<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN"
"http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head><meta http-equiv="content-type" content="text/html; charset=utf-8" />
<title>[286347] trunk/Source</title>
</head>
<body>

<style type="text/css"><!--
#msg dl.meta { border: 1px #006 solid; background: #369; padding: 6px; color: #fff; }
#msg dl.meta dt { float: left; width: 6em; font-weight: bold; }
#msg dt:after { content:':';}
#msg dl, #msg dt, #msg ul, #msg li, #header, #footer, #logmsg { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt;  }
#msg dl a { font-weight: bold}
#msg dl a:link    { color:#fc3; }
#msg dl a:active  { color:#ff0; }
#msg dl a:visited { color:#cc6; }
h3 { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; font-weight: bold; }
#msg pre { overflow: auto; background: #ffc; border: 1px #fa0 solid; padding: 6px; }
#logmsg { background: #ffc; border: 1px #fa0 solid; padding: 1em 1em 0 1em; }
#logmsg p, #logmsg pre, #logmsg blockquote { margin: 0 0 1em 0; }
#logmsg p, #logmsg li, #logmsg dt, #logmsg dd { line-height: 14pt; }
#logmsg h1, #logmsg h2, #logmsg h3, #logmsg h4, #logmsg h5, #logmsg h6 { margin: .5em 0; }
#logmsg h1:first-child, #logmsg h2:first-child, #logmsg h3:first-child, #logmsg h4:first-child, #logmsg h5:first-child, #logmsg h6:first-child { margin-top: 0; }
#logmsg ul, #logmsg ol { padding: 0; list-style-position: inside; margin: 0 0 0 1em; }
#logmsg ul { text-indent: -1em; padding-left: 1em; }#logmsg ol { text-indent: -1.5em; padding-left: 1.5em; }
#logmsg > ul, #logmsg > ol { margin: 0 0 1em 0; }
#logmsg pre { background: #eee; padding: 1em; }
#logmsg blockquote { border: 1px solid #fa0; border-left-width: 10px; padding: 1em 1em 0 1em; background: white;}
#logmsg dl { margin: 0; }
#logmsg dt { font-weight: bold; }
#logmsg dd { margin: 0; padding: 0 0 0.5em 0; }
#logmsg dd:before { content:'\00bb';}
#logmsg table { border-spacing: 0px; border-collapse: collapse; border-top: 4px solid #fa0; border-bottom: 1px solid #fa0; background: #fff; }
#logmsg table th { text-align: left; font-weight: normal; padding: 0.2em 0.5em; border-top: 1px dotted #fa0; }
#logmsg table td { text-align: right; border-top: 1px dotted #fa0; padding: 0.2em 0.5em; }
#logmsg table thead th { text-align: center; border-bottom: 1px solid #fa0; }
#logmsg table th.Corner { text-align: left; }
#logmsg hr { border: none 0; border-top: 2px dashed #fa0; height: 1px; }
#header, #footer { color: #fff; background: #636; border: 1px #300 solid; padding: 6px; }
#patch { width: 100%; }
#patch h4 {font-family: verdana,arial,helvetica,sans-serif;font-size:10pt;padding:8px;background:#369;color:#fff;margin:0;}
#patch .propset h4, #patch .binary h4 {margin:0;}
#patch pre {padding:0;line-height:1.2em;margin:0;}
#patch .diff {width:100%;background:#eee;padding: 0 0 10px 0;overflow:auto;}
#patch .propset .diff, #patch .binary .diff  {padding:10px 0;}
#patch span {display:block;padding:0 10px;}
#patch .modfile, #patch .addfile, #patch .delfile, #patch .propset, #patch .binary, #patch .copfile {border:1px solid #ccc;margin:10px 0;}
#patch ins {background:#dfd;text-decoration:none;display:block;padding:0 10px;}
#patch del {background:#fdd;text-decoration:none;display:block;padding:0 10px;}
#patch .lines, .info {color:#888;background:#fff;}
--></style>
<div id="msg">
<dl class="meta">
<dt>Revision</dt> <dd><a href="http://trac.webkit.org/projects/webkit/changeset/286347">286347</a></dd>
<dt>Author</dt> <dd>mark.lam@apple.com</dd>
<dt>Date</dt> <dd>2021-11-30 20:38:56 -0800 (Tue, 30 Nov 2021)</dd>
</dl>

<h3>Log Message</h3>
<pre>Move Subspaces from VM to Heap.
https://bugs.webkit.org/show_bug.cgi?id=233648
rdar://85875751

Reviewed by Saam Barati.

Source/JavaScriptCore:

Subspaces are Heap data structures to begin with, and this refactoring is needed
in preparation for the global GC.

1. Embed HeapCellType and IsoHeapCellType instances in Heap directly instead of
   malloc'ing them separately and referencing them via unique_ptrs.  These
   instances are always instantiated unconditionally anyway.  This change
   eliminates the unneeded busy work to allocate them separately.

2. Introduce a HeapSubspaceTypes.h that #include all the types that we have
   subspaces for.  This makes it so that Heap.cpp's #include list is not flooded
   with these types with subspaces, and that it'll be easier to discern between
   these Subspace types from other data structures needed for implementing Heap.

3. Add VM accessor methods for subspaces that forward to Heap.  This will make it
   easier for us to redirect to a thread local allocator later for the global GC.

4. Remove unneeded #includes in VM.h.

5. Remove unused CodeBlockSet::iterateViaSubspaces().

* CMakeLists.txt:
* JavaScriptCore.xcodeproj/project.pbxproj:
* bytecode/AccessCase.cpp:
(JSC::AccessCase::generateImpl):
* bytecode/DFGExitProfile.h:
* bytecode/EvalCodeBlock.h:
* bytecode/ExecutableToCodeBlockEdge.cpp:
(JSC::ExecutableToCodeBlockEdge::visitChildrenImpl):
(JSC::ExecutableToCodeBlockEdge::finalizeUnconditionally):
(JSC::ExecutableToCodeBlockEdge::runConstraint):
* bytecode/ExecutableToCodeBlockEdge.h:
* bytecode/FunctionCodeBlock.h:
* bytecode/ModuleProgramCodeBlock.h:
* bytecode/ProgramCodeBlock.h:
* bytecode/Repatch.h:
* bytecode/UnlinkedFunctionExecutable.cpp:
(JSC::UnlinkedFunctionExecutable::unlinkedCodeBlockFor):
(JSC::UnlinkedFunctionExecutable::finalizeUnconditionally):
* bytecode/UnlinkedFunctionExecutable.h:
* dfg/DFGSpeculativeJIT.cpp:
(JSC::DFG::SpeculativeJIT::emitAllocateRawObject):
* ftl/FTLLowerDFGToB3.cpp:
(JSC::FTL::DFG::LowerDFGToB3::emitNewTypedArrayWithSize):
(JSC::FTL::DFG::LowerDFGToB3::compileCompareStrictEq):
* generator/DSL.rb:
* heap/CodeBlockSet.h:
* heap/CodeBlockSetInlines.h:
(JSC::CodeBlockSet::iterateViaSubspaces): Deleted.
* heap/Heap.cpp:
(JSC::Heap::Heap):
(JSC::Heap::finalizeUnconditionalFinalizers):
(JSC::Heap::deleteAllCodeBlocks):
(JSC::Heap::deleteAllUnlinkedCodeBlocks):
(JSC::Heap::deleteUnmarkedCompiledCode):
(JSC::Heap::sweepInFinalize):
(JSC::Heap::addCoreConstraints):
* heap/Heap.h:
(JSC::Heap::gigacageAuxiliarySpace):
(JSC::Heap::SpaceAndSet::SpaceAndSet):
(JSC::Heap::SpaceAndSet::setFor):
(JSC::Heap::forEachCodeBlockSpace):
(JSC::Heap::forEachScriptExecutableSpace):
* heap/HeapSubspaceTypes.h: Added.
* heap/IsoHeapCellType.h:
* heap/IsoInlinedHeapCellType.h:
* heap/IsoInlinedHeapCellTypeInlines.h: Added.
(JSC::IsoInlinedHeapCellType<CellType>::IsoInlinedHeapCellType):
(JSC::IsoInlinedHeapCellType<CellType>::DestroyFunc::operator const):
(JSC::IsoInlinedHeapCellType<CellType>::finishSweep const):
(JSC::IsoInlinedHeapCellType<CellType>::destroy const):
* heap/MarkedBlockInlines.h:
* inspector/JSInjectedScriptHostPrototype.h:
* inspector/JSJavaScriptCallFramePrototype.h:
* interpreter/CallFrame.h:
* jsc.cpp:
(JSCMemoryFootprint::subspaceFor):
(JSFileDescriptor::subspaceFor):
* runtime/AggregateErrorPrototype.h:
* runtime/ArrayIteratorPrototype.h:
* runtime/AsyncFromSyncIteratorPrototype.h:
* runtime/AsyncFunctionPrototype.h:
* runtime/AsyncGeneratorFunctionPrototype.h:
* runtime/AsyncGeneratorPrototype.h:
* runtime/AsyncIteratorPrototype.h:
* runtime/AtomicsObject.h:
* runtime/BigIntPrototype.h:
* runtime/BrandedStructure.h:
* runtime/ButterflyInlines.h:
(JSC::Butterfly::tryCreateUninitialized):
(JSC::Butterfly::createUninitialized):
(JSC::Butterfly::tryCreate):
(JSC::Butterfly::growArrayRight):
(JSC::Butterfly::reallocArrayRightIfPossible):
* runtime/CachedTypes.h:
* runtime/ClonedArguments.h:
* runtime/ConsoleObject.h:
* runtime/CustomGetterSetter.h:
(JSC::CustomGetterSetter::subspaceFor):
* runtime/DOMAttributeGetterSetter.h:
* runtime/DateInstance.h:
* runtime/DatePrototype.h:
* runtime/DirectArguments.h:
* runtime/ErrorPrototype.h:
* runtime/Exception.h:
* runtime/FinalizationRegistryPrototype.h:
* runtime/FunctionExecutable.h:
* runtime/GeneratorFunctionPrototype.h:
* runtime/GeneratorPrototype.h:
* runtime/GetterSetter.h:
* runtime/HashMapImpl.h:
(JSC::HashMapBuffer::create):
* runtime/InternalFunction.h:
(JSC::InternalFunction::subspaceFor):
* runtime/IntlCollatorPrototype.h:
* runtime/IntlDateTimeFormatPrototype.h:
* runtime/IntlDisplayNamesPrototype.h:
* runtime/IntlListFormatPrototype.h:
* runtime/IntlLocalePrototype.h:
* runtime/IntlNumberFormatPrototype.h:
* runtime/IntlObject.h:
* runtime/IntlPluralRulesPrototype.h:
* runtime/IntlRelativeTimeFormatPrototype.h:
* runtime/IntlSegmentIteratorPrototype.h:
* runtime/IntlSegmenterPrototype.h:
* runtime/IntlSegmentsPrototype.h:
* runtime/IteratorPrototype.h:
* runtime/JSArray.cpp:
(JSC::JSArray::tryCreateUninitializedRestricted):
* runtime/JSArray.h:
(JSC::JSArray::subspaceFor):
(JSC::JSArray::tryCreate):
* runtime/JSArrayBufferPrototype.h:
* runtime/JSArrayBufferView.cpp:
(JSC::JSArrayBufferView::ConstructionContext::ConstructionContext):
* runtime/JSBigInt.cpp:
(JSC::JSBigInt::createWithLength):
* runtime/JSBigInt.h:
* runtime/JSCallee.h:
(JSC::JSCallee::subspaceFor):
* runtime/JSDataViewPrototype.h:
* runtime/JSFunction.h:
(JSC::JSFunction::subspaceFor):
* runtime/JSGenericTypedArrayViewPrototype.h:
* runtime/JSGlobalLexicalEnvironment.h:
* runtime/JSImmutableButterfly.h:
(JSC::JSImmutableButterfly::subspaceFor):
* runtime/JSLexicalEnvironment.h:
(JSC::JSLexicalEnvironment::subspaceFor):
* runtime/JSModuleLoader.h:
* runtime/JSONObject.h:
* runtime/JSObjectInlines.h:
(JSC::JSFinalObject::subspaceFor):
* runtime/JSPromise.h:
(JSC::JSPromise::subspaceFor):
* runtime/JSPromisePrototype.h:
(JSC::JSPromisePrototype::subspaceFor):
* runtime/JSPropertyNameEnumerator.cpp:
(JSC::JSPropertyNameEnumerator::create):
* runtime/JSPropertyNameEnumerator.h:
* runtime/JSProxy.h:
(JSC::JSProxy::subspaceFor):
* runtime/JSString.h:
(JSC::JSString::subspaceFor):
* runtime/JSTypedArrayViewPrototype.h:
* runtime/MapIteratorPrototype.h:
* runtime/MapPrototype.h:
* runtime/MathObject.h:
* runtime/NativeErrorPrototype.h:
* runtime/NativeExecutable.h:
* runtime/NumberObject.h:
(JSC::NumberObject::subspaceFor):
* runtime/ObjectPrototype.h:
* runtime/ProgramExecutable.h:
* runtime/PropertyTable.h:
* runtime/ReflectObject.h:
* runtime/RegExp.h:
* runtime/RegExpObject.h:
* runtime/RegExpPrototype.h:
* runtime/RegExpStringIteratorPrototype.h:
* runtime/ScopedArguments.cpp:
(JSC::ScopedArguments::createUninitialized):
* runtime/ScopedArguments.h:
* runtime/SetIteratorPrototype.h:
* runtime/SetPrototype.h:
* runtime/ShadowRealmPrototype.h:
* runtime/SparseArrayValueMap.h:
* runtime/StringIteratorPrototype.h:
* runtime/StringObject.h:
(JSC::StringObject::subspaceFor):
* runtime/Structure.h:
(JSC::Structure::subspaceFor):
* runtime/StructureChain.cpp:
(JSC::StructureChain::create):
* runtime/StructureChain.h:
* runtime/StructureRareData.h:
* runtime/SymbolPrototype.h:
* runtime/SymbolTable.h:
* runtime/TemporalCalendarPrototype.h:
* runtime/TemporalDurationPrototype.h:
* runtime/TemporalInstantPrototype.h:
* runtime/TemporalNow.h:
* runtime/TemporalObject.h:
* runtime/TemporalPlainTimePrototype.h:
* runtime/TemporalTimeZonePrototype.h:
* runtime/ThrowScope.cpp:
* runtime/VM.cpp:
(JSC::VM::VM):
* runtime/VM.h:
(JSC::VM::cellHeapCellType):
(JSC::VM::destructibleObjectHeapCellType):
(JSC::VM::primitiveGigacageAuxiliarySpace):
(JSC::VM::jsValueGigacageAuxiliarySpace):
(JSC::VM::immutableButterflyJSValueGigacageAuxiliarySpace):
(JSC::VM::gigacageAuxiliarySpace):
(JSC::VM::cellSpace):
(JSC::VM::variableSizedCellSpace):
(JSC::VM::destructibleObjectSpace):
(JSC::VM::arraySpace):
(JSC::VM::bigIntSpace):
(JSC::VM::calleeSpace):
(JSC::VM::clonedArgumentsSpace):
(JSC::VM::customGetterSetterSpace):
(JSC::VM::dateInstanceSpace):
(JSC::VM::domAttributeGetterSetterSpace):
(JSC::VM::exceptionSpace):
(JSC::VM::executableToCodeBlockEdgeSpace):
(JSC::VM::functionSpace):
(JSC::VM::getterSetterSpace):
(JSC::VM::globalLexicalEnvironmentSpace):
(JSC::VM::internalFunctionSpace):
(JSC::VM::jsProxySpace):
(JSC::VM::nativeExecutableSpace):
(JSC::VM::numberObjectSpace):
(JSC::VM::plainObjectSpace):
(JSC::VM::promiseSpace):
(JSC::VM::propertyNameEnumeratorSpace):
(JSC::VM::propertyTableSpace):
(JSC::VM::regExpSpace):
(JSC::VM::regExpObjectSpace):
(JSC::VM::ropeStringSpace):
(JSC::VM::scopedArgumentsSpace):
(JSC::VM::sparseArrayValueMapSpace):
(JSC::VM::stringSpace):
(JSC::VM::stringObjectSpace):
(JSC::VM::structureChainSpace):
(JSC::VM::structureRareDataSpace):
(JSC::VM::structureSpace):
(JSC::VM::brandedStructureSpace):
(JSC::VM::symbolTableSpace):
(JSC::VM::executableToCodeBlockEdgesWithConstraints):
(JSC::VM::executableToCodeBlockEdgesWithFinalizers):
(JSC::VM::codeBlockSpace):
(JSC::VM::functionExecutableSpace):
(JSC::VM::programExecutableSpace):
(JSC::VM::unlinkedFunctionExecutableSpace):
(JSC::VM::setFuzzerAgent): Deleted.
(JSC::VM::SpaceAndSet::SpaceAndSet): Deleted.
(JSC::VM::SpaceAndSet::setFor): Deleted.
(JSC::VM::forEachCodeBlockSpace): Deleted.
(JSC::VM::forEachScriptExecutableSpace): Deleted.
* runtime/VMInlines.h:
(JSC::VM::setFuzzerAgent):
* runtime/WeakMapPrototype.h:
* runtime/WeakObjectRefPrototype.h:
* runtime/WeakSetPrototype.h:
* tools/JSDollarVM.cpp:
* tools/JSDollarVM.h:
* wasm/js/JSWebAssembly.h:
* wasm/js/WebAssemblyCompileErrorPrototype.h:
* wasm/js/WebAssemblyExceptionPrototype.h:
* wasm/js/WebAssemblyGlobalPrototype.h:
* wasm/js/WebAssemblyInstancePrototype.h:
* wasm/js/WebAssemblyLinkErrorPrototype.h:
* wasm/js/WebAssemblyMemoryPrototype.h:
* wasm/js/WebAssemblyModulePrototype.h:
* wasm/js/WebAssemblyRuntimeErrorPrototype.h:
* wasm/js/WebAssemblyTablePrototype.h:
* wasm/js/WebAssemblyTagPrototype.h:

Source/WebCore:

1. Embed IsoHeapCellType instances in JSVMClientData directly instead of
   malloc'ing them separately and referencing them via unique_ptrs.  These
   instances are always instantiated unconditionally anyway.  This change
   eliminates the unneeded busy work to allocate them separately.

2. Add missing initialization of JSVMClientData::m_heapCellTypeForJSSharedWorkerGlobalScope.
   This hasn't been an issue so far because we don't currently allow shared workers.

3. Rebase bindings test results.

* bindings/js/JSDOMAsyncIterator.h:
* bindings/js/JSDOMIterator.h:
* bindings/js/JSFileSystemDirectoryHandleIterator.cpp:
(WebCore::JSFileSystemDirectoryHandleIterator::subspaceForImpl):
* bindings/js/WebCoreJSClientData.cpp:
(WebCore::JSVMClientData::JSVMClientData):
* bindings/js/WebCoreJSClientData.h:
* bindings/scripts/CodeGeneratorJS.pm:
(GenerateImplementation):
(GenerateIterableDefinition):
(GeneratePrototypeDeclaration):
* bindings/scripts/test/JS/JSDOMWindow.cpp:
(WebCore::JSDOMWindow::subspaceForImpl):
* bindings/scripts/test/JS/JSDOMWindow.h:
* bindings/scripts/test/JS/JSDedicatedWorkerGlobalScope.cpp:
(WebCore::JSDedicatedWorkerGlobalScope::subspaceForImpl):
* bindings/scripts/test/JS/JSDedicatedWorkerGlobalScope.h:
* bindings/scripts/test/JS/JSExposedStar.cpp:
(WebCore::JSExposedStarDOMConstructor::prototypeForStructure):
(WebCore::JSExposedStar::subspaceForImpl):
* bindings/scripts/test/JS/JSExposedToWorkerAndWindow.cpp:
(WebCore::JSExposedToWorkerAndWindow::subspaceForImpl):
* bindings/scripts/test/JS/JSPaintWorkletGlobalScope.cpp:
(WebCore::JSPaintWorkletGlobalScope::subspaceForImpl):
* bindings/scripts/test/JS/JSPaintWorkletGlobalScope.h:
* bindings/scripts/test/JS/JSServiceWorkerGlobalScope.cpp:
(WebCore::JSServiceWorkerGlobalScope::subspaceForImpl):
* bindings/scripts/test/JS/JSServiceWorkerGlobalScope.h:
* bindings/scripts/test/JS/JSSharedWorkerGlobalScope.cpp:
(WebCore::JSSharedWorkerGlobalScope::subspaceForImpl):
* bindings/scripts/test/JS/JSSharedWorkerGlobalScope.h:
* bindings/scripts/test/JS/JSTestCEReactions.cpp:
(WebCore::JSTestCEReactionsDOMConstructor::prototypeForStructure):
(WebCore::JSTestCEReactions::subspaceForImpl):
* bindings/scripts/test/JS/JSTestCEReactionsStringifier.cpp:
(WebCore::JSTestCEReactionsStringifierDOMConstructor::prototypeForStructure):
(WebCore::JSTestCEReactionsStringifier::subspaceForImpl):
* bindings/scripts/test/JS/JSTestCallTracer.cpp:
(WebCore::JSTestCallTracerDOMConstructor::prototypeForStructure):
(WebCore::JSTestCallTracer::subspaceForImpl):
* bindings/scripts/test/JS/JSTestClassWithJSBuiltinConstructor.cpp:
(WebCore::JSTestClassWithJSBuiltinConstructorDOMConstructor::prototypeForStructure):
(WebCore::JSTestClassWithJSBuiltinConstructor::subspaceForImpl):
* bindings/scripts/test/JS/JSTestConditionalIncludes.cpp:
(WebCore::JSTestConditionalIncludesDOMConstructor::prototypeForStructure):
(WebCore::JSTestConditionalIncludes::subspaceForImpl):
* bindings/scripts/test/JS/JSTestConditionallyReadWrite.cpp:
(WebCore::JSTestConditionallyReadWriteDOMConstructor::prototypeForStructure):
(WebCore::JSTestConditionallyReadWrite::subspaceForImpl):
* bindings/scripts/test/JS/JSTestDOMJIT.cpp:
(WebCore::JSTestDOMJITDOMConstructor::prototypeForStructure):
(WebCore::JSTestDOMJIT::subspaceForImpl):
* bindings/scripts/test/JS/JSTestDefaultToJSON.cpp:
(WebCore::JSTestDefaultToJSONDOMConstructor::prototypeForStructure):
(WebCore::JSTestDefaultToJSON::subspaceForImpl):
* bindings/scripts/test/JS/JSTestDefaultToJSONFilteredByExposed.cpp:
(WebCore::JSTestDefaultToJSONFilteredByExposedDOMConstructor::prototypeForStructure):
(WebCore::JSTestDefaultToJSONFilteredByExposed::subspaceForImpl):
* bindings/scripts/test/JS/JSTestDefaultToJSONIndirectInheritance.cpp:
(WebCore::JSTestDefaultToJSONIndirectInheritanceDOMConstructor::prototypeForStructure):
(WebCore::JSTestDefaultToJSONIndirectInheritance::subspaceForImpl):
* bindings/scripts/test/JS/JSTestDefaultToJSONInherit.cpp:
(WebCore::JSTestDefaultToJSONInheritDOMConstructor::prototypeForStructure):
(WebCore::JSTestDefaultToJSONInherit::subspaceForImpl):
* bindings/scripts/test/JS/JSTestDefaultToJSONInheritFinal.cpp:
(WebCore::JSTestDefaultToJSONInheritFinalDOMConstructor::prototypeForStructure):
(WebCore::JSTestDefaultToJSONInheritFinal::subspaceForImpl):
* bindings/scripts/test/JS/JSTestDelegateToSharedSyntheticAttribute.cpp:
(WebCore::JSTestDelegateToSharedSyntheticAttributeDOMConstructor::prototypeForStructure):
(WebCore::JSTestDelegateToSharedSyntheticAttribute::subspaceForImpl):
* bindings/scripts/test/JS/JSTestDomainSecurity.cpp:
(WebCore::JSTestDomainSecurityDOMConstructor::prototypeForStructure):
(WebCore::JSTestDomainSecurity::subspaceForImpl):
* bindings/scripts/test/JS/JSTestEnabledBySetting.cpp:
(WebCore::JSTestEnabledBySettingDOMConstructor::prototypeForStructure):
(WebCore::JSTestEnabledBySetting::subspaceForImpl):
* bindings/scripts/test/JS/JSTestEnabledForContext.cpp:
(WebCore::JSTestEnabledForContextDOMConstructor::prototypeForStructure):
(WebCore::JSTestEnabledForContext::subspaceForImpl):
* bindings/scripts/test/JS/JSTestEventConstructor.cpp:
(WebCore::JSTestEventConstructor::subspaceForImpl):
* bindings/scripts/test/JS/JSTestEventTarget.cpp:
(WebCore::JSTestEventTargetDOMConstructor::prototypeForStructure):
(WebCore::JSTestEventTarget::subspaceForImpl):
* bindings/scripts/test/JS/JSTestException.cpp:
(WebCore::JSTestExceptionDOMConstructor::prototypeForStructure):
(WebCore::JSTestException::subspaceForImpl):
* bindings/scripts/test/JS/JSTestGenerateAddOpaqueRoot.cpp:
(WebCore::JSTestGenerateAddOpaqueRootDOMConstructor::prototypeForStructure):
(WebCore::JSTestGenerateAddOpaqueRoot::subspaceForImpl):
* bindings/scripts/test/JS/JSTestGenerateIsReachable.cpp:
(WebCore::JSTestGenerateIsReachableDOMConstructor::prototypeForStructure):
(WebCore::JSTestGenerateIsReachable::subspaceForImpl):
* bindings/scripts/test/JS/JSTestGlobalObject.cpp:
(WebCore::JSTestGlobalObject::subspaceForImpl):
* bindings/scripts/test/JS/JSTestGlobalObject.h:
* bindings/scripts/test/JS/JSTestIndexedSetterNoIdentifier.cpp:
(WebCore::JSTestIndexedSetterNoIdentifierDOMConstructor::prototypeForStructure):
(WebCore::JSTestIndexedSetterNoIdentifier::subspaceForImpl):
* bindings/scripts/test/JS/JSTestIndexedSetterThrowingException.cpp:
(WebCore::JSTestIndexedSetterThrowingExceptionDOMConstructor::prototypeForStructure):
(WebCore::JSTestIndexedSetterThrowingException::subspaceForImpl):
* bindings/scripts/test/JS/JSTestIndexedSetterWithIdentifier.cpp:
(WebCore::JSTestIndexedSetterWithIdentifierDOMConstructor::prototypeForStructure):
(WebCore::JSTestIndexedSetterWithIdentifier::subspaceForImpl):
* bindings/scripts/test/JS/JSTestInterface.cpp:
(WebCore::JSTestInterfaceDOMConstructor::construct):
(WebCore::jsTestInterfacePrototypeFunction_entriesCaller):
(WebCore::JSTestInterface::subspaceForImpl):
* bindings/scripts/test/JS/JSTestInterfaceLeadingUnderscore.cpp:
(WebCore::JSTestInterfaceLeadingUnderscoreDOMConstructor::prototypeForStructure):
(WebCore::JSTestInterfaceLeadingUnderscore::subspaceForImpl):
* bindings/scripts/test/JS/JSTestIterable.cpp:
(WebCore::JSTestIterableDOMConstructor::prototypeForStructure):
(WebCore::jsTestIterablePrototypeFunction_entriesCaller):
(WebCore::JSTestIterable::subspaceForImpl):
* bindings/scripts/test/JS/JSTestJSBuiltinConstructor.cpp:
(WebCore::JSTestJSBuiltinConstructorDOMConstructor::prototypeForStructure):
(WebCore::JSTestJSBuiltinConstructor::subspaceForImpl):
* bindings/scripts/test/JS/JSTestLegacyFactoryFunction.cpp:
(WebCore::JSTestLegacyFactoryFunctionDOMConstructor::prototypeForStructure):
(WebCore::JSTestLegacyFactoryFunction::subspaceForImpl):
* bindings/scripts/test/JS/JSTestLegacyNoInterfaceObject.cpp:
(WebCore::JSTestLegacyNoInterfaceObjectPrototype::finishCreation):
(WebCore::JSTestLegacyNoInterfaceObject::subspaceForImpl):
* bindings/scripts/test/JS/JSTestLegacyOverrideBuiltIns.cpp:
(WebCore::JSTestLegacyOverrideBuiltInsDOMConstructor::prototypeForStructure):
(WebCore::JSTestLegacyOverrideBuiltIns::subspaceForImpl):
* bindings/scripts/test/JS/JSTestMapLike.cpp:
(WebCore::JSTestMapLikeDOMConstructor::prototypeForStructure):
(WebCore::JSTestMapLike::subspaceForImpl):
* bindings/scripts/test/JS/JSTestMapLikeWithOverriddenOperations.cpp:
(WebCore::JSTestMapLikeWithOverriddenOperationsDOMConstructor::prototypeForStructure):
(WebCore::JSTestMapLikeWithOverriddenOperations::subspaceForImpl):
* bindings/scripts/test/JS/JSTestNamedAndIndexedSetterNoIdentifier.cpp:
(WebCore::JSTestNamedAndIndexedSetterNoIdentifierDOMConstructor::prototypeForStructure):
(WebCore::JSTestNamedAndIndexedSetterNoIdentifier::subspaceForImpl):
* bindings/scripts/test/JS/JSTestNamedAndIndexedSetterThrowingException.cpp:
(WebCore::JSTestNamedAndIndexedSetterThrowingExceptionDOMConstructor::prototypeForStructure):
(WebCore::JSTestNamedAndIndexedSetterThrowingException::subspaceForImpl):
* bindings/scripts/test/JS/JSTestNamedAndIndexedSetterWithIdentifier.cpp:
(WebCore::JSTestNamedAndIndexedSetterWithIdentifierDOMConstructor::prototypeForStructure):
(WebCore::JSTestNamedAndIndexedSetterWithIdentifier::subspaceForImpl):
* bindings/scripts/test/JS/JSTestNamedDeleterNoIdentifier.cpp:
(WebCore::JSTestNamedDeleterNoIdentifierDOMConstructor::prototypeForStructure):
(WebCore::JSTestNamedDeleterNoIdentifier::subspaceForImpl):
* bindings/scripts/test/JS/JSTestNamedDeleterThrowingException.cpp:
(WebCore::JSTestNamedDeleterThrowingExceptionDOMConstructor::prototypeForStructure):
(WebCore::JSTestNamedDeleterThrowingException::subspaceForImpl):
* bindings/scripts/test/JS/JSTestNamedDeleterWithIdentifier.cpp:
(WebCore::JSTestNamedDeleterWithIdentifierDOMConstructor::prototypeForStructure):
(WebCore::JSTestNamedDeleterWithIdentifier::subspaceForImpl):
* bindings/scripts/test/JS/JSTestNamedDeleterWithIndexedGetter.cpp:
(WebCore::JSTestNamedDeleterWithIndexedGetterDOMConstructor::prototypeForStructure):
(WebCore::JSTestNamedDeleterWithIndexedGetter::subspaceForImpl):
* bindings/scripts/test/JS/JSTestNamedGetterCallWith.cpp:
(WebCore::JSTestNamedGetterCallWithDOMConstructor::prototypeForStructure):
(WebCore::JSTestNamedGetterCallWith::subspaceForImpl):
* bindings/scripts/test/JS/JSTestNamedGetterNoIdentifier.cpp:
(WebCore::JSTestNamedGetterNoIdentifierDOMConstructor::prototypeForStructure):
(WebCore::JSTestNamedGetterNoIdentifier::subspaceForImpl):
* bindings/scripts/test/JS/JSTestNamedGetterWithIdentifier.cpp:
(WebCore::JSTestNamedGetterWithIdentifierDOMConstructor::prototypeForStructure):
(WebCore::JSTestNamedGetterWithIdentifier::subspaceForImpl):
* bindings/scripts/test/JS/JSTestNamedSetterNoIdentifier.cpp:
(WebCore::JSTestNamedSetterNoIdentifierDOMConstructor::prototypeForStructure):
(WebCore::JSTestNamedSetterNoIdentifier::subspaceForImpl):
* bindings/scripts/test/JS/JSTestNamedSetterThrowingException.cpp:
(WebCore::JSTestNamedSetterThrowingExceptionDOMConstructor::prototypeForStructure):
(WebCore::JSTestNamedSetterThrowingException::subspaceForImpl):
* bindings/scripts/test/JS/JSTestNamedSetterWithIdentifier.cpp:
(WebCore::JSTestNamedSetterWithIdentifierDOMConstructor::prototypeForStructure):
(WebCore::JSTestNamedSetterWithIdentifier::subspaceForImpl):
* bindings/scripts/test/JS/JSTestNamedSetterWithIndexedGetter.cpp:
(WebCore::JSTestNamedSetterWithIndexedGetterDOMConstructor::prototypeForStructure):
(WebCore::JSTestNamedSetterWithIndexedGetter::subspaceForImpl):
* bindings/scripts/test/JS/JSTestNamedSetterWithIndexedGetterAndSetter.cpp:
(WebCore::JSTestNamedSetterWithIndexedGetterAndSetterDOMConstructor::prototypeForStructure):
(WebCore::JSTestNamedSetterWithIndexedGetterAndSetter::subspaceForImpl):
* bindings/scripts/test/JS/JSTestNamedSetterWithLegacyOverrideBuiltIns.cpp:
(WebCore::JSTestNamedSetterWithLegacyOverrideBuiltInsDOMConstructor::prototypeForStructure):
(WebCore::JSTestNamedSetterWithLegacyOverrideBuiltIns::subspaceForImpl):
* bindings/scripts/test/JS/JSTestNamedSetterWithLegacyUnforgeableProperties.cpp:
(WebCore::JSTestNamedSetterWithLegacyUnforgeablePropertiesDOMConstructor::prototypeForStructure):
(WebCore::JSTestNamedSetterWithLegacyUnforgeableProperties::subspaceForImpl):
* bindings/scripts/test/JS/JSTestNamedSetterWithLegacyUnforgeablePropertiesAndLegacyOverrideBuiltIns.cpp:
(WebCore::JSTestNamedSetterWithLegacyUnforgeablePropertiesAndLegacyOverrideBuiltInsDOMConstructor::prototypeForStructure):
(WebCore::JSTestNamedSetterWithLegacyUnforgeablePropertiesAndLegacyOverrideBuiltIns::subspaceForImpl):
* bindings/scripts/test/JS/JSTestNamespaceObject.cpp:
(WebCore::JSTestNamespaceObject::subspaceForImpl):
* bindings/scripts/test/JS/JSTestNode.cpp:
(WebCore::jsTestNodePrototypeFunction_entriesCaller):
(WebCore::JSTestNode::subspaceForImpl):
* bindings/scripts/test/JS/JSTestObj.cpp:
(WebCore::JSTestObjDOMConstructor::construct):
(WebCore::JSTestObj::subspaceForImpl):
* bindings/scripts/test/JS/JSTestOperationConditional.cpp:
(WebCore::JSTestOperationConditionalDOMConstructor::prototypeForStructure):
(WebCore::JSTestOperationConditional::subspaceForImpl):
* bindings/scripts/test/JS/JSTestOverloadedConstructors.cpp:
(WebCore::JSTestOverloadedConstructors::subspaceForImpl):
* bindings/scripts/test/JS/JSTestOverloadedConstructorsWithSequence.cpp:
(WebCore::JSTestOverloadedConstructorsWithSequence::subspaceForImpl):
* bindings/scripts/test/JS/JSTestPluginInterface.cpp:
(WebCore::JSTestPluginInterfaceDOMConstructor::prototypeForStructure):
(WebCore::JSTestPluginInterface::subspaceForImpl):
* bindings/scripts/test/JS/JSTestPromiseRejectionEvent.cpp:
(WebCore::JSTestPromiseRejectionEvent::subspaceForImpl):
* bindings/scripts/test/JS/JSTestReadOnlyMapLike.cpp:
(WebCore::JSTestReadOnlyMapLikeDOMConstructor::prototypeForStructure):
(WebCore::JSTestReadOnlyMapLike::subspaceForImpl):
* bindings/scripts/test/JS/JSTestReadOnlySetLike.cpp:
(WebCore::JSTestReadOnlySetLikeDOMConstructor::prototypeForStructure):
(WebCore::JSTestReadOnlySetLike::subspaceForImpl):
* bindings/scripts/test/JS/JSTestReportExtraMemoryCost.cpp:
(WebCore::JSTestReportExtraMemoryCostDOMConstructor::prototypeForStructure):
(WebCore::JSTestReportExtraMemoryCost::subspaceForImpl):
* bindings/scripts/test/JS/JSTestSerializedScriptValueInterface.cpp:
(WebCore::JSTestSerializedScriptValueInterfaceDOMConstructor::prototypeForStructure):
(WebCore::JSTestSerializedScriptValueInterface::subspaceForImpl):
* bindings/scripts/test/JS/JSTestSetLike.cpp:
(WebCore::JSTestSetLikeDOMConstructor::prototypeForStructure):
(WebCore::JSTestSetLike::subspaceForImpl):
* bindings/scripts/test/JS/JSTestSetLikeWithOverriddenOperations.cpp:
(WebCore::JSTestSetLikeWithOverriddenOperationsDOMConstructor::prototypeForStructure):
(WebCore::JSTestSetLikeWithOverriddenOperations::subspaceForImpl):
* bindings/scripts/test/JS/JSTestStringifier.cpp:
(WebCore::JSTestStringifierDOMConstructor::prototypeForStructure):
(WebCore::JSTestStringifier::subspaceForImpl):
* bindings/scripts/test/JS/JSTestStringifierAnonymousOperation.cpp:
(WebCore::JSTestStringifierAnonymousOperationDOMConstructor::prototypeForStructure):
(WebCore::JSTestStringifierAnonymousOperation::subspaceForImpl):
* bindings/scripts/test/JS/JSTestStringifierNamedOperation.cpp:
(WebCore::JSTestStringifierNamedOperationDOMConstructor::prototypeForStructure):
(WebCore::JSTestStringifierNamedOperation::subspaceForImpl):
* bindings/scripts/test/JS/JSTestStringifierOperationImplementedAs.cpp:
(WebCore::JSTestStringifierOperationImplementedAsDOMConstructor::prototypeForStructure):
(WebCore::JSTestStringifierOperationImplementedAs::subspaceForImpl):
* bindings/scripts/test/JS/JSTestStringifierOperationNamedToString.cpp:
(WebCore::JSTestStringifierOperationNamedToStringDOMConstructor::prototypeForStructure):
(WebCore::JSTestStringifierOperationNamedToString::subspaceForImpl):
* bindings/scripts/test/JS/JSTestStringifierReadOnlyAttribute.cpp:
(WebCore::JSTestStringifierReadOnlyAttributeDOMConstructor::prototypeForStructure):
(WebCore::JSTestStringifierReadOnlyAttribute::subspaceForImpl):
* bindings/scripts/test/JS/JSTestStringifierReadWriteAttribute.cpp:
(WebCore::JSTestStringifierReadWriteAttributeDOMConstructor::prototypeForStructure):
(WebCore::JSTestStringifierReadWriteAttribute::subspaceForImpl):
* bindings/scripts/test/JS/JSTestTypedefs.cpp:
(WebCore::JSTestTypedefsDOMConstructor::construct):
(WebCore::JSTestTypedefs::subspaceForImpl):
* bindings/scripts/test/JS/JSWorkerGlobalScope.cpp:
(WebCore::JSWorkerGlobalScope::subspaceForImpl):
* bindings/scripts/test/JS/JSWorkerGlobalScope.h:
* bindings/scripts/test/JS/JSWorkletGlobalScope.cpp:
(WebCore::JSWorkletGlobalScope::subspaceForImpl):
* bindings/scripts/test/JS/JSWorkletGlobalScope.h:
* bridge/objc/objc_runtime.mm:
(JSC::Bindings::ObjcFallbackObjectImp::subspaceForImpl):
* workers/WorkerOrWorkletScriptController.h:</pre>

