebCorebindingsscriptstestJSJSTestCEReactionsh"></a>

<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/scripts/test/JS/JSTestCEReactions.h (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/WebCore/bindings/scripts/test/JS/JSTestCEReactions.h        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/WebCore/bindings/scripts/test/JS/JSTestCEReactions.h        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -38,7 +38,7 @@

</span><span class="cx"> 

</span><span class="cx">     static JSC::JSObject* createPrototype(JSC::VM&amp;, JSC::JSGlobalObject*);

</span><span class="cx">     static JSC::JSObject* prototype(JSC::VM&amp;, JSC::JSGlobalObject*);

</span><del>-    static TestCEReactions* toWrapped(JSC::JSValue);

</del><ins>+    static TestCEReactions* toWrapped(JSC::VM&amp;, JSC::JSValue);

</ins><span class="cx">     static void destroy(JSC::JSCell*);

</span><span class="cx"> 

</span><span class="cx">     DECLARE_INFO;

</span></span></pre></div>

<a id="trunkSourceWebCorebindingsscriptstestJSJSTestCEReactionsStringifiercpp"></a>

<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/scripts/test/JS/JSTestCEReactionsStringifier.cpp (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/WebCore/bindings/scripts/test/JS/JSTestCEReactionsStringifier.cpp        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/WebCore/bindings/scripts/test/JS/JSTestCEReactionsStringifier.cpp        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -113,7 +113,7 @@

</span><span class="cx"> void JSTestCEReactionsStringifier::finishCreation(VM&amp; vm)

</span><span class="cx"> {

</span><span class="cx">     Base::finishCreation(vm);

</span><del>-    ASSERT(inherits(info()));

</del><ins>+    ASSERT(inherits(vm, info()));

</ins><span class="cx"> 

</span><span class="cx"> }

</span><span class="cx"> 

</span><span class="lines">@@ -133,14 +133,14 @@

</span><span class="cx">     thisObject-&gt;JSTestCEReactionsStringifier::~JSTestCEReactionsStringifier();

</span><span class="cx"> }

</span><span class="cx"> 

</span><del>-template&lt;&gt; inline JSTestCEReactionsStringifier* BindingCaller&lt;JSTestCEReactionsStringifier&gt;::castForAttribute(ExecState&amp;, EncodedJSValue thisValue)

</del><ins>+template&lt;&gt; inline JSTestCEReactionsStringifier* BindingCaller&lt;JSTestCEReactionsStringifier&gt;::castForAttribute(ExecState&amp; state, EncodedJSValue thisValue)

</ins><span class="cx"> {

</span><del>-    return jsDynamicDowncast&lt;JSTestCEReactionsStringifier*&gt;(JSValue::decode(thisValue));

</del><ins>+    return jsDynamicDowncast&lt;JSTestCEReactionsStringifier*&gt;(state.vm(), JSValue::decode(thisValue));

</ins><span class="cx"> }

</span><span class="cx"> 

</span><span class="cx"> template&lt;&gt; inline JSTestCEReactionsStringifier* BindingCaller&lt;JSTestCEReactionsStringifier&gt;::castForOperation(ExecState&amp; state)

</span><span class="cx"> {

</span><del>-    return jsDynamicDowncast&lt;JSTestCEReactionsStringifier*&gt;(state.thisValue());

</del><ins>+    return jsDynamicDowncast&lt;JSTestCEReactionsStringifier*&gt;(state.vm(), state.thisValue());

</ins><span class="cx"> }

</span><span class="cx"> 

</span><span class="cx"> static inline JSValue jsTestCEReactionsStringifierValueGetter(ExecState&amp;, JSTestCEReactionsStringifier&amp;, ThrowScope&amp; throwScope);

</span><span class="lines">@@ -163,7 +163,7 @@

</span><span class="cx"> {

</span><span class="cx">     VM&amp; vm = state-&gt;vm();

</span><span class="cx">     auto throwScope = DECLARE_THROW_SCOPE(vm);

</span><del>-    JSTestCEReactionsStringifierPrototype* domObject = jsDynamicDowncast&lt;JSTestCEReactionsStringifierPrototype*&gt;(JSValue::decode(thisValue));

</del><ins>+    JSTestCEReactionsStringifierPrototype* domObject = jsDynamicDowncast&lt;JSTestCEReactionsStringifierPrototype*&gt;(vm, JSValue::decode(thisValue));

</ins><span class="cx">     if (UNLIKELY(!domObject))

</span><span class="cx">         return throwVMTypeError(state, throwScope);

</span><span class="cx">     return JSValue::encode(JSTestCEReactionsStringifier::getConstructor(state-&gt;vm(), domObject-&gt;globalObject()));

</span><span class="lines">@@ -174,7 +174,7 @@

</span><span class="cx">     VM&amp; vm = state-&gt;vm();

</span><span class="cx">     auto throwScope = DECLARE_THROW_SCOPE(vm);

</span><span class="cx">     JSValue value = JSValue::decode(encodedValue);

</span><del>-    JSTestCEReactionsStringifierPrototype* domObject = jsDynamicDowncast&lt;JSTestCEReactionsStringifierPrototype*&gt;(JSValue::decode(thisValue));

</del><ins>+    JSTestCEReactionsStringifierPrototype* domObject = jsDynamicDowncast&lt;JSTestCEReactionsStringifierPrototype*&gt;(vm, JSValue::decode(thisValue));

</ins><span class="cx">     if (UNLIKELY(!domObject)) {

</span><span class="cx">         throwVMTypeError(state, throwScope);

</span><span class="cx">         return false;

</span><span class="lines">@@ -275,9 +275,9 @@

</span><span class="cx">     return wrap(state, globalObject, impl);

</span><span class="cx"> }

</span><span class="cx"> 

</span><del>-TestCEReactionsStringifier* JSTestCEReactionsStringifier::toWrapped(JSC::JSValue value)

</del><ins>+TestCEReactionsStringifier* JSTestCEReactionsStringifier::toWrapped(JSC::VM&amp; vm, JSC::JSValue value)

</ins><span class="cx"> {

</span><del>-    if (auto* wrapper = jsDynamicDowncast&lt;JSTestCEReactionsStringifier*&gt;(value))

</del><ins>+    if (auto* wrapper = jsDynamicDowncast&lt;JSTestCEReactionsStringifier*&gt;(vm, value))

</ins><span class="cx">         return &amp;wrapper-&gt;wrapped();

</span><span class="cx">     return nullptr;

</span><span class="cx"> }

</span></span></pre></div>

<a id="trunkSourceWebCorebindingsscriptstestJSJSTestCEReactionsStringifierh"></a>

<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/scripts/test/JS/JSTestCEReactionsStringifier.h (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/WebCore/bindings/scripts/test/JS/JSTestCEReactionsStringifier.h        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/WebCore/bindings/scripts/test/JS/JSTestCEReactionsStringifier.h        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -38,7 +38,7 @@

</span><span class="cx"> 

</span><span class="cx">     static JSC::JSObject* createPrototype(JSC::VM&amp;, JSC::JSGlobalObject*);

</span><span class="cx">     static JSC::JSObject* prototype(JSC::VM&amp;, JSC::JSGlobalObject*);

</span><del>-    static TestCEReactionsStringifier* toWrapped(JSC::JSValue);

</del><ins>+    static TestCEReactionsStringifier* toWrapped(JSC::VM&amp;, JSC::JSValue);

</ins><span class="cx">     static void destroy(JSC::JSCell*);

</span><span class="cx"> 

</span><span class="cx">     DECLARE_INFO;

</span></span></pre></div>

<a id="trunkSourceWebCorebindingsscriptstestJSJSTestClassWithJSBuiltinConstructorcpp"></a>

<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/scripts/test/JS/JSTestClassWithJSBuiltinConstructor.cpp (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/WebCore/bindings/scripts/test/JS/JSTestClassWithJSBuiltinConstructor.cpp        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/WebCore/bindings/scripts/test/JS/JSTestClassWithJSBuiltinConstructor.cpp        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -108,7 +108,7 @@

</span><span class="cx"> void JSTestClassWithJSBuiltinConstructor::finishCreation(VM&amp; vm)

</span><span class="cx"> {

</span><span class="cx">     Base::finishCreation(vm);

</span><del>-    ASSERT(inherits(info()));

</del><ins>+    ASSERT(inherits(vm, info()));

</ins><span class="cx"> 

</span><span class="cx"> }

</span><span class="cx"> 

</span><span class="lines">@@ -132,7 +132,7 @@

</span><span class="cx"> {

</span><span class="cx">     VM&amp; vm = state-&gt;vm();

</span><span class="cx">     auto throwScope = DECLARE_THROW_SCOPE(vm);

</span><del>-    JSTestClassWithJSBuiltinConstructorPrototype* domObject = jsDynamicDowncast&lt;JSTestClassWithJSBuiltinConstructorPrototype*&gt;(JSValue::decode(thisValue));

</del><ins>+    JSTestClassWithJSBuiltinConstructorPrototype* domObject = jsDynamicDowncast&lt;JSTestClassWithJSBuiltinConstructorPrototype*&gt;(vm, JSValue::decode(thisValue));

</ins><span class="cx">     if (UNLIKELY(!domObject))

</span><span class="cx">         return throwVMTypeError(state, throwScope);

</span><span class="cx">     return JSValue::encode(JSTestClassWithJSBuiltinConstructor::getConstructor(state-&gt;vm(), domObject-&gt;globalObject()));

</span><span class="lines">@@ -143,7 +143,7 @@

</span><span class="cx">     VM&amp; vm = state-&gt;vm();

</span><span class="cx">     auto throwScope = DECLARE_THROW_SCOPE(vm);

</span><span class="cx">     JSValue value = JSValue::decode(encodedValue);

</span><del>-    JSTestClassWithJSBuiltinConstructorPrototype* domObject = jsDynamicDowncast&lt;JSTestClassWithJSBuiltinConstructorPrototype*&gt;(JSValue::decode(thisValue));

</del><ins>+    JSTestClassWithJSBuiltinConstructorPrototype* domObject = jsDynamicDowncast&lt;JSTestClassWithJSBuiltinConstructorPrototype*&gt;(vm, JSValue::decode(thisValue));

</ins><span class="cx">     if (UNLIKELY(!domObject)) {

</span><span class="cx">         throwVMTypeError(state, throwScope);

</span><span class="cx">         return false;

</span><span class="lines">@@ -216,9 +216,9 @@

</span><span class="cx">     return wrap(state, globalObject, impl);

</span><span class="cx"> }

</span><span class="cx"> 

</span><del>-TestClassWithJSBuiltinConstructor* JSTestClassWithJSBuiltinConstructor::toWrapped(JSC::JSValue value)

</del><ins>+TestClassWithJSBuiltinConstructor* JSTestClassWithJSBuiltinConstructor::toWrapped(JSC::VM&amp; vm, JSC::JSValue value)

</ins><span class="cx"> {

</span><del>-    if (auto* wrapper = jsDynamicDowncast&lt;JSTestClassWithJSBuiltinConstructor*&gt;(value))

</del><ins>+    if (auto* wrapper = jsDynamicDowncast&lt;JSTestClassWithJSBuiltinConstructor*&gt;(vm, value))

</ins><span class="cx">         return &amp;wrapper-&gt;wrapped();

</span><span class="cx">     return nullptr;

</span><span class="cx"> }

</span></span></pre></div>

<a id="trunkSourceWebCorebindingsscriptstestJSJSTestClassWithJSBuiltinConstructorh"></a>

<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/scripts/test/JS/JSTestClassWithJSBuiltinConstructor.h (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/WebCore/bindings/scripts/test/JS/JSTestClassWithJSBuiltinConstructor.h        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/WebCore/bindings/scripts/test/JS/JSTestClassWithJSBuiltinConstructor.h        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -38,7 +38,7 @@

</span><span class="cx"> 

</span><span class="cx">     static JSC::JSObject* createPrototype(JSC::VM&amp;, JSC::JSGlobalObject*);

</span><span class="cx">     static JSC::JSObject* prototype(JSC::VM&amp;, JSC::JSGlobalObject*);

</span><del>-    static TestClassWithJSBuiltinConstructor* toWrapped(JSC::JSValue);

</del><ins>+    static TestClassWithJSBuiltinConstructor* toWrapped(JSC::VM&amp;, JSC::JSValue);

</ins><span class="cx">     static void destroy(JSC::JSCell*);

</span><span class="cx"> 

</span><span class="cx">     DECLARE_INFO;

</span></span></pre></div>

<a id="trunkSourceWebCorebindingsscriptstestJSJSTestCustomConstructorWithNoInterfaceObjectcpp"></a>

<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/scripts/test/JS/JSTestCustomConstructorWithNoInterfaceObject.cpp (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/WebCore/bindings/scripts/test/JS/JSTestCustomConstructorWithNoInterfaceObject.cpp        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/WebCore/bindings/scripts/test/JS/JSTestCustomConstructorWithNoInterfaceObject.cpp        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -108,7 +108,7 @@

</span><span class="cx"> void JSTestCustomConstructorWithNoInterfaceObject::finishCreation(VM&amp; vm)

</span><span class="cx"> {

</span><span class="cx">     Base::finishCreation(vm);

</span><del>-    ASSERT(inherits(info()));

</del><ins>+    ASSERT(inherits(vm, info()));

</ins><span class="cx"> 

</span><span class="cx"> }

</span><span class="cx"> 

</span><span class="lines">@@ -132,7 +132,7 @@

</span><span class="cx"> {

</span><span class="cx">     VM&amp; vm = state-&gt;vm();

</span><span class="cx">     auto throwScope = DECLARE_THROW_SCOPE(vm);

</span><del>-    JSTestCustomConstructorWithNoInterfaceObjectPrototype* domObject = jsDynamicDowncast&lt;JSTestCustomConstructorWithNoInterfaceObjectPrototype*&gt;(JSValue::decode(thisValue));

</del><ins>+    JSTestCustomConstructorWithNoInterfaceObjectPrototype* domObject = jsDynamicDowncast&lt;JSTestCustomConstructorWithNoInterfaceObjectPrototype*&gt;(vm, JSValue::decode(thisValue));

</ins><span class="cx">     if (UNLIKELY(!domObject))

</span><span class="cx">         return throwVMTypeError(state, throwScope);

</span><span class="cx">     JSValue constructor = JSTestCustomConstructorWithNoInterfaceObjectConstructor::create(state-&gt;vm(), JSTestCustomConstructorWithNoInterfaceObjectConstructor::createStructure(state-&gt;vm(), *domObject-&gt;globalObject(), domObject-&gt;globalObject()-&gt;objectPrototype()), *jsCast&lt;JSDOMGlobalObject*&gt;(domObject-&gt;globalObject()));

</span><span class="lines">@@ -146,7 +146,7 @@

</span><span class="cx">     VM&amp; vm = state-&gt;vm();

</span><span class="cx">     auto throwScope = DECLARE_THROW_SCOPE(vm);

</span><span class="cx">     JSValue value = JSValue::decode(encodedValue);

</span><del>-    JSTestCustomConstructorWithNoInterfaceObjectPrototype* domObject = jsDynamicDowncast&lt;JSTestCustomConstructorWithNoInterfaceObjectPrototype*&gt;(JSValue::decode(thisValue));

</del><ins>+    JSTestCustomConstructorWithNoInterfaceObjectPrototype* domObject = jsDynamicDowncast&lt;JSTestCustomConstructorWithNoInterfaceObjectPrototype*&gt;(vm, JSValue::decode(thisValue));

</ins><span class="cx">     if (UNLIKELY(!domObject)) {

</span><span class="cx">         throwVMTypeError(state, throwScope);

</span><span class="cx">         return false;

</span><span class="lines">@@ -207,9 +207,9 @@

</span><span class="cx">     return wrap(state, globalObject, impl);

</span><span class="cx"> }

</span><span class="cx"> 

</span><del>-TestCustomConstructorWithNoInterfaceObject* JSTestCustomConstructorWithNoInterfaceObject::toWrapped(JSC::JSValue value)

</del><ins>+TestCustomConstructorWithNoInterfaceObject* JSTestCustomConstructorWithNoInterfaceObject::toWrapped(JSC::VM&amp; vm, JSC::JSValue value)

</ins><span class="cx"> {

</span><del>-    if (auto* wrapper = jsDynamicDowncast&lt;JSTestCustomConstructorWithNoInterfaceObject*&gt;(value))

</del><ins>+    if (auto* wrapper = jsDynamicDowncast&lt;JSTestCustomConstructorWithNoInterfaceObject*&gt;(vm, value))

</ins><span class="cx">         return &amp;wrapper-&gt;wrapped();

</span><span class="cx">     return nullptr;

</span><span class="cx"> }

</span></span></pre></div>

<a id="trunkSourceWebCorebindingsscriptstestJSJSTestCustomConstructorWithNoInterfaceObjecth"></a>

<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/scripts/test/JS/JSTestCustomConstructorWithNoInterfaceObject.h (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/WebCore/bindings/scripts/test/JS/JSTestCustomConstructorWithNoInterfaceObject.h        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/WebCore/bindings/scripts/test/JS/JSTestCustomConstructorWithNoInterfaceObject.h        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -38,7 +38,7 @@

</span><span class="cx"> 

</span><span class="cx">     static JSC::JSObject* createPrototype(JSC::VM&amp;, JSC::JSGlobalObject*);

</span><span class="cx">     static JSC::JSObject* prototype(JSC::VM&amp;, JSC::JSGlobalObject*);

</span><del>-    static TestCustomConstructorWithNoInterfaceObject* toWrapped(JSC::JSValue);

</del><ins>+    static TestCustomConstructorWithNoInterfaceObject* toWrapped(JSC::VM&amp;, JSC::JSValue);

</ins><span class="cx">     static void destroy(JSC::JSCell*);

</span><span class="cx"> 

</span><span class="cx">     DECLARE_INFO;

</span></span></pre></div>

<a id="trunkSourceWebCorebindingsscriptstestJSJSTestCustomNamedGettercpp"></a>

<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/scripts/test/JS/JSTestCustomNamedGetter.cpp (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/WebCore/bindings/scripts/test/JS/JSTestCustomNamedGetter.cpp        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/WebCore/bindings/scripts/test/JS/JSTestCustomNamedGetter.cpp        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -109,7 +109,7 @@

</span><span class="cx"> void JSTestCustomNamedGetter::finishCreation(VM&amp; vm)

</span><span class="cx"> {

</span><span class="cx">     Base::finishCreation(vm);

</span><del>-    ASSERT(inherits(info()));

</del><ins>+    ASSERT(inherits(vm, info()));

</ins><span class="cx"> 

</span><span class="cx"> }

</span><span class="cx"> 

</span><span class="lines">@@ -166,7 +166,7 @@

</span><span class="cx"> 

</span><span class="cx"> template&lt;&gt; inline JSTestCustomNamedGetter* BindingCaller&lt;JSTestCustomNamedGetter&gt;::castForOperation(ExecState&amp; state)

</span><span class="cx"> {

</span><del>-    return jsDynamicDowncast&lt;JSTestCustomNamedGetter*&gt;(state.thisValue());

</del><ins>+    return jsDynamicDowncast&lt;JSTestCustomNamedGetter*&gt;(state.vm(), state.thisValue());

</ins><span class="cx"> }

</span><span class="cx"> 

</span><span class="cx"> EncodedJSValue jsTestCustomNamedGetterConstructor(ExecState* state, EncodedJSValue thisValue, PropertyName)

</span><span class="lines">@@ -173,7 +173,7 @@

</span><span class="cx"> {

</span><span class="cx">     VM&amp; vm = state-&gt;vm();

</span><span class="cx">     auto throwScope = DECLARE_THROW_SCOPE(vm);

</span><del>-    JSTestCustomNamedGetterPrototype* domObject = jsDynamicDowncast&lt;JSTestCustomNamedGetterPrototype*&gt;(JSValue::decode(thisValue));

</del><ins>+    JSTestCustomNamedGetterPrototype* domObject = jsDynamicDowncast&lt;JSTestCustomNamedGetterPrototype*&gt;(vm, JSValue::decode(thisValue));

</ins><span class="cx">     if (UNLIKELY(!domObject))

</span><span class="cx">         return throwVMTypeError(state, throwScope);

</span><span class="cx">     return JSValue::encode(JSTestCustomNamedGetter::getConstructor(state-&gt;vm(), domObject-&gt;globalObject()));

</span><span class="lines">@@ -184,7 +184,7 @@

</span><span class="cx">     VM&amp; vm = state-&gt;vm();

</span><span class="cx">     auto throwScope = DECLARE_THROW_SCOPE(vm);

</span><span class="cx">     JSValue value = JSValue::decode(encodedValue);

</span><del>-    JSTestCustomNamedGetterPrototype* domObject = jsDynamicDowncast&lt;JSTestCustomNamedGetterPrototype*&gt;(JSValue::decode(thisValue));

</del><ins>+    JSTestCustomNamedGetterPrototype* domObject = jsDynamicDowncast&lt;JSTestCustomNamedGetterPrototype*&gt;(vm, JSValue::decode(thisValue));

</ins><span class="cx">     if (UNLIKELY(!domObject)) {

</span><span class="cx">         throwVMTypeError(state, throwScope);

</span><span class="cx">         return false;

</span><span class="lines">@@ -270,9 +270,9 @@

</span><span class="cx">     return wrap(state, globalObject, impl);

</span><span class="cx"> }

</span><span class="cx"> 

</span><del>-TestCustomNamedGetter* JSTestCustomNamedGetter::toWrapped(JSC::JSValue value)

</del><ins>+TestCustomNamedGetter* JSTestCustomNamedGetter::toWrapped(JSC::VM&amp; vm, JSC::JSValue value)

</ins><span class="cx"> {

</span><del>-    if (auto* wrapper = jsDynamicDowncast&lt;JSTestCustomNamedGetter*&gt;(value))

</del><ins>+    if (auto* wrapper = jsDynamicDowncast&lt;JSTestCustomNamedGetter*&gt;(vm, value))

</ins><span class="cx">         return &amp;wrapper-&gt;wrapped();

</span><span class="cx">     return nullptr;

</span><span class="cx"> }

</span></span></pre></div>

<a id="trunkSourceWebCorebindingsscriptstestJSJSTestCustomNamedGetterh"></a>

<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/scripts/test/JS/JSTestCustomNamedGetter.h (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/WebCore/bindings/scripts/test/JS/JSTestCustomNamedGetter.h        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/WebCore/bindings/scripts/test/JS/JSTestCustomNamedGetter.h        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -38,7 +38,7 @@

</span><span class="cx"> 

</span><span class="cx">     static JSC::JSObject* createPrototype(JSC::VM&amp;, JSC::JSGlobalObject*);

</span><span class="cx">     static JSC::JSObject* prototype(JSC::VM&amp;, JSC::JSGlobalObject*);

</span><del>-    static TestCustomNamedGetter* toWrapped(JSC::JSValue);

</del><ins>+    static TestCustomNamedGetter* toWrapped(JSC::VM&amp;, JSC::JSValue);

</ins><span class="cx">     static bool getOwnPropertySlot(JSC::JSObject*, JSC::ExecState*, JSC::PropertyName, JSC::PropertySlot&amp;);

</span><span class="cx">     static bool getOwnPropertySlotByIndex(JSC::JSObject*, JSC::ExecState*, unsigned propertyName, JSC::PropertySlot&amp;);

</span><span class="cx">     static void destroy(JSC::JSCell*);

</span></span></pre></div>

<a id="trunkSourceWebCorebindingsscriptstestJSJSTestDOMJITcpp"></a>

<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/scripts/test/JS/JSTestDOMJIT.cpp (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/WebCore/bindings/scripts/test/JS/JSTestDOMJIT.cpp        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/WebCore/bindings/scripts/test/JS/JSTestDOMJIT.cpp        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -229,7 +229,7 @@

</span><span class="cx"> void JSTestDOMJIT::finishCreation(VM&amp; vm)

</span><span class="cx"> {

</span><span class="cx">     Base::finishCreation(vm);

</span><del>-    ASSERT(inherits(info()));

</del><ins>+    ASSERT(inherits(vm, info()));

</ins><span class="cx"> 

</span><span class="cx"> }

</span><span class="cx"> 

</span><span class="lines">@@ -243,14 +243,14 @@

</span><span class="cx">     return getDOMPrototype&lt;JSTestDOMJIT&gt;(vm, globalObject);

</span><span class="cx"> }

</span><span class="cx"> 

</span><del>-template&lt;&gt; inline JSTestDOMJIT* BindingCaller&lt;JSTestDOMJIT&gt;::castForAttribute(ExecState&amp;, EncodedJSValue thisValue)

</del><ins>+template&lt;&gt; inline JSTestDOMJIT* BindingCaller&lt;JSTestDOMJIT&gt;::castForAttribute(ExecState&amp; state, EncodedJSValue thisValue)

</ins><span class="cx"> {

</span><del>-    return jsDynamicDowncast&lt;JSTestDOMJIT*&gt;(JSValue::decode(thisValue));

</del><ins>+    return jsDynamicDowncast&lt;JSTestDOMJIT*&gt;(state.vm(), JSValue::decode(thisValue));

</ins><span class="cx"> }

</span><span class="cx"> 

</span><span class="cx"> template&lt;&gt; inline JSTestDOMJIT* BindingCaller&lt;JSTestDOMJIT&gt;::castForOperation(ExecState&amp; state)

</span><span class="cx"> {

</span><del>-    return jsDynamicDowncast&lt;JSTestDOMJIT*&gt;(state.thisValue());

</del><ins>+    return jsDynamicDowncast&lt;JSTestDOMJIT*&gt;(state.vm(), state.thisValue());

</ins><span class="cx"> }

</span><span class="cx"> 

</span><span class="cx"> static inline JSValue jsTestDOMJITAnyAttrGetter(ExecState&amp;, JSTestDOMJIT&amp;, ThrowScope&amp; throwScope);

</span><span class="lines">@@ -1202,7 +1202,7 @@

</span><span class="cx"> {

</span><span class="cx">     VM&amp; vm = state-&gt;vm();

</span><span class="cx">     auto throwScope = DECLARE_THROW_SCOPE(vm);

</span><del>-    JSTestDOMJITPrototype* domObject = jsDynamicDowncast&lt;JSTestDOMJITPrototype*&gt;(JSValue::decode(thisValue));

</del><ins>+    JSTestDOMJITPrototype* domObject = jsDynamicDowncast&lt;JSTestDOMJITPrototype*&gt;(vm, JSValue::decode(thisValue));

</ins><span class="cx">     if (UNLIKELY(!domObject))

</span><span class="cx">         return throwVMTypeError(state, throwScope);

