<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN"
"http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head><meta http-equiv="content-type" content="text/html; charset=utf-8" />
<title>[217843] trunk</title>
</head>
<body>

<style type="text/css"><!--
#msg dl.meta { border: 1px #006 solid; background: #369; padding: 6px; color: #fff; }
#msg dl.meta dt { float: left; width: 6em; font-weight: bold; }
#msg dt:after { content:':';}
#msg dl, #msg dt, #msg ul, #msg li, #header, #footer, #logmsg { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt;  }
#msg dl a { font-weight: bold}
#msg dl a:link    { color:#fc3; }
#msg dl a:active  { color:#ff0; }
#msg dl a:visited { color:#cc6; }
h3 { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; font-weight: bold; }
#msg pre { overflow: auto; background: #ffc; border: 1px #fa0 solid; padding: 6px; }
#logmsg { background: #ffc; border: 1px #fa0 solid; padding: 1em 1em 0 1em; }
#logmsg p, #logmsg pre, #logmsg blockquote { margin: 0 0 1em 0; }
#logmsg p, #logmsg li, #logmsg dt, #logmsg dd { line-height: 14pt; }
#logmsg h1, #logmsg h2, #logmsg h3, #logmsg h4, #logmsg h5, #logmsg h6 { margin: .5em 0; }
#logmsg h1:first-child, #logmsg h2:first-child, #logmsg h3:first-child, #logmsg h4:first-child, #logmsg h5:first-child, #logmsg h6:first-child { margin-top: 0; }
#logmsg ul, #logmsg ol { padding: 0; list-style-position: inside; margin: 0 0 0 1em; }
#logmsg ul { text-indent: -1em; padding-left: 1em; }#logmsg ol { text-indent: -1.5em; padding-left: 1.5em; }
#logmsg > ul, #logmsg > ol { margin: 0 0 1em 0; }
#logmsg pre { background: #eee; padding: 1em; }
#logmsg blockquote { border: 1px solid #fa0; border-left-width: 10px; padding: 1em 1em 0 1em; background: white;}
#logmsg dl { margin: 0; }
#logmsg dt { font-weight: bold; }
#logmsg dd { margin: 0; padding: 0 0 0.5em 0; }
#logmsg dd:before { content:'\00bb';}
#logmsg table { border-spacing: 0px; border-collapse: collapse; border-top: 4px solid #fa0; border-bottom: 1px solid #fa0; background: #fff; }
#logmsg table th { text-align: left; font-weight: normal; padding: 0.2em 0.5em; border-top: 1px dotted #fa0; }
#logmsg table td { text-align: right; border-top: 1px dotted #fa0; padding: 0.2em 0.5em; }
#logmsg table thead th { text-align: center; border-bottom: 1px solid #fa0; }
#logmsg table th.Corner { text-align: left; }
#logmsg hr { border: none 0; border-top: 2px dashed #fa0; height: 1px; }
#header, #footer { color: #fff; background: #636; border: 1px #300 solid; padding: 6px; }
#patch { width: 100%; }
#patch h4 {font-family: verdana,arial,helvetica,sans-serif;font-size:10pt;padding:8px;background:#369;color:#fff;margin:0;}
#patch .propset h4, #patch .binary h4 {margin:0;}
#patch pre {padding:0;line-height:1.2em;margin:0;}
#patch .diff {width:100%;background:#eee;padding: 0 0 10px 0;overflow:auto;}
#patch .propset .diff, #patch .binary .diff  {padding:10px 0;}
#patch span {display:block;padding:0 10px;}
#patch .modfile, #patch .addfile, #patch .delfile, #patch .propset, #patch .binary, #patch .copfile {border:1px solid #ccc;margin:10px 0;}
#patch ins {background:#dfd;text-decoration:none;display:block;padding:0 10px;}
#patch del {background:#fdd;text-decoration:none;display:block;padding:0 10px;}
#patch .lines, .info {color:#888;background:#fff;}
--></style>
<div id="msg">
<dl class="meta">
<dt>Revision</dt> <dd><a href="http://trac.webkit.org/projects/webkit/changeset/217843">217843</a></dd>
<dt>Author</dt> <dd>joepeck@webkit.org</dd>
<dt>Date</dt> <dd>2017-06-06 11:15:31 -0700 (Tue, 06 Jun 2017)</dd>
</dl>

<h3>Log Message</h3>
<pre>Unreviewed rollout <a href="http://trac.webkit.org/projects/webkit/changeset/217807">r217807</a>. Caused a test to crash.

JSTests:

* heapProfiler/class-names.js: Removed.
* heapProfiler/driver/driver.js:
(CheapHeapSnapshotNode):
(CheapHeapSnapshot):
(createCheapHeapSnapshot):
(HeapSnapshot):
(createHeapSnapshot):
* typeProfiler/inheritance.js:
(wrapper.A):
(wrapper.B):
(wrapper.C):
(wrapper):

Source/JavaScriptCore:

* heap/HeapSnapshotBuilder.cpp:
(JSC::HeapSnapshotBuilder::buildSnapshot):
(JSC::HeapSnapshotBuilder::json):
(): Deleted.