<h3>Modified Paths</h3>
<ul>
<li><a href="#trunkSourceJavaScriptCoreCMakeListstxt">trunk/Source/JavaScriptCore/CMakeLists.txt</a></li>
<li><a href="#trunkSourceJavaScriptCoreChangeLog">trunk/Source/JavaScriptCore/ChangeLog</a></li>
<li><a href="#trunkSourceJavaScriptCoreJavaScriptCorexcodeprojprojectpbxproj">trunk/Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj</a></li>
<li><a href="#trunkSourceJavaScriptCorebytecodeAccessCasecpp">trunk/Source/JavaScriptCore/bytecode/AccessCase.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCorebytecodeDFGExitProfileh">trunk/Source/JavaScriptCore/bytecode/DFGExitProfile.h</a></li>
<li><a href="#trunkSourceJavaScriptCorebytecodeEvalCodeBlockh">trunk/Source/JavaScriptCore/bytecode/EvalCodeBlock.h</a></li>
<li><a href="#trunkSourceJavaScriptCorebytecodeExecutableToCodeBlockEdgecpp">trunk/Source/JavaScriptCore/bytecode/ExecutableToCodeBlockEdge.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCorebytecodeExecutableToCodeBlockEdgeh">trunk/Source/JavaScriptCore/bytecode/ExecutableToCodeBlockEdge.h</a></li>
<li><a href="#trunkSourceJavaScriptCorebytecodeFunctionCodeBlockh">trunk/Source/JavaScriptCore/bytecode/FunctionCodeBlock.h</a></li>
<li><a href="#trunkSourceJavaScriptCorebytecodeModuleProgramCodeBlockh">trunk/Source/JavaScriptCore/bytecode/ModuleProgramCodeBlock.h</a></li>
<li><a href="#trunkSourceJavaScriptCorebytecodeProgramCodeBlockh">trunk/Source/JavaScriptCore/bytecode/ProgramCodeBlock.h</a></li>
<li><a href="#trunkSourceJavaScriptCorebytecodeRepatchh">trunk/Source/JavaScriptCore/bytecode/Repatch.h</a></li>
<li><a href="#trunkSourceJavaScriptCorebytecodeUnlinkedFunctionExecutablecpp">trunk/Source/JavaScriptCore/bytecode/UnlinkedFunctionExecutable.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCorebytecodeUnlinkedFunctionExecutableh">trunk/Source/JavaScriptCore/bytecode/UnlinkedFunctionExecutable.h</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGSpeculativeJITcpp">trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreftlFTLLowerDFGToB3cpp">trunk/Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoregeneratorDSLrb">trunk/Source/JavaScriptCore/generator/DSL.rb</a></li>
<li><a href="#trunkSourceJavaScriptCoreheapCodeBlockSeth">trunk/Source/JavaScriptCore/heap/CodeBlockSet.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreheapCodeBlockSetInlinesh">trunk/Source/JavaScriptCore/heap/CodeBlockSetInlines.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreheapHeapcpp">trunk/Source/JavaScriptCore/heap/Heap.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreheapHeaph">trunk/Source/JavaScriptCore/heap/Heap.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreheapIsoHeapCellTypeh">trunk/Source/JavaScriptCore/heap/IsoHeapCellType.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreheapIsoInlinedHeapCellTypeh">trunk/Source/JavaScriptCore/heap/IsoInlinedHeapCellType.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreheapMarkedBlockInlinesh">trunk/Source/JavaScriptCore/heap/MarkedBlockInlines.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreinspectorJSInjectedScriptHostPrototypeh">trunk/Source/JavaScriptCore/inspector/JSInjectedScriptHostPrototype.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreinspectorJSJavaScriptCallFramePrototypeh">trunk/Source/JavaScriptCore/inspector/JSJavaScriptCallFramePrototype.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreinterpreterCallFrameh">trunk/Source/JavaScriptCore/interpreter/CallFrame.h</a></li>
<li><a href="#trunkSourceJavaScriptCorejsccpp">trunk/Source/JavaScriptCore/jsc.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeAggregateErrorPrototypeh">trunk/Source/JavaScriptCore/runtime/AggregateErrorPrototype.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeArrayIteratorPrototypeh">trunk/Source/JavaScriptCore/runtime/ArrayIteratorPrototype.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeAsyncFromSyncIteratorPrototypeh">trunk/Source/JavaScriptCore/runtime/AsyncFromSyncIteratorPrototype.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeAsyncFunctionPrototypeh">trunk/Source/JavaScriptCore/runtime/AsyncFunctionPrototype.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeAsyncGeneratorFunctionPrototypeh">trunk/Source/JavaScriptCore/runtime/AsyncGeneratorFunctionPrototype.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeAsyncGeneratorPrototypeh">trunk/Source/JavaScriptCore/runtime/AsyncGeneratorPrototype.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeAsyncIteratorPrototypeh">trunk/Source/JavaScriptCore/runtime/AsyncIteratorPrototype.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeAtomicsObjecth">trunk/Source/JavaScriptCore/runtime/AtomicsObject.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeBigIntPrototypeh">trunk/Source/JavaScriptCore/runtime/BigIntPrototype.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeBrandedStructureh">trunk/Source/JavaScriptCore/runtime/BrandedStructure.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeButterflyInlinesh">trunk/Source/JavaScriptCore/runtime/ButterflyInlines.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeCachedTypesh">trunk/Source/JavaScriptCore/runtime/CachedTypes.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeClonedArgumentsh">trunk/Source/JavaScriptCore/runtime/ClonedArguments.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeConsoleObjecth">trunk/Source/JavaScriptCore/runtime/ConsoleObject.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeCustomGetterSetterh">trunk/Source/JavaScriptCore/runtime/CustomGetterSetter.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeDOMAttributeGetterSetterh">trunk/Source/JavaScriptCore/runtime/DOMAttributeGetterSetter.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeDateInstanceh">trunk/Source/JavaScriptCore/runtime/DateInstance.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeDatePrototypeh">trunk/Source/JavaScriptCore/runtime/DatePrototype.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeDirectArgumentsh">trunk/Source/JavaScriptCore/runtime/DirectArguments.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeErrorPrototypeh">trunk/Source/JavaScriptCore/runtime/ErrorPrototype.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeExceptionh">trunk/Source/JavaScriptCore/runtime/Exception.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeFinalizationRegistryPrototypeh">trunk/Source/JavaScriptCore/runtime/FinalizationRegistryPrototype.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeFunctionExecutableh">trunk/Source/JavaScriptCore/runtime/FunctionExecutable.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeGeneratorFunctionPrototypeh">trunk/Source/JavaScriptCore/runtime/GeneratorFunctionPrototype.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeGeneratorPrototypeh">trunk/Source/JavaScriptCore/runtime/GeneratorPrototype.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeGetterSetterh">trunk/Source/JavaScriptCore/runtime/GetterSetter.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeHashMapImplh">trunk/Source/JavaScriptCore/runtime/HashMapImpl.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeInternalFunctionh">trunk/Source/JavaScriptCore/runtime/InternalFunction.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeIntlCollatorPrototypeh">trunk/Source/JavaScriptCore/runtime/IntlCollatorPrototype.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeIntlDateTimeFormatPrototypeh">trunk/Source/JavaScriptCore/runtime/IntlDateTimeFormatPrototype.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeIntlDisplayNamesPrototypeh">trunk/Source/JavaScriptCore/runtime/IntlDisplayNamesPrototype.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeIntlListFormatPrototypeh">trunk/Source/JavaScriptCore/runtime/IntlListFormatPrototype.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeIntlLocalePrototypeh">trunk/Source/JavaScriptCore/runtime/IntlLocalePrototype.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeIntlNumberFormatPrototypeh">trunk/Source/JavaScriptCore/runtime/IntlNumberFormatPrototype.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeIntlObjecth">trunk/Source/JavaScriptCore/runtime/IntlObject.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeIntlPluralRulesPrototypeh">trunk/Source/JavaScriptCore/runtime/IntlPluralRulesPrototype.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeIntlRelativeTimeFormatPrototypeh">trunk/Source/JavaScriptCore/runtime/IntlRelativeTimeFormatPrototype.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeIntlSegmentIteratorPrototypeh">trunk/Source/JavaScriptCore/runtime/IntlSegmentIteratorPrototype.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeIntlSegmenterPrototypeh">trunk/Source/JavaScriptCore/runtime/IntlSegmenterPrototype.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeIntlSegmentsPrototypeh">trunk/Source/JavaScriptCore/runtime/IntlSegmentsPrototype.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeIteratorPrototypeh">trunk/Source/JavaScriptCore/runtime/IteratorPrototype.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeJSArraycpp">trunk/Source/JavaScriptCore/runtime/JSArray.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeJSArrayh">trunk/Source/JavaScriptCore/runtime/JSArray.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeJSArrayBufferPrototypeh">trunk/Source/JavaScriptCore/runtime/JSArrayBufferPrototype.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeJSArrayBufferViewcpp">trunk/Source/JavaScriptCore/runtime/JSArrayBufferView.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeJSBigIntcpp">trunk/Source/JavaScriptCore/runtime/JSBigInt.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeJSBigInth">trunk/Source/JavaScriptCore/runtime/JSBigInt.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeJSCalleeh">trunk/Source/JavaScriptCore/runtime/JSCallee.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeJSDataViewPrototypeh">trunk/Source/JavaScriptCore/runtime/JSDataViewPrototype.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeJSFunctionh">trunk/Source/JavaScriptCore/runtime/JSFunction.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeJSGenericTypedArrayViewPrototypeh">trunk/Source/JavaScriptCore/runtime/JSGenericTypedArrayViewPrototype.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeJSGlobalLexicalEnvironmenth">trunk/Source/JavaScriptCore/runtime/JSGlobalLexicalEnvironment.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeJSImmutableButterflyh">trunk/Source/JavaScriptCore/runtime/JSImmutableButterfly.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeJSLexicalEnvironmenth">trunk/Source/JavaScriptCore/runtime/JSLexicalEnvironment.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeJSModuleLoaderh">trunk/Source/JavaScriptCore/runtime/JSModuleLoader.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeJSONObjecth">trunk/Source/JavaScriptCore/runtime/JSONObject.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeJSObjectInlinesh">trunk/Source/JavaScriptCore/runtime/JSObjectInlines.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeJSPromiseh">trunk/Source/JavaScriptCore/runtime/JSPromise.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeJSPromisePrototypeh">trunk/Source/JavaScriptCore/runtime/JSPromisePrototype.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeJSPropertyNameEnumeratorcpp">trunk/Source/JavaScriptCore/runtime/JSPropertyNameEnumerator.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeJSPropertyNameEnumeratorh">trunk/Source/JavaScriptCore/runtime/JSPropertyNameEnumerator.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeJSProxyh">trunk/Source/JavaScriptCore/runtime/JSProxy.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeJSStringh">trunk/Source/JavaScriptCore/runtime/JSString.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeJSTypedArrayViewPrototypeh">trunk/Source/JavaScriptCore/runtime/JSTypedArrayViewPrototype.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeMapIteratorPrototypeh">trunk/Source/JavaScriptCore/runtime/MapIteratorPrototype.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeMapPrototypeh">trunk/Source/JavaScriptCore/runtime/MapPrototype.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeMathObjecth">trunk/Source/JavaScriptCore/runtime/MathObject.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeNativeErrorPrototypeh">trunk/Source/JavaScriptCore/runtime/NativeErrorPrototype.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeNativeExecutableh">trunk/Source/JavaScriptCore/runtime/NativeExecutable.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeNumberObjecth">trunk/Source/JavaScriptCore/runtime/NumberObject.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeObjectPrototypeh">trunk/Source/JavaScriptCore/runtime/ObjectPrototype.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeProgramExecutableh">trunk/Source/JavaScriptCore/runtime/ProgramExecutable.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimePropertyTableh">trunk/Source/JavaScriptCore/runtime/PropertyTable.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeReflectObjecth">trunk/Source/JavaScriptCore/runtime/ReflectObject.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeRegExph">trunk/Source/JavaScriptCore/runtime/RegExp.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeRegExpObjecth">trunk/Source/JavaScriptCore/runtime/RegExpObject.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeRegExpPrototypeh">trunk/Source/JavaScriptCore/runtime/RegExpPrototype.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeRegExpStringIteratorPrototypeh">trunk/Source/JavaScriptCore/runtime/RegExpStringIteratorPrototype.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeScopedArgumentscpp">trunk/Source/JavaScriptCore/runtime/ScopedArguments.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeScopedArgumentsh">trunk/Source/JavaScriptCore/runtime/ScopedArguments.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeSetIteratorPrototypeh">trunk/Source/JavaScriptCore/runtime/SetIteratorPrototype.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeSetPrototypeh">trunk/Source/JavaScriptCore/runtime/SetPrototype.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeShadowRealmPrototypeh">trunk/Source/JavaScriptCore/runtime/ShadowRealmPrototype.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeSparseArrayValueMaph">trunk/Source/JavaScriptCore/runtime/SparseArrayValueMap.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeStringIteratorPrototypeh">trunk/Source/JavaScriptCore/runtime/StringIteratorPrototype.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeStringObjecth">trunk/Source/JavaScriptCore/runtime/StringObject.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeStructureh">trunk/Source/JavaScriptCore/runtime/Structure.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeStructureChaincpp">trunk/Source/JavaScriptCore/runtime/StructureChain.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeStructureChainh">trunk/Source/JavaScriptCore/runtime/StructureChain.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeStructureRareDatah">trunk/Source/JavaScriptCore/runtime/StructureRareData.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeSymbolPrototypeh">trunk/Source/JavaScriptCore/runtime/SymbolPrototype.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeSymbolTableh">trunk/Source/JavaScriptCore/runtime/SymbolTable.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeTemporalCalendarPrototypeh">trunk/Source/JavaScriptCore/runtime/TemporalCalendarPrototype.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeTemporalDurationPrototypeh">trunk/Source/JavaScriptCore/runtime/TemporalDurationPrototype.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeTemporalInstantPrototypeh">trunk/Source/JavaScriptCore/runtime/TemporalInstantPrototype.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeTemporalNowh">trunk/Source/JavaScriptCore/runtime/TemporalNow.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeTemporalObjecth">trunk/Source/JavaScriptCore/runtime/TemporalObject.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeTemporalPlainTimePrototypeh">trunk/Source/JavaScriptCore/runtime/TemporalPlainTimePrototype.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeTemporalTimeZonePrototypeh">trunk/Source/JavaScriptCore/runtime/TemporalTimeZonePrototype.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeThrowScopecpp">trunk/Source/JavaScriptCore/runtime/ThrowScope.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeVMcpp">trunk/Source/JavaScriptCore/runtime/VM.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeVMh">trunk/Source/JavaScriptCore/runtime/VM.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeVMInlinesh">trunk/Source/JavaScriptCore/runtime/VMInlines.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeWeakMapPrototypeh">trunk/Source/JavaScriptCore/runtime/WeakMapPrototype.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeWeakObjectRefPrototypeh">trunk/Source/JavaScriptCore/runtime/WeakObjectRefPrototype.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeWeakSetPrototypeh">trunk/Source/JavaScriptCore/runtime/WeakSetPrototype.h</a></li>
<li><a href="#trunkSourceJavaScriptCoretoolsJSDollarVMcpp">trunk/Source/JavaScriptCore/tools/JSDollarVM.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoretoolsJSDollarVMh">trunk/Source/JavaScriptCore/tools/JSDollarVM.h</a></li>
<li><a href="#trunkSourceJavaScriptCorewasmjsJSWebAssemblyh">trunk/Source/JavaScriptCore/wasm/js/JSWebAssembly.h</a></li>
<li><a href="#trunkSourceJavaScriptCorewasmjsWebAssemblyCompileErrorPrototypeh">trunk/Source/JavaScriptCore/wasm/js/WebAssemblyCompileErrorPrototype.h</a></li>
<li><a href="#trunkSourceJavaScriptCorewasmjsWebAssemblyExceptionPrototypeh">trunk/Source/JavaScriptCore/wasm/js/WebAssemblyExceptionPrototype.h</a></li>
<li><a href="#trunkSourceJavaScriptCorewasmjsWebAssemblyGlobalPrototypeh">trunk/Source/JavaScriptCore/wasm/js/WebAssemblyGlobalPrototype.h</a></li>
<li><a href="#trunkSourceJavaScriptCorewasmjsWebAssemblyInstancePrototypeh">trunk/Source/JavaScriptCore/wasm/js/WebAssemblyInstancePrototype.h</a></li>
<li><a href="#trunkSourceJavaScriptCorewasmjsWebAssemblyLinkErrorPrototypeh">trunk/Source/JavaScriptCore/wasm/js/WebAssemblyLinkErrorPrototype.h</a></li>
<li><a href="#trunkSourceJavaScriptCorewasmjsWebAssemblyMemoryPrototypeh">trunk/Source/JavaScriptCore/wasm/js/WebAssemblyMemoryPrototype.h</a></li>
<li><a href="#trunkSourceJavaScriptCorewasmjsWebAssemblyModulePrototypeh">trunk/Source/JavaScriptCore/wasm/js/WebAssemblyModulePrototype.h</a></li>
<li><a href="#trunkSourceJavaScriptCorewasmjsWebAssemblyRuntimeErrorPrototypeh">trunk/Source/JavaScriptCore/wasm/js/WebAssemblyRuntimeErrorPrototype.h</a></li>
<li><a href="#trunkSourceJavaScriptCorewasmjsWebAssemblyTablePrototypeh">trunk/Source/JavaScriptCore/wasm/js/WebAssemblyTablePrototype.h</a></li>
<li><a href="#trunkSourceJavaScriptCorewasmjsWebAssemblyTagPrototypeh">trunk/Source/JavaScriptCore/wasm/js/WebAssemblyTagPrototype.h</a></li>
<li><a href="#trunkSourceWebCoreChangeLog">trunk/Source/WebCore/ChangeLog</a></li>
<li><a href="#trunkSourceWebCorebindingsjsJSDOMAsyncIteratorh">trunk/Source/WebCore/bindings/js/JSDOMAsyncIterator.h</a></li>
<li><a href="#trunkSourceWebCorebindingsjsJSDOMIteratorh">trunk/Source/WebCore/bindings/js/JSDOMIterator.h</a></li>
<li><a href="#trunkSourceWebCorebindingsjsJSFileSystemDirectoryHandleIteratorcpp">trunk/Source/WebCore/bindings/js/JSFileSystemDirectoryHandleIterator.cpp</a></li>
<li><a href="#trunkSourceWebCorebindingsjsWebCoreJSClientDatacpp">trunk/Source/WebCore/bindings/js/WebCoreJSClientData.cpp</a></li>
<li><a href="#trunkSourceWebCorebindingsjsWebCoreJSClientDatah">trunk/Source/WebCore/bindings/js/WebCoreJSClientData.h</a></li>
<li><a href="#trunkSourceWebCorebindingsscriptsCodeGeneratorJSpm">trunk/Source/WebCore/bindings/scripts/CodeGeneratorJS.pm</a></li>
<li><a href="#trunkSourceWebCorebindingsscriptstestJSJSDOMWindowcpp">trunk/Source/WebCore/bindings/scripts/test/JS/JSDOMWindow.cpp</a></li>
<li><a href="#trunkSourceWebCorebindingsscriptstestJSJSDOMWindowh">trunk/Source/WebCore/bindings/scripts/test/JS/JSDOMWindow.h</a></li>
<li><a href="#trunkSourceWebCorebindingsscriptstestJSJSDedicatedWorkerGlobalScopecpp">trunk/Source/WebCore/bindings/scripts/test/JS/JSDedicatedWorkerGlobalScope.cpp</a></li>
<li><a href="#trunkSourceWebCorebindingsscriptstestJSJSDedicatedWorkerGlobalScopeh">trunk/Source/WebCore/bindings/scripts/test/JS/JSDedicatedWorkerGlobalScope.h</a></li>
<li><a href="#trunkSourceWebCorebindingsscriptstestJSJSExposedStarcpp">trunk/Source/WebCore/bindings/scripts/test/JS/JSExposedStar.cpp</a></li>
<li><a href="#trunkSourceWebCorebindingsscriptstestJSJSExposedToWorkerAndWindowcpp">trunk/Source/WebCore/bindings/scripts/test/JS/JSExposedToWorkerAndWindow.cpp</a></li>
<li><a href="#trunkSourceWebCorebindingsscriptstestJSJSPaintWorkletGlobalScopecpp">trunk/Source/WebCore/bindings/scripts/test/JS/JSPaintWorkletGlobalScope.cpp</a></li>
<li><a href="#trunkSourceWebCorebindingsscriptstestJSJSPaintWorkletGlobalScopeh">trunk/Source/WebCore/bindings/scripts/test/JS/JSPaintWorkletGlobalScope.h</a></li>
<li><a href="#trunkSourceWebCorebindingsscriptstestJSJSServiceWorkerGlobalScopecpp">trunk/Source/WebCore/bindings/scripts/test/JS/JSServiceWorkerGlobalScope.cpp</a></li>
<li><a href="#trunkSourceWebCorebindingsscriptstestJSJSServiceWorkerGlobalScopeh">trunk/Source/WebCore/bindings/scripts/test/JS/JSServiceWorkerGlobalScope.h</a></li>
<li><a href="#trunkSourceWebCorebindingsscriptstestJSJSSharedWorkerGlobalScopecpp">trunk/Source/WebCore/bindings/scripts/test/JS/JSSharedWorkerGlobalScope.cpp</a></li>
<li><a href="#trunkSourceWebCorebindingsscriptstestJSJSSharedWorkerGlobalScopeh">trunk/Source/WebCore/bindings/scripts/test/JS/JSSharedWorkerGlobalScope.h</a></li>
<li><a href="#trunkSourceWebCorebindingsscriptstestJSJSTestCEReactionscpp">trunk/Source/WebCore/bindings/scripts/test/JS/JSTestCEReactions.cpp</a></li>
<li><a href="#trunkSourceWebCorebindingsscriptstestJSJSTestCEReactionsStringifiercpp">trunk/Source/WebCore/bindings/scripts/test/JS/JSTestCEReactionsStringifier.cpp</a></li>
<li><a href="#trunkSourceWebCorebindingsscriptstestJSJSTestCallTracercpp">trunk/Source/WebCore/bindings/scripts/test/JS/JSTestCallTracer.cpp</a></li>
<li><a href="#trunkSourceWebCorebindingsscriptstestJSJSTestClassWithJSBuiltinConstructorcpp">trunk/Source/WebCore/bindings/scripts/test/JS/JSTestClassWithJSBuiltinConstructor.cpp</a></li>
<li><a href="#trunkSourceWebCorebindingsscriptstestJSJSTestConditionalIncludescpp">trunk/Source/WebCore/bindings/scripts/test/JS/JSTestConditionalIncludes.cpp</a></li>
<li><a href="#trunkSourceWebCorebindingsscriptstestJSJSTestConditionallyReadWritecpp">trunk/Source/WebCore/bindings/scripts/test/JS/JSTestConditionallyReadWrite.cpp</a></li>
<li><a href="#trunkSourceWebCorebindingsscriptstestJSJSTestDOMJITcpp">trunk/Source/WebCore/bindings/scripts/test/JS/JSTestDOMJIT.cpp</a></li>
<li><a href="#trunkSourceWebCorebindingsscriptstestJSJSTestDefaultToJSONcpp">trunk/Source/WebCore/bindings/scripts/test/JS/JSTestDefaultToJSON.cpp</a></li>
<li><a href="#trunkSourceWebCorebindingsscriptstestJSJSTestDefaultToJSONFilteredByExposedcpp">trunk/Source/WebCore/bindings/scripts/test/JS/JSTestDefaultToJSONFilteredByExposed.cpp</a></li>
<li><a href="#trunkSourceWebCorebindingsscriptstestJSJSTestDefaultToJSONIndirectInheritancecpp">trunk/Source/WebCore/bindings/scripts/test/JS/JSTestDefaultToJSONIndirectInheritance.cpp</a></li>
<li><a href="#trunkSourceWebCorebindingsscriptstestJSJSTestDefaultToJSONInheritcpp">trunk/Source/WebCore/bindings/scripts/test/JS/JSTestDefaultToJSONInherit.cpp</a></li>
<li><a href="#trunkSourceWebCorebindingsscriptstestJSJSTestDefaultToJSONInheritFinalcpp">trunk/Source/WebCore/bindings/scripts/test/JS/JSTestDefaultToJSONInheritFinal.cpp</a></li>
<li><a href="#trunkSourceWebCorebindingsscriptstestJSJSTestDelegateToSharedSyntheticAttributecpp">trunk/Source/WebCore/bindings/scripts/test/JS/JSTestDelegateToSharedSyntheticAttribute.cpp</a></li>
<li><a href="#trunkSourceWebCorebindingsscriptstestJSJSTestDomainSecuritycpp">trunk/Source/WebCore/bindings/scripts/test/JS/JSTestDomainSecurity.cpp</a></li>
<li><a href="#trunkSourceWebCorebindingsscriptstestJSJSTestEnabledBySettingcpp">trunk/Source/WebCore/bindings/scripts/test/JS/JSTestEnabledBySetting.cpp</a></li>
<li><a href="#trunkSourceWebCorebindingsscriptstestJSJSTestEnabledForContextcpp">trunk/Source/WebCore/bindings/scripts/test/JS/JSTestEnabledForContext.cpp</a></li>
<li><a href="#trunkSourceWebCorebindingsscriptstestJSJSTestEventConstructorcpp">trunk/Source/WebCore/bindings/scripts/test/JS/JSTestEventConstructor.cpp</a></li>
<li><a href="#trunkSourceWebCorebindingsscriptstestJSJSTestEventTargetcpp">trunk/Source/WebCore/bindings/scripts/test/JS/JSTestEventTarget.cpp</a></li>
<li><a href="#trunkSourceWebCorebindingsscriptstestJSJSTestExceptioncpp">trunk/Source/WebCore/bindings/scripts/test/JS/JSTestException.cpp</a></li>
<li><a href="#trunkSourceWebCorebindingsscriptstestJSJSTestGenerateAddOpaqueRootcpp">trunk/Source/WebCore/bindings/scripts/test/JS/JSTestGenerateAddOpaqueRoot.cpp</a></li>
<li><a href="#trunkSourceWebCorebindingsscriptstestJSJSTestGenerateIsReachablecpp">trunk/Source/WebCore/bindings/scripts/test/JS/JSTestGenerateIsReachable.cpp</a></li>
<li><a href="#trunkSourceWebCorebindingsscriptstestJSJSTestGlobalObjectcpp">trunk/Source/WebCore/bindings/scripts/test/JS/JSTestGlobalObject.cpp</a></li>
<li><a href="#trunkSourceWebCorebindingsscriptstestJSJSTestGlobalObjecth">trunk/Source/WebCore/bindings/scripts/test/JS/JSTestGlobalObject.h</a></li>
<li><a href="#trunkSourceWebCorebindingsscriptstestJSJSTestIndexedSetterNoIdentifiercpp">trunk/Source/WebCore/bindings/scripts/test/JS/JSTestIndexedSetterNoIdentifier.cpp</a></li>
<li><a href="#trunkSourceWebCorebindingsscriptstestJSJSTestIndexedSetterThrowingExceptioncpp">trunk/Source/WebCore/bindings/scripts/test/JS/JSTestIndexedSetterThrowingException.cpp</a></li>
<li><a href="#trunkSourceWebCorebindingsscriptstestJSJSTestIndexedSetterWithIdentifiercpp">trunk/Source/WebCore/bindings/scripts/test/JS/JSTestIndexedSetterWithIdentifier.cpp</a></li>
<li><a href="#trunkSourceWebCorebindingsscriptstestJSJSTestInterfacecpp">trunk/Source/WebCore/bindings/scripts/test/JS/JSTestInterface.cpp</a></li>
<li><a href="#trunkSourceWebCorebindingsscriptstestJSJSTestInterfaceLeadingUnderscorecpp">trunk/Source/WebCore/bindings/scripts/test/JS/JSTestInterfaceLeadingUnderscore.cpp</a></li>
<li><a href="#trunkSourceWebCorebindingsscriptstestJSJSTestIterablecpp">trunk/Source/WebCore/bindings/scripts/test/JS/JSTestIterable.cpp</a></li>
<li><a href="#trunkSourceWebCorebindingsscriptstestJSJSTestJSBuiltinConstructorcpp">trunk/Source/WebCore/bindings/scripts/test/JS/JSTestJSBuiltinConstructor.cpp</a></li>
<li><a href="#trunkSourceWebCorebindingsscriptstestJSJSTestLegacyFactoryFunctioncpp">trunk/Source/WebCore/bindings/scripts/test/JS/JSTestLegacyFactoryFunction.cpp</a></li>
<li><a href="#trunkSourceWebCorebindingsscriptstestJSJSTestLegacyNoInterfaceObjectcpp">trunk/Source/WebCore/bindings/scripts/test/JS/JSTestLegacyNoInterfaceObject.cpp</a></li>
<li><a href="#trunkSourceWebCorebindingsscriptstestJSJSTestLegacyOverrideBuiltInscpp">trunk/Source/WebCore/bindings/scripts/test/JS/JSTestLegacyOverrideBuiltIns.cpp</a></li>
<li><a href="#trunkSourceWebCorebindingsscriptstestJSJSTestMapLikecpp">trunk/Source/WebCore/bindings/scripts/test/JS/JSTestMapLike.cpp</a></li>
<li><a href="#trunkSourceWebCorebindingsscriptstestJSJSTestMapLikeWithOverriddenOperationscpp">trunk/Source/WebCore/bindings/scripts/test/JS/JSTestMapLikeWithOverriddenOperations.cpp</a></li>
<li><a href="#trunkSourceWebCorebindingsscriptstestJSJSTestNamedAndIndexedSetterNoIdentifiercpp">trunk/Source/WebCore/bindings/scripts/test/JS/JSTestNamedAndIndexedSetterNoIdentifier.cpp</a></li>
<li><a href="#trunkSourceWebCorebindingsscriptstestJSJSTestNamedAndIndexedSetterThrowingExceptioncpp">trunk/Source/WebCore/bindings/scripts/test/JS/JSTestNamedAndIndexedSetterThrowingException.cpp</a></li>
<li><a href="#trunkSourceWebCorebindingsscriptstestJSJSTestNamedAndIndexedSetterWithIdentifiercpp">trunk/Source/WebCore/bindings/scripts/test/JS/JSTestNamedAndIndexedSetterWithIdentifier.cpp</a></li>
<li><a href="#trunkSourceWebCorebindingsscriptstestJSJSTestNamedDeleterNoIdentifiercpp">trunk/Source/WebCore/bindings/scripts/test/JS/JSTestNamedDeleterNoIdentifier.cpp</a></li>
<li><a href="#trunkSourceWebCorebindingsscriptstestJSJSTestNamedDeleterThrowingExceptioncpp">trunk/Source/WebCore/bindings/scripts/test/JS/JSTestNamedDeleterThrowingException.cpp</a></li>
<li><a href="#trunkSourceWebCorebindingsscriptstestJSJSTestNamedDeleterWithIdentifiercpp">trunk/Source/WebCore/bindings/scripts/test/JS/JSTestNamedDeleterWithIdentifier.cpp</a></li>
<li><a href="#trunkSourceWebCorebindingsscriptstestJSJSTestNamedDeleterWithIndexedGettercpp">trunk/Source/WebCore/bindings/scripts/test/JS/JSTestNamedDeleterWithIndexedGetter.cpp</a></li>
<li><a href="#trunkSourceWebCorebindingsscriptstestJSJSTestNamedGetterCallWithcpp">trunk/Source/WebCore/bindings/scripts/test/JS/JSTestNamedGetterCallWith.cpp</a></li>
<li><a href="#trunkSourceWebCorebindingsscriptstestJSJSTestNamedGetterNoIdentifiercpp">trunk/Source/WebCore/bindings/scripts/test/JS/JSTestNamedGetterNoIdentifier.cpp</a></li>
<li><a href="#trunkSourceWebCorebindingsscriptstestJSJSTestNamedGetterWithIdentifiercpp">trunk/Source/WebCore/bindings/scripts/test/JS/JSTestNamedGetterWithIdentifier.cpp</a></li>
<li><a href="#trunkSourceWebCorebindingsscriptstestJSJSTestNamedSetterNoIdentifiercpp">trunk/Source/WebCore/bindings/scripts/test/JS/JSTestNamedSetterNoIdentifier.cpp</a></li>
<li><a href="#trunkSourceWebCorebindingsscriptstestJSJSTestNamedSetterThrowingExceptioncpp">trunk/Source/WebCore/bindings/scripts/test/JS/JSTestNamedSetterThrowingException.cpp</a></li>
<li><a href="#trunkSourceWebCorebindingsscriptstestJSJSTestNamedSetterWithIdentifiercpp">trunk/Source/WebCore/bindings/scripts/test/JS/JSTestNamedSetterWithIdentifier.cpp</a></li>
<li><a href="#trunkSourceWebCorebindingsscriptstestJSJSTestNamedSetterWithIndexedGettercpp">trunk/Source/WebCore/bindings/scripts/test/JS/JSTestNamedSetterWithIndexedGetter.cpp</a></li>
<li><a href="#trunkSourceWebCorebindingsscriptstestJSJSTestNamedSetterWithIndexedGetterAndSettercpp">trunk/Source/WebCore/bindings/scripts/test/JS/JSTestNamedSetterWithIndexedGetterAndSetter.cpp</a></li>
<li><a href="#trunkSourceWebCorebindingsscriptstestJSJSTestNamedSetterWithLegacyOverrideBuiltInscpp">trunk/Source/WebCore/bindings/scripts/test/JS/JSTestNamedSetterWithLegacyOverrideBuiltIns.cpp</a></li>
<li><a href="#trunkSourceWebCorebindingsscriptstestJSJSTestNamedSetterWithLegacyUnforgeablePropertiescpp">trunk/Source/WebCore/bindings/scripts/test/JS/JSTestNamedSetterWithLegacyUnforgeableProperties.cpp</a></li>
<li><a href="#trunkSourceWebCorebindingsscriptstestJSJSTestNamedSetterWithLegacyUnforgeablePropertiesAndLegacyOverrideBuiltInscpp">trunk/Source/WebCore/bindings/scripts/test/JS/JSTestNamedSetterWithLegacyUnforgeablePropertiesAndLegacyOverrideBuiltIns.cpp</a></li>
<li><a href="#trunkSourceWebCorebindingsscriptstestJSJSTestNamespaceObjectcpp">trunk/Source/WebCore/bindings/scripts/test/JS/JSTestNamespaceObject.cpp</a></li>
<li><a href="#trunkSourceWebCorebindingsscriptstestJSJSTestNodecpp">trunk/Source/WebCore/bindings/scripts/test/JS/JSTestNode.cpp</a></li>
<li><a href="#trunkSourceWebCorebindingsscriptstestJSJSTestObjcpp">trunk/Source/WebCore/bindings/scripts/test/JS/JSTestObj.cpp</a></li>
<li><a href="#trunkSourceWebCorebindingsscriptstestJSJSTestOperationConditionalcpp">trunk/Source/WebCore/bindings/scripts/test/JS/JSTestOperationConditional.cpp</a></li>
<li><a href="#trunkSourceWebCorebindingsscriptstestJSJSTestOverloadedConstructorscpp">trunk/Source/WebCore/bindings/scripts/test/JS/JSTestOverloadedConstructors.cpp</a></li>
<li><a href="#trunkSourceWebCorebindingsscriptstestJSJSTestOverloadedConstructorsWithSequencecpp">trunk/Source/WebCore/bindings/scripts/test/JS/JSTestOverloadedConstructorsWithSequence.cpp</a></li>
<li><a href="#trunkSourceWebCorebindingsscriptstestJSJSTestPluginInterfacecpp">trunk/Source/WebCore/bindings/scripts/test/JS/JSTestPluginInterface.cpp</a></li>
<li><a href="#trunkSourceWebCorebindingsscriptstestJSJSTestPromiseRejectionEventcpp">trunk/Source/WebCore/bindings/scripts/test/JS/JSTestPromiseRejectionEvent.cpp</a></li>
<li><a href="#trunkSourceWebCorebindingsscriptstestJSJSTestReadOnlyMapLikecpp">trunk/Source/WebCore/bindings/scripts/test/JS/JSTestReadOnlyMapLike.cpp</a></li>
<li><a href="#trunkSourceWebCorebindingsscriptstestJSJSTestReadOnlySetLikecpp">trunk/Source/WebCore/bindings/scripts/test/JS/JSTestReadOnlySetLike.cpp</a></li>
<li><a href="#trunkSourceWebCorebindingsscriptstestJSJSTestReportExtraMemoryCostcpp">trunk/Source/WebCore/bindings/scripts/test/JS/JSTestReportExtraMemoryCost.cpp</a></li>
<li><a href="#trunkSourceWebCorebindingsscriptstestJSJSTestSerializedScriptValueInterfacecpp">trunk/Source/WebCore/bindings/scripts/test/JS/JSTestSerializedScriptValueInterface.cpp</a></li>
<li><a href="#trunkSourceWebCorebindingsscriptstestJSJSTestSetLikecpp">trunk/Source/WebCore/bindings/scripts/test/JS/JSTestSetLike.cpp</a></li>
<li><a href="#trunkSourceWebCorebindingsscriptstestJSJSTestSetLikeWithOverriddenOperationscpp">trunk/Source/WebCore/bindings/scripts/test/JS/JSTestSetLikeWithOverriddenOperations.cpp</a></li>
<li><a href="#trunkSourceWebCorebindingsscriptstestJSJSTestStringifiercpp">trunk/Source/WebCore/bindings/scripts/test/JS/JSTestStringifier.cpp</a></li>
<li><a href="#trunkSourceWebCorebindingsscriptstestJSJSTestStringifierAnonymousOperationcpp">trunk/Source/WebCore/bindings/scripts/test/JS/JSTestStringifierAnonymousOperation.cpp</a></li>
<li><a href="#trunkSourceWebCorebindingsscriptstestJSJSTestStringifierNamedOperationcpp">trunk/Source/WebCore/bindings/scripts/test/JS/JSTestStringifierNamedOperation.cpp</a></li>
<li><a href="#trunkSourceWebCorebindingsscriptstestJSJSTestStringifierOperationImplementedAscpp">trunk/Source/WebCore/bindings/scripts/test/JS/JSTestStringifierOperationImplementedAs.cpp</a></li>
<li><a href="#trunkSourceWebCorebindingsscriptstestJSJSTestStringifierOperationNamedToStringcpp">trunk/Source/WebCore/bindings/scripts/test/JS/JSTestStringifierOperationNamedToString.cpp</a></li>
<li><a href="#trunkSourceWebCorebindingsscriptstestJSJSTestStringifierReadOnlyAttributecpp">trunk/Source/WebCore/bindings/scripts/test/JS/JSTestStringifierReadOnlyAttribute.cpp</a></li>
<li><a href="#trunkSourceWebCorebindingsscriptstestJSJSTestStringifierReadWriteAttributecpp">trunk/Source/WebCore/bindings/scripts/test/JS/JSTestStringifierReadWriteAttribute.cpp</a></li>
<li><a href="#trunkSourceWebCorebindingsscriptstestJSJSTestTypedefscpp">trunk/Source/WebCore/bindings/scripts/test/JS/JSTestTypedefs.cpp</a></li>
<li><a href="#trunkSourceWebCorebindingsscriptstestJSJSWorkerGlobalScopecpp">trunk/Source/WebCore/bindings/scripts/test/JS/JSWorkerGlobalScope.cpp</a></li>
<li><a href="#trunkSourceWebCorebindingsscriptstestJSJSWorkerGlobalScopeh">trunk/Source/WebCore/bindings/scripts/test/JS/JSWorkerGlobalScope.h</a></li>
<li><a href="#trunkSourceWebCorebindingsscriptstestJSJSWorkletGlobalScopecpp">trunk/Source/WebCore/bindings/scripts/test/JS/JSWorkletGlobalScope.cpp</a></li>
<li><a href="#trunkSourceWebCorebindingsscriptstestJSJSWorkletGlobalScopeh">trunk/Source/WebCore/bindings/scripts/test/JS/JSWorkletGlobalScope.h</a></li>
<li><a href="#trunkSourceWebCorebridgeobjcobjc_runtimemm">trunk/Source/WebCore/bridge/objc/objc_runtime.mm</a></li>
<li><a href="#trunkSourceWebCoreworkersWorkerOrWorkletScriptControllerh">trunk/Source/WebCore/workers/WorkerOrWorkletScriptController.h</a></li>
<li><a href="#trunkSourceWebKitUIProcessCocoaModelElementControllerCocoamm">trunk/Source/WebKit/UIProcess/Cocoa/ModelElementControllerCocoa.mm</a></li>
</ul>

