<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN"
"http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head><meta http-equiv="content-type" content="text/html; charset=utf-8" />
<title>[265744] trunk</title>
</head>
<body>

<style type="text/css"><!--
#msg dl.meta { border: 1px #006 solid; background: #369; padding: 6px; color: #fff; }
#msg dl.meta dt { float: left; width: 6em; font-weight: bold; }
#msg dt:after { content:':';}
#msg dl, #msg dt, #msg ul, #msg li, #header, #footer, #logmsg { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt;  }
#msg dl a { font-weight: bold}
#msg dl a:link    { color:#fc3; }
#msg dl a:active  { color:#ff0; }
#msg dl a:visited { color:#cc6; }
h3 { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; font-weight: bold; }
#msg pre { overflow: auto; background: #ffc; border: 1px #fa0 solid; padding: 6px; }
#logmsg { background: #ffc; border: 1px #fa0 solid; padding: 1em 1em 0 1em; }
#logmsg p, #logmsg pre, #logmsg blockquote { margin: 0 0 1em 0; }
#logmsg p, #logmsg li, #logmsg dt, #logmsg dd { line-height: 14pt; }
#logmsg h1, #logmsg h2, #logmsg h3, #logmsg h4, #logmsg h5, #logmsg h6 { margin: .5em 0; }
#logmsg h1:first-child, #logmsg h2:first-child, #logmsg h3:first-child, #logmsg h4:first-child, #logmsg h5:first-child, #logmsg h6:first-child { margin-top: 0; }
#logmsg ul, #logmsg ol { padding: 0; list-style-position: inside; margin: 0 0 0 1em; }
#logmsg ul { text-indent: -1em; padding-left: 1em; }#logmsg ol { text-indent: -1.5em; padding-left: 1.5em; }
#logmsg > ul, #logmsg > ol { margin: 0 0 1em 0; }
#logmsg pre { background: #eee; padding: 1em; }
#logmsg blockquote { border: 1px solid #fa0; border-left-width: 10px; padding: 1em 1em 0 1em; background: white;}
#logmsg dl { margin: 0; }
#logmsg dt { font-weight: bold; }
#logmsg dd { margin: 0; padding: 0 0 0.5em 0; }
#logmsg dd:before { content:'\00bb';}
#logmsg table { border-spacing: 0px; border-collapse: collapse; border-top: 4px solid #fa0; border-bottom: 1px solid #fa0; background: #fff; }
#logmsg table th { text-align: left; font-weight: normal; padding: 0.2em 0.5em; border-top: 1px dotted #fa0; }
#logmsg table td { text-align: right; border-top: 1px dotted #fa0; padding: 0.2em 0.5em; }
#logmsg table thead th { text-align: center; border-bottom: 1px solid #fa0; }
#logmsg table th.Corner { text-align: left; }
#logmsg hr { border: none 0; border-top: 2px dashed #fa0; height: 1px; }
#header, #footer { color: #fff; background: #636; border: 1px #300 solid; padding: 6px; }
#patch { width: 100%; }
#patch h4 {font-family: verdana,arial,helvetica,sans-serif;font-size:10pt;padding:8px;background:#369;color:#fff;margin:0;}
#patch .propset h4, #patch .binary h4 {margin:0;}
#patch pre {padding:0;line-height:1.2em;margin:0;}
#patch .diff {width:100%;background:#eee;padding: 0 0 10px 0;overflow:auto;}
#patch .propset .diff, #patch .binary .diff  {padding:10px 0;}
#patch span {display:block;padding:0 10px;}
#patch .modfile, #patch .addfile, #patch .delfile, #patch .propset, #patch .binary, #patch .copfile {border:1px solid #ccc;margin:10px 0;}
#patch ins {background:#dfd;text-decoration:none;display:block;padding:0 10px;}
#patch del {background:#fdd;text-decoration:none;display:block;padding:0 10px;}
#patch .lines, .info {color:#888;background:#fff;}
--></style>
<div id="msg">
<dl class="meta">
<dt>Revision</dt> <dd><a href="http://trac.webkit.org/projects/webkit/changeset/265744">265744</a></dd>
<dt>Author</dt> <dd>shvaikalesh@gmail.com</dd>
<dt>Date</dt> <dd>2020-08-16 13:40:17 -0700 (Sun, 16 Aug 2020)</dd>
</dl>

<h3>Log Message</h3>
<pre>Remove OpIsObjectOrNull from ClassExprNode::emitBytecode()
https://bugs.webkit.org/show_bug.cgi?id=214525

Reviewed by Keith Miller.

Source/JavaScriptCore:

This patch:

1. Replaces OpIsObjectOrNull in ClassExprNode::emitBytecode() [1] with emitIsObject() +
   emitIsNull(), preventing DFG/FTL from throwing a TypeError if `document.all` is the
   value of superclass "prototype" property, which aligns JSC with V8 and SpiderMonkey.
   Also, tweaks error message to reflect that `null` is allowed.

2. Renames is_object_or_null bytecode op to typeof_is_object, fixing the confusing
   operationObjectIsObject() name, and aligns it with typeof_is_undefined.
   New name offers better semantics and clearly communicates the op should be avoided when
   implementing new features because of `typeof` behavior with [[IsHTMLDDA]] objects [2].

[1]: https://tc39.es/ecma262/#sec-runtime-semantics-classdefinitionevaluation (step 5.g.ii)
[2]: https://tc39.es/ecma262/#sec-IsHTMLDDA-internal-slot-typeof

* bytecode/BytecodeList.rb:
* bytecode/BytecodeUseDef.cpp:
(JSC::computeUsesForBytecodeIndexImpl):
(JSC::computeDefsForBytecodeIndexImpl):
* bytecompiler/BytecodeGenerator.cpp:
(JSC::BytecodeGenerator::emitEqualityOpImpl):
* bytecompiler/NodesCodegen.cpp:
(JSC::ClassExprNode::emitBytecode):
* dfg/DFGAbstractInterpreterInlines.h:
(JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
* dfg/DFGByteCodeParser.cpp:
(JSC::DFG::ByteCodeParser::parseBlock):
* dfg/DFGCapabilities.cpp:
(JSC::DFG::capabilityLevel):
* dfg/DFGClobberize.h:
(JSC::DFG::clobberize):
* dfg/DFGDoesGC.cpp:
(JSC::DFG::doesGC):
* dfg/DFGFixupPhase.cpp:
(JSC::DFG::FixupPhase::fixupNode):
* dfg/DFGHeapLocation.cpp:
(WTF::printInternal):
* dfg/DFGHeapLocation.h:
* dfg/DFGNodeType.h:
* dfg/DFGOperations.cpp:
* dfg/DFGOperations.h:
* dfg/DFGPredictionPropagationPhase.cpp:
* dfg/DFGSafeToExecute.h:
(JSC::DFG::safeToExecute):
* dfg/DFGSpeculativeJIT.cpp:
(JSC::DFG::SpeculativeJIT::compileTypeOfIsObject):
(JSC::DFG::SpeculativeJIT::compileIsObjectOrNull): Deleted.
* dfg/DFGSpeculativeJIT.h:
* dfg/DFGSpeculativeJIT32_64.cpp:
(JSC::DFG::SpeculativeJIT::compile):
* dfg/DFGSpeculativeJIT64.cpp:
(JSC::DFG::SpeculativeJIT::compile):
* ftl/FTLCapabilities.cpp:
(JSC::FTL::canCompile):
* ftl/FTLLowerDFGToB3.cpp:
(JSC::FTL::DFG::LowerDFGToB3::compileNode):
(JSC::FTL::DFG::LowerDFGToB3::compileTypeOfIsObject):
(JSC::FTL::DFG::LowerDFGToB3::compileIsObjectOrNull): Deleted.
* jit/JIT.cpp:
(JSC::JIT::privateCompileMainPass):
* llint/LowLevelInterpreter.asm:
* runtime/CommonSlowPaths.cpp:
(JSC::SLOW_PATH_DECL):
* runtime/CommonSlowPaths.h:
* runtime/Operations.cpp:
(JSC::jsTypeofIsObject):
(JSC::jsIsObjectTypeOrNull): Deleted.
* runtime/Operations.h:

LayoutTests:

New tests are added for `document.all` rather than `makeMasquerader()` since
the latter has sufficient test coverage and takes the short path as JSFunction.