</span><span class="cx">     return JSValue::encode(JSTestDOMJIT::getConstructor(state-&gt;vm(), domObject-&gt;globalObject()));

</span><span class="lines">@@ -1213,7 +1213,7 @@

</span><span class="cx">     VM&amp; vm = state-&gt;vm();

</span><span class="cx">     auto throwScope = DECLARE_THROW_SCOPE(vm);

</span><span class="cx">     JSValue value = JSValue::decode(encodedValue);

</span><del>-    JSTestDOMJITPrototype* domObject = jsDynamicDowncast&lt;JSTestDOMJITPrototype*&gt;(JSValue::decode(thisValue));

</del><ins>+    JSTestDOMJITPrototype* domObject = jsDynamicDowncast&lt;JSTestDOMJITPrototype*&gt;(vm, JSValue::decode(thisValue));

</ins><span class="cx">     if (UNLIKELY(!domObject)) {

</span><span class="cx">         throwVMTypeError(state, throwScope);

</span><span class="cx">         return false;

</span></span></pre></div>

<a id="trunkSourceWebCorebindingsscriptstestJSJSTestEventConstructorcpp"></a>

<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/scripts/test/JS/JSTestEventConstructor.cpp (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/WebCore/bindings/scripts/test/JS/JSTestEventConstructor.cpp        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/WebCore/bindings/scripts/test/JS/JSTestEventConstructor.cpp        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -178,7 +178,7 @@

</span><span class="cx"> void JSTestEventConstructor::finishCreation(VM&amp; vm)

</span><span class="cx"> {

</span><span class="cx">     Base::finishCreation(vm);

</span><del>-    ASSERT(inherits(info()));

</del><ins>+    ASSERT(inherits(vm, info()));

</ins><span class="cx"> 

</span><span class="cx"> }

</span><span class="cx"> 

</span><span class="lines">@@ -192,9 +192,9 @@

</span><span class="cx">     return getDOMPrototype&lt;JSTestEventConstructor&gt;(vm, globalObject);

</span><span class="cx"> }

</span><span class="cx"> 

</span><del>-template&lt;&gt; inline JSTestEventConstructor* BindingCaller&lt;JSTestEventConstructor&gt;::castForAttribute(ExecState&amp;, EncodedJSValue thisValue)

</del><ins>+template&lt;&gt; inline JSTestEventConstructor* BindingCaller&lt;JSTestEventConstructor&gt;::castForAttribute(ExecState&amp; state, EncodedJSValue thisValue)

</ins><span class="cx"> {

</span><del>-    return jsDynamicDowncast&lt;JSTestEventConstructor*&gt;(JSValue::decode(thisValue));

</del><ins>+    return jsDynamicDowncast&lt;JSTestEventConstructor*&gt;(state.vm(), JSValue::decode(thisValue));

</ins><span class="cx"> }

</span><span class="cx"> 

</span><span class="cx"> static inline JSValue jsTestEventConstructorAttr1Getter(ExecState&amp;, JSTestEventConstructor&amp;, ThrowScope&amp; throwScope);

</span><span class="lines">@@ -252,7 +252,7 @@

</span><span class="cx"> {

</span><span class="cx">     VM&amp; vm = state-&gt;vm();

</span><span class="cx">     auto throwScope = DECLARE_THROW_SCOPE(vm);

</span><del>-    JSTestEventConstructorPrototype* domObject = jsDynamicDowncast&lt;JSTestEventConstructorPrototype*&gt;(JSValue::decode(thisValue));

</del><ins>+    JSTestEventConstructorPrototype* domObject = jsDynamicDowncast&lt;JSTestEventConstructorPrototype*&gt;(vm, JSValue::decode(thisValue));

</ins><span class="cx">     if (UNLIKELY(!domObject))

</span><span class="cx">         return throwVMTypeError(state, throwScope);

</span><span class="cx">     return JSValue::encode(JSTestEventConstructor::getConstructor(state-&gt;vm(), domObject-&gt;globalObject()));

</span><span class="lines">@@ -263,7 +263,7 @@

</span><span class="cx">     VM&amp; vm = state-&gt;vm();

</span><span class="cx">     auto throwScope = DECLARE_THROW_SCOPE(vm);

</span><span class="cx">     JSValue value = JSValue::decode(encodedValue);

</span><del>-    JSTestEventConstructorPrototype* domObject = jsDynamicDowncast&lt;JSTestEventConstructorPrototype*&gt;(JSValue::decode(thisValue));

</del><ins>+    JSTestEventConstructorPrototype* domObject = jsDynamicDowncast&lt;JSTestEventConstructorPrototype*&gt;(vm, JSValue::decode(thisValue));

</ins><span class="cx">     if (UNLIKELY(!domObject)) {

</span><span class="cx">         throwVMTypeError(state, throwScope);

</span><span class="cx">         return false;

</span></span></pre></div>

<a id="trunkSourceWebCorebindingsscriptstestJSJSTestEventTargetcpp"></a>

<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/scripts/test/JS/JSTestEventTarget.cpp (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/WebCore/bindings/scripts/test/JS/JSTestEventTarget.cpp        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/WebCore/bindings/scripts/test/JS/JSTestEventTarget.cpp        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -109,7 +109,7 @@

</span><span class="cx"> void JSTestEventTarget::finishCreation(VM&amp; vm)

</span><span class="cx"> {

</span><span class="cx">     Base::finishCreation(vm);

</span><del>-    ASSERT(inherits(info()));

</del><ins>+    ASSERT(inherits(vm, info()));

</ins><span class="cx"> 

</span><span class="cx"> }

</span><span class="cx"> 

</span><span class="lines">@@ -173,7 +173,7 @@

</span><span class="cx"> 

</span><span class="cx"> template&lt;&gt; inline JSTestEventTarget* BindingCaller&lt;JSTestEventTarget&gt;::castForOperation(ExecState&amp; state)

</span><span class="cx"> {

</span><del>-    return jsDynamicDowncast&lt;JSTestEventTarget*&gt;(state.thisValue());

</del><ins>+    return jsDynamicDowncast&lt;JSTestEventTarget*&gt;(state.vm(), state.thisValue());

</ins><span class="cx"> }

</span><span class="cx"> 

</span><span class="cx"> EncodedJSValue jsTestEventTargetConstructor(ExecState* state, EncodedJSValue thisValue, PropertyName)

</span><span class="lines">@@ -180,7 +180,7 @@

</span><span class="cx"> {

</span><span class="cx">     VM&amp; vm = state-&gt;vm();

</span><span class="cx">     auto throwScope = DECLARE_THROW_SCOPE(vm);

</span><del>-    JSTestEventTargetPrototype* domObject = jsDynamicDowncast&lt;JSTestEventTargetPrototype*&gt;(JSValue::decode(thisValue));

</del><ins>+    JSTestEventTargetPrototype* domObject = jsDynamicDowncast&lt;JSTestEventTargetPrototype*&gt;(vm, JSValue::decode(thisValue));

</ins><span class="cx">     if (UNLIKELY(!domObject))

</span><span class="cx">         return throwVMTypeError(state, throwScope);

</span><span class="cx">     return JSValue::encode(JSTestEventTarget::getConstructor(state-&gt;vm(), domObject-&gt;globalObject()));

</span><span class="lines">@@ -191,7 +191,7 @@

</span><span class="cx">     VM&amp; vm = state-&gt;vm();

</span><span class="cx">     auto throwScope = DECLARE_THROW_SCOPE(vm);

</span><span class="cx">     JSValue value = JSValue::decode(encodedValue);

</span><del>-    JSTestEventTargetPrototype* domObject = jsDynamicDowncast&lt;JSTestEventTargetPrototype*&gt;(JSValue::decode(thisValue));

</del><ins>+    JSTestEventTargetPrototype* domObject = jsDynamicDowncast&lt;JSTestEventTargetPrototype*&gt;(vm, JSValue::decode(thisValue));

</ins><span class="cx">     if (UNLIKELY(!domObject)) {

</span><span class="cx">         throwVMTypeError(state, throwScope);

</span><span class="cx">         return false;

</span><span class="lines">@@ -270,9 +270,9 @@

</span><span class="cx">     return wrap(state, globalObject, impl);

</span><span class="cx"> }

</span><span class="cx"> 

</span><del>-TestEventTarget* JSTestEventTarget::toWrapped(JSC::JSValue value)

</del><ins>+TestEventTarget* JSTestEventTarget::toWrapped(JSC::VM&amp; vm, JSC::JSValue value)

</ins><span class="cx"> {

</span><del>-    if (auto* wrapper = jsDynamicDowncast&lt;JSTestEventTarget*&gt;(value))

</del><ins>+    if (auto* wrapper = jsDynamicDowncast&lt;JSTestEventTarget*&gt;(vm, value))

</ins><span class="cx">         return &amp;wrapper-&gt;wrapped();

</span><span class="cx">     return nullptr;

</span><span class="cx"> }

</span></span></pre></div>

<a id="trunkSourceWebCorebindingsscriptstestJSJSTestEventTargeth"></a>

<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/scripts/test/JS/JSTestEventTarget.h (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/WebCore/bindings/scripts/test/JS/JSTestEventTarget.h        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/WebCore/bindings/scripts/test/JS/JSTestEventTarget.h        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -39,7 +39,7 @@

</span><span class="cx"> 

</span><span class="cx">     static JSC::JSObject* createPrototype(JSC::VM&amp;, JSC::JSGlobalObject*);

</span><span class="cx">     static JSC::JSObject* prototype(JSC::VM&amp;, JSC::JSGlobalObject*);

</span><del>-    static TestEventTarget* toWrapped(JSC::JSValue);

</del><ins>+    static TestEventTarget* toWrapped(JSC::VM&amp;, JSC::JSValue);

</ins><span class="cx">     static bool getOwnPropertySlot(JSC::JSObject*, JSC::ExecState*, JSC::PropertyName, JSC::PropertySlot&amp;);

</span><span class="cx">     static bool getOwnPropertySlotByIndex(JSC::JSObject*, JSC::ExecState*, unsigned propertyName, JSC::PropertySlot&amp;);

</span><span class="cx"> 

</span></span></pre></div>

<a id="trunkSourceWebCorebindingsscriptstestJSJSTestExceptioncpp"></a>

<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/scripts/test/JS/JSTestException.cpp (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/WebCore/bindings/scripts/test/JS/JSTestException.cpp        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/WebCore/bindings/scripts/test/JS/JSTestException.cpp        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -118,7 +118,7 @@

</span><span class="cx"> void JSTestException::finishCreation(VM&amp; vm)

</span><span class="cx"> {

</span><span class="cx">     Base::finishCreation(vm);

</span><del>-    ASSERT(inherits(info()));

</del><ins>+    ASSERT(inherits(vm, info()));

</ins><span class="cx"> 

</span><span class="cx"> }

</span><span class="cx"> 

</span><span class="lines">@@ -138,9 +138,9 @@

</span><span class="cx">     thisObject-&gt;JSTestException::~JSTestException();

</span><span class="cx"> }

</span><span class="cx"> 

</span><del>-template&lt;&gt; inline JSTestException* BindingCaller&lt;JSTestException&gt;::castForAttribute(ExecState&amp;, EncodedJSValue thisValue)

</del><ins>+template&lt;&gt; inline JSTestException* BindingCaller&lt;JSTestException&gt;::castForAttribute(ExecState&amp; state, EncodedJSValue thisValue)

</ins><span class="cx"> {

</span><del>-    return jsDynamicDowncast&lt;JSTestException*&gt;(JSValue::decode(thisValue));

</del><ins>+    return jsDynamicDowncast&lt;JSTestException*&gt;(state.vm(), JSValue::decode(thisValue));

</ins><span class="cx"> }

</span><span class="cx"> 

</span><span class="cx"> static inline JSValue jsTestExceptionNameGetter(ExecState&amp;, JSTestException&amp;, ThrowScope&amp; throwScope);

</span><span class="lines">@@ -163,7 +163,7 @@

</span><span class="cx"> {

</span><span class="cx">     VM&amp; vm = state-&gt;vm();

</span><span class="cx">     auto throwScope = DECLARE_THROW_SCOPE(vm);

</span><del>-    JSTestExceptionPrototype* domObject = jsDynamicDowncast&lt;JSTestExceptionPrototype*&gt;(JSValue::decode(thisValue));

</del><ins>+    JSTestExceptionPrototype* domObject = jsDynamicDowncast&lt;JSTestExceptionPrototype*&gt;(vm, JSValue::decode(thisValue));

</ins><span class="cx">     if (UNLIKELY(!domObject))

</span><span class="cx">         return throwVMTypeError(state, throwScope);

</span><span class="cx">     return JSValue::encode(JSTestException::getConstructor(state-&gt;vm(), domObject-&gt;globalObject()));

</span><span class="lines">@@ -174,7 +174,7 @@

</span><span class="cx">     VM&amp; vm = state-&gt;vm();

</span><span class="cx">     auto throwScope = DECLARE_THROW_SCOPE(vm);

</span><span class="cx">     JSValue value = JSValue::decode(encodedValue);

</span><del>-    JSTestExceptionPrototype* domObject = jsDynamicDowncast&lt;JSTestExceptionPrototype*&gt;(JSValue::decode(thisValue));

</del><ins>+    JSTestExceptionPrototype* domObject = jsDynamicDowncast&lt;JSTestExceptionPrototype*&gt;(vm, JSValue::decode(thisValue));

</ins><span class="cx">     if (UNLIKELY(!domObject)) {

</span><span class="cx">         throwVMTypeError(state, throwScope);

</span><span class="cx">         return false;

</span><span class="lines">@@ -240,9 +240,9 @@

</span><span class="cx">     return wrap(state, globalObject, impl);

</span><span class="cx"> }

</span><span class="cx"> 

</span><del>-TestException* JSTestException::toWrapped(JSC::JSValue value)

</del><ins>+TestException* JSTestException::toWrapped(JSC::VM&amp; vm, JSC::JSValue value)

</ins><span class="cx"> {

</span><del>-    if (auto* wrapper = jsDynamicDowncast&lt;JSTestException*&gt;(value))

</del><ins>+    if (auto* wrapper = jsDynamicDowncast&lt;JSTestException*&gt;(vm, value))

</ins><span class="cx">         return &amp;wrapper-&gt;wrapped();

</span><span class="cx">     return nullptr;

</span><span class="cx"> }

</span></span></pre></div>

<a id="trunkSourceWebCorebindingsscriptstestJSJSTestExceptionh"></a>

<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/scripts/test/JS/JSTestException.h (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/WebCore/bindings/scripts/test/JS/JSTestException.h        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/WebCore/bindings/scripts/test/JS/JSTestException.h        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -39,7 +39,7 @@

</span><span class="cx"> 

</span><span class="cx">     static JSC::JSObject* createPrototype(JSC::VM&amp;, JSC::JSGlobalObject*);

</span><span class="cx">     static JSC::JSObject* prototype(JSC::VM&amp;, JSC::JSGlobalObject*);

</span><del>-    static TestException* toWrapped(JSC::JSValue);

</del><ins>+    static TestException* toWrapped(JSC::VM&amp;, JSC::JSValue);

</ins><span class="cx">     static void destroy(JSC::JSCell*);

</span><span class="cx"> 

</span><span class="cx">     DECLARE_INFO;

</span></span></pre></div>

<a id="trunkSourceWebCorebindingsscriptstestJSJSTestGenerateIsReachablecpp"></a>

<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/scripts/test/JS/JSTestGenerateIsReachable.cpp (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/WebCore/bindings/scripts/test/JS/JSTestGenerateIsReachable.cpp        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/WebCore/bindings/scripts/test/JS/JSTestGenerateIsReachable.cpp        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -102,7 +102,7 @@

</span><span class="cx"> void JSTestGenerateIsReachable::finishCreation(VM&amp; vm)

</span><span class="cx"> {

</span><span class="cx">     Base::finishCreation(vm);

</span><del>-    ASSERT(inherits(info()));

</del><ins>+    ASSERT(inherits(vm, info()));

</ins><span class="cx"> 

</span><span class="cx"> }

</span><span class="cx"> 

</span><span class="lines">@@ -126,7 +126,7 @@

</span><span class="cx"> {

</span><span class="cx">     VM&amp; vm = state-&gt;vm();

</span><span class="cx">     auto throwScope = DECLARE_THROW_SCOPE(vm);

</span><del>-    JSTestGenerateIsReachablePrototype* domObject = jsDynamicDowncast&lt;JSTestGenerateIsReachablePrototype*&gt;(JSValue::decode(thisValue));

</del><ins>+    JSTestGenerateIsReachablePrototype* domObject = jsDynamicDowncast&lt;JSTestGenerateIsReachablePrototype*&gt;(vm, JSValue::decode(thisValue));

</ins><span class="cx">     if (UNLIKELY(!domObject))

</span><span class="cx">         return throwVMTypeError(state, throwScope);

</span><span class="cx">     return JSValue::encode(JSTestGenerateIsReachable::getConstructor(state-&gt;vm(), domObject-&gt;globalObject()));

</span><span class="lines">@@ -137,7 +137,7 @@

</span><span class="cx">     VM&amp; vm = state-&gt;vm();

</span><span class="cx">     auto throwScope = DECLARE_THROW_SCOPE(vm);

</span><span class="cx">     JSValue value = JSValue::decode(encodedValue);

</span><del>-    JSTestGenerateIsReachablePrototype* domObject = jsDynamicDowncast&lt;JSTestGenerateIsReachablePrototype*&gt;(JSValue::decode(thisValue));

</del><ins>+    JSTestGenerateIsReachablePrototype* domObject = jsDynamicDowncast&lt;JSTestGenerateIsReachablePrototype*&gt;(vm, JSValue::decode(thisValue));

</ins><span class="cx">     if (UNLIKELY(!domObject)) {

</span><span class="cx">         throwVMTypeError(state, throwScope);

</span><span class="cx">         return false;

</span><span class="lines">@@ -203,9 +203,9 @@

</span><span class="cx">     return wrap(state, globalObject, impl);

</span><span class="cx"> }

</span><span class="cx"> 

</span><del>-TestGenerateIsReachable* JSTestGenerateIsReachable::toWrapped(JSC::JSValue value)

</del><ins>+TestGenerateIsReachable* JSTestGenerateIsReachable::toWrapped(JSC::VM&amp; vm, JSC::JSValue value)

</ins><span class="cx"> {

</span><del>-    if (auto* wrapper = jsDynamicDowncast&lt;JSTestGenerateIsReachable*&gt;(value))

</del><ins>+    if (auto* wrapper = jsDynamicDowncast&lt;JSTestGenerateIsReachable*&gt;(vm, value))

</ins><span class="cx">         return &amp;wrapper-&gt;wrapped();

</span><span class="cx">     return nullptr;

</span><span class="cx"> }

</span></span></pre></div>

<a id="trunkSourceWebCorebindingsscriptstestJSJSTestGenerateIsReachableh"></a>

<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/scripts/test/JS/JSTestGenerateIsReachable.h (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/WebCore/bindings/scripts/test/JS/JSTestGenerateIsReachable.h        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/WebCore/bindings/scripts/test/JS/JSTestGenerateIsReachable.h        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -38,7 +38,7 @@

</span><span class="cx"> 

</span><span class="cx">     static JSC::JSObject* createPrototype(JSC::VM&amp;, JSC::JSGlobalObject*);

</span><span class="cx">     static JSC::JSObject* prototype(JSC::VM&amp;, JSC::JSGlobalObject*);

</span><del>-    static TestGenerateIsReachable* toWrapped(JSC::JSValue);

</del><ins>+    static TestGenerateIsReachable* toWrapped(JSC::VM&amp;, JSC::JSValue);

</ins><span class="cx">     static void destroy(JSC::JSCell*);

</span><span class="cx"> 

</span><span class="cx">     DECLARE_INFO;

</span></span></pre></div>

<a id="trunkSourceWebCorebindingsscriptstestJSJSTestGlobalObjectcpp"></a>

<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/scripts/test/JS/JSTestGlobalObject.cpp (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/WebCore/bindings/scripts/test/JS/JSTestGlobalObject.cpp        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/WebCore/bindings/scripts/test/JS/JSTestGlobalObject.cpp        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -144,7 +144,7 @@

</span><span class="cx"> void JSTestGlobalObject::finishCreation(VM&amp; vm)

</span><span class="cx"> {

</span><span class="cx">     Base::finishCreation(vm);

</span><del>-    ASSERT(inherits(info()));

</del><ins>+    ASSERT(inherits(vm, info()));

</ins><span class="cx"> 

</span><span class="cx"> #if ENABLE(TEST_FEATURE)

</span><span class="cx">     if (RuntimeEnabledFeatures::sharedFeatures().testFeatureEnabled()) {

</span><span class="lines">@@ -178,14 +178,14 @@

</span><span class="cx">     thisObject-&gt;JSTestGlobalObject::~JSTestGlobalObject();

</span><span class="cx"> }

</span><span class="cx"> 

</span><del>-template&lt;&gt; inline JSTestGlobalObject* BindingCaller&lt;JSTestGlobalObject&gt;::castForAttribute(ExecState&amp;, EncodedJSValue thisValue)

</del><ins>+template&lt;&gt; inline JSTestGlobalObject* BindingCaller&lt;JSTestGlobalObject&gt;::castForAttribute(ExecState&amp; state, EncodedJSValue thisValue)

</ins><span class="cx"> {

</span><del>-    return jsDynamicDowncast&lt;JSTestGlobalObject*&gt;(JSValue::decode(thisValue));

</del><ins>+    return jsDynamicDowncast&lt;JSTestGlobalObject*&gt;(state.vm(), JSValue::decode(thisValue));

</ins><span class="cx"> }

</span><span class="cx"> 

</span><span class="cx"> template&lt;&gt; inline JSTestGlobalObject* BindingCaller&lt;JSTestGlobalObject&gt;::castForOperation(ExecState&amp; state)

</span><span class="cx"> {

</span><del>-    return jsDynamicDowncast&lt;JSTestGlobalObject*&gt;(state.thisValue());

</del><ins>+    return jsDynamicDowncast&lt;JSTestGlobalObject*&gt;(state.vm(), state.thisValue());

</ins><span class="cx"> }

</span><span class="cx"> 

</span><span class="cx"> static inline JSValue jsTestGlobalObjectRegularAttributeGetter(ExecState&amp;, JSTestGlobalObject&amp;, ThrowScope&amp; throwScope);

</span><span class="lines">@@ -262,7 +262,7 @@

</span><span class="cx"> {

</span><span class="cx">     VM&amp; vm = state-&gt;vm();

</span><span class="cx">     auto throwScope = DECLARE_THROW_SCOPE(vm);

</span><del>-    JSTestGlobalObjectPrototype* domObject = jsDynamicDowncast&lt;JSTestGlobalObjectPrototype*&gt;(JSValue::decode(thisValue));

</del><ins>+    JSTestGlobalObjectPrototype* domObject = jsDynamicDowncast&lt;JSTestGlobalObjectPrototype*&gt;(vm, JSValue::decode(thisValue));

</ins><span class="cx">     if (UNLIKELY(!domObject))

</span><span class="cx">         return throwVMTypeError(state, throwScope);

</span><span class="cx">     return JSValue::encode(JSTestGlobalObject::getConstructor(state-&gt;vm(), domObject-&gt;globalObject()));

</span><span class="lines">@@ -273,7 +273,7 @@

</span><span class="cx">     VM&amp; vm = state-&gt;vm();

</span><span class="cx">     auto throwScope = DECLARE_THROW_SCOPE(vm);

</span><span class="cx">     JSValue value = JSValue::decode(encodedValue);

</span><del>-    JSTestGlobalObjectPrototype* domObject = jsDynamicDowncast&lt;JSTestGlobalObjectPrototype*&gt;(JSValue::decode(thisValue));

</del><ins>+    JSTestGlobalObjectPrototype* domObject = jsDynamicDowncast&lt;JSTestGlobalObjectPrototype*&gt;(vm, JSValue::decode(thisValue));

</ins><span class="cx">     if (UNLIKELY(!domObject)) {

</span><span class="cx">         throwVMTypeError(state, throwScope);

</span><span class="cx">         return false;

</span><span class="lines">@@ -545,9 +545,9 @@

</span><span class="cx">     return wrap(state, globalObject, impl);

</span><span class="cx"> }

</span><span class="cx"> 

</span><del>-TestGlobalObject* JSTestGlobalObject::toWrapped(JSC::JSValue value)

</del><ins>+TestGlobalObject* JSTestGlobalObject::toWrapped(JSC::VM&amp; vm, JSC::JSValue value)

</ins><span class="cx"> {

</span><del>-    if (auto* wrapper = jsDynamicDowncast&lt;JSTestGlobalObject*&gt;(value))

</del><ins>+    if (auto* wrapper = jsDynamicDowncast&lt;JSTestGlobalObject*&gt;(vm, value))

</ins><span class="cx">         return &amp;wrapper-&gt;wrapped();

</span><span class="cx">     return nullptr;

</span><span class="cx"> }

</span></span></pre></div>

<a id="trunkSourceWebCorebindingsscriptstestJSJSTestGlobalObjecth"></a>

<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/scripts/test/JS/JSTestGlobalObject.h (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/WebCore/bindings/scripts/test/JS/JSTestGlobalObject.h        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/WebCore/bindings/scripts/test/JS/JSTestGlobalObject.h        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -40,7 +40,7 @@

</span><span class="cx"> 

</span><span class="cx">     static const bool needsDestruction = false;

</span><span class="cx"> 

</span><del>-    static TestGlobalObject* toWrapped(JSC::JSValue);

</del><ins>+    static TestGlobalObject* toWrapped(JSC::VM&amp;, JSC::JSValue);

</ins><span class="cx">     static void destroy(JSC::JSCell*);

</span><span class="cx"> 

</span><span class="cx">     DECLARE_INFO;

</span></span></pre></div>

<a id="trunkSourceWebCorebindingsscriptstestJSJSTestInterfacecpp"></a>

<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/scripts/test/JS/JSTestInterface.cpp (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/WebCore/bindings/scripts/test/JS/JSTestInterface.cpp        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/WebCore/bindings/scripts/test/JS/JSTestInterface.cpp        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -378,7 +378,7 @@

</span><span class="cx"> void JSTestInterface::finishCreation(VM&amp; vm)

</span><span class="cx"> {

</span><span class="cx">     Base::finishCreation(vm);

</span><del>-    ASSERT(inherits(info()));

</del><ins>+    ASSERT(inherits(vm, info()));

</ins><span class="cx"> 

</span><span class="cx"> }

</span><span class="cx"> 

</span><span class="lines">@@ -420,14 +420,14 @@

</span><span class="cx">     return Base::putByIndex(cell, state, index, value, shouldThrow);