<h3>Added Paths</h3>
<ul>
<li><a href="#trunkSourceJavaScriptCoreheapHeapSubspaceTypesh">trunk/Source/JavaScriptCore/heap/HeapSubspaceTypes.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreheapIsoInlinedHeapCellTypeInlinesh">trunk/Source/JavaScriptCore/heap/IsoInlinedHeapCellTypeInlines.h</a></li>
</ul>

</div>
<div id="patch">
<h3>Diff</h3>
<a id="trunkSourceJavaScriptCoreCMakeListstxt"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/CMakeLists.txt (286346 => 286347)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/CMakeLists.txt       2021-12-01 02:56:24 UTC (rev 286346)
+++ trunk/Source/JavaScriptCore/CMakeLists.txt  2021-12-01 04:38:56 UTC (rev 286347)
</span><span class="lines">@@ -760,9 +760,12 @@
</span><span class="cx">     heap/HeapInlines.h
</span><span class="cx">     heap/HeapObserver.h
</span><span class="cx">     heap/HeapSnapshotBuilder.h
</span><ins>+    heap/HeapSubspaceTypes.h
</ins><span class="cx">     heap/IncrementalSweeper.h
</span><span class="cx">     heap/IsoCellSet.h
</span><span class="cx">     heap/IsoHeapCellType.h
</span><ins>+    heap/IsoInlinedHeapCellType.h
+    heap/IsoInlinedHeapCellTypeInlines.h
</ins><span class="cx">     heap/IsoMemoryAllocatorBase.h
</span><span class="cx">     heap/IsoSubspace.h
</span><span class="cx">     heap/IsoSubspaceInlines.h
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreChangeLog"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/ChangeLog (286346 => 286347)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/ChangeLog    2021-12-01 02:56:24 UTC (rev 286346)
+++ trunk/Source/JavaScriptCore/ChangeLog       2021-12-01 04:38:56 UTC (rev 286347)
</span><span class="lines">@@ -1,3 +1,290 @@
</span><ins>+2021-11-30  Mark Lam  <mark.lam@apple.com>
+
+        Move Subspaces from VM to Heap.
+        https://bugs.webkit.org/show_bug.cgi?id=233648
+        rdar://85875751
+
+        Reviewed by Saam Barati.
+
+        Subspaces are Heap data structures to begin with, and this refactoring is needed
+        in preparation for the global GC.
+
+        1. Embed HeapCellType and IsoHeapCellType instances in Heap directly instead of
+           malloc'ing them separately and referencing them via unique_ptrs.  These
+           instances are always instantiated unconditionally anyway.  This change
+           eliminates the unneeded busy work to allocate them separately.
+
+        2. Introduce a HeapSubspaceTypes.h that #include all the types that we have
+           subspaces for.  This makes it so that Heap.cpp's #include list is not flooded
+           with these types with subspaces, and that it'll be easier to discern between
+           these Subspace types from other data structures needed for implementing Heap.
+
+        3. Add VM accessor methods for subspaces that forward to Heap.  This will make it
+           easier for us to redirect to a thread local allocator later for the global GC.
+
+        4. Remove unneeded #includes in VM.h.
+
+        5. Remove unused CodeBlockSet::iterateViaSubspaces().
+
+        * CMakeLists.txt:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * bytecode/AccessCase.cpp:
+        (JSC::AccessCase::generateImpl):
+        * bytecode/DFGExitProfile.h:
+        * bytecode/EvalCodeBlock.h:
+        * bytecode/ExecutableToCodeBlockEdge.cpp:
+        (JSC::ExecutableToCodeBlockEdge::visitChildrenImpl):
+        (JSC::ExecutableToCodeBlockEdge::finalizeUnconditionally):
+        (JSC::ExecutableToCodeBlockEdge::runConstraint):
+        * bytecode/ExecutableToCodeBlockEdge.h:
+        * bytecode/FunctionCodeBlock.h:
+        * bytecode/ModuleProgramCodeBlock.h:
+        * bytecode/ProgramCodeBlock.h:
+        * bytecode/Repatch.h:
+        * bytecode/UnlinkedFunctionExecutable.cpp:
+        (JSC::UnlinkedFunctionExecutable::unlinkedCodeBlockFor):
+        (JSC::UnlinkedFunctionExecutable::finalizeUnconditionally):
+        * bytecode/UnlinkedFunctionExecutable.h:
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::emitAllocateRawObject):
+        * ftl/FTLLowerDFGToB3.cpp:
+        (JSC::FTL::DFG::LowerDFGToB3::emitNewTypedArrayWithSize):
+        (JSC::FTL::DFG::LowerDFGToB3::compileCompareStrictEq):
+        * generator/DSL.rb:
+        * heap/CodeBlockSet.h:
+        * heap/CodeBlockSetInlines.h:
+        (JSC::CodeBlockSet::iterateViaSubspaces): Deleted.
+        * heap/Heap.cpp:
+        (JSC::Heap::Heap):
+        (JSC::Heap::finalizeUnconditionalFinalizers):
+        (JSC::Heap::deleteAllCodeBlocks):
+        (JSC::Heap::deleteAllUnlinkedCodeBlocks):
+        (JSC::Heap::deleteUnmarkedCompiledCode):
+        (JSC::Heap::sweepInFinalize):
+        (JSC::Heap::addCoreConstraints):
+        * heap/Heap.h:
+        (JSC::Heap::gigacageAuxiliarySpace):
+        (JSC::Heap::SpaceAndSet::SpaceAndSet):
+        (JSC::Heap::SpaceAndSet::setFor):
+        (JSC::Heap::forEachCodeBlockSpace):
+        (JSC::Heap::forEachScriptExecutableSpace):
+        * heap/HeapSubspaceTypes.h: Added.
+        * heap/IsoHeapCellType.h:
+        * heap/IsoInlinedHeapCellType.h:
+        * heap/IsoInlinedHeapCellTypeInlines.h: Added.
+        (JSC::IsoInlinedHeapCellType<CellType>::IsoInlinedHeapCellType):
+        (JSC::IsoInlinedHeapCellType<CellType>::DestroyFunc::operator const):
+        (JSC::IsoInlinedHeapCellType<CellType>::finishSweep const):
+        (JSC::IsoInlinedHeapCellType<CellType>::destroy const):
+        * heap/MarkedBlockInlines.h:
+        * inspector/JSInjectedScriptHostPrototype.h:
+        * inspector/JSJavaScriptCallFramePrototype.h:
+        * interpreter/CallFrame.h:
+        * jsc.cpp:
+        (JSCMemoryFootprint::subspaceFor):
+        (JSFileDescriptor::subspaceFor):
+        * runtime/AggregateErrorPrototype.h:
+        * runtime/ArrayIteratorPrototype.h:
+        * runtime/AsyncFromSyncIteratorPrototype.h:
+        * runtime/AsyncFunctionPrototype.h:
+        * runtime/AsyncGeneratorFunctionPrototype.h:
+        * runtime/AsyncGeneratorPrototype.h:
+        * runtime/AsyncIteratorPrototype.h:
+        * runtime/AtomicsObject.h:
+        * runtime/BigIntPrototype.h:
+        * runtime/BrandedStructure.h:
+        * runtime/ButterflyInlines.h:
+        (JSC::Butterfly::tryCreateUninitialized):
+        (JSC::Butterfly::createUninitialized):
+        (JSC::Butterfly::tryCreate):
+        (JSC::Butterfly::growArrayRight):
+        (JSC::Butterfly::reallocArrayRightIfPossible):
+        * runtime/CachedTypes.h:
+        * runtime/ClonedArguments.h:
+        * runtime/ConsoleObject.h:
+        * runtime/CustomGetterSetter.h:
+        (JSC::CustomGetterSetter::subspaceFor):
+        * runtime/DOMAttributeGetterSetter.h:
+        * runtime/DateInstance.h:
+        * runtime/DatePrototype.h:
+        * runtime/DirectArguments.h:
+        * runtime/ErrorPrototype.h:
+        * runtime/Exception.h:
+        * runtime/FinalizationRegistryPrototype.h:
+        * runtime/FunctionExecutable.h:
+        * runtime/GeneratorFunctionPrototype.h:
+        * runtime/GeneratorPrototype.h:
+        * runtime/GetterSetter.h:
+        * runtime/HashMapImpl.h:
+        (JSC::HashMapBuffer::create):
+        * runtime/InternalFunction.h:
+        (JSC::InternalFunction::subspaceFor):
+        * runtime/IntlCollatorPrototype.h:
+        * runtime/IntlDateTimeFormatPrototype.h:
+        * runtime/IntlDisplayNamesPrototype.h:
+        * runtime/IntlListFormatPrototype.h:
+        * runtime/IntlLocalePrototype.h:
+        * runtime/IntlNumberFormatPrototype.h:
+        * runtime/IntlObject.h:
+        * runtime/IntlPluralRulesPrototype.h:
+        * runtime/IntlRelativeTimeFormatPrototype.h:
+        * runtime/IntlSegmentIteratorPrototype.h:
+        * runtime/IntlSegmenterPrototype.h:
+        * runtime/IntlSegmentsPrototype.h:
+        * runtime/IteratorPrototype.h:
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::tryCreateUninitializedRestricted):
+        * runtime/JSArray.h:
+        (JSC::JSArray::subspaceFor):
+        (JSC::JSArray::tryCreate):
+        * runtime/JSArrayBufferPrototype.h:
+        * runtime/JSArrayBufferView.cpp:
+        (JSC::JSArrayBufferView::ConstructionContext::ConstructionContext):
+        * runtime/JSBigInt.cpp:
+        (JSC::JSBigInt::createWithLength):
+        * runtime/JSBigInt.h:
+        * runtime/JSCallee.h:
+        (JSC::JSCallee::subspaceFor):
+        * runtime/JSDataViewPrototype.h:
+        * runtime/JSFunction.h:
+        (JSC::JSFunction::subspaceFor):
+        * runtime/JSGenericTypedArrayViewPrototype.h:
+        * runtime/JSGlobalLexicalEnvironment.h:
+        * runtime/JSImmutableButterfly.h:
+        (JSC::JSImmutableButterfly::subspaceFor):
+        * runtime/JSLexicalEnvironment.h:
+        (JSC::JSLexicalEnvironment::subspaceFor):
+        * runtime/JSModuleLoader.h:
+        * runtime/JSONObject.h:
+        * runtime/JSObjectInlines.h:
+        (JSC::JSFinalObject::subspaceFor):
+        * runtime/JSPromise.h:
+        (JSC::JSPromise::subspaceFor):
+        * runtime/JSPromisePrototype.h:
+        (JSC::JSPromisePrototype::subspaceFor):
+        * runtime/JSPropertyNameEnumerator.cpp:
+        (JSC::JSPropertyNameEnumerator::create):
+        * runtime/JSPropertyNameEnumerator.h:
+        * runtime/JSProxy.h:
+        (JSC::JSProxy::subspaceFor):
+        * runtime/JSString.h:
+        (JSC::JSString::subspaceFor):
+        * runtime/JSTypedArrayViewPrototype.h:
+        * runtime/MapIteratorPrototype.h:
+        * runtime/MapPrototype.h:
+        * runtime/MathObject.h:
+        * runtime/NativeErrorPrototype.h:
+        * runtime/NativeExecutable.h:
+        * runtime/NumberObject.h:
+        (JSC::NumberObject::subspaceFor):
+        * runtime/ObjectPrototype.h:
+        * runtime/ProgramExecutable.h:
+        * runtime/PropertyTable.h:
+        * runtime/ReflectObject.h:
+        * runtime/RegExp.h:
+        * runtime/RegExpObject.h:
+        * runtime/RegExpPrototype.h:
+        * runtime/RegExpStringIteratorPrototype.h:
+        * runtime/ScopedArguments.cpp:
+        (JSC::ScopedArguments::createUninitialized):
+        * runtime/ScopedArguments.h:
+        * runtime/SetIteratorPrototype.h:
+        * runtime/SetPrototype.h:
+        * runtime/ShadowRealmPrototype.h:
+        * runtime/SparseArrayValueMap.h:
+        * runtime/StringIteratorPrototype.h:
+        * runtime/StringObject.h:
+        (JSC::StringObject::subspaceFor):
+        * runtime/Structure.h:
+        (JSC::Structure::subspaceFor):
+        * runtime/StructureChain.cpp:
+        (JSC::StructureChain::create):
+        * runtime/StructureChain.h:
+        * runtime/StructureRareData.h:
+        * runtime/SymbolPrototype.h:
+        * runtime/SymbolTable.h:
+        * runtime/TemporalCalendarPrototype.h:
+        * runtime/TemporalDurationPrototype.h:
+        * runtime/TemporalInstantPrototype.h:
+        * runtime/TemporalNow.h:
+        * runtime/TemporalObject.h:
+        * runtime/TemporalPlainTimePrototype.h:
+        * runtime/TemporalTimeZonePrototype.h:
+        * runtime/ThrowScope.cpp:
+        * runtime/VM.cpp:
+        (JSC::VM::VM):
+        * runtime/VM.h:
+        (JSC::VM::cellHeapCellType):
+        (JSC::VM::destructibleObjectHeapCellType):
+        (JSC::VM::primitiveGigacageAuxiliarySpace):
+        (JSC::VM::jsValueGigacageAuxiliarySpace):
+        (JSC::VM::immutableButterflyJSValueGigacageAuxiliarySpace):
+        (JSC::VM::gigacageAuxiliarySpace):
+        (JSC::VM::cellSpace):
+        (JSC::VM::variableSizedCellSpace):
+        (JSC::VM::destructibleObjectSpace):
+        (JSC::VM::arraySpace):
+        (JSC::VM::bigIntSpace):
+        (JSC::VM::calleeSpace):
+        (JSC::VM::clonedArgumentsSpace):
+        (JSC::VM::customGetterSetterSpace):
+        (JSC::VM::dateInstanceSpace):
+        (JSC::VM::domAttributeGetterSetterSpace):
+        (JSC::VM::exceptionSpace):
+        (JSC::VM::executableToCodeBlockEdgeSpace):
+        (JSC::VM::functionSpace):
+        (JSC::VM::getterSetterSpace):
+        (JSC::VM::globalLexicalEnvironmentSpace):
+        (JSC::VM::internalFunctionSpace):
+        (JSC::VM::jsProxySpace):
+        (JSC::VM::nativeExecutableSpace):
+        (JSC::VM::numberObjectSpace):
+        (JSC::VM::plainObjectSpace):
+        (JSC::VM::promiseSpace):
+        (JSC::VM::propertyNameEnumeratorSpace):
+        (JSC::VM::propertyTableSpace):
+        (JSC::VM::regExpSpace):
+        (JSC::VM::regExpObjectSpace):
+        (JSC::VM::ropeStringSpace):
+        (JSC::VM::scopedArgumentsSpace):
+        (JSC::VM::sparseArrayValueMapSpace):
+        (JSC::VM::stringSpace):
+        (JSC::VM::stringObjectSpace):
+        (JSC::VM::structureChainSpace):
+        (JSC::VM::structureRareDataSpace):
+        (JSC::VM::structureSpace):
+        (JSC::VM::brandedStructureSpace):
+        (JSC::VM::symbolTableSpace):
+        (JSC::VM::executableToCodeBlockEdgesWithConstraints):
+        (JSC::VM::executableToCodeBlockEdgesWithFinalizers):
+        (JSC::VM::codeBlockSpace):
+        (JSC::VM::functionExecutableSpace):
+        (JSC::VM::programExecutableSpace):
+        (JSC::VM::unlinkedFunctionExecutableSpace):
+        (JSC::VM::setFuzzerAgent): Deleted.
+        (JSC::VM::SpaceAndSet::SpaceAndSet): Deleted.
+        (JSC::VM::SpaceAndSet::setFor): Deleted.
+        (JSC::VM::forEachCodeBlockSpace): Deleted.
+        (JSC::VM::forEachScriptExecutableSpace): Deleted.
+        * runtime/VMInlines.h:
+        (JSC::VM::setFuzzerAgent):
+        * runtime/WeakMapPrototype.h:
+        * runtime/WeakObjectRefPrototype.h:
+        * runtime/WeakSetPrototype.h:
+        * tools/JSDollarVM.cpp:
+        * tools/JSDollarVM.h:
+        * wasm/js/JSWebAssembly.h:
+        * wasm/js/WebAssemblyCompileErrorPrototype.h:
+        * wasm/js/WebAssemblyExceptionPrototype.h:
+        * wasm/js/WebAssemblyGlobalPrototype.h:
+        * wasm/js/WebAssemblyInstancePrototype.h:
+        * wasm/js/WebAssemblyLinkErrorPrototype.h:
+        * wasm/js/WebAssemblyMemoryPrototype.h:
+        * wasm/js/WebAssemblyModulePrototype.h:
+        * wasm/js/WebAssemblyRuntimeErrorPrototype.h:
+        * wasm/js/WebAssemblyTablePrototype.h:
+        * wasm/js/WebAssemblyTagPrototype.h:
+
</ins><span class="cx"> 2021-11-30  Keith Miller  <keith_miller@apple.com>
</span><span class="cx"> 
</span><span class="cx">         Structures should be allocated out of an aligned pool of memory so StructureID->Structure* is fast.
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreJavaScriptCorexcodeprojprojectpbxproj"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj (286346 => 286347)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj     2021-12-01 02:56:24 UTC (rev 286346)
+++ trunk/Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj        2021-12-01 04:38:56 UTC (rev 286347)
</span><span class="lines">@@ -1961,7 +1961,7 @@
</span><span class="cx">          E3C694B323026877006FBE42 /* WasmOSREntryData.h in Headers */ = {isa = PBXBuildFile; fileRef = E3C694B123026873006FBE42 /* WasmOSREntryData.h */; settings = {ATTRIBUTES = (Private, ); }; };
</span><span class="cx">          E3C73A9125BFA73B00EFE303 /* WasmStreamingPlan.h in Headers */ = {isa = PBXBuildFile; fileRef = E3C73A9025BFA73400EFE303 /* WasmStreamingPlan.h */; };
</span><span class="cx">          E3C79CAB1DB9A4DC00D1ECA4 /* DOMJITEffect.h in Headers */ = {isa = PBXBuildFile; fileRef = E3C79CAA1DB9A4D600D1ECA4 /* DOMJITEffect.h */; settings = {ATTRIBUTES = (Private, ); }; };
</span><del>-               E3C8ED4323A1DBCB00131958 /* IsoInlinedHeapCellType.h in Headers */ = {isa = PBXBuildFile; fileRef = E3C8ED4223A1DBC500131958 /* IsoInlinedHeapCellType.h */; };
</del><ins>+                E3C8ED4323A1DBCB00131958 /* IsoInlinedHeapCellType.h in Headers */ = {isa = PBXBuildFile; fileRef = E3C8ED4223A1DBC500131958 /* IsoInlinedHeapCellType.h */; settings = {ATTRIBUTES = (Private, ); }; };
</ins><span class="cx">           E3CA3A4E2527AB2F004802BF /* JITOperationList.h in Headers */ = {isa = PBXBuildFile; fileRef = E3CA3A4C2527AB2F004802BF /* JITOperationList.h */; settings = {ATTRIBUTES = (Private, ); }; };
</span><span class="cx">          E3D239C91B829C1C00BBEF67 /* JSModuleEnvironment.h in Headers */ = {isa = PBXBuildFile; fileRef = E3D239C71B829C1C00BBEF67 /* JSModuleEnvironment.h */; settings = {ATTRIBUTES = (Private, ); }; };
</span><span class="cx">          E3D3515F241B89D7008DC16E /* MarkedJSValueRefArray.h in Headers */ = {isa = PBXBuildFile; fileRef = E3D3515D241B89CE008DC16E /* MarkedJSValueRefArray.h */; };
</span><span class="lines">@@ -2012,6 +2012,7 @@
</span><span class="cx">          FE20CE9E15F04A9500DF3430 /* LLIntCLoop.h in Headers */ = {isa = PBXBuildFile; fileRef = FE20CE9C15F04A9500DF3430 /* LLIntCLoop.h */; settings = {ATTRIBUTES = (Private, ); }; };
</span><span class="cx">          FE287D02252FB2E800D723F9 /* VerifierSlotVisitor.h in Headers */ = {isa = PBXBuildFile; fileRef = FE287D01252FB2E800D723F9 /* VerifierSlotVisitor.h */; settings = {ATTRIBUTES = (Private, ); }; };
</span><span class="cx">          FE2A87601F02381600EB31B2 /* MinimumReservedZoneSize.h in Headers */ = {isa = PBXBuildFile; fileRef = FE2A875F1F02381600EB31B2 /* MinimumReservedZoneSize.h */; };
</span><ins>+               FE2CC9302756B2B9003F5AB8 /* HeapSubspaceTypes.h in Headers */ = {isa = PBXBuildFile; fileRef = FE2CC92F2756B2B9003F5AB8 /* HeapSubspaceTypes.h */; settings = {ATTRIBUTES = (Private, ); }; };
</ins><span class="cx">           FE3022D31E3D73A500BAC493 /* SigillCrashAnalyzer.h in Headers */ = {isa = PBXBuildFile; fileRef = FE3022D11E3D739600BAC493 /* SigillCrashAnalyzer.h */; settings = {ATTRIBUTES = (Private, ); }; };
</span><span class="cx">          FE3022D71E42857300BAC493 /* VMInspector.h in Headers */ = {isa = PBXBuildFile; fileRef = FE3022D51E42856700BAC493 /* VMInspector.h */; };
</span><span class="cx">          FE336B5325DB497D0098F034 /* MarkingConstraintExecutorPair.h in Headers */ = {isa = PBXBuildFile; fileRef = FE336B5225DB497D0098F034 /* MarkingConstraintExecutorPair.h */; };
</span><span class="lines">@@ -2043,6 +2044,7 @@
</span><span class="cx">          FE63DD541EA9B61E00103A69 /* Printer.h in Headers */ = {isa = PBXBuildFile; fileRef = FE63DD531EA9B60E00103A69 /* Printer.h */; settings = {ATTRIBUTES = (Private, ); }; };
</span><span class="cx">          FE64872E2141D04800AB0D3E /* OpcodeInlines.h in Headers */ = {isa = PBXBuildFile; fileRef = FE64872D2141D04800AB0D3E /* OpcodeInlines.h */; settings = {ATTRIBUTES = (Private, ); }; };
</span><span class="cx">          FE6491371D78F01D00A694D4 /* ExceptionScope.h in Headers */ = {isa = PBXBuildFile; fileRef = FE6491361D78F01300A694D4 /* ExceptionScope.h */; settings = {ATTRIBUTES = (Private, ); }; };
</span><ins>+               FE65B1512748601F00DB5B16 /* IsoInlinedHeapCellTypeInlines.h in Headers */ = {isa = PBXBuildFile; fileRef = FE65B1502748601F00DB5B16 /* IsoInlinedHeapCellTypeInlines.h */; };
</ins><span class="cx">           FE68C6371B90DE040042BCB3 /* MacroAssemblerPrinter.h in Headers */ = {isa = PBXBuildFile; fileRef = FE68C6361B90DDD90042BCB3 /* MacroAssemblerPrinter.h */; settings = {ATTRIBUTES = (Private, ); }; };
</span><span class="cx">          FE6F56DE1E64EAD600D17801 /* VMTraps.h in Headers */ = {isa = PBXBuildFile; fileRef = FE6F56DD1E64E92000D17801 /* VMTraps.h */; settings = {ATTRIBUTES = (Private, ); }; };
</span><span class="cx">          FE7497E6209001B10003565B /* JSCPtrTag.h in Headers */ = {isa = PBXBuildFile; fileRef = FE7497E5209001B00003565B /* JSCPtrTag.h */; settings = {ATTRIBUTES = (Private, ); }; };
</span><span class="lines">@@ -5441,6 +5443,7 @@
</span><span class="cx">          FE287D01252FB2E800D723F9 /* VerifierSlotVisitor.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = VerifierSlotVisitor.h; sourceTree = "<group>"; };
</span><span class="cx">          FE2A875F1F02381600EB31B2 /* MinimumReservedZoneSize.h */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.c.h; path = MinimumReservedZoneSize.h; sourceTree = "<group>"; };
</span><span class="cx">          FE2BD66E25C0DC8200999D3B /* VerifierSlotVisitor.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = VerifierSlotVisitor.cpp; sourceTree = "<group>"; };
</span><ins>+               FE2CC92F2756B2B9003F5AB8 /* HeapSubspaceTypes.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = HeapSubspaceTypes.h; sourceTree = "<group>"; };
</ins><span class="cx">           FE2E6A7A1D6EA5FE0060F896 /* ThrowScope.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ThrowScope.cpp; sourceTree = "<group>"; };
</span><span class="cx">          FE3022D01E3D739600BAC493 /* SigillCrashAnalyzer.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = SigillCrashAnalyzer.cpp; sourceTree = "<group>"; };
</span><span class="cx">          FE3022D11E3D739600BAC493 /* SigillCrashAnalyzer.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = SigillCrashAnalyzer.h; sourceTree = "<group>"; };
</span><span class="lines">@@ -5503,6 +5506,7 @@
</span><span class="cx">          FE64872D2141D04800AB0D3E /* OpcodeInlines.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = OpcodeInlines.h; sourceTree = "<group>"; };
</span><span class="cx">          FE6491361D78F01300A694D4 /* ExceptionScope.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ExceptionScope.h; sourceTree = "<group>"; };
</span><span class="cx">          FE6491381D78F3A300A694D4 /* ExceptionScope.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ExceptionScope.cpp; sourceTree = "<group>"; };
</span><ins>+               FE65B1502748601F00DB5B16 /* IsoInlinedHeapCellTypeInlines.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = IsoInlinedHeapCellTypeInlines.h; sourceTree = "<group>"; };
</ins><span class="cx">           FE68C6351B90DDD90042BCB3 /* MacroAssemblerPrinter.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = MacroAssemblerPrinter.cpp; sourceTree = "<group>"; };
</span><span class="cx">          FE68C6361B90DDD90042BCB3 /* MacroAssemblerPrinter.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = MacroAssemblerPrinter.h; sourceTree = "<group>"; };
</span><span class="cx">          FE6F56DC1E64E92000D17801 /* VMTraps.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = VMTraps.cpp; sourceTree = "<group>"; };
</span><span class="lines">@@ -6594,6 +6598,7 @@
</span><span class="cx">                          A54C2AAF1C6544D100A18D78 /* HeapSnapshot.h */,
</span><span class="cx">                          A5311C341C77CEAC00E6B1B6 /* HeapSnapshotBuilder.cpp */,
</span><span class="cx">                          A5311C351C77CEAC00E6B1B6 /* HeapSnapshotBuilder.h */,
</span><ins>+                               FE2CC92F2756B2B9003F5AB8 /* HeapSubspaceTypes.h */,
</ins><span class="cx">                           0FADE6721D4D23BC00768457 /* HeapUtil.h */,
</span><span class="cx">                          C25F8BCB157544A900245B71 /* IncrementalSweeper.cpp */,
</span><span class="cx">                          C25F8BCC157544A900245B71 /* IncrementalSweeper.h */,
</span><span class="lines">@@ -6605,6 +6610,7 @@
</span><span class="cx">                          E3C8ED4123A1DBC400131958 /* IsoHeapCellType.cpp */,
</span><span class="cx">                          E3BF1BAD238AAED1003A1C2B /* IsoHeapCellType.h */,
</span><span class="cx">                          E3C8ED4223A1DBC500131958 /* IsoInlinedHeapCellType.h */,
</span><ins>+                               FE65B1502748601F00DB5B16 /* IsoInlinedHeapCellTypeInlines.h */,
</ins><span class="cx">                           537FEECD2742BDE000C9EFEE /* IsoMemoryAllocatorBase.h */,
</span><span class="cx">                          537FEECA2742BDE000C9EFEE /* IsoMemoryAllocatorBaseInlines.h */,
</span><span class="cx">                          0FDCE12C1FAFB4DE006F3901 /* IsoSubspace.cpp */,
</span><span class="lines">@@ -10420,6 +10426,7 @@
</span><span class="cx">                          E33F50811B8429A400413856 /* JSInternalPromise.h in Headers */,
</span><span class="cx">                          E33F50791B84225700413856 /* JSInternalPromiseConstructor.h in Headers */,
</span><span class="cx">                          E33F50871B8449EF00413856 /* JSInternalPromiseConstructor.lut.h in Headers */,
</span><ins>+                               FE65B1512748601F00DB5B16 /* IsoInlinedHeapCellTypeInlines.h in Headers */,
</ins><span class="cx">                           E33F50751B8421C000413856 /* JSInternalPromisePrototype.h in Headers */,
</span><span class="cx">                          A503FA1E188E0FB000110F14 /* JSJavaScriptCallFramePrototype.h in Headers */,
</span><span class="cx">                          BC18C4160E16F5CD00B34460 /* JSLexicalEnvironment.h in Headers */,
</span><span class="lines">@@ -10948,6 +10955,7 @@
</span><span class="cx">                          E337B967224324EA0093A820 /* WasmCapabilities.h in Headers */,
</span><span class="cx">                          526AC4B71E977C5D003500E1 /* WasmCodeBlock.h in Headers */,
</span><span class="cx">                          E3BD2B7622F275020011765C /* WasmCompilationMode.h in Headers */,
</span><ins>+                               FE2CC9302756B2B9003F5AB8 /* HeapSubspaceTypes.h in Headers */,
</ins><span class="cx">                           AD412B341E7B2E9E008AF157 /* WasmContext.h in Headers */,
</span><span class="cx">                          7593C898BE714A64BE93A6E7 /* WasmContextInlines.h in Headers */,
</span><span class="cx">                          E36CC9472086314F0051FFD6 /* WasmCreationMode.h in Headers */,
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorebytecodeAccessCasecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/bytecode/AccessCase.cpp (286346 => 286347)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/bytecode/AccessCase.cpp      2021-12-01 02:56:24 UTC (rev 286346)
+++ trunk/Source/JavaScriptCore/bytecode/AccessCase.cpp 2021-12-01 04:38:56 UTC (rev 286347)
</span><span class="lines">@@ -2277,7 +2277,7 @@
</span><span class="cx">             size_t newSize = newStructure()->outOfLineCapacity() * sizeof(JSValue);
</span><span class="cx"> 
</span><span class="cx">             if (allocatingInline) {
</span><del>-                Allocator allocator = vm.jsValueGigacageAuxiliarySpace.allocatorFor(newSize, AllocatorForMode::AllocatorIfExists);
</del><ins>+                Allocator allocator = vm.jsValueGigacageAuxiliarySpace().allocatorFor(newSize, AllocatorForMode::AllocatorIfExists);
</ins><span class="cx"> 
</span><span class="cx">                 jit.emitAllocate(scratchGPR, JITAllocator::constant(allocator), scratchGPR2, scratchGPR3, slowPath);
</span><span class="cx">                 jit.addPtr(CCallHelpers::TrustedImm32(newSize + sizeof(IndexingHeader)), scratchGPR);
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorebytecodeDFGExitProfileh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/bytecode/DFGExitProfile.h (286346 => 286347)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/bytecode/DFGExitProfile.h    2021-12-01 02:56:24 UTC (rev 286346)
+++ trunk/Source/JavaScriptCore/bytecode/DFGExitProfile.h       2021-12-01 04:38:56 UTC (rev 286347)
</span><span class="lines">@@ -1,5 +1,5 @@
</span><span class="cx"> /*
</span><del>- * Copyright (C) 2011-2019 Apple Inc. All rights reserved.
</del><ins>+ * Copyright (C) 2011-2021 Apple Inc. All rights reserved.
</ins><span class="cx">  *
</span><span class="cx">  * Redistribution and use in source and binary forms, with or without
</span><span class="cx">  * modification, are permitted provided that the following conditions
</span><span class="lines">@@ -34,8 +34,12 @@
</span><span class="cx"> #include <wtf/HashSet.h>
</span><span class="cx"> #include <wtf/Vector.h>
</span><span class="cx"> 
</span><del>-namespace JSC { namespace DFG {
</del><ins>+namespace JSC {
</ins><span class="cx"> 
</span><ins>+class UnlinkedCodeBlock;
+
+namespace DFG {
+
</ins><span class="cx"> class FrequentExitSite {
</span><span class="cx"> public:
</span><span class="cx">     FrequentExitSite()
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorebytecodeEvalCodeBlockh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/bytecode/EvalCodeBlock.h (286346 => 286347)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/bytecode/EvalCodeBlock.h     2021-12-01 02:56:24 UTC (rev 286346)
+++ trunk/Source/JavaScriptCore/bytecode/EvalCodeBlock.h        2021-12-01 04:38:56 UTC (rev 286347)
</span><span class="lines">@@ -41,7 +41,7 @@
</span><span class="cx">     template<typename, SubspaceAccess>
</span><span class="cx">     static IsoSubspace* subspaceFor(VM& vm)
</span><span class="cx">     {
</span><del>-        return &vm.codeBlockSpace.space;
</del><ins>+        return &vm.codeBlockSpace().space;
</ins><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     static EvalCodeBlock* create(VM& vm, CopyParsedBlockTag, EvalCodeBlock& other)
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorebytecodeExecutableToCodeBlockEdgecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/bytecode/ExecutableToCodeBlockEdge.cpp (286346 => 286347)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/bytecode/ExecutableToCodeBlockEdge.cpp       2021-12-01 02:56:24 UTC (rev 286346)
+++ trunk/Source/JavaScriptCore/bytecode/ExecutableToCodeBlockEdge.cpp  2021-12-01 04:38:56 UTC (rev 286347)
</span><span class="lines">@@ -81,7 +81,7 @@
</span><span class="cx">         visitor.appendUnbarriered(codeBlock);
</span><span class="cx">     
</span><span class="cx">     if (!visitor.isMarked(codeBlock))
</span><del>-        vm.executableToCodeBlockEdgesWithFinalizers.add(edge);
</del><ins>+        vm.executableToCodeBlockEdgesWithFinalizers().add(edge);
</ins><span class="cx">     
</span><span class="cx">     if (JITCode::isOptimizingJIT(codeBlock->jitType())) {
</span><span class="cx">         // If we jettison ourselves we'll install our alternative, so make sure that it
</span><span class="lines">@@ -114,7 +114,7 @@
</span><span class="cx">     // not yet marked because it weakly depends on a structure that we did not yet mark, then we
</span><span class="cx">     // will keep fixpointing until the end.
</span><span class="cx">     visitor.appendUnbarriered(codeBlock->globalObject());
</span><del>-    vm.executableToCodeBlockEdgesWithConstraints.add(edge);
</del><ins>+    vm.executableToCodeBlockEdgesWithConstraints().add(edge);
</ins><span class="cx">     edge->runConstraint(locker, vm, visitor);
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="lines">@@ -143,8 +143,8 @@
</span><span class="cx">         m_codeBlock.clear();
</span><span class="cx">     }
</span><span class="cx">     
</span><del>-    vm.executableToCodeBlockEdgesWithFinalizers.remove(this);
-    vm.executableToCodeBlockEdgesWithConstraints.remove(this);
</del><ins>+    vm.executableToCodeBlockEdgesWithFinalizers().remove(this);
+    vm.executableToCodeBlockEdgesWithConstraints().remove(this);
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> inline void ExecutableToCodeBlockEdge::activate()
</span><span class="lines">@@ -201,7 +201,7 @@
</span><span class="cx">     codeBlock->determineLiveness(locker, visitor);
</span><span class="cx"> 
</span><span class="cx">     if (visitor.isMarked(codeBlock))
</span><del>-        vm.executableToCodeBlockEdgesWithConstraints.remove(this);
</del><ins>+        vm.executableToCodeBlockEdgesWithConstraints().remove(this);
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> template void ExecutableToCodeBlockEdge::runConstraint(const ConcurrentJSLocker&, VM&, AbstractSlotVisitor&);
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorebytecodeExecutableToCodeBlockEdgeh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/bytecode/ExecutableToCodeBlockEdge.h (286346 => 286347)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/bytecode/ExecutableToCodeBlockEdge.h 2021-12-01 02:56:24 UTC (rev 286346)
+++ trunk/Source/JavaScriptCore/bytecode/ExecutableToCodeBlockEdge.h    2021-12-01 04:38:56 UTC (rev 286347)
</span><span class="lines">@@ -43,7 +43,7 @@
</span><span class="cx">     template<typename CellType, SubspaceAccess>
</span><span class="cx">     static IsoSubspace* subspaceFor(VM& vm)
</span><span class="cx">     {
</span><del>-        return &vm.executableToCodeBlockEdgeSpace;
</del><ins>+        return &vm.executableToCodeBlockEdgeSpace();
</ins><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     static Structure* createStructure(VM&, JSGlobalObject*, JSValue prototype);
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorebytecodeFunctionCodeBlockh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/bytecode/FunctionCodeBlock.h (286346 => 286347)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/bytecode/FunctionCodeBlock.h 2021-12-01 02:56:24 UTC (rev 286346)
+++ trunk/Source/JavaScriptCore/bytecode/FunctionCodeBlock.h    2021-12-01 04:38:56 UTC (rev 286347)
</span><span class="lines">@@ -42,7 +42,7 @@
</span><span class="cx">     template<typename, SubspaceAccess>
</span><span class="cx">     static IsoSubspace* subspaceFor(VM& vm)
</span><span class="cx">     {
</span><del>-        return &vm.codeBlockSpace.space;
</del><ins>+        return &vm.codeBlockSpace().space;
</ins><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     static FunctionCodeBlock* create(VM& vm, CopyParsedBlockTag, FunctionCodeBlock& other)
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorebytecodeModuleProgramCodeBlockh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/bytecode/ModuleProgramCodeBlock.h (286346 => 286347)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/bytecode/ModuleProgramCodeBlock.h    2021-12-01 02:56:24 UTC (rev 286346)
+++ trunk/Source/JavaScriptCore/bytecode/ModuleProgramCodeBlock.h       2021-12-01 04:38:56 UTC (rev 286347)
</span><span class="lines">@@ -42,7 +42,7 @@
</span><span class="cx">     template<typename, SubspaceAccess>
</span><span class="cx">     static IsoSubspace* subspaceFor(VM& vm)
</span><span class="cx">     {
</span><del>-        return &vm.codeBlockSpace.space;
</del><ins>+        return &vm.codeBlockSpace().space;
</ins><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     static ModuleProgramCodeBlock* create(VM& vm, CopyParsedBlockTag, ModuleProgramCodeBlock& other)
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorebytecodeProgramCodeBlockh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/bytecode/ProgramCodeBlock.h (286346 => 286347)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/bytecode/ProgramCodeBlock.h  2021-12-01 02:56:24 UTC (rev 286346)
+++ trunk/Source/JavaScriptCore/bytecode/ProgramCodeBlock.h     2021-12-01 04:38:56 UTC (rev 286347)
</span><span class="lines">@@ -42,7 +42,7 @@
</span><span class="cx">     template<typename, SubspaceAccess>
</span><span class="cx">     static IsoSubspace* subspaceFor(VM& vm)
</span><span class="cx">     {
</span><del>-        return &vm.codeBlockSpace.space;
</del><ins>+        return &vm.codeBlockSpace().space;
</ins><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     static ProgramCodeBlock* create(VM& vm, CopyParsedBlockTag, ProgramCodeBlock& other)
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorebytecodeRepatchh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/bytecode/Repatch.h (286346 => 286347)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/bytecode/Repatch.h   2021-12-01 02:56:24 UTC (rev 286346)