* js/class-syntax-extends-expected.txt:
* js/dom/document-all-class-extends-expected.txt: Added.
* js/dom/document-all-class-extends.html: Added.
* js/dom/document-all-typeof-is-object-fold-expected.txt: Added.
* js/dom/document-all-typeof-is-object-fold.html: Added.
* js/dom/script-tests/document-all-class-extends.js: Added.
* js/dom/script-tests/document-all-typeof-is-object-fold.js: Added.
* js/script-tests/class-syntax-extends.js:</pre>

<h3>Modified Paths</h3>
<ul>
<li><a href="#trunkLayoutTestsChangeLog">trunk/LayoutTests/ChangeLog</a></li>
<li><a href="#trunkLayoutTestsjsclasssyntaxextendsexpectedtxt">trunk/LayoutTests/js/class-syntax-extends-expected.txt</a></li>
<li><a href="#trunkLayoutTestsjsscripttestsclasssyntaxextendsjs">trunk/LayoutTests/js/script-tests/class-syntax-extends.js</a></li>
<li><a href="#trunkSourceJavaScriptCoreChangeLog">trunk/Source/JavaScriptCore/ChangeLog</a></li>
<li><a href="#trunkSourceJavaScriptCorebytecodeBytecodeListrb">trunk/Source/JavaScriptCore/bytecode/BytecodeList.rb</a></li>
<li><a href="#trunkSourceJavaScriptCorebytecodeBytecodeUseDefcpp">trunk/Source/JavaScriptCore/bytecode/BytecodeUseDef.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCorebytecompilerBytecodeGeneratorcpp">trunk/Source/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCorebytecompilerNodesCodegencpp">trunk/Source/JavaScriptCore/bytecompiler/NodesCodegen.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGAbstractInterpreterInlinesh">trunk/Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGByteCodeParsercpp">trunk/Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGCapabilitiescpp">trunk/Source/JavaScriptCore/dfg/DFGCapabilities.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGClobberizeh">trunk/Source/JavaScriptCore/dfg/DFGClobberize.h</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGDoesGCcpp">trunk/Source/JavaScriptCore/dfg/DFGDoesGC.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGFixupPhasecpp">trunk/Source/JavaScriptCore/dfg/DFGFixupPhase.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGHeapLocationcpp">trunk/Source/JavaScriptCore/dfg/DFGHeapLocation.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGHeapLocationh">trunk/Source/JavaScriptCore/dfg/DFGHeapLocation.h</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGNodeTypeh">trunk/Source/JavaScriptCore/dfg/DFGNodeType.h</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGOperationscpp">trunk/Source/JavaScriptCore/dfg/DFGOperations.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGOperationsh">trunk/Source/JavaScriptCore/dfg/DFGOperations.h</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGPredictionPropagationPhasecpp">trunk/Source/JavaScriptCore/dfg/DFGPredictionPropagationPhase.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGSafeToExecuteh">trunk/Source/JavaScriptCore/dfg/DFGSafeToExecute.h</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGSpeculativeJITcpp">trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGSpeculativeJITh">trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGSpeculativeJIT32_64cpp">trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGSpeculativeJIT64cpp">trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreftlFTLCapabilitiescpp">trunk/Source/JavaScriptCore/ftl/FTLCapabilities.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreftlFTLLowerDFGToB3cpp">trunk/Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCorejitJITcpp">trunk/Source/JavaScriptCore/jit/JIT.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCorellintLowLevelInterpreterasm">trunk/Source/JavaScriptCore/llint/LowLevelInterpreter.asm</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeCommonSlowPathscpp">trunk/Source/JavaScriptCore/runtime/CommonSlowPaths.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeCommonSlowPathsh">trunk/Source/JavaScriptCore/runtime/CommonSlowPaths.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeOperationscpp">trunk/Source/JavaScriptCore/runtime/Operations.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeOperationsh">trunk/Source/JavaScriptCore/runtime/Operations.h</a></li>
</ul>

<h3>Added Paths</h3>
<ul>
<li><a href="#trunkLayoutTestsjsdomdocumentallclassextendsexpectedtxt">trunk/LayoutTests/js/dom/document-all-class-extends-expected.txt</a></li>
<li><a href="#trunkLayoutTestsjsdomdocumentallclassextendshtml">trunk/LayoutTests/js/dom/document-all-class-extends.html</a></li>
<li><a href="#trunkLayoutTestsjsdomdocumentalltypeofisobjectfoldexpectedtxt">trunk/LayoutTests/js/dom/document-all-typeof-is-object-fold-expected.txt</a></li>
<li><a href="#trunkLayoutTestsjsdomdocumentalltypeofisobjectfoldhtml">trunk/LayoutTests/js/dom/document-all-typeof-is-object-fold.html</a></li>
<li><a href="#trunkLayoutTestsjsdomscripttestsdocumentallclassextendsjs">trunk/LayoutTests/js/dom/script-tests/document-all-class-extends.js</a></li>
<li><a href="#trunkLayoutTestsjsdomscripttestsdocumentalltypeofisobjectfoldjs">trunk/LayoutTests/js/dom/script-tests/document-all-typeof-is-object-fold.js</a></li>
</ul>