</span><span class="cx"> }

</span><span class="cx"> 

</span><del>-template&lt;&gt; inline JSTestInterface* BindingCaller&lt;JSTestInterface&gt;::castForAttribute(ExecState&amp;, EncodedJSValue thisValue)

</del><ins>+template&lt;&gt; inline JSTestInterface* BindingCaller&lt;JSTestInterface&gt;::castForAttribute(ExecState&amp; state, EncodedJSValue thisValue)

</ins><span class="cx"> {

</span><del>-    return jsDynamicDowncast&lt;JSTestInterface*&gt;(JSValue::decode(thisValue));

</del><ins>+    return jsDynamicDowncast&lt;JSTestInterface*&gt;(state.vm(), JSValue::decode(thisValue));

</ins><span class="cx"> }

</span><span class="cx"> 

</span><span class="cx"> template&lt;&gt; inline JSTestInterface* BindingCaller&lt;JSTestInterface&gt;::castForOperation(ExecState&amp; state)

</span><span class="cx"> {

</span><del>-    return jsDynamicDowncast&lt;JSTestInterface*&gt;(state.thisValue());

</del><ins>+    return jsDynamicDowncast&lt;JSTestInterface*&gt;(state.vm(), state.thisValue());

</ins><span class="cx"> }

</span><span class="cx"> 

</span><span class="cx"> #if ENABLE(Condition22) || ENABLE(Condition23)

</span><span class="lines">@@ -654,7 +654,7 @@

</span><span class="cx"> {

</span><span class="cx">     VM&amp; vm = state-&gt;vm();

</span><span class="cx">     auto throwScope = DECLARE_THROW_SCOPE(vm);

</span><del>-    JSTestInterfacePrototype* domObject = jsDynamicDowncast&lt;JSTestInterfacePrototype*&gt;(JSValue::decode(thisValue));

</del><ins>+    JSTestInterfacePrototype* domObject = jsDynamicDowncast&lt;JSTestInterfacePrototype*&gt;(vm, JSValue::decode(thisValue));

</ins><span class="cx">     if (UNLIKELY(!domObject))

</span><span class="cx">         return throwVMTypeError(state, throwScope);

</span><span class="cx">     return JSValue::encode(JSTestInterface::getConstructor(state-&gt;vm(), domObject-&gt;globalObject()));

</span><span class="lines">@@ -665,7 +665,7 @@

</span><span class="cx">     VM&amp; vm = state-&gt;vm();

</span><span class="cx">     auto throwScope = DECLARE_THROW_SCOPE(vm);

</span><span class="cx">     JSValue value = JSValue::decode(encodedValue);

</span><del>-    JSTestInterfacePrototype* domObject = jsDynamicDowncast&lt;JSTestInterfacePrototype*&gt;(JSValue::decode(thisValue));

</del><ins>+    JSTestInterfacePrototype* domObject = jsDynamicDowncast&lt;JSTestInterfacePrototype*&gt;(vm, JSValue::decode(thisValue));

</ins><span class="cx">     if (UNLIKELY(!domObject)) {

</span><span class="cx">         throwVMTypeError(state, throwScope);

</span><span class="cx">         return false;

</span><span class="lines">@@ -1012,9 +1012,9 @@

</span><span class="cx">     return wrap(state, globalObject, impl);

</span><span class="cx"> }

</span><span class="cx"> 

</span><del>-TestInterface* JSTestInterface::toWrapped(JSC::JSValue value)

</del><ins>+TestInterface* JSTestInterface::toWrapped(JSC::VM&amp; vm, JSC::JSValue value)

</ins><span class="cx"> {

</span><del>-    if (auto* wrapper = jsDynamicDowncast&lt;JSTestInterface*&gt;(value))

</del><ins>+    if (auto* wrapper = jsDynamicDowncast&lt;JSTestInterface*&gt;(vm, value))

</ins><span class="cx">         return &amp;wrapper-&gt;wrapped();

</span><span class="cx">     return nullptr;

</span><span class="cx"> }

</span></span></pre></div>

<a id="trunkSourceWebCorebindingsscriptstestJSJSTestInterfaceh"></a>

<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/scripts/test/JS/JSTestInterface.h (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/WebCore/bindings/scripts/test/JS/JSTestInterface.h        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/WebCore/bindings/scripts/test/JS/JSTestInterface.h        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -40,7 +40,7 @@

</span><span class="cx"> 

</span><span class="cx">     static JSC::JSObject* createPrototype(JSC::VM&amp;, JSC::JSGlobalObject*);

</span><span class="cx">     static JSC::JSObject* prototype(JSC::VM&amp;, JSC::JSGlobalObject*);

</span><del>-    static TestInterface* toWrapped(JSC::JSValue);

</del><ins>+    static TestInterface* toWrapped(JSC::VM&amp;, JSC::JSValue);

</ins><span class="cx">     static bool put(JSC::JSCell*, JSC::ExecState*, JSC::PropertyName, JSC::JSValue, JSC::PutPropertySlot&amp;);

</span><span class="cx">     static bool putByIndex(JSC::JSCell*, JSC::ExecState*, unsigned propertyName, JSC::JSValue, bool shouldThrow);

</span><span class="cx">     static void destroy(JSC::JSCell*);

</span></span></pre></div>

<a id="trunkSourceWebCorebindingsscriptstestJSJSTestInterfaceLeadingUnderscorecpp"></a>

<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/scripts/test/JS/JSTestInterfaceLeadingUnderscore.cpp (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/WebCore/bindings/scripts/test/JS/JSTestInterfaceLeadingUnderscore.cpp        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/WebCore/bindings/scripts/test/JS/JSTestInterfaceLeadingUnderscore.cpp        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -105,7 +105,7 @@

</span><span class="cx"> void JSTestInterfaceLeadingUnderscore::finishCreation(VM&amp; vm)

</span><span class="cx"> {

</span><span class="cx">     Base::finishCreation(vm);

</span><del>-    ASSERT(inherits(info()));

</del><ins>+    ASSERT(inherits(vm, info()));

</ins><span class="cx"> 

</span><span class="cx"> }

</span><span class="cx"> 

</span><span class="lines">@@ -125,9 +125,9 @@

</span><span class="cx">     thisObject-&gt;JSTestInterfaceLeadingUnderscore::~JSTestInterfaceLeadingUnderscore();

</span><span class="cx"> }

</span><span class="cx"> 

</span><del>-template&lt;&gt; inline JSTestInterfaceLeadingUnderscore* BindingCaller&lt;JSTestInterfaceLeadingUnderscore&gt;::castForAttribute(ExecState&amp;, EncodedJSValue thisValue)

</del><ins>+template&lt;&gt; inline JSTestInterfaceLeadingUnderscore* BindingCaller&lt;JSTestInterfaceLeadingUnderscore&gt;::castForAttribute(ExecState&amp; state, EncodedJSValue thisValue)

</ins><span class="cx"> {

</span><del>-    return jsDynamicDowncast&lt;JSTestInterfaceLeadingUnderscore*&gt;(JSValue::decode(thisValue));

</del><ins>+    return jsDynamicDowncast&lt;JSTestInterfaceLeadingUnderscore*&gt;(state.vm(), JSValue::decode(thisValue));

</ins><span class="cx"> }

</span><span class="cx"> 

</span><span class="cx"> static inline JSValue jsTestInterfaceLeadingUnderscoreReadonlyGetter(ExecState&amp;, JSTestInterfaceLeadingUnderscore&amp;, ThrowScope&amp; throwScope);

</span><span class="lines">@@ -150,7 +150,7 @@

</span><span class="cx"> {

</span><span class="cx">     VM&amp; vm = state-&gt;vm();

</span><span class="cx">     auto throwScope = DECLARE_THROW_SCOPE(vm);

</span><del>-    JSTestInterfaceLeadingUnderscorePrototype* domObject = jsDynamicDowncast&lt;JSTestInterfaceLeadingUnderscorePrototype*&gt;(JSValue::decode(thisValue));

</del><ins>+    JSTestInterfaceLeadingUnderscorePrototype* domObject = jsDynamicDowncast&lt;JSTestInterfaceLeadingUnderscorePrototype*&gt;(vm, JSValue::decode(thisValue));

</ins><span class="cx">     if (UNLIKELY(!domObject))

</span><span class="cx">         return throwVMTypeError(state, throwScope);

</span><span class="cx">     return JSValue::encode(JSTestInterfaceLeadingUnderscore::getConstructor(state-&gt;vm(), domObject-&gt;globalObject()));

</span><span class="lines">@@ -161,7 +161,7 @@

</span><span class="cx">     VM&amp; vm = state-&gt;vm();

</span><span class="cx">     auto throwScope = DECLARE_THROW_SCOPE(vm);

</span><span class="cx">     JSValue value = JSValue::decode(encodedValue);

</span><del>-    JSTestInterfaceLeadingUnderscorePrototype* domObject = jsDynamicDowncast&lt;JSTestInterfaceLeadingUnderscorePrototype*&gt;(JSValue::decode(thisValue));

</del><ins>+    JSTestInterfaceLeadingUnderscorePrototype* domObject = jsDynamicDowncast&lt;JSTestInterfaceLeadingUnderscorePrototype*&gt;(vm, JSValue::decode(thisValue));

</ins><span class="cx">     if (UNLIKELY(!domObject)) {

</span><span class="cx">         throwVMTypeError(state, throwScope);

</span><span class="cx">         return false;

</span><span class="lines">@@ -206,9 +206,9 @@

</span><span class="cx">     return wrap(state, globalObject, impl);

</span><span class="cx"> }

</span><span class="cx"> 

</span><del>-TestInterfaceLeadingUnderscore* JSTestInterfaceLeadingUnderscore::toWrapped(JSC::JSValue value)

</del><ins>+TestInterfaceLeadingUnderscore* JSTestInterfaceLeadingUnderscore::toWrapped(JSC::VM&amp; vm, JSC::JSValue value)

</ins><span class="cx"> {

</span><del>-    if (auto* wrapper = jsDynamicDowncast&lt;JSTestInterfaceLeadingUnderscore*&gt;(value))

</del><ins>+    if (auto* wrapper = jsDynamicDowncast&lt;JSTestInterfaceLeadingUnderscore*&gt;(vm, value))

</ins><span class="cx">         return &amp;wrapper-&gt;wrapped();

</span><span class="cx">     return nullptr;

</span><span class="cx"> }

</span></span></pre></div>

<a id="trunkSourceWebCorebindingsscriptstestJSJSTestInterfaceLeadingUnderscoreh"></a>

<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/scripts/test/JS/JSTestInterfaceLeadingUnderscore.h (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/WebCore/bindings/scripts/test/JS/JSTestInterfaceLeadingUnderscore.h        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/WebCore/bindings/scripts/test/JS/JSTestInterfaceLeadingUnderscore.h        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -38,7 +38,7 @@

</span><span class="cx"> 

</span><span class="cx">     static JSC::JSObject* createPrototype(JSC::VM&amp;, JSC::JSGlobalObject*);

</span><span class="cx">     static JSC::JSObject* prototype(JSC::VM&amp;, JSC::JSGlobalObject*);

</span><del>-    static TestInterfaceLeadingUnderscore* toWrapped(JSC::JSValue);

</del><ins>+    static TestInterfaceLeadingUnderscore* toWrapped(JSC::VM&amp;, JSC::JSValue);

</ins><span class="cx">     static void destroy(JSC::JSCell*);

</span><span class="cx"> 

</span><span class="cx">     DECLARE_INFO;

</span></span></pre></div>

<a id="trunkSourceWebCorebindingsscriptstestJSJSTestIterablecpp"></a>

<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/scripts/test/JS/JSTestIterable.cpp (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/WebCore/bindings/scripts/test/JS/JSTestIterable.cpp        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/WebCore/bindings/scripts/test/JS/JSTestIterable.cpp        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -116,7 +116,7 @@

</span><span class="cx"> void JSTestIterable::finishCreation(VM&amp; vm)

</span><span class="cx"> {

</span><span class="cx">     Base::finishCreation(vm);

</span><del>-    ASSERT(inherits(info()));

</del><ins>+    ASSERT(inherits(vm, info()));

</ins><span class="cx"> 

</span><span class="cx"> }

</span><span class="cx"> 

</span><span class="lines">@@ -138,7 +138,7 @@

</span><span class="cx"> 

</span><span class="cx"> template&lt;&gt; inline JSTestIterable* BindingCaller&lt;JSTestIterable&gt;::castForOperation(ExecState&amp; state)

</span><span class="cx"> {

</span><del>-    return jsDynamicDowncast&lt;JSTestIterable*&gt;(state.thisValue());

</del><ins>+    return jsDynamicDowncast&lt;JSTestIterable*&gt;(state.vm(), state.thisValue());

</ins><span class="cx"> }

</span><span class="cx"> 

</span><span class="cx"> EncodedJSValue jsTestIterableConstructor(ExecState* state, EncodedJSValue thisValue, PropertyName)

</span><span class="lines">@@ -145,7 +145,7 @@

</span><span class="cx"> {

</span><span class="cx">     VM&amp; vm = state-&gt;vm();

</span><span class="cx">     auto throwScope = DECLARE_THROW_SCOPE(vm);

</span><del>-    JSTestIterablePrototype* domObject = jsDynamicDowncast&lt;JSTestIterablePrototype*&gt;(JSValue::decode(thisValue));

</del><ins>+    JSTestIterablePrototype* domObject = jsDynamicDowncast&lt;JSTestIterablePrototype*&gt;(vm, JSValue::decode(thisValue));

</ins><span class="cx">     if (UNLIKELY(!domObject))

</span><span class="cx">         return throwVMTypeError(state, throwScope);

</span><span class="cx">     return JSValue::encode(JSTestIterable::getConstructor(state-&gt;vm(), domObject-&gt;globalObject()));

</span><span class="lines">@@ -156,7 +156,7 @@

</span><span class="cx">     VM&amp; vm = state-&gt;vm();

</span><span class="cx">     auto throwScope = DECLARE_THROW_SCOPE(vm);

</span><span class="cx">     JSValue value = JSValue::decode(encodedValue);

</span><del>-    JSTestIterablePrototype* domObject = jsDynamicDowncast&lt;JSTestIterablePrototype*&gt;(JSValue::decode(thisValue));

</del><ins>+    JSTestIterablePrototype* domObject = jsDynamicDowncast&lt;JSTestIterablePrototype*&gt;(vm, JSValue::decode(thisValue));

</ins><span class="cx">     if (UNLIKELY(!domObject)) {

</span><span class="cx">         throwVMTypeError(state, throwScope);

</span><span class="cx">         return false;

</span><span class="lines">@@ -287,9 +287,9 @@

</span><span class="cx">     return wrap(state, globalObject, impl);

</span><span class="cx"> }

</span><span class="cx"> 

</span><del>-TestIterable* JSTestIterable::toWrapped(JSC::JSValue value)

</del><ins>+TestIterable* JSTestIterable::toWrapped(JSC::VM&amp; vm, JSC::JSValue value)

</ins><span class="cx"> {

</span><del>-    if (auto* wrapper = jsDynamicDowncast&lt;JSTestIterable*&gt;(value))

</del><ins>+    if (auto* wrapper = jsDynamicDowncast&lt;JSTestIterable*&gt;(vm, value))

</ins><span class="cx">         return &amp;wrapper-&gt;wrapped();

</span><span class="cx">     return nullptr;

</span><span class="cx"> }

</span></span></pre></div>

<a id="trunkSourceWebCorebindingsscriptstestJSJSTestIterableh"></a>

<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/scripts/test/JS/JSTestIterable.h (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/WebCore/bindings/scripts/test/JS/JSTestIterable.h        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/WebCore/bindings/scripts/test/JS/JSTestIterable.h        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -38,7 +38,7 @@

</span><span class="cx"> 

</span><span class="cx">     static JSC::JSObject* createPrototype(JSC::VM&amp;, JSC::JSGlobalObject*);

</span><span class="cx">     static JSC::JSObject* prototype(JSC::VM&amp;, JSC::JSGlobalObject*);

</span><del>-    static TestIterable* toWrapped(JSC::JSValue);

</del><ins>+    static TestIterable* toWrapped(JSC::VM&amp;, JSC::JSValue);

</ins><span class="cx">     static void destroy(JSC::JSCell*);

</span><span class="cx"> 

</span><span class="cx">     DECLARE_INFO;

</span></span></pre></div>

<a id="trunkSourceWebCorebindingsscriptstestJSJSTestJSBuiltinConstructorcpp"></a>

<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/scripts/test/JS/JSTestJSBuiltinConstructor.cpp (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/WebCore/bindings/scripts/test/JS/JSTestJSBuiltinConstructor.cpp        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/WebCore/bindings/scripts/test/JS/JSTestJSBuiltinConstructor.cpp        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -119,7 +119,7 @@

</span><span class="cx"> void JSTestJSBuiltinConstructor::finishCreation(VM&amp; vm)

</span><span class="cx"> {

</span><span class="cx">     Base::finishCreation(vm);

</span><del>-    ASSERT(inherits(info()));

</del><ins>+    ASSERT(inherits(vm, info()));

</ins><span class="cx"> 

</span><span class="cx"> }

</span><span class="cx"> 

</span><span class="lines">@@ -139,14 +139,14 @@

</span><span class="cx">     thisObject-&gt;JSTestJSBuiltinConstructor::~JSTestJSBuiltinConstructor();

</span><span class="cx"> }

</span><span class="cx"> 

</span><del>-template&lt;&gt; inline JSTestJSBuiltinConstructor* BindingCaller&lt;JSTestJSBuiltinConstructor&gt;::castForAttribute(ExecState&amp;, EncodedJSValue thisValue)

</del><ins>+template&lt;&gt; inline JSTestJSBuiltinConstructor* BindingCaller&lt;JSTestJSBuiltinConstructor&gt;::castForAttribute(ExecState&amp; state, EncodedJSValue thisValue)

</ins><span class="cx"> {

</span><del>-    return jsDynamicDowncast&lt;JSTestJSBuiltinConstructor*&gt;(JSValue::decode(thisValue));

</del><ins>+    return jsDynamicDowncast&lt;JSTestJSBuiltinConstructor*&gt;(state.vm(), JSValue::decode(thisValue));

</ins><span class="cx"> }

</span><span class="cx"> 

</span><span class="cx"> template&lt;&gt; inline JSTestJSBuiltinConstructor* BindingCaller&lt;JSTestJSBuiltinConstructor&gt;::castForOperation(ExecState&amp; state)

</span><span class="cx"> {

</span><del>-    return jsDynamicDowncast&lt;JSTestJSBuiltinConstructor*&gt;(state.thisValue());

</del><ins>+    return jsDynamicDowncast&lt;JSTestJSBuiltinConstructor*&gt;(state.vm(), state.thisValue());

</ins><span class="cx"> }

</span><span class="cx"> 

</span><span class="cx"> static inline JSValue jsTestJSBuiltinConstructorTestAttributeCustomGetter(ExecState&amp;, JSTestJSBuiltinConstructor&amp;, ThrowScope&amp; throwScope);

</span><span class="lines">@@ -181,7 +181,7 @@

</span><span class="cx"> {

</span><span class="cx">     VM&amp; vm = state-&gt;vm();

</span><span class="cx">     auto throwScope = DECLARE_THROW_SCOPE(vm);

</span><del>-    JSTestJSBuiltinConstructorPrototype* domObject = jsDynamicDowncast&lt;JSTestJSBuiltinConstructorPrototype*&gt;(JSValue::decode(thisValue));

</del><ins>+    JSTestJSBuiltinConstructorPrototype* domObject = jsDynamicDowncast&lt;JSTestJSBuiltinConstructorPrototype*&gt;(vm, JSValue::decode(thisValue));

</ins><span class="cx">     if (UNLIKELY(!domObject))

</span><span class="cx">         return throwVMTypeError(state, throwScope);

</span><span class="cx">     return JSValue::encode(JSTestJSBuiltinConstructor::getConstructor(state-&gt;vm(), domObject-&gt;globalObject()));

</span><span class="lines">@@ -192,7 +192,7 @@

</span><span class="cx">     VM&amp; vm = state-&gt;vm();

</span><span class="cx">     auto throwScope = DECLARE_THROW_SCOPE(vm);

</span><span class="cx">     JSValue value = JSValue::decode(encodedValue);

</span><del>-    JSTestJSBuiltinConstructorPrototype* domObject = jsDynamicDowncast&lt;JSTestJSBuiltinConstructorPrototype*&gt;(JSValue::decode(thisValue));

</del><ins>+    JSTestJSBuiltinConstructorPrototype* domObject = jsDynamicDowncast&lt;JSTestJSBuiltinConstructorPrototype*&gt;(vm, JSValue::decode(thisValue));

</ins><span class="cx">     if (UNLIKELY(!domObject)) {

</span><span class="cx">         throwVMTypeError(state, throwScope);

</span><span class="cx">         return false;

</span></span></pre></div>

<a id="trunkSourceWebCorebindingsscriptstestJSJSTestMediaQueryListListenercpp"></a>

<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/scripts/test/JS/JSTestMediaQueryListListener.cpp (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/WebCore/bindings/scripts/test/JS/JSTestMediaQueryListListener.cpp        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/WebCore/bindings/scripts/test/JS/JSTestMediaQueryListListener.cpp        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -110,7 +110,7 @@

</span><span class="cx"> void JSTestMediaQueryListListener::finishCreation(VM&amp; vm)

</span><span class="cx"> {

</span><span class="cx">     Base::finishCreation(vm);

</span><del>-    ASSERT(inherits(info()));

</del><ins>+    ASSERT(inherits(vm, info()));

</ins><span class="cx"> 

</span><span class="cx"> }

</span><span class="cx"> 

</span><span class="lines">@@ -132,7 +132,7 @@

</span><span class="cx"> 

</span><span class="cx"> template&lt;&gt; inline JSTestMediaQueryListListener* BindingCaller&lt;JSTestMediaQueryListListener&gt;::castForOperation(ExecState&amp; state)

</span><span class="cx"> {

</span><del>-    return jsDynamicDowncast&lt;JSTestMediaQueryListListener*&gt;(state.thisValue());

</del><ins>+    return jsDynamicDowncast&lt;JSTestMediaQueryListListener*&gt;(state.vm(), state.thisValue());

</ins><span class="cx"> }

</span><span class="cx"> 

</span><span class="cx"> EncodedJSValue jsTestMediaQueryListListenerConstructor(ExecState* state, EncodedJSValue thisValue, PropertyName)

</span><span class="lines">@@ -139,7 +139,7 @@

</span><span class="cx"> {

</span><span class="cx">     VM&amp; vm = state-&gt;vm();

</span><span class="cx">     auto throwScope = DECLARE_THROW_SCOPE(vm);

</span><del>-    JSTestMediaQueryListListenerPrototype* domObject = jsDynamicDowncast&lt;JSTestMediaQueryListListenerPrototype*&gt;(JSValue::decode(thisValue));

</del><ins>+    JSTestMediaQueryListListenerPrototype* domObject = jsDynamicDowncast&lt;JSTestMediaQueryListListenerPrototype*&gt;(vm, JSValue::decode(thisValue));

</ins><span class="cx">     if (UNLIKELY(!domObject))

</span><span class="cx">         return throwVMTypeError(state, throwScope);

</span><span class="cx">     return JSValue::encode(JSTestMediaQueryListListener::getConstructor(state-&gt;vm(), domObject-&gt;globalObject()));

</span><span class="lines">@@ -150,7 +150,7 @@

</span><span class="cx">     VM&amp; vm = state-&gt;vm();

</span><span class="cx">     auto throwScope = DECLARE_THROW_SCOPE(vm);

</span><span class="cx">     JSValue value = JSValue::decode(encodedValue);

</span><del>-    JSTestMediaQueryListListenerPrototype* domObject = jsDynamicDowncast&lt;JSTestMediaQueryListListenerPrototype*&gt;(JSValue::decode(thisValue));

</del><ins>+    JSTestMediaQueryListListenerPrototype* domObject = jsDynamicDowncast&lt;JSTestMediaQueryListListenerPrototype*&gt;(vm, JSValue::decode(thisValue));

</ins><span class="cx">     if (UNLIKELY(!domObject)) {

</span><span class="cx">         throwVMTypeError(state, throwScope);

</span><span class="cx">         return false;

</span><span class="lines">@@ -236,9 +236,9 @@

</span><span class="cx">     return wrap(state, globalObject, impl);

</span><span class="cx"> }

</span><span class="cx"> 

</span><del>-TestMediaQueryListListener* JSTestMediaQueryListListener::toWrapped(JSC::JSValue value)

</del><ins>+TestMediaQueryListListener* JSTestMediaQueryListListener::toWrapped(JSC::VM&amp; vm, JSC::JSValue value)

</ins><span class="cx"> {

</span><del>-    if (auto* wrapper = jsDynamicDowncast&lt;JSTestMediaQueryListListener*&gt;(value))

</del><ins>+    if (auto* wrapper = jsDynamicDowncast&lt;JSTestMediaQueryListListener*&gt;(vm, value))

</ins><span class="cx">         return &amp;wrapper-&gt;wrapped();

</span><span class="cx">     return nullptr;

</span><span class="cx"> }

</span></span></pre></div>

<a id="trunkSourceWebCorebindingsscriptstestJSJSTestMediaQueryListListenerh"></a>

<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/scripts/test/JS/JSTestMediaQueryListListener.h (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/WebCore/bindings/scripts/test/JS/JSTestMediaQueryListListener.h        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/WebCore/bindings/scripts/test/JS/JSTestMediaQueryListListener.h        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -38,7 +38,7 @@

</span><span class="cx"> 

</span><span class="cx">     static JSC::JSObject* createPrototype(JSC::VM&amp;, JSC::JSGlobalObject*);

</span><span class="cx">     static JSC::JSObject* prototype(JSC::VM&amp;, JSC::JSGlobalObject*);

</span><del>-    static TestMediaQueryListListener* toWrapped(JSC::JSValue);

</del><ins>+    static TestMediaQueryListListener* toWrapped(JSC::VM&amp;, JSC::JSValue);

</ins><span class="cx">     static void destroy(JSC::JSCell*);

</span><span class="cx"> 

</span><span class="cx">     DECLARE_INFO;

</span></span></pre></div>

<a id="trunkSourceWebCorebindingsscriptstestJSJSTestNamedConstructorcpp"></a>

<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/scripts/test/JS/JSTestNamedConstructor.cpp (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/WebCore/bindings/scripts/test/JS/JSTestNamedConstructor.cpp        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/WebCore/bindings/scripts/test/JS/JSTestNamedConstructor.cpp        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -139,7 +139,7 @@