+++ trunk/Source/JavaScriptCore/bytecode/Repatch.h      2021-12-01 04:38:56 UTC (rev 286347)
</span><span class="lines">@@ -1,5 +1,5 @@
</span><span class="cx"> /*
</span><del>- * Copyright (C) 2011-2020 Apple Inc. All rights reserved.
</del><ins>+ * Copyright (C) 2011-2021 Apple Inc. All rights reserved.
</ins><span class="cx">  *
</span><span class="cx">  * Redistribution and use in source and binary forms, with or without
</span><span class="cx">  * modification, are permitted provided that the following conditions
</span><span class="lines">@@ -31,6 +31,7 @@
</span><span class="cx"> 
</span><span class="cx"> namespace JSC {
</span><span class="cx"> 
</span><ins>+class CallLinkInfo;
</ins><span class="cx"> class StructureStubInfo;
</span><span class="cx"> 
</span><span class="cx"> enum class GetByKind {
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorebytecodeUnlinkedFunctionExecutablecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/bytecode/UnlinkedFunctionExecutable.cpp (286346 => 286347)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/bytecode/UnlinkedFunctionExecutable.cpp      2021-12-01 02:56:24 UTC (rev 286346)
+++ trunk/Source/JavaScriptCore/bytecode/UnlinkedFunctionExecutable.cpp 2021-12-01 04:38:56 UTC (rev 286347)
</span><span class="lines">@@ -251,7 +251,7 @@
</span><span class="cx">         m_unlinkedCodeBlockForConstruct.set(vm, this, result);
</span><span class="cx">         break;
</span><span class="cx">     }
</span><del>-    vm.unlinkedFunctionExecutableSpace.set.add(this);
</del><ins>+    vm.unlinkedFunctionExecutableSpace().set.add(this);
</ins><span class="cx">     return result;
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="lines">@@ -310,7 +310,7 @@
</span><span class="cx">         clearIfDead(m_unlinkedCodeBlockForCall);
</span><span class="cx">         clearIfDead(m_unlinkedCodeBlockForConstruct);
</span><span class="cx">         if (isCleared && !isStillValid)
</span><del>-            vm.unlinkedFunctionExecutableSpace.set.remove(this);
</del><ins>+            vm.unlinkedFunctionExecutableSpace().set.remove(this);
</ins><span class="cx">     }
</span><span class="cx"> }
</span><span class="cx"> 
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorebytecodeUnlinkedFunctionExecutableh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/bytecode/UnlinkedFunctionExecutable.h (286346 => 286347)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/bytecode/UnlinkedFunctionExecutable.h        2021-12-01 02:56:24 UTC (rev 286346)
+++ trunk/Source/JavaScriptCore/bytecode/UnlinkedFunctionExecutable.h   2021-12-01 04:38:56 UTC (rev 286347)
</span><span class="lines">@@ -42,13 +42,14 @@
</span><span class="cx"> 
</span><span class="cx"> namespace JSC {
</span><span class="cx"> 
</span><ins>+class CachedFunctionExecutable;
</ins><span class="cx"> class Decoder;
</span><ins>+class FunctionExecutable;
</ins><span class="cx"> class FunctionMetadataNode;
</span><del>-class FunctionExecutable;
</del><span class="cx"> class ParserError;
</span><ins>+class ScriptExecutable;
</ins><span class="cx"> class SourceProvider;
</span><span class="cx"> class UnlinkedFunctionCodeBlock;
</span><del>-class CachedFunctionExecutable;
</del><span class="cx"> 
</span><span class="cx"> enum UnlinkedFunctionKind {
</span><span class="cx">     UnlinkedNormalFunction,
</span><span class="lines">@@ -67,7 +68,7 @@
</span><span class="cx">     template<typename CellType, SubspaceAccess>
</span><span class="cx">     static IsoSubspace* subspaceFor(VM& vm)
</span><span class="cx">     {
</span><del>-        return &vm.unlinkedFunctionExecutableSpace.space;
</del><ins>+        return &vm.unlinkedFunctionExecutableSpace().space;
</ins><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     static UnlinkedFunctionExecutable* create(VM& vm, const SourceCode& source, FunctionMetadataNode* node, UnlinkedFunctionKind unlinkedFunctionKind, ConstructAbility constructAbility, JSParserScriptMode scriptMode, RefPtr<TDZEnvironmentLink> parentScopeTDZVariables, std::optional<PrivateNameEnvironment> parentPrivateNameEnvironment, DerivedContextType derivedContextType, NeedsClassFieldInitializer needsClassFieldInitializer, PrivateBrandRequirement privateBrandRequirement, bool isBuiltinDefaultClassConstructor = false)
</span><span class="lines">@@ -131,7 +132,7 @@
</span><span class="cx">     {
</span><span class="cx">         m_unlinkedCodeBlockForCall.clear();
</span><span class="cx">         m_unlinkedCodeBlockForConstruct.clear();
</span><del>-        vm.unlinkedFunctionExecutableSpace.set.remove(this);
</del><ins>+        vm.unlinkedFunctionExecutableSpace().set.remove(this);
</ins><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     void recordParse(CodeFeatures features, LexicalScopeFeatures lexicalScopeFeatures, bool hasCapturedVariables)
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGSpeculativeJITcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp (286346 => 286347)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp    2021-12-01 02:56:24 UTC (rev 286346)
+++ trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp       2021-12-01 04:38:56 UTC (rev 286347)
</span><span class="lines">@@ -120,7 +120,7 @@
</span><span class="cx"> 
</span><span class="cx">     VM& vm = this->vm();
</span><span class="cx">     if (size) {
</span><del>-        if (Allocator allocator = vm.jsValueGigacageAuxiliarySpace.allocatorForNonVirtual(size, AllocatorForMode::AllocatorIfExists)) {
</del><ins>+        if (Allocator allocator = vm.jsValueGigacageAuxiliarySpace().allocatorForNonVirtual(size, AllocatorForMode::AllocatorIfExists)) {
</ins><span class="cx">             m_jit.emitAllocate(storageGPR, JITAllocator::constant(allocator), scratchGPR, scratch2GPR, slowCases);
</span><span class="cx">             
</span><span class="cx">             m_jit.addPtr(
</span><span class="lines">@@ -10737,7 +10737,7 @@
</span><span class="cx">     
</span><span class="cx">     size_t size = initialOutOfLineCapacity * sizeof(JSValue);
</span><span class="cx"> 
</span><del>-    Allocator allocator = vm().jsValueGigacageAuxiliarySpace.allocatorForNonVirtual(size, AllocatorForMode::AllocatorIfExists);
</del><ins>+    Allocator allocator = vm().jsValueGigacageAuxiliarySpace().allocatorForNonVirtual(size, AllocatorForMode::AllocatorIfExists);
</ins><span class="cx"> 
</span><span class="cx">     if (!allocator || node->transition()->previous->couldHaveIndexingHeader()) {
</span><span class="cx">         SpeculateCellOperand base(this, node->child1());
</span><span class="lines">@@ -10781,7 +10781,7 @@
</span><span class="cx">     size_t newSize = oldSize * outOfLineGrowthFactor;
</span><span class="cx">     ASSERT(newSize == node->transition()->next->outOfLineCapacity() * sizeof(JSValue));
</span><span class="cx">     
</span><del>-    Allocator allocator = vm().jsValueGigacageAuxiliarySpace.allocatorForNonVirtual(newSize, AllocatorForMode::AllocatorIfExists);
</del><ins>+    Allocator allocator = vm().jsValueGigacageAuxiliarySpace().allocatorForNonVirtual(newSize, AllocatorForMode::AllocatorIfExists);
</ins><span class="cx"> 
</span><span class="cx">     if (!allocator || node->transition()->previous->couldHaveIndexingHeader()) {
</span><span class="cx">         SpeculateCellOperand base(this, node->child1());
</span><span class="lines">@@ -11498,7 +11498,7 @@
</span><span class="cx">         m_jit.and32(TrustedImm32(~7), scratchGPR);
</span><span class="cx">     }
</span><span class="cx">     m_jit.emitAllocateVariableSized(
</span><del>-        storageGPR, vm().primitiveGigacageAuxiliarySpace, scratchGPR, scratchGPR,
</del><ins>+        storageGPR, vm().primitiveGigacageAuxiliarySpace(), scratchGPR, scratchGPR,
</ins><span class="cx">         scratchGPR2, slowCases);
</span><span class="cx">     
</span><span class="cx">     MacroAssembler::Jump done = m_jit.branchTest32(MacroAssembler::Zero, sizeGPR);
</span><span class="lines">@@ -13699,7 +13699,7 @@
</span><span class="cx">     didNotOverflow.link(&m_jit);
</span><span class="cx"> #endif
</span><span class="cx">     m_jit.emitAllocateVariableSized(
</span><del>-        storageResultGPR, vm().jsValueGigacageAuxiliarySpace, scratch2, scratch1, scratch3, slowCases);
</del><ins>+        storageResultGPR, vm().jsValueGigacageAuxiliarySpace(), scratch2, scratch1, scratch3, slowCases);
</ins><span class="cx">     m_jit.addPtr(TrustedImm32(sizeof(IndexingHeader)), storageResultGPR);
</span><span class="cx"> 
</span><span class="cx">     m_jit.store32(sizeGPR, MacroAssembler::Address(storageResultGPR, Butterfly::offsetOfPublicLength()));
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreftlFTLLowerDFGToB3cpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp (286346 => 286347)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp      2021-12-01 02:56:24 UTC (rev 286346)
+++ trunk/Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp 2021-12-01 04:38:56 UTC (rev 286347)
</span><span class="lines">@@ -8301,7 +8301,7 @@
</span><span class="cx">                 m_out.constIntPtr(~static_cast<intptr_t>(7)));
</span><span class="cx">         }
</span><span class="cx"> 
</span><del>-        LValue allocator = allocatorForSize(vm().primitiveGigacageAuxiliarySpace, byteSize, slowCase);
</del><ins>+        LValue allocator = allocatorForSize(vm().primitiveGigacageAuxiliarySpace(), byteSize, slowCase);
</ins><span class="cx">         LValue storage = allocateHeapCell(allocator, slowCase);
</span><span class="cx"> 
</span><span class="cx">         splatWords(
</span><span class="lines">@@ -13922,7 +13922,7 @@
</span><span class="cx">                 ValueFromBlock noButterfly = m_out.anchor(m_out.intPtrZero);
</span><span class="cx">                 
</span><span class="cx">                 LValue startOfStorage = allocateHeapCell(
</span><del>-                    allocatorForSize(vm().jsValueGigacageAuxiliarySpace, butterflySize, slowPath),
</del><ins>+                    allocatorForSize(vm().jsValueGigacageAuxiliarySpace(), butterflySize, slowPath),
</ins><span class="cx">                     slowPath);
</span><span class="cx"> 
</span><span class="cx">                 LValue fastButterflyValue = m_out.add(
</span><span class="lines">@@ -15017,7 +15017,7 @@
</span><span class="cx">         LBasicBlock lastNext = m_out.insertNewBlocksBefore(slowPath);
</span><span class="cx"> 
</span><span class="cx">         size_t sizeInBytes = sizeInValues * sizeof(JSValue);
</span><del>-        Allocator allocator = vm().jsValueGigacageAuxiliarySpace.allocatorForNonVirtual(sizeInBytes, AllocatorForMode::AllocatorIfExists);
</del><ins>+        Allocator allocator = vm().jsValueGigacageAuxiliarySpace().allocatorForNonVirtual(sizeInBytes, AllocatorForMode::AllocatorIfExists);
</ins><span class="cx">         LValue startOfStorage = allocateHeapCell(
</span><span class="cx">             m_out.constIntPtr(allocator.localAllocator()), slowPath);
</span><span class="cx">         ValueFromBlock fastButterfly = m_out.anchor(
</span><span class="lines">@@ -17039,7 +17039,7 @@
</span><span class="cx">         LValue butterflySize = m_out.add(
</span><span class="cx">             payloadSize, m_out.constIntPtr(sizeof(IndexingHeader)));
</span><span class="cx"> 
</span><del>-        LValue allocator = allocatorForSize(vm().jsValueGigacageAuxiliarySpace, butterflySize, failCase);
</del><ins>+        LValue allocator = allocatorForSize(vm().jsValueGigacageAuxiliarySpace(), butterflySize, failCase);
</ins><span class="cx">         LValue startOfStorage = allocateHeapCell(allocator, failCase);
</span><span class="cx"> 
</span><span class="cx">         LValue butterfly = m_out.add(startOfStorage, m_out.constIntPtr(sizeof(IndexingHeader)));
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoregeneratorDSLrb"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/generator/DSL.rb (286346 => 286347)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/generator/DSL.rb     2021-12-01 02:56:24 UTC (rev 286346)
+++ trunk/Source/JavaScriptCore/generator/DSL.rb        2021-12-01 04:38:56 UTC (rev 286347)
</span><span class="lines">@@ -1,4 +1,4 @@
</span><del>-# Copyright (C) 2018 Apple Inc. All rights reserved.
</del><ins>+# Copyright (C) 2018-2021 Apple Inc. All rights reserved.
</ins><span class="cx"> #
</span><span class="cx"> # Redistribution and use in source and binary forms, with or without
</span><span class="cx"> # modification, are permitted provided that the following conditions
</span><span class="lines">@@ -147,6 +147,8 @@
</span><span class="cx"> 
</span><span class="cx"> namespace JSC {
</span><span class="cx"> 
</span><ins>+class BasicBlockLocation;
+
</ins><span class="cx"> void dumpBytecode(BytecodeDumperBase* dumper, InstructionStream::Offset, const Instruction*);
</span><span class="cx"> 
</span><span class="cx"> #if ENABLE(WEBASSEMBLY)
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreheapCodeBlockSeth"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/heap/CodeBlockSet.h (286346 => 286347)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/heap/CodeBlockSet.h  2021-12-01 02:56:24 UTC (rev 286346)
+++ trunk/Source/JavaScriptCore/heap/CodeBlockSet.h     2021-12-01 04:38:56 UTC (rev 286347)
</span><span class="lines">@@ -66,8 +66,6 @@
</span><span class="cx">     template<typename Functor> void iterate(const Functor&);
</span><span class="cx">     template<typename Functor> void iterate(const AbstractLocker&, const Functor&);
</span><span class="cx"> 
</span><del>-    template<typename Functor> void iterateViaSubspaces(VM&, const Functor&);
-    
</del><span class="cx">     template<typename Functor> void iterateCurrentlyExecuting(const Functor&);
</span><span class="cx">     
</span><span class="cx">     void dump(PrintStream&) const;
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreheapCodeBlockSetInlinesh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/heap/CodeBlockSetInlines.h (286346 => 286347)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/heap/CodeBlockSetInlines.h   2021-12-01 02:56:24 UTC (rev 286346)
+++ trunk/Source/JavaScriptCore/heap/CodeBlockSetInlines.h      2021-12-01 04:38:56 UTC (rev 286347)
</span><span class="lines">@@ -60,18 +60,6 @@
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> template<typename Functor>
</span><del>-void CodeBlockSet::iterateViaSubspaces(VM& vm, const Functor& functor)
-{
-    vm.forEachCodeBlockSpace(
-        [&] (auto& spaceAndSet) {
-            spaceAndSet.space.forEachLiveCell(
-                [&] (HeapCell* cell, HeapCell::Kind) {
-                    functor(jsCast<CodeBlock*>(static_cast<JSCell*>(cell)));
-                });
-        });
-}
-
-template<typename Functor>
</del><span class="cx"> void CodeBlockSet::iterateCurrentlyExecuting(const Functor& functor)
</span><span class="cx"> {
</span><span class="cx">     Locker locker { m_lock };
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreheapHeapcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/heap/Heap.cpp (286346 => 286347)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/heap/Heap.cpp        2021-12-01 02:56:24 UTC (rev 286346)
+++ trunk/Source/JavaScriptCore/heap/Heap.cpp   2021-12-01 04:38:56 UTC (rev 286347)
</span><span class="lines">@@ -28,6 +28,7 @@
</span><span class="cx"> #include "ConservativeRoots.h"
</span><span class="cx"> #include "EdenGCActivityCallback.h"
</span><span class="cx"> #include "Exception.h"
</span><ins>+#include "FastMallocAlignedMemoryAllocator.h"
</ins><span class="cx"> #include "FullGCActivityCallback.h"
</span><span class="cx"> #include "FunctionExecutableInlines.h"
</span><span class="cx"> #include "GCActivityCallback.h"
</span><span class="lines">@@ -40,10 +41,12 @@
</span><span class="cx"> #include "HeapIterationScope.h"
</span><span class="cx"> #include "HeapProfiler.h"
</span><span class="cx"> #include "HeapSnapshot.h"
</span><ins>+#include "HeapSubspaceTypes.h"
</ins><span class="cx"> #include "HeapVerifier.h"
</span><span class="cx"> #include "IncrementalSweeper.h"
</span><span class="cx"> #include "Interpreter.h"
</span><span class="cx"> #include "IsoCellSetInlines.h"
</span><ins>+#include "IsoInlinedHeapCellTypeInlines.h"
</ins><span class="cx"> #include "JITStubRoutineSet.h"
</span><span class="cx"> #include "JITWorklistInlines.h"
</span><span class="cx"> #include "JSFinalizationRegistry.h"
</span><span class="lines">@@ -63,6 +66,7 @@
</span><span class="cx"> #include "SpaceTimeMutatorScheduler.h"
</span><span class="cx"> #include "StochasticSpaceTimeMutatorScheduler.h"
</span><span class="cx"> #include "StopIfNecessaryTimer.h"
</span><ins>+#include "StructureAlignedMemoryAllocator.h"
</ins><span class="cx"> #include "SubspaceInlines.h"
</span><span class="cx"> #include "SuperSampler.h"
</span><span class="cx"> #include "SweepingScope.h"
</span><span class="lines">@@ -286,6 +290,114 @@
</span><span class="cx">     , m_helperClient(&heapHelperPool())
</span><span class="cx">     , m_threadLock(Box<Lock>::create())
</span><span class="cx">     , m_threadCondition(AutomaticThreadCondition::create())
</span><ins>+
+    // HeapCellTypes
+    , auxiliaryHeapCellType(CellAttributes(DoesNotNeedDestruction, HeapCell::Auxiliary))
+    , immutableButterflyHeapCellType(CellAttributes(DoesNotNeedDestruction, HeapCell::JSCellWithIndexingHeader))
+    , cellHeapCellType(CellAttributes(DoesNotNeedDestruction, HeapCell::JSCell))
+    , destructibleCellHeapCellType(CellAttributes(NeedsDestruction, HeapCell::JSCell))
+    , apiGlobalObjectHeapCellType(IsoHeapCellType::Args<JSAPIGlobalObject>())
+    , callbackConstructorHeapCellType(IsoHeapCellType::Args<JSCallbackConstructor>())
+    , callbackGlobalObjectHeapCellType(IsoHeapCellType::Args<JSCallbackObject<JSGlobalObject>>())
+    , callbackObjectHeapCellType(IsoHeapCellType::Args<JSCallbackObject<JSNonFinalObject>>())
+    , customGetterFunctionHeapCellType(IsoHeapCellType::Args<JSCustomGetterFunction>())
+    , customSetterFunctionHeapCellType(IsoHeapCellType::Args<JSCustomSetterFunction>())
+    , dateInstanceHeapCellType(IsoHeapCellType::Args<DateInstance>())
+    , errorInstanceHeapCellType(IsoHeapCellType::Args<ErrorInstance>())
+    , finalizationRegistryCellType(IsoHeapCellType::Args<JSFinalizationRegistry>())
+    , globalLexicalEnvironmentHeapCellType(IsoHeapCellType::Args<JSGlobalLexicalEnvironment>())
+    , globalObjectHeapCellType(IsoHeapCellType::Args<JSGlobalObject>())
+    , injectedScriptHostSpaceHeapCellType(IsoHeapCellType::Args<Inspector::JSInjectedScriptHost>())
+    , javaScriptCallFrameHeapCellType(IsoHeapCellType::Args<Inspector::JSJavaScriptCallFrame>())
+    , jsModuleRecordHeapCellType(IsoHeapCellType::Args<JSModuleRecord>())
+    , moduleNamespaceObjectHeapCellType(IsoHeapCellType::Args<JSModuleNamespaceObject>())
+    , nativeStdFunctionHeapCellType(IsoHeapCellType::Args<JSNativeStdFunction>())
+    , weakMapHeapCellType(IsoHeapCellType::Args<JSWeakMap>())
+    , weakSetHeapCellType(IsoHeapCellType::Args<JSWeakSet>())
+#if JSC_OBJC_API_ENABLED
+    , apiWrapperObjectHeapCellType(IsoHeapCellType::Args<JSCallbackObject<JSAPIWrapperObject>>())
+    , objCCallbackFunctionHeapCellType(IsoHeapCellType::Args<ObjCCallbackFunction>())
+#endif
+#ifdef JSC_GLIB_API_ENABLED
+    , apiWrapperObjectHeapCellType(IsoHeapCellType::Args<JSCallbackObject<JSAPIWrapperObject>>())
+    , callbackAPIWrapperGlobalObjectHeapCellType(IsoHeapCellType::Args<JSCallbackObject<JSAPIWrapperGlobalObject>>())
+    , jscCallbackFunctionHeapCellType(IsoHeapCellType::Args<JSCCallbackFunction>())
+#endif
+    , intlCollatorHeapCellType(IsoHeapCellType::Args<IntlCollator>())
+    , intlDateTimeFormatHeapCellType(IsoHeapCellType::Args<IntlDateTimeFormat>())
+    , intlDisplayNamesHeapCellType(IsoHeapCellType::Args<IntlDisplayNames>())
+    , intlListFormatHeapCellType(IsoHeapCellType::Args<IntlListFormat>())
+    , intlLocaleHeapCellType(IsoHeapCellType::Args<IntlLocale>())
+    , intlNumberFormatHeapCellType(IsoHeapCellType::Args<IntlNumberFormat>())
+    , intlPluralRulesHeapCellType(IsoHeapCellType::Args<IntlPluralRules>())
+    , intlRelativeTimeFormatHeapCellType(IsoHeapCellType::Args<IntlRelativeTimeFormat>())
+    , intlSegmentIteratorHeapCellType(IsoHeapCellType::Args<IntlSegmentIterator>())
+    , intlSegmenterHeapCellType(IsoHeapCellType::Args<IntlSegmenter>())
+    , intlSegmentsHeapCellType(IsoHeapCellType::Args<IntlSegments>())
+#if ENABLE(WEBASSEMBLY)
+    , webAssemblyCodeBlockHeapCellType(IsoHeapCellType::Args<JSWebAssemblyCodeBlock>())
+    , webAssemblyExceptionHeapCellType(IsoHeapCellType::Args<JSWebAssemblyException>())
+    , webAssemblyFunctionHeapCellType(IsoHeapCellType::Args<WebAssemblyFunction>())
+    , webAssemblyGlobalHeapCellType(IsoHeapCellType::Args<JSWebAssemblyGlobal>())
+    , webAssemblyInstanceHeapCellType(IsoHeapCellType::Args<JSWebAssemblyInstance>())
+    , webAssemblyMemoryHeapCellType(IsoHeapCellType::Args<JSWebAssemblyMemory>())
+    , webAssemblyModuleHeapCellType(IsoHeapCellType::Args<JSWebAssemblyModule>())
+    , webAssemblyModuleRecordHeapCellType(IsoHeapCellType::Args<WebAssemblyModuleRecord>())
+    , webAssemblyTableHeapCellType(IsoHeapCellType::Args<JSWebAssemblyTable>())
+    , webAssemblyTagHeapCellType(IsoHeapCellType::Args<JSWebAssemblyTag>())
+#endif
+
+    // AlignedMemoryAllocators
+    , fastMallocAllocator(makeUnique<FastMallocAlignedMemoryAllocator>())
+    , primitiveGigacageAllocator(makeUnique<GigacageAlignedMemoryAllocator>(Gigacage::Primitive))
+    , jsValueGigacageAllocator(makeUnique<GigacageAlignedMemoryAllocator>(Gigacage::JSValue))
+
+    // Subspaces
+    , primitiveGigacageAuxiliarySpace("Primitive Gigacage Auxiliary", *this, auxiliaryHeapCellType, primitiveGigacageAllocator.get()) // Hash:0x3e7cd762
+    , jsValueGigacageAuxiliarySpace("JSValue Gigacage Auxiliary", *this, auxiliaryHeapCellType, jsValueGigacageAllocator.get()) // Hash:0x241e946
+    , immutableButterflyJSValueGigacageAuxiliarySpace("ImmutableButterfly Gigacage JSCellWithIndexingHeader", *this, immutableButterflyHeapCellType, jsValueGigacageAllocator.get()) // Hash:0x7a945300
+    , cellSpace("JSCell", *this, cellHeapCellType, fastMallocAllocator.get()) // Hash:0xadfb5a79
+    , variableSizedCellSpace("Variable Sized JSCell", *this, cellHeapCellType, fastMallocAllocator.get()) // Hash:0xbcd769cc
+    , destructibleObjectSpace("JSDestructibleObject", *this, destructibleObjectHeapCellType, fastMallocAllocator.get()) // Hash:0x4f5ed7a9
+    , arraySpace ISO_SUBSPACE_INIT(*this, cellHeapCellType, JSArray)
+    , bigIntSpace ISO_SUBSPACE_INIT(*this, cellHeapCellType, JSBigInt)
+    , calleeSpace ISO_SUBSPACE_INIT(*this, cellHeapCellType, JSCallee)
+    , clonedArgumentsSpace ISO_SUBSPACE_INIT(*this, cellHeapCellType, ClonedArguments)
+    , customGetterSetterSpace ISO_SUBSPACE_INIT(*this, cellHeapCellType, CustomGetterSetter)
+    , dateInstanceSpace ISO_SUBSPACE_INIT(*this, dateInstanceHeapCellType, DateInstance)
+    , domAttributeGetterSetterSpace ISO_SUBSPACE_INIT(*this, cellHeapCellType, DOMAttributeGetterSetter)
+    , exceptionSpace ISO_SUBSPACE_INIT(*this, destructibleCellHeapCellType, Exception)
+    , executableToCodeBlockEdgeSpace ISO_SUBSPACE_INIT(*this, cellHeapCellType, ExecutableToCodeBlockEdge) // Hash:0x7b730b20
+    , functionSpace ISO_SUBSPACE_INIT(*this, cellHeapCellType, JSFunction) // Hash:0x800fca72
+    , getterSetterSpace ISO_SUBSPACE_INIT(*this, cellHeapCellType, GetterSetter)
+    , globalLexicalEnvironmentSpace ISO_SUBSPACE_INIT(*this, globalLexicalEnvironmentHeapCellType, JSGlobalLexicalEnvironment)
+    , internalFunctionSpace ISO_SUBSPACE_INIT(*this, cellHeapCellType, InternalFunction) // Hash:0xf845c464
+    , jsProxySpace ISO_SUBSPACE_INIT(*this, cellHeapCellType, JSProxy)
+    , nativeExecutableSpace ISO_SUBSPACE_INIT(*this, destructibleCellHeapCellType, NativeExecutable) // Hash:0x67567f95
+    , numberObjectSpace ISO_SUBSPACE_INIT(*this, cellHeapCellType, NumberObject)
+    , plainObjectSpace ISO_SUBSPACE_INIT(*this, cellHeapCellType, JSNonFinalObject) // Mainly used for prototypes.
+    , promiseSpace ISO_SUBSPACE_INIT(*this, cellHeapCellType, JSPromise)
+    , propertyNameEnumeratorSpace ISO_SUBSPACE_INIT(*this, cellHeapCellType, JSPropertyNameEnumerator)
+    , propertyTableSpace ISO_SUBSPACE_INIT(*this, destructibleCellHeapCellType, PropertyTable) // Hash:0xc6bc9f12
+    , regExpSpace ISO_SUBSPACE_INIT(*this, destructibleCellHeapCellType, RegExp)
+    , regExpObjectSpace ISO_SUBSPACE_INIT(*this, cellHeapCellType, RegExpObject)
+    , ropeStringSpace ISO_SUBSPACE_INIT(*this, stringHeapCellType, JSRopeString)
+    , scopedArgumentsSpace ISO_SUBSPACE_INIT(*this, cellHeapCellType, ScopedArguments)
+    , sparseArrayValueMapSpace ISO_SUBSPACE_INIT(*this, destructibleCellHeapCellType, SparseArrayValueMap)
+    , stringSpace ISO_SUBSPACE_INIT(*this, stringHeapCellType, JSString) // Hash:0x90cf758f
+    , stringObjectSpace ISO_SUBSPACE_INIT(*this, cellHeapCellType, StringObject)
+    , structureChainSpace ISO_SUBSPACE_INIT(*this, cellHeapCellType, StructureChain)
+    , structureRareDataSpace ISO_SUBSPACE_INIT(*this, destructibleCellHeapCellType, StructureRareData) // Hash:0xaca4e62d
+    , structureSpace("IsolatedStructureSpace", *this, destructibleCellHeapCellType, sizeof(Structure), Structure::numberOfLowerTierCells, makeUnique<StructureAlignedMemoryAllocator>("Structure"))
+    , brandedStructureSpace("IsolatedBrandedStructureSpace", *this, destructibleCellHeapCellType, sizeof(BrandedStructure), BrandedStructure::numberOfLowerTierCells, makeUnique<StructureAlignedMemoryAllocator>("Structure"))
+    , symbolTableSpace ISO_SUBSPACE_INIT(*this, destructibleCellHeapCellType, SymbolTable) // Hash:0xc5215afd
+    , executableToCodeBlockEdgesWithConstraints(executableToCodeBlockEdgeSpace)
+    , executableToCodeBlockEdgesWithFinalizers(executableToCodeBlockEdgeSpace)
+    , codeBlockSpace ISO_SUBSPACE_INIT(*this, destructibleCellHeapCellType, CodeBlock) // Hash:0x77e66ec9
+    , functionExecutableSpace ISO_SUBSPACE_INIT(*this, destructibleCellHeapCellType, FunctionExecutable) // Hash:0x5d158f3
+    , programExecutableSpace ISO_SUBSPACE_INIT(*this, destructibleCellHeapCellType, ProgramExecutable) // Hash:0x527c77e7
+    , unlinkedFunctionExecutableSpace ISO_SUBSPACE_INIT(*this, destructibleCellHeapCellType, UnlinkedFunctionExecutable) // Hash:0xf6b828d9
+
</ins><span class="cx"> {
</span><span class="cx">     m_worldState.store(0);
</span><span class="cx"> 
</span><span class="lines">@@ -579,31 +691,31 @@
</span><span class="cx"> {
</span><span class="cx">     VM& vm = this->vm();
</span><span class="cx">     vm.builtinExecutables()->finalizeUnconditionally();
</span><del>-    finalizeMarkedUnconditionalFinalizers<FunctionExecutable>(vm.functionExecutableSpace.space);
-    finalizeMarkedUnconditionalFinalizers<SymbolTable>(vm.symbolTableSpace);
-    finalizeMarkedUnconditionalFinalizers<ExecutableToCodeBlockEdge>(vm.executableToCodeBlockEdgesWithFinalizers); // We run this before CodeBlock's unconditional finalizer since CodeBlock looks at the owner executable's installed CodeBlock in its finalizeUnconditionally.
-    vm.forEachCodeBlockSpace(
</del><ins>+    finalizeMarkedUnconditionalFinalizers<FunctionExecutable>(functionExecutableSpace.space);
+    finalizeMarkedUnconditionalFinalizers<SymbolTable>(symbolTableSpace);
+    finalizeMarkedUnconditionalFinalizers<ExecutableToCodeBlockEdge>(executableToCodeBlockEdgesWithFinalizers); // We run this before CodeBlock's unconditional finalizer since CodeBlock looks at the owner executable's installed CodeBlock in its finalizeUnconditionally.
+    forEachCodeBlockSpace(
</ins><span class="cx">         [&] (auto& space) {
</span><span class="cx">             this->finalizeMarkedUnconditionalFinalizers<CodeBlock>(space.set);
</span><span class="cx">         });
</span><del>-    finalizeMarkedUnconditionalFinalizers<StructureRareData>(vm.structureRareDataSpace);
-    finalizeMarkedUnconditionalFinalizers<UnlinkedFunctionExecutable>(vm.unlinkedFunctionExecutableSpace.set);
-    if (vm.m_weakSetSpace)
-        finalizeMarkedUnconditionalFinalizers<JSWeakSet>(*vm.m_weakSetSpace);
-    if (vm.m_weakMapSpace)
-        finalizeMarkedUnconditionalFinalizers<JSWeakMap>(*vm.m_weakMapSpace);
-    if (vm.m_weakObjectRefSpace)
-        finalizeMarkedUnconditionalFinalizers<JSWeakObjectRef>(*vm.m_weakObjectRefSpace);
-    if (vm.m_errorInstanceSpace)
-        finalizeMarkedUnconditionalFinalizers<ErrorInstance>(*vm.m_errorInstanceSpace);
</del><ins>+    finalizeMarkedUnconditionalFinalizers<StructureRareData>(structureRareDataSpace);
+    finalizeMarkedUnconditionalFinalizers<UnlinkedFunctionExecutable>(unlinkedFunctionExecutableSpace.set);
+    if (m_weakSetSpace)
+        finalizeMarkedUnconditionalFinalizers<JSWeakSet>(*m_weakSetSpace);
+    if (m_weakMapSpace)
+        finalizeMarkedUnconditionalFinalizers<JSWeakMap>(*m_weakMapSpace);
+    if (m_weakObjectRefSpace)
+        finalizeMarkedUnconditionalFinalizers<JSWeakObjectRef>(*m_weakObjectRefSpace);
+    if (m_errorInstanceSpace)
+        finalizeMarkedUnconditionalFinalizers<ErrorInstance>(*m_errorInstanceSpace);
</ins><span class="cx"> 
</span><span class="cx">     // FinalizationRegistries currently rely on serial finalization because they can post tasks to the deferredWorkTimer, which normally expects tasks to only be posted by the API lock holder.
</span><del>-    if (vm.m_finalizationRegistrySpace)
-        finalizeMarkedUnconditionalFinalizers<JSFinalizationRegistry>(*vm.m_finalizationRegistrySpace);
</del><ins>+    if (m_finalizationRegistrySpace)
+        finalizeMarkedUnconditionalFinalizers<JSFinalizationRegistry>(*m_finalizationRegistrySpace);
</ins><span class="cx"> 
</span><span class="cx"> #if ENABLE(WEBASSEMBLY)
</span><del>-    if (vm.m_webAssemblyCodeBlockSpace)
-        finalizeMarkedUnconditionalFinalizers<JSWebAssemblyCodeBlock>(*vm.m_webAssemblyCodeBlockSpace);
</del><ins>+    if (m_webAssemblyCodeBlockSpace)
+        finalizeMarkedUnconditionalFinalizers<JSWebAssemblyCodeBlock>(*m_webAssemblyCodeBlockSpace);
</ins><span class="cx"> #endif
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="lines">@@ -905,7 +1017,7 @@
</span><span class="cx"> 
</span><span class="cx">     completeAllJITPlans();
</span><span class="cx"> 
</span><del>-    vm.forEachScriptExecutableSpace(
</del><ins>+    forEachScriptExecutableSpace(
</ins><span class="cx">         [&] (auto& spaceAndSet) {
</span><span class="cx">             HeapIterationScope heapIterationScope(*this);
</span><span class="cx">             auto& set = spaceAndSet.set;
</span><span class="lines">@@ -924,8 +1036,8 @@
</span><span class="cx">         // points into a CodeBlock that could be dead. The IC will still succeed because
</span><span class="cx">         // it uses a callee check, but then it will call into dead code.
</span><span class="cx">         HeapIterationScope heapIterationScope(*this);
</span><del>-        if (vm.m_webAssemblyCodeBlockSpace) {
-            vm.m_webAssemblyCodeBlockSpace->forEachLiveCell([&] (HeapCell* cell, HeapCell::Kind kind) {
</del><ins>+        if (m_webAssemblyCodeBlockSpace) {
+            m_webAssemblyCodeBlockSpace->forEachLiveCell([&] (HeapCell* cell, HeapCell::Kind kind) {
</ins><span class="cx">                 ASSERT_UNUSED(kind, kind == HeapCell::JSCell);
</span><span class="cx">                 JSWebAssemblyCodeBlock* codeBlock = static_cast<JSWebAssemblyCodeBlock*>(cell);
</span><span class="cx">                 codeBlock->clearJSCallICs(vm);
</span><span class="lines">@@ -946,7 +1058,7 @@
</span><span class="cx">     RELEASE_ASSERT(!m_collectionScope);
</span><span class="cx"> 
</span><span class="cx">     HeapIterationScope heapIterationScope(*this);
</span><del>-    vm.unlinkedFunctionExecutableSpace.set.forEachLiveCell(
</del><ins>+    unlinkedFunctionExecutableSpace.set.forEachLiveCell(
</ins><span class="cx">         [&] (HeapCell* cell, HeapCell::Kind) {
</span><span class="cx">             UnlinkedFunctionExecutable* executable = static_cast<UnlinkedFunctionExecutable*>(cell);
</span><span class="cx">             executable->clearCode(vm);
</span><span class="lines">@@ -955,10 +1067,10 @@
</span><span class="cx"> 
</span><span class="cx"> void Heap::deleteUnmarkedCompiledCode()
</span><span class="cx"> {
</span><del>-    vm().forEachScriptExecutableSpace([] (auto& space) { space.space.sweep(); });
</del><ins>+    forEachScriptExecutableSpace([] (auto& space) { space.space.sweep(); });
</ins><span class="cx">     // Sweeping must occur before deleting stubs, otherwise the stubs might still think they're alive as they get deleted.
</span><span class="cx">     // And CodeBlock destructor is assuming that CodeBlock gets destroyed before UnlinkedCodeBlock gets destroyed.
</span><del>-    vm().forEachCodeBlockSpace([] (auto& space) { space.space.sweep(); });
</del><ins>+    forEachCodeBlockSpace([] (auto& space) { space.space.sweep(); });
</ins><span class="cx">     m_jitStubRoutines->deleteUnmarkedJettisonedStubRoutines();
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="lines">@@ -2101,8 +2213,8 @@
</span><span class="cx">     m_objectSpace.sweepPreciseAllocations();
</span><span class="cx"> #if ENABLE(WEBASSEMBLY)
</span><span class="cx">     // We hold onto a lot of memory, so it makes a lot of sense to be swept eagerly.
</span><del>-    if (vm().m_webAssemblyMemorySpace)
-        vm().m_webAssemblyMemorySpace->sweep();
</del><ins>+    if (m_webAssemblyMemorySpace)
+        m_webAssemblyMemorySpace->sweep();
</ins><span class="cx"> #endif
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="lines">@@ -2803,7 +2915,7 @@
</span><span class="cx">         "O", "Output",
</span><span class="cx">         MAKE_MARKING_CONSTRAINT_EXECUTOR_PAIR(([] (auto& visitor) {
</span><span class="cx">             using Visitor = decltype(visitor);
</span><del>-            VM& vm = visitor.vm();
</del><ins>+            Heap* heap = visitor.heap();
</ins><span class="cx"> 
</span><span class="cx">             // The `visitor2` argument is strangely named because the WinCairo port
</span><span class="cx">             // gets confused  and thinks we're trying to capture the outer visitor
</span><span class="lines">@@ -2822,11 +2934,11 @@
</span><span class="cx"> 
</span><span class="cx">             {
</span><span class="cx">                 SetRootMarkReasonScope rootScope(visitor, RootMarkReason::ExecutableToCodeBlockEdges);
</span><del>-                add(vm.executableToCodeBlockEdgesWithConstraints);
</del><ins>+                add(heap->executableToCodeBlockEdgesWithConstraints);
</ins><span class="cx">             }
</span><del>-            if (vm.m_weakMapSpace) {
</del><ins>+            if (heap->m_weakMapSpace) {
</ins><span class="cx">                 SetRootMarkReasonScope rootScope(visitor, RootMarkReason::WeakMapSpace);
</span><del>-                add(*vm.m_weakMapSpace);
</del><ins>+                add(*heap->m_weakMapSpace);
</ins><span class="cx">             }
</span><span class="cx">         })),
</span><span class="cx">         ConstraintVolatility::GreyedByMarking,
</span><span class="lines">@@ -3060,4 +3172,135 @@
</span><span class="cx">     m_verifierSlotVisitor = nullptr;
</span><span class="cx"> }
</span><span class="cx"> 