</div>
<div id="patch">
<h3>Diff</h3>
<a id="trunkLayoutTestsChangeLog"></a>
<div class="modfile"><h4>Modified: trunk/LayoutTests/ChangeLog (265743 => 265744)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/ChangeLog      2020-08-16 20:16:29 UTC (rev 265743)
+++ trunk/LayoutTests/ChangeLog 2020-08-16 20:40:17 UTC (rev 265744)
</span><span class="lines">@@ -1,3 +1,22 @@
</span><ins>+2020-08-16  Alexey Shvayka  <shvaikalesh@gmail.com>
+
+        Remove OpIsObjectOrNull from ClassExprNode::emitBytecode()
+        https://bugs.webkit.org/show_bug.cgi?id=214525
+
+        Reviewed by Keith Miller.
+
+        New tests are added for `document.all` rather than `makeMasquerader()` since
+        the latter has sufficient test coverage and takes the short path as JSFunction.
+
+        * js/class-syntax-extends-expected.txt:
+        * js/dom/document-all-class-extends-expected.txt: Added.
+        * js/dom/document-all-class-extends.html: Added.
+        * js/dom/document-all-typeof-is-object-fold-expected.txt: Added.
+        * js/dom/document-all-typeof-is-object-fold.html: Added.
+        * js/dom/script-tests/document-all-class-extends.js: Added.
+        * js/dom/script-tests/document-all-typeof-is-object-fold.js: Added.
+        * js/script-tests/class-syntax-extends.js:
+
</ins><span class="cx"> 2020-08-16  Dean Jackson  <dino@apple.com>
</span><span class="cx"> 
</span><span class="cx">         [AS Layout Tests] 6 WPT css-backgrounds tests consistently failing
</span></span></pre></div>
<a id="trunkLayoutTestsjsclasssyntaxextendsexpectedtxt"></a>
<div class="modfile"><h4>Modified: trunk/LayoutTests/js/class-syntax-extends-expected.txt (265743 => 265744)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/class-syntax-extends-expected.txt   2020-08-16 20:16:29 UTC (rev 265743)
+++ trunk/LayoutTests/js/class-syntax-extends-expected.txt      2020-08-16 20:40:17 UTC (rev 265744)
</span><span class="lines">@@ -26,9 +26,9 @@
</span><span class="cx"> PASS x = class extends 3 { constructor() { } }; x.__proto__:::TypeError: The superclass is not a constructor.
</span><span class="cx"> PASS x = class extends "abc" { constructor() { } }; x.__proto__:::TypeError: The superclass is not a constructor.
</span><span class="cx"> PASS baseWithBadPrototype = function () {}; baseWithBadPrototype.prototype = 3; new baseWithBadPrototype
</span><del>-PASS x = class extends baseWithBadPrototype { constructor() { } }:::TypeError: The value of the superclass's prototype property is not an object.
</del><ins>+PASS x = class extends baseWithBadPrototype { constructor() { } }:::TypeError: The value of the superclass's prototype property is not an object or null.
</ins><span class="cx"> PASS baseWithBadPrototype.prototype = "abc"
</span><del>-PASS x = class extends baseWithBadPrototype { constructor() { } }:::TypeError: The value of the superclass's prototype property is not an object.
</del><ins>+PASS x = class extends baseWithBadPrototype { constructor() { } }:::TypeError: The value of the superclass's prototype property is not an object or null.
</ins><span class="cx"> PASS baseWithBadPrototype.prototype = null; x = class extends baseWithBadPrototype { constructor() { } }
</span><span class="cx"> PASS x = 1; c = class extends ++x { constructor() { } };:::SyntaxError: Unexpected token '++'
</span><span class="cx"> PASS x = 1; c = class extends x++ { constructor() { } };:::SyntaxError: Unexpected token '++'. Expected opening '{' at the start of a class body.
</span></span></pre></div>
<a id="trunkLayoutTestsjsdomdocumentallclassextendsexpectedtxt"></a>
<div class="addfile"><h4>Added: trunk/LayoutTests/js/dom/document-all-class-extends-expected.txt (0 => 265744)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/dom/document-all-class-extends-expected.txt                         (rev 0)
+++ trunk/LayoutTests/js/dom/document-all-class-extends-expected.txt    2020-08-16 20:40:17 UTC (rev 265744)
</span><span class="lines">@@ -0,0 +1,11 @@
</span><ins>+document.all works as superclass.prototype, but not as superclass
+
+On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
+
+
+PASS testAsSuperclassPrototype() is true
+PASS class Foo extends document.all {} threw exception TypeError: The superclass is not a constructor..
+PASS successfullyParsed is true
+
+TEST COMPLETE
+
</ins></span></pre></div>
<a id="trunkLayoutTestsjsdomdocumentallclassextendshtml"></a>
<div class="addfile"><h4>Added: trunk/LayoutTests/js/dom/document-all-class-extends.html (0 => 265744)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/dom/document-all-class-extends.html                         (rev 0)
+++ trunk/LayoutTests/js/dom/document-all-class-extends.html    2020-08-16 20:40:17 UTC (rev 265744)
</span><span class="lines">@@ -0,0 +1,10 @@
</span><ins>+<!DOCTYPE HTML>
+<html>
+<head>
+<script src="../../resources/js-test-pre.js"></script>
+</head>
+<body>
+<script src="script-tests/document-all-class-extends.js"></script>
+<script src="../../resources/js-test-post.js"></script>
+</body>
+</html>
</ins></span></pre></div>
<a id="trunkLayoutTestsjsdomdocumentalltypeofisobjectfoldexpectedtxt"></a>
<div class="addfile"><h4>Added: trunk/LayoutTests/js/dom/document-all-typeof-is-object-fold-expected.txt (0 => 265744)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/dom/document-all-typeof-is-object-fold-expected.txt                         (rev 0)
+++ trunk/LayoutTests/js/dom/document-all-typeof-is-object-fold-expected.txt    2020-08-16 20:40:17 UTC (rev 265744)
</span><span class="lines">@@ -0,0 +1,10 @@
</span><ins>+typeof document.all is never 'object'
+
+On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
+
+
+PASS testTypeofIsObject() is true
+PASS successfullyParsed is true
+
+TEST COMPLETE
+
</ins></span></pre></div>
<a id="trunkLayoutTestsjsdomdocumentalltypeofisobjectfoldhtml"></a>
<div class="addfile"><h4>Added: trunk/LayoutTests/js/dom/document-all-typeof-is-object-fold.html (0 => 265744)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/dom/document-all-typeof-is-object-fold.html                         (rev 0)
+++ trunk/LayoutTests/js/dom/document-all-typeof-is-object-fold.html    2020-08-16 20:40:17 UTC (rev 265744)
</span><span class="lines">@@ -0,0 +1,10 @@
</span><ins>+<!DOCTYPE HTML>
+<html>
+<head>
+<script src="../../resources/js-test-pre.js"></script>
+</head>
+<body>
+<script src="script-tests/document-all-typeof-is-object-fold.js"></script>
+<script src="../../resources/js-test-post.js"></script>
+</body>
+</html>
</ins></span></pre></div>
<a id="trunkLayoutTestsjsdomscripttestsdocumentallclassextendsjs"></a>
<div class="addfile"><h4>Added: trunk/LayoutTests/js/dom/script-tests/document-all-class-extends.js (0 => 265744)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/dom/script-tests/document-all-class-extends.js                              (rev 0)
+++ trunk/LayoutTests/js/dom/script-tests/document-all-class-extends.js 2020-08-16 20:40:17 UTC (rev 265744)
</span><span class="lines">@@ -0,0 +1,18 @@
</span><ins>+description("document.all works as superclass.prototype, but not as superclass");
+
+function testAsSuperclassPrototype() {
+    function Bar() {}
+    Bar.prototype = document.all;
+
+    for (let i = 0; i < 1e5; ++i) {
+        class Foo extends Bar {}
+
+        if (!(new Foo() instanceof Bar))
+            return false;
+    }
+
+    return true;
+}
+
+shouldBe("testAsSuperclassPrototype()", "true");
+shouldThrow("class Foo extends document.all {}", "'TypeError: The superclass is not a constructor.'");
</ins></span></pre></div>
<a id="trunkLayoutTestsjsdomscripttestsdocumentalltypeofisobjectfoldjs"></a>
<div class="addfile"><h4>Added: trunk/LayoutTests/js/dom/script-tests/document-all-typeof-is-object-fold.js (0 => 265744)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/dom/script-tests/document-all-typeof-is-object-fold.js                              (rev 0)
+++ trunk/LayoutTests/js/dom/script-tests/document-all-typeof-is-object-fold.js 2020-08-16 20:40:17 UTC (rev 265744)
</span><span class="lines">@@ -0,0 +1,17 @@
</span><ins>+description("typeof document.all is never 'object'");
+
+const documentAll = document.all;
+function testTypeofIsObject() {
+    let acc = 0;
+    for (let i = 0; i < 1e6; ++i)
+        acc += (typeof documentAll === "object");
+
+    if (acc !== 0)
+        return false;
+
+    for (let i = 0; i < 1e6; ++i)
+        acc += (typeof documentAll !== "object");
+    return acc === 1e6;
+}
+
+shouldBe("testTypeofIsObject()", "true");
</ins></span></pre></div>
<a id="trunkLayoutTestsjsscripttestsclasssyntaxextendsjs"></a>
<div class="modfile"><h4>Modified: trunk/LayoutTests/js/script-tests/class-syntax-extends.js (265743 => 265744)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/script-tests/class-syntax-extends.js        2020-08-16 20:16:29 UTC (rev 265743)
+++ trunk/LayoutTests/js/script-tests/class-syntax-extends.js   2020-08-16 20:40:17 UTC (rev 265744)
</span><span class="lines">@@ -81,9 +81,9 @@
</span><span class="cx"> shouldThrow('x = class extends 3 { constructor() { } }; x.__proto__', '"TypeError: The superclass is not a constructor."');
</span><span class="cx"> shouldThrow('x = class extends "abc" { constructor() { } }; x.__proto__', '"TypeError: The superclass is not a constructor."');