</span><span class="cx"> void JSTestNamedConstructor::finishCreation(VM&amp; vm)

</span><span class="cx"> {

</span><span class="cx">     Base::finishCreation(vm);

</span><del>-    ASSERT(inherits(info()));

</del><ins>+    ASSERT(inherits(vm, info()));

</ins><span class="cx"> 

</span><span class="cx"> }

</span><span class="cx"> 

</span><span class="lines">@@ -163,7 +163,7 @@

</span><span class="cx"> {

</span><span class="cx">     VM&amp; vm = state-&gt;vm();

</span><span class="cx">     auto throwScope = DECLARE_THROW_SCOPE(vm);

</span><del>-    JSTestNamedConstructorPrototype* domObject = jsDynamicDowncast&lt;JSTestNamedConstructorPrototype*&gt;(JSValue::decode(thisValue));

</del><ins>+    JSTestNamedConstructorPrototype* domObject = jsDynamicDowncast&lt;JSTestNamedConstructorPrototype*&gt;(vm, JSValue::decode(thisValue));

</ins><span class="cx">     if (UNLIKELY(!domObject))

</span><span class="cx">         return throwVMTypeError(state, throwScope);

</span><span class="cx">     return JSValue::encode(JSTestNamedConstructor::getConstructor(state-&gt;vm(), domObject-&gt;globalObject()));

</span><span class="lines">@@ -174,7 +174,7 @@

</span><span class="cx">     VM&amp; vm = state-&gt;vm();

</span><span class="cx">     auto throwScope = DECLARE_THROW_SCOPE(vm);

</span><span class="cx">     JSValue value = JSValue::decode(encodedValue);

</span><del>-    JSTestNamedConstructorPrototype* domObject = jsDynamicDowncast&lt;JSTestNamedConstructorPrototype*&gt;(JSValue::decode(thisValue));

</del><ins>+    JSTestNamedConstructorPrototype* domObject = jsDynamicDowncast&lt;JSTestNamedConstructorPrototype*&gt;(vm, JSValue::decode(thisValue));

</ins><span class="cx">     if (UNLIKELY(!domObject)) {

</span><span class="cx">         throwVMTypeError(state, throwScope);

</span><span class="cx">         return false;

</span><span class="lines">@@ -247,9 +247,9 @@

</span><span class="cx">     return wrap(state, globalObject, impl);

</span><span class="cx"> }

</span><span class="cx"> 

</span><del>-TestNamedConstructor* JSTestNamedConstructor::toWrapped(JSC::JSValue value)

</del><ins>+TestNamedConstructor* JSTestNamedConstructor::toWrapped(JSC::VM&amp; vm, JSC::JSValue value)

</ins><span class="cx"> {

</span><del>-    if (auto* wrapper = jsDynamicDowncast&lt;JSTestNamedConstructor*&gt;(value))

</del><ins>+    if (auto* wrapper = jsDynamicDowncast&lt;JSTestNamedConstructor*&gt;(vm, value))

</ins><span class="cx">         return &amp;wrapper-&gt;wrapped();

</span><span class="cx">     return nullptr;

</span><span class="cx"> }

</span></span></pre></div>

<a id="trunkSourceWebCorebindingsscriptstestJSJSTestNamedConstructorh"></a>

<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/scripts/test/JS/JSTestNamedConstructor.h (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/WebCore/bindings/scripts/test/JS/JSTestNamedConstructor.h        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/WebCore/bindings/scripts/test/JS/JSTestNamedConstructor.h        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -38,7 +38,7 @@

</span><span class="cx"> 

</span><span class="cx">     static JSC::JSObject* createPrototype(JSC::VM&amp;, JSC::JSGlobalObject*);

</span><span class="cx">     static JSC::JSObject* prototype(JSC::VM&amp;, JSC::JSGlobalObject*);

</span><del>-    static TestNamedConstructor* toWrapped(JSC::JSValue);

</del><ins>+    static TestNamedConstructor* toWrapped(JSC::VM&amp;, JSC::JSValue);

</ins><span class="cx">     static void destroy(JSC::JSCell*);

</span><span class="cx"> 

</span><span class="cx">     DECLARE_INFO;

</span></span></pre></div>

<a id="trunkSourceWebCorebindingsscriptstestJSJSTestNodecpp"></a>

<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/scripts/test/JS/JSTestNode.cpp (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/WebCore/bindings/scripts/test/JS/JSTestNode.cpp        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/WebCore/bindings/scripts/test/JS/JSTestNode.cpp        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -157,7 +157,7 @@

</span><span class="cx"> void JSTestNode::finishCreation(VM&amp; vm)

</span><span class="cx"> {

</span><span class="cx">     Base::finishCreation(vm);

</span><del>-    ASSERT(inherits(info()));

</del><ins>+    ASSERT(inherits(vm, info()));

</ins><span class="cx"> 

</span><span class="cx"> }

</span><span class="cx"> 

</span><span class="lines">@@ -171,14 +171,14 @@

</span><span class="cx">     return getDOMPrototype&lt;JSTestNode&gt;(vm, globalObject);

</span><span class="cx"> }

</span><span class="cx"> 

</span><del>-template&lt;&gt; inline JSTestNode* BindingCaller&lt;JSTestNode&gt;::castForAttribute(ExecState&amp;, EncodedJSValue thisValue)

</del><ins>+template&lt;&gt; inline JSTestNode* BindingCaller&lt;JSTestNode&gt;::castForAttribute(ExecState&amp; state, EncodedJSValue thisValue)

</ins><span class="cx"> {

</span><del>-    return jsDynamicDowncast&lt;JSTestNode*&gt;(JSValue::decode(thisValue));

</del><ins>+    return jsDynamicDowncast&lt;JSTestNode*&gt;(state.vm(), JSValue::decode(thisValue));

</ins><span class="cx"> }

</span><span class="cx"> 

</span><span class="cx"> template&lt;&gt; inline JSTestNode* BindingCaller&lt;JSTestNode&gt;::castForOperation(ExecState&amp; state)

</span><span class="cx"> {

</span><del>-    return jsDynamicDowncast&lt;JSTestNode*&gt;(state.thisValue());

</del><ins>+    return jsDynamicDowncast&lt;JSTestNode*&gt;(state.vm(), state.thisValue());

</ins><span class="cx"> }

</span><span class="cx"> 

</span><span class="cx"> static inline JSValue jsTestNodeNameGetter(ExecState&amp;, JSTestNode&amp;, ThrowScope&amp; throwScope);

</span><span class="lines">@@ -201,7 +201,7 @@

</span><span class="cx"> {

</span><span class="cx">     VM&amp; vm = state-&gt;vm();

</span><span class="cx">     auto throwScope = DECLARE_THROW_SCOPE(vm);

</span><del>-    JSTestNodePrototype* domObject = jsDynamicDowncast&lt;JSTestNodePrototype*&gt;(JSValue::decode(thisValue));

</del><ins>+    JSTestNodePrototype* domObject = jsDynamicDowncast&lt;JSTestNodePrototype*&gt;(vm, JSValue::decode(thisValue));

</ins><span class="cx">     if (UNLIKELY(!domObject))

</span><span class="cx">         return throwVMTypeError(state, throwScope);

</span><span class="cx">     return JSValue::encode(JSTestNode::getConstructor(state-&gt;vm(), domObject-&gt;globalObject()));

</span><span class="lines">@@ -212,7 +212,7 @@

</span><span class="cx">     VM&amp; vm = state-&gt;vm();

</span><span class="cx">     auto throwScope = DECLARE_THROW_SCOPE(vm);

</span><span class="cx">     JSValue value = JSValue::decode(encodedValue);

</span><del>-    JSTestNodePrototype* domObject = jsDynamicDowncast&lt;JSTestNodePrototype*&gt;(JSValue::decode(thisValue));

</del><ins>+    JSTestNodePrototype* domObject = jsDynamicDowncast&lt;JSTestNodePrototype*&gt;(vm, JSValue::decode(thisValue));

</ins><span class="cx">     if (UNLIKELY(!domObject)) {

</span><span class="cx">         throwVMTypeError(state, throwScope);

</span><span class="cx">         return false;

</span></span></pre></div>

<a id="trunkSourceWebCorebindingsscriptstestJSJSTestObjcpp"></a>

<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/scripts/test/JS/JSTestObj.cpp (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/WebCore/bindings/scripts/test/JS/JSTestObj.cpp        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/WebCore/bindings/scripts/test/JS/JSTestObj.cpp        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -1916,7 +1916,7 @@

</span><span class="cx"> void JSTestObj::finishCreation(VM&amp; vm)

</span><span class="cx"> {

</span><span class="cx">     Base::finishCreation(vm);

</span><del>-    ASSERT(inherits(info()));

</del><ins>+    ASSERT(inherits(vm, info()));

</ins><span class="cx"> 

</span><span class="cx"> }

</span><span class="cx"> 

</span><span class="lines">@@ -1971,14 +1971,14 @@

</span><span class="cx">     Base::getOwnPropertyNames(thisObject, state, propertyNames, mode);

</span><span class="cx"> }

</span><span class="cx"> 

</span><del>-template&lt;&gt; inline JSTestObj* BindingCaller&lt;JSTestObj&gt;::castForAttribute(ExecState&amp;, EncodedJSValue thisValue)

</del><ins>+template&lt;&gt; inline JSTestObj* BindingCaller&lt;JSTestObj&gt;::castForAttribute(ExecState&amp; state, EncodedJSValue thisValue)

</ins><span class="cx"> {

</span><del>-    return jsDynamicDowncast&lt;JSTestObj*&gt;(JSValue::decode(thisValue));

</del><ins>+    return jsDynamicDowncast&lt;JSTestObj*&gt;(state.vm(), JSValue::decode(thisValue));

</ins><span class="cx"> }

</span><span class="cx"> 

</span><span class="cx"> template&lt;&gt; inline JSTestObj* BindingCaller&lt;JSTestObj&gt;::castForOperation(ExecState&amp; state)

</span><span class="cx"> {

</span><del>-    return jsDynamicDowncast&lt;JSTestObj*&gt;(state.thisValue());

</del><ins>+    return jsDynamicDowncast&lt;JSTestObj*&gt;(state.vm(), state.thisValue());

</ins><span class="cx"> }

</span><span class="cx"> 

</span><span class="cx"> static inline JSValue jsTestObjReadOnlyLongAttrGetter(ExecState&amp;, JSTestObj&amp;, ThrowScope&amp; throwScope);

</span><span class="lines">@@ -3566,7 +3566,7 @@

</span><span class="cx"> {

</span><span class="cx">     VM&amp; vm = state-&gt;vm();

</span><span class="cx">     auto throwScope = DECLARE_THROW_SCOPE(vm);

</span><del>-    JSTestObjPrototype* domObject = jsDynamicDowncast&lt;JSTestObjPrototype*&gt;(JSValue::decode(thisValue));

</del><ins>+    JSTestObjPrototype* domObject = jsDynamicDowncast&lt;JSTestObjPrototype*&gt;(vm, JSValue::decode(thisValue));

</ins><span class="cx">     if (UNLIKELY(!domObject))

</span><span class="cx">         return throwVMTypeError(state, throwScope);

</span><span class="cx">     return JSValue::encode(JSTestObj::getConstructor(state-&gt;vm(), domObject-&gt;globalObject()));

</span><span class="lines">@@ -3577,7 +3577,7 @@

</span><span class="cx">     VM&amp; vm = state-&gt;vm();

</span><span class="cx">     auto throwScope = DECLARE_THROW_SCOPE(vm);

</span><span class="cx">     JSValue value = JSValue::decode(encodedValue);

</span><del>-    JSTestObjPrototype* domObject = jsDynamicDowncast&lt;JSTestObjPrototype*&gt;(JSValue::decode(thisValue));

</del><ins>+    JSTestObjPrototype* domObject = jsDynamicDowncast&lt;JSTestObjPrototype*&gt;(vm, JSValue::decode(thisValue));

</ins><span class="cx">     if (UNLIKELY(!domObject)) {

</span><span class="cx">         throwVMTypeError(state, throwScope);

</span><span class="cx">         return false;

</span><span class="lines">@@ -7209,17 +7209,17 @@

</span><span class="cx">         JSValue distinguishingArg = state-&gt;uncheckedArgument(0);

</span><span class="cx">         if (distinguishingArg.isUndefinedOrNull())

</span><span class="cx">             return jsTestObjPrototypeFunctionOverloadedMethod2(state);

</span><del>-        if (distinguishingArg.isObject() &amp;&amp; asObject(distinguishingArg)-&gt;inherits(JSTestObj::info()))

</del><ins>+        if (distinguishingArg.isObject() &amp;&amp; asObject(distinguishingArg)-&gt;inherits(vm, JSTestObj::info()))

</ins><span class="cx">             return jsTestObjPrototypeFunctionOverloadedMethod2(state);

</span><del>-        if (distinguishingArg.isObject() &amp;&amp; asObject(distinguishingArg)-&gt;inherits(JSTestCallbackInterface::info()))

</del><ins>+        if (distinguishingArg.isObject() &amp;&amp; asObject(distinguishingArg)-&gt;inherits(vm, JSTestCallbackInterface::info()))

</ins><span class="cx">             return jsTestObjPrototypeFunctionOverloadedMethod5(state);

</span><del>-        if (distinguishingArg.isObject() &amp;&amp; asObject(distinguishingArg)-&gt;inherits(JSDOMStringList::info()))

</del><ins>+        if (distinguishingArg.isObject() &amp;&amp; asObject(distinguishingArg)-&gt;inherits(vm, JSDOMStringList::info()))

</ins><span class="cx">             return jsTestObjPrototypeFunctionOverloadedMethod6(state);

</span><del>-        if (distinguishingArg.isObject() &amp;&amp; asObject(distinguishingArg)-&gt;inherits(JSTestObj::info()))

</del><ins>+        if (distinguishingArg.isObject() &amp;&amp; asObject(distinguishingArg)-&gt;inherits(vm, JSTestObj::info()))

</ins><span class="cx">             return jsTestObjPrototypeFunctionOverloadedMethod8(state);

</span><del>-        if (distinguishingArg.isObject() &amp;&amp; (asObject(distinguishingArg)-&gt;inherits(JSDOMWindowShell::info()) || asObject(distinguishingArg)-&gt;inherits(JSDOMWindow::info())))

</del><ins>+        if (distinguishingArg.isObject() &amp;&amp; (asObject(distinguishingArg)-&gt;inherits(vm, JSDOMWindowShell::info()) || asObject(distinguishingArg)-&gt;inherits(vm, JSDOMWindow::info())))

</ins><span class="cx">             return jsTestObjPrototypeFunctionOverloadedMethod9(state);

</span><del>-        if (distinguishingArg.isObject() &amp;&amp; asObject(distinguishingArg)-&gt;inherits(JSBlob::info()))

</del><ins>+        if (distinguishingArg.isObject() &amp;&amp; asObject(distinguishingArg)-&gt;inherits(vm, JSBlob::info()))

</ins><span class="cx">             return jsTestObjPrototypeFunctionOverloadedMethod13(state);

</span><span class="cx">         if (hasIteratorMethod(*state, distinguishingArg))

</span><span class="cx">             return jsTestObjPrototypeFunctionOverloadedMethod7(state);

</span><span class="lines">@@ -7233,7 +7233,7 @@

</span><span class="cx">         JSValue distinguishingArg = state-&gt;uncheckedArgument(1);

</span><span class="cx">         if (distinguishingArg.isUndefined())

</span><span class="cx">             return jsTestObjPrototypeFunctionOverloadedMethod2(state);

</span><del>-        if (distinguishingArg.isObject() &amp;&amp; asObject(distinguishingArg)-&gt;inherits(JSBlob::info()))

</del><ins>+        if (distinguishingArg.isObject() &amp;&amp; asObject(distinguishingArg)-&gt;inherits(vm, JSBlob::info()))

</ins><span class="cx">             return jsTestObjPrototypeFunctionOverloadedMethod13(state);

</span><span class="cx">         if (distinguishingArg.isNumber())

</span><span class="cx">             return jsTestObjPrototypeFunctionOverloadedMethod2(state);

</span><span class="lines">@@ -7296,7 +7296,7 @@

</span><span class="cx">         JSValue distinguishingArg = state-&gt;uncheckedArgument(0);

</span><span class="cx">         if (distinguishingArg.isUndefinedOrNull())

</span><span class="cx">             return jsTestObjPrototypeFunctionOverloadedMethodWithOptionalParameter2(state);

</span><del>-        if (distinguishingArg.isObject() &amp;&amp; asObject(distinguishingArg)-&gt;inherits(JSTestObj::info()))

</del><ins>+        if (distinguishingArg.isObject() &amp;&amp; asObject(distinguishingArg)-&gt;inherits(vm, JSTestObj::info()))

</ins><span class="cx">             return jsTestObjPrototypeFunctionOverloadedMethodWithOptionalParameter2(state);

</span><span class="cx">         return jsTestObjPrototypeFunctionOverloadedMethodWithOptionalParameter1(state);

</span><span class="cx">     }

</span><span class="lines">@@ -7304,7 +7304,7 @@

</span><span class="cx">         JSValue distinguishingArg = state-&gt;uncheckedArgument(0);

</span><span class="cx">         if (distinguishingArg.isUndefinedOrNull())

</span><span class="cx">             return jsTestObjPrototypeFunctionOverloadedMethodWithOptionalParameter2(state);

</span><del>-        if (distinguishingArg.isObject() &amp;&amp; asObject(distinguishingArg)-&gt;inherits(JSTestObj::info()))

</del><ins>+        if (distinguishingArg.isObject() &amp;&amp; asObject(distinguishingArg)-&gt;inherits(vm, JSTestObj::info()))

</ins><span class="cx">             return jsTestObjPrototypeFunctionOverloadedMethodWithOptionalParameter2(state);

</span><span class="cx">         return jsTestObjPrototypeFunctionOverloadedMethodWithOptionalParameter1(state);

</span><span class="cx">     }

</span><span class="lines">@@ -7359,9 +7359,9 @@

</span><span class="cx">     size_t argsCount = std::min&lt;size_t&gt;(1, state-&gt;argumentCount());

</span><span class="cx">     if (argsCount == 1) {

</span><span class="cx">         JSValue distinguishingArg = state-&gt;uncheckedArgument(0);

</span><del>-        if (distinguishingArg.isObject() &amp;&amp; asObject(distinguishingArg)-&gt;inherits(JSTestObj::info()))

</del><ins>+        if (distinguishingArg.isObject() &amp;&amp; asObject(distinguishingArg)-&gt;inherits(vm, JSTestObj::info()))

</ins><span class="cx">             return jsTestObjPrototypeFunctionOverloadedMethodWithDistinguishingUnion1(state);

</span><del>-        if (distinguishingArg.isObject() &amp;&amp; asObject(distinguishingArg)-&gt;inherits(JSTestNode::info()))

</del><ins>+        if (distinguishingArg.isObject() &amp;&amp; asObject(distinguishingArg)-&gt;inherits(vm, JSTestNode::info()))

</ins><span class="cx">             return jsTestObjPrototypeFunctionOverloadedMethodWithDistinguishingUnion1(state);

</span><span class="cx">         if (distinguishingArg.isNumber())

</span><span class="cx">             return jsTestObjPrototypeFunctionOverloadedMethodWithDistinguishingUnion2(state);

</span><span class="lines">@@ -7418,11 +7418,11 @@

</span><span class="cx">     size_t argsCount = std::min&lt;size_t&gt;(1, state-&gt;argumentCount());

</span><span class="cx">     if (argsCount == 1) {

</span><span class="cx">         JSValue distinguishingArg = state-&gt;uncheckedArgument(0);

</span><del>-        if (distinguishingArg.isObject() &amp;&amp; asObject(distinguishingArg)-&gt;inherits(JSTestObj::info()))

</del><ins>+        if (distinguishingArg.isObject() &amp;&amp; asObject(distinguishingArg)-&gt;inherits(vm, JSTestObj::info()))

</ins><span class="cx">             return jsTestObjPrototypeFunctionOverloadedMethodWith2DistinguishingUnions1(state);

</span><del>-        if (distinguishingArg.isObject() &amp;&amp; asObject(distinguishingArg)-&gt;inherits(JSTestNode::info()))

</del><ins>+        if (distinguishingArg.isObject() &amp;&amp; asObject(distinguishingArg)-&gt;inherits(vm, JSTestNode::info()))

</ins><span class="cx">             return jsTestObjPrototypeFunctionOverloadedMethodWith2DistinguishingUnions1(state);

</span><del>-        if (distinguishingArg.isObject() &amp;&amp; asObject(distinguishingArg)-&gt;inherits(JSTestInterface::info()))

</del><ins>+        if (distinguishingArg.isObject() &amp;&amp; asObject(distinguishingArg)-&gt;inherits(vm, JSTestInterface::info()))

</ins><span class="cx">             return jsTestObjPrototypeFunctionOverloadedMethodWith2DistinguishingUnions2(state);

</span><span class="cx">         if (distinguishingArg.isNumber())

</span><span class="cx">             return jsTestObjPrototypeFunctionOverloadedMethodWith2DistinguishingUnions2(state);

</span><span class="lines">@@ -7483,9 +7483,9 @@

</span><span class="cx">     size_t argsCount = std::min&lt;size_t&gt;(2, state-&gt;argumentCount());

</span><span class="cx">     if (argsCount == 2) {

</span><span class="cx">         JSValue distinguishingArg = state-&gt;uncheckedArgument(1);

</span><del>-        if (distinguishingArg.isObject() &amp;&amp; asObject(distinguishingArg)-&gt;inherits(JSTestObj::info()))

</del><ins>+        if (distinguishingArg.isObject() &amp;&amp; asObject(distinguishingArg)-&gt;inherits(vm, JSTestObj::info()))

</ins><span class="cx">             return jsTestObjPrototypeFunctionOverloadedMethodWithNonDistinguishingUnion1(state);

</span><del>-        if (distinguishingArg.isObject() &amp;&amp; asObject(distinguishingArg)-&gt;inherits(JSTestNode::info()))

</del><ins>+        if (distinguishingArg.isObject() &amp;&amp; asObject(distinguishingArg)-&gt;inherits(vm, JSTestNode::info()))

</ins><span class="cx">             return jsTestObjPrototypeFunctionOverloadedMethodWithNonDistinguishingUnion2(state);

</span><span class="cx">     }

</span><span class="cx">     return argsCount &lt; 2 ? throwVMError(state, throwScope, createNotEnoughArgumentsError(state)) : throwVMTypeError(state, throwScope);

</span><span class="lines">@@ -7541,9 +7541,9 @@

</span><span class="cx">         JSValue distinguishingArg = state-&gt;uncheckedArgument(0);

</span><span class="cx">         if (distinguishingArg.isUndefinedOrNull())

</span><span class="cx">             return jsTestObjPrototypeFunctionOverloadWithNullableUnion1(state);

</span><del>-        if (distinguishingArg.isObject() &amp;&amp; asObject(distinguishingArg)-&gt;inherits(JSTestObj::info()))

</del><ins>+        if (distinguishingArg.isObject() &amp;&amp; asObject(distinguishingArg)-&gt;inherits(vm, JSTestObj::info()))

</ins><span class="cx">             return jsTestObjPrototypeFunctionOverloadWithNullableUnion1(state);

</span><del>-        if (distinguishingArg.isObject() &amp;&amp; asObject(distinguishingArg)-&gt;inherits(JSTestNode::info()))

</del><ins>+        if (distinguishingArg.isObject() &amp;&amp; asObject(distinguishingArg)-&gt;inherits(vm, JSTestNode::info()))

</ins><span class="cx">             return jsTestObjPrototypeFunctionOverloadWithNullableUnion1(state);

</span><span class="cx">         if (distinguishingArg.isNumber())

</span><span class="cx">             return jsTestObjPrototypeFunctionOverloadWithNullableUnion2(state);

</span><span class="lines">@@ -7664,7 +7664,7 @@

</span><span class="cx">     size_t argsCount = std::min&lt;size_t&gt;(2, state-&gt;argumentCount());

</span><span class="cx">     if (argsCount == 2) {

</span><span class="cx">         JSValue distinguishingArg = state-&gt;uncheckedArgument(1);

</span><del>-        if (distinguishingArg.isObject() &amp;&amp; asObject(distinguishingArg)-&gt;inherits(JSTestNode::info()))

</del><ins>+        if (distinguishingArg.isObject() &amp;&amp; asObject(distinguishingArg)-&gt;inherits(vm, JSTestNode::info()))

</ins><span class="cx">             return jsTestObjPrototypeFunctionOverloadWithNullableNonDistinguishingParameter1(state);

</span><span class="cx">         if (distinguishingArg.isNumber())

</span><span class="cx">             return jsTestObjPrototypeFunctionOverloadWithNullableNonDistinguishingParameter2(state);

</span><span class="lines">@@ -8312,7 +8312,7 @@

</span><span class="cx">     size_t argsCount = std::min&lt;size_t&gt;(1, state-&gt;argumentCount());

</span><span class="cx">     if (argsCount == 1) {

</span><span class="cx">         JSValue distinguishingArg = state-&gt;uncheckedArgument(0);

</span><del>-        if (distinguishingArg.isObject() &amp;&amp; asObject(distinguishingArg)-&gt;inherits(JSFetchRequest::info()))

</del><ins>+        if (distinguishingArg.isObject() &amp;&amp; asObject(distinguishingArg)-&gt;inherits(vm, JSFetchRequest::info()))

</ins><span class="cx">             return jsTestObjPrototypeFunctionTestPromiseOverloadedFunction2(state);

</span><span class="cx">         if (distinguishingArg.isNumber())

</span><span class="cx">             return jsTestObjPrototypeFunctionTestPromiseOverloadedFunction1(state);

</span><span class="lines">@@ -8661,9 +8661,9 @@

</span><span class="cx">     return wrap(state, globalObject, impl);

</span><span class="cx"> }

</span><span class="cx"> 

</span><del>-TestObj* JSTestObj::toWrapped(JSC::JSValue value)

</del><ins>+TestObj* JSTestObj::toWrapped(JSC::VM&amp; vm, JSC::JSValue value)

</ins><span class="cx"> {

</span><del>-    if (auto* wrapper = jsDynamicDowncast&lt;JSTestObj*&gt;(value))

</del><ins>+    if (auto* wrapper = jsDynamicDowncast&lt;JSTestObj*&gt;(vm, value))

</ins><span class="cx">         return &amp;wrapper-&gt;wrapped();

</span><span class="cx">     return nullptr;