</span><ins>+#define DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(name, heapCellType, type) \
+    IsoSubspace* Heap::name##Slow() \
+    { \
+        ASSERT(!m_##name); \
+        auto space = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(*this, heapCellType, type); \
+        WTF::storeStoreFence(); \
+        m_##name = WTFMove(space); \
+        return m_##name.get(); \
+    }
+
+
+DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(apiGlobalObjectSpace, apiGlobalObjectHeapCellType, JSAPIGlobalObject)
+DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(apiValueWrapperSpace, cellHeapCellType, JSAPIValueWrapper)
+DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(arrayBufferSpace, cellHeapCellType, JSArrayBuffer)
+DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(arrayIteratorSpace, cellHeapCellType, JSArrayIterator)
+DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(asyncGeneratorSpace, cellHeapCellType, JSAsyncGenerator)
+DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(bigInt64ArraySpace, cellHeapCellType, JSBigInt64Array)
+DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(bigIntObjectSpace, cellHeapCellType, BigIntObject)
+DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(bigUint64ArraySpace, cellHeapCellType, JSBigUint64Array)
+DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(booleanObjectSpace, cellHeapCellType, BooleanObject)
+DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(boundFunctionSpace, cellHeapCellType, JSBoundFunction) // Hash:0xd7916d41
+DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(callbackConstructorSpace, callbackConstructorHeapCellType, JSCallbackConstructor)
+DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(callbackGlobalObjectSpace, callbackGlobalObjectHeapCellType, JSCallbackObject<JSGlobalObject>)
+DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(callbackFunctionSpace, cellHeapCellType, JSCallbackFunction) // Hash:0xe7648ebc
+DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(callbackObjectSpace, callbackObjectHeapCellType, JSCallbackObject<JSNonFinalObject>)
+DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(customGetterFunctionSpace, customGetterFunctionHeapCellType, JSCustomGetterFunction)
+DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(customSetterFunctionSpace, customSetterFunctionHeapCellType, JSCustomSetterFunction)
+DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(dataViewSpace, cellHeapCellType, JSDataView)
+DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(debuggerScopeSpace, cellHeapCellType, DebuggerScope)
+DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(errorInstanceSpace, errorInstanceHeapCellType, ErrorInstance) // Hash:0x3f40d4a
+DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(float32ArraySpace, cellHeapCellType, JSFloat32Array)
+DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(float64ArraySpace, cellHeapCellType, JSFloat64Array)
+DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(functionRareDataSpace, destructibleCellHeapCellType, FunctionRareData)
+DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(generatorSpace, cellHeapCellType, JSGenerator)
+DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(globalObjectSpace, globalObjectHeapCellType, JSGlobalObject)
+DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(injectedScriptHostSpace, injectedScriptHostSpaceHeapCellType, Inspector::JSInjectedScriptHost)
+DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(int8ArraySpace, cellHeapCellType, JSInt8Array)
+DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(int16ArraySpace, cellHeapCellType, JSInt16Array)
+DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(int32ArraySpace, cellHeapCellType, JSInt32Array)
+DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(javaScriptCallFrameSpace, javaScriptCallFrameHeapCellType, Inspector::JSJavaScriptCallFrame)
+DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(jsModuleRecordSpace, jsModuleRecordHeapCellType, JSModuleRecord)
+DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(mapBucketSpace, cellHeapCellType, JSMap::BucketType)
+DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(mapIteratorSpace, cellHeapCellType, JSMapIterator)
+DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(mapSpace, cellHeapCellType, JSMap)
+DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(moduleNamespaceObjectSpace, moduleNamespaceObjectHeapCellType, JSModuleNamespaceObject)
+DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(nativeStdFunctionSpace, nativeStdFunctionHeapCellType, JSNativeStdFunction) // Hash:0x70ed61e4
+DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(proxyObjectSpace, cellHeapCellType, ProxyObject)
+DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(proxyRevokeSpace, cellHeapCellType, ProxyRevoke) // Hash:0xb506a939
+DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(scopedArgumentsTableSpace, destructibleCellHeapCellType, ScopedArgumentsTable)
+DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(scriptFetchParametersSpace, destructibleCellHeapCellType, JSScriptFetchParameters)
+DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(scriptFetcherSpace, destructibleCellHeapCellType, JSScriptFetcher)
+DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(setBucketSpace, cellHeapCellType, JSSet::BucketType)
+DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(setIteratorSpace, cellHeapCellType, JSSetIterator)
+DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(setSpace, cellHeapCellType, JSSet)
+DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(shadowRealmSpace, cellHeapCellType, ShadowRealmObject)
+DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(strictEvalActivationSpace, cellHeapCellType, StrictEvalActivation)
+DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(stringIteratorSpace, cellHeapCellType, JSStringIterator)
+DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(sourceCodeSpace, destructibleCellHeapCellType, JSSourceCode)
+DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(symbolSpace, destructibleCellHeapCellType, Symbol)
+DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(symbolObjectSpace, cellHeapCellType, SymbolObject)
+DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(templateObjectDescriptorSpace, destructibleCellHeapCellType, JSTemplateObjectDescriptor)
+DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(temporalCalendarSpace, cellHeapCellType, TemporalCalendar)
+DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(temporalDurationSpace, cellHeapCellType, TemporalDuration)
+DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(temporalInstantSpace, cellHeapCellType, TemporalInstant)
+DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(temporalPlainTimeSpace, cellHeapCellType, TemporalPlainTime)
+DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(temporalTimeZoneSpace, cellHeapCellType, TemporalTimeZone)
+DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(uint8ArraySpace, cellHeapCellType, JSUint8Array)
+DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(uint8ClampedArraySpace, cellHeapCellType, JSUint8ClampedArray)
+DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(uint16ArraySpace, cellHeapCellType, JSUint16Array)
+DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(uint32ArraySpace, cellHeapCellType, JSUint32Array)
+DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(unlinkedEvalCodeBlockSpace, destructibleCellHeapCellType, UnlinkedEvalCodeBlock)
+DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(unlinkedFunctionCodeBlockSpace, destructibleCellHeapCellType, UnlinkedFunctionCodeBlock)
+DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(unlinkedModuleProgramCodeBlockSpace, destructibleCellHeapCellType, UnlinkedModuleProgramCodeBlock)
+DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(unlinkedProgramCodeBlockSpace, destructibleCellHeapCellType, UnlinkedProgramCodeBlock)
+DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(weakMapSpace, weakMapHeapCellType, JSWeakMap) // Hash:0x662b12a3
+DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(weakSetSpace, weakSetHeapCellType, JSWeakSet) // Hash:0x4c781b30
+DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(weakObjectRefSpace, cellHeapCellType, JSWeakObjectRef) // Hash:0x8ec68f1f
+DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(withScopeSpace, cellHeapCellType, JSWithScope)
+DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(finalizationRegistrySpace, finalizationRegistryCellType, JSFinalizationRegistry)
+#if JSC_OBJC_API_ENABLED
+DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(apiWrapperObjectSpace, apiWrapperObjectHeapCellType, JSCallbackObject<JSAPIWrapperObject>)
+DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(objCCallbackFunctionSpace, objCCallbackFunctionHeapCellType, ObjCCallbackFunction) // Hash:0x10f610b8
+#endif
+#ifdef JSC_GLIB_API_ENABLED
+DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(apiWrapperObjectSpace, apiWrapperObjectHeapCellType, JSCallbackObject<JSAPIWrapperObject>)
+DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(jscCallbackFunctionSpace, jscCallbackFunctionHeapCellType, JSCCallbackFunction)
+DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(callbackAPIWrapperGlobalObjectSpace, callbackAPIWrapperGlobalObjectHeapCellType, JSCallbackObject<JSAPIWrapperGlobalObject>)
+#endif
+DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(intlCollatorSpace, intlCollatorHeapCellType, IntlCollator)
+DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(intlDateTimeFormatSpace, intlDateTimeFormatHeapCellType, IntlDateTimeFormat)
+DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(intlDisplayNamesSpace, intlDisplayNamesHeapCellType, IntlDisplayNames)
+DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(intlListFormatSpace, intlListFormatHeapCellType, IntlListFormat)
+DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(intlLocaleSpace, intlLocaleHeapCellType, IntlLocale)
+DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(intlNumberFormatSpace, intlNumberFormatHeapCellType, IntlNumberFormat)
+DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(intlPluralRulesSpace, intlPluralRulesHeapCellType, IntlPluralRules)
+DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(intlRelativeTimeFormatSpace, intlRelativeTimeFormatHeapCellType, IntlRelativeTimeFormat)
+DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(intlSegmentIteratorSpace, intlSegmentIteratorHeapCellType, IntlSegmentIterator)
+DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(intlSegmenterSpace, intlSegmenterHeapCellType, IntlSegmenter)
+DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(intlSegmentsSpace, intlSegmentsHeapCellType, IntlSegments)
+#if ENABLE(WEBASSEMBLY)
+DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(jsToWasmICCalleeSpace, cellHeapCellType, JSToWasmICCallee)
+DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(webAssemblyCodeBlockSpace, webAssemblyCodeBlockHeapCellType, JSWebAssemblyCodeBlock) // Hash:0x9ad995cd
+DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(webAssemblyExceptionSpace, webAssemblyExceptionHeapCellType, JSWebAssemblyException)
+DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(webAssemblyFunctionSpace, webAssemblyFunctionHeapCellType, WebAssemblyFunction) // Hash:0x8b7c32db
+DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(webAssemblyGlobalSpace, webAssemblyGlobalHeapCellType, JSWebAssemblyGlobal)
+DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(webAssemblyInstanceSpace, webAssemblyInstanceHeapCellType, JSWebAssemblyInstance)
+DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(webAssemblyMemorySpace, webAssemblyMemoryHeapCellType, JSWebAssemblyMemory)
+DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(webAssemblyModuleSpace, webAssemblyModuleHeapCellType, JSWebAssemblyModule)
+DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(webAssemblyModuleRecordSpace, webAssemblyModuleRecordHeapCellType, WebAssemblyModuleRecord)
+DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(webAssemblyTableSpace, webAssemblyTableHeapCellType, JSWebAssemblyTable)
+DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(webAssemblyTagSpace, webAssemblyTagHeapCellType, JSWebAssemblyTag)
+DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(webAssemblyWrapperFunctionSpace, cellHeapCellType, WebAssemblyWrapperFunction) // Hash:0xd4a5ff01
+#endif
+
+#undef DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW
+
+#define DYNAMIC_SPACE_AND_SET_DEFINE_MEMBER_SLOW(name, heapCellType, type) \
+    IsoSubspace* Heap::name##Slow() \
+    { \
+        ASSERT(!m_##name); \
+        auto space = makeUnique<SpaceAndSet> ISO_SUBSPACE_INIT(*this, heapCellType, type); \
+        WTF::storeStoreFence(); \
+        m_##name = WTFMove(space); \
+        return &m_##name->space; \
+    }
+
+DYNAMIC_SPACE_AND_SET_DEFINE_MEMBER_SLOW(evalExecutableSpace, destructibleCellHeapCellType, EvalExecutable) // Hash:0x958e3e9d
+DYNAMIC_SPACE_AND_SET_DEFINE_MEMBER_SLOW(moduleProgramExecutableSpace, destructibleCellHeapCellType, ModuleProgramExecutable) // Hash:0x6506fa3c
+
+#undef DYNAMIC_SPACE_AND_SET_DEFINE_MEMBER_SLOW
+
</ins><span class="cx"> } // namespace JSC
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreheapHeaph"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/heap/Heap.h (286346 => 286347)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/heap/Heap.h  2021-12-01 02:56:24 UTC (rev 286346)
+++ trunk/Source/JavaScriptCore/heap/Heap.h     2021-12-01 04:38:56 UTC (rev 286347)
</span><span class="lines">@@ -25,6 +25,7 @@
</span><span class="cx"> #include "CellState.h"
</span><span class="cx"> #include "CollectionScope.h"
</span><span class="cx"> #include "CollectorPhase.h"
</span><ins>+#include "CompleteSubspace.h"
</ins><span class="cx"> #include "DeleteAllCodeEffort.h"
</span><span class="cx"> #include "GCConductor.h"
</span><span class="cx"> #include "GCIncomingRefCountedSet.h"
</span><span class="lines">@@ -33,6 +34,11 @@
</span><span class="cx"> #include "HandleSet.h"
</span><span class="cx"> #include "HeapFinalizerCallback.h"
</span><span class="cx"> #include "HeapObserver.h"
</span><ins>+#include "IsoCellSet.h"
+#include "IsoHeapCellType.h"
+#include "IsoInlinedHeapCellType.h"
+#include "IsoSubspace.h"
+#include "JSDestructibleObjectHeapCellType.h"
</ins><span class="cx"> #include "MarkedBlock.h"
</span><span class="cx"> #include "MarkedSpace.h"
</span><span class="cx"> #include "MutatorState.h"
</span><span class="lines">@@ -58,9 +64,11 @@
</span><span class="cx"> class ConservativeRoots;
</span><span class="cx"> class GCDeferralContext;
</span><span class="cx"> class EdenGCActivityCallback;
</span><ins>+class FastMallocAlignedMemoryAllocator;
</ins><span class="cx"> class FullGCActivityCallback;
</span><span class="cx"> class GCActivityCallback;
</span><span class="cx"> class GCAwareJITStubRoutine;
</span><ins>+class GigacageAlignedMemoryAllocator;
</ins><span class="cx"> class Heap;
</span><span class="cx"> class HeapProfiler;
</span><span class="cx"> class HeapVerifier;
</span><span class="lines">@@ -69,8 +77,8 @@
</span><span class="cx"> class JITStubRoutineSet;
</span><span class="cx"> class JSCell;
</span><span class="cx"> class JSImmutableButterfly;
</span><ins>+class JSString;
</ins><span class="cx"> class JSValue;
</span><del>-class LLIntOffsetsExtractor;
</del><span class="cx"> class MachineThreads;
</span><span class="cx"> class MarkStackArray;
</span><span class="cx"> class MarkStackMergingConstraint;
</span><span class="lines">@@ -726,6 +734,318 @@
</span><span class="cx">     bool m_parallelMarkersShouldExit { false };
</span><span class="cx">     Lock m_collectContinuouslyLock;
</span><span class="cx">     Condition m_collectContinuouslyCondition;
</span><ins>+
+public:
+    // HeapCellTypes
+    HeapCellType auxiliaryHeapCellType;
+    HeapCellType immutableButterflyHeapCellType;
+    HeapCellType cellHeapCellType;
+    HeapCellType destructibleCellHeapCellType;
+    IsoHeapCellType apiGlobalObjectHeapCellType;
+    IsoHeapCellType callbackConstructorHeapCellType;
+    IsoHeapCellType callbackGlobalObjectHeapCellType;
+    IsoHeapCellType callbackObjectHeapCellType;
+    IsoHeapCellType customGetterFunctionHeapCellType;
+    IsoHeapCellType customSetterFunctionHeapCellType;
+    IsoHeapCellType dateInstanceHeapCellType;
+    IsoHeapCellType errorInstanceHeapCellType;
+    IsoHeapCellType finalizationRegistryCellType;
+    IsoHeapCellType globalLexicalEnvironmentHeapCellType;
+    IsoHeapCellType globalObjectHeapCellType;
+    IsoHeapCellType injectedScriptHostSpaceHeapCellType;
+    IsoHeapCellType javaScriptCallFrameHeapCellType;
+    IsoHeapCellType jsModuleRecordHeapCellType;
+    IsoHeapCellType moduleNamespaceObjectHeapCellType;
+    IsoHeapCellType nativeStdFunctionHeapCellType;
+    IsoInlinedHeapCellType<JSString> stringHeapCellType;
+    IsoHeapCellType weakMapHeapCellType;
+    IsoHeapCellType weakSetHeapCellType;
+    JSDestructibleObjectHeapCellType destructibleObjectHeapCellType;
+#if JSC_OBJC_API_ENABLED
+    IsoHeapCellType apiWrapperObjectHeapCellType;
+    IsoHeapCellType objCCallbackFunctionHeapCellType;
+#endif
+#ifdef JSC_GLIB_API_ENABLED
+    IsoHeapCellType apiWrapperObjectHeapCellType;
+    IsoHeapCellType callbackAPIWrapperGlobalObjectHeapCellType;
+    IsoHeapCellType jscCallbackFunctionHeapCellType;
+#endif
+    IsoHeapCellType intlCollatorHeapCellType;
+    IsoHeapCellType intlDateTimeFormatHeapCellType;
+    IsoHeapCellType intlDisplayNamesHeapCellType;
+    IsoHeapCellType intlListFormatHeapCellType;
+    IsoHeapCellType intlLocaleHeapCellType;
+    IsoHeapCellType intlNumberFormatHeapCellType;
+    IsoHeapCellType intlPluralRulesHeapCellType;
+    IsoHeapCellType intlRelativeTimeFormatHeapCellType;
+    IsoHeapCellType intlSegmentIteratorHeapCellType;
+    IsoHeapCellType intlSegmenterHeapCellType;
+    IsoHeapCellType intlSegmentsHeapCellType;
+#if ENABLE(WEBASSEMBLY)
+    IsoHeapCellType webAssemblyCodeBlockHeapCellType;
+    IsoHeapCellType webAssemblyExceptionHeapCellType;
+    IsoHeapCellType webAssemblyFunctionHeapCellType;
+    IsoHeapCellType webAssemblyGlobalHeapCellType;
+    IsoHeapCellType webAssemblyInstanceHeapCellType;
+    IsoHeapCellType webAssemblyMemoryHeapCellType;
+    IsoHeapCellType webAssemblyModuleHeapCellType;
+    IsoHeapCellType webAssemblyModuleRecordHeapCellType;
+    IsoHeapCellType webAssemblyTableHeapCellType;
+    IsoHeapCellType webAssemblyTagHeapCellType;
+#endif
+
+    // AlignedMemoryAllocators
+    std::unique_ptr<FastMallocAlignedMemoryAllocator> fastMallocAllocator;
+    std::unique_ptr<GigacageAlignedMemoryAllocator> primitiveGigacageAllocator;
+    std::unique_ptr<GigacageAlignedMemoryAllocator> jsValueGigacageAllocator;
+
+    // Subspaces
+    CompleteSubspace primitiveGigacageAuxiliarySpace; // Typed arrays, strings, bitvectors, etc go here.
+    CompleteSubspace jsValueGigacageAuxiliarySpace; // Butterflies, arrays of JSValues, etc go here.
+    CompleteSubspace immutableButterflyJSValueGigacageAuxiliarySpace; // JSImmutableButterfly goes here.
+
+    // We make cross-cutting assumptions about typed arrays being in the primitive Gigacage and butterflies
+    // being in the JSValue gigacage. For some types, it's super obvious where they should go, and so we
+    // can hardcode that fact. But sometimes it's not clear, so we abstract it by having a Gigacage::Kind
+    // constant somewhere.
+    // FIXME: Maybe it would be better if everyone abstracted this?
+    // https://bugs.webkit.org/show_bug.cgi?id=175248
+    ALWAYS_INLINE CompleteSubspace& gigacageAuxiliarySpace(Gigacage::Kind kind)
+    {
+        switch (kind) {
+        case Gigacage::Primitive:
+            return primitiveGigacageAuxiliarySpace;
+        case Gigacage::JSValue:
+            return jsValueGigacageAuxiliarySpace;
+        case Gigacage::NumberOfKinds:
+            break;
+        }
+        RELEASE_ASSERT_NOT_REACHED();
+        return primitiveGigacageAuxiliarySpace;
+    }
+    
+    // Whenever possible, use subspaceFor<CellType>(vm) to get one of these subspaces.
+    CompleteSubspace cellSpace;
+    CompleteSubspace variableSizedCellSpace; // FIXME: This space is problematic because we have things in here like DirectArguments and ScopedArguments; those should be split into JSValueOOB cells and JSValueStrict auxiliaries. https://bugs.webkit.org/show_bug.cgi?id=182858
+    CompleteSubspace destructibleObjectSpace;
+
+    IsoSubspace arraySpace;
+    IsoSubspace bigIntSpace;
+    IsoSubspace calleeSpace;
+    IsoSubspace clonedArgumentsSpace;
+    IsoSubspace customGetterSetterSpace;
+    IsoSubspace dateInstanceSpace;
+    IsoSubspace domAttributeGetterSetterSpace;
+    IsoSubspace exceptionSpace;
+    IsoSubspace executableToCodeBlockEdgeSpace;
+    IsoSubspace functionSpace;
+    IsoSubspace getterSetterSpace;
+    IsoSubspace globalLexicalEnvironmentSpace;
+    IsoSubspace internalFunctionSpace;
+    IsoSubspace jsProxySpace;
+    IsoSubspace nativeExecutableSpace;
+    IsoSubspace numberObjectSpace;
+    IsoSubspace plainObjectSpace;
+    IsoSubspace promiseSpace;
+    IsoSubspace propertyNameEnumeratorSpace;
+    IsoSubspace propertyTableSpace;
+    IsoSubspace regExpSpace;
+    IsoSubspace regExpObjectSpace;
+    IsoSubspace ropeStringSpace;
+    IsoSubspace scopedArgumentsSpace;
+    IsoSubspace sparseArrayValueMapSpace;
+    IsoSubspace stringSpace;
+    IsoSubspace stringObjectSpace;
+    IsoSubspace structureChainSpace;
+    IsoSubspace structureRareDataSpace;
+    IsoSubspace structureSpace;
+    IsoSubspace brandedStructureSpace;
+    IsoSubspace symbolTableSpace;
+
+#define DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER(name) \
+    template<SubspaceAccess mode> \
+    IsoSubspace* name() \
+    { \
+        if (m_##name || mode == SubspaceAccess::Concurrently) \
+            return m_##name.get(); \
+        return name##Slow(); \
+    } \
+    JS_EXPORT_PRIVATE IsoSubspace* name##Slow(); \
+    std::unique_ptr<IsoSubspace> m_##name;
+
+
+#if JSC_OBJC_API_ENABLED
+    DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER(apiWrapperObjectSpace)
+    DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER(objCCallbackFunctionSpace)
+#endif
+#ifdef JSC_GLIB_API_ENABLED
+    DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER(apiWrapperObjectSpace)
+    DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER(jscCallbackFunctionSpace)
+    DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER(callbackAPIWrapperGlobalObjectSpace)
+#endif
+    DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER(apiGlobalObjectSpace)
+    DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER(apiValueWrapperSpace)
+    DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER(arrayBufferSpace)
+    DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER(arrayIteratorSpace)
+    DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER(asyncGeneratorSpace)
+    DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER(bigInt64ArraySpace)
+    DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER(bigIntObjectSpace)
+    DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER(bigUint64ArraySpace)
+    DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER(booleanObjectSpace)
+    DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER(boundFunctionSpace)
+    DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER(callbackConstructorSpace)
+    DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER(callbackGlobalObjectSpace)
+    DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER(callbackFunctionSpace)
+    DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER(callbackObjectSpace)
+    DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER(customGetterFunctionSpace)
+    DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER(customSetterFunctionSpace)
+    DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER(dataViewSpace)
+    DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER(debuggerScopeSpace)
+    DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER(errorInstanceSpace)
+    DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER(float32ArraySpace)
+    DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER(float64ArraySpace)
+    DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER(functionRareDataSpace)
+    DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER(generatorSpace)
+    DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER(globalObjectSpace)
+    DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER(injectedScriptHostSpace)
+    DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER(int8ArraySpace)
+    DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER(int16ArraySpace)
+    DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER(int32ArraySpace)
+    DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER(javaScriptCallFrameSpace)
+    DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER(jsModuleRecordSpace)
+    DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER(mapBucketSpace)
+    DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER(mapIteratorSpace)
+    DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER(mapSpace)
+    DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER(moduleNamespaceObjectSpace)
+    DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER(nativeStdFunctionSpace)
+    DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER(proxyObjectSpace)
+    DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER(proxyRevokeSpace)
+    DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER(scopedArgumentsTableSpace)
+    DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER(scriptFetchParametersSpace)
+    DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER(scriptFetcherSpace)
+    DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER(setBucketSpace)
+    DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER(setIteratorSpace)
+    DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER(setSpace)
+    DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER(shadowRealmSpace);
+    DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER(strictEvalActivationSpace)
+    DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER(stringIteratorSpace)
+    DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER(sourceCodeSpace)
+    DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER(symbolSpace)
+    DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER(symbolObjectSpace)
+    DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER(templateObjectDescriptorSpace)
+    DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER(temporalCalendarSpace)
+    DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER(temporalDurationSpace)
+    DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER(temporalInstantSpace)
+    DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER(temporalPlainTimeSpace)
+    DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER(temporalTimeZoneSpace)
+    DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER(uint8ArraySpace)
+    DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER(uint8ClampedArraySpace)
+    DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER(uint16ArraySpace)
+    DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER(uint32ArraySpace)
+    DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER(unlinkedEvalCodeBlockSpace)
+    DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER(unlinkedFunctionCodeBlockSpace)
+    DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER(unlinkedModuleProgramCodeBlockSpace)
+    DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER(unlinkedProgramCodeBlockSpace)
+    DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER(finalizationRegistrySpace)
+    DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER(weakObjectRefSpace)
+    DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER(weakSetSpace)
+    DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER(weakMapSpace)
+    DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER(withScopeSpace)
+    DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER(intlCollatorSpace)
+    DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER(intlDateTimeFormatSpace)
+    DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER(intlDisplayNamesSpace)
+    DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER(intlListFormatSpace)
+    DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER(intlLocaleSpace)
+    DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER(intlNumberFormatSpace)
+    DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER(intlPluralRulesSpace)
+    DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER(intlRelativeTimeFormatSpace)
+    DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER(intlSegmentIteratorSpace)
+    DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER(intlSegmenterSpace)
+    DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER(intlSegmentsSpace)
+#if ENABLE(WEBASSEMBLY)
+    DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER(jsToWasmICCalleeSpace)
+    DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER(webAssemblyCodeBlockSpace)
+    DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER(webAssemblyExceptionSpace)
+    DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER(webAssemblyFunctionSpace)
+    DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER(webAssemblyGlobalSpace)
+    DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER(webAssemblyInstanceSpace)
+    DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER(webAssemblyMemorySpace)
+    DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER(webAssemblyModuleSpace)
+    DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER(webAssemblyModuleRecordSpace)
+    DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER(webAssemblyTableSpace)
+    DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER(webAssemblyTagSpace)
+    DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER(webAssemblyWrapperFunctionSpace)
+#endif
+
+#undef DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER
+    
+    IsoCellSet executableToCodeBlockEdgesWithConstraints;
+    IsoCellSet executableToCodeBlockEdgesWithFinalizers;
+
+#define DYNAMIC_SPACE_AND_SET_DEFINE_MEMBER(name) \
+    template<SubspaceAccess mode> \
+    IsoSubspace* name() \
+    { \
+        if (auto* spaceAndSet = m_##name.get()) \
+            return &spaceAndSet->space; \
+        if (mode == SubspaceAccess::Concurrently) \
+            return nullptr; \
+        return name##Slow(); \
+    } \
+    IsoSubspace* name##Slow(); \
+    std::unique_ptr<SpaceAndSet> m_##name;
+    
+    struct SpaceAndSet {
+        WTF_MAKE_STRUCT_FAST_ALLOCATED;
+
+        IsoSubspace space;
+        IsoCellSet set;
+        
+        template<typename... Arguments>
+        SpaceAndSet(Arguments&&... arguments)
+            : space(std::forward<Arguments>(arguments)...)
+            , set(space)
+        {
+        }
+        
+        static IsoCellSet& setFor(Subspace& space)
+        {
+            return *bitwise_cast<IsoCellSet*>(
+                bitwise_cast<char*>(&space) -
+                OBJECT_OFFSETOF(SpaceAndSet, space) +
+                OBJECT_OFFSETOF(SpaceAndSet, set));
+        }
+    };
+    
+    SpaceAndSet codeBlockSpace;
+
+    template<typename Func>
+    void forEachCodeBlockSpace(const Func& func)
+    {
+        // This should not include webAssemblyCodeBlockSpace because this is about subsclasses of
+        // JSC::CodeBlock.
+        func(codeBlockSpace);
+    }
+
+    DYNAMIC_SPACE_AND_SET_DEFINE_MEMBER(evalExecutableSpace)
+    DYNAMIC_SPACE_AND_SET_DEFINE_MEMBER(moduleProgramExecutableSpace)
+    SpaceAndSet functionExecutableSpace;
+    SpaceAndSet programExecutableSpace;
+
+    template<typename Func>
+    void forEachScriptExecutableSpace(const Func& func)
+    {
+        if (m_evalExecutableSpace)
+            func(*m_evalExecutableSpace);
+        func(functionExecutableSpace);
+        if (m_moduleProgramExecutableSpace)
+            func(*m_moduleProgramExecutableSpace);
+        func(programExecutableSpace);
+    }
+
+    SpaceAndSet unlinkedFunctionExecutableSpace;
+
+#undef DYNAMIC_SPACE_AND_SET_DEFINE_MEMBER
</ins><span class="cx"> };
</span><span class="cx"> 
</span><span class="cx"> } // namespace JSC
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreheapHeapSubspaceTypesh"></a>
<div class="addfile"><h4>Added: trunk/Source/JavaScriptCore/heap/HeapSubspaceTypes.h (0 => 286347)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/heap/HeapSubspaceTypes.h                             (rev 0)
+++ trunk/Source/JavaScriptCore/heap/HeapSubspaceTypes.h        2021-12-01 04:38:56 UTC (rev 286347)
</span><span class="lines">@@ -0,0 +1,128 @@
</span><ins>+/*
+ * Copyright (C) 2021 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+// The purpose of this header file is simply to #include all the types
+// that we have Subspaces for so that Heap.cpp's #include list is not flooded
+// with these, and that it'll be easier to discern between these Subspace types
+// from other data structures needed for implementing Heap.
+
+#include "BigIntObject.h"
+#include "BooleanObject.h"
+#include "BrandedStructure.h"
+#include "ClonedArguments.h"
+#include "DateInstance.h"
+#include "DebuggerScope.h"
+#include "GetterSetter.h"
+#include "IntlCollator.h"
+#include "IntlDateTimeFormat.h"
+#include "IntlDisplayNames.h"
+#include "IntlListFormat.h"
+#include "IntlLocale.h"
+#include "IntlNumberFormat.h"
+#include "IntlPluralRules.h"
+#include "IntlRelativeTimeFormat.h"
+#include "IntlSegmentIterator.h"
+#include "IntlSegmenter.h"
+#include "IntlSegments.h"
+#include "JSAPIGlobalObject.h"
+#include "JSAPIValueWrapper.h"
+#include "JSAPIWrapperObject.h"
+#include "JSArray.h"
+#include "JSArrayBuffer.h"
+#include "JSArrayIterator.h"
+#include "JSAsyncGenerator.h"
+#include "JSBigInt.h"
+#include "JSBoundFunction.h"
+#include "JSCallbackConstructor.h"
+#include "JSCallbackFunction.h"
+#include "JSCallbackObject.h"
+#include "JSCallee.h"
+#include "JSCustomGetterFunction.h"
+#include "JSCustomSetterFunction.h"
+#include "JSDataView.h"
+#include "JSFunction.h"
+#include "JSGlobalLexicalEnvironment.h"
+#include "JSGlobalObject.h"
+#include "JSInjectedScriptHost.h"
+#include "JSJavaScriptCallFrame.h"
+#include "JSMap.h"
+#include "JSMapIterator.h"
+#include "JSModuleNamespaceObject.h"
+#include "JSModuleRecord.h"
+#include "JSNativeStdFunction.h"
+#include "JSPromise.h"
+#include "JSPropertyNameEnumerator.h"
+#include "JSProxy.h"
+#include "JSScriptFetchParameters.h"
+#include "JSScriptFetcher.h"
+#include "JSSet.h"
+#include "JSSetIterator.h"
+#include "JSSourceCode.h"
+#include "JSString.h"
+#include "JSStringIterator.h"
+#include "JSTemplateObjectDescriptor.h"
+#include "JSToWasmICCallee.h"
+#include "JSTypedArrays.h"
+#include "JSWebAssemblyException.h"
+#include "JSWebAssemblyGlobal.h"
+#include "JSWebAssemblyInstance.h"
+#include "JSWebAssemblyMemory.h"
+#include "JSWebAssemblyModule.h"
+#include "JSWebAssemblyTable.h"
+#include "JSWebAssemblyTag.h"
+#include "JSWithScope.h"
+#include "NativeExecutable.h"