* heap/HeapSnapshotBuilder.h:
* runtime/JSObject.cpp:
(JSC::JSObject::calculatedClassName):

Source/WebInspectorUI:

* UserInterface/Proxies/HeapSnapshotNodeProxy.js:
(WebInspector.HeapSnapshotNodeProxy):
(WebInspector.HeapSnapshotNodeProxy.deserialize):
* UserInterface/Views/HeapSnapshotClassDataGridNode.js:
(WebInspector.HeapSnapshotClassDataGridNode.prototype.createCellContent):
* UserInterface/Views/HeapSnapshotClusterContentView.js:
(WebInspector.HeapSnapshotClusterContentView.iconStyleClassNameForClassName):
* UserInterface/Views/HeapSnapshotDataGridTree.js:
(WebInspector.HeapSnapshotInstancesDataGridTree.prototype.populateTopLevel):
* UserInterface/Views/HeapSnapshotInstanceDataGridNode.js:
(WebInspector.HeapSnapshotInstanceDataGridNode.prototype.createCellContent):
(WebInspector.HeapSnapshotInstanceDataGridNode.prototype._mouseoverHandler.appendPathRow):
* UserInterface/Workers/HeapSnapshot/HeapSnapshot.js:
(HeapSnapshot):
(HeapSnapshot.updateCategoriesAndMetadata):
(HeapSnapshot.prototype.serializeNode):
(HeapSnapshot.prototype._gcRootPathes.visitNode):
(HeapSnapshot.prototype._gcRootPathes):

LayoutTests:

* inspector/unit-tests/heap-snapshot-expected.txt:
* inspector/unit-tests/heap-snapshot.html:</pre>

<h3>Modified Paths</h3>
<ul>
<li><a href="#trunkJSTestsChangeLog">trunk/JSTests/ChangeLog</a></li>
<li><a href="#trunkJSTestsheapProfilerdriverdriverjs">trunk/JSTests/heapProfiler/driver/driver.js</a></li>
<li><a href="#trunkJSTeststypeProfilerinheritancejs">trunk/JSTests/typeProfiler/inheritance.js</a></li>
<li><a href="#trunkLayoutTestsChangeLog">trunk/LayoutTests/ChangeLog</a></li>
<li><a href="#trunkLayoutTestsinspectorunittestsheapsnapshotexpectedtxt">trunk/LayoutTests/inspector/unit-tests/heap-snapshot-expected.txt</a></li>
<li><a href="#trunkLayoutTestsinspectorunittestsheapsnapshothtml">trunk/LayoutTests/inspector/unit-tests/heap-snapshot.html</a></li>
<li><a href="#trunkSourceJavaScriptCoreChangeLog">trunk/Source/JavaScriptCore/ChangeLog</a></li>
<li><a href="#trunkSourceJavaScriptCoreheapHeapSnapshotBuildercpp">trunk/Source/JavaScriptCore/heap/HeapSnapshotBuilder.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreheapHeapSnapshotBuilderh">trunk/Source/JavaScriptCore/heap/HeapSnapshotBuilder.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeJSObjectcpp">trunk/Source/JavaScriptCore/runtime/JSObject.cpp</a></li>
<li><a href="#trunkSourceWebInspectorUIChangeLog">trunk/Source/WebInspectorUI/ChangeLog</a></li>
<li><a href="#trunkSourceWebInspectorUIUserInterfaceProxiesHeapSnapshotNodeProxyjs">trunk/Source/WebInspectorUI/UserInterface/Proxies/HeapSnapshotNodeProxy.js</a></li>
<li><a href="#trunkSourceWebInspectorUIUserInterfaceViewsHeapSnapshotClassDataGridNodejs">trunk/Source/WebInspectorUI/UserInterface/Views/HeapSnapshotClassDataGridNode.js</a></li>
<li><a href="#trunkSourceWebInspectorUIUserInterfaceViewsHeapSnapshotClusterContentViewjs">trunk/Source/WebInspectorUI/UserInterface/Views/HeapSnapshotClusterContentView.js</a></li>
<li><a href="#trunkSourceWebInspectorUIUserInterfaceViewsHeapSnapshotDataGridTreejs">trunk/Source/WebInspectorUI/UserInterface/Views/HeapSnapshotDataGridTree.js</a></li>
<li><a href="#trunkSourceWebInspectorUIUserInterfaceViewsHeapSnapshotInstanceDataGridNodejs">trunk/Source/WebInspectorUI/UserInterface/Views/HeapSnapshotInstanceDataGridNode.js</a></li>
<li><a href="#trunkSourceWebInspectorUIUserInterfaceWorkersHeapSnapshotHeapSnapshotjs">trunk/Source/WebInspectorUI/UserInterface/Workers/HeapSnapshot/HeapSnapshot.js</a></li>
</ul>

<h3>Removed Paths</h3>
<ul>
<li><a href="#trunkJSTestsheapProfilerclassnamesjs">trunk/JSTests/heapProfiler/class-names.js</a></li>
</ul>

</div>
<div id="patch">
<h3>Diff</h3>
<a id="trunkJSTestsChangeLog"></a>
<div class="modfile"><h4>Modified: trunk/JSTests/ChangeLog (217842 => 217843)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/JSTests/ChangeLog  2017-06-06 18:11:21 UTC (rev 217842)
+++ trunk/JSTests/ChangeLog     2017-06-06 18:15:31 UTC (rev 217843)
</span><span class="lines">@@ -1,3 +1,20 @@
</span><ins>+2017-06-06  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Unreviewed rollout r217807. Caused a test to crash.
+
+        * heapProfiler/class-names.js: Removed.
+        * heapProfiler/driver/driver.js:
+        (CheapHeapSnapshotNode):
+        (CheapHeapSnapshot):
+        (createCheapHeapSnapshot):
+        (HeapSnapshot):
+        (createHeapSnapshot):
+        * typeProfiler/inheritance.js:
+        (wrapper.A):
+        (wrapper.B):
+        (wrapper.C):
+        (wrapper):
+
</ins><span class="cx"> 2017-06-06  Filip Pizlo  <fpizlo@apple.com>
</span><span class="cx"> 
</span><span class="cx">         index out of bound in bytecodebasicblock
</span></span></pre></div>
<a id="trunkJSTestsheapProfilerclassnamesjs"></a>
<div class="delfile"><h4>Deleted: trunk/JSTests/heapProfiler/class-names.js (217842 => 217843)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/JSTests/heapProfiler/class-names.js        2017-06-06 18:11:21 UTC (rev 217842)
+++ trunk/JSTests/heapProfiler/class-names.js   2017-06-06 18:15:31 UTC (rev 217843)
</span><span class="lines">@@ -1,44 +0,0 @@
</span><del>-load("./driver/driver.js");
-
-function MyES5ClassUgly() {};
-MyES5ClassUgly.displayName = "MyES5ClassDisplayName";
-MyES5ClassUgly.prototype = { constructor: MyES5ClassUgly };
-
-class MyES6Class {};
-class MyES6Subclass extends MyES6Class {};
-
-let classInstances = [];
-for (let i = 0; i < 5; ++i)
-    classInstances.push(new MyES5ClassUgly);
-for (let i = 0; i < 10; ++i)
-    classInstances.push(new MyES6Class);
-for (let i = 0; i < 20; ++i)
-    classInstances.push(new MyES6Subclass);
-
-let myFunction = function() {};
-let myMap = new Map;
-
-(function() {
-    let nodes;
-    let snapshot = createCheapHeapSnapshot();
-
-    nodes = snapshot.nodesWithClassName("MyES5ClassDisplayName");
-    assert(nodes.length === 5, "Snapshot should contain 5 'MyES5ClassDisplayName' (MyES5ClassUgly) instances");
-    assert(nodes[0].isObjectType, "MyES5Class instance should have had its ObjectType flag set");
-
-    nodes = snapshot.nodesWithClassName("MyES6Class");
-    assert(nodes.length === 10, "Snapshot should contain 10 'MyES6Class' instances");
-    assert(nodes[0].isObjectType, "MyES6Class instance should have had its ObjectType flag set");
-
-    nodes = snapshot.nodesWithClassName("MyES6Subclass");
-    assert(nodes.length === 20, "Snapshot should contain 20 'MyES6Subclass' instances");
-    assert(nodes[0].isObjectType, "MyES6Subclass instance should have had its ObjectType flag set");
-
-    nodes = snapshot.nodesWithClassName("Function");
-    assert(nodes.length > 0, "Should be at least 1 Function instance");
-    assert(!nodes[0].isObjectType, "Function instance should not have its ObjectType flag set");
-
-    nodes = snapshot.nodesWithClassName("Map");
-    assert(nodes.length > 0, "Should be at least 1 Map instance");
-    assert(!nodes[0].isObjectType, "Map instance should not have its ObjectType flag set");
-})();
</del></span></pre></div>
<a id="trunkJSTestsheapProfilerdriverdriverjs"></a>
<div class="modfile"><h4>Modified: trunk/JSTests/heapProfiler/driver/driver.js (217842 => 217843)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/JSTests/heapProfiler/driver/driver.js      2017-06-06 18:11:21 UTC (rev 217842)
+++ trunk/JSTests/heapProfiler/driver/driver.js 2017-06-06 18:15:31 UTC (rev 217843)
</span><span class="lines">@@ -14,14 +14,10 @@
</span><span class="cx"> const nodeIdOffset = 0;
</span><span class="cx"> const nodeSizeOffset = 1;
</span><span class="cx"> const nodeClassNameOffset = 2;
</span><del>-const nodeFlagsOffset = 3;
</del><ins>+const nodeInternalOffset = 3;
</ins><span class="cx"> const nodeFirstEdgeOffset = 4;
</span><span class="cx"> const nodeNoEdgeValue = 0xffffffff; // UINT_MAX
</span><span class="cx"> 
</span><del>-// Node Flags.