</span><span class="cx"> shouldNotThrow('baseWithBadPrototype = function () {}; baseWithBadPrototype.prototype = 3; new baseWithBadPrototype');
</span><del>-shouldThrow('x = class extends baseWithBadPrototype { constructor() { } }', '"TypeError: The value of the superclass\'s prototype property is not an object."');
</del><ins>+shouldThrow('x = class extends baseWithBadPrototype { constructor() { } }', '"TypeError: The value of the superclass\'s prototype property is not an object or null."');
</ins><span class="cx"> shouldNotThrow('baseWithBadPrototype.prototype = "abc"');
</span><del>-shouldThrow('x = class extends baseWithBadPrototype { constructor() { } }', '"TypeError: The value of the superclass\'s prototype property is not an object."');
</del><ins>+shouldThrow('x = class extends baseWithBadPrototype { constructor() { } }', '"TypeError: The value of the superclass\'s prototype property is not an object or null."');
</ins><span class="cx"> shouldNotThrow('baseWithBadPrototype.prototype = null; x = class extends baseWithBadPrototype { constructor() { } }');
</span><span class="cx"> 
</span><span class="cx"> shouldThrow('x = 1; c = class extends ++x { constructor() { } };');
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreChangeLog"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/ChangeLog (265743 => 265744)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/ChangeLog    2020-08-16 20:16:29 UTC (rev 265743)
+++ trunk/Source/JavaScriptCore/ChangeLog       2020-08-16 20:40:17 UTC (rev 265744)
</span><span class="lines">@@ -1,3 +1,79 @@
</span><ins>+2020-08-16  Alexey Shvayka  <shvaikalesh@gmail.com>
+
+        Remove OpIsObjectOrNull from ClassExprNode::emitBytecode()
+        https://bugs.webkit.org/show_bug.cgi?id=214525
+
+        Reviewed by Keith Miller.
+
+        This patch:
+
+        1. Replaces OpIsObjectOrNull in ClassExprNode::emitBytecode() [1] with emitIsObject() +
+           emitIsNull(), preventing DFG/FTL from throwing a TypeError if `document.all` is the
+           value of superclass "prototype" property, which aligns JSC with V8 and SpiderMonkey.
+           Also, tweaks error message to reflect that `null` is allowed.
+
+        2. Renames is_object_or_null bytecode op to typeof_is_object, fixing the confusing
+           operationObjectIsObject() name, and aligns it with typeof_is_undefined.
+           New name offers better semantics and clearly communicates the op should be avoided when
+           implementing new features because of `typeof` behavior with [[IsHTMLDDA]] objects [2].
+
+        [1]: https://tc39.es/ecma262/#sec-runtime-semantics-classdefinitionevaluation (step 5.g.ii)
+        [2]: https://tc39.es/ecma262/#sec-IsHTMLDDA-internal-slot-typeof
+
+        * bytecode/BytecodeList.rb:
+        * bytecode/BytecodeUseDef.cpp:
+        (JSC::computeUsesForBytecodeIndexImpl):
+        (JSC::computeDefsForBytecodeIndexImpl):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitEqualityOpImpl):
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::ClassExprNode::emitBytecode):
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * dfg/DFGCapabilities.cpp:
+        (JSC::DFG::capabilityLevel):
+        * dfg/DFGClobberize.h:
+        (JSC::DFG::clobberize):
+        * dfg/DFGDoesGC.cpp:
+        (JSC::DFG::doesGC):
+        * dfg/DFGFixupPhase.cpp:
+        (JSC::DFG::FixupPhase::fixupNode):
+        * dfg/DFGHeapLocation.cpp:
+        (WTF::printInternal):
+        * dfg/DFGHeapLocation.h:
+        * dfg/DFGNodeType.h:
+        * dfg/DFGOperations.cpp:
+        * dfg/DFGOperations.h:
+        * dfg/DFGPredictionPropagationPhase.cpp:
+        * dfg/DFGSafeToExecute.h:
+        (JSC::DFG::safeToExecute):
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileTypeOfIsObject):
+        (JSC::DFG::SpeculativeJIT::compileIsObjectOrNull): Deleted.
+        * dfg/DFGSpeculativeJIT.h:
+        * dfg/DFGSpeculativeJIT32_64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * dfg/DFGSpeculativeJIT64.cpp:
+        (JSC::DFG::SpeculativeJIT::compile):
+        * ftl/FTLCapabilities.cpp:
+        (JSC::FTL::canCompile):
+        * ftl/FTLLowerDFGToB3.cpp:
+        (JSC::FTL::DFG::LowerDFGToB3::compileNode):
+        (JSC::FTL::DFG::LowerDFGToB3::compileTypeOfIsObject):
+        (JSC::FTL::DFG::LowerDFGToB3::compileIsObjectOrNull): Deleted.
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        * llint/LowLevelInterpreter.asm:
+        * runtime/CommonSlowPaths.cpp:
+        (JSC::SLOW_PATH_DECL):
+        * runtime/CommonSlowPaths.h:
+        * runtime/Operations.cpp:
+        (JSC::jsTypeofIsObject):
+        (JSC::jsIsObjectTypeOrNull): Deleted.
+        * runtime/Operations.h:
+
</ins><span class="cx"> 2020-08-15  Adrian Perez de Castro  <aperez@igalia.com>
</span><span class="cx"> 
</span><span class="cx">         Unreviewed non-unified source build fix
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorebytecodeBytecodeListrb"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/bytecode/BytecodeList.rb (265743 => 265744)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/bytecode/BytecodeList.rb     2020-08-16 20:16:29 UTC (rev 265743)
+++ trunk/Source/JavaScriptCore/bytecode/BytecodeList.rb        2020-08-16 20:40:17 UTC (rev 265744)
</span><span class="lines">@@ -328,12 +328,12 @@
</span><span class="cx">         :unsigned,
</span><span class="cx">         :is_empty,
</span><span class="cx">         :typeof_is_undefined,
</span><ins>+        :typeof_is_object,
</ins><span class="cx">         :is_undefined_or_null,
</span><span class="cx">         :is_boolean,
</span><span class="cx">         :is_number,
</span><span class="cx">         :is_big_int,
</span><span class="cx">         :is_object,
</span><del>-        :is_object_or_null,
</del><span class="cx">         :is_function,
</span><span class="cx">         :is_constructor,
</span><span class="cx">     ],
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorebytecodeBytecodeUseDefcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/bytecode/BytecodeUseDef.cpp (265743 => 265744)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/bytecode/BytecodeUseDef.cpp  2020-08-16 20:16:29 UTC (rev 265743)
+++ trunk/Source/JavaScriptCore/bytecode/BytecodeUseDef.cpp     2020-08-16 20:40:17 UTC (rev 265744)
</span><span class="lines">@@ -183,12 +183,12 @@
</span><span class="cx">     USES(OpTypeof, value)
</span><span class="cx">     USES(OpIsEmpty, operand)
</span><span class="cx">     USES(OpTypeofIsUndefined, operand)
</span><ins>+    USES(OpTypeofIsObject, operand)
</ins><span class="cx">     USES(OpIsUndefinedOrNull, operand)
</span><span class="cx">     USES(OpIsBoolean, operand)
</span><span class="cx">     USES(OpIsNumber, operand)
</span><span class="cx">     USES(OpIsBigInt, operand)
</span><span class="cx">     USES(OpIsObject, operand)
</span><del>-    USES(OpIsObjectOrNull, operand)
</del><span class="cx">     USES(OpIsCellWithType, operand)
</span><span class="cx">     USES(OpIsFunction, operand)
</span><span class="cx">     USES(OpIsConstructor, operand)
</span><span class="lines">@@ -490,12 +490,12 @@
</span><span class="cx">     DEFS(OpIdentityWithProfile, srcDst)
</span><span class="cx">     DEFS(OpIsEmpty, dst)
</span><span class="cx">     DEFS(OpTypeofIsUndefined, dst)
</span><ins>+    DEFS(OpTypeofIsObject, dst)
</ins><span class="cx">     DEFS(OpIsUndefinedOrNull, dst)
</span><span class="cx">     DEFS(OpIsBoolean, dst)
</span><span class="cx">     DEFS(OpIsNumber, dst)
</span><span class="cx">     DEFS(OpIsBigInt, dst)
</span><span class="cx">     DEFS(OpIsObject, dst)
</span><del>-    DEFS(OpIsObjectOrNull, dst)
</del><span class="cx">     DEFS(OpIsCellWithType, dst)
</span><span class="cx">     DEFS(OpIsFunction, dst)
</span><span class="cx">     DEFS(OpIsConstructor, dst)
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorebytecompilerBytecodeGeneratorcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp (265743 => 265744)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp   2020-08-16 20:16:29 UTC (rev 265743)
+++ trunk/Source/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp      2020-08-16 20:40:17 UTC (rev 265744)
</span><span class="lines">@@ -1715,7 +1715,7 @@
</span><span class="cx">             }
</span><span class="cx">             if (value == "object") {
</span><span class="cx">                 rewind();
</span><del>-                OpIsObjectOrNull::emit(this, dst, op.m_value);
</del><ins>+                OpTypeofIsObject::emit(this, dst, op.m_value);
</ins><span class="cx">                 return true;
</span><span class="cx">             }
</span><span class="cx">             if (value == "function") {
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorebytecompilerNodesCodegencpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/bytecompiler/NodesCodegen.cpp (265743 => 265744)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/bytecompiler/NodesCodegen.cpp        2020-08-16 20:16:29 UTC (rev 265743)
+++ trunk/Source/JavaScriptCore/bytecompiler/NodesCodegen.cpp   2020-08-16 20:40:17 UTC (rev 265744)
</span><span class="lines">@@ -4902,9 +4902,9 @@
</span><span class="cx">         generator.emitGetById(protoParent.get(), superclass.get(), generator.propertyNames().prototype);
</span><span class="cx"> 
</span><span class="cx">         Ref<Label> protoParentIsObjectOrNullLabel = generator.newLabel();