+#include "ProgramExecutable.h"
+#include "PropertyTable.h"
+#include "ProxyRevoke.h"
+#include "RegExpObject.h"
+#include "ScopedArguments.h"
+#include "ShadowRealmObject.h"
+#include "StrictEvalActivation.h"
+#include "StringObject.h"
+#include "StructureChain.h"
+#include "SymbolObject.h"
+#include "TemporalCalendar.h"
+#include "TemporalDuration.h"
+#include "TemporalInstant.h"
+#include "TemporalPlainTime.h"
+#include "TemporalTimeZone.h"
+#include "UnlinkedFunctionCodeBlock.h"
+#include "UnlinkedModuleProgramCodeBlock.h"
+#include "UnlinkedProgramCodeBlock.h"
+#include "WebAssemblyFunction.h"
+#include "WebAssemblyModuleRecord.h"
+#include "WebAssemblyWrapperFunction.h"
+
+#if JSC_OBJC_API_ENABLED
+#include "ObjCCallbackFunction.h"
+#endif
+
+#ifdef JSC_GLIB_API_ENABLED
+#include "JSAPIWrapperGlobalObject.h"
+#include "JSCCallbackFunction.h"
+#endif
</ins></span></pre></div>
<a id="trunkSourceJavaScriptCoreheapIsoHeapCellTypeh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/heap/IsoHeapCellType.h (286346 => 286347)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/heap/IsoHeapCellType.h       2021-12-01 02:56:24 UTC (rev 286346)
+++ trunk/Source/JavaScriptCore/heap/IsoHeapCellType.h  2021-12-01 04:38:56 UTC (rev 286347)
</span><span class="lines">@@ -30,22 +30,30 @@
</span><span class="cx"> 
</span><span class="cx"> namespace JSC {
</span><span class="cx"> 
</span><del>-class IsoHeapCellType final : public HeapCellType {
</del><ins>+class JS_EXPORT_PRIVATE IsoHeapCellType final : public HeapCellType {
</ins><span class="cx"> public:
</span><span class="cx">     using DestroyFunctionPtr = void (*)(JSCell*);
</span><span class="cx"> 
</span><del>-    JS_EXPORT_PRIVATE ~IsoHeapCellType();
</del><ins>+    ~IsoHeapCellType();
</ins><span class="cx"> 
</span><del>-    JS_EXPORT_PRIVATE IsoHeapCellType(DestructionMode, DestroyFunctionPtr);
</del><ins>+    template<typename CellType>
+    struct Args {
+        Args()
+            : mode(CellType::needsDestruction ? NeedsDestruction : DoesNotNeedDestruction)
+            , functionPtr(&CellType::destroy)
+        { }
</ins><span class="cx"> 
</span><ins>+        DestructionMode mode;
+        DestroyFunctionPtr functionPtr;
+    };
+
</ins><span class="cx">     template<typename CellType>
</span><del>-    static std::unique_ptr<IsoHeapCellType> create()
-    {
-        return makeUnique<IsoHeapCellType>(CellType::needsDestruction ? NeedsDestruction : DoesNotNeedDestruction, &CellType::destroy);
-    }
</del><ins>+    IsoHeapCellType(Args<CellType>&& args)
+        : IsoHeapCellType(args.mode, args.functionPtr)
+    { }
</ins><span class="cx"> 
</span><del>-    JS_EXPORT_PRIVATE void finishSweep(MarkedBlock::Handle&, FreeList*) const final;
-    JS_EXPORT_PRIVATE void destroy(VM&, JSCell*) const final;
</del><ins>+    void finishSweep(MarkedBlock::Handle&, FreeList*) const final;
+    void destroy(VM&, JSCell*) const final;
</ins><span class="cx"> 
</span><span class="cx">     ALWAYS_INLINE void operator()(VM&, JSCell* cell) const
</span><span class="cx">     {
</span><span class="lines">@@ -53,6 +61,8 @@
</span><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx"> private:
</span><ins>+    IsoHeapCellType(DestructionMode, DestroyFunctionPtr);
+
</ins><span class="cx">     DestroyFunctionPtr WTF_VTBL_FUNCPTR_PTRAUTH_STR("IsoHeapCellType.destroy") m_destroy;
</span><span class="cx"> };
</span><span class="cx"> 
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreheapIsoInlinedHeapCellTypeh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/heap/IsoInlinedHeapCellType.h (286346 => 286347)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/heap/IsoInlinedHeapCellType.h        2021-12-01 02:56:24 UTC (rev 286346)
+++ trunk/Source/JavaScriptCore/heap/IsoInlinedHeapCellType.h   2021-12-01 04:38:56 UTC (rev 286347)
</span><span class="lines">@@ -32,28 +32,14 @@
</span><span class="cx"> template<typename CellType>
</span><span class="cx"> class IsoInlinedHeapCellType final : public HeapCellType {
</span><span class="cx"> public:
</span><del>-    IsoInlinedHeapCellType()
-        : HeapCellType(CellAttributes(CellType::needsDestruction ? NeedsDestruction : DoesNotNeedDestruction, HeapCell::JSCell))
-    {
-    }
</del><ins>+    IsoInlinedHeapCellType();
</ins><span class="cx"> 
</span><span class="cx">     struct DestroyFunc {
</span><del>-        ALWAYS_INLINE void operator()(VM&, JSCell* cell) const
-        {
-            CellType::destroy(cell);
-        }
</del><ins>+        ALWAYS_INLINE void operator()(VM&, JSCell*) const;
</ins><span class="cx">     };
</span><span class="cx"> 
</span><del>-    void finishSweep(MarkedBlock::Handle& handle, FreeList* freeList) const final
-    {
-        handle.finishSweepKnowingHeapCellType(freeList, DestroyFunc());
-    }
-
-    void destroy(VM&, JSCell* cell) const final
-    {
-        CellType::destroy(cell);
-    }
</del><ins>+    void finishSweep(MarkedBlock::Handle&, FreeList*) const final;
+    void destroy(VM&, JSCell*) const final;
</ins><span class="cx"> };
</span><span class="cx"> 
</span><span class="cx"> } // namespace JSC
</span><del>-
</del></span></pre></div>
<a id="trunkSourceJavaScriptCoreheapIsoInlinedHeapCellTypeInlinesh"></a>
<div class="addfile"><h4>Added: trunk/Source/JavaScriptCore/heap/IsoInlinedHeapCellTypeInlines.h (0 => 286347)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/heap/IsoInlinedHeapCellTypeInlines.h                         (rev 0)
+++ trunk/Source/JavaScriptCore/heap/IsoInlinedHeapCellTypeInlines.h    2021-12-01 04:38:56 UTC (rev 286347)
</span><span class="lines">@@ -0,0 +1,58 @@
</span><ins>+/*
+ * Copyright (C) 2021 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include "IsoInlinedHeapCellType.h"
+
+#include "MarkedBlock.h"
+
+namespace JSC {
+
+template<typename CellType>
+inline IsoInlinedHeapCellType<CellType>::IsoInlinedHeapCellType()
+    : HeapCellType(CellAttributes(CellType::needsDestruction ? NeedsDestruction : DoesNotNeedDestruction, HeapCell::JSCell))
+{
+}
+
+template<typename CellType>
+ALWAYS_INLINE void IsoInlinedHeapCellType<CellType>::DestroyFunc::operator()(VM&, JSCell* cell) const
+{
+    CellType::destroy(cell);
+}
+
+template<typename CellType>
+inline void IsoInlinedHeapCellType<CellType>::finishSweep(MarkedBlock::Handle& handle, FreeList* freeList) const
+{
+    handle.finishSweepKnowingHeapCellType(freeList, DestroyFunc());
+}
+
+template<typename CellType>
+inline void IsoInlinedHeapCellType<CellType>::destroy(VM&, JSCell* cell) const
+{
+    CellType::destroy(cell);
+}
+
+} // namespace JSC
</ins></span></pre></div>
<a id="trunkSourceJavaScriptCoreheapMarkedBlockInlinesh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/heap/MarkedBlockInlines.h (286346 => 286347)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/heap/MarkedBlockInlines.h    2021-12-01 02:56:24 UTC (rev 286346)
+++ trunk/Source/JavaScriptCore/heap/MarkedBlockInlines.h       2021-12-01 04:38:56 UTC (rev 286347)
</span><span class="lines">@@ -1,5 +1,5 @@
</span><span class="cx"> /*
</span><del>- * Copyright (C) 2016-2019 Apple Inc. All rights reserved.
</del><ins>+ * Copyright (C) 2016-2021 Apple Inc. All rights reserved.
</ins><span class="cx">  *
</span><span class="cx">  * Redistribution and use in source and binary forms, with or without
</span><span class="cx">  * modification, are permitted provided that the following conditions
</span><span class="lines">@@ -213,7 +213,7 @@
</span><span class="cx"> // sweepMode == SweepToFreeList
</span><span class="cx"> // scribbleMode == DontScribble
</span><span class="cx"> // newlyAllocatedMode == DoesNotHaveNewlyAllocated
</span><del>-// destructionMode != BlockHasDestrictorsAndCollectorIsRunning
</del><ins>+// destructionMode != BlockHasDestructorsAndCollectorIsRunning
</ins><span class="cx"> //
</span><span class="cx"> // emptyMode = IsEmpty
</span><span class="cx"> //     destructionMode = DoesNotNeedDestruction
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreinspectorJSInjectedScriptHostPrototypeh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/inspector/JSInjectedScriptHostPrototype.h (286346 => 286347)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/inspector/JSInjectedScriptHostPrototype.h    2021-12-01 02:56:24 UTC (rev 286346)
+++ trunk/Source/JavaScriptCore/inspector/JSInjectedScriptHostPrototype.h       2021-12-01 04:38:56 UTC (rev 286347)
</span><span class="lines">@@ -40,7 +40,7 @@
</span><span class="cx">     static JSC::IsoSubspace* subspaceFor(JSC::VM& vm)
</span><span class="cx">     {
</span><span class="cx">         STATIC_ASSERT_ISO_SUBSPACE_SHARABLE(JSInjectedScriptHostPrototype, Base);
</span><del>-        return &vm.plainObjectSpace;
</del><ins>+        return &vm.plainObjectSpace();
</ins><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     DECLARE_INFO;
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreinspectorJSJavaScriptCallFramePrototypeh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/inspector/JSJavaScriptCallFramePrototype.h (286346 => 286347)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/inspector/JSJavaScriptCallFramePrototype.h   2021-12-01 02:56:24 UTC (rev 286346)
+++ trunk/Source/JavaScriptCore/inspector/JSJavaScriptCallFramePrototype.h      2021-12-01 04:38:56 UTC (rev 286347)
</span><span class="lines">@@ -40,7 +40,7 @@
</span><span class="cx">     static JSC::IsoSubspace* subspaceFor(JSC::VM& vm)
</span><span class="cx">     {
</span><span class="cx">         STATIC_ASSERT_ISO_SUBSPACE_SHARABLE(JSJavaScriptCallFramePrototype, Base);
</span><del>-        return &vm.plainObjectSpace;
</del><ins>+        return &vm.plainObjectSpace();
</ins><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     DECLARE_INFO;
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreinterpreterCallFrameh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/interpreter/CallFrame.h (286346 => 286347)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/interpreter/CallFrame.h      2021-12-01 02:56:24 UTC (rev 286346)
+++ trunk/Source/JavaScriptCore/interpreter/CallFrame.h 2021-12-01 04:38:56 UTC (rev 286347)
</span><span class="lines">@@ -38,6 +38,7 @@
</span><span class="cx">     class JSCallee;
</span><span class="cx">     class JSScope;
</span><span class="cx">     class SourceOrigin;
</span><ins>+    class VirtualRegister;
</ins><span class="cx"> 
</span><span class="cx">     struct Instruction;
</span><span class="cx"> 
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorejsccpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/jsc.cpp (286346 => 286347)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/jsc.cpp      2021-12-01 02:56:24 UTC (rev 286346)
+++ trunk/Source/JavaScriptCore/jsc.cpp 2021-12-01 04:38:56 UTC (rev 286347)
</span><span class="lines">@@ -1429,7 +1429,7 @@
</span><span class="cx">     template<typename CellType, SubspaceAccess>
</span><span class="cx">     static CompleteSubspace* subspaceFor(VM& vm)
</span><span class="cx">     {
</span><del>-        return &vm.destructibleObjectSpace;
</del><ins>+        return &vm.destructibleObjectSpace();
</ins><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     JSCMemoryFootprint(VM& vm, Structure* structure)
</span><span class="lines">@@ -1762,7 +1762,7 @@
</span><span class="cx">     template<typename CellType, SubspaceAccess>
</span><span class="cx">     static CompleteSubspace* subspaceFor(VM& vm)
</span><span class="cx">     {
</span><del>-        return &vm.destructibleObjectSpace;
</del><ins>+        return &vm.destructibleObjectSpace();
</ins><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     static Structure* createStructure(VM& vm, JSGlobalObject* globalObject, JSValue prototype)
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeAggregateErrorPrototypeh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/AggregateErrorPrototype.h (286346 => 286347)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/AggregateErrorPrototype.h    2021-12-01 02:56:24 UTC (rev 286346)
+++ trunk/Source/JavaScriptCore/runtime/AggregateErrorPrototype.h       2021-12-01 04:38:56 UTC (rev 286347)
</span><span class="lines">@@ -44,7 +44,7 @@
</span><span class="cx">     static IsoSubspace* subspaceFor(VM& vm)
</span><span class="cx">     {
</span><span class="cx">         STATIC_ASSERT_ISO_SUBSPACE_SHARABLE(AggregateErrorPrototype, Base);
</span><del>-        return &vm.plainObjectSpace;
</del><ins>+        return &vm.plainObjectSpace();
</ins><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     static Structure* createStructure(VM& vm, JSGlobalObject* globalObject, JSValue prototype)
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeArrayIteratorPrototypeh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/ArrayIteratorPrototype.h (286346 => 286347)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/ArrayIteratorPrototype.h     2021-12-01 02:56:24 UTC (rev 286346)
+++ trunk/Source/JavaScriptCore/runtime/ArrayIteratorPrototype.h        2021-12-01 04:38:56 UTC (rev 286347)
</span><span class="lines">@@ -38,7 +38,7 @@
</span><span class="cx">     static IsoSubspace* subspaceFor(VM& vm)
</span><span class="cx">     {
</span><span class="cx">         STATIC_ASSERT_ISO_SUBSPACE_SHARABLE(ArrayIteratorPrototype, Base);
</span><del>-        return &vm.plainObjectSpace;
</del><ins>+        return &vm.plainObjectSpace();
</ins><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     static ArrayIteratorPrototype* create(VM& vm, JSGlobalObject* globalObject, Structure* structure)
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeAsyncFromSyncIteratorPrototypeh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/AsyncFromSyncIteratorPrototype.h (286346 => 286347)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/AsyncFromSyncIteratorPrototype.h     2021-12-01 02:56:24 UTC (rev 286346)
+++ trunk/Source/JavaScriptCore/runtime/AsyncFromSyncIteratorPrototype.h        2021-12-01 04:38:56 UTC (rev 286347)
</span><span class="lines">@@ -1,5 +1,6 @@
</span><span class="cx"> /*
</span><span class="cx">  * Copyright (C) 2017-2019 Oleksandr Skachkov <gskachkov@gmail.com>.
</span><ins>+ * Copyright (C) 2021 Apple, Inc. All rights reserved.
</ins><span class="cx">  *
</span><span class="cx">  * Redistribution and use in source and binary forms, with or without
</span><span class="cx">  * modification, are permitted provided that the following conditions
</span><span class="lines">@@ -37,7 +38,7 @@
</span><span class="cx">     static IsoSubspace* subspaceFor(VM& vm)
</span><span class="cx">     {
</span><span class="cx">         STATIC_ASSERT_ISO_SUBSPACE_SHARABLE(AsyncFromSyncIteratorPrototype, Base);
</span><del>-        return &vm.plainObjectSpace;
</del><ins>+        return &vm.plainObjectSpace();
</ins><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     DECLARE_INFO;
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeAsyncFunctionPrototypeh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/AsyncFunctionPrototype.h (286346 => 286347)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/AsyncFunctionPrototype.h     2021-12-01 02:56:24 UTC (rev 286346)
+++ trunk/Source/JavaScriptCore/runtime/AsyncFunctionPrototype.h        2021-12-01 04:38:56 UTC (rev 286347)
</span><span class="lines">@@ -38,7 +38,7 @@
</span><span class="cx">     static IsoSubspace* subspaceFor(VM& vm)
</span><span class="cx">     {
</span><span class="cx">         STATIC_ASSERT_ISO_SUBSPACE_SHARABLE(AsyncFunctionPrototype, Base);
</span><del>-        return &vm.plainObjectSpace;
</del><ins>+        return &vm.plainObjectSpace();
</ins><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     DECLARE_INFO;
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeAsyncGeneratorFunctionPrototypeh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/AsyncGeneratorFunctionPrototype.h (286346 => 286347)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/AsyncGeneratorFunctionPrototype.h    2021-12-01 02:56:24 UTC (rev 286346)
+++ trunk/Source/JavaScriptCore/runtime/AsyncGeneratorFunctionPrototype.h       2021-12-01 04:38:56 UTC (rev 286347)
</span><span class="lines">@@ -38,7 +38,7 @@
</span><span class="cx">     static IsoSubspace* subspaceFor(VM& vm)
</span><span class="cx">     {
</span><span class="cx">         STATIC_ASSERT_ISO_SUBSPACE_SHARABLE(AsyncGeneratorFunctionPrototype, Base);
</span><del>-        return &vm.plainObjectSpace;
</del><ins>+        return &vm.plainObjectSpace();
</ins><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     DECLARE_INFO;
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeAsyncGeneratorPrototypeh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/AsyncGeneratorPrototype.h (286346 => 286347)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/AsyncGeneratorPrototype.h    2021-12-01 02:56:24 UTC (rev 286346)
+++ trunk/Source/JavaScriptCore/runtime/AsyncGeneratorPrototype.h       2021-12-01 04:38:56 UTC (rev 286347)
</span><span class="lines">@@ -41,7 +41,7 @@
</span><span class="cx">     static IsoSubspace* subspaceFor(VM& vm)
</span><span class="cx">     {
</span><span class="cx">         STATIC_ASSERT_ISO_SUBSPACE_SHARABLE(AsyncGeneratorPrototype, Base);
</span><del>-        return &vm.plainObjectSpace;
</del><ins>+        return &vm.plainObjectSpace();
</ins><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     static AsyncGeneratorPrototype* create(VM& vm, JSGlobalObject*, Structure* structure)
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeAsyncIteratorPrototypeh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/AsyncIteratorPrototype.h (286346 => 286347)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/AsyncIteratorPrototype.h     2021-12-01 02:56:24 UTC (rev 286346)
+++ trunk/Source/JavaScriptCore/runtime/AsyncIteratorPrototype.h        2021-12-01 04:38:56 UTC (rev 286347)
</span><span class="lines">@@ -39,7 +39,7 @@
</span><span class="cx">     static IsoSubspace* subspaceFor(VM& vm)
</span><span class="cx">     {
</span><span class="cx">         STATIC_ASSERT_ISO_SUBSPACE_SHARABLE(AsyncIteratorPrototype, Base);
</span><del>-        return &vm.plainObjectSpace;
</del><ins>+        return &vm.plainObjectSpace();
</ins><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     static AsyncIteratorPrototype* create(VM& vm, JSGlobalObject* globalObject, Structure* structure)
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeAtomicsObjecth"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/AtomicsObject.h (286346 => 286347)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/AtomicsObject.h      2021-12-01 02:56:24 UTC (rev 286346)
+++ trunk/Source/JavaScriptCore/runtime/AtomicsObject.h 2021-12-01 04:38:56 UTC (rev 286347)
</span><span class="lines">@@ -1,5 +1,5 @@
</span><span class="cx"> /*
</span><del>- * Copyright (C) 2016-2017 Apple Inc. All rights reserved.
</del><ins>+ * Copyright (C) 2016-2021 Apple Inc. All rights reserved.
</ins><span class="cx">  *
</span><span class="cx">  * Redistribution and use in source and binary forms, with or without
</span><span class="cx">  * modification, are permitted provided that the following conditions
</span><span class="lines">@@ -37,7 +37,7 @@
</span><span class="cx">     static IsoSubspace* subspaceFor(VM& vm)
</span><span class="cx">     {
</span><span class="cx">         STATIC_ASSERT_ISO_SUBSPACE_SHARABLE(AtomicsObject, Base);
</span><del>-        return &vm.plainObjectSpace;
</del><ins>+        return &vm.plainObjectSpace();
</ins><span class="cx">     }
</span><span class="cx">     
</span><span class="cx">     static AtomicsObject* create(VM&, JSGlobalObject*, Structure*);
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeBigIntPrototypeh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/BigIntPrototype.h (286346 => 286347)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/BigIntPrototype.h    2021-12-01 02:56:24 UTC (rev 286346)
+++ trunk/Source/JavaScriptCore/runtime/BigIntPrototype.h       2021-12-01 04:38:56 UTC (rev 286347)
</span><span class="lines">@@ -39,7 +39,7 @@
</span><span class="cx">     static IsoSubspace* subspaceFor(VM& vm)
</span><span class="cx">     {
</span><span class="cx">         STATIC_ASSERT_ISO_SUBSPACE_SHARABLE(BigIntPrototype, Base);
</span><del>-        return &vm.plainObjectSpace;
</del><ins>+        return &vm.plainObjectSpace();
</ins><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     static BigIntPrototype* create(VM& vm, JSGlobalObject* globalObject, Structure* structure)
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeBrandedStructureh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/BrandedStructure.h (286346 => 286347)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/BrandedStructure.h   2021-12-01 02:56:24 UTC (rev 286346)
+++ trunk/Source/JavaScriptCore/runtime/BrandedStructure.h      2021-12-01 04:38:56 UTC (rev 286347)
</span><span class="lines">@@ -47,7 +47,7 @@
</span><span class="cx">     template<typename CellType, SubspaceAccess>
</span><span class="cx">     static IsoSubspace* subspaceFor(VM& vm)
</span><span class="cx">     {
</span><del>-        return &vm.brandedStructureSpace;
</del><ins>+        return &vm.brandedStructureSpace();
</ins><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     ALWAYS_INLINE bool checkBrand(Symbol* brand)
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeButterflyInlinesh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/ButterflyInlines.h (286346 => 286347)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/ButterflyInlines.h   2021-12-01 02:56:24 UTC (rev 286346)
+++ trunk/Source/JavaScriptCore/runtime/ButterflyInlines.h      2021-12-01 04:38:56 UTC (rev 286347)
</span><span class="lines">@@ -77,7 +77,7 @@
</span><span class="cx"> inline Butterfly* Butterfly::tryCreateUninitialized(VM& vm, JSObject*, size_t preCapacity, size_t propertyCapacity, bool hasIndexingHeader, size_t indexingPayloadSizeInBytes, GCDeferralContext* deferralContext)
</span><span class="cx"> {
</span><span class="cx">     size_t size = totalSize(preCapacity, propertyCapacity, hasIndexingHeader, indexingPayloadSizeInBytes);
</span><del>-    void* base = vm.jsValueGigacageAuxiliarySpace.allocateNonVirtual(vm, size, deferralContext, AllocationFailureMode::ReturnNull);
</del><ins>+    void* base = vm.jsValueGigacageAuxiliarySpace().allocateNonVirtual(vm, size, deferralContext, AllocationFailureMode::ReturnNull);
</ins><span class="cx">     if (UNLIKELY(!base))
</span><span class="cx">         return nullptr;
</span><span class="cx"> 
</span><span class="lines">@@ -89,7 +89,7 @@
</span><span class="cx"> inline Butterfly* Butterfly::createUninitialized(VM& vm, JSObject*, size_t preCapacity, size_t propertyCapacity, bool hasIndexingHeader, size_t indexingPayloadSizeInBytes)
</span><span class="cx"> {
</span><span class="cx">     size_t size = totalSize(preCapacity, propertyCapacity, hasIndexingHeader, indexingPayloadSizeInBytes);
</span><del>-    void* base = vm.jsValueGigacageAuxiliarySpace.allocateNonVirtual(vm, size, nullptr, AllocationFailureMode::Assert);
</del><ins>+    void* base = vm.jsValueGigacageAuxiliarySpace().allocateNonVirtual(vm, size, nullptr, AllocationFailureMode::Assert);
</ins><span class="cx">     Butterfly* result = fromBase(base, preCapacity, propertyCapacity);
</span><span class="cx"> 
</span><span class="cx">     return result;
</span><span class="lines">@@ -98,7 +98,7 @@
</span><span class="cx"> inline Butterfly* Butterfly::tryCreate(VM& vm, JSObject*, size_t preCapacity, size_t propertyCapacity, bool hasIndexingHeader, const IndexingHeader& indexingHeader, size_t indexingPayloadSizeInBytes)
</span><span class="cx"> {
</span><span class="cx">     size_t size = totalSize(preCapacity, propertyCapacity, hasIndexingHeader, indexingPayloadSizeInBytes);
</span><del>-    void* base = vm.jsValueGigacageAuxiliarySpace.allocateNonVirtual(vm, size, nullptr, AllocationFailureMode::ReturnNull);
</del><ins>+    void* base = vm.jsValueGigacageAuxiliarySpace().allocateNonVirtual(vm, size, nullptr, AllocationFailureMode::ReturnNull);
</ins><span class="cx">     if (!base)
</span><span class="cx">         return nullptr;
</span><span class="cx">     Butterfly* result = fromBase(base, preCapacity, propertyCapacity);
</span><span class="lines">@@ -174,7 +174,7 @@
</span><span class="cx">     void* theBase = base(0, propertyCapacity);
</span><span class="cx">     size_t oldSize = totalSize(0, propertyCapacity, hadIndexingHeader, oldIndexingPayloadSizeInBytes);
</span><span class="cx">     size_t newSize = totalSize(0, propertyCapacity, true, newIndexingPayloadSizeInBytes);
</span><del>-    void* newBase = vm.jsValueGigacageAuxiliarySpace.allocateNonVirtual(vm, newSize, nullptr, AllocationFailureMode::ReturnNull);
</del><ins>+    void* newBase = vm.jsValueGigacageAuxiliarySpace().allocateNonVirtual(vm, newSize, nullptr, AllocationFailureMode::ReturnNull);
</ins><span class="cx">     if (!newBase)
</span><span class="cx">         return nullptr;
</span><span class="cx">     // FIXME: This probably shouldn't be a memcpy.
</span><span class="lines">@@ -211,13 +211,13 @@
</span><span class="cx">     // Objects with no properties are common in arrays, and we are focusing on very large array crafted by repeating Array#push, so... that's fine!
</span><span class="cx">     bool canRealloc = !propertyCapacity && !vm.heap.mutatorShouldBeFenced() && bitwise_cast<HeapCell*>(theBase)->isPreciseAllocation();
</span><span class="cx">     if (canRealloc) {
</span><del>-        void* newBase = vm.jsValueGigacageAuxiliarySpace.reallocatePreciseAllocationNonVirtual(vm, bitwise_cast<HeapCell*>(theBase), newSize, &deferralContext, AllocationFailureMode::ReturnNull);
</del><ins>+        void* newBase = vm.jsValueGigacageAuxiliarySpace().reallocatePreciseAllocationNonVirtual(vm, bitwise_cast<HeapCell*>(theBase), newSize, &deferralContext, AllocationFailureMode::ReturnNull);
</ins><span class="cx">         if (!newBase)
</span><span class="cx">             return nullptr;
</span><span class="cx">         return fromBase(newBase, 0, propertyCapacity);
</span><span class="cx">     }
</span><span class="cx"> 
</span><del>-    void* newBase = vm.jsValueGigacageAuxiliarySpace.allocateNonVirtual(vm, newSize, &deferralContext, AllocationFailureMode::ReturnNull);
</del><ins>+    void* newBase = vm.jsValueGigacageAuxiliarySpace().allocateNonVirtual(vm, newSize, &deferralContext, AllocationFailureMode::ReturnNull);
</ins><span class="cx">     if (!newBase)
</span><span class="cx">         return nullptr;
</span><span class="cx">     gcSafeMemcpy(static_cast<JSValue*>(newBase), static_cast<JSValue*>(theBase), oldSize);
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeCachedTypesh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/CachedTypes.h (286346 => 286347)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/CachedTypes.h        2021-12-01 02:56:24 UTC (rev 286346)
+++ trunk/Source/JavaScriptCore/runtime/CachedTypes.h   2021-12-01 04:38:56 UTC (rev 286347)
</span><span class="lines">@@ -1,5 +1,5 @@
</span><span class="cx"> /*
</span><del>- * Copyright (C) 2018-2019 Apple Inc. All rights reserved.
</del><ins>+ * Copyright (C) 2018-2021 Apple Inc. All rights reserved.
</ins><span class="cx">  *
</span><span class="cx">  * Redistribution and use in source and binary forms, with or without
</span><span class="cx">  * modification, are permitted provided that the following conditions
</span><span class="lines">@@ -39,6 +39,7 @@
</span><span class="cx"> class SourceCodeKey;
</span><span class="cx"> class UnlinkedCodeBlock;
</span><span class="cx"> class UnlinkedFunctionCodeBlock;
</span><ins>+class UnlinkedFunctionExecutable;
</ins><span class="cx"> 
</span><span class="cx"> enum class SourceCodeType;
</span><span class="cx"> 
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeClonedArgumentsh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/ClonedArguments.h (286346 => 286347)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/ClonedArguments.h    2021-12-01 02:56:24 UTC (rev 286346)
+++ trunk/Source/JavaScriptCore/runtime/ClonedArguments.h       2021-12-01 04:38:56 UTC (rev 286347)
</span><span class="lines">@@ -46,7 +46,7 @@
</span><span class="cx">     static IsoSubspace* subspaceFor(VM& vm)
</span><span class="cx">     {
</span><span class="cx">         static_assert(!CellType::needsDestruction, "");
</span><del>-        return &vm.clonedArgumentsSpace;
</del><ins>+        return &vm.clonedArgumentsSpace();
</ins><span class="cx">     }
</span><span class="cx">     
</span><span class="cx"> private:
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeConsoleObjecth"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/ConsoleObject.h (286346 => 286347)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/ConsoleObject.h      2021-12-01 02:56:24 UTC (rev 286346)
+++ trunk/Source/JavaScriptCore/runtime/ConsoleObject.h 2021-12-01 04:38:56 UTC (rev 286347)
</span><span class="lines">@@ -37,7 +37,7 @@
</span><span class="cx">     static IsoSubspace* subspaceFor(VM& vm)
</span><span class="cx">     {
</span><span class="cx">         STATIC_ASSERT_ISO_SUBSPACE_SHARABLE(ConsoleObject, Base);
</span><del>-        return &vm.plainObjectSpace;
</del><ins>+        return &vm.plainObjectSpace();
</ins><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     static ConsoleObject* create(VM& vm, JSGlobalObject* globalObject, Structure* structure)
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeCustomGetterSetterh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/CustomGetterSetter.h (286346 => 286347)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/CustomGetterSetter.h 2021-12-01 02:56:24 UTC (rev 286346)
+++ trunk/Source/JavaScriptCore/runtime/CustomGetterSetter.h    2021-12-01 04:38:56 UTC (rev 286347)
</span><span class="lines">@@ -43,7 +43,7 @@
</span><span class="cx">     template<typename CellType, SubspaceAccess>
</span><span class="cx">     static IsoSubspace* subspaceFor(VM& vm)
</span><span class="cx">     {
</span><del>-        return &vm.customGetterSetterSpace;
</del><ins>+        return &vm.customGetterSetterSpace();
</ins><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     static CustomGetterSetter* create(VM& vm, CustomGetter customGetter, CustomSetter customSetter)
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeDOMAttributeGetterSetterh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/DOMAttributeGetterSetter.h (286346 => 286347)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/DOMAttributeGetterSetter.h   2021-12-01 02:56:24 UTC (rev 286346)
+++ trunk/Source/JavaScriptCore/runtime/DOMAttributeGetterSetter.h      2021-12-01 04:38:56 UTC (rev 286347)
</span><span class="lines">@@ -43,7 +43,7 @@
</span><span class="cx">     template<typename CellType, SubspaceAccess>
</span><span class="cx">     static IsoSubspace* subspaceFor(VM& vm)
</span><span class="cx">     {
</span><del>-        return &vm.domAttributeGetterSetterSpace;
</del><ins>+        return &vm.domAttributeGetterSetterSpace();
</ins><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     static DOMAttributeGetterSetter* create(VM& vm, CustomGetter customGetter, CustomSetter customSetter, DOMAttributeAnnotation domAttribute)
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeDateInstanceh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/DateInstance.h (286346 => 286347)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/DateInstance.h       2021-12-01 02:56:24 UTC (rev 286346)
+++ trunk/Source/JavaScriptCore/runtime/DateInstance.h  2021-12-01 04:38:56 UTC (rev 286347)
</span><span class="lines">@@ -37,7 +37,7 @@
</span><span class="cx">     template<typename CellType, SubspaceAccess mode>
</span><span class="cx">     static IsoSubspace* subspaceFor(VM& vm)
</span><span class="cx">     {
</span><del>-        return &vm.dateInstanceSpace;
</del><ins>+        return &vm.dateInstanceSpace();
</ins><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     static DateInstance* create(VM& vm, Structure* structure, double date)
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeDatePrototypeh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/DatePrototype.h (286346 => 286347)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/DatePrototype.h      2021-12-01 02:56:24 UTC (rev 286346)
+++ trunk/Source/JavaScriptCore/runtime/DatePrototype.h 2021-12-01 04:38:56 UTC (rev 286347)
</span><span class="lines">@@ -35,7 +35,7 @@
</span><span class="cx">     static IsoSubspace* subspaceFor(VM& vm)
</span><span class="cx">     {
</span><span class="cx">         STATIC_ASSERT_ISO_SUBSPACE_SHARABLE(DatePrototype, Base);
</span><del>-        return &vm.plainObjectSpace;
</del><ins>+        return &vm.plainObjectSpace();
</ins><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     static DatePrototype* create(VM& vm, JSGlobalObject* globalObject, Structure* structure)
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeDirectArgumentsh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/DirectArguments.h (286346 => 286347)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/DirectArguments.h    2021-12-01 02:56:24 UTC (rev 286346)
+++ trunk/Source/JavaScriptCore/runtime/DirectArguments.h       2021-12-01 04:38:56 UTC (rev 286347)
</span><span class="lines">@@ -50,7 +50,7 @@
</span><span class="cx">     static CompleteSubspace* subspaceFor(VM& vm)
</span><span class="cx">     {
</span><span class="cx">         static_assert(!CellType::needsDestruction, "");
</span><del>-        return &vm.variableSizedCellSpace;
</del><ins>+        return &vm.variableSizedCellSpace();
</ins><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     // Creates an arguments object but leaves it uninitialized. This is dangerous if we GC right
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeErrorPrototypeh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/ErrorPrototype.h (286346 => 286347)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/ErrorPrototype.h     2021-12-01 02:56:24 UTC (rev 286346)
+++ trunk/Source/JavaScriptCore/runtime/ErrorPrototype.h        2021-12-01 04:38:56 UTC (rev 286347)
</span><span class="lines">@@ -45,7 +45,7 @@
</span><span class="cx">     static IsoSubspace* subspaceFor(VM& vm)
</span><span class="cx">     {
</span><span class="cx">         STATIC_ASSERT_ISO_SUBSPACE_SHARABLE(ErrorPrototypeBase, Base);
</span><del>-        return &vm.plainObjectSpace;
</del><ins>+        return &vm.plainObjectSpace();
</ins><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     DECLARE_INFO;
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeExceptionh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/Exception.h (286346 => 286347)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/Exception.h  2021-12-01 02:56:24 UTC (rev 286346)
+++ trunk/Source/JavaScriptCore/runtime/Exception.h     2021-12-01 04:38:56 UTC (rev 286347)
</span><span class="lines">@@ -40,7 +40,7 @@
</span><span class="cx">     template<typename CellType, SubspaceAccess mode>
</span><span class="cx">     static IsoSubspace* subspaceFor(VM& vm)
</span><span class="cx">     {
</span><del>-        return &vm.exceptionSpace;
</del><ins>+        return &vm.exceptionSpace();
</ins><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     enum StackCaptureAction {