-const internalFlagMask = (1 << 0);
-const objectTypeMask = (1 << 1);
-
</del><span class="cx"> // [<0:fromId>, <1:toId>, <2:typeTableIndex>, <3:edgeDataIndexOrEdgeNameIndex>]
</span><span class="cx"> const edgeFieldCount = 4;
</span><span class="cx"> const edgeFromIdOffset = 0;
</span><span class="lines">@@ -39,11 +35,8 @@
</span><span class="cx">         this.id = nodes[nodeIndex + nodeIdOffset];
</span><span class="cx">         this.size = nodes[nodeIndex + nodeSizeOffset];
</span><span class="cx">         this.className = snapshot.classNameFromTableIndex(nodes[nodeIndex + nodeClassNameOffset]);
</span><ins>+        this.internal = nodes[nodeIndex + nodeInternalOffset] ? true : false;
</ins><span class="cx"> 
</span><del>-        let flags = nodes[nodeIndex + nodeFlagsOffset];
-        this.internal = flags & internalFlagMask ? true : false;
-        this.isObjectType = flags & objectTypeMask ? true : false;
-
</del><span class="cx">         this.outgoingEdges = [];
</span><span class="cx">         let firstEdgeIndex = nodes[nodeIndex + nodeFirstEdgeOffset];
</span><span class="cx">         if (firstEdgeIndex !== nodeNoEdgeValue) {
</span><span class="lines">@@ -98,7 +91,7 @@
</span><span class="cx">             this._nodes[n++] = nodes[i++]; // id
</span><span class="cx">             this._nodes[n++] = nodes[i++]; // size
</span><span class="cx">             this._nodes[n++] = nodes[i++]; // classNameTableIndex
</span><del>-            this._nodes[n++] = nodes[i++]; // flags
</del><ins>+            this._nodes[n++] = nodes[i++]; // internal
</ins><span class="cx">             this._nodes[n++] = nodeNoEdgeValue;
</span><span class="cx">         }
</span><span class="cx"> 
</span><span class="lines">@@ -161,7 +154,7 @@
</span><span class="cx">     let json = generateHeapSnapshot();
</span><span class="cx"> 
</span><span class="cx">     let {version, nodes, nodeClassNames, edges, edgeTypes} = json;
</span><del>-    assert(version === 2, "Heap Snapshot payload should be version 2");
</del><ins>+    assert(version === 1, "Heap Snapshot payload should be version 1");
</ins><span class="cx">     assert(nodes.length, "Heap Snapshot should have nodes");
</span><span class="cx">     assert(nodeClassNames.length, "Heap Snapshot should have nodeClassNames");
</span><span class="cx">     assert(edges.length, "Heap Snapshot should have edges");
</span><span class="lines">@@ -217,8 +210,7 @@
</span><span class="cx">             let id = nodes[i++];
</span><span class="cx">             let size = nodes[i++];
</span><span class="cx">             let classNameIndex = nodes[i++];
</span><del>-            let flags = nodes[i++];
-            let internal = flags & internalFlagMask ? true : false;
</del><ins>+            let internal = nodes[i++];
</ins><span class="cx"> 
</span><span class="cx">             let node = new HeapSnapshotNode(id, nodeClassNames[classNameIndex], size, internal);
</span><span class="cx">             this.nodeMap.set(id, node);
</span><span class="lines">@@ -264,7 +256,7 @@
</span><span class="cx">     let json = generateHeapSnapshot();
</span><span class="cx"> 
</span><span class="cx">     let {version, nodes, nodeClassNames, edges, edgeTypes} = json;
</span><del>-    assert(version === 2, "Heap Snapshot payload should be version 2");
</del><ins>+    assert(version === 1, "Heap Snapshot payload should be version 1");
</ins><span class="cx">     assert(nodes.length, "Heap Snapshot should have nodes");
</span><span class="cx">     assert(nodeClassNames.length, "Heap Snapshot should have nodeClassNames");
</span><span class="cx">     assert(edges.length, "Heap Snapshot should have edges");
</span></span></pre></div>
<a id="trunkJSTeststypeProfilerinheritancejs"></a>
<div class="modfile"><h4>Modified: trunk/JSTests/typeProfiler/inheritance.js (217842 => 217843)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/JSTests/typeProfiler/inheritance.js        2017-06-06 18:11:21 UTC (rev 217842)
+++ trunk/JSTests/typeProfiler/inheritance.js   2017-06-06 18:15:31 UTC (rev 217843)
</span><span class="lines">@@ -3,10 +3,6 @@
</span><span class="cx"> function wrapper()
</span><span class="cx"> {
</span><span class="cx"> 
</span><del>-function A() { };
-function B() { };
-function C() { };
-
</del><span class="cx"> var theA = new A;
</span><span class="cx"> var theB = new B;
</span><span class="cx"> var theC = new C;
</span><span class="lines">@@ -18,8 +14,9 @@
</span><span class="cx"> 
</span><span class="cx"> var secondB = Object.create(theB);
</span><span class="cx"> 
</span><del>-B.prototype.__proto__ = A.prototype;
-C.prototype.__proto__ = A.prototype;
</del><ins>+function A() { };
+function B() { }; B.prototype.__proto__ = A.prototype;
+function C() { }; C.prototype.__proto__ = A.prototype;
</ins><span class="cx"> 
</span><span class="cx"> }
</span><span class="cx"> wrapper();
</span></span></pre></div>
<a id="trunkLayoutTestsChangeLog"></a>
<div class="modfile"><h4>Modified: trunk/LayoutTests/ChangeLog (217842 => 217843)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/ChangeLog      2017-06-06 18:11:21 UTC (rev 217842)
+++ trunk/LayoutTests/ChangeLog 2017-06-06 18:15:31 UTC (rev 217843)
</span><span class="lines">@@ -1,3 +1,10 @@
</span><ins>+2017-06-06  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Unreviewed rollout r217807. Caused a test to crash.
+
+        * inspector/unit-tests/heap-snapshot-expected.txt:
+        * inspector/unit-tests/heap-snapshot.html:
+
</ins><span class="cx"> 2017-06-06  Antoine Quint  <graouts@apple.com>
</span><span class="cx"> 
</span><span class="cx">         Rebaseline and enable media/modern-media-controls/audio
</span></span></pre></div>
<a id="trunkLayoutTestsinspectorunittestsheapsnapshotexpectedtxt"></a>
<div class="modfile"><h4>Modified: trunk/LayoutTests/inspector/unit-tests/heap-snapshot-expected.txt (217842 => 217843)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/inspector/unit-tests/heap-snapshot-expected.txt        2017-06-06 18:11:21 UTC (rev 217842)
+++ trunk/LayoutTests/inspector/unit-tests/heap-snapshot-expected.txt   2017-06-06 18:15:31 UTC (rev 217843)
</span><span class="lines">@@ -23,7 +23,6 @@
</span><span class="cx"> PASS: Node identifier should match.