</span><del>-        generator.emitJumpIfTrue(generator.emitUnaryOp<OpIsObjectOrNull>(tempRegister.get(), protoParent.get()), protoParentIsObjectOrNullLabel.get());
-        generator.emitJumpIfTrue(generator.emitUnaryOp<OpIsFunction>(tempRegister.get(), protoParent.get()), protoParentIsObjectOrNullLabel.get());
-        generator.emitThrowTypeError("The value of the superclass's prototype property is not an object."_s);
</del><ins>+        generator.emitJumpIfTrue(generator.emitIsObject(tempRegister.get(), protoParent.get()), protoParentIsObjectOrNullLabel.get());
+        generator.emitJumpIfTrue(generator.emitIsNull(tempRegister.get(), protoParent.get()), protoParentIsObjectOrNullLabel.get());
+        generator.emitThrowTypeError("The value of the superclass's prototype property is not an object or null."_s);
</ins><span class="cx">         generator.emitLabel(protoParentIsObjectOrNullLabel.get());
</span><span class="cx"> 
</span><span class="cx">         generator.emitDirectPutById(constructor.get(), generator.propertyNames().underscoreProto, superclass.get(), PropertyNode::Unknown);
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGAbstractInterpreterInlinesh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h (265743 => 265744)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h  2020-08-16 20:16:29 UTC (rev 265743)
+++ trunk/Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h     2020-08-16 20:40:17 UTC (rev 265744)
</span><span class="lines">@@ -1451,6 +1451,7 @@
</span><span class="cx"> 
</span><span class="cx">     case IsEmpty:
</span><span class="cx">     case TypeOfIsUndefined:
</span><ins>+    case TypeOfIsObject:
</ins><span class="cx">     case IsUndefinedOrNull:
</span><span class="cx">     case IsBoolean:
</span><span class="cx">     case IsNumber:
</span><span class="lines">@@ -1457,7 +1458,6 @@
</span><span class="cx">     case IsBigInt:
</span><span class="cx">     case NumberIsInteger:
</span><span class="cx">     case IsObject:
</span><del>-    case IsObjectOrNull:
</del><span class="cx">     case IsFunction:
</span><span class="cx">     case IsConstructor:
</span><span class="cx">     case IsCellWithType:
</span><span class="lines">@@ -1475,6 +1475,21 @@
</span><span class="cx">                     ? child.value().asCell()->structure(m_vm)->masqueradesAsUndefined(m_codeBlock->globalObjectFor(node->origin.semantic))
</span><span class="cx">                     : child.value().isUndefined()));
</span><span class="cx">                 break;
</span><ins>+            case TypeOfIsObject:
+                if (child.value().isObject()) {
+                    JSObject* object = asObject(child.value());
+                    if (object->type() == JSFunctionType)
+                        setConstant(node, jsBoolean(false));
+                    else if (!(object->inlineTypeFlags() & OverridesGetCallData))
+                        setConstant(node, jsBoolean(!child.value().asCell()->structure(m_vm)->masqueradesAsUndefined(m_codeBlock->globalObjectFor(node->origin.semantic))));
+                    else {
+                        // FIXME: This could just call getCallData.
+                        // https://bugs.webkit.org/show_bug.cgi?id=144457
+                        constantWasSet = false;
+                    }
+                } else
+                    setConstant(node, jsBoolean(child.value().isNull()));
+                break;
</ins><span class="cx">             case IsUndefinedOrNull:
</span><span class="cx">                 setConstant(node, jsBoolean(child.value().isUndefinedOrNull()));
</span><span class="cx">                 break;
</span><span class="lines">@@ -1493,21 +1508,6 @@
</span><span class="cx">             case IsObject:
</span><span class="cx">                 setConstant(node, jsBoolean(child.value().isObject()));
</span><span class="cx">                 break;
</span><del>-            case IsObjectOrNull:
-                if (child.value().isObject()) {
-                    JSObject* object = asObject(child.value());
-                    if (object->type() == JSFunctionType)
-                        setConstant(node, jsBoolean(false));
-                    else if (!(object->inlineTypeFlags() & OverridesGetCallData))
-                        setConstant(node, jsBoolean(!child.value().asCell()->structure(m_vm)->masqueradesAsUndefined(m_codeBlock->globalObjectFor(node->origin.semantic))));
-                    else {
-                        // FIXME: This could just call getCallData.
-                        // https://bugs.webkit.org/show_bug.cgi?id=144457
-                        constantWasSet = false;
-                    }
-                } else
-                    setConstant(node, jsBoolean(child.value().isNull()));
-                break;
</del><span class="cx">             case IsFunction:
</span><span class="cx">                 if (child.value().isObject()) {
</span><span class="cx">                     JSObject* object = asObject(child.value());
</span><span class="lines">@@ -1603,6 +1603,38 @@
</span><span class="cx">             }
</span><span class="cx">             
</span><span class="cx">             break;
</span><ins>+        case TypeOfIsObject:
+            // FIXME: Use the masquerades-as-undefined watchpoint thingy.
+            // https://bugs.webkit.org/show_bug.cgi?id=144456
+            
+            // These expressions are complicated to parse. A helpful way to parse this is that
+            // "!(T & ~S)" means "T is a subset of S". Conversely, "!(T & S)" means "T is a
+            // disjoint set from S". Things like "T - S" means that, provided that S is a
+            // subset of T, it's the "set of all things in T but not in S". Things like "T | S"
+            // mean the "union of T and S".
+            
+            // Is the child's type an object that isn't an other-object (i.e. object that could
+            // have masquaredes-as-undefined traps) and isn't a function? Then: we should fold
+            // this to true.
+            if (!(child.m_type & ~(SpecObject - SpecObjectOther - SpecFunction))) {
+                setConstant(node, jsBoolean(true));
+                constantWasSet = true;
+                break;
+            }
+            
+            // Is the child's type definitely not either of: an object that isn't a function,
+            // or either undefined or null? Then: we should fold this to false. This means
+            // for example that if it's any non-function object, including those that have
+            // masquerades-as-undefined traps, then we don't fold. It also means we won't fold
+            // if it's undefined-or-null, since the type bits don't distinguish between
+            // undefined (which should fold to false) and null (which should fold to true).
+            if (!(child.m_type & ((SpecObject - SpecFunction) | SpecOther))) {
+                setConstant(node, jsBoolean(false));
+                constantWasSet = true;
+                break;
+            }
+            
+            break;
</ins><span class="cx">         case IsUndefinedOrNull:
</span><span class="cx">             if (!(child.m_type & ~SpecOther)) {
</span><span class="cx">                 setConstant(node, jsBoolean(true));
</span><span class="lines">@@ -1689,38 +1721,6 @@
</span><span class="cx">             }
</span><span class="cx">             
</span><span class="cx">             break;
</span><del>-        case IsObjectOrNull:
-            // FIXME: Use the masquerades-as-undefined watchpoint thingy.
-            // https://bugs.webkit.org/show_bug.cgi?id=144456
-            
-            // These expressions are complicated to parse. A helpful way to parse this is that
-            // "!(T & ~S)" means "T is a subset of S". Conversely, "!(T & S)" means "T is a
-            // disjoint set from S". Things like "T - S" means that, provided that S is a
-            // subset of T, it's the "set of all things in T but not in S". Things like "T | S"
-            // mean the "union of T and S".
-            
-            // Is the child's type an object that isn't an other-object (i.e. object that could
-            // have masquaredes-as-undefined traps) and isn't a function?  Then: we should fold
-            // this to true.
-            if (!(child.m_type & ~(SpecObject - SpecObjectOther - SpecFunction))) {
-                setConstant(node, jsBoolean(true));
-                constantWasSet = true;
-                break;
-            }
-            
-            // Is the child's type definitely not either of: an object that isn't a function,
-            // or either undefined or null?  Then: we should fold this to false.  This means
-            // for example that if it's any non-function object, including those that have
-            // masquerades-as-undefined traps, then we don't fold. It also means we won't fold
-            // if it's undefined-or-null, since the type bits don't distinguish between
-            // undefined (which should fold to false) and null (which should fold to true).
-            if (!(child.m_type & ((SpecObject - SpecFunction) | SpecOther))) {
-                setConstant(node, jsBoolean(false));
-                constantWasSet = true;
-                break;
-            }
-            