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeFinalizationRegistryPrototypeh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/FinalizationRegistryPrototype.h (286346 => 286347)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/FinalizationRegistryPrototype.h      2021-12-01 02:56:24 UTC (rev 286346)
+++ trunk/Source/JavaScriptCore/runtime/FinalizationRegistryPrototype.h 2021-12-01 04:38:56 UTC (rev 286347)
</span><span class="lines">@@ -37,7 +37,7 @@
</span><span class="cx">     static IsoSubspace* subspaceFor(VM& vm)
</span><span class="cx">     {
</span><span class="cx">         STATIC_ASSERT_ISO_SUBSPACE_SHARABLE(FinalizationRegistryPrototype, Base);
</span><del>-        return &vm.plainObjectSpace;
</del><ins>+        return &vm.plainObjectSpace();
</ins><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     static FinalizationRegistryPrototype* create(VM& vm, JSGlobalObject* globalObject, Structure* structure)
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeFunctionExecutableh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/FunctionExecutable.h (286346 => 286347)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/FunctionExecutable.h 2021-12-01 02:56:24 UTC (rev 286346)
+++ trunk/Source/JavaScriptCore/runtime/FunctionExecutable.h    2021-12-01 04:38:56 UTC (rev 286347)
</span><span class="lines">@@ -46,7 +46,7 @@
</span><span class="cx">     template<typename CellType, SubspaceAccess>
</span><span class="cx">     static IsoSubspace* subspaceFor(VM& vm)
</span><span class="cx">     {
</span><del>-        return &vm.functionExecutableSpace.space;
</del><ins>+        return &vm.functionExecutableSpace().space;
</ins><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     static FunctionExecutable* create(VM& vm, ScriptExecutable* topLevelExecutable, const SourceCode& source, UnlinkedFunctionExecutable* unlinkedExecutable, Intrinsic intrinsic, bool isInsideOrdinaryFunction)
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeGeneratorFunctionPrototypeh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/GeneratorFunctionPrototype.h (286346 => 286347)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/GeneratorFunctionPrototype.h 2021-12-01 02:56:24 UTC (rev 286346)
+++ trunk/Source/JavaScriptCore/runtime/GeneratorFunctionPrototype.h    2021-12-01 04:38:56 UTC (rev 286347)
</span><span class="lines">@@ -40,7 +40,7 @@
</span><span class="cx">     static IsoSubspace* subspaceFor(VM& vm)
</span><span class="cx">     {
</span><span class="cx">         STATIC_ASSERT_ISO_SUBSPACE_SHARABLE(GeneratorFunctionPrototype, Base);
</span><del>-        return &vm.plainObjectSpace;
</del><ins>+        return &vm.plainObjectSpace();
</ins><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     static GeneratorFunctionPrototype* create(VM& vm, Structure* structure)
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeGeneratorPrototypeh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/GeneratorPrototype.h (286346 => 286347)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/GeneratorPrototype.h 2021-12-01 02:56:24 UTC (rev 286346)
+++ trunk/Source/JavaScriptCore/runtime/GeneratorPrototype.h    2021-12-01 04:38:56 UTC (rev 286347)
</span><span class="lines">@@ -41,7 +41,7 @@
</span><span class="cx">     static IsoSubspace* subspaceFor(VM& vm)
</span><span class="cx">     {
</span><span class="cx">         STATIC_ASSERT_ISO_SUBSPACE_SHARABLE(GeneratorPrototype, Base);
</span><del>-        return &vm.plainObjectSpace;
</del><ins>+        return &vm.plainObjectSpace();
</ins><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     static GeneratorPrototype* create(VM& vm, JSGlobalObject*, Structure* structure)
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeGetterSetterh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/GetterSetter.h (286346 => 286347)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/GetterSetter.h       2021-12-01 02:56:24 UTC (rev 286346)
+++ trunk/Source/JavaScriptCore/runtime/GetterSetter.h  2021-12-01 04:38:56 UTC (rev 286347)
</span><span class="lines">@@ -59,7 +59,7 @@
</span><span class="cx">     template<typename CellType, SubspaceAccess>
</span><span class="cx">     static IsoSubspace* subspaceFor(VM& vm)
</span><span class="cx">     {
</span><del>-        return &vm.getterSetterSpace;
</del><ins>+        return &vm.getterSetterSpace();
</ins><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     static GetterSetter* create(VM& vm, JSGlobalObject* globalObject, JSObject* getter, JSObject* setter)
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeHashMapImplh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/HashMapImpl.h (286346 => 286347)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/HashMapImpl.h        2021-12-01 02:56:24 UTC (rev 286346)
+++ trunk/Source/JavaScriptCore/runtime/HashMapImpl.h   2021-12-01 04:38:56 UTC (rev 286347)
</span><span class="lines">@@ -213,7 +213,7 @@
</span><span class="cx">     {
</span><span class="cx">         auto scope = DECLARE_THROW_SCOPE(vm);
</span><span class="cx">         size_t allocationSize = HashMapBuffer::allocationSize(capacity);
</span><del>-        void* data = vm.jsValueGigacageAuxiliarySpace.allocateNonVirtual(vm, allocationSize, nullptr, AllocationFailureMode::ReturnNull);
</del><ins>+        void* data = vm.jsValueGigacageAuxiliarySpace().allocateNonVirtual(vm, allocationSize, nullptr, AllocationFailureMode::ReturnNull);
</ins><span class="cx">         if (!data) {
</span><span class="cx">             throwOutOfMemoryError(globalObject, scope);
</span><span class="cx">             return nullptr;
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeInternalFunctionh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/InternalFunction.h (286346 => 286347)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/InternalFunction.h   2021-12-01 02:56:24 UTC (rev 286346)
+++ trunk/Source/JavaScriptCore/runtime/InternalFunction.h      2021-12-01 04:38:56 UTC (rev 286347)
</span><span class="lines">@@ -41,7 +41,7 @@
</span><span class="cx">     static IsoSubspace* subspaceFor(VM& vm)
</span><span class="cx">     {
</span><span class="cx">         static_assert(sizeof(CellType) == sizeof(InternalFunction), "InternalFunction subclasses that add fields need to override subspaceFor<>()");
</span><del>-        return &vm.internalFunctionSpace;
</del><ins>+        return &vm.internalFunctionSpace();
</ins><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     DECLARE_EXPORT_INFO;
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeIntlCollatorPrototypeh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/IntlCollatorPrototype.h (286346 => 286347)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/IntlCollatorPrototype.h      2021-12-01 02:56:24 UTC (rev 286346)
+++ trunk/Source/JavaScriptCore/runtime/IntlCollatorPrototype.h 2021-12-01 04:38:56 UTC (rev 286347)
</span><span class="lines">@@ -1,6 +1,6 @@
</span><span class="cx"> /*
</span><span class="cx">  * Copyright (C) 2015 Andy VanWagoner (andy@vanwagoner.family)
</span><del>- * Copyright (C) 2019 Apple Inc. All rights reserved.
</del><ins>+ * Copyright (C) 2019-2021 Apple Inc. All rights reserved.
</ins><span class="cx">  *
</span><span class="cx">  * Redistribution and use in source and binary forms, with or without
</span><span class="cx">  * modification, are permitted provided that the following conditions
</span><span class="lines">@@ -39,7 +39,7 @@
</span><span class="cx">     static IsoSubspace* subspaceFor(VM& vm)
</span><span class="cx">     {
</span><span class="cx">         STATIC_ASSERT_ISO_SUBSPACE_SHARABLE(IntlCollatorPrototype, Base);
</span><del>-        return &vm.plainObjectSpace;
</del><ins>+        return &vm.plainObjectSpace();
</ins><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     static IntlCollatorPrototype* create(VM&, JSGlobalObject*, Structure*);
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeIntlDateTimeFormatPrototypeh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/IntlDateTimeFormatPrototype.h (286346 => 286347)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/IntlDateTimeFormatPrototype.h        2021-12-01 02:56:24 UTC (rev 286346)
+++ trunk/Source/JavaScriptCore/runtime/IntlDateTimeFormatPrototype.h   2021-12-01 04:38:56 UTC (rev 286347)
</span><span class="lines">@@ -1,6 +1,6 @@
</span><span class="cx"> /*
</span><span class="cx">  * Copyright (C) 2015 Andy VanWagoner (andy@vanwagoner.family)
</span><del>- * Copyright (C) 2019 Apple Inc. All rights reserved.
</del><ins>+ * Copyright (C) 2019-2021 Apple Inc. All rights reserved.
</ins><span class="cx">  *
</span><span class="cx">  * Redistribution and use in source and binary forms, with or without
</span><span class="cx">  * modification, are permitted provided that the following conditions
</span><span class="lines">@@ -39,7 +39,7 @@
</span><span class="cx">     static IsoSubspace* subspaceFor(VM& vm)
</span><span class="cx">     {
</span><span class="cx">         STATIC_ASSERT_ISO_SUBSPACE_SHARABLE(IntlDateTimeFormatPrototype, Base);
</span><del>-        return &vm.plainObjectSpace;
</del><ins>+        return &vm.plainObjectSpace();
</ins><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     static IntlDateTimeFormatPrototype* create(VM&, JSGlobalObject*, Structure*);
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeIntlDisplayNamesPrototypeh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/IntlDisplayNamesPrototype.h (286346 => 286347)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/IntlDisplayNamesPrototype.h  2021-12-01 02:56:24 UTC (rev 286346)
+++ trunk/Source/JavaScriptCore/runtime/IntlDisplayNamesPrototype.h     2021-12-01 04:38:56 UTC (rev 286347)
</span><span class="lines">@@ -1,5 +1,5 @@
</span><span class="cx"> /*
</span><del>- * Copyright (C) 2020 Apple Inc. All rights reserved.
</del><ins>+ * Copyright (C) 2020-2021 Apple Inc. All rights reserved.
</ins><span class="cx">  *
</span><span class="cx">  * Redistribution and use in source and binary forms, with or without
</span><span class="cx">  * modification, are permitted provided that the following conditions
</span><span class="lines">@@ -38,7 +38,7 @@
</span><span class="cx">     static IsoSubspace* subspaceFor(VM& vm)
</span><span class="cx">     {
</span><span class="cx">         STATIC_ASSERT_ISO_SUBSPACE_SHARABLE(IntlDisplayNamesPrototype, Base);
</span><del>-        return &vm.plainObjectSpace;
</del><ins>+        return &vm.plainObjectSpace();
</ins><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     static IntlDisplayNamesPrototype* create(VM&, Structure*);
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeIntlListFormatPrototypeh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/IntlListFormatPrototype.h (286346 => 286347)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/IntlListFormatPrototype.h    2021-12-01 02:56:24 UTC (rev 286346)
+++ trunk/Source/JavaScriptCore/runtime/IntlListFormatPrototype.h       2021-12-01 04:38:56 UTC (rev 286347)
</span><span class="lines">@@ -1,5 +1,5 @@
</span><span class="cx"> /*
</span><del>- * Copyright (C) 2020 Apple Inc. All rights reserved.
</del><ins>+ * Copyright (C) 2020-2021 Apple Inc. All rights reserved.
</ins><span class="cx">  *
</span><span class="cx">  * Redistribution and use in source and binary forms, with or without
</span><span class="cx">  * modification, are permitted provided that the following conditions
</span><span class="lines">@@ -38,7 +38,7 @@
</span><span class="cx">     static IsoSubspace* subspaceFor(VM& vm)
</span><span class="cx">     {
</span><span class="cx">         STATIC_ASSERT_ISO_SUBSPACE_SHARABLE(IntlListFormatPrototype, Base);
</span><del>-        return &vm.plainObjectSpace;
</del><ins>+        return &vm.plainObjectSpace();
</ins><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     static IntlListFormatPrototype* create(VM&, Structure*);
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeIntlLocalePrototypeh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/IntlLocalePrototype.h (286346 => 286347)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/IntlLocalePrototype.h        2021-12-01 02:56:24 UTC (rev 286346)
+++ trunk/Source/JavaScriptCore/runtime/IntlLocalePrototype.h   2021-12-01 04:38:56 UTC (rev 286347)
</span><span class="lines">@@ -1,5 +1,6 @@
</span><span class="cx"> /*
</span><span class="cx">  * Copyright (C) 2020 Sony Interactive Entertainment Inc.
</span><ins>+ * Copyright (C) 2021 Apple Inc. All rights reserved.
</ins><span class="cx">  *
</span><span class="cx">  * Redistribution and use in source and binary forms, with or without
</span><span class="cx">  * modification, are permitted provided that the following conditions
</span><span class="lines">@@ -38,7 +39,7 @@
</span><span class="cx">     static IsoSubspace* subspaceFor(VM& vm)
</span><span class="cx">     {
</span><span class="cx">         STATIC_ASSERT_ISO_SUBSPACE_SHARABLE(IntlLocalePrototype, Base);
</span><del>-        return &vm.plainObjectSpace;
</del><ins>+        return &vm.plainObjectSpace();
</ins><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     static IntlLocalePrototype* create(VM&, Structure*);
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeIntlNumberFormatPrototypeh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/IntlNumberFormatPrototype.h (286346 => 286347)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/IntlNumberFormatPrototype.h  2021-12-01 02:56:24 UTC (rev 286346)
+++ trunk/Source/JavaScriptCore/runtime/IntlNumberFormatPrototype.h     2021-12-01 04:38:56 UTC (rev 286347)
</span><span class="lines">@@ -1,6 +1,6 @@
</span><span class="cx"> /*
</span><span class="cx">  * Copyright (C) 2015 Andy VanWagoner (andy@vanwagoner.family)
</span><del>- * Copyright (C) 2019 Apple Inc. All rights reserved.
</del><ins>+ * Copyright (C) 2019-2021 Apple Inc. All rights reserved.
</ins><span class="cx">  *
</span><span class="cx">  * Redistribution and use in source and binary forms, with or without
</span><span class="cx">  * modification, are permitted provided that the following conditions
</span><span class="lines">@@ -39,7 +39,7 @@
</span><span class="cx">     static IsoSubspace* subspaceFor(VM& vm)
</span><span class="cx">     {
</span><span class="cx">         STATIC_ASSERT_ISO_SUBSPACE_SHARABLE(IntlNumberFormatPrototype, Base);
</span><del>-        return &vm.plainObjectSpace;
</del><ins>+        return &vm.plainObjectSpace();
</ins><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     static IntlNumberFormatPrototype* create(VM&, JSGlobalObject*, Structure*);
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeIntlObjecth"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/IntlObject.h (286346 => 286347)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/IntlObject.h 2021-12-01 02:56:24 UTC (rev 286346)
+++ trunk/Source/JavaScriptCore/runtime/IntlObject.h    2021-12-01 04:38:56 UTC (rev 286347)
</span><span class="lines">@@ -1,6 +1,6 @@
</span><span class="cx"> /*
</span><span class="cx">  * Copyright (C) 2015 Andy VanWagoner (andy@vanwagoner.family)
</span><del>- * Copyright (C) 2019-2020 Apple Inc. All rights reserved.
</del><ins>+ * Copyright (C) 2019-2021 Apple Inc. All rights reserved.
</ins><span class="cx">  * Copyright (C) 2020 Sony Interactive Entertainment Inc.
</span><span class="cx">  *
</span><span class="cx">  * Redistribution and use in source and binary forms, with or without
</span><span class="lines">@@ -76,7 +76,7 @@
</span><span class="cx">     static IsoSubspace* subspaceFor(VM& vm)
</span><span class="cx">     {
</span><span class="cx">         STATIC_ASSERT_ISO_SUBSPACE_SHARABLE(IntlObject, Base);
</span><del>-        return &vm.plainObjectSpace;
</del><ins>+        return &vm.plainObjectSpace();
</ins><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     static IntlObject* create(VM&, JSGlobalObject*, Structure*);
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeIntlPluralRulesPrototypeh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/IntlPluralRulesPrototype.h (286346 => 286347)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/IntlPluralRulesPrototype.h   2021-12-01 02:56:24 UTC (rev 286346)
+++ trunk/Source/JavaScriptCore/runtime/IntlPluralRulesPrototype.h      2021-12-01 04:38:56 UTC (rev 286347)
</span><span class="lines">@@ -1,6 +1,6 @@
</span><span class="cx"> /*
</span><span class="cx">  * Copyright (C) 2018 Andy VanWagoner (andy@vanwagoner.family)
</span><del>- * Copyright (C) 2019 Apple Inc. All rights reserved.
</del><ins>+ * Copyright (C) 2019-2021 Apple Inc. All rights reserved.
</ins><span class="cx">  *
</span><span class="cx">  * Redistribution and use in source and binary forms, with or without
</span><span class="cx">  * modification, are permitted provided that the following conditions
</span><span class="lines">@@ -39,7 +39,7 @@
</span><span class="cx">     static IsoSubspace* subspaceFor(VM& vm)
</span><span class="cx">     {
</span><span class="cx">         STATIC_ASSERT_ISO_SUBSPACE_SHARABLE(IntlPluralRulesPrototype, Base);
</span><del>-        return &vm.plainObjectSpace;
</del><ins>+        return &vm.plainObjectSpace();
</ins><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     static IntlPluralRulesPrototype* create(VM&, JSGlobalObject*, Structure*);
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeIntlRelativeTimeFormatPrototypeh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/IntlRelativeTimeFormatPrototype.h (286346 => 286347)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/IntlRelativeTimeFormatPrototype.h    2021-12-01 02:56:24 UTC (rev 286346)
+++ trunk/Source/JavaScriptCore/runtime/IntlRelativeTimeFormatPrototype.h       2021-12-01 04:38:56 UTC (rev 286347)
</span><span class="lines">@@ -1,5 +1,6 @@
</span><span class="cx"> /*
</span><span class="cx">  * Copyright (C) 2020 Sony Interactive Entertainment Inc.
</span><ins>+ * Copyright (C) 2021 Apple Inc. All rights reserved.
</ins><span class="cx">  *
</span><span class="cx">  * Redistribution and use in source and binary forms, with or without
</span><span class="cx">  * modification, are permitted provided that the following conditions
</span><span class="lines">@@ -38,7 +39,7 @@
</span><span class="cx">     static IsoSubspace* subspaceFor(VM& vm)
</span><span class="cx">     {
</span><span class="cx">         STATIC_ASSERT_ISO_SUBSPACE_SHARABLE(IntlRelativeTimeFormatPrototype, Base);
</span><del>-        return &vm.plainObjectSpace;
</del><ins>+        return &vm.plainObjectSpace();
</ins><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     static IntlRelativeTimeFormatPrototype* create(VM&, Structure*);
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeIntlSegmentIteratorPrototypeh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/IntlSegmentIteratorPrototype.h (286346 => 286347)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/IntlSegmentIteratorPrototype.h       2021-12-01 02:56:24 UTC (rev 286346)
+++ trunk/Source/JavaScriptCore/runtime/IntlSegmentIteratorPrototype.h  2021-12-01 04:38:56 UTC (rev 286347)
</span><span class="lines">@@ -1,5 +1,5 @@
</span><span class="cx"> /*
</span><del>- * Copyright (C) 2020 Apple Inc. All rights reserved.
</del><ins>+ * Copyright (C) 2020-2021 Apple Inc. All rights reserved.
</ins><span class="cx">  *
</span><span class="cx">  * Redistribution and use in source and binary forms, with or without
</span><span class="cx">  * modification, are permitted provided that the following conditions
</span><span class="lines">@@ -38,7 +38,7 @@
</span><span class="cx">     static IsoSubspace* subspaceFor(VM& vm)
</span><span class="cx">     {
</span><span class="cx">         STATIC_ASSERT_ISO_SUBSPACE_SHARABLE(IntlSegmentIteratorPrototype, Base);
</span><del>-        return &vm.plainObjectSpace;
</del><ins>+        return &vm.plainObjectSpace();
</ins><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     static IntlSegmentIteratorPrototype* create(VM&, Structure*);
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeIntlSegmenterPrototypeh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/IntlSegmenterPrototype.h (286346 => 286347)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/IntlSegmenterPrototype.h     2021-12-01 02:56:24 UTC (rev 286346)
+++ trunk/Source/JavaScriptCore/runtime/IntlSegmenterPrototype.h        2021-12-01 04:38:56 UTC (rev 286347)
</span><span class="lines">@@ -1,5 +1,5 @@
</span><span class="cx"> /*
</span><del>- * Copyright (C) 2020 Apple Inc. All rights reserved.
</del><ins>+ * Copyright (C) 2020-2021 Apple Inc. All rights reserved.
</ins><span class="cx">  *
</span><span class="cx">  * Redistribution and use in source and binary forms, with or without
</span><span class="cx">  * modification, are permitted provided that the following conditions
</span><span class="lines">@@ -38,7 +38,7 @@
</span><span class="cx">     static IsoSubspace* subspaceFor(VM& vm)
</span><span class="cx">     {
</span><span class="cx">         STATIC_ASSERT_ISO_SUBSPACE_SHARABLE(IntlSegmenterPrototype, Base);
</span><del>-        return &vm.plainObjectSpace;
</del><ins>+        return &vm.plainObjectSpace();
</ins><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     static IntlSegmenterPrototype* create(VM&, Structure*);
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeIntlSegmentsPrototypeh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/IntlSegmentsPrototype.h (286346 => 286347)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/IntlSegmentsPrototype.h      2021-12-01 02:56:24 UTC (rev 286346)
+++ trunk/Source/JavaScriptCore/runtime/IntlSegmentsPrototype.h 2021-12-01 04:38:56 UTC (rev 286347)
</span><span class="lines">@@ -1,5 +1,5 @@
</span><span class="cx"> /*
</span><del>- * Copyright (C) 2020 Apple Inc. All rights reserved.
</del><ins>+ * Copyright (C) 2020-2021 Apple Inc. All rights reserved.
</ins><span class="cx">  *
</span><span class="cx">  * Redistribution and use in source and binary forms, with or without
</span><span class="cx">  * modification, are permitted provided that the following conditions
</span><span class="lines">@@ -38,7 +38,7 @@
</span><span class="cx">     static IsoSubspace* subspaceFor(VM& vm)
</span><span class="cx">     {
</span><span class="cx">         STATIC_ASSERT_ISO_SUBSPACE_SHARABLE(IntlSegmentsPrototype, Base);
</span><del>-        return &vm.plainObjectSpace;
</del><ins>+        return &vm.plainObjectSpace();
</ins><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     static IntlSegmentsPrototype* create(VM&, JSGlobalObject*, Structure*);
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeIteratorPrototypeh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/IteratorPrototype.h (286346 => 286347)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/IteratorPrototype.h  2021-12-01 02:56:24 UTC (rev 286346)
+++ trunk/Source/JavaScriptCore/runtime/IteratorPrototype.h     2021-12-01 04:38:56 UTC (rev 286347)
</span><span class="lines">@@ -39,7 +39,7 @@
</span><span class="cx">     static IsoSubspace* subspaceFor(VM& vm)
</span><span class="cx">     {
</span><span class="cx">         STATIC_ASSERT_ISO_SUBSPACE_SHARABLE(IteratorPrototype, Base);
</span><del>-        return &vm.plainObjectSpace;
</del><ins>+        return &vm.plainObjectSpace();
</ins><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     static IteratorPrototype* create(VM& vm, JSGlobalObject* globalObject, Structure* structure)
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeJSArraycpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/JSArray.cpp (286346 => 286347)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/JSArray.cpp  2021-12-01 02:56:24 UTC (rev 286346)
+++ trunk/Source/JavaScriptCore/runtime/JSArray.cpp     2021-12-01 04:38:56 UTC (rev 286347)
</span><span class="lines">@@ -56,7 +56,7 @@
</span><span class="cx">             || hasContiguous(indexingType));
</span><span class="cx"> 
</span><span class="cx">         unsigned vectorLength = Butterfly::optimalContiguousVectorLength(structure, initialLength);
</span><del>-        void* temp = vm.jsValueGigacageAuxiliarySpace.allocateNonVirtual(
</del><ins>+        void* temp = vm.jsValueGigacageAuxiliarySpace().allocateNonVirtual(
</ins><span class="cx">             vm,
</span><span class="cx">             Butterfly::totalSize(0, outOfLineStorage, true, vectorLength * sizeof(EncodedJSValue)),
</span><span class="cx">             deferralContext, AllocationFailureMode::ReturnNull);
</span><span class="lines">@@ -78,7 +78,7 @@
</span><span class="cx">             || indexingType == ArrayWithArrayStorage);
</span><span class="cx">         static constexpr unsigned indexBias = 0;
</span><span class="cx">         unsigned vectorLength = ArrayStorage::optimalVectorLength(indexBias, structure, initialLength);
</span><del>-        void* temp = vm.jsValueGigacageAuxiliarySpace.allocateNonVirtual(
</del><ins>+        void* temp = vm.jsValueGigacageAuxiliarySpace().allocateNonVirtual(
</ins><span class="cx">             vm,
</span><span class="cx">             Butterfly::totalSize(indexBias, outOfLineStorage, true, ArrayStorage::sizeFor(vectorLength)),
</span><span class="cx">             deferralContext, AllocationFailureMode::ReturnNull);
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeJSArrayh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/JSArray.h (286346 => 286347)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/JSArray.h    2021-12-01 02:56:24 UTC (rev 286346)
+++ trunk/Source/JavaScriptCore/runtime/JSArray.h       2021-12-01 04:38:56 UTC (rev 286347)
</span><span class="lines">@@ -51,7 +51,7 @@
</span><span class="cx">     template<typename CellType, SubspaceAccess>
</span><span class="cx">     static IsoSubspace* subspaceFor(VM& vm)
</span><span class="cx">     {
</span><del>-        return &vm.arraySpace;
</del><ins>+        return &vm.arraySpace();
</ins><span class="cx">     }
</span><span class="cx">         
</span><span class="cx"> protected:
</span><span class="lines">@@ -244,7 +244,7 @@
</span><span class="cx">             return nullptr;
</span><span class="cx"> 
</span><span class="cx">         unsigned vectorLength = Butterfly::optimalContiguousVectorLength(structure, vectorLengthHint);
</span><del>-        void* temp = vm.jsValueGigacageAuxiliarySpace.allocateNonVirtual(
</del><ins>+        void* temp = vm.jsValueGigacageAuxiliarySpace().allocateNonVirtual(
</ins><span class="cx">             vm,
</span><span class="cx">             Butterfly::totalSize(0, outOfLineStorage, true, vectorLength * sizeof(EncodedJSValue)),
</span><span class="cx">             nullptr, AllocationFailureMode::ReturnNull);
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeJSArrayBufferPrototypeh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/JSArrayBufferPrototype.h (286346 => 286347)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/JSArrayBufferPrototype.h     2021-12-01 02:56:24 UTC (rev 286346)
+++ trunk/Source/JavaScriptCore/runtime/JSArrayBufferPrototype.h        2021-12-01 04:38:56 UTC (rev 286347)
</span><span class="lines">@@ -1,5 +1,5 @@
</span><span class="cx"> /*
</span><del>- * Copyright (C) 2013, 2016 Apple Inc. All rights reserved.
</del><ins>+ * Copyright (C) 2013-2021 Apple Inc. All rights reserved.
</ins><span class="cx">  *
</span><span class="cx">  * Redistribution and use in source and binary forms, with or without
</span><span class="cx">  * modification, are permitted provided that the following conditions
</span><span class="lines">@@ -37,7 +37,7 @@
</span><span class="cx">     static IsoSubspace* subspaceFor(VM& vm)
</span><span class="cx">     {
</span><span class="cx">         STATIC_ASSERT_ISO_SUBSPACE_SHARABLE(JSArrayBufferPrototype, Base);
</span><del>-        return &vm.plainObjectSpace;
</del><ins>+        return &vm.plainObjectSpace();
</ins><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     static JSArrayBufferPrototype* create(VM&, JSGlobalObject*, Structure*, ArrayBufferSharingMode = ArrayBufferSharingMode::Default);
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeJSArrayBufferViewcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/JSArrayBufferView.cpp (286346 => 286347)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/JSArrayBufferView.cpp        2021-12-01 02:56:24 UTC (rev 286346)
+++ trunk/Source/JavaScriptCore/runtime/JSArrayBufferView.cpp   2021-12-01 04:38:56 UTC (rev 286347)
</span><span class="lines">@@ -64,7 +64,7 @@
</span><span class="cx">         // Attempt GC allocation.
</span><span class="cx">         void* temp;
</span><span class="cx">         size_t size = sizeOf(length, elementSize);
</span><del>-        temp = vm.primitiveGigacageAuxiliarySpace.allocateNonVirtual(vm, size, nullptr, AllocationFailureMode::ReturnNull);
</del><ins>+        temp = vm.primitiveGigacageAuxiliarySpace().allocateNonVirtual(vm, size, nullptr, AllocationFailureMode::ReturnNull);
</ins><span class="cx">         if (!temp)
</span><span class="cx">             return;
</span><span class="cx"> 
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeJSBigIntcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/JSBigInt.cpp (286346 => 286347)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/JSBigInt.cpp 2021-12-01 02:56:24 UTC (rev 286346)
+++ trunk/Source/JavaScriptCore/runtime/JSBigInt.cpp    2021-12-01 04:38:56 UTC (rev 286347)
</span><span class="lines">@@ -117,7 +117,7 @@
</span><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     ASSERT(length <= maxLength);
</span><del>-    void* data = vm.primitiveGigacageAuxiliarySpace.allocateNonVirtual(vm, length * sizeof(Digit), nullptr, AllocationFailureMode::ReturnNull);
</del><ins>+    void* data = vm.primitiveGigacageAuxiliarySpace().allocateNonVirtual(vm, length * sizeof(Digit), nullptr, AllocationFailureMode::ReturnNull);
</ins><span class="cx">     if (UNLIKELY(!data)) {
</span><span class="cx">         if (nullOrGlobalObjectForOOM) {
</span><span class="cx">             auto scope = DECLARE_THROW_SCOPE(vm);
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeJSBigInth"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/JSBigInt.h (286346 => 286347)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/JSBigInt.h   2021-12-01 02:56:24 UTC (rev 286346)
+++ trunk/Source/JavaScriptCore/runtime/JSBigInt.h      2021-12-01 04:38:56 UTC (rev 286347)
</span><span class="lines">@@ -56,7 +56,7 @@
</span><span class="cx">     template<typename CellType, SubspaceAccess>
</span><span class="cx">     static IsoSubspace* subspaceFor(VM& vm)
</span><span class="cx">     {
</span><del>-        return &vm.bigIntSpace;
</del><ins>+        return &vm.bigIntSpace();
</ins><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     enum class InitializationType { None, WithZero };
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeJSCalleeh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/JSCallee.h (286346 => 286347)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/JSCallee.h   2021-12-01 02:56:24 UTC (rev 286346)
+++ trunk/Source/JavaScriptCore/runtime/JSCallee.h      2021-12-01 04:38:56 UTC (rev 286347)
</span><span class="lines">@@ -50,7 +50,7 @@
</span><span class="cx">     template<typename CellType, SubspaceAccess>
</span><span class="cx">     static IsoSubspace* subspaceFor(VM& vm)
</span><span class="cx">     {
</span><del>-        return &vm.calleeSpace;
</del><ins>+        return &vm.calleeSpace();
</ins><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     static JSCallee* create(VM& vm, JSGlobalObject* globalObject, JSScope* scope)
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeJSDataViewPrototypeh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/JSDataViewPrototype.h (286346 => 286347)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/JSDataViewPrototype.h        2021-12-01 02:56:24 UTC (rev 286346)
+++ trunk/Source/JavaScriptCore/runtime/JSDataViewPrototype.h   2021-12-01 04:38:56 UTC (rev 286347)
</span><span class="lines">@@ -1,5 +1,5 @@
</span><span class="cx"> /*
</span><del>- * Copyright (C) 2013-2019 Apple Inc. All rights reserved.
</del><ins>+ * Copyright (C) 2013-2021 Apple Inc. All rights reserved.
</ins><span class="cx">  *
</span><span class="cx">  * Redistribution and use in source and binary forms, with or without
</span><span class="cx">  * modification, are permitted provided that the following conditions
</span><span class="lines">@@ -38,7 +38,7 @@
</span><span class="cx">     static IsoSubspace* subspaceFor(VM& vm)
</span><span class="cx">     {
</span><span class="cx">         STATIC_ASSERT_ISO_SUBSPACE_SHARABLE(JSDataViewPrototype, Base);
</span><del>-        return &vm.plainObjectSpace;
</del><ins>+        return &vm.plainObjectSpace();
</ins><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     static JSDataViewPrototype* create(VM&, Structure*);
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeJSFunctionh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/JSFunction.h (286346 => 286347)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/JSFunction.h 2021-12-01 02:56:24 UTC (rev 286346)
+++ trunk/Source/JavaScriptCore/runtime/JSFunction.h    2021-12-01 04:38:56 UTC (rev 286347)
</span><span class="lines">@@ -66,7 +66,7 @@
</span><span class="cx">     template<typename CellType, SubspaceAccess>
</span><span class="cx">     static IsoSubspace* subspaceFor(VM& vm)
</span><span class="cx">     {
</span><del>-        return &vm.functionSpace;
</del><ins>+        return &vm.functionSpace();
</ins><span class="cx">     }
</span><span class="cx">     
</span><span class="cx">     typedef JSCallee Base;
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeJSGenericTypedArrayViewPrototypeh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/JSGenericTypedArrayViewPrototype.h (286346 => 286347)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/JSGenericTypedArrayViewPrototype.h   2021-12-01 02:56:24 UTC (rev 286346)
+++ trunk/Source/JavaScriptCore/runtime/JSGenericTypedArrayViewPrototype.h      2021-12-01 04:38:56 UTC (rev 286347)
</span><span class="lines">@@ -1,5 +1,5 @@
</span><span class="cx"> /*
</span><del>- * Copyright (C) 2013 Apple Inc. All rights reserved.
</del><ins>+ * Copyright (C) 2013-2021 Apple Inc. All rights reserved.
</ins><span class="cx">  *
</span><span class="cx">  * Redistribution and use in source and binary forms, with or without
</span><span class="cx">  * modification, are permitted provided that the following conditions
</span><span class="lines">@@ -38,7 +38,7 @@
</span><span class="cx">     static IsoSubspace* subspaceFor(VM& vm)
</span><span class="cx">     {
</span><span class="cx">         STATIC_ASSERT_ISO_SUBSPACE_SHARABLE(JSGenericTypedArrayViewPrototype, Base);
</span><del>-        return &vm.plainObjectSpace;
</del><ins>+        return &vm.plainObjectSpace();
</ins><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     static JSGenericTypedArrayViewPrototype* create(
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeJSGlobalLexicalEnvironmenth"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/JSGlobalLexicalEnvironment.h (286346 => 286347)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/JSGlobalLexicalEnvironment.h 2021-12-01 02:56:24 UTC (rev 286346)