</span><span class="cx"> PASS: Node size should match.
</span><span class="cx"> PASS: Node internal state should match.
</span><del>-PASS: Node isObjectType state should match.
</del><span class="cx"> PASS: Node gcRoot state should match.
</span><span class="cx"> PASS: Node retainedSize should at least be the size.
</span><span class="cx"> 
</span></span></pre></div>
<a id="trunkLayoutTestsinspectorunittestsheapsnapshothtml"></a>
<div class="modfile"><h4>Modified: trunk/LayoutTests/inspector/unit-tests/heap-snapshot.html (217842 => 217843)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/inspector/unit-tests/heap-snapshot.html        2017-06-06 18:11:21 UTC (rev 217842)
+++ trunk/LayoutTests/inspector/unit-tests/heap-snapshot.html   2017-06-06 18:15:31 UTC (rev 217843)
</span><span class="lines">@@ -9,13 +9,12 @@
</span><span class="cx"> 
</span><span class="cx">     WebInspector.TestHeapSnapshotNode = class TestHeapSnapshotNode
</span><span class="cx">     {
</span><del>-        constructor(identifier, className, size, flags)
</del><ins>+        constructor(identifier, className, size, internal)
</ins><span class="cx">         {
</span><span class="cx">             this.id = identifier;
</span><span class="cx">             this.className = className;
</span><span class="cx">             this.size = size; 
</span><del>-            this.internal = flags & (1 << 0) ? true : false;
-            this.isObjectType = flags & (1 << 1) ? true : false;
</del><ins>+            this.internal = internal;
</ins><span class="cx">             this.gcRoot = false;
</span><span class="cx">             this.outgoingEdges = [];
</span><span class="cx">             this.incomingEdges = [];
</span><span class="lines">@@ -60,9 +59,9 @@
</span><span class="cx">                 let id = nodes[i++];
</span><span class="cx">                 let size = nodes[i++];
</span><span class="cx">                 let classNameIndex = nodes[i++];
</span><del>-                let flags = nodes[i++];
</del><ins>+                let internal = nodes[i++];
</ins><span class="cx"> 
</span><del>-                let node = new WebInspector.TestHeapSnapshotNode(id, nodeClassNames[classNameIndex], size, flags);
</del><ins>+                let node = new WebInspector.TestHeapSnapshotNode(id, nodeClassNames[classNameIndex], size, !!internal);
</ins><span class="cx">                 nodeMap.set(id, node);
</span><span class="cx">                 processedNodes.push(node);
</span><span class="cx">             }
</span><span class="lines">@@ -128,7 +127,6 @@
</span><span class="cx">             && node1.size === node2.size
</span><span class="cx">             && node1.className === node2.className
</span><span class="cx">             && node1.internal === node2.internal
</span><del>-            && node1.isObjectType === node2.isObjectType
</del><span class="cx">             && node1.gcRoot === node2.gcRoot;
</span><span class="cx">     }
</span><span class="cx"> 
</span><span class="lines">@@ -191,7 +189,6 @@
</span><span class="cx">                 InspectorTest.expectThat(heapSnapshotNode.id === testSnapshotNodeForWindowObject.id, "Node identifier should match.")
</span><span class="cx">                 InspectorTest.expectThat(heapSnapshotNode.size === testSnapshotNodeForWindowObject.size, "Node size should match.");
</span><span class="cx">                 InspectorTest.expectThat(heapSnapshotNode.internal === testSnapshotNodeForWindowObject.internal, "Node internal state should match.");
</span><del>-                InspectorTest.expectThat(heapSnapshotNode.isObjectType === testSnapshotNodeForWindowObject.isObjectType, "Node isObjectType state should match.");
</del><span class="cx">                 InspectorTest.expectThat(heapSnapshotNode.gcRoot === testSnapshotNodeForWindowObject.gcRoot, "Node gcRoot state should match.");
</span><span class="cx">                 InspectorTest.expectThat(heapSnapshotNode.retainedSize >= heapSnapshotNode.size, "Node retainedSize should at least be the size.");
</span><span class="cx">                 resolve();
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreChangeLog"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/ChangeLog (217842 => 217843)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/ChangeLog    2017-06-06 18:11:21 UTC (rev 217842)
+++ trunk/Source/JavaScriptCore/ChangeLog       2017-06-06 18:15:31 UTC (rev 217843)
</span><span class="lines">@@ -1,3 +1,15 @@
</span><ins>+2017-06-06  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Unreviewed rollout r217807. Caused a test to crash.
+
+        * heap/HeapSnapshotBuilder.cpp:
+        (JSC::HeapSnapshotBuilder::buildSnapshot):
+        (JSC::HeapSnapshotBuilder::json):
+        (): Deleted.
+        * heap/HeapSnapshotBuilder.h:
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::calculatedClassName):
+
</ins><span class="cx"> 2017-06-06  Filip Pizlo  <fpizlo@apple.com>
</span><span class="cx"> 
</span><span class="cx">         index out of bound in bytecodebasicblock
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreheapHeapSnapshotBuildercpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/heap/HeapSnapshotBuilder.cpp (217842 => 217843)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/heap/HeapSnapshotBuilder.cpp 2017-06-06 18:11:21 UTC (rev 217842)
+++ trunk/Source/JavaScriptCore/heap/HeapSnapshotBuilder.cpp    2017-06-06 18:15:31 UTC (rev 217843)
</span><span class="lines">@@ -1,5 +1,5 @@
</span><span class="cx"> /*
</span><del>- * Copyright (C) 2016-2017 Apple Inc. All rights reserved.
</del><ins>+ * Copyright (C) 2016 Apple Inc. All rights reserved.
</ins><span class="cx">  *
</span><span class="cx">  * Redistribution and use in source and binary forms, with or without
</span><span class="cx">  * modification, are permitted provided that the following conditions
</span><span class="lines">@@ -20,7 +20,7 @@
</span><span class="cx">  * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
</span><span class="cx">  * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
</span><span class="cx">  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
</span><del>- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
</del><ins>+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
</ins><span class="cx">  */
</span><span class="cx"> 
</span><span class="cx"> #include "config.h"
</span><span class="lines">@@ -37,7 +37,7 @@
</span><span class="cx"> #include <wtf/text/StringBuilder.h>
</span><span class="cx"> 
</span><span class="cx"> namespace JSC {
</span><del>-
</del><ins>+    
</ins><span class="cx"> unsigned HeapSnapshotBuilder::nextAvailableObjectIdentifier = 1;
</span><span class="cx"> unsigned HeapSnapshotBuilder::getNextObjectIdentifier() { return nextAvailableObjectIdentifier++; }
</span><span class="cx"> void HeapSnapshotBuilder::resetNextAvailableObjectIdentifier() { HeapSnapshotBuilder::nextAvailableObjectIdentifier = 1; }
</span><span class="lines">@@ -54,7 +54,7 @@
</span><span class="cx"> void HeapSnapshotBuilder::buildSnapshot()
</span><span class="cx"> {
</span><span class="cx">     PreventCollectionScope preventCollectionScope(m_profiler.vm().heap);
</span><del>-
</del><ins>+    
</ins><span class="cx">     m_snapshot = std::make_unique<HeapSnapshot>(m_profiler.mostRecentSnapshot());
</span><span class="cx">     {
</span><span class="cx">         m_profiler.setActiveSnapshotBuilder(this);
</span><span class="lines">@@ -135,10 +135,10 @@
</span><span class="cx"> // Heap Snapshot JSON Format:
</span><span class="cx"> //
</span><span class="cx"> //   {
</span><del>-//      "version": 2,
</del><ins>+//      "version": 1.0,
</ins><span class="cx"> //      "nodes": [
</span><del>-//          <nodeId>, <sizeInBytes>, <nodeClassNameIndex>, <flags>,
-//          <nodeId>, <sizeInBytes>, <nodeClassNameIndex>, <flags>,
</del><ins>+//          <nodeId>, <sizeInBytes>, <nodeClassNameIndex>, <internal>,
+//          <nodeId>, <sizeInBytes>, <nodeClassNameIndex>, <internal>,
</ins><span class="cx"> //          ...