</span><span class="cx"> }

</span></span></pre></div>

<a id="trunkSourceWebCorebindingsscriptstestJSJSTestObjh"></a>

<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/scripts/test/JS/JSTestObj.h (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/WebCore/bindings/scripts/test/JS/JSTestObj.h        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/WebCore/bindings/scripts/test/JS/JSTestObj.h        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -39,7 +39,7 @@

</span><span class="cx"> 

</span><span class="cx">     static JSC::JSObject* createPrototype(JSC::VM&amp;, JSC::JSGlobalObject*);

</span><span class="cx">     static JSC::JSObject* prototype(JSC::VM&amp;, JSC::JSGlobalObject*);

</span><del>-    static TestObj* toWrapped(JSC::JSValue);

</del><ins>+    static TestObj* toWrapped(JSC::VM&amp;, JSC::JSValue);

</ins><span class="cx">     static bool getOwnPropertySlot(JSC::JSObject*, JSC::ExecState*, JSC::PropertyName, JSC::PropertySlot&amp;);

</span><span class="cx">     static bool getOwnPropertySlotByIndex(JSC::JSObject*, JSC::ExecState*, unsigned propertyName, JSC::PropertySlot&amp;);

</span><span class="cx">     static void destroy(JSC::JSCell*);

</span></span></pre></div>

<a id="trunkSourceWebCorebindingsscriptstestJSJSTestOverloadedConstructorscpp"></a>

<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/scripts/test/JS/JSTestOverloadedConstructors.cpp (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/WebCore/bindings/scripts/test/JS/JSTestOverloadedConstructors.cpp        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/WebCore/bindings/scripts/test/JS/JSTestOverloadedConstructors.cpp        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -149,11 +149,11 @@

</span><span class="cx">     }

</span><span class="cx">     if (argsCount == 1) {

</span><span class="cx">         JSValue distinguishingArg = state-&gt;uncheckedArgument(0);

</span><del>-        if (distinguishingArg.isObject() &amp;&amp; asObject(distinguishingArg)-&gt;inherits(JSArrayBuffer::info()))

</del><ins>+        if (distinguishingArg.isObject() &amp;&amp; asObject(distinguishingArg)-&gt;inherits(vm, JSArrayBuffer::info()))

</ins><span class="cx">             return constructJSTestOverloadedConstructors1(state);

</span><del>-        if (distinguishingArg.isObject() &amp;&amp; asObject(distinguishingArg)-&gt;inherits(JSArrayBufferView::info()))

</del><ins>+        if (distinguishingArg.isObject() &amp;&amp; asObject(distinguishingArg)-&gt;inherits(vm, JSArrayBufferView::info()))

</ins><span class="cx">             return constructJSTestOverloadedConstructors2(state);

</span><del>-        if (distinguishingArg.isObject() &amp;&amp; asObject(distinguishingArg)-&gt;inherits(JSBlob::info()))

</del><ins>+        if (distinguishingArg.isObject() &amp;&amp; asObject(distinguishingArg)-&gt;inherits(vm, JSBlob::info()))

</ins><span class="cx">             return constructJSTestOverloadedConstructors3(state);

</span><span class="cx">         if (distinguishingArg.isNumber())

</span><span class="cx">             return constructJSTestOverloadedConstructors5(state);

</span><span class="lines">@@ -202,7 +202,7 @@

</span><span class="cx"> void JSTestOverloadedConstructors::finishCreation(VM&amp; vm)

</span><span class="cx"> {

</span><span class="cx">     Base::finishCreation(vm);

</span><del>-    ASSERT(inherits(info()));

</del><ins>+    ASSERT(inherits(vm, info()));

</ins><span class="cx"> 

</span><span class="cx"> }

</span><span class="cx"> 

</span><span class="lines">@@ -226,7 +226,7 @@

</span><span class="cx"> {

</span><span class="cx">     VM&amp; vm = state-&gt;vm();

</span><span class="cx">     auto throwScope = DECLARE_THROW_SCOPE(vm);

</span><del>-    JSTestOverloadedConstructorsPrototype* domObject = jsDynamicDowncast&lt;JSTestOverloadedConstructorsPrototype*&gt;(JSValue::decode(thisValue));

</del><ins>+    JSTestOverloadedConstructorsPrototype* domObject = jsDynamicDowncast&lt;JSTestOverloadedConstructorsPrototype*&gt;(vm, JSValue::decode(thisValue));

</ins><span class="cx">     if (UNLIKELY(!domObject))

</span><span class="cx">         return throwVMTypeError(state, throwScope);

</span><span class="cx">     return JSValue::encode(JSTestOverloadedConstructors::getConstructor(state-&gt;vm(), domObject-&gt;globalObject()));

</span><span class="lines">@@ -237,7 +237,7 @@

</span><span class="cx">     VM&amp; vm = state-&gt;vm();

</span><span class="cx">     auto throwScope = DECLARE_THROW_SCOPE(vm);

</span><span class="cx">     JSValue value = JSValue::decode(encodedValue);

</span><del>-    JSTestOverloadedConstructorsPrototype* domObject = jsDynamicDowncast&lt;JSTestOverloadedConstructorsPrototype*&gt;(JSValue::decode(thisValue));

</del><ins>+    JSTestOverloadedConstructorsPrototype* domObject = jsDynamicDowncast&lt;JSTestOverloadedConstructorsPrototype*&gt;(vm, JSValue::decode(thisValue));

</ins><span class="cx">     if (UNLIKELY(!domObject)) {

</span><span class="cx">         throwVMTypeError(state, throwScope);

</span><span class="cx">         return false;

</span><span class="lines">@@ -303,9 +303,9 @@

</span><span class="cx">     return wrap(state, globalObject, impl);

</span><span class="cx"> }

</span><span class="cx"> 

</span><del>-TestOverloadedConstructors* JSTestOverloadedConstructors::toWrapped(JSC::JSValue value)

</del><ins>+TestOverloadedConstructors* JSTestOverloadedConstructors::toWrapped(JSC::VM&amp; vm, JSC::JSValue value)

</ins><span class="cx"> {

</span><del>-    if (auto* wrapper = jsDynamicDowncast&lt;JSTestOverloadedConstructors*&gt;(value))

</del><ins>+    if (auto* wrapper = jsDynamicDowncast&lt;JSTestOverloadedConstructors*&gt;(vm, value))

</ins><span class="cx">         return &amp;wrapper-&gt;wrapped();

</span><span class="cx">     return nullptr;

</span><span class="cx"> }

</span></span></pre></div>

<a id="trunkSourceWebCorebindingsscriptstestJSJSTestOverloadedConstructorsh"></a>

<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/scripts/test/JS/JSTestOverloadedConstructors.h (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/WebCore/bindings/scripts/test/JS/JSTestOverloadedConstructors.h        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/WebCore/bindings/scripts/test/JS/JSTestOverloadedConstructors.h        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -38,7 +38,7 @@

</span><span class="cx"> 

</span><span class="cx">     static JSC::JSObject* createPrototype(JSC::VM&amp;, JSC::JSGlobalObject*);

</span><span class="cx">     static JSC::JSObject* prototype(JSC::VM&amp;, JSC::JSGlobalObject*);

</span><del>-    static TestOverloadedConstructors* toWrapped(JSC::JSValue);

</del><ins>+    static TestOverloadedConstructors* toWrapped(JSC::VM&amp;, JSC::JSValue);

</ins><span class="cx">     static void destroy(JSC::JSCell*);

</span><span class="cx"> 

</span><span class="cx">     DECLARE_INFO;

</span></span></pre></div>

<a id="trunkSourceWebCorebindingsscriptstestJSJSTestOverloadedConstructorsWithSequencecpp"></a>

<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/scripts/test/JS/JSTestOverloadedConstructorsWithSequence.cpp (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/WebCore/bindings/scripts/test/JS/JSTestOverloadedConstructorsWithSequence.cpp        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/WebCore/bindings/scripts/test/JS/JSTestOverloadedConstructorsWithSequence.cpp        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -153,7 +153,7 @@

</span><span class="cx"> void JSTestOverloadedConstructorsWithSequence::finishCreation(VM&amp; vm)

</span><span class="cx"> {

</span><span class="cx">     Base::finishCreation(vm);

</span><del>-    ASSERT(inherits(info()));

</del><ins>+    ASSERT(inherits(vm, info()));

</ins><span class="cx"> 

</span><span class="cx"> }

</span><span class="cx"> 

</span><span class="lines">@@ -177,7 +177,7 @@

</span><span class="cx"> {

</span><span class="cx">     VM&amp; vm = state-&gt;vm();

</span><span class="cx">     auto throwScope = DECLARE_THROW_SCOPE(vm);

</span><del>-    JSTestOverloadedConstructorsWithSequencePrototype* domObject = jsDynamicDowncast&lt;JSTestOverloadedConstructorsWithSequencePrototype*&gt;(JSValue::decode(thisValue));

</del><ins>+    JSTestOverloadedConstructorsWithSequencePrototype* domObject = jsDynamicDowncast&lt;JSTestOverloadedConstructorsWithSequencePrototype*&gt;(vm, JSValue::decode(thisValue));

</ins><span class="cx">     if (UNLIKELY(!domObject))

</span><span class="cx">         return throwVMTypeError(state, throwScope);

</span><span class="cx">     return JSValue::encode(JSTestOverloadedConstructorsWithSequence::getConstructor(state-&gt;vm(), domObject-&gt;globalObject()));

</span><span class="lines">@@ -188,7 +188,7 @@

</span><span class="cx">     VM&amp; vm = state-&gt;vm();

</span><span class="cx">     auto throwScope = DECLARE_THROW_SCOPE(vm);

</span><span class="cx">     JSValue value = JSValue::decode(encodedValue);

</span><del>-    JSTestOverloadedConstructorsWithSequencePrototype* domObject = jsDynamicDowncast&lt;JSTestOverloadedConstructorsWithSequencePrototype*&gt;(JSValue::decode(thisValue));

</del><ins>+    JSTestOverloadedConstructorsWithSequencePrototype* domObject = jsDynamicDowncast&lt;JSTestOverloadedConstructorsWithSequencePrototype*&gt;(vm, JSValue::decode(thisValue));

</ins><span class="cx">     if (UNLIKELY(!domObject)) {

</span><span class="cx">         throwVMTypeError(state, throwScope);

</span><span class="cx">         return false;

</span><span class="lines">@@ -254,9 +254,9 @@

</span><span class="cx">     return wrap(state, globalObject, impl);

</span><span class="cx"> }

</span><span class="cx"> 

</span><del>-TestOverloadedConstructorsWithSequence* JSTestOverloadedConstructorsWithSequence::toWrapped(JSC::JSValue value)

</del><ins>+TestOverloadedConstructorsWithSequence* JSTestOverloadedConstructorsWithSequence::toWrapped(JSC::VM&amp; vm, JSC::JSValue value)

</ins><span class="cx"> {

</span><del>-    if (auto* wrapper = jsDynamicDowncast&lt;JSTestOverloadedConstructorsWithSequence*&gt;(value))

</del><ins>+    if (auto* wrapper = jsDynamicDowncast&lt;JSTestOverloadedConstructorsWithSequence*&gt;(vm, value))

</ins><span class="cx">         return &amp;wrapper-&gt;wrapped();

</span><span class="cx">     return nullptr;

</span><span class="cx"> }

</span></span></pre></div>

<a id="trunkSourceWebCorebindingsscriptstestJSJSTestOverloadedConstructorsWithSequenceh"></a>

<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/scripts/test/JS/JSTestOverloadedConstructorsWithSequence.h (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/WebCore/bindings/scripts/test/JS/JSTestOverloadedConstructorsWithSequence.h        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/WebCore/bindings/scripts/test/JS/JSTestOverloadedConstructorsWithSequence.h        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -38,7 +38,7 @@

</span><span class="cx"> 

</span><span class="cx">     static JSC::JSObject* createPrototype(JSC::VM&amp;, JSC::JSGlobalObject*);

</span><span class="cx">     static JSC::JSObject* prototype(JSC::VM&amp;, JSC::JSGlobalObject*);

</span><del>-    static TestOverloadedConstructorsWithSequence* toWrapped(JSC::JSValue);

</del><ins>+    static TestOverloadedConstructorsWithSequence* toWrapped(JSC::VM&amp;, JSC::JSValue);

</ins><span class="cx">     static void destroy(JSC::JSCell*);

</span><span class="cx"> 

</span><span class="cx">     DECLARE_INFO;

</span></span></pre></div>

<a id="trunkSourceWebCorebindingsscriptstestJSJSTestOverrideBuiltinscpp"></a>

<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/scripts/test/JS/JSTestOverrideBuiltins.cpp (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/WebCore/bindings/scripts/test/JS/JSTestOverrideBuiltins.cpp        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/WebCore/bindings/scripts/test/JS/JSTestOverrideBuiltins.cpp        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -110,7 +110,7 @@

</span><span class="cx"> void JSTestOverrideBuiltins::finishCreation(VM&amp; vm)

</span><span class="cx"> {

</span><span class="cx">     Base::finishCreation(vm);

</span><del>-    ASSERT(inherits(info()));

</del><ins>+    ASSERT(inherits(vm, info()));

</ins><span class="cx"> 

</span><span class="cx"> }

</span><span class="cx"> 

</span><span class="lines">@@ -172,7 +172,7 @@

</span><span class="cx"> 

</span><span class="cx"> template&lt;&gt; inline JSTestOverrideBuiltins* BindingCaller&lt;JSTestOverrideBuiltins&gt;::castForOperation(ExecState&amp; state)

</span><span class="cx"> {

</span><del>-    return jsDynamicDowncast&lt;JSTestOverrideBuiltins*&gt;(state.thisValue());

</del><ins>+    return jsDynamicDowncast&lt;JSTestOverrideBuiltins*&gt;(state.vm(), state.thisValue());

</ins><span class="cx"> }

</span><span class="cx"> 

</span><span class="cx"> EncodedJSValue jsTestOverrideBuiltinsConstructor(ExecState* state, EncodedJSValue thisValue, PropertyName)

</span><span class="lines">@@ -179,7 +179,7 @@

</span><span class="cx"> {

</span><span class="cx">     VM&amp; vm = state-&gt;vm();

</span><span class="cx">     auto throwScope = DECLARE_THROW_SCOPE(vm);

</span><del>-    JSTestOverrideBuiltinsPrototype* domObject = jsDynamicDowncast&lt;JSTestOverrideBuiltinsPrototype*&gt;(JSValue::decode(thisValue));

</del><ins>+    JSTestOverrideBuiltinsPrototype* domObject = jsDynamicDowncast&lt;JSTestOverrideBuiltinsPrototype*&gt;(vm, JSValue::decode(thisValue));

</ins><span class="cx">     if (UNLIKELY(!domObject))

</span><span class="cx">         return throwVMTypeError(state, throwScope);

</span><span class="cx">     return JSValue::encode(JSTestOverrideBuiltins::getConstructor(state-&gt;vm(), domObject-&gt;globalObject()));

</span><span class="lines">@@ -190,7 +190,7 @@

</span><span class="cx">     VM&amp; vm = state-&gt;vm();

</span><span class="cx">     auto throwScope = DECLARE_THROW_SCOPE(vm);

</span><span class="cx">     JSValue value = JSValue::decode(encodedValue);

</span><del>-    JSTestOverrideBuiltinsPrototype* domObject = jsDynamicDowncast&lt;JSTestOverrideBuiltinsPrototype*&gt;(JSValue::decode(thisValue));

</del><ins>+    JSTestOverrideBuiltinsPrototype* domObject = jsDynamicDowncast&lt;JSTestOverrideBuiltinsPrototype*&gt;(vm, JSValue::decode(thisValue));

</ins><span class="cx">     if (UNLIKELY(!domObject)) {

</span><span class="cx">         throwVMTypeError(state, throwScope);

</span><span class="cx">         return false;

</span><span class="lines">@@ -275,9 +275,9 @@

</span><span class="cx">     return wrap(state, globalObject, impl);

</span><span class="cx"> }

</span><span class="cx"> 

</span><del>-TestOverrideBuiltins* JSTestOverrideBuiltins::toWrapped(JSC::JSValue value)

</del><ins>+TestOverrideBuiltins* JSTestOverrideBuiltins::toWrapped(JSC::VM&amp; vm, JSC::JSValue value)

</ins><span class="cx"> {

</span><del>-    if (auto* wrapper = jsDynamicDowncast&lt;JSTestOverrideBuiltins*&gt;(value))

</del><ins>+    if (auto* wrapper = jsDynamicDowncast&lt;JSTestOverrideBuiltins*&gt;(vm, value))

</ins><span class="cx">         return &amp;wrapper-&gt;wrapped();

</span><span class="cx">     return nullptr;

</span><span class="cx"> }

</span></span></pre></div>

<a id="trunkSourceWebCorebindingsscriptstestJSJSTestOverrideBuiltinsh"></a>

<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/scripts/test/JS/JSTestOverrideBuiltins.h (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/WebCore/bindings/scripts/test/JS/JSTestOverrideBuiltins.h        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/WebCore/bindings/scripts/test/JS/JSTestOverrideBuiltins.h        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -38,7 +38,7 @@

</span><span class="cx"> 

</span><span class="cx">     static JSC::JSObject* createPrototype(JSC::VM&amp;, JSC::JSGlobalObject*);

</span><span class="cx">     static JSC::JSObject* prototype(JSC::VM&amp;, JSC::JSGlobalObject*);

</span><del>-    static TestOverrideBuiltins* toWrapped(JSC::JSValue);

</del><ins>+    static TestOverrideBuiltins* toWrapped(JSC::VM&amp;, JSC::JSValue);

</ins><span class="cx">     static bool getOwnPropertySlot(JSC::JSObject*, JSC::ExecState*, JSC::PropertyName, JSC::PropertySlot&amp;);

</span><span class="cx">     static bool getOwnPropertySlotByIndex(JSC::JSObject*, JSC::ExecState*, unsigned propertyName, JSC::PropertySlot&amp;);

</span><span class="cx">     static void destroy(JSC::JSCell*);

</span></span></pre></div>

<a id="trunkSourceWebCorebindingsscriptstestJSJSTestSerializationcpp"></a>

<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/scripts/test/JS/JSTestSerialization.cpp (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/WebCore/bindings/scripts/test/JS/JSTestSerialization.cpp        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/WebCore/bindings/scripts/test/JS/JSTestSerialization.cpp        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -125,7 +125,7 @@

</span><span class="cx"> void JSTestSerialization::finishCreation(VM&amp; vm)

</span><span class="cx"> {

</span><span class="cx">     Base::finishCreation(vm);

</span><del>-    ASSERT(inherits(info()));

</del><ins>+    ASSERT(inherits(vm, info()));

</ins><span class="cx"> 

</span><span class="cx"> }

</span><span class="cx"> 

</span><span class="lines">@@ -145,14 +145,14 @@

</span><span class="cx">     thisObject-&gt;JSTestSerialization::~JSTestSerialization();

</span><span class="cx"> }

</span><span class="cx"> 

</span><del>-template&lt;&gt; inline JSTestSerialization* BindingCaller&lt;JSTestSerialization&gt;::castForAttribute(ExecState&amp;, EncodedJSValue thisValue)

</del><ins>+template&lt;&gt; inline JSTestSerialization* BindingCaller&lt;JSTestSerialization&gt;::castForAttribute(ExecState&amp; state, EncodedJSValue thisValue)

</ins><span class="cx"> {

</span><del>-    return jsDynamicDowncast&lt;JSTestSerialization*&gt;(JSValue::decode(thisValue));

</del><ins>+    return jsDynamicDowncast&lt;JSTestSerialization*&gt;(state.vm(), JSValue::decode(thisValue));

</ins><span class="cx"> }

</span><span class="cx"> 

</span><span class="cx"> template&lt;&gt; inline JSTestSerialization* BindingCaller&lt;JSTestSerialization&gt;::castForOperation(ExecState&amp; state)

</span><span class="cx"> {

</span><del>-    return jsDynamicDowncast&lt;JSTestSerialization*&gt;(state.thisValue());

</del><ins>+    return jsDynamicDowncast&lt;JSTestSerialization*&gt;(state.vm(), state.thisValue());

</ins><span class="cx"> }

</span><span class="cx"> 

</span><span class="cx"> static inline JSValue jsTestSerializationFirstStringAttributeGetter(ExecState&amp;, JSTestSerialization&amp;, ThrowScope&amp; throwScope);

</span><span class="lines">@@ -239,7 +239,7 @@

</span><span class="cx"> {

</span><span class="cx">     VM&amp; vm = state-&gt;vm();

</span><span class="cx">     auto throwScope = DECLARE_THROW_SCOPE(vm);

</span><del>-    JSTestSerializationPrototype* domObject = jsDynamicDowncast&lt;JSTestSerializationPrototype*&gt;(JSValue::decode(thisValue));

</del><ins>+    JSTestSerializationPrototype* domObject = jsDynamicDowncast&lt;JSTestSerializationPrototype*&gt;(vm, JSValue::decode(thisValue));

</ins><span class="cx">     if (UNLIKELY(!domObject))

</span><span class="cx">         return throwVMTypeError(state, throwScope);

</span><span class="cx">     return JSValue::encode(JSTestSerialization::getConstructor(state-&gt;vm(), domObject-&gt;globalObject()));

</span><span class="lines">@@ -250,7 +250,7 @@

</span><span class="cx">     VM&amp; vm = state-&gt;vm();

</span><span class="cx">     auto throwScope = DECLARE_THROW_SCOPE(vm);

</span><span class="cx">     JSValue value = JSValue::decode(encodedValue);

</span><del>-    JSTestSerializationPrototype* domObject = jsDynamicDowncast&lt;JSTestSerializationPrototype*&gt;(JSValue::decode(thisValue));

</del><ins>+    JSTestSerializationPrototype* domObject = jsDynamicDowncast&lt;JSTestSerializationPrototype*&gt;(vm, JSValue::decode(thisValue));

</ins><span class="cx">     if (UNLIKELY(!domObject)) {

</span><span class="cx">         throwVMTypeError(state, throwScope);

</span><span class="cx">         return false;

</span><span class="lines">@@ -440,9 +440,9 @@

</span><span class="cx">     return wrap(state, globalObject, impl);

</span><span class="cx"> }

</span><span class="cx"> 

</span><del>-TestSerialization* JSTestSerialization::toWrapped(JSC::JSValue value)

</del><ins>+TestSerialization* JSTestSerialization::toWrapped(JSC::VM&amp; vm, JSC::JSValue value)

</ins><span class="cx"> {

</span><del>-    if (auto* wrapper = jsDynamicDowncast&lt;JSTestSerialization*&gt;(value))

</del><ins>+    if (auto* wrapper = jsDynamicDowncast&lt;JSTestSerialization*&gt;(vm, value))

</ins><span class="cx">         return &amp;wrapper-&gt;wrapped();

</span><span class="cx">     return nullptr;

</span><span class="cx"> }

</span></span></pre></div>

<a id="trunkSourceWebCorebindingsscriptstestJSJSTestSerializationh"></a>

<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/scripts/test/JS/JSTestSerialization.h (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/WebCore/bindings/scripts/test/JS/JSTestSerialization.h        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/WebCore/bindings/scripts/test/JS/JSTestSerialization.h        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -38,7 +38,7 @@

</span><span class="cx"> 

</span><span class="cx">     static JSC::JSObject* createPrototype(JSC::VM&amp;, JSC::JSGlobalObject*);

</span><span class="cx">     static JSC::JSObject* prototype(JSC::VM&amp;, JSC::JSGlobalObject*);

</span><del>-    static TestSerialization* toWrapped(JSC::JSValue);

</del><ins>+    static TestSerialization* toWrapped(JSC::VM&amp;, JSC::JSValue);

</ins><span class="cx">     static void destroy(JSC::JSCell*);

</span><span class="cx"> 

</span><span class="cx">     DECLARE_INFO;

</span></span></pre></div>

<a id="trunkSourceWebCorebindingsscriptstestJSJSTestSerializedScriptValueInterfacecpp"></a>

<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/scripts/test/JS/JSTestSerializedScriptValueInterface.cpp (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/WebCore/bindings/scripts/test/JS/JSTestSerializedScriptValueInterface.cpp        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/WebCore/bindings/scripts/test/JS/JSTestSerializedScriptValueInterface.cpp        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -129,7 +129,7 @@

</span><span class="cx"> void JSTestSerializedScriptValueInterface::finishCreation(VM&amp; vm)

</span><span class="cx"> {

</span><span class="cx">     Base::finishCreation(vm);

</span><del>-    ASSERT(inherits(info()));

</del><ins>+    ASSERT(inherits(vm, info()));

</ins><span class="cx"> 

</span><span class="cx"> }

</span><span class="cx"> 

</span><span class="lines">@@ -149,14 +149,14 @@

</span><span class="cx">     thisObject-&gt;JSTestSerializedScriptValueInterface::~JSTestSerializedScriptValueInterface();

</span><span class="cx"> }

</span><span class="cx"> 

</span><del>-template&lt;&gt; inline JSTestSerializedScriptValueInterface* BindingCaller&lt;JSTestSerializedScriptValueInterface&gt;::castForAttribute(ExecState&amp;, EncodedJSValue thisValue)

</del><ins>+template&lt;&gt; inline JSTestSerializedScriptValueInterface* BindingCaller&lt;JSTestSerializedScriptValueInterface&gt;::castForAttribute(ExecState&amp; state, EncodedJSValue thisValue)

</ins><span class="cx"> {

</span><del>-    return jsDynamicDowncast&lt;JSTestSerializedScriptValueInterface*&gt;(JSValue::decode(thisValue));

</del><ins>+    return jsDynamicDowncast&lt;JSTestSerializedScriptValueInterface*&gt;(state.vm(), JSValue::decode(thisValue));

</ins><span class="cx"> }

</span><span class="cx"> 

</span><span class="cx"> template&lt;&gt; inline JSTestSerializedScriptValueInterface* BindingCaller&lt;JSTestSerializedScriptValueInterface&gt;::castForOperation(ExecState&amp; state)

</span><span class="cx"> {

</span><del>-    return jsDynamicDowncast&lt;JSTestSerializedScriptValueInterface*&gt;(state.thisValue());

</del><ins>+    return jsDynamicDowncast&lt;JSTestSerializedScriptValueInterface*&gt;(state.vm(), state.thisValue());

</ins><span class="cx"> }

</span><span class="cx"> 

</span><span class="cx"> static inline JSValue jsTestSerializedScriptValueInterfaceValueGetter(ExecState&amp;, JSTestSerializedScriptValueInterface&amp;, ThrowScope&amp; throwScope);

</span><span class="lines">@@ -249,7 +249,7 @@

</span><span class="cx"> {

</span><span class="cx">     VM&amp; vm = state-&gt;vm();