-            break;
</del><span class="cx">         case IsFunction:
</span><span class="cx">             if (!(child.m_type & ~SpecFunction)) {
</span><span class="cx">                 setConstant(node, jsBoolean(true));
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGByteCodeParsercpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp (265743 => 265744)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp    2020-08-16 20:16:29 UTC (rev 265743)
+++ trunk/Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp       2020-08-16 20:40:17 UTC (rev 265744)
</span><span class="lines">@@ -5742,6 +5742,12 @@
</span><span class="cx">             set(bytecode.m_dst, addToGraph(TypeOfIsUndefined, value));
</span><span class="cx">             NEXT_OPCODE(op_is_undefined);
</span><span class="cx">         }
</span><ins>+        case op_typeof_is_object: {
+            auto bytecode = currentInstruction->as<OpTypeofIsObject>();
+            Node* value = get(bytecode.m_operand);
+            set(bytecode.m_dst, addToGraph(TypeOfIsObject, value));
+            NEXT_OPCODE(op_typeof_is_object);
+        }
</ins><span class="cx">         case op_is_undefined_or_null: {
</span><span class="cx">             auto bytecode = currentInstruction->as<OpIsUndefinedOrNull>();
</span><span class="cx">             Node* value = get(bytecode.m_operand);
</span><span class="lines">@@ -5788,13 +5794,6 @@
</span><span class="cx">             NEXT_OPCODE(op_is_object);
</span><span class="cx">         }
</span><span class="cx"> 
</span><del>-        case op_is_object_or_null: {
-            auto bytecode = currentInstruction->as<OpIsObjectOrNull>();
-            Node* value = get(bytecode.m_operand);
-            set(bytecode.m_dst, addToGraph(IsObjectOrNull, value));
-            NEXT_OPCODE(op_is_object_or_null);
-        }
-
</del><span class="cx">         case op_is_function: {
</span><span class="cx">             auto bytecode = currentInstruction->as<OpIsFunction>();
</span><span class="cx">             Node* value = get(bytecode.m_operand);
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGCapabilitiescpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGCapabilities.cpp (265743 => 265744)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGCapabilities.cpp      2020-08-16 20:16:29 UTC (rev 265743)
+++ trunk/Source/JavaScriptCore/dfg/DFGCapabilities.cpp 2020-08-16 20:40:17 UTC (rev 265744)
</span><span class="lines">@@ -144,12 +144,12 @@
</span><span class="cx">     case op_instanceof_custom:
</span><span class="cx">     case op_is_empty:
</span><span class="cx">     case op_typeof_is_undefined:
</span><ins>+    case op_typeof_is_object:
</ins><span class="cx">     case op_is_undefined_or_null:
</span><span class="cx">     case op_is_boolean:
</span><span class="cx">     case op_is_number:
</span><span class="cx">     case op_is_big_int:
</span><span class="cx">     case op_is_object:
</span><del>-    case op_is_object_or_null:
</del><span class="cx">     case op_is_cell_with_type:
</span><span class="cx">     case op_is_function:
</span><span class="cx">     case op_is_constructor:
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGClobberizeh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGClobberize.h (265743 => 265744)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGClobberize.h  2020-08-16 20:16:29 UTC (rev 265743)
+++ trunk/Source/JavaScriptCore/dfg/DFGClobberize.h     2020-08-16 20:40:17 UTC (rev 265744)
</span><span class="lines">@@ -592,9 +592,9 @@
</span><span class="cx">         write(HeapObjectCount);
</span><span class="cx">         return;
</span><span class="cx"> 
</span><del>-    case IsObjectOrNull:
</del><ins>+    case TypeOfIsObject:
</ins><span class="cx">         read(MiscFields);
</span><del>-        def(HeapLocation(IsObjectOrNullLoc, MiscFields, node->child1()), LazyNode(node));
</del><ins>+        def(HeapLocation(TypeOfIsObjectLoc, MiscFields, node->child1()), LazyNode(node));
</ins><span class="cx">         return;
</span><span class="cx">         
</span><span class="cx">     case IsFunction:
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGDoesGCcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGDoesGC.cpp (265743 => 265744)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGDoesGC.cpp    2020-08-16 20:16:29 UTC (rev 265743)
+++ trunk/Source/JavaScriptCore/dfg/DFGDoesGC.cpp       2020-08-16 20:40:17 UTC (rev 265744)
</span><span class="lines">@@ -144,6 +144,7 @@
</span><span class="cx">     case OverridesHasInstance:
</span><span class="cx">     case IsEmpty:
</span><span class="cx">     case TypeOfIsUndefined:
</span><ins>+    case TypeOfIsObject:
</ins><span class="cx">     case IsUndefinedOrNull:
</span><span class="cx">     case IsBoolean:
</span><span class="cx">     case IsNumber:
</span><span class="lines">@@ -150,7 +151,6 @@
</span><span class="cx">     case IsBigInt:
</span><span class="cx">     case NumberIsInteger:
</span><span class="cx">     case IsObject:
</span><del>-    case IsObjectOrNull:
</del><span class="cx">     case IsFunction:
</span><span class="cx">     case IsConstructor:
</span><span class="cx">     case IsCellWithType:
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGFixupPhasecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGFixupPhase.cpp (265743 => 265744)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGFixupPhase.cpp        2020-08-16 20:16:29 UTC (rev 265743)
+++ trunk/Source/JavaScriptCore/dfg/DFGFixupPhase.cpp   2020-08-16 20:40:17 UTC (rev 265744)
</span><span class="lines">@@ -2714,11 +2714,11 @@
</span><span class="cx">         case IsTypedArrayView:
</span><span class="cx">         case IsEmpty:
</span><span class="cx">         case TypeOfIsUndefined:
</span><ins>+        case TypeOfIsObject:
</ins><span class="cx">         case IsUndefinedOrNull:
</span><span class="cx">         case IsBoolean:
</span><span class="cx">         case IsNumber:
</span><span class="cx">         case IsBigInt:
</span><del>-        case IsObjectOrNull:
</del><span class="cx">         case IsFunction:
</span><span class="cx">         case IsConstructor:
</span><span class="cx">         case CreateDirectArguments:
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGHeapLocationcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGHeapLocation.cpp (265743 => 265744)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGHeapLocation.cpp      2020-08-16 20:16:29 UTC (rev 265743)
+++ trunk/Source/JavaScriptCore/dfg/DFGHeapLocation.cpp 2020-08-16 20:40:17 UTC (rev 265744)
</span><span class="lines">@@ -62,8 +62,8 @@
</span><span class="cx">         out.print("InvalidationPointLoc");
</span><span class="cx">         return;
</span><span class="cx">         
</span><del>-    case IsObjectOrNullLoc:
-        out.print("IsObjectOrNullLoc");
</del><ins>+    case TypeOfIsObjectLoc:
+        out.print("TypeOfIsObjectLoc");
</ins><span class="cx">         return;
</span><span class="cx"> 
</span><span class="cx">     case IsFunctionLoc:
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGHeapLocationh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGHeapLocation.h (265743 => 265744)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGHeapLocation.h        2020-08-16 20:16:29 UTC (rev 265743)
+++ trunk/Source/JavaScriptCore/dfg/DFGHeapLocation.h   2020-08-16 20:40:17 UTC (rev 265744)
</span><span class="lines">@@ -56,7 +56,7 @@
</span><span class="cx">     InvalidationPointLoc,
</span><span class="cx">     IsFunctionLoc,
</span><span class="cx">     IsConstructorLoc,
</span><del>-    IsObjectOrNullLoc,
</del><ins>+    TypeOfIsObjectLoc,
</ins><span class="cx">     NamedPropertyLoc,
</span><span class="cx">     RegExpObjectLastIndexLoc,
</span><span class="cx">     SetterLoc,
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGNodeTypeh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGNodeType.h (265743 => 265744)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGNodeType.h    2020-08-16 20:16:29 UTC (rev 265743)
+++ trunk/Source/JavaScriptCore/dfg/DFGNodeType.h       2020-08-16 20:40:17 UTC (rev 265744)
</span><span class="lines">@@ -393,6 +393,7 @@
</span><span class="cx">     macro(IsCellWithType, NodeResultBoolean) \
</span><span class="cx">     macro(IsEmpty, NodeResultBoolean) \
</span><span class="cx">     macro(TypeOfIsUndefined, NodeResultBoolean) \
</span><ins>+    macro(TypeOfIsObject, NodeResultBoolean) \
</ins><span class="cx">     macro(IsUndefinedOrNull, NodeResultBoolean) \
</span><span class="cx">     macro(IsBoolean, NodeResultBoolean) \
</span><span class="cx">     macro(IsNumber, NodeResultBoolean) \
</span><span class="lines">@@ -400,7 +401,6 @@
</span><span class="cx">     macro(IsBigInt, NodeResultBoolean) \
</span><span class="cx">     macro(NumberIsInteger, NodeResultBoolean) \
</span><span class="cx">     macro(IsObject, NodeResultBoolean) \
</span><del>-    macro(IsObjectOrNull, NodeResultBoolean) \
</del><span class="cx">     macro(IsFunction, NodeResultBoolean) \
</span><span class="cx">     macro(IsConstructor, NodeResultBoolean) \
</span><span class="cx">     macro(IsTypedArrayView, NodeResultBoolean) \
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGOperationscpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGOperations.cpp (265743 => 265744)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGOperations.cpp        2020-08-16 20:16:29 UTC (rev 265743)