</span><span class="cx"> //      ],
</span><span class="cx"> //      "nodeClassNames": [
</span><span class="lines">@@ -162,10 +162,8 @@
</span><span class="cx"> //     <nodeClassNameIndex>
</span><span class="cx"> //       - index into the "nodeClassNames" list.
</span><span class="cx"> //
</span><del>-//     <flags>
-//       - 0b0000 - no flags
-//       - 0b0001 - internal instance
-//       - 0b0010 - Object subclassification
</del><ins>+//     <internal>
+//       - 0 = false, 1 = true.
</ins><span class="cx"> //
</span><span class="cx"> //     <edgeTypeIndex>
</span><span class="cx"> //       - index into the "edgeTypes" list.
</span><span class="lines">@@ -175,11 +173,6 @@
</span><span class="cx"> //       - for Index edges this is the index value.
</span><span class="cx"> //       - for Property or Variable edges this is an index into the "edgeNames" list.
</span><span class="cx"> 
</span><del>-typedef enum {
-    Internal      = 1 << 0,
-    ObjectSubtype = 1 << 1,
-} NodeFlags;
-
</del><span class="cx"> static uint8_t edgeTypeToNumber(EdgeType type)
</span><span class="cx"> {
</span><span class="cx">     return static_cast<uint8_t>(type);
</span><span class="lines">@@ -230,38 +223,20 @@
</span><span class="cx">         if (!allowNodeCallback(node))
</span><span class="cx">             return;
</span><span class="cx"> 
</span><del>-        unsigned flags = 0;
-
</del><span class="cx">         allowedNodeIdentifiers.set(node.cell, node.identifier);
</span><span class="cx"> 
</span><del>-        const char* className = node.cell->classInfo(vm)->className;
-        if (node.cell->isObject() && !strcmp(className, JSObject::info()->className)) {
-            flags |= ObjectSubtype;
-
-            // Skip calculating a class name if this object has a `constructor` own property.
-            // These cases are typically F.prototype objects and we want to treat these as
-            // "Object" in snapshots and not get the name of what the prototype's parent.
-            JSObject* object = jsCast<JSObject*>(node.cell);
-            if (JSGlobalObject* globalObject = object->structure(vm)->globalObject()) {
-                ExecState* exec = globalObject->globalExec();
-                PropertySlot slot(object, PropertySlot::InternalMethodType::VMInquiry);
-                if (!object->getOwnPropertySlot(object, exec, vm.propertyNames->constructor, slot))
-                    className = JSObject::calculatedClassName(object).utf8().data();
-            }
-        }
-
-        auto result = classNameIndexes.add(className, nextClassNameIndex);
</del><ins>+        auto result = classNameIndexes.add(node.cell->classInfo(vm)->className, nextClassNameIndex);
</ins><span class="cx">         if (result.isNewEntry)
</span><span class="cx">             nextClassNameIndex++;
</span><span class="cx">         unsigned classNameIndex = result.iterator->value;
</span><span class="cx"> 
</span><ins>+        bool isInternal = false;
</ins><span class="cx">         if (!node.cell->isString()) {
</span><span class="cx">             Structure* structure = node.cell->structure(vm);
</span><del>-            if (!structure || !structure->globalObject())
-                flags |= Internal;
</del><ins>+            isInternal = !structure || !structure->globalObject();
</ins><span class="cx">         }
</span><span class="cx"> 
</span><del>-        // <nodeId>, <sizeInBytes>, <className>, <flags>
</del><ins>+        // <nodeId>, <sizeInBytes>, <className>, <optionalInternalBoolean>
</ins><span class="cx">         json.append(',');
</span><span class="cx">         json.appendNumber(node.identifier);
</span><span class="cx">         json.append(',');
</span><span class="lines">@@ -269,7 +244,7 @@
</span><span class="cx">         json.append(',');
</span><span class="cx">         json.appendNumber(classNameIndex);
</span><span class="cx">         json.append(',');
</span><del>-        json.appendNumber(flags);
</del><ins>+        json.append(isInternal ? '1' : '0');
</ins><span class="cx">     };
</span><span class="cx"> 
</span><span class="cx">     bool firstEdge = true;
</span><span class="lines">@@ -308,7 +283,7 @@
</span><span class="cx">     json.append('{');
</span><span class="cx"> 
</span><span class="cx">     // version
</span><del>-    json.appendLiteral("\"version\":2");
</del><ins>+    json.appendLiteral("\"version\":1");
</ins><span class="cx"> 
</span><span class="cx">     // nodes
</span><span class="cx">     json.append(',');
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreheapHeapSnapshotBuilderh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/heap/HeapSnapshotBuilder.h (217842 => 217843)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/heap/HeapSnapshotBuilder.h   2017-06-06 18:11:21 UTC (rev 217842)
+++ trunk/Source/JavaScriptCore/heap/HeapSnapshotBuilder.h      2017-06-06 18:15:31 UTC (rev 217843)
</span><span class="lines">@@ -36,8 +36,6 @@
</span><span class="cx"> class HeapProfiler;
</span><span class="cx"> class HeapSnapshot;
</span><span class="cx"> class JSCell;
</span><del>-class JSObject;
-class VM;
</del><span class="cx"> 
</span><span class="cx"> struct HeapSnapshotNode {
</span><span class="cx">     HeapSnapshotNode(JSCell* cell, unsigned identifier)
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeJSObjectcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/JSObject.cpp (217842 => 217843)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/JSObject.cpp 2017-06-06 18:11:21 UTC (rev 217842)
+++ trunk/Source/JavaScriptCore/runtime/JSObject.cpp    2017-06-06 18:15:31 UTC (rev 217843)
</span><span class="lines">@@ -526,23 +526,19 @@
</span><span class="cx"> String JSObject::calculatedClassName(JSObject* object)
</span><span class="cx"> {
</span><span class="cx">     String prototypeFunctionName;
</span><del>-    auto structure = object->structure();
-    auto globalObject = structure->globalObject();
</del><ins>+    auto globalObject = object->globalObject();
</ins><span class="cx">     VM& vm = globalObject->vm();
</span><span class="cx">     auto scope = DECLARE_CATCH_SCOPE(vm);
</span><span class="cx"> 
</span><del>-    // Get the display name of obj.__proto__.constructor.