</span><span class="cx">     auto throwScope = DECLARE_THROW_SCOPE(vm);

</span><del>-    JSTestSerializedScriptValueInterfacePrototype* domObject = jsDynamicDowncast&lt;JSTestSerializedScriptValueInterfacePrototype*&gt;(JSValue::decode(thisValue));

</del><ins>+    JSTestSerializedScriptValueInterfacePrototype* domObject = jsDynamicDowncast&lt;JSTestSerializedScriptValueInterfacePrototype*&gt;(vm, JSValue::decode(thisValue));

</ins><span class="cx">     if (UNLIKELY(!domObject))

</span><span class="cx">         return throwVMTypeError(state, throwScope);

</span><span class="cx">     return JSValue::encode(JSTestSerializedScriptValueInterface::getConstructor(state-&gt;vm(), domObject-&gt;globalObject()));

</span><span class="lines">@@ -260,7 +260,7 @@

</span><span class="cx">     VM&amp; vm = state-&gt;vm();

</span><span class="cx">     auto throwScope = DECLARE_THROW_SCOPE(vm);

</span><span class="cx">     JSValue value = JSValue::decode(encodedValue);

</span><del>-    JSTestSerializedScriptValueInterfacePrototype* domObject = jsDynamicDowncast&lt;JSTestSerializedScriptValueInterfacePrototype*&gt;(JSValue::decode(thisValue));

</del><ins>+    JSTestSerializedScriptValueInterfacePrototype* domObject = jsDynamicDowncast&lt;JSTestSerializedScriptValueInterfacePrototype*&gt;(vm, JSValue::decode(thisValue));

</ins><span class="cx">     if (UNLIKELY(!domObject)) {

</span><span class="cx">         throwVMTypeError(state, throwScope);

</span><span class="cx">         return false;

</span><span class="lines">@@ -408,9 +408,9 @@

</span><span class="cx">     return wrap(state, globalObject, impl);

</span><span class="cx"> }

</span><span class="cx"> 

</span><del>-TestSerializedScriptValueInterface* JSTestSerializedScriptValueInterface::toWrapped(JSC::JSValue value)

</del><ins>+TestSerializedScriptValueInterface* JSTestSerializedScriptValueInterface::toWrapped(JSC::VM&amp; vm, JSC::JSValue value)

</ins><span class="cx"> {

</span><del>-    if (auto* wrapper = jsDynamicDowncast&lt;JSTestSerializedScriptValueInterface*&gt;(value))

</del><ins>+    if (auto* wrapper = jsDynamicDowncast&lt;JSTestSerializedScriptValueInterface*&gt;(vm, value))

</ins><span class="cx">         return &amp;wrapper-&gt;wrapped();

</span><span class="cx">     return nullptr;

</span><span class="cx"> }

</span></span></pre></div>

<a id="trunkSourceWebCorebindingsscriptstestJSJSTestSerializedScriptValueInterfaceh"></a>

<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/scripts/test/JS/JSTestSerializedScriptValueInterface.h (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/WebCore/bindings/scripts/test/JS/JSTestSerializedScriptValueInterface.h        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/WebCore/bindings/scripts/test/JS/JSTestSerializedScriptValueInterface.h        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -40,7 +40,7 @@

</span><span class="cx"> 

</span><span class="cx">     static JSC::JSObject* createPrototype(JSC::VM&amp;, JSC::JSGlobalObject*);

</span><span class="cx">     static JSC::JSObject* prototype(JSC::VM&amp;, JSC::JSGlobalObject*);

</span><del>-    static TestSerializedScriptValueInterface* toWrapped(JSC::JSValue);

</del><ins>+    static TestSerializedScriptValueInterface* toWrapped(JSC::VM&amp;, JSC::JSValue);

</ins><span class="cx">     static void destroy(JSC::JSCell*);

</span><span class="cx"> 

</span><span class="cx">     DECLARE_INFO;

</span></span></pre></div>

<a id="trunkSourceWebCorebindingsscriptstestJSJSTestTypedefscpp"></a>

<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/scripts/test/JS/JSTestTypedefs.cpp (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/WebCore/bindings/scripts/test/JS/JSTestTypedefs.cpp        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/WebCore/bindings/scripts/test/JS/JSTestTypedefs.cpp        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -203,7 +203,7 @@

</span><span class="cx"> void JSTestTypedefs::finishCreation(VM&amp; vm)

</span><span class="cx"> {

</span><span class="cx">     Base::finishCreation(vm);

</span><del>-    ASSERT(inherits(info()));

</del><ins>+    ASSERT(inherits(vm, info()));

</ins><span class="cx"> 

</span><span class="cx"> }

</span><span class="cx"> 

</span><span class="lines">@@ -223,14 +223,14 @@

</span><span class="cx">     thisObject-&gt;JSTestTypedefs::~JSTestTypedefs();

</span><span class="cx"> }

</span><span class="cx"> 

</span><del>-template&lt;&gt; inline JSTestTypedefs* BindingCaller&lt;JSTestTypedefs&gt;::castForAttribute(ExecState&amp;, EncodedJSValue thisValue)

</del><ins>+template&lt;&gt; inline JSTestTypedefs* BindingCaller&lt;JSTestTypedefs&gt;::castForAttribute(ExecState&amp; state, EncodedJSValue thisValue)

</ins><span class="cx"> {

</span><del>-    return jsDynamicDowncast&lt;JSTestTypedefs*&gt;(JSValue::decode(thisValue));

</del><ins>+    return jsDynamicDowncast&lt;JSTestTypedefs*&gt;(state.vm(), JSValue::decode(thisValue));

</ins><span class="cx"> }

</span><span class="cx"> 

</span><span class="cx"> template&lt;&gt; inline JSTestTypedefs* BindingCaller&lt;JSTestTypedefs&gt;::castForOperation(ExecState&amp; state)

</span><span class="cx"> {

</span><del>-    return jsDynamicDowncast&lt;JSTestTypedefs*&gt;(state.thisValue());

</del><ins>+    return jsDynamicDowncast&lt;JSTestTypedefs*&gt;(state.vm(), state.thisValue());

</ins><span class="cx"> }

</span><span class="cx"> 

</span><span class="cx"> static inline JSValue jsTestTypedefsUnsignedLongLongAttrGetter(ExecState&amp;, JSTestTypedefs&amp;, ThrowScope&amp; throwScope);

</span><span class="lines">@@ -347,7 +347,7 @@

</span><span class="cx"> {

</span><span class="cx">     VM&amp; vm = state-&gt;vm();

</span><span class="cx">     auto throwScope = DECLARE_THROW_SCOPE(vm);

</span><del>-    JSTestTypedefsPrototype* domObject = jsDynamicDowncast&lt;JSTestTypedefsPrototype*&gt;(JSValue::decode(thisValue));

</del><ins>+    JSTestTypedefsPrototype* domObject = jsDynamicDowncast&lt;JSTestTypedefsPrototype*&gt;(vm, JSValue::decode(thisValue));

</ins><span class="cx">     if (UNLIKELY(!domObject))

</span><span class="cx">         return throwVMTypeError(state, throwScope);

</span><span class="cx">     return JSValue::encode(JSTestTypedefs::getConstructor(state-&gt;vm(), domObject-&gt;globalObject()));

</span><span class="lines">@@ -358,7 +358,7 @@

</span><span class="cx">     VM&amp; vm = state-&gt;vm();

</span><span class="cx">     auto throwScope = DECLARE_THROW_SCOPE(vm);

</span><span class="cx">     JSValue value = JSValue::decode(encodedValue);

</span><del>-    JSTestTypedefsPrototype* domObject = jsDynamicDowncast&lt;JSTestTypedefsPrototype*&gt;(JSValue::decode(thisValue));

</del><ins>+    JSTestTypedefsPrototype* domObject = jsDynamicDowncast&lt;JSTestTypedefsPrototype*&gt;(vm, JSValue::decode(thisValue));

</ins><span class="cx">     if (UNLIKELY(!domObject)) {

</span><span class="cx">         throwVMTypeError(state, throwScope);

</span><span class="cx">         return false;

</span><span class="lines">@@ -813,9 +813,9 @@

</span><span class="cx">     return wrap(state, globalObject, impl);

</span><span class="cx"> }

</span><span class="cx"> 

</span><del>-TestTypedefs* JSTestTypedefs::toWrapped(JSC::JSValue value)

</del><ins>+TestTypedefs* JSTestTypedefs::toWrapped(JSC::VM&amp; vm, JSC::JSValue value)

</ins><span class="cx"> {

</span><del>-    if (auto* wrapper = jsDynamicDowncast&lt;JSTestTypedefs*&gt;(value))

</del><ins>+    if (auto* wrapper = jsDynamicDowncast&lt;JSTestTypedefs*&gt;(vm, value))

</ins><span class="cx">         return &amp;wrapper-&gt;wrapped();

</span><span class="cx">     return nullptr;

</span><span class="cx"> }

</span></span></pre></div>

<a id="trunkSourceWebCorebindingsscriptstestJSJSTestTypedefsh"></a>

<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/scripts/test/JS/JSTestTypedefs.h (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/WebCore/bindings/scripts/test/JS/JSTestTypedefs.h        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/WebCore/bindings/scripts/test/JS/JSTestTypedefs.h        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -38,7 +38,7 @@

</span><span class="cx"> 

</span><span class="cx">     static JSC::JSObject* createPrototype(JSC::VM&amp;, JSC::JSGlobalObject*);

</span><span class="cx">     static JSC::JSObject* prototype(JSC::VM&amp;, JSC::JSGlobalObject*);

</span><del>-    static TestTypedefs* toWrapped(JSC::JSValue);

</del><ins>+    static TestTypedefs* toWrapped(JSC::VM&amp;, JSC::JSValue);

</ins><span class="cx">     static void destroy(JSC::JSCell*);

</span><span class="cx"> 

</span><span class="cx">     DECLARE_INFO;

</span></span></pre></div>

<a id="trunkSourceWebCorebridgecCRuntimeObjectcpp"></a>

<div class="modfile"><h4>Modified: trunk/Source/WebCore/bridge/c/CRuntimeObject.cpp (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/WebCore/bridge/c/CRuntimeObject.cpp        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/WebCore/bridge/c/CRuntimeObject.cpp        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -45,7 +45,7 @@

</span><span class="cx"> void CRuntimeObject::finishCreation(VM&amp; vm)

</span><span class="cx"> {

</span><span class="cx">     Base::finishCreation(vm);

</span><del>-    ASSERT(inherits(info()));

</del><ins>+    ASSERT(inherits(vm, info()));

</ins><span class="cx"> }

</span><span class="cx"> 

</span><span class="cx"> CInstance* CRuntimeObject::getInternalCInstance() const

</span></span></pre></div>

<a id="trunkSourceWebCorebridgecc_instancecpp"></a>

<div class="modfile"><h4>Modified: trunk/Source/WebCore/bridge/c/c_instance.cpp (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/WebCore/bridge/c/c_instance.cpp        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/WebCore/bridge/c/c_instance.cpp        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -141,7 +141,7 @@

</span><span class="cx">     void finishCreation(VM&amp; vm, const String&amp; name)

</span><span class="cx">     {

</span><span class="cx">         Base::finishCreation(vm, name);

</span><del>-        ASSERT(inherits(info()));

</del><ins>+        ASSERT(inherits(vm, info()));

</ins><span class="cx">     }

</span><span class="cx"> 

</span><span class="cx"> };

</span><span class="lines">@@ -159,7 +159,7 @@

</span><span class="cx">     VM&amp; vm = exec-&gt;vm();

</span><span class="cx">     auto scope = DECLARE_THROW_SCOPE(vm);

</span><span class="cx"> 

</span><del>-    if (!asObject(runtimeMethod)-&gt;inherits(CRuntimeMethod::info()))

</del><ins>+    if (!asObject(runtimeMethod)-&gt;inherits(vm, CRuntimeMethod::info()))

</ins><span class="cx">         return throwTypeError(exec, scope, ASCIILiteral(&quot;Attempt to invoke non-plug-in method on plug-in object.&quot;));

</span><span class="cx"> 

</span><span class="cx">     CMethod* method = static_cast&lt;CMethod*&gt;(runtimeMethod-&gt;method());

</span></span></pre></div>

<a id="trunkSourceWebCorebridgecc_utilitycpp"></a>

<div class="modfile"><h4>Modified: trunk/Source/WebCore/bridge/c/c_utility.cpp (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/WebCore/bridge/c/c_utility.cpp        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/WebCore/bridge/c/c_utility.cpp        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -70,7 +70,8 @@

</span><span class="cx"> void convertValueToNPVariant(ExecState* exec, JSValue value, NPVariant* result)

</span><span class="cx"> {

</span><span class="cx">     JSLockHolder lock(exec);

</span><del>-

</del><ins>+    VM&amp; vm = exec-&gt;vm();

+    

</ins><span class="cx">     VOID_TO_NPVARIANT(*result);

</span><span class="cx"> 

</span><span class="cx">     if (value.isString()) {

</span><span class="lines">@@ -86,7 +87,7 @@

</span><span class="cx">         NULL_TO_NPVARIANT(*result);

</span><span class="cx">     } else if (value.isObject()) {

</span><span class="cx">         JSObject* object = asObject(value);

</span><del>-        if (object-&gt;classInfo() == CRuntimeObject::info()) {

</del><ins>+        if (object-&gt;classInfo(vm) == CRuntimeObject::info()) {

</ins><span class="cx">             CRuntimeObject* runtimeObject = static_cast&lt;CRuntimeObject*&gt;(object);

</span><span class="cx">             CInstance* instance = runtimeObject-&gt;getInternalCInstance();

</span><span class="cx">             if (instance) {

</span></span></pre></div>

<a id="trunkSourceWebCorebridgeobjcObjCRuntimeObjectmm"></a>

<div class="modfile"><h4>Modified: trunk/Source/WebCore/bridge/objc/ObjCRuntimeObject.mm (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/WebCore/bridge/objc/ObjCRuntimeObject.mm        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/WebCore/bridge/objc/ObjCRuntimeObject.mm        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -43,7 +43,7 @@

</span><span class="cx"> void ObjCRuntimeObject::finishCreation(VM&amp; vm)

</span><span class="cx"> {

</span><span class="cx">     Base::finishCreation(vm);

</span><del>-    ASSERT(inherits(&amp;s_info));

</del><ins>+    ASSERT(inherits(vm, &amp;s_info));

</ins><span class="cx"> }

</span><span class="cx"> 

</span><span class="cx"> ObjcInstance* ObjCRuntimeObject::getInternalObjCInstance() const

</span></span></pre></div>

<a id="trunkSourceWebCorebridgeobjcWebScriptObjectmm"></a>

<div class="modfile"><h4>Modified: trunk/Source/WebCore/bridge/objc/WebScriptObject.mm (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/WebCore/bridge/objc/WebScriptObject.mm        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/WebCore/bridge/objc/WebScriptObject.mm        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -399,7 +399,7 @@

</span><span class="cx">     auto scope = DECLARE_CATCH_SCOPE(vm);

</span><span class="cx">     ExecState* exec = globalObject-&gt;globalExec();

</span><span class="cx"> 

</span><del>-    JSObject* object = jsDynamicDowncast&lt;JSObject*&gt;([self _imp]);

</del><ins>+    JSObject* object = jsDynamicDowncast&lt;JSObject*&gt;(vm, [self _imp]);

</ins><span class="cx">     PutPropertySlot slot(object);

</span><span class="cx">     object-&gt;methodTable()-&gt;put(object, exec, Identifier::fromString(exec, String(key)), convertObjcValueToValue(exec, &amp;value, ObjcObjectType, [self _rootObject]), slot);

</span><span class="cx"> 

</span><span class="lines">@@ -565,13 +565,14 @@

</span><span class="cx"> {

</span><span class="cx">     if (value.isObject()) {

</span><span class="cx">         JSObject* object = asObject(value);

</span><del>-        JSLockHolder lock(rootObject-&gt;globalObject()-&gt;vm());

</del><ins>+        JSC::VM&amp; vm = rootObject-&gt;globalObject()-&gt;vm();

+        JSLockHolder lock(vm);

</ins><span class="cx"> 

</span><del>-        if (object-&gt;inherits(JSHTMLElement::info())) {

</del><ins>+        if (object-&gt;inherits(vm, JSHTMLElement::info())) {

</ins><span class="cx">             // Plugin elements cache the instance internally.

</span><span class="cx">             if (ObjcInstance* instance = static_cast&lt;ObjcInstance*&gt;(pluginInstance(jsCast&lt;JSHTMLElement*&gt;(object)-&gt;wrapped())))

</span><span class="cx">                 return instance-&gt;getObject();

</span><del>-        } else if (object-&gt;inherits(ObjCRuntimeObject::info())) {

</del><ins>+        } else if (object-&gt;inherits(vm, ObjCRuntimeObject::info())) {

</ins><span class="cx">             ObjCRuntimeObject* runtimeObject = static_cast&lt;ObjCRuntimeObject*&gt;(object);

</span><span class="cx">             ObjcInstance* instance = runtimeObject-&gt;getInternalObjCInstance();

</span><span class="cx">             if (instance)

</span></span></pre></div>

<a id="trunkSourceWebCorebridgeobjcobjc_instancemm"></a>

<div class="modfile"><h4>Modified: trunk/Source/WebCore/bridge/objc/objc_instance.mm (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/WebCore/bridge/objc/objc_instance.mm        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/WebCore/bridge/objc/objc_instance.mm        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -194,7 +194,7 @@

</span><span class="cx">     void finishCreation(VM&amp; vm, const String&amp; name)

</span><span class="cx">     {

</span><span class="cx">         Base::finishCreation(vm, name);

</span><del>-        ASSERT(inherits(info()));

</del><ins>+        ASSERT(inherits(vm, info()));

</ins><span class="cx">     }

</span><span class="cx"> };

</span><span class="cx"> 

</span><span class="lines">@@ -211,7 +211,7 @@

</span><span class="cx">     JSC::VM&amp; vm = exec-&gt;vm();

</span><span class="cx">     auto scope = DECLARE_THROW_SCOPE(vm);

</span><span class="cx"> 

</span><del>-    if (!asObject(runtimeMethod)-&gt;inherits(ObjCRuntimeMethod::info()))

</del><ins>+    if (!asObject(runtimeMethod)-&gt;inherits(vm, ObjCRuntimeMethod::info()))

</ins><span class="cx">         return throwTypeError(exec, scope, ASCIILiteral(&quot;Attempt to invoke non-plug-in method on plug-in object.&quot;));

</span><span class="cx"> 

</span><span class="cx">     ObjcMethod *method = static_cast&lt;ObjcMethod*&gt;(runtimeMethod-&gt;method());

</span></span></pre></div>

<a id="trunkSourceWebCorebridgeobjcobjc_runtimemm"></a>

<div class="modfile"><h4>Modified: trunk/Source/WebCore/bridge/objc/objc_runtime.mm (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/WebCore/bridge/objc/objc_runtime.mm        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/WebCore/bridge/objc/objc_runtime.mm        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -226,8 +226,9 @@

</span><span class="cx"> 

</span><span class="cx"> void ObjcFallbackObjectImp::finishCreation(JSGlobalObject* globalObject)

</span><span class="cx"> {

</span><del>-    Base::finishCreation(globalObject-&gt;vm());

-    ASSERT(inherits(info()));

</del><ins>+    VM&amp; vm = globalObject-&gt;vm();

+    Base::finishCreation(vm);

+    ASSERT(inherits(vm, info()));

</ins><span class="cx"> }

</span><span class="cx"> 

</span><span class="cx"> bool ObjcFallbackObjectImp::getOwnPropertySlot(JSObject*, ExecState*, PropertyName, PropertySlot&amp; slot)

</span><span class="lines">@@ -248,7 +249,7 @@

</span><span class="cx">     auto scope = DECLARE_THROW_SCOPE(vm);

</span><span class="cx"> 

</span><span class="cx">     JSValue thisValue = exec-&gt;thisValue();

</span><del>-    if (!thisValue.inherits(ObjCRuntimeObject::info()))

</del><ins>+    if (!thisValue.inherits(vm, ObjCRuntimeObject::info()))

</ins><span class="cx">         return throwVMTypeError(exec, scope);

</span><span class="cx"> 

</span><span class="cx">     JSValue result = jsUndefined();

</span></span></pre></div>

<a id="trunkSourceWebCorebridgeruntime_arraycpp"></a>

<div class="modfile"><h4>Modified: trunk/Source/WebCore/bridge/runtime_array.cpp (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/WebCore/bridge/runtime_array.cpp        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/WebCore/bridge/runtime_array.cpp        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -46,7 +46,7 @@

</span><span class="cx"> void RuntimeArray::finishCreation(VM&amp; vm, Bindings::Array* array)

</span><span class="cx"> {

</span><span class="cx">     Base::finishCreation(vm);

</span><del>-    ASSERT(inherits(info()));

</del><ins>+    ASSERT(inherits(vm, info()));

</ins><span class="cx">     m_array = array;

</span><span class="cx"> }

</span><span class="cx"> 

</span><span class="lines">@@ -65,7 +65,7 @@

</span><span class="cx">     VM&amp; vm = exec-&gt;vm();

</span><span class="cx">     auto scope = DECLARE_THROW_SCOPE(vm);

</span><span class="cx"> 

</span><del>-    RuntimeArray* thisObject = jsDynamicDowncast&lt;RuntimeArray*&gt;(JSValue::decode(thisValue));

</del><ins>+    RuntimeArray* thisObject = jsDynamicDowncast&lt;RuntimeArray*&gt;(vm, JSValue::decode(thisValue));

</ins><span class="cx">     if (!thisObject)

</span><span class="cx">         return throwVMTypeError(exec, scope);

</span><span class="cx">     return JSValue::encode(jsNumber(thisObject-&gt;getLength()));

</span></span></pre></div>

<a id="trunkSourceWebCorebridgeruntime_methodcpp"></a>

<div class="modfile"><h4>Modified: trunk/Source/WebCore/bridge/runtime_method.cpp (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/WebCore/bridge/runtime_method.cpp        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/WebCore/bridge/runtime_method.cpp        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -51,7 +51,7 @@

</span><span class="cx"> void RuntimeMethod::finishCreation(VM&amp; vm, const String&amp; ident)

</span><span class="cx"> {

</span><span class="cx">     Base::finishCreation(vm, ident);

</span><del>-    ASSERT(inherits(info()));

</del><ins>+    ASSERT(inherits(vm, info()));

</ins><span class="cx"> }

</span><span class="cx"> 

</span><span class="cx"> EncodedJSValue RuntimeMethod::lengthGetter(ExecState* exec, EncodedJSValue thisValue, PropertyName)

</span><span class="lines">@@ -59,7 +59,7 @@

</span><span class="cx">     VM&amp; vm = exec-&gt;vm();

</span><span class="cx">     auto scope = DECLARE_THROW_SCOPE(vm);

</span><span class="cx"> 

</span><del>-    RuntimeMethod* thisObject = jsDynamicDowncast&lt;RuntimeMethod*&gt;(JSValue::decode(thisValue));

</del><ins>+    RuntimeMethod* thisObject = jsDynamicDowncast&lt;RuntimeMethod*&gt;(vm, JSValue::decode(thisValue));

</ins><span class="cx">     if (!thisObject)

</span><span class="cx">         return throwVMTypeError(exec, scope);

</span><span class="cx">     return JSValue::encode(jsNumber(thisObject-&gt;m_method-&gt;numParameters()));

</span><span class="lines">@@ -89,7 +89,7 @@

</span><span class="cx">     RefPtr&lt;Instance&gt; instance;

</span><span class="cx"> 

</span><span class="cx">     JSValue thisValue = exec-&gt;thisValue();

</span><del>-    if (thisValue.inherits(RuntimeObject::info())) {

</del><ins>+    if (thisValue.inherits(vm, RuntimeObject::info())) {

</ins><span class="cx">         RuntimeObject* runtimeObject = static_cast&lt;RuntimeObject*&gt;(asObject(thisValue));

</span><span class="cx">         instance = runtimeObject-&gt;getInternalInstance();

</span><span class="cx">         if (!instance) 

</span><span class="lines">@@ -96,7 +96,7 @@

</span><span class="cx">             return JSValue::encode(RuntimeObject::throwInvalidAccessError(exec, scope));

</span><span class="cx">     } else {

<span class="cx">         // Calling a runtime object of a plugin element?