+++ trunk/Source/JavaScriptCore/dfg/DFGOperations.cpp   2020-08-16 20:40:17 UTC (rev 265744)
</span><span class="lines">@@ -2103,7 +2103,7 @@
</span><span class="cx">     return constructArray(globalObject, structure, argumentsToCopyRegion, arraySize);
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-size_t JIT_OPERATION operationObjectIsObject(JSGlobalObject* globalObject, JSCell* object)
</del><ins>+size_t JIT_OPERATION operationTypeOfIsObject(JSGlobalObject* globalObject, JSCell* object)
</ins><span class="cx"> {
</span><span class="cx">     VM& vm = globalObject->vm();
</span><span class="cx">     CallFrame* callFrame = DECLARE_CALL_FRAME(vm);
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGOperationsh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGOperations.h (265743 => 265744)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGOperations.h  2020-08-16 20:16:29 UTC (rev 265743)
+++ trunk/Source/JavaScriptCore/dfg/DFGOperations.h     2020-08-16 20:40:17 UTC (rev 265744)
</span><span class="lines">@@ -213,7 +213,7 @@
</span><span class="cx"> void JIT_OPERATION operationWeakSetAdd(VM*, JSCell*, JSCell*, int32_t) WTF_INTERNAL;
</span><span class="cx"> void JIT_OPERATION operationWeakMapSet(VM*, JSCell*, JSCell*, EncodedJSValue, int32_t) WTF_INTERNAL;
</span><span class="cx"> double JIT_OPERATION operationFModOnInts(int32_t, int32_t) WTF_INTERNAL;
</span><del>-size_t JIT_OPERATION operationObjectIsObject(JSGlobalObject*, JSCell*) WTF_INTERNAL;
</del><ins>+size_t JIT_OPERATION operationTypeOfIsObject(JSGlobalObject*, JSCell*) WTF_INTERNAL;
</ins><span class="cx"> size_t JIT_OPERATION operationObjectIsFunction(JSGlobalObject*, JSCell*) WTF_INTERNAL;
</span><span class="cx"> size_t JIT_OPERATION operationIsConstructor(JSGlobalObject*, EncodedJSValue) WTF_INTERNAL;
</span><span class="cx"> JSCell* JIT_OPERATION operationTypeOfObject(JSGlobalObject*, JSCell*) WTF_INTERNAL;
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGPredictionPropagationPhasecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGPredictionPropagationPhase.cpp (265743 => 265744)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGPredictionPropagationPhase.cpp        2020-08-16 20:16:29 UTC (rev 265743)
+++ trunk/Source/JavaScriptCore/dfg/DFGPredictionPropagationPhase.cpp   2020-08-16 20:40:17 UTC (rev 265744)
</span><span class="lines">@@ -1035,6 +1035,7 @@
</span><span class="cx">         case InstanceOfCustom:
</span><span class="cx">         case IsEmpty:
</span><span class="cx">         case TypeOfIsUndefined:
</span><ins>+        case TypeOfIsObject:
</ins><span class="cx">         case IsUndefinedOrNull:
</span><span class="cx">         case IsBoolean:
</span><span class="cx">         case IsNumber:
</span><span class="lines">@@ -1041,7 +1042,6 @@
</span><span class="cx">         case IsBigInt:
</span><span class="cx">         case NumberIsInteger:
</span><span class="cx">         case IsObject:
</span><del>-        case IsObjectOrNull:
</del><span class="cx">         case IsFunction:
</span><span class="cx">         case IsConstructor:
</span><span class="cx">         case IsCellWithType:
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGSafeToExecuteh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGSafeToExecute.h (265743 => 265744)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGSafeToExecute.h       2020-08-16 20:16:29 UTC (rev 265743)
+++ trunk/Source/JavaScriptCore/dfg/DFGSafeToExecute.h  2020-08-16 20:40:17 UTC (rev 265744)
</span><span class="lines">@@ -257,6 +257,7 @@
</span><span class="cx">     case OverridesHasInstance:
</span><span class="cx">     case IsEmpty:
</span><span class="cx">     case TypeOfIsUndefined:
</span><ins>+    case TypeOfIsObject:
</ins><span class="cx">     case IsUndefinedOrNull:
</span><span class="cx">     case IsBoolean:
</span><span class="cx">     case IsNumber:
</span><span class="lines">@@ -263,7 +264,6 @@
</span><span class="cx">     case IsBigInt:
</span><span class="cx">     case NumberIsInteger:
</span><span class="cx">     case IsObject:
</span><del>-    case IsObjectOrNull:
</del><span class="cx">     case IsFunction:
</span><span class="cx">     case IsConstructor:
</span><span class="cx">     case IsCellWithType:
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGSpeculativeJITcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp (265743 => 265744)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp    2020-08-16 20:16:29 UTC (rev 265743)
+++ trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp       2020-08-16 20:40:17 UTC (rev 265744)
</span><span class="lines">@@ -9506,7 +9506,7 @@
</span><span class="cx">     unblessedBooleanResult(resultGPR, node);
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-void SpeculativeJIT::compileIsObjectOrNull(Node* node)
</del><ins>+void SpeculativeJIT::compileTypeOfIsObject(Node* node)
</ins><span class="cx"> {
</span><span class="cx">     JSGlobalObject* globalObject = m_jit.graph().globalObjectFor(node->origin.semantic);
</span><span class="cx">     
</span><span class="lines">@@ -9541,7 +9541,7 @@
</span><span class="cx">     
</span><span class="cx">     addSlowPathGenerator(
</span><span class="cx">         slowPathCall(
</span><del>-            slowPath, this, operationObjectIsObject, resultGPR, globalObject,
</del><ins>+            slowPath, this, operationTypeOfIsObject, resultGPR, globalObject,
</ins><span class="cx">             valueRegs.payloadGPR()));
</span><span class="cx">     
</span><span class="cx">     done.link(&m_jit);
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGSpeculativeJITh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h (265743 => 265744)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h      2020-08-16 20:16:29 UTC (rev 265743)
+++ trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h 2020-08-16 20:40:17 UTC (rev 265744)
</span><span class="lines">@@ -1405,7 +1405,7 @@
</span><span class="cx">     void compileRegExpTest(Node*);
</span><span class="cx">     void compileStringReplace(Node*);
</span><span class="cx">     void compileIsObject(Node*);
</span><del>-    void compileIsObjectOrNull(Node*);
</del><ins>+    void compileTypeOfIsObject(Node*);
</ins><span class="cx">     void compileIsFunction(Node*);
</span><span class="cx">     void compileIsConstructor(Node*);
</span><span class="cx">     void compileTypeOf(Node*);
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGSpeculativeJIT32_64cpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp (265743 => 265744)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp       2020-08-16 20:16:29 UTC (rev 265743)
+++ trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp  2020-08-16 20:40:17 UTC (rev 265744)
</span><span class="lines">@@ -3664,6 +3664,11 @@
</span><span class="cx">         break;
</span><span class="cx">     }
</span><span class="cx"> 
</span><ins>+    case TypeOfIsObject: {
+        compileTypeOfIsObject(node);
+        break;
+    }
+
</ins><span class="cx">     case IsUndefinedOrNull: {
</span><span class="cx">         JSValueOperand value(this, node->child1());
</span><span class="cx">         GPRTemporary result(this, Reuse, value, TagWord);
</span><span class="lines">@@ -3716,11 +3721,6 @@
</span><span class="cx">         break;
</span><span class="cx">     }
</span><span class="cx"> 
</span><del>-    case IsObjectOrNull: {
-        compileIsObjectOrNull(node);
-        break;
-    }
-
</del><span class="cx">     case IsFunction: {
</span><span class="cx">         compileIsFunction(node);
</span><span class="cx">         break;
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGSpeculativeJIT64cpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp (265743 => 265744)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp  2020-08-16 20:16:29 UTC (rev 265743)
+++ trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp     2020-08-16 20:40:17 UTC (rev 265744)
</span><span class="lines">@@ -4283,6 +4283,11 @@
</span><span class="cx">         break;
</span><span class="cx">     }
</span><span class="cx"> 
</span><ins>+    case TypeOfIsObject: {
+        compileTypeOfIsObject(node);
+        break;
+    }
+
</ins><span class="cx">     case IsUndefinedOrNull: {
</span><span class="cx">         JSValueOperand value(this, node->child1());
</span><span class="cx">         GPRTemporary result(this, Reuse, value);
</span><span class="lines">@@ -4691,11 +4696,6 @@
</span><span class="cx">         break;
</span><span class="cx">     }
</span><span class="cx"> 
</span><del>-    case IsObjectOrNull: {
-        compileIsObjectOrNull(node);
-        break;
-    }
-
</del><span class="cx">     case IsFunction: {
</span><span class="cx">         compileIsFunction(node);
</span><span class="cx">         break;
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreftlFTLCapabilitiescpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/ftl/FTLCapabilities.cpp (265743 => 265744)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/ftl/FTLCapabilities.cpp      2020-08-16 20:16:29 UTC (rev 265743)
+++ trunk/Source/JavaScriptCore/ftl/FTLCapabilities.cpp 2020-08-16 20:40:17 UTC (rev 265744)
</span><span class="lines">@@ -258,6 +258,7 @@
</span><span class="cx">     case WeakMapSet:
</span><span class="cx">     case IsEmpty:
</span><span class="cx">     case TypeOfIsUndefined:
</span><ins>+    case TypeOfIsObject:
</ins><span class="cx">     case IsUndefinedOrNull:
</span><span class="cx">     case IsBoolean:
</span><span class="cx">     case IsNumber:
</span><span class="lines">@@ -264,7 +265,6 @@
</span><span class="cx">     case IsBigInt:
</span><span class="cx">     case NumberIsInteger:
</span><span class="cx">     case IsObject:
</span><del>-    case IsObjectOrNull:
</del><span class="cx">     case IsFunction:
</span><span class="cx">     case IsConstructor:
</span><span class="cx">     case IsTypedArrayView:
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreftlFTLLowerDFGToB3cpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp (265743 => 265744)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp      2020-08-16 20:16:29 UTC (rev 265743)
+++ trunk/Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp 2020-08-16 20:40:17 UTC (rev 265744)
</span><span class="lines">@@ -1367,6 +1367,9 @@
</span><span class="cx">         case TypeOfIsUndefined:
</span><span class="cx">             compileTypeOfIsUndefined();
</span><span class="cx">             break;
</span><ins>+        case TypeOfIsObject:
+            compileTypeOfIsObject();
+            break;
</ins><span class="cx">         case IsUndefinedOrNull:
</span><span class="cx">             compileIsUndefinedOrNull();
</span><span class="cx">             break;
</span><span class="lines">@@ -1427,9 +1430,6 @@
</span><span class="cx">         case IsObject:
</span><span class="cx">             compileIsObject();
</span><span class="cx">             break;
</span><del>-        case IsObjectOrNull:
-            compileIsObjectOrNull();
-            break;
</del><span class="cx">         case IsFunction:
</span><span class="cx">             compileIsFunction();
</span><span class="cx">             break;
</span><span class="lines">@@ -11671,7 +11671,7 @@
</span><span class="cx">         vmCall(Void, operationWeakMapSet, m_vmValue, map, key, value, hash);
</span><span class="cx">     }
</span><span class="cx"> 
</span><del>-    void compileIsObjectOrNull()
</del><ins>+    void compileTypeOfIsObject()
</ins><span class="cx">     {
</span><span class="cx">         JSGlobalObject* globalObject = m_graph.globalObjectFor(m_node->origin.semantic);
</span><span class="cx">         
</span><span class="lines">@@ -11710,7 +11710,7 @@
</span><span class="cx">         LValue slowResultValue = lazySlowPath(
</span><span class="cx">             [=, &vm] (const Vector<Location>& locations) -> RefPtr<LazySlowPath::Generator> {
</span><span class="cx">                 return createLazyCallGenerator(vm,
</span><del>-                    operationObjectIsObject, locations[0].directGPR(),
</del><ins>+                    operationTypeOfIsObject, locations[0].directGPR(),
</ins><span class="cx">                     CCallHelpers::TrustedImmPtr(globalObject), locations[1].directGPR());
</span><span class="cx">             }, value);
</span><span class="cx">         ValueFromBlock slowResult = m_out.anchor(m_out.notZero64(slowResultValue));
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorejitJITcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/jit/JIT.cpp (265743 => 265744)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/jit/JIT.cpp  2020-08-16 20:16:29 UTC (rev 265743)
+++ trunk/Source/JavaScriptCore/jit/JIT.cpp     2020-08-16 20:40:17 UTC (rev 265744)
</span><span class="lines">@@ -286,8 +286,8 @@
</span><span class="cx">         DEFINE_SLOW_OP(greatereq)
</span><span class="cx">         DEFINE_SLOW_OP(is_function)
</span><span class="cx">         DEFINE_SLOW_OP(is_constructor)
</span><del>-        DEFINE_SLOW_OP(is_object_or_null)
</del><span class="cx">         DEFINE_SLOW_OP(typeof)
</span><ins>+        DEFINE_SLOW_OP(typeof_is_object)
</ins><span class="cx">         DEFINE_SLOW_OP(strcat)
</span><span class="cx">         DEFINE_SLOW_OP(push_with_scope)
</span><span class="cx">         DEFINE_SLOW_OP(create_lexical_environment)
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorellintLowLevelInterpreterasm"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/llint/LowLevelInterpreter.asm (265743 => 265744)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/llint/LowLevelInterpreter.asm        2020-08-16 20:16:29 UTC (rev 265743)
+++ trunk/Source/JavaScriptCore/llint/LowLevelInterpreter.asm   2020-08-16 20:40:17 UTC (rev 265744)
</span><span class="lines">@@ -1783,7 +1783,6 @@
</span><span class="cx"> slowPathOp(in_by_val)
</span><span class="cx"> slowPathOp(is_function)
</span><span class="cx"> slowPathOp(is_constructor)
</span><del>-slowPathOp(is_object_or_null)
</del><span class="cx"> slowPathOp(less)
</span><span class="cx"> slowPathOp(lesseq)
</span><span class="cx"> slowPathOp(mod)
</span><span class="lines">@@ -1799,6 +1798,7 @@
</span><span class="cx"> slowPathOp(throw_static_error)
</span><span class="cx"> slowPathOp(to_index_string)
</span><span class="cx"> slowPathOp(typeof)
</span><ins>+slowPathOp(typeof_is_object)
</ins><span class="cx"> slowPathOp(unreachable)
</span><span class="cx"> slowPathOp(new_promise)
</span><span class="cx"> slowPathOp(new_generator)
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeCommonSlowPathscpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/CommonSlowPaths.cpp (265743 => 265744)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/CommonSlowPaths.cpp  2020-08-16 20:16:29 UTC (rev 265743)
+++ trunk/Source/JavaScriptCore/runtime/CommonSlowPaths.cpp     2020-08-16 20:40:17 UTC (rev 265744)
</span><span class="lines">@@ -804,11 +804,11 @@
</span><span class="cx">     RETURN(jsTypeStringForValue(globalObject, GET_C(bytecode.m_value).jsValue()));
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-SLOW_PATH_DECL(slow_path_is_object_or_null)
</del><ins>+SLOW_PATH_DECL(slow_path_typeof_is_object)
</ins><span class="cx"> {
</span><span class="cx">     BEGIN();
</span><del>-    auto bytecode = pc->as<OpIsObjectOrNull>();
-    RETURN(jsBoolean(jsIsObjectTypeOrNull(globalObject, GET_C(bytecode.m_operand).jsValue())));
</del><ins>+    auto bytecode = pc->as<OpTypeofIsObject>();
+    RETURN(jsBoolean(jsTypeofIsObject(globalObject, GET_C(bytecode.m_operand).jsValue())));
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> SLOW_PATH_DECL(slow_path_is_function)
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeCommonSlowPathsh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/CommonSlowPaths.h (265743 => 265744)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/CommonSlowPaths.h    2020-08-16 20:16:29 UTC (rev 265743)
+++ trunk/Source/JavaScriptCore/runtime/CommonSlowPaths.h       2020-08-16 20:40:17 UTC (rev 265744)
</span><span class="lines">@@ -251,8 +251,8 @@
</span><span class="cx"> SLOW_PATH_HIDDEN_DECL(slow_path_bitor);
</span><span class="cx"> SLOW_PATH_HIDDEN_DECL(slow_path_bitxor);
</span><span class="cx"> SLOW_PATH_HIDDEN_DECL(slow_path_typeof);
</span><ins>+SLOW_PATH_HIDDEN_DECL(slow_path_typeof_is_object);
</ins><span class="cx"> SLOW_PATH_HIDDEN_DECL(slow_path_is_object);
</span><del>-SLOW_PATH_HIDDEN_DECL(slow_path_is_object_or_null);
</del><span class="cx"> SLOW_PATH_HIDDEN_DECL(slow_path_is_function);
</span><span class="cx"> SLOW_PATH_HIDDEN_DECL(slow_path_is_constructor);
</span><span class="cx"> SLOW_PATH_HIDDEN_DECL(slow_path_in_by_id);
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeOperationscpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/Operations.cpp (265743 => 265744)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/Operations.cpp       2020-08-16 20:16:29 UTC (rev 265743)
+++ trunk/Source/JavaScriptCore/runtime/Operations.cpp  2020-08-16 20:40:17 UTC (rev 265744)
</span><span class="lines">@@ -106,7 +106,7 @@
</span><span class="cx">     return jsTypeStringForValue(globalObject->vm(), globalObject, v);
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-bool jsIsObjectTypeOrNull(JSGlobalObject* globalObject, JSValue v)
</del><ins>+bool jsTypeofIsObject(JSGlobalObject* globalObject, JSValue v)
</ins><span class="cx"> {
</span><span class="cx">     VM& vm = globalObject->vm();
</span><span class="cx">     if (!v.isCell())
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeOperationsh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/Operations.h (265743 => 265744)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/Operations.h 2020-08-16 20:16:29 UTC (rev 265743)
+++ trunk/Source/JavaScriptCore/runtime/Operations.h    2020-08-16 20:40:17 UTC (rev 265744)
</span><span class="lines">@@ -33,7 +33,7 @@
</span><span class="cx"> NEVER_INLINE JSValue jsAddSlowCase(JSGlobalObject*, JSValue, JSValue);
</span><span class="cx"> JSValue jsTypeStringForValue(JSGlobalObject*, JSValue);
</span><span class="cx"> JSValue jsTypeStringForValue(VM&, JSGlobalObject*, JSValue);
</span><del>-bool jsIsObjectTypeOrNull(JSGlobalObject*, JSValue);
</del><ins>+bool jsTypeofIsObject(JSGlobalObject*, JSValue);
</ins><span class="cx"> size_t normalizePrototypeChain(JSGlobalObject*, JSCell*, bool& sawPolyProto);
</span><span class="cx"> 
</span><span class="cx"> ALWAYS_INLINE JSString* jsString(JSGlobalObject* globalObject, const String& u1, JSString* s2)
</span></span></pre>
</div>
</div>

</body>
</html>