-    MethodTable::GetPrototypeFunctionPtr defaultGetPrototype = JSObject::getPrototype;
-    if (structure->classInfo()->methodTable.getPrototype == defaultGetPrototype) {
-        JSValue protoValue = object->getPrototypeDirect();
-        if (protoValue.isObject()) {
-            JSObject* protoObject = jsCast<JSObject*>(protoValue);
-            ExecState* exec = globalObject->globalExec();
-            PropertyName constructor(exec->propertyNames().constructor);
-            PropertySlot slot(protoValue, PropertySlot::InternalMethodType::VMInquiry);
-            if (protoObject->getPropertySlot(exec, constructor, slot)) {
-                if (slot.isValue()) {
-                    if (JSObject* ctorObject = jsDynamicCast<JSObject*>(vm, slot.getValue(exec, constructor))) {
</del><ins>+    ExecState* exec = globalObject->globalExec();
+    PropertySlot slot(object->getPrototypeDirect(), PropertySlot::InternalMethodType::VMInquiry);
+    PropertyName constructor(exec->propertyNames().constructor);
+    if (object->getPropertySlot(exec, constructor, slot)) {
+        if (slot.isValue()) {
+            JSValue constructorValue = slot.getValue(exec, constructor);
+            if (constructorValue.isCell()) {
+                if (JSCell* constructorCell = constructorValue.asCell()) {
+                    if (JSObject* ctorObject = constructorCell->getObject()) {
</ins><span class="cx">                         if (JSFunction* constructorFunction = jsDynamicCast<JSFunction*>(vm, ctorObject))
</span><span class="cx">                             prototypeFunctionName = constructorFunction->calculatedDisplayName(vm);
</span><span class="cx">                         else if (InternalFunction* constructorFunction = jsDynamicCast<InternalFunction*>(vm, ctorObject))
</span><span class="lines">@@ -552,7 +548,6 @@
</span><span class="cx">             }
</span><span class="cx">         }
</span><span class="cx">     }
</span><del>-
</del><span class="cx">     ASSERT(!scope.exception() || prototypeFunctionName.isNull());
</span><span class="cx">     if (UNLIKELY(scope.exception()))
</span><span class="cx">         scope.clearException();
</span></span></pre></div>
<a id="trunkSourceWebInspectorUIChangeLog"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebInspectorUI/ChangeLog (217842 => 217843)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebInspectorUI/ChangeLog    2017-06-06 18:11:21 UTC (rev 217842)
+++ trunk/Source/WebInspectorUI/ChangeLog       2017-06-06 18:15:31 UTC (rev 217843)
</span><span class="lines">@@ -1,3 +1,26 @@
</span><ins>+2017-06-06  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Unreviewed rollout r217807. Caused a test to crash.
+
+        * UserInterface/Proxies/HeapSnapshotNodeProxy.js:
+        (WebInspector.HeapSnapshotNodeProxy):
+        (WebInspector.HeapSnapshotNodeProxy.deserialize):
+        * UserInterface/Views/HeapSnapshotClassDataGridNode.js:
+        (WebInspector.HeapSnapshotClassDataGridNode.prototype.createCellContent):
+        * UserInterface/Views/HeapSnapshotClusterContentView.js:
+        (WebInspector.HeapSnapshotClusterContentView.iconStyleClassNameForClassName):
+        * UserInterface/Views/HeapSnapshotDataGridTree.js:
+        (WebInspector.HeapSnapshotInstancesDataGridTree.prototype.populateTopLevel):
+        * UserInterface/Views/HeapSnapshotInstanceDataGridNode.js:
+        (WebInspector.HeapSnapshotInstanceDataGridNode.prototype.createCellContent):
+        (WebInspector.HeapSnapshotInstanceDataGridNode.prototype._mouseoverHandler.appendPathRow):
+        * UserInterface/Workers/HeapSnapshot/HeapSnapshot.js:
+        (HeapSnapshot):
+        (HeapSnapshot.updateCategoriesAndMetadata):
+        (HeapSnapshot.prototype.serializeNode):
+        (HeapSnapshot.prototype._gcRootPathes.visitNode):
+        (HeapSnapshot.prototype._gcRootPathes):
+
</ins><span class="cx"> 2017-06-05  Joseph Pecoraro  <pecoraro@apple.com>
</span><span class="cx"> 
</span><span class="cx">         Web Inspector: Improve ES6 Class instances in Heap Snapshot instances view
</span></span></pre></div>
<a id="trunkSourceWebInspectorUIUserInterfaceProxiesHeapSnapshotNodeProxyjs"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebInspectorUI/UserInterface/Proxies/HeapSnapshotNodeProxy.js (217842 => 217843)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebInspectorUI/UserInterface/Proxies/HeapSnapshotNodeProxy.js       2017-06-06 18:11:21 UTC (rev 217842)
+++ trunk/Source/WebInspectorUI/UserInterface/Proxies/HeapSnapshotNodeProxy.js  2017-06-06 18:15:31 UTC (rev 217843)
</span><span class="lines">@@ -25,7 +25,7 @@
</span><span class="cx"> 
</span><span class="cx"> WebInspector.HeapSnapshotNodeProxy = class HeapSnapshotNodeProxy
</span><span class="cx"> {
</span><del>-    constructor(snapshotObjectId, identifier, className, size, retainedSize, internal, isObjectType, gcRoot, dead, dominatorNodeIdentifier, hasChildren)
</del><ins>+    constructor(snapshotObjectId, identifier, className, size, retainedSize, internal, gcRoot, dead, dominatorNodeIdentifier, hasChildren)
</ins><span class="cx">     {
</span><span class="cx">         this._proxyObjectId = snapshotObjectId;
</span><span class="cx"> 
</span><span class="lines">@@ -34,7 +34,6 @@
</span><span class="cx">         this.size = size;
</span><span class="cx">         this.retainedSize = retainedSize;
</span><span class="cx">         this.internal = internal;
</span><del>-        this.isObjectType = isObjectType;
</del><span class="cx">         this.gcRoot = gcRoot;
</span><span class="cx">         this.dead = dead;
</span><span class="cx">         this.dominatorNodeIdentifier = dominatorNodeIdentifier;
</span><span class="lines">@@ -45,8 +44,8 @@
</span><span class="cx"> 
</span><span class="cx">     static deserialize(objectId, serializedNode)
</span><span class="cx">     {
</span><del>-        let {id, className, size, retainedSize, internal, isObjectType, gcRoot, dead, dominatorNodeIdentifier, hasChildren} = serializedNode;
-        return new WebInspector.HeapSnapshotNodeProxy(objectId, id, className, size, retainedSize, internal, isObjectType, gcRoot, dead, dominatorNodeIdentifier, hasChildren);
</del><ins>+        let {id, className, size, retainedSize, internal, gcRoot, dead, dominatorNodeIdentifier, hasChildren} = serializedNode;
+        return new WebInspector.HeapSnapshotNodeProxy(objectId, id, className, size, retainedSize, internal, gcRoot, dead, dominatorNodeIdentifier, hasChildren);
</ins><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     // Proxied
</span></span></pre></div>
<a id="trunkSourceWebInspectorUIUserInterfaceViewsHeapSnapshotClassDataGridNodejs"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebInspectorUI/UserInterface/Views/HeapSnapshotClassDataGridNode.js (217842 => 217843)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebInspectorUI/UserInterface/Views/HeapSnapshotClassDataGridNode.js 2017-06-06 18:11:21 UTC (rev 217842)
+++ trunk/Source/WebInspectorUI/UserInterface/Views/HeapSnapshotClassDataGridNode.js    2017-06-06 18:15:31 UTC (rev 217843)
</span><span class="lines">@@ -60,11 +60,10 @@
</span><span class="cx">             return Number.bytesToString(this._data.size);
</span><span class="cx"> 
</span><span class="cx">         if (columnIdentifier === "className") {
</span><del>-            const internal = false;
-            let {className, isObjectSubcategory} = this._data;
</del><ins>+            let {className} = this._data;
</ins><span class="cx">             let fragment = document.createDocumentFragment();
</span><span class="cx">             let iconElement = fragment.appendChild(document.createElement("img"));
</span><del>-            iconElement.classList.add("icon", WebInspector.HeapSnapshotClusterContentView.iconStyleClassNameForClassName(className, internal, isObjectSubcategory));
</del><ins>+            iconElement.classList.add("icon", WebInspector.HeapSnapshotClusterContentView.iconStyleClassNameForClassName(className));