</span><del>-        if (thisValue.inherits(JSHTMLElement::info()))

</del><ins>+        if (thisValue.inherits(vm, JSHTMLElement::info()))

</ins><span class="cx">             instance = pluginInstance(jsCast&lt;JSHTMLElement*&gt;(asObject(thisValue))-&gt;wrapped());

</span><span class="cx">         if (!instance)

</span><span class="cx">             return throwVMTypeError(exec, scope);

</span></span></pre></div>

<a id="trunkSourceWebCorebridgeruntime_objectcpp"></a>

<div class="modfile"><h4>Modified: trunk/Source/WebCore/bridge/runtime_object.cpp (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/WebCore/bridge/runtime_object.cpp        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/WebCore/bridge/runtime_object.cpp        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -46,7 +46,7 @@

</span><span class="cx"> void RuntimeObject::finishCreation(VM&amp; vm)

</span><span class="cx"> {

</span><span class="cx">     Base::finishCreation(vm);

</span><del>-    ASSERT(inherits(info()));

</del><ins>+    ASSERT(inherits(vm, info()));

</ins><span class="cx"> }

</span><span class="cx"> 

</span><span class="cx"> void RuntimeObject::destroy(JSCell* cell)

</span><span class="lines">@@ -224,7 +224,7 @@

</span><span class="cx"> 

</span><span class="cx"> static EncodedJSValue JSC_HOST_CALL callRuntimeObject(ExecState* exec)

</span><span class="cx"> {

</span><del>-    ASSERT(exec-&gt;jsCallee()-&gt;inherits(RuntimeObject::info()));

</del><ins>+    ASSERT(exec-&gt;jsCallee()-&gt;inherits(exec-&gt;vm(), RuntimeObject::info()));

</ins><span class="cx">     RefPtr&lt;Instance&gt; instance(static_cast&lt;RuntimeObject*&gt;(exec-&gt;jsCallee())-&gt;getInternalInstance());

</span><span class="cx">     instance-&gt;begin();

</span><span class="cx">     JSValue result = instance-&gt;invokeDefaultMethod(exec);

</span><span class="lines">@@ -249,7 +249,7 @@

</span><span class="cx"> static EncodedJSValue JSC_HOST_CALL callRuntimeConstructor(ExecState* exec)

</span><span class="cx"> {

</span><span class="cx">     JSObject* constructor = exec-&gt;jsCallee();

</span><del>-    ASSERT(constructor-&gt;inherits(RuntimeObject::info()));

</del><ins>+    ASSERT(constructor-&gt;inherits(exec-&gt;vm(), RuntimeObject::info()));

</ins><span class="cx">     RefPtr&lt;Instance&gt; instance(static_cast&lt;RuntimeObject*&gt;(exec-&gt;jsCallee())-&gt;getInternalInstance());

</span><span class="cx">     instance-&gt;begin();

</span><span class="cx">     ArgList args(exec);

</span></span></pre></div>

<a id="trunkSourceWebCorecssFontFacecpp"></a>

<div class="modfile"><h4>Modified: trunk/Source/WebCore/css/FontFace.cpp (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/WebCore/css/FontFace.cpp        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/WebCore/css/FontFace.cpp        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -48,6 +48,7 @@

</span><span class="cx"> 

</span><span class="cx"> ExceptionOr&lt;Ref&lt;FontFace&gt;&gt; FontFace::create(JSC::ExecState&amp; state, Document&amp; document, const String&amp; family, JSC::JSValue source, const Descriptors&amp; descriptors)

</span><span class="cx"> {

</span><ins>+    JSC::VM&amp; vm = state.vm();

</ins><span class="cx">     auto result = adoptRef(*new FontFace(document.fontSelector()));

</span><span class="cx"> 

</span><span class="cx">     bool dataRequiresAsynchronousLoading = true;

</span><span class="lines">@@ -61,9 +62,9 @@

</span><span class="cx">         if (!is&lt;CSSValueList&gt;(value.get()))

</span><span class="cx">             return Exception { SYNTAX_ERR };

</span><span class="cx">         CSSFontFace::appendSources(result-&gt;backing(), downcast&lt;CSSValueList&gt;(*value), &amp;document, false);

</span><del>-    } else if (auto arrayBufferView = toUnsharedArrayBufferView(source))

</del><ins>+    } else if (auto arrayBufferView = toUnsharedArrayBufferView(vm, source))

</ins><span class="cx">         dataRequiresAsynchronousLoading = populateFontFaceWithArrayBuffer(result-&gt;backing(), arrayBufferView.releaseNonNull());

</span><del>-    else if (auto arrayBuffer = toUnsharedArrayBuffer(source)) {

</del><ins>+    else if (auto arrayBuffer = toUnsharedArrayBuffer(vm, source)) {

</ins><span class="cx">         auto arrayBufferView = JSC::Uint8Array::create(arrayBuffer, 0, arrayBuffer-&gt;byteLength());

</span><span class="cx">         dataRequiresAsynchronousLoading = populateFontFaceWithArrayBuffer(result-&gt;backing(), arrayBufferView.releaseNonNull());

</span><span class="cx">     }

</span></span></pre></div>

<a id="trunkSourceWebCorehtmlHTMLMediaElementcpp"></a>

<div class="modfile"><h4>Modified: trunk/Source/WebCore/html/HTMLMediaElement.cpp (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/WebCore/html/HTMLMediaElement.cpp        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/WebCore/html/HTMLMediaElement.cpp        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -3881,7 +3881,7 @@

</span><span class="cx">     auto mediaJSWrapper = toJS(&amp;exec, &amp;globalObject, media);

</span><span class="cx">     

</span><span class="cx">     // Retrieve the controller through the JS object graph

</span><del>-    JSC::JSObject* mediaJSWrapperObject = jsDynamicDowncast&lt;JSC::JSObject*&gt;(mediaJSWrapper);

</del><ins>+    JSC::JSObject* mediaJSWrapperObject = jsDynamicDowncast&lt;JSC::JSObject*&gt;(vm, mediaJSWrapper);

</ins><span class="cx">     if (!mediaJSWrapperObject)

</span><span class="cx">         return JSC::jsNull();

</span><span class="cx">     

</span><span class="lines">@@ -3889,7 +3889,7 @@

</span><span class="cx">     JSC::JSValue controlsHostJSWrapper = mediaJSWrapperObject-&gt;get(&amp;exec, controlsHost);

</span><span class="cx">     RETURN_IF_EXCEPTION(scope, JSC::jsNull());

</span><span class="cx"> 

</span><del>-    JSC::JSObject* controlsHostJSWrapperObject = jsDynamicDowncast&lt;JSC::JSObject*&gt;(controlsHostJSWrapper);

</del><ins>+    JSC::JSObject* controlsHostJSWrapperObject = jsDynamicDowncast&lt;JSC::JSObject*&gt;(vm, controlsHostJSWrapper);

</ins><span class="cx">     if (!controlsHostJSWrapperObject)

</span><span class="cx">         return JSC::jsNull();

</span><span class="cx"> 

</span><span class="lines">@@ -3937,7 +3937,7 @@

</span><span class="cx">     JSC::ExecState* exec = globalObject-&gt;globalExec();

</span><span class="cx"> 

</span><span class="cx">     JSC::JSValue controllerValue = controllerJSValue(*exec, *globalObject, *this);

</span><del>-    JSC::JSObject* controllerObject = jsDynamicDowncast&lt;JSC::JSObject*&gt;(controllerValue);

</del><ins>+    JSC::JSObject* controllerObject = jsDynamicDowncast&lt;JSC::JSObject*&gt;(vm, controllerValue);

</ins><span class="cx">     if (!controllerObject)

</span><span class="cx">         return;

</span><span class="cx"> 

</span><span class="lines">@@ -3948,7 +3948,7 @@

</span><span class="cx">     // Return value:

</span><span class="cx">     //     None

</span><span class="cx">     JSC::JSValue methodValue = controllerObject-&gt;get(exec, JSC::Identifier::fromString(exec, &quot;updateCaptionContainer&quot;));

</span><del>-    JSC::JSObject* methodObject = jsDynamicDowncast&lt;JSC::JSObject*&gt;(methodValue);

</del><ins>+    JSC::JSObject* methodObject = jsDynamicDowncast&lt;JSC::JSObject*&gt;(vm, methodValue);

</ins><span class="cx">     if (!methodObject)

</span><span class="cx">         return;

</span><span class="cx"> 

</span><span class="lines">@@ -6663,7 +6663,7 @@

</span><span class="cx"> 

</span><span class="cx">     JSC::JSValue controllerValue = JSC::call(exec, function, callType, callData, globalObject, argList);

</span><span class="cx">     scope.clearException();

</span><del>-    JSC::JSObject* controllerObject = jsDynamicDowncast&lt;JSC::JSObject*&gt;(controllerValue);

</del><ins>+    JSC::JSObject* controllerObject = jsDynamicDowncast&lt;JSC::JSObject*&gt;(vm, controllerValue);

</ins><span class="cx">     if (!controllerObject)

</span><span class="cx">         return;

</span><span class="cx"> 

</span><span class="lines">@@ -6676,7 +6676,7 @@

</span><span class="cx"> 

</span><span class="cx">     mediaJSWrapperObject-&gt;putDirect(exec-&gt;vm(), controlsHost, mediaControlsHostJSWrapper, JSC::DontDelete | JSC::DontEnum | JSC::ReadOnly);

</span><span class="cx"> 

</span><del>-    JSC::JSObject* mediaControlsHostJSWrapperObject = jsDynamicDowncast&lt;JSC::JSObject*&gt;(mediaControlsHostJSWrapper);

</del><ins>+    JSC::JSObject* mediaControlsHostJSWrapperObject = jsDynamicDowncast&lt;JSC::JSObject*&gt;(vm, mediaControlsHostJSWrapper);

</ins><span class="cx">     if (!mediaControlsHostJSWrapperObject)

</span><span class="cx">         return;

</span><span class="cx">     

</span></span></pre></div>

<a id="trunkSourceWebCoreinspectorInspectorControllercpp"></a>

<div class="modfile"><h4>Modified: trunk/Source/WebCore/inspector/InspectorController.cpp (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/WebCore/inspector/InspectorController.cpp        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/WebCore/inspector/InspectorController.cpp        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -434,7 +434,8 @@

</span><span class="cx"> bool InspectorController::canAccessInspectedScriptState(JSC::ExecState* scriptState) const

</span><span class="cx"> {

</span><span class="cx">     JSLockHolder lock(scriptState);

</span><del>-    JSDOMWindow* inspectedWindow = toJSDOMWindow(scriptState-&gt;lexicalGlobalObject());

</del><ins>+

+    JSDOMWindow* inspectedWindow = toJSDOMWindow(scriptState-&gt;vm(), scriptState-&gt;lexicalGlobalObject());

</ins><span class="cx">     if (!inspectedWindow)

</span><span class="cx">         return false;

</span><span class="cx"> 

</span></span></pre></div>

<a id="trunkSourceWebCoreinspectorInspectorDOMAgentcpp"></a>

<div class="modfile"><h4>Modified: trunk/Source/WebCore/inspector/InspectorDOMAgent.cpp (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/WebCore/inspector/InspectorDOMAgent.cpp        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/WebCore/inspector/InspectorDOMAgent.cpp        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -1510,7 +1510,7 @@

</span><span class="cx">         handler = scriptListener-&gt;jsFunction(&amp;node-&gt;document());

</span><span class="cx">         if (handler &amp;&amp; state) {

</span><span class="cx">             body = handler-&gt;toString(state)-&gt;value(state);

</span><del>-            if (auto function = jsDynamicDowncast&lt;JSC::JSFunction*&gt;(handler)) {

</del><ins>+            if (auto function = jsDynamicDowncast&lt;JSC::JSFunction*&gt;(state-&gt;vm(), handler)) {

</ins><span class="cx">                 if (!function-&gt;isHostOrBuiltinFunction()) {

</span><span class="cx">                     if (auto executable = function-&gt;jsExecutable()) {

</span><span class="cx">                         lineNumber = executable-&gt;firstLine() - 1;

</span><span class="lines">@@ -2227,9 +2227,9 @@

</span><span class="cx"> 

</span><span class="cx"> Node* InspectorDOMAgent::scriptValueAsNode(JSC::JSValue value)

</span><span class="cx"> {

</span><del>-    if (!value)

</del><ins>+    if (!value || !value.isObject())

</ins><span class="cx">         return nullptr;

</span><del>-    return JSNode::toWrapped(value);

</del><ins>+    return JSNode::toWrapped(*value.getObject()-&gt;vm(), value.getObject());

</ins><span class="cx"> }

</span><span class="cx"> 

</span><span class="cx"> JSC::JSValue InspectorDOMAgent::nodeAsScriptValue(JSC::ExecState&amp; state, Node* node)

</span></span></pre></div>

<a id="trunkSourceWebCoreinspectorWebInjectedScriptHostcpp"></a>

<div class="modfile"><h4>Modified: trunk/Source/WebCore/inspector/WebInjectedScriptHost.cpp (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/WebCore/inspector/WebInjectedScriptHost.cpp        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/WebCore/inspector/WebInjectedScriptHost.cpp        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -38,16 +38,17 @@

</span><span class="cx"> namespace WebCore {

</span><span class="cx">     

</span><span class="cx"> #define RETURN_ERROR_IF_VALUE_INHERITS_EXCEPTION_TYPE(interfaceName) \

</span><del>-    if (value.inherits(JS##interfaceName::info())) \

</del><ins>+    if (value.inherits(vm, JS##interfaceName::info())) \

</ins><span class="cx">         return jsNontrivialString(exec, ASCIILiteral(&quot;error&quot;));

</span><span class="cx"> 

</span><span class="cx"> JSValue WebInjectedScriptHost::subtype(JSC::ExecState* exec, JSC::JSValue value)

</span><span class="cx"> {

</span><del>-    if (value.inherits(JSNode::info()))

</del><ins>+    VM&amp; vm = exec-&gt;vm();

+    if (value.inherits(vm, JSNode::info()))

</ins><span class="cx">         return jsNontrivialString(exec, ASCIILiteral(&quot;node&quot;));

</span><del>-    if (value.inherits(JSNodeList::info()))

</del><ins>+    if (value.inherits(vm, JSNodeList::info()))

</ins><span class="cx">         return jsNontrivialString(exec, ASCIILiteral(&quot;array&quot;));

</span><del>-    if (value.inherits(JSHTMLCollection::info()))

</del><ins>+    if (value.inherits(vm, JSHTMLCollection::info()))

</ins><span class="cx">         return jsNontrivialString(exec, ASCIILiteral(&quot;array&quot;));

</span><span class="cx"> 

</span><span class="cx">     DOM_EXCEPTION_INTERFACES_FOR_EACH(RETURN_ERROR_IF_VALUE_INHERITS_EXCEPTION_TYPE)

</span><span class="lines">@@ -55,9 +56,9 @@

</span><span class="cx">     return jsUndefined();

</span><span class="cx"> }

</span><span class="cx"> 

</span><del>-bool WebInjectedScriptHost::isHTMLAllCollection(JSC::JSValue value)

</del><ins>+bool WebInjectedScriptHost::isHTMLAllCollection(JSC::VM&amp; vm, JSC::JSValue value)

</ins><span class="cx"> {

</span><del>-    return value.inherits(JSHTMLAllCollection::info());

</del><ins>+    return value.inherits(vm, JSHTMLAllCollection::info());

</ins><span class="cx"> }

</span><span class="cx"> 

</span><span class="cx"> } // namespace WebCore

</span></span></pre></div>

<a id="trunkSourceWebCoreinspectorWebInjectedScriptHosth"></a>

<div class="modfile"><h4>Modified: trunk/Source/WebCore/inspector/WebInjectedScriptHost.h (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/WebCore/inspector/WebInjectedScriptHost.h        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/WebCore/inspector/WebInjectedScriptHost.h        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -34,7 +34,7 @@

</span><span class="cx">     static Ref&lt;WebInjectedScriptHost&gt; create() { return adoptRef(*new WebInjectedScriptHost); }

</span><span class="cx"> 

</span><span class="cx">     JSC::JSValue subtype(JSC::ExecState*, JSC::JSValue) override;

</span><del>-    bool isHTMLAllCollection(JSC::JSValue) override;

</del><ins>+    bool isHTMLAllCollection(JSC::VM&amp;, JSC::JSValue) override;

</ins><span class="cx"> };

</span><span class="cx"> 

</span><span class="cx"> } // namespace WebCore

</span></span></pre></div>

<a id="trunkSourceWebKitmacChangeLog"></a>

<div class="modfile"><h4>Modified: trunk/Source/WebKit/mac/ChangeLog (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/WebKit/mac/ChangeLog        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/WebKit/mac/ChangeLog        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -1,3 +1,37 @@

</span><ins>+2017-01-26  Keith Miller  &lt;keith_miller@apple.com&gt;

+

+        classInfo should take a VM so it is not materialized from the object on each call

+        https://bugs.webkit.org/show_bug.cgi?id=167424

+

+        Rubber Stamped by Michael Saboff.

+

+        Previously, classInfo() would get the VM from the target's

+        MarkedBlock.  Most callers already have a VM on hand, so it is

+        wasteful to compute the VM from the marked block every time. This

+        patch refactors some of the most common callers of classInfo(),

+        jsDynamicCast and inherits to take a VM as well.

+

+        * DOM/DOM.mm:

+        (+[DOMNode _nodeFromJSWrapper:]):

+        * DOM/DOMUtility.mm:

+        (createDOMWrapper):

+        * DOM/WebDOMOperations.mm:

+        * Plugins/Hosted/NetscapePluginInstanceProxy.mm:

+        (WebKit::getObjectID):

+        (WebKit::NetscapePluginInstanceProxy::retainLocalObject):

+        (WebKit::NetscapePluginInstanceProxy::releaseLocalObject):

+        * Plugins/Hosted/ProxyInstance.mm:

+        (WebKit::ProxyRuntimeMethod::finishCreation):

+        (WebKit::ProxyInstance::invokeMethod):

+        * Plugins/Hosted/ProxyRuntimeObject.mm:

+        (WebKit::ProxyRuntimeObject::finishCreation):

+        * WebView/WebFrame.mm:

+        (-[WebFrame _stringByEvaluatingJavaScriptFromString:withGlobalObject:inScriptWorld:]):

+        * WebView/WebView.mm:

+        (+[WebView _reportException:inContext:]):

+        (aeDescFromJSValue):

+        (-[WebView _notificationIDForTesting:]):

+

</ins><span class="cx"> 2017-01-26  Wenson Hsieh  &lt;wenson_hsieh@apple.com&gt;

</span><span class="cx"> 

</span><span class="cx">         REGRESSION (r207483): Touch Bar: Lists and BIU Buttons Missing from Touch Bar in HTML Notes

</span></span></pre></div>

<a id="trunkSourceWebKitmacDOMDOMmm"></a>

<div class="modfile"><h4>Modified: trunk/Source/WebKit/mac/DOM/DOM.mm (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/WebKit/mac/DOM/DOM.mm        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/WebKit/mac/DOM/DOM.mm        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -534,7 +534,7 @@

</span><span class="cx"> + (id)_nodeFromJSWrapper:(JSObjectRef)jsWrapper

</span><span class="cx"> {

</span><span class="cx">     JSObject* object = toJS(jsWrapper);

</span><del>-    if (!object-&gt;inherits(JSNode::info()))

</del><ins>+    if (!object-&gt;inherits(*object-&gt;vm(), JSNode::info()))

</ins><span class="cx">         return nil;

</span><span class="cx">     return kit(&amp;jsCast&lt;JSNode*&gt;(object)-&gt;wrapped());

</span><span class="cx"> }

</span></span></pre></div>

<a id="trunkSourceWebKitmacDOMDOMUtilitymm"></a>

<div class="modfile"><h4>Modified: trunk/Source/WebKit/mac/DOM/DOMUtility.mm (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/WebKit/mac/DOM/DOMUtility.mm        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/WebKit/mac/DOM/DOMUtility.mm        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -74,8 +74,9 @@

</span><span class="cx"> 

</span><span class="cx"> static WebScriptObject *createDOMWrapper(JSC::JSObject&amp; jsWrapper)

</span><span class="cx"> {

</span><ins>+    JSC::VM&amp; vm = *jsWrapper.vm();

</ins><span class="cx">     #define WRAP(className) \

</span><del>-        if (auto* wrapped = WebCore::JS##className::toWrapped(&amp;jsWrapper)) \

</del><ins>+        if (auto* wrapped = WebCore::JS##className::toWrapped(vm, &amp;jsWrapper)) \

</ins><span class="cx">             return kit(wrapped);

</span><span class="cx"> 

</span><span class="cx">     WRAP(CSSRule)

</span></span></pre></div>

<a id="trunkSourceWebKitmacDOMWebDOMOperationsmm"></a>

<div class="modfile"><h4>Modified: trunk/Source/WebKit/mac/DOM/WebDOMOperations.mm (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/WebKit/mac/DOM/WebDOMOperations.mm        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/WebKit/mac/DOM/WebDOMOperations.mm        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -74,7 +74,7 @@

</span><span class="cx"> 

</span><span class="cx">     ExecState* exec = toJS(context);

</span><span class="cx">     JSLockHolder lock(exec);

</span><del>-    return kit(JSElement::toWrapped(toJS(exec, value)));

</del><ins>+    return kit(JSElement::toWrapped(exec-&gt;vm(), toJS(exec, value)));

</ins><span class="cx"> }

</span><span class="cx"> 

</span><span class="cx"> @end

</span></span></pre></div>

<a id="trunkSourceWebKitmacPluginsHostedNetscapePluginInstanceProxymm"></a>

<div class="modfile"><h4>Modified: trunk/Source/WebKit/mac/Plugins/Hosted/NetscapePluginInstanceProxy.mm (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/WebKit/mac/Plugins/Hosted/NetscapePluginInstanceProxy.mm        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/WebKit/mac/Plugins/Hosted/NetscapePluginInstanceProxy.mm        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -1299,7 +1299,8 @@

</span><span class="cx"> 

</span><span class="cx"> static bool getObjectID(NetscapePluginInstanceProxy* pluginInstanceProxy, JSObject* object, uint64_t&amp; objectID)

</span><span class="cx"> {

</span><del>-    if (object-&gt;classInfo() != ProxyRuntimeObject::info())

</del><ins>+    JSC::VM&amp; vm = *object-&gt;vm();

+    if (object-&gt;classInfo(vm) != ProxyRuntimeObject::info())

</ins><span class="cx">         return false;

</span><span class="cx"> 

</span><span class="cx">     ProxyRuntimeObject* runtimeObject = static_cast&lt;ProxyRuntimeObject*&gt;(object);

</span><span class="lines">@@ -1454,7 +1455,7 @@

</span><span class="cx"> 

</span><span class="cx"> void NetscapePluginInstanceProxy::retainLocalObject(JSC::JSValue value)

</span><span class="cx"> {

</span><del>-    if (!value.isObject() || value.inherits(ProxyRuntimeObject::info()))

</del><ins>+    if (!value.isObject() || value.inherits(*value.getObject()-&gt;vm(), ProxyRuntimeObject::info()))

</ins><span class="cx">         return;

</span><span class="cx"> 

</span><span class="cx">     m_localObjects.retain(asObject(value));

</span><span class="lines">@@ -1462,7 +1463,7 @@

</span><span class="cx"> 

</span><span class="cx"> void NetscapePluginInstanceProxy::releaseLocalObject(JSC::JSValue value)

</span><span class="cx"> {

</span><del>-    if (!value.isObject() || value.inherits(ProxyRuntimeObject::info()))

</del><ins>+    if (!value.isObject() || value.inherits(*value.getObject()-&gt;vm(), ProxyRuntimeObject::info()))

</ins><span class="cx">         return;

</span><span class="cx"> 

</span><span class="cx">     m_localObjects.release(asObject(value));

</span></span></pre></div>

<a id="trunkSourceWebKitmacPluginsHostedProxyInstancemm"></a>

<div class="modfile"><h4>Modified: trunk/Source/WebKit/mac/Plugins/Hosted/ProxyInstance.mm (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/WebKit/mac/Plugins/Hosted/ProxyInstance.mm        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/WebKit/mac/Plugins/Hosted/ProxyInstance.mm        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -206,7 +206,7 @@

</span><span class="cx">     void finishCreation(VM&amp; vm, const String&amp; name)

</span><span class="cx">     {

</span><span class="cx">         Base::finishCreation(vm, name);

</span><del>-        ASSERT(inherits(info()));

</del><ins>+        ASSERT(inherits(vm, info()));

</ins><span class="cx">     }

</span><span class="cx"> };

</span><span class="cx"> 

</span><span class="lines">@@ -223,7 +223,7 @@

</span><span class="cx">     VM&amp; vm = exec-&gt;vm();

</span><span class="cx">     auto scope = DECLARE_THROW_SCOPE(vm);

</span><span class="cx"> 

</span><del>-    if (!asObject(runtimeMethod)-&gt;inherits(ProxyRuntimeMethod::info()))

</del><ins>+    if (!asObject(runtimeMethod)-&gt;inherits(vm, ProxyRuntimeMethod::info()))

</ins><span class="cx">         return throwTypeError(exec, scope, ASCIILiteral(&quot;Attempt to invoke non-plug-in method on plug-in object.&quot;));

</span><span class="cx"> 

</span><span class="cx">     ProxyMethod* method = static_cast&lt;ProxyMethod*&gt;(runtimeMethod-&gt;method());

</span></span></pre></div>

<a id="trunkSourceWebKitmacPluginsHostedProxyRuntimeObjectmm"></a>

<div class="modfile"><h4>Modified: trunk/Source/WebKit/mac/Plugins/Hosted/ProxyRuntimeObject.mm (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/WebKit/mac/Plugins/Hosted/ProxyRuntimeObject.mm        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/WebKit/mac/Plugins/Hosted/ProxyRuntimeObject.mm        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -44,7 +44,7 @@

</span><span class="cx"> void ProxyRuntimeObject::finishCreation(VM&amp; vm)

</span><span class="cx"> {

</span><span class="cx">     Base::finishCreation(vm);

</span><del>-    ASSERT(inherits(&amp;s_info));

</del><ins>+    ASSERT(inherits(vm, &amp;s_info));

</ins><span class="cx"> }

</span><span class="cx"> 

</span><span class="cx"> ProxyInstance* ProxyRuntimeObject::getInternalProxyInstance() const

</span></span></pre></div>

<a id="trunkSourceWebKitmacWebViewWebFramemm"></a>

<div class="modfile"><h4>Modified: trunk/Source/WebKit/mac/WebView/WebFrame.mm (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/WebKit/mac/WebView/WebFrame.mm        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/WebKit/mac/WebView/WebFrame.mm        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -2064,7 +2064,8 @@

</span><span class="cx"> 

<span class="cx">     // The global object is probably a shell object? - if so, we know how to use this!

</span><span class="cx">     JSC::JSObject* globalObjectObj = toJS(globalObjectRef);

</span><del>-    if (!strcmp(globalObjectObj-&gt;classInfo()-&gt;className, &quot;JSDOMWindowShell&quot;))

</del><ins>+    JSC::VM&amp; vm = *globalObjectObj-&gt;vm();

+    if (!strcmp(globalObjectObj-&gt;classInfo(vm)-&gt;className, &quot;JSDOMWindowShell&quot;))

</ins><span class="cx">         anyWorldGlobalObject = static_cast&lt;JSDOMWindowShell*&gt;(globalObjectObj)-&gt;window();

</span><span class="cx"> 

<span class="cx">     // Get the frame frome the global object we've settled on.

</span></span></pre></div>

<a id="trunkSourceWebKitmacWebViewWebViewmm"></a>

<div class="modfile"><h4>Modified: trunk/Source/WebKit/mac/WebView/WebView.mm (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/WebKit/mac/WebView/WebView.mm        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/WebKit/mac/WebView/WebView.mm        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -1056,7 +1056,8 @@

</span><span class="cx">     JSLockHolder lock(execState);

</span><span class="cx"> 

<span class="cx">     // Make sure the context has a DOMWindow global object, otherwise this context didn't originate from a WebView.