</ins><span class="cx">             let nameElement = fragment.appendChild(document.createElement("span"));
</span><span class="cx">             nameElement.classList.add("class-name");
</span><span class="cx">             nameElement.textContent = className;
</span></span></pre></div>
<a id="trunkSourceWebInspectorUIUserInterfaceViewsHeapSnapshotClusterContentViewjs"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebInspectorUI/UserInterface/Views/HeapSnapshotClusterContentView.js (217842 => 217843)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebInspectorUI/UserInterface/Views/HeapSnapshotClusterContentView.js        2017-06-06 18:11:21 UTC (rev 217842)
+++ trunk/Source/WebInspectorUI/UserInterface/Views/HeapSnapshotClusterContentView.js   2017-06-06 18:15:31 UTC (rev 217843)
</span><span class="lines">@@ -58,12 +58,10 @@
</span><span class="cx"> 
</span><span class="cx">     // Static
</span><span class="cx"> 
</span><del>-    static iconStyleClassNameForClassName(className, internal, isObjectType)
</del><ins>+    static iconStyleClassNameForClassName(className, internal)
</ins><span class="cx">     {
</span><span class="cx">         if (internal)
</span><span class="cx">             return "native";
</span><del>-        if (isObjectType)
-            return "object";
</del><span class="cx"> 
</span><span class="cx">         switch (className) {
</span><span class="cx">         case "Object":
</span></span></pre></div>
<a id="trunkSourceWebInspectorUIUserInterfaceViewsHeapSnapshotDataGridTreejs"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebInspectorUI/UserInterface/Views/HeapSnapshotDataGridTree.js (217842 => 217843)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebInspectorUI/UserInterface/Views/HeapSnapshotDataGridTree.js      2017-06-06 18:11:21 UTC (rev 217842)
+++ trunk/Source/WebInspectorUI/UserInterface/Views/HeapSnapshotDataGridTree.js 2017-06-06 18:15:31 UTC (rev 217843)
</span><span class="lines">@@ -216,8 +216,7 @@
</span><span class="cx">     populateTopLevel()
</span><span class="cx">     {
</span><span class="cx">         // Populate the first level with the different non-internal classes.
</span><del>-        for (let [className, {size, retainedSize, count, internalCount, deadCount, objectCount}] of this.heapSnapshot.categories) {
-            console.assert(count > 0);
</del><ins>+        for (let [className, {size, retainedSize, count, internalCount, deadCount}] of this.heapSnapshot.categories) {
</ins><span class="cx">             if (count === internalCount)
</span><span class="cx">                 continue;
</span><span class="cx"> 
</span><span class="lines">@@ -226,11 +225,7 @@
</span><span class="cx">             if (!liveCount)
</span><span class="cx">                 continue;
</span><span class="cx"> 
</span><del>-            // If over half of the objects with this class name are Object sub-types, treat this as an Object category.
-            // This can happen if the page has a JavaScript Class with the same name as a native class.
-            let isObjectSubcategory = (objectCount / count) > 0.5;
-
-            this.appendChild(new WebInspector.HeapSnapshotClassDataGridNode({className, size, retainedSize, isObjectSubcategory, count: liveCount}, this));
</del><ins>+            this.appendChild(new WebInspector.HeapSnapshotClassDataGridNode({className, size, retainedSize, count: liveCount}, this));
</ins><span class="cx">         }
</span><span class="cx"> 
</span><span class="cx">         this.didPopulate();
</span></span></pre></div>
<a id="trunkSourceWebInspectorUIUserInterfaceViewsHeapSnapshotInstanceDataGridNodejs"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebInspectorUI/UserInterface/Views/HeapSnapshotInstanceDataGridNode.js (217842 => 217843)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebInspectorUI/UserInterface/Views/HeapSnapshotInstanceDataGridNode.js      2017-06-06 18:11:21 UTC (rev 217842)
+++ trunk/Source/WebInspectorUI/UserInterface/Views/HeapSnapshotInstanceDataGridNode.js 2017-06-06 18:15:31 UTC (rev 217843)
</span><span class="lines">@@ -146,12 +146,12 @@
</span><span class="cx">             return Number.bytesToString(this._node.size);
</span><span class="cx"> 
</span><span class="cx">         if (columnIdentifier === "className") {
</span><del>-            let {className, id, internal, isObjectType} = this._node;
</del><ins>+            let {className, id, internal} = this._node;
</ins><span class="cx">             let containerElement = document.createElement("span");
</span><span class="cx">             containerElement.addEventListener("contextmenu", this._contextMenuHandler.bind(this));
</span><span class="cx"> 
</span><span class="cx">             let iconElement = containerElement.appendChild(document.createElement("img"));
</span><del>-            iconElement.classList.add("icon", WebInspector.HeapSnapshotClusterContentView.iconStyleClassNameForClassName(className, internal, isObjectType));
</del><ins>+            iconElement.classList.add("icon", WebInspector.HeapSnapshotClusterContentView.iconStyleClassNameForClassName(className, internal));
</ins><span class="cx"> 
</span><span class="cx">             if (this._edge) {
</span><span class="cx">                 let nameElement = containerElement.appendChild(document.createElement("span"));
</span><span class="lines">@@ -410,7 +410,7 @@
</span><span class="cx">             containerElement.classList.add("node");
</span><span class="cx"> 
</span><span class="cx">             let iconElement = containerElement.appendChild(document.createElement("img"));
</span><del>-            iconElement.classList.add("icon", WebInspector.HeapSnapshotClusterContentView.iconStyleClassNameForClassName(node.className, node.internal, node.isObjectType));
</del><ins>+            iconElement.classList.add("icon", WebInspector.HeapSnapshotClusterContentView.iconStyleClassNameForClassName(node.className, node.internal));
</ins><span class="cx"> 
</span><span class="cx">             let classNameElement = containerElement.appendChild(document.createElement("span"));
</span><span class="cx">             classNameElement.textContent = sanitizeClassName(node.className) + " ";
</span></span></pre></div>
<a id="trunkSourceWebInspectorUIUserInterfaceWorkersHeapSnapshotHeapSnapshotjs"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebInspectorUI/UserInterface/Workers/HeapSnapshot/HeapSnapshot.js (217842 => 217843)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebInspectorUI/UserInterface/Workers/HeapSnapshot/HeapSnapshot.js   2017-06-06 18:11:21 UTC (rev 217842)
+++ trunk/Source/WebInspectorUI/UserInterface/Workers/HeapSnapshot/HeapSnapshot.js      2017-06-06 18:15:31 UTC (rev 217843)
</span><span class="lines">@@ -30,17 +30,13 @@
</span><span class="cx">  */
</span><span class="cx"> 
</span><span class="cx"> // nodes
</span><del>-// [<0:id>, <1:size>, <2:classNameTableIndex>, <3:flags>]
</del><ins>+// [<0:id>, <1:size>, <2:classNameTableIndex>, <3:internal>]
</ins><span class="cx"> const nodeFieldCount = 4;
</span><span class="cx"> const nodeIdOffset = 0;
</span><span class="cx"> const nodeSizeOffset = 1;
</span><span class="cx"> const nodeClassNameOffset = 2;
</span><del>-const nodeFlagsOffset = 3;
</del><ins>+const nodeInternalOffset = 3;
</ins><span class="cx"> 
</span><del>-// node flags
-const internalFlagsMask = (1 << 0);
-const objectTypeMask = (1 << 1);
-
</del><span class="cx"> // edges
</span><span class="cx"> // [<0:fromId>, <1:toId>, <2:typeTableIndex>, <3:edgeDataIndexOrEdgeNameIndex>]
</span><span class="cx"> const edgeFieldCount = 4;
</span><span class="lines">@@ -54,10 +50,6 @@
</span><span class="cx"> const rootNodeOrdinal = 0;
</span><span class="cx"> const rootNodeIdentifier = 0;
</span><span class="cx"> 
</span><del>-// Version Differences:
-//   - In Version 1, node[3] now named <flags> was the value 0 or 1 indicating not-internal or internal.