</span><del>-    if (!toJSDOMWindow(execState-&gt;lexicalGlobalObject()))

</del><ins>+    JSC::JSGlobalObject* globalObject = execState-&gt;lexicalGlobalObject();

+    if (!toJSDOMWindow(globalObject-&gt;vm(), globalObject))

</ins><span class="cx">         return;

</span><span class="cx"> 

</span><span class="cx">     reportException(execState, toJS(execState, exception));

</span><span class="lines">@@ -7448,7 +7449,7 @@

</span><span class="cx">     }

</span><span class="cx">     if (jsValue.isObject()) {

</span><span class="cx">         JSObject* object = jsValue.getObject();

</span><del>-        if (object-&gt;inherits(DateInstance::info())) {

</del><ins>+        if (object-&gt;inherits(vm, DateInstance::info())) {

</ins><span class="cx">             DateInstance* date = static_cast&lt;DateInstance*&gt;(object);

</span><span class="cx">             double ms = date-&gt;internalNumber();

</span><span class="cx">             if (!std::isnan(ms)) {

</span><span class="lines">@@ -7457,8 +7458,7 @@

</span><span class="cx">                 if (noErr == UCConvertCFAbsoluteTimeToLongDateTime(utcSeconds, &amp;ldt))

</span><span class="cx">                     return [NSAppleEventDescriptor descriptorWithDescriptorType:typeLongDateTime bytes:&amp;ldt length:sizeof(ldt)];

</span><span class="cx">             }

</span><del>-        }

-        else if (object-&gt;inherits(JSArray::info())) {

</del><ins>+        } else if (object-&gt;inherits(vm, JSArray::info())) {

</ins><span class="cx">             static NeverDestroyed&lt;HashSet&lt;JSObject*&gt;&gt; visitedElems;

</span><span class="cx">             if (!visitedElems.get().contains(object)) {

</span><span class="cx">                 visitedElems.get().add(object);

</span><span class="lines">@@ -9889,7 +9889,7 @@

</span><span class="cx">     if (!page)

</span><span class="cx">         return 0;

</span><span class="cx">     JSContextRef context = [[self mainFrame] globalContext];

</span><del>-    auto* notification = JSNotification::toWrapped(toJS(toJS(context), jsNotification));

</del><ins>+    auto* notification = JSNotification::toWrapped(toJS(context)-&gt;vm(), toJS(toJS(context), jsNotification));

</ins><span class="cx">     return static_cast&lt;WebNotificationClient*&gt;(NotificationController::clientFrom(*page))-&gt;notificationIDForTesting(notification);

</span><span class="cx"> #else

</span><span class="cx">     return 0;

</span></span></pre></div>

<a id="trunkSourceWebKitwinChangeLog"></a>

<div class="modfile"><h4>Modified: trunk/Source/WebKit/win/ChangeLog (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/WebKit/win/ChangeLog        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/WebKit/win/ChangeLog        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -1,3 +1,21 @@

</span><ins>+2017-01-26  Keith Miller  &lt;keith_miller@apple.com&gt;

+

+        classInfo should take a VM so it is not materialized from the object on each call

+        https://bugs.webkit.org/show_bug.cgi?id=167424

+

+        Rubber Stamped by Michael Saboff.

+

+        Previously, classInfo() would get the VM from the target's

+        MarkedBlock.  Most callers already have a VM on hand, so it is

+        wasteful to compute the VM from the marked block every time. This

+        patch refactors some of the most common callers of classInfo(),

+        jsDynamicCast and inherits to take a VM as well.

+

+        * WebFrame.cpp:

+        (WebFrame::stringByEvaluatingJavaScriptInScriptWorld):

+        * WebView.cpp:

+        (WebView::elementFromJS):

+

</ins><span class="cx"> 2017-01-26  Per Arne Vollan  &lt;pvollan@apple.com&gt;

</span><span class="cx"> 

<span class="cx">         Crash when setting custom scale factor.

</span></span></pre></div>

<a id="trunkSourceWebKitwinWebFramecpp"></a>

<div class="modfile"><h4>Modified: trunk/Source/WebKit/win/WebFrame.cpp (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/WebKit/win/WebFrame.cpp        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/WebKit/win/WebFrame.cpp        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -2002,7 +2002,7 @@

</span><span class="cx"> 

<span class="cx">     // The global object is probably a shell object? - if so, we know how to use this!

</span><span class="cx">     JSC::JSObject* globalObjectObj = toJS(globalObjectRef);

</span><del>-    if (!strcmp(globalObjectObj-&gt;classInfo()-&gt;className, &quot;JSDOMWindowShell&quot;))

</del><ins>+    if (globalObjectObj-&gt;inherits(*globalObjectObj-&gt;vm(), JSDOMWindowShell::info()))

</ins><span class="cx">         anyWorldGlobalObject = static_cast&lt;JSDOMWindowShell*&gt;(globalObjectObj)-&gt;window();

</span><span class="cx"> 

<span class="cx">     // Get the frame frome the global object we've settled on.

</span></span></pre></div>

<a id="trunkSourceWebKitwinWebViewcpp"></a>

<div class="modfile"><h4>Modified: trunk/Source/WebKit/win/WebView.cpp (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/WebKit/win/WebView.cpp        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/WebKit/win/WebView.cpp        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -6492,7 +6492,7 @@

</span><span class="cx">     JSC::JSLockHolder lock(execState);

</span><span class="cx"> 

<span class="cx">     // Make sure the context has a DOMWindow global object, otherwise this context didn't originate from a WebView.

</span><del>-    if (!toJSDOMWindow(execState-&gt;lexicalGlobalObject()))

</del><ins>+    if (!toJSDOMWindow(execState-&gt;vm(), execState-&gt;lexicalGlobalObject()))

</ins><span class="cx">         return E_FAIL;

</span><span class="cx"> 

</span><span class="cx">     WebCore::reportException(execState, toJS(execState, exception));

</span><span class="lines">@@ -6511,7 +6511,7 @@

</span><span class="cx"> 

</span><span class="cx">     JSC::ExecState* exec = toJS(context);

</span><span class="cx">     JSC::JSLockHolder lock(exec);

</span><del>-    Element* elt = JSElement::toWrapped(toJS(exec, nodeObject));

</del><ins>+    Element* elt = JSElement::toWrapped(exec-&gt;vm(), toJS(exec, nodeObject));

</ins><span class="cx">     if (!elt)

</span><span class="cx">         return E_FAIL;

</span><span class="cx"> 

</span></span></pre></div>

<a id="trunkSourceWebKit2ChangeLog"></a>

<div class="modfile"><h4>Modified: trunk/Source/WebKit2/ChangeLog (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/WebKit2/ChangeLog        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/WebKit2/ChangeLog        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -1,3 +1,41 @@

</span><ins>+2017-01-26  Keith Miller  &lt;keith_miller@apple.com&gt;

+

+        classInfo should take a VM so it is not materialized from the object on each call

+        https://bugs.webkit.org/show_bug.cgi?id=167424

+

+        Rubber Stamped by Michael Saboff.

+

+        Previously, classInfo() would get the VM from the target's

+        MarkedBlock.  Most callers already have a VM on hand, so it is

+        wasteful to compute the VM from the marked block every time. This

+        patch refactors some of the most common callers of classInfo(),

+        jsDynamicCast and inherits to take a VM as well.

+

+        * WebProcess/Automation/WebAutomationSessionProxy.cpp:

+        (WebKit::WebAutomationSessionProxy::elementForNodeHandle):

+        * WebProcess/InjectedBundle/DOM/InjectedBundleNodeHandle.cpp:

+        (WebKit::InjectedBundleNodeHandle::getOrCreate):

+        * WebProcess/InjectedBundle/DOM/InjectedBundleRangeHandle.cpp:

+        (WebKit::InjectedBundleRangeHandle::getOrCreate):

+        * WebProcess/InjectedBundle/InjectedBundle.cpp:

+        (WebKit::InjectedBundle::reportException):

+        (WebKit::InjectedBundle::webNotificationID):

+        (WebKit::InjectedBundle::createWebDataFromUint8Array):

+        * WebProcess/Plugins/Netscape/JSNPMethod.cpp:

+        (WebKit::JSNPMethod::finishCreation):

+        (WebKit::callMethod):

+        * WebProcess/Plugins/Netscape/JSNPObject.cpp:

+        (WebKit::JSNPObject::finishCreation):

+        (WebKit::callNPJSObject):

+        (WebKit::constructWithConstructor):

+        * WebProcess/Plugins/Netscape/NPJSObject.cpp:

+        (WebKit::NPJSObject::create):

+        * WebProcess/Plugins/Netscape/NPRuntimeObjectMap.cpp:

+        (WebKit::NPRuntimeObjectMap::getOrCreateNPObject):

+        * WebProcess/WebPage/WebFrame.cpp:

+        (WebKit::WebFrame::frameForContext):

+        (WebKit::WebFrame::counterValue):

+

</ins><span class="cx"> 2017-01-26  Chris Dumez  &lt;cdumez@apple.com&gt;

</span><span class="cx"> 

</span><span class="cx">         Fix CPU usage diagnostic logging in PerActivityStateCPUUsageSampler

</span></span></pre></div>

<a id="trunkSourceWebKit2WebProcessAutomationWebAutomationSessionProxycpp"></a>

<div class="modfile"><h4>Modified: trunk/Source/WebKit2/WebProcess/Automation/WebAutomationSessionProxy.cpp (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/WebKit2/WebProcess/Automation/WebAutomationSessionProxy.cpp        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/WebKit2/WebProcess/Automation/WebAutomationSessionProxy.cpp        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -205,7 +205,7 @@

</span><span class="cx">     if (!element)

</span><span class="cx">         return nullptr;

</span><span class="cx"> 

</span><del>-    auto elementWrapper = WebCore::jsDynamicDowncast&lt;WebCore::JSElement*&gt;(toJS(element));

</del><ins>+    auto elementWrapper = WebCore::jsDynamicDowncast&lt;WebCore::JSElement*&gt;(toJS(context)-&gt;vm(), toJS(element));

</ins><span class="cx">     if (!elementWrapper)

</span><span class="cx">         return nullptr;

</span><span class="cx"> 

</span></span></pre></div>

<a id="trunkSourceWebKit2WebProcessInjectedBundleDOMInjectedBundleNodeHandlecpp"></a>

<div class="modfile"><h4>Modified: trunk/Source/WebKit2/WebProcess/InjectedBundle/DOM/InjectedBundleNodeHandle.cpp (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/WebKit2/WebProcess/InjectedBundle/DOM/InjectedBundleNodeHandle.cpp        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/WebKit2/WebProcess/InjectedBundle/DOM/InjectedBundleNodeHandle.cpp        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -70,7 +70,7 @@

</span><span class="cx"> 

</span><span class="cx"> RefPtr&lt;InjectedBundleNodeHandle&gt; InjectedBundleNodeHandle::getOrCreate(JSContextRef, JSObjectRef object)

</span><span class="cx"> {

</span><del>-    Node* node = JSNode::toWrapped(toJS(object));

</del><ins>+    Node* node = JSNode::toWrapped(*toJS(object)-&gt;vm(), toJS(object));

</ins><span class="cx">     return getOrCreate(node);

</span><span class="cx"> }

</span><span class="cx"> 

</span></span></pre></div>

<a id="trunkSourceWebKit2WebProcessInjectedBundleDOMInjectedBundleRangeHandlecpp"></a>

<div class="modfile"><h4>Modified: trunk/Source/WebKit2/WebProcess/InjectedBundle/DOM/InjectedBundleRangeHandle.cpp (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/WebKit2/WebProcess/InjectedBundle/DOM/InjectedBundleRangeHandle.cpp        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/WebKit2/WebProcess/InjectedBundle/DOM/InjectedBundleRangeHandle.cpp        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -57,9 +57,9 @@

</span><span class="cx">     return cache;

</span><span class="cx"> }

</span><span class="cx"> 

</span><del>-PassRefPtr&lt;InjectedBundleRangeHandle&gt; InjectedBundleRangeHandle::getOrCreate(JSContextRef, JSObjectRef object)

</del><ins>+PassRefPtr&lt;InjectedBundleRangeHandle&gt; InjectedBundleRangeHandle::getOrCreate(JSContextRef context, JSObjectRef object)

</ins><span class="cx"> {

</span><del>-    Range* range = JSRange::toWrapped(toJS(object));

</del><ins>+    Range* range = JSRange::toWrapped(toJS(context)-&gt;vm(), toJS(object));

</ins><span class="cx">     return getOrCreate(range);

</span><span class="cx"> }

</span><span class="cx"> 

</span></span></pre></div>

<a id="trunkSourceWebKit2WebProcessInjectedBundleInjectedBundlecpp"></a>

<div class="modfile"><h4>Modified: trunk/Source/WebKit2/WebProcess/InjectedBundle/InjectedBundle.cpp (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/WebKit2/WebProcess/InjectedBundle/InjectedBundle.cpp        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/WebKit2/WebProcess/InjectedBundle/InjectedBundle.cpp        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -503,7 +503,8 @@

</span><span class="cx">     JSLockHolder lock(execState);

</span><span class="cx"> 

<span class="cx">     // Make sure the context has a DOMWindow global object, otherwise this context didn't originate from a Page.

</span><del>-    if (!toJSDOMWindow(execState-&gt;lexicalGlobalObject()))

</del><ins>+    JSC::JSGlobalObject* globalObject = execState-&gt;lexicalGlobalObject();

+    if (!toJSDOMWindow(globalObject-&gt;vm(), globalObject))

</ins><span class="cx">         return;

</span><span class="cx"> 

</span><span class="cx">     WebCore::reportException(execState, toJS(execState, exception));

</span><span class="lines">@@ -564,7 +565,7 @@

</span><span class="cx"> uint64_t InjectedBundle::webNotificationID(JSContextRef jsContext, JSValueRef jsNotification)

</span><span class="cx"> {

</span><span class="cx"> #if ENABLE(NOTIFICATIONS) || ENABLE(LEGACY_NOTIFICATIONS)

</span><del>-    WebCore::Notification* notification = JSNotification::toWrapped(toJS(toJS(jsContext), jsNotification));

</del><ins>+    WebCore::Notification* notification = JSNotification::toWrapped(toJS(jsContext)-&gt;vm(), toJS(toJS(jsContext), jsNotification));

</ins><span class="cx">     if (!notification)

</span><span class="cx">         return 0;

</span><span class="cx">     return WebProcess::singleton().supplement&lt;WebNotificationManager&gt;()-&gt;notificationIDForTesting(notification);

</span><span class="lines">@@ -579,7 +580,7 @@

</span><span class="cx"> PassRefPtr&lt;API::Data&gt; InjectedBundle::createWebDataFromUint8Array(JSContextRef context, JSValueRef data)

</span><span class="cx"> {

</span><span class="cx">     JSC::ExecState* execState = toJS(context);

</span><del>-    RefPtr&lt;Uint8Array&gt; arrayData = WebCore::toUnsharedUint8Array(toJS(execState, data));

</del><ins>+    RefPtr&lt;Uint8Array&gt; arrayData = WebCore::toUnsharedUint8Array(execState-&gt;vm(), toJS(execState, data));

</ins><span class="cx">     return API::Data::create(static_cast&lt;unsigned char*&gt;(arrayData-&gt;baseAddress()), arrayData-&gt;byteLength());

</span><span class="cx"> }

</span><span class="cx"> 

</span></span></pre></div>

<a id="trunkSourceWebKit2WebProcessPluginsNetscapeJSNPMethodcpp"></a>

<div class="modfile"><h4>Modified: trunk/Source/WebKit2/WebProcess/Plugins/Netscape/JSNPMethod.cpp (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/WebKit2/WebProcess/Plugins/Netscape/JSNPMethod.cpp        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/WebKit2/WebProcess/Plugins/Netscape/JSNPMethod.cpp        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -54,7 +54,7 @@

</span><span class="cx"> void JSNPMethod::finishCreation(VM&amp; vm, const String&amp; name)

</span><span class="cx"> {

</span><span class="cx">     Base::finishCreation(vm, name);

</span><del>-    ASSERT(inherits(info()));

</del><ins>+    ASSERT(inherits(vm, info()));

</ins><span class="cx"> }

</span><span class="cx"> 

</span><span class="cx"> static EncodedJSValue JSC_HOST_CALL callMethod(ExecState* exec)

</span><span class="lines">@@ -67,7 +67,7 @@

</span><span class="cx">     JSValue thisValue = exec-&gt;thisValue();

</span><span class="cx"> 

<span class="cx">     // Check if we're calling a method on the plug-in script object.

</span><del>-    if (thisValue.inherits(JSHTMLElement::info())) {

</del><ins>+    if (thisValue.inherits(vm, JSHTMLElement::info())) {

</ins><span class="cx">         JSHTMLElement* element = jsCast&lt;JSHTMLElement*&gt;(asObject(thisValue));

</span><span class="cx"> 

</span><span class="cx">         // Try to get the script object from the element

</span><span class="lines">@@ -75,7 +75,7 @@

</span><span class="cx">             thisValue = scriptObject;

</span><span class="cx">     }

</span><span class="cx"> 

</span><del>-    if (thisValue.inherits(JSNPObject::info())) {

</del><ins>+    if (thisValue.inherits(vm, JSNPObject::info())) {

</ins><span class="cx">         JSNPObject* jsNPObject = jsCast&lt;JSNPObject*&gt;(asObject(thisValue));

</span><span class="cx"> 

</span><span class="cx">         return JSValue::encode(jsNPObject-&gt;callMethod(exec, jsNPMethod-&gt;npIdentifier()));

</span></span></pre></div>

<a id="trunkSourceWebKit2WebProcessPluginsNetscapeJSNPObjectcpp"></a>

<div class="modfile"><h4>Modified: trunk/Source/WebKit2/WebProcess/Plugins/Netscape/JSNPObject.cpp (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/WebKit2/WebProcess/Plugins/Netscape/JSNPObject.cpp        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/WebKit2/WebProcess/Plugins/Netscape/JSNPObject.cpp        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -70,8 +70,9 @@

</span><span class="cx"> 

</span><span class="cx"> void JSNPObject::finishCreation(JSGlobalObject* globalObject)

</span><span class="cx"> {

</span><del>-    Base::finishCreation(globalObject-&gt;vm());

-    ASSERT(inherits(info()));

</del><ins>+    VM&amp; vm = globalObject-&gt;vm();

+    Base::finishCreation(vm);

+    ASSERT(inherits(vm, info()));

</ins><span class="cx"> 

<span class="cx">     // We should never have an NPJSObject inside a JSNPObject.

</span><span class="cx">     ASSERT(!NPJSObject::isNPJSObject(m_npObject));

</span><span class="lines">@@ -239,7 +240,7 @@

</span><span class="cx"> static EncodedJSValue JSC_HOST_CALL callNPJSObject(ExecState* exec)

</span><span class="cx"> {

</span><span class="cx">     JSObject* object = exec-&gt;jsCallee();

</span><del>-    ASSERT(object-&gt;inherits(JSNPObject::info()));

</del><ins>+    ASSERT(object-&gt;inherits(exec-&gt;vm(), JSNPObject::info()));

</ins><span class="cx"> 

</span><span class="cx">     return JSValue::encode(jsCast&lt;JSNPObject*&gt;(object)-&gt;callObject(exec));

</span><span class="cx"> }

</span><span class="lines">@@ -258,7 +259,7 @@

</span><span class="cx"> static EncodedJSValue JSC_HOST_CALL constructWithConstructor(ExecState* exec)

</span><span class="cx"> {

</span><span class="cx">     JSObject* constructor = exec-&gt;jsCallee();

</span><del>-    ASSERT(constructor-&gt;inherits(JSNPObject::info()));

</del><ins>+    ASSERT(constructor-&gt;inherits(exec-&gt;vm(), JSNPObject::info()));

</ins><span class="cx"> 

</span><span class="cx">     return JSValue::encode(jsCast&lt;JSNPObject*&gt;(constructor)-&gt;callConstructor(exec));

</span><span class="cx"> }

</span></span></pre></div>

<a id="trunkSourceWebKit2WebProcessPluginsNetscapeNPJSObjectcpp"></a>

<div class="modfile"><h4>Modified: trunk/Source/WebKit2/WebProcess/Plugins/Netscape/NPJSObject.cpp (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/WebKit2/WebProcess/Plugins/Netscape/NPJSObject.cpp        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/WebKit2/WebProcess/Plugins/Netscape/NPJSObject.cpp        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -48,7 +48,7 @@

</span><span class="cx"> NPJSObject* NPJSObject::create(VM&amp; vm, NPRuntimeObjectMap* objectMap, JSObject* jsObject)

</span><span class="cx"> {

<span class="cx">     // We should never have a JSNPObject inside an NPJSObject.

</span><del>-    ASSERT(!jsObject-&gt;inherits(JSNPObject::info()));

</del><ins>+    ASSERT(!jsObject-&gt;inherits(vm, JSNPObject::info()));

</ins><span class="cx"> 

</span><span class="cx">     NPJSObject* npJSObject = toNPJSObject(createNPObject(0, npClass()));

</span><span class="cx">     npJSObject-&gt;initialize(vm, objectMap, jsObject);

</span></span></pre></div>

<a id="trunkSourceWebKit2WebProcessPluginsNetscapeNPRuntimeObjectMapcpp"></a>

<div class="modfile"><h4>Modified: trunk/Source/WebKit2/WebProcess/Plugins/Netscape/NPRuntimeObjectMap.cpp (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/WebKit2/WebProcess/Plugins/Netscape/NPRuntimeObjectMap.cpp        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/WebKit2/WebProcess/Plugins/Netscape/NPRuntimeObjectMap.cpp        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -70,7 +70,7 @@

</span><span class="cx"> NPObject* NPRuntimeObjectMap::getOrCreateNPObject(VM&amp; vm, JSObject* jsObject)

</span><span class="cx"> {

<span class="cx">     // If this is a JSNPObject, we can just get its underlying NPObject.

</span><del>-    if (jsObject-&gt;classInfo() == JSNPObject::info()) {

</del><ins>+    if (jsObject-&gt;classInfo(vm) == JSNPObject::info()) {

</ins><span class="cx">         JSNPObject* jsNPObject = jsCast&lt;JSNPObject*&gt;(jsObject);

</span><span class="cx">         NPObject* npObject = jsNPObject-&gt;npObject();

</span><span class="cx">         

</span></span></pre></div>

<a id="trunkSourceWebKit2WebProcessWebPageWebFramecpp"></a>

<div class="modfile"><h4>Modified: trunk/Source/WebKit2/WebProcess/WebPage/WebFrame.cpp (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Source/WebKit2/WebProcess/WebPage/WebFrame.cpp        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Source/WebKit2/WebProcess/WebPage/WebFrame.cpp        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -681,13 +681,12 @@

</span><span class="cx"> 

</span><span class="cx"> WebFrame* WebFrame::frameForContext(JSContextRef context)

</span><span class="cx"> {

</span><del>-    JSObjectRef globalObjectRef = JSContextGetGlobalObject(context);

-    JSC::JSObject* globalObjectObj = toJS(globalObjectRef);

-    if (strcmp(globalObjectObj-&gt;classInfo()-&gt;className, &quot;JSDOMWindowShell&quot;) != 0)

-        return 0;

</del><span class="cx"> 

</span><del>-    Frame* frame = static_cast&lt;JSDOMWindowShell*&gt;(globalObjectObj)-&gt;window()-&gt;wrapped().frame();

-    return WebFrame::fromCoreFrame(*frame);

</del><ins>+    JSC::JSGlobalObject* globalObjectObj = toJS(context)-&gt;lexicalGlobalObject();

+    JSDOMWindow* window = jsDynamicDowncast&lt;JSDOMWindow*&gt;(globalObjectObj-&gt;vm(), globalObjectObj);

+    if (!window)

+        return nullptr;

+    return WebFrame::fromCoreFrame(*(window-&gt;wrapped().frame()));

</ins><span class="cx"> }

</span><span class="cx"> 

</span><span class="cx"> JSValueRef WebFrame::jsWrapperForWorld(InjectedBundleNodeHandle* nodeHandle, InjectedBundleScriptWorld* world)

</span><span class="lines">@@ -728,7 +727,7 @@

</span><span class="cx"> 

</span><span class="cx"> String WebFrame::counterValue(JSObjectRef element)

</span><span class="cx"> {

</span><del>-    if (!toJS(element)-&gt;inherits(JSElement::info()))

</del><ins>+    if (!toJS(element)-&gt;inherits(*toJS(element)-&gt;vm(), JSElement::info()))

</ins><span class="cx">         return String();

</span><span class="cx"> 

</span><span class="cx">     return counterValueForElement(&amp;jsCast&lt;JSElement*&gt;(toJS(element))-&gt;wrapped());

</span></span></pre></div>

<a id="trunkToolsChangeLog"></a>

<div class="modfile"><h4>Modified: trunk/Tools/ChangeLog (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Tools/ChangeLog        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Tools/ChangeLog        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -1,3 +1,19 @@

</span><ins>+2017-01-26  Keith Miller  &lt;keith_miller@apple.com&gt;

+

+        classInfo should take a VM so it is not materialized from the object on each call

+        https://bugs.webkit.org/show_bug.cgi?id=167424

+

+        Rubber Stamped by Michael Saboff.

+

+        Previously, classInfo() would get the VM from the target's

+        MarkedBlock.  Most callers already have a VM on hand, so it is

+        wasteful to compute the VM from the marked block every time. This

+        patch refactors some of the most common callers of classInfo(),

+        jsDynamicCast and inherits to take a VM as well.

+

+        * DumpRenderTree/TestRunner.cpp:

+        (setAudioResultCallback):

+

</ins><span class="cx"> 2017-01-26  Jer Noble  &lt;jer.noble@apple.com&gt;

</span><span class="cx"> 

</span><span class="cx">         Autoplay muted videos stop playback of any streaming app in the background

</span></span></pre></div>

<a id="trunkToolsDumpRenderTreeTestRunnercpp"></a>

<div class="modfile"><h4>Modified: trunk/Tools/DumpRenderTree/TestRunner.cpp (211246 => 211247)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/Tools/DumpRenderTree/TestRunner.cpp        2017-01-27 01:38:05 UTC (rev 211246)

+++ trunk/Tools/DumpRenderTree/TestRunner.cpp        2017-01-27 01:47:52 UTC (rev 211247)

</span><span class="lines">@@ -342,7 +342,7 @@

</span><span class="cx">         return JSValueMakeUndefined(context);

</span><span class="cx"> 

<span class="cx">     // FIXME (123058): Use a JSC API to get buffer contents once such is exposed.

</span><del>-    JSC::JSArrayBufferView* jsBufferView = JSC::jsDynamicCast&lt;JSC::JSArrayBufferView*&gt;(toJS(toJS(context), arguments[0]));

</del><ins>+    JSC::JSArrayBufferView* jsBufferView = JSC::jsDynamicCast&lt;JSC::JSArrayBufferView*&gt;(toJS(context)-&gt;vm(), toJS(toJS(context), arguments[0]));

</ins><span class="cx">     ASSERT(jsBufferView);

</span><span class="cx">     RefPtr&lt;JSC::ArrayBufferView&gt; bufferView = jsBufferView-&gt;unsharedImpl();

</span><span class="cx">     const char* buffer = static_cast&lt;const char*&gt;(bufferView-&gt;baseAddress());

</span></span></pre>

</div>

</div>

</body>

</html>