-//   - In Version 2, this became a bitmask so multiple flags could be included without modifying the size.
-//
</del><span class="cx"> // Terminology:
</span><span class="cx"> //   - `nodeIndex` is an index into the `nodes` list.
</span><span class="cx"> //   - `nodeOrdinal` is the order of the node in the `nodes` list. (nodeIndex / nodeFieldCount).
</span><span class="lines">@@ -91,7 +83,7 @@
</span><span class="cx">         snapshotDataString = null;
</span><span class="cx"> 
</span><span class="cx">         let {version, nodes, nodeClassNames, edges, edgeTypes, edgeNames} = json;
</span><del>-        console.assert(version === 1 || version === 2, "Expect JavaScriptCore Heap Snapshot version 1 or 2");
</del><ins>+        console.assert(version === 1, "Expect JavaScriptCore Heap Snapshot version 1");
</ins><span class="cx"> 
</span><span class="cx">         this._nodes = nodes;
</span><span class="cx">         this._nodeCount = nodes.length / nodeFieldCount;
</span><span class="lines">@@ -168,20 +160,18 @@
</span><span class="cx">             let className = nodeClassNamesTable[classNameTableIndex];
</span><span class="cx">             let size = nodes[nodeIndex + nodeSizeOffset];
</span><span class="cx">             let retainedSize = nodeOrdinalToRetainedSizes[nodeOrdinal];
</span><del>-            let flags = nodes[nodeIndex + nodeFlagsOffset];
</del><ins>+            let internal = nodes[nodeIndex + nodeInternalOffset] ? true : false;
</ins><span class="cx">             let dead = nodeOrdinalIsDead[nodeOrdinal] ? true : false;
</span><span class="cx"> 
</span><span class="cx">             let category = categories[className];
</span><span class="cx">             if (!category)
</span><del>-                category = categories[className] = {className, size: 0, retainedSize: 0, count: 0, internalCount: 0, deadCount: 0, objectCount: 0};
</del><ins>+                category = categories[className] = {className, size: 0, retainedSize: 0, count: 0, internalCount: 0, deadCount: 0};
</ins><span class="cx"> 
</span><span class="cx">             category.size += size;
</span><span class="cx">             category.retainedSize += retainedSize;
</span><span class="cx">             category.count += 1;
</span><del>-            if (flags & internalFlagsMask)
</del><ins>+            if (internal)
</ins><span class="cx">                 category.internalCount += 1;
</span><del>-            if (flags & objectTypeMask)
-                category.objectCount += 1;
</del><span class="cx">             if (dead)
</span><span class="cx">                 category.deadCount += 1;
</span><span class="cx">             else
</span><span class="lines">@@ -423,7 +413,6 @@
</span><span class="cx">         let nodeOrdinal = nodeIndex / nodeFieldCount;
</span><span class="cx">         let edgeIndex = this._nodeOrdinalToFirstOutgoingEdge[nodeOrdinal];
</span><span class="cx">         let hasChildren = this._edges[edgeIndex + edgeFromIdOffset] === nodeIdentifier;
</span><del>-        let nodeFlags = this._nodes[nodeIndex + nodeFlagsOffset];
</del><span class="cx"> 
</span><span class="cx">         let dominatorNodeOrdinal = this._nodeOrdinalToDominatorNodeOrdinal[nodeOrdinal];
</span><span class="cx">         let dominatorNodeIndex = dominatorNodeOrdinal * nodeFieldCount;
</span><span class="lines">@@ -434,8 +423,7 @@
</span><span class="cx">             className: this._nodeClassNamesTable[this._nodes[nodeIndex + nodeClassNameOffset]],
</span><span class="cx">             size: this._nodes[nodeIndex + nodeSizeOffset],
</span><span class="cx">             retainedSize: this._nodeOrdinalToRetainedSizes[nodeOrdinal],
</span><del>-            internal: nodeFlags & internalFlagsMask ? true : false,
-            isObjectType: nodeFlags & objectTypeMask ? true : false,
</del><ins>+            internal: this._nodes[nodeIndex + nodeInternalOffset] ? true : false,
</ins><span class="cx">             gcRoot: this._nodeOrdinalIsGCRoot[nodeOrdinal] ? true : false,
</span><span class="cx">             dead: this._nodeOrdinalIsDead[nodeOrdinal] ? true : false,
</span><span class="cx">             dominatorNodeIdentifier,
</span><span class="lines">@@ -762,7 +750,7 @@
</span><span class="cx">             for (let incomingEdgeIndex = incomingEdgeIndexEnd - 1; incomingEdgeIndex >= incomingEdgeIndexStart; --incomingEdgeIndex) {
</span><span class="cx">                 let fromNodeOrdinal = this._incomingNodes[incomingEdgeIndex];
</span><span class="cx">                 let fromNodeIndex = fromNodeOrdinal * nodeFieldCount;
</span><del>-                let fromNodeIsInternal = this._nodes[fromNodeIndex + nodeFlagsOffset] & internalFlagsMask;
</del><ins>+                let fromNodeIsInternal = this._nodes[fromNodeIndex + nodeInternalOffset];
</ins><span class="cx">                 if (fromNodeIsInternal)
</span><span class="cx">                     continue;
</span><span class="cx"> 
</span></span></pre>
</div>
</div>

</body>
</html>