+++ trunk/Source/JavaScriptCore/runtime/JSGlobalLexicalEnvironment.h    2021-12-01 04:38:56 UTC (rev 286347)
</span><span class="lines">@@ -38,7 +38,7 @@
</span><span class="cx">     template<typename CellType, SubspaceAccess mode>
</span><span class="cx">     static IsoSubspace* subspaceFor(VM& vm)
</span><span class="cx">     {
</span><del>-        return &vm.globalLexicalEnvironmentSpace;
</del><ins>+        return &vm.globalLexicalEnvironmentSpace();
</ins><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     static JSGlobalLexicalEnvironment* create(VM& vm, Structure* structure, JSScope* parentScope)
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeJSImmutableButterflyh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/JSImmutableButterfly.h (286346 => 286347)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/JSImmutableButterfly.h       2021-12-01 02:56:24 UTC (rev 286346)
+++ trunk/Source/JavaScriptCore/runtime/JSImmutableButterfly.h  2021-12-01 04:38:56 UTC (rev 286347)
</span><span class="lines">@@ -153,7 +153,7 @@
</span><span class="cx">     static CompleteSubspace* subspaceFor(VM& vm)
</span><span class="cx">     {
</span><span class="cx">         // We allocate out of the JSValue gigacage as other code expects all butterflies to live there.
</span><del>-        return &vm.immutableButterflyJSValueGigacageAuxiliarySpace;
</del><ins>+        return &vm.immutableButterflyJSValueGigacageAuxiliarySpace();
</ins><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     // Only call this if you just allocated this butterfly.
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeJSLexicalEnvironmenth"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/JSLexicalEnvironment.h (286346 => 286347)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/JSLexicalEnvironment.h       2021-12-01 02:56:24 UTC (rev 286346)
+++ trunk/Source/JavaScriptCore/runtime/JSLexicalEnvironment.h  2021-12-01 04:38:56 UTC (rev 286347)
</span><span class="lines">@@ -44,7 +44,7 @@
</span><span class="cx">     static CompleteSubspace* subspaceFor(VM& vm)
</span><span class="cx">     {
</span><span class="cx">         static_assert(!CellType::needsDestruction, "");
</span><del>-        return &vm.variableSizedCellSpace;
</del><ins>+        return &vm.variableSizedCellSpace();
</ins><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     using Base = JSSymbolTableObject;
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeJSModuleLoaderh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/JSModuleLoader.h (286346 => 286347)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/JSModuleLoader.h     2021-12-01 02:56:24 UTC (rev 286346)
+++ trunk/Source/JavaScriptCore/runtime/JSModuleLoader.h        2021-12-01 04:38:56 UTC (rev 286347)
</span><span class="lines">@@ -44,7 +44,7 @@
</span><span class="cx">     static IsoSubspace* subspaceFor(VM& vm)
</span><span class="cx">     {
</span><span class="cx">         STATIC_ASSERT_ISO_SUBSPACE_SHARABLE(JSModuleLoader, Base);
</span><del>-        return &vm.plainObjectSpace;
</del><ins>+        return &vm.plainObjectSpace();
</ins><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     enum Status {
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeJSONObjecth"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/JSONObject.h (286346 => 286347)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/JSONObject.h 2021-12-01 02:56:24 UTC (rev 286346)
+++ trunk/Source/JavaScriptCore/runtime/JSONObject.h    2021-12-01 04:38:56 UTC (rev 286347)
</span><span class="lines">@@ -38,7 +38,7 @@
</span><span class="cx">     static IsoSubspace* subspaceFor(VM& vm)
</span><span class="cx">     {
</span><span class="cx">         STATIC_ASSERT_ISO_SUBSPACE_SHARABLE(JSONObject, Base);
</span><del>-        return &vm.plainObjectSpace;
</del><ins>+        return &vm.plainObjectSpace();
</ins><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     static JSONObject* create(VM& vm, Structure* structure)
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeJSObjectInlinesh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/JSObjectInlines.h (286346 => 286347)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/JSObjectInlines.h    2021-12-01 02:56:24 UTC (rev 286346)
+++ trunk/Source/JavaScriptCore/runtime/JSObjectInlines.h       2021-12-01 04:38:56 UTC (rev 286347)
</span><span class="lines">@@ -41,7 +41,7 @@
</span><span class="cx"> CompleteSubspace* JSFinalObject::subspaceFor(VM& vm)
</span><span class="cx"> {
</span><span class="cx">     static_assert(!CellType::needsDestruction);
</span><del>-    return &vm.cellSpace;
</del><ins>+    return &vm.cellSpace();
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> // https://tc39.es/ecma262/#sec-createlistfromarraylike
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeJSPromiseh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/JSPromise.h (286346 => 286347)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/JSPromise.h  2021-12-01 02:56:24 UTC (rev 286346)
+++ trunk/Source/JavaScriptCore/runtime/JSPromise.h     2021-12-01 04:38:56 UTC (rev 286347)
</span><span class="lines">@@ -37,7 +37,7 @@
</span><span class="cx">     template<typename CellType, SubspaceAccess mode>
</span><span class="cx">     static IsoSubspace* subspaceFor(VM& vm)
</span><span class="cx">     {
</span><del>-        return &vm.promiseSpace;
</del><ins>+        return &vm.promiseSpace();
</ins><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     JS_EXPORT_PRIVATE static JSPromise* create(VM&, Structure*);
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeJSPromisePrototypeh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/JSPromisePrototype.h (286346 => 286347)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/JSPromisePrototype.h 2021-12-01 02:56:24 UTC (rev 286346)
+++ trunk/Source/JavaScriptCore/runtime/JSPromisePrototype.h    2021-12-01 04:38:56 UTC (rev 286347)
</span><span class="lines">@@ -1,5 +1,5 @@
</span><span class="cx"> /*
</span><del>- * Copyright (C) 2013-2019 Apple Inc. All rights reserved.
</del><ins>+ * Copyright (C) 2013-2021 Apple Inc. All rights reserved.
</ins><span class="cx">  *
</span><span class="cx">  * Redistribution and use in source and binary forms, with or without
</span><span class="cx">  * modification, are permitted provided that the following conditions
</span><span class="lines">@@ -38,7 +38,7 @@
</span><span class="cx">     static IsoSubspace* subspaceFor(VM& vm)
</span><span class="cx">     {
</span><span class="cx">         STATIC_ASSERT_ISO_SUBSPACE_SHARABLE(JSPromisePrototype, Base);
</span><del>-        return &vm.plainObjectSpace;
</del><ins>+        return &vm.plainObjectSpace();
</ins><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     static JSPromisePrototype* create(VM&, JSGlobalObject*, Structure*);
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeJSPropertyNameEnumeratorcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/JSPropertyNameEnumerator.cpp (286346 => 286347)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/JSPropertyNameEnumerator.cpp 2021-12-01 02:56:24 UTC (rev 286346)
+++ trunk/Source/JavaScriptCore/runtime/JSPropertyNameEnumerator.cpp    2021-12-01 04:38:56 UTC (rev 286347)
</span><span class="lines">@@ -38,7 +38,7 @@
</span><span class="cx">     unsigned propertyNamesBufferSizeInBytes = Checked<unsigned>(propertyNamesSize) * sizeof(WriteBarrier<JSString>);
</span><span class="cx">     WriteBarrier<JSString>* propertyNamesBuffer = nullptr;
</span><span class="cx">     if (propertyNamesBufferSizeInBytes) {
</span><del>-        propertyNamesBuffer = static_cast<WriteBarrier<JSString>*>(vm.jsValueGigacageAuxiliarySpace.allocateNonVirtual(vm, propertyNamesBufferSizeInBytes, nullptr, AllocationFailureMode::Assert));
</del><ins>+        propertyNamesBuffer = static_cast<WriteBarrier<JSString>*>(vm.jsValueGigacageAuxiliarySpace().allocateNonVirtual(vm, propertyNamesBufferSizeInBytes, nullptr, AllocationFailureMode::Assert));
</ins><span class="cx">         for (unsigned i = 0; i < propertyNamesSize; ++i)
</span><span class="cx">             propertyNamesBuffer[i].clear();
</span><span class="cx">     }
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeJSPropertyNameEnumeratorh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/JSPropertyNameEnumerator.h (286346 => 286347)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/JSPropertyNameEnumerator.h   2021-12-01 02:56:24 UTC (rev 286346)
+++ trunk/Source/JavaScriptCore/runtime/JSPropertyNameEnumerator.h      2021-12-01 04:38:56 UTC (rev 286347)
</span><span class="lines">@@ -51,7 +51,7 @@
</span><span class="cx">     template<typename CellType, SubspaceAccess mode>
</span><span class="cx">     static IsoSubspace* subspaceFor(VM& vm)
</span><span class="cx">     {
</span><del>-        return &vm.propertyNameEnumeratorSpace;
</del><ins>+        return &vm.propertyNameEnumeratorSpace();
</ins><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     static JSPropertyNameEnumerator* create(VM&, Structure*, uint32_t, uint32_t, PropertyNameArray&&);
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeJSProxyh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/JSProxy.h (286346 => 286347)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/JSProxy.h    2021-12-01 02:56:24 UTC (rev 286346)
+++ trunk/Source/JavaScriptCore/runtime/JSProxy.h       2021-12-01 04:38:56 UTC (rev 286347)
</span><span class="lines">@@ -38,7 +38,7 @@
</span><span class="cx">     static IsoSubspace* subspaceFor(VM& vm)
</span><span class="cx">     {
</span><span class="cx">         static_assert(sizeof(CellType) == sizeof(JSProxy));
</span><del>-        return &vm.jsProxySpace;
</del><ins>+        return &vm.jsProxySpace();
</ins><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     static JSProxy* create(VM& vm, Structure* structure, JSObject* target)
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeJSStringh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/JSString.h (286346 => 286347)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/JSString.h   2021-12-01 02:56:24 UTC (rev 286346)
+++ trunk/Source/JavaScriptCore/runtime/JSString.h      2021-12-01 04:38:56 UTC (rev 286347)
</span><span class="lines">@@ -111,7 +111,7 @@
</span><span class="cx">     template<typename, SubspaceAccess>
</span><span class="cx">     static IsoSubspace* subspaceFor(VM& vm)
</span><span class="cx">     {
</span><del>-        return &vm.stringSpace;
</del><ins>+        return &vm.stringSpace();
</ins><span class="cx">     }
</span><span class="cx">     
</span><span class="cx">     // We employ overflow checks in many places with the assumption that MaxLength
</span><span class="lines">@@ -270,7 +270,7 @@
</span><span class="cx">     template<typename, SubspaceAccess>
</span><span class="cx">     static IsoSubspace* subspaceFor(VM& vm)
</span><span class="cx">     {
</span><del>-        return &vm.ropeStringSpace;
</del><ins>+        return &vm.ropeStringSpace();
</ins><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     // We use lower 3bits of fiber0 for flags. These bits are usable due to alignment, and it is OK even in 32bit architecture.
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeJSTypedArrayViewPrototypeh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/JSTypedArrayViewPrototype.h (286346 => 286347)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/JSTypedArrayViewPrototype.h  2021-12-01 02:56:24 UTC (rev 286346)
+++ trunk/Source/JavaScriptCore/runtime/JSTypedArrayViewPrototype.h     2021-12-01 04:38:56 UTC (rev 286347)
</span><span class="lines">@@ -1,5 +1,5 @@
</span><span class="cx"> /*
</span><del>- * Copyright (C) 2015 Apple Inc. All rights reserved.
</del><ins>+ * Copyright (C) 2015-2021 Apple Inc. All rights reserved.
</ins><span class="cx">  *
</span><span class="cx">  * Redistribution and use in source and binary forms, with or without
</span><span class="cx">  * modification, are permitted provided that the following conditions
</span><span class="lines">@@ -37,7 +37,7 @@
</span><span class="cx">     static IsoSubspace* subspaceFor(VM& vm)
</span><span class="cx">     {
</span><span class="cx">         STATIC_ASSERT_ISO_SUBSPACE_SHARABLE(JSTypedArrayViewPrototype, Base);
</span><del>-        return &vm.plainObjectSpace;
</del><ins>+        return &vm.plainObjectSpace();
</ins><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     static JSTypedArrayViewPrototype* create(VM&, JSGlobalObject*, Structure*);
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeMapIteratorPrototypeh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/MapIteratorPrototype.h (286346 => 286347)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/MapIteratorPrototype.h       2021-12-01 02:56:24 UTC (rev 286346)
+++ trunk/Source/JavaScriptCore/runtime/MapIteratorPrototype.h  2021-12-01 04:38:56 UTC (rev 286347)
</span><span class="lines">@@ -37,7 +37,7 @@
</span><span class="cx">     static IsoSubspace* subspaceFor(VM& vm)
</span><span class="cx">     {
</span><span class="cx">         STATIC_ASSERT_ISO_SUBSPACE_SHARABLE(MapIteratorPrototype, Base);
</span><del>-        return &vm.plainObjectSpace;
</del><ins>+        return &vm.plainObjectSpace();
</ins><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     static MapIteratorPrototype* create(VM& vm, JSGlobalObject* globalObject, Structure* structure)
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeMapPrototypeh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/MapPrototype.h (286346 => 286347)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/MapPrototype.h       2021-12-01 02:56:24 UTC (rev 286346)
+++ trunk/Source/JavaScriptCore/runtime/MapPrototype.h  2021-12-01 04:38:56 UTC (rev 286347)
</span><span class="lines">@@ -37,7 +37,7 @@
</span><span class="cx">     static IsoSubspace* subspaceFor(VM& vm)
</span><span class="cx">     {
</span><span class="cx">         STATIC_ASSERT_ISO_SUBSPACE_SHARABLE(MapPrototype, Base);
</span><del>-        return &vm.plainObjectSpace;
</del><ins>+        return &vm.plainObjectSpace();
</ins><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     static constexpr unsigned StructureFlags = Base::StructureFlags | HasStaticPropertyTable;
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeMathObjecth"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/MathObject.h (286346 => 286347)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/MathObject.h 2021-12-01 02:56:24 UTC (rev 286346)
+++ trunk/Source/JavaScriptCore/runtime/MathObject.h    2021-12-01 04:38:56 UTC (rev 286347)
</span><span class="lines">@@ -32,7 +32,7 @@
</span><span class="cx">     static IsoSubspace* subspaceFor(VM& vm)
</span><span class="cx">     {
</span><span class="cx">         STATIC_ASSERT_ISO_SUBSPACE_SHARABLE(MathObject, Base);
</span><del>-        return &vm.plainObjectSpace;
</del><ins>+        return &vm.plainObjectSpace();
</ins><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     static MathObject* create(VM& vm, JSGlobalObject* globalObject, Structure* structure)
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeNativeErrorPrototypeh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/NativeErrorPrototype.h (286346 => 286347)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/NativeErrorPrototype.h       2021-12-01 02:56:24 UTC (rev 286346)
+++ trunk/Source/JavaScriptCore/runtime/NativeErrorPrototype.h  2021-12-01 04:38:56 UTC (rev 286347)
</span><span class="lines">@@ -34,7 +34,7 @@
</span><span class="cx">     static IsoSubspace* subspaceFor(VM& vm)
</span><span class="cx">     {
</span><span class="cx">         STATIC_ASSERT_ISO_SUBSPACE_SHARABLE(NativeErrorPrototype, Base);
</span><del>-        return &vm.plainObjectSpace;
</del><ins>+        return &vm.plainObjectSpace();
</ins><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     static Structure* createStructure(VM& vm, JSGlobalObject* globalObject, JSValue prototype)
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeNativeExecutableh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/NativeExecutable.h (286346 => 286347)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/NativeExecutable.h   2021-12-01 02:56:24 UTC (rev 286346)
+++ trunk/Source/JavaScriptCore/runtime/NativeExecutable.h      2021-12-01 04:38:56 UTC (rev 286347)
</span><span class="lines">@@ -1,5 +1,5 @@
</span><span class="cx"> /*
</span><del>- * Copyright (C) 2009-2019 Apple Inc. All rights reserved.
</del><ins>+ * Copyright (C) 2009-2021 Apple Inc. All rights reserved.
</ins><span class="cx">  *
</span><span class="cx">  * Redistribution and use in source and binary forms, with or without
</span><span class="cx">  * modification, are permitted provided that the following conditions
</span><span class="lines">@@ -43,7 +43,7 @@
</span><span class="cx">     template<typename CellType, SubspaceAccess>
</span><span class="cx">     static IsoSubspace* subspaceFor(VM& vm)
</span><span class="cx">     {
</span><del>-        return &vm.nativeExecutableSpace;
</del><ins>+        return &vm.nativeExecutableSpace();
</ins><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     CodeBlockHash hashFor(CodeSpecializationKind) const;
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeNumberObjecth"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/NumberObject.h (286346 => 286347)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/NumberObject.h       2021-12-01 02:56:24 UTC (rev 286346)
+++ trunk/Source/JavaScriptCore/runtime/NumberObject.h  2021-12-01 04:38:56 UTC (rev 286347)
</span><span class="lines">@@ -35,7 +35,7 @@
</span><span class="cx">     template<typename, SubspaceAccess mode>
</span><span class="cx">     static IsoSubspace* subspaceFor(VM& vm)
</span><span class="cx">     {
</span><del>-        return &vm.numberObjectSpace;
</del><ins>+        return &vm.numberObjectSpace();
</ins><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     static NumberObject* create(VM& vm, Structure* structure)
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeObjectPrototypeh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/ObjectPrototype.h (286346 => 286347)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/ObjectPrototype.h    2021-12-01 02:56:24 UTC (rev 286346)
+++ trunk/Source/JavaScriptCore/runtime/ObjectPrototype.h       2021-12-01 04:38:56 UTC (rev 286347)
</span><span class="lines">@@ -1,6 +1,6 @@
</span><span class="cx"> /*
</span><span class="cx">  *  Copyright (C) 1999-2000 Harri Porten (porten@kde.org)
</span><del>- *  Copyright (C) 2008-2019 Apple Inc. All rights reserved.
</del><ins>+ *  Copyright (C) 2008-2021 Apple Inc. All rights reserved.
</ins><span class="cx">  *
</span><span class="cx">  *  This library is free software; you can redistribute it and/or
</span><span class="cx">  *  modify it under the terms of the GNU Lesser General Public
</span><span class="lines">@@ -33,7 +33,7 @@
</span><span class="cx">     static IsoSubspace* subspaceFor(VM& vm)
</span><span class="cx">     {
</span><span class="cx">         STATIC_ASSERT_ISO_SUBSPACE_SHARABLE(ObjectPrototype, Base);
</span><del>-        return &vm.plainObjectSpace;
</del><ins>+        return &vm.plainObjectSpace();
</ins><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     static ObjectPrototype* create(VM&, JSGlobalObject*, Structure*);
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeProgramExecutableh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/ProgramExecutable.h (286346 => 286347)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/ProgramExecutable.h  2021-12-01 02:56:24 UTC (rev 286346)
+++ trunk/Source/JavaScriptCore/runtime/ProgramExecutable.h     2021-12-01 04:38:56 UTC (rev 286347)
</span><span class="lines">@@ -30,6 +30,8 @@
</span><span class="cx"> 
</span><span class="cx"> namespace JSC {
</span><span class="cx"> 
</span><ins>+class UnlinkedProgramCodeBlock;
+
</ins><span class="cx"> class ProgramExecutable final : public GlobalExecutable {
</span><span class="cx">     friend class LLIntOffsetsExtractor;
</span><span class="cx"> public:
</span><span class="lines">@@ -39,7 +41,7 @@
</span><span class="cx">     template<typename CellType, SubspaceAccess>
</span><span class="cx">     static IsoSubspace* subspaceFor(VM& vm)
</span><span class="cx">     {
</span><del>-        return &vm.programExecutableSpace.space;
</del><ins>+        return &vm.programExecutableSpace().space;
</ins><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     static ProgramExecutable* create(JSGlobalObject* globalObject, const SourceCode& source)
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimePropertyTableh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/PropertyTable.h (286346 => 286347)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/PropertyTable.h      2021-12-01 02:56:24 UTC (rev 286346)
+++ trunk/Source/JavaScriptCore/runtime/PropertyTable.h 2021-12-01 04:38:56 UTC (rev 286347)
</span><span class="lines">@@ -129,7 +129,7 @@
</span><span class="cx">     template<typename CellType, SubspaceAccess>
</span><span class="cx">     static IsoSubspace* subspaceFor(VM& vm)
</span><span class="cx">     {
</span><del>-        return &vm.propertyTableSpace;
</del><ins>+        return &vm.propertyTableSpace();
</ins><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     static constexpr bool needsDestruction = true;
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeReflectObjecth"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/ReflectObject.h (286346 => 286347)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/ReflectObject.h      2021-12-01 02:56:24 UTC (rev 286346)
+++ trunk/Source/JavaScriptCore/runtime/ReflectObject.h 2021-12-01 04:38:56 UTC (rev 286347)
</span><span class="lines">@@ -38,7 +38,7 @@
</span><span class="cx">     static IsoSubspace* subspaceFor(VM& vm)
</span><span class="cx">     {
</span><span class="cx">         STATIC_ASSERT_ISO_SUBSPACE_SHARABLE(ReflectObject, Base);
</span><del>-        return &vm.plainObjectSpace;
</del><ins>+        return &vm.plainObjectSpace();
</ins><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     static ReflectObject* create(VM& vm, JSGlobalObject* globalObject, Structure* structure)
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeRegExph"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/RegExp.h (286346 => 286347)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/RegExp.h     2021-12-01 02:56:24 UTC (rev 286346)
+++ trunk/Source/JavaScriptCore/runtime/RegExp.h        2021-12-01 04:38:56 UTC (rev 286347)
</span><span class="lines">@@ -49,7 +49,7 @@
</span><span class="cx">     template<typename CellType, SubspaceAccess mode>
</span><span class="cx">     static IsoSubspace* subspaceFor(VM& vm)
</span><span class="cx">     {
</span><del>-        return &vm.regExpSpace;
</del><ins>+        return &vm.regExpSpace();
</ins><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     JS_EXPORT_PRIVATE static RegExp* create(VM&, const String& pattern, OptionSet<Yarr::Flags>);
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeRegExpObjecth"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/RegExpObject.h (286346 => 286347)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/RegExpObject.h       2021-12-01 02:56:24 UTC (rev 286346)
+++ trunk/Source/JavaScriptCore/runtime/RegExpObject.h  2021-12-01 04:38:56 UTC (rev 286347)
</span><span class="lines">@@ -36,7 +36,7 @@
</span><span class="cx">     static IsoSubspace* subspaceFor(VM& vm)
</span><span class="cx">     {
</span><span class="cx">         static_assert(!CellType::needsDestruction, "");
</span><del>-        return &vm.regExpObjectSpace;
</del><ins>+        return &vm.regExpObjectSpace();
</ins><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     static constexpr uintptr_t lastIndexIsNotWritableFlag = 0b01;
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeRegExpPrototypeh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/RegExpPrototype.h (286346 => 286347)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/RegExpPrototype.h    2021-12-01 02:56:24 UTC (rev 286346)
+++ trunk/Source/JavaScriptCore/runtime/RegExpPrototype.h       2021-12-01 04:38:56 UTC (rev 286347)
</span><span class="lines">@@ -34,7 +34,7 @@
</span><span class="cx">     static IsoSubspace* subspaceFor(VM& vm)
</span><span class="cx">     {
</span><span class="cx">         STATIC_ASSERT_ISO_SUBSPACE_SHARABLE(RegExpPrototype, Base);
</span><del>-        return &vm.plainObjectSpace;
</del><ins>+        return &vm.plainObjectSpace();
</ins><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     static RegExpPrototype* create(VM& vm, JSGlobalObject* globalObject, Structure* structure)
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeRegExpStringIteratorPrototypeh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/RegExpStringIteratorPrototype.h (286346 => 286347)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/RegExpStringIteratorPrototype.h      2021-12-01 02:56:24 UTC (rev 286346)
+++ trunk/Source/JavaScriptCore/runtime/RegExpStringIteratorPrototype.h 2021-12-01 04:38:56 UTC (rev 286347)
</span><span class="lines">@@ -39,7 +39,7 @@
</span><span class="cx">     static IsoSubspace* subspaceFor(VM& vm)
</span><span class="cx">     {
</span><span class="cx">         STATIC_ASSERT_ISO_SUBSPACE_SHARABLE(RegExpStringIteratorPrototype, Base);
</span><del>-        return &vm.plainObjectSpace;
</del><ins>+        return &vm.plainObjectSpace();
</ins><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     static RegExpStringIteratorPrototype* create(VM& vm, JSGlobalObject* globalObject, Structure* structure)
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeScopedArgumentscpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/ScopedArguments.cpp (286346 => 286347)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/ScopedArguments.cpp  2021-12-01 02:56:24 UTC (rev 286346)
+++ trunk/Source/JavaScriptCore/runtime/ScopedArguments.cpp     2021-12-01 04:38:56 UTC (rev 286347)
</span><span class="lines">@@ -55,7 +55,7 @@
</span><span class="cx">     WriteBarrier<Unknown>* storage = nullptr;
</span><span class="cx">     if (totalLength > table->length()) {
</span><span class="cx">         Checked<unsigned> overflowLength = totalLength - table->length();
</span><del>-        storage = static_cast<WriteBarrier<Unknown>*>(vm.jsValueGigacageAuxiliarySpace.allocateNonVirtual(vm, overflowLength * sizeof(WriteBarrier<Unknown>), nullptr, AllocationFailureMode::Assert));
</del><ins>+        storage = static_cast<WriteBarrier<Unknown>*>(vm.jsValueGigacageAuxiliarySpace().allocateNonVirtual(vm, overflowLength * sizeof(WriteBarrier<Unknown>), nullptr, AllocationFailureMode::Assert));
</ins><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     ScopedArguments* result = new (
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeScopedArgumentsh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/ScopedArguments.h (286346 => 286347)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/ScopedArguments.h    2021-12-01 02:56:24 UTC (rev 286346)
+++ trunk/Source/JavaScriptCore/runtime/ScopedArguments.h       2021-12-01 04:38:56 UTC (rev 286347)
</span><span class="lines">@@ -47,7 +47,7 @@
</span><span class="cx">     static IsoSubspace* subspaceFor(VM& vm)
</span><span class="cx">     {
</span><span class="cx">         static_assert(!CellType::needsDestruction, "");
</span><del>-        return &vm.scopedArgumentsSpace;
</del><ins>+        return &vm.scopedArgumentsSpace();
</ins><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     // Creates an arguments object but leaves it uninitialized. This is dangerous if we GC right
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeSetIteratorPrototypeh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/SetIteratorPrototype.h (286346 => 286347)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/SetIteratorPrototype.h       2021-12-01 02:56:24 UTC (rev 286346)
+++ trunk/Source/JavaScriptCore/runtime/SetIteratorPrototype.h  2021-12-01 04:38:56 UTC (rev 286347)
</span><span class="lines">@@ -37,7 +37,7 @@
</span><span class="cx">     static IsoSubspace* subspaceFor(VM& vm)
</span><span class="cx">     {
</span><span class="cx">         STATIC_ASSERT_ISO_SUBSPACE_SHARABLE(SetIteratorPrototype, Base);
</span><del>-        return &vm.plainObjectSpace;
</del><ins>+        return &vm.plainObjectSpace();
</ins><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     static SetIteratorPrototype* create(VM& vm, JSGlobalObject* globalObject, Structure* structure)
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeSetPrototypeh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/SetPrototype.h (286346 => 286347)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/SetPrototype.h       2021-12-01 02:56:24 UTC (rev 286346)
+++ trunk/Source/JavaScriptCore/runtime/SetPrototype.h  2021-12-01 04:38:56 UTC (rev 286347)
</span><span class="lines">@@ -37,7 +37,7 @@
</span><span class="cx">     static IsoSubspace* subspaceFor(VM& vm)
</span><span class="cx">     {
</span><span class="cx">         STATIC_ASSERT_ISO_SUBSPACE_SHARABLE(SetPrototype, Base);
</span><del>-        return &vm.plainObjectSpace;
</del><ins>+        return &vm.plainObjectSpace();
</ins><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     static constexpr unsigned StructureFlags = Base::StructureFlags | HasStaticPropertyTable;
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeShadowRealmPrototypeh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/ShadowRealmPrototype.h (286346 => 286347)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/ShadowRealmPrototype.h       2021-12-01 02:56:24 UTC (rev 286346)
+++ trunk/Source/JavaScriptCore/runtime/ShadowRealmPrototype.h  2021-12-01 04:38:56 UTC (rev 286347)
</span><span class="lines">@@ -39,7 +39,7 @@
</span><span class="cx">     static IsoSubspace* subspaceFor(VM& vm)
</span><span class="cx">     {
</span><span class="cx">         STATIC_ASSERT_ISO_SUBSPACE_SHARABLE(ShadowRealmPrototype, Base);
</span><del>-        return &vm.plainObjectSpace;
</del><ins>+        return &vm.plainObjectSpace();
</ins><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     static ShadowRealmPrototype* create(VM& vm, Structure* structure)
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeSparseArrayValueMaph"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/SparseArrayValueMap.h (286346 => 286347)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/SparseArrayValueMap.h        2021-12-01 02:56:24 UTC (rev 286346)
+++ trunk/Source/JavaScriptCore/runtime/SparseArrayValueMap.h   2021-12-01 04:38:56 UTC (rev 286347)
</span><span class="lines">@@ -110,7 +110,7 @@
</span><span class="cx">     template<typename CellType, SubspaceAccess>
</span><span class="cx">     static IsoSubspace* subspaceFor(VM& vm)
</span><span class="cx">     {
</span><del>-        return &vm.sparseArrayValueMapSpace;
</del><ins>+        return &vm.sparseArrayValueMapSpace();
</ins><span class="cx">     }
</span><span class="cx">     
</span><span class="cx">     static Structure* createStructure(VM&, JSGlobalObject*, JSValue prototype);
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeStringIteratorPrototypeh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/StringIteratorPrototype.h (286346 => 286347)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/StringIteratorPrototype.h    2021-12-01 02:56:24 UTC (rev 286346)
+++ trunk/Source/JavaScriptCore/runtime/StringIteratorPrototype.h       2021-12-01 04:38:56 UTC (rev 286347)
</span><span class="lines">@@ -39,7 +39,7 @@
</span><span class="cx">     static IsoSubspace* subspaceFor(VM& vm)
</span><span class="cx">     {
</span><span class="cx">         STATIC_ASSERT_ISO_SUBSPACE_SHARABLE(StringIteratorPrototype, Base);
</span><del>-        return &vm.plainObjectSpace;
</del><ins>+        return &vm.plainObjectSpace();
</ins><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     static StringIteratorPrototype* create(VM& vm, JSGlobalObject* globalObject, Structure* structure)
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeStringObjecth"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/StringObject.h (286346 => 286347)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/StringObject.h       2021-12-01 02:56:24 UTC (rev 286346)
+++ trunk/Source/JavaScriptCore/runtime/StringObject.h  2021-12-01 04:38:56 UTC (rev 286347)
</span><span class="lines">@@ -33,7 +33,7 @@
</span><span class="cx">     template<typename, SubspaceAccess mode>
</span><span class="cx">     static IsoSubspace* subspaceFor(VM& vm)
</span><span class="cx">     {
</span><del>-        return &vm.stringObjectSpace;
</del><ins>+        return &vm.stringObjectSpace();
</ins><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     static StringObject* create(VM& vm, Structure* structure)
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeStructureh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/Structure.h (286346 => 286347)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/Structure.h  2021-12-01 02:56:24 UTC (rev 286346)
+++ trunk/Source/JavaScriptCore/runtime/Structure.h     2021-12-01 04:38:56 UTC (rev 286347)
</span><span class="lines">@@ -129,7 +129,7 @@
</span><span class="cx">     template<typename CellType, SubspaceAccess>
</span><span class="cx">     static IsoSubspace* subspaceFor(VM& vm)
</span><span class="cx">     {
</span><del>-        return &vm.structureSpace;
</del><ins>+        return &vm.structureSpace();
</ins><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     JS_EXPORT_PRIVATE static bool isValidPrototype(JSValue);
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeStructureChaincpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/StructureChain.cpp (286346 => 286347)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/StructureChain.cpp   2021-12-01 02:56:24 UTC (rev 286346)
+++ trunk/Source/JavaScriptCore/runtime/StructureChain.cpp      2021-12-01 04:38:56 UTC (rev 286347)
</span><span class="lines">@@ -48,7 +48,7 @@
</span><span class="cx">         ++size;
</span><span class="cx">     ++size; // Sentinel nullptr.
</span><span class="cx">     size_t bytes = Checked<size_t>(size) * sizeof(StructureID);
</span><del>-    StructureID* vector = static_cast<StructureID*>(vm.jsValueGigacageAuxiliarySpace.allocateNonVirtual(vm, bytes, nullptr, AllocationFailureMode::Assert));
</del><ins>+    StructureID* vector = static_cast<StructureID*>(vm.jsValueGigacageAuxiliarySpace().allocateNonVirtual(vm, bytes, nullptr, AllocationFailureMode::Assert));
</ins><span class="cx">     memset(vector, 0, bytes);
</span><span class="cx">     StructureChain* chain = new (NotNull, allocateCell<StructureChain>(vm)) StructureChain(vm, vm.structureChainStructure.get(), vector);
</span><span class="cx">     chain->finishCreation(vm, head);
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeStructureChainh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/StructureChain.h (286346 => 286347)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/StructureChain.h     2021-12-01 02:56:24 UTC (rev 286346)
+++ trunk/Source/JavaScriptCore/runtime/StructureChain.h        2021-12-01 04:38:56 UTC (rev 286347)
</span><span class="lines">@@ -46,7 +46,7 @@
</span><span class="cx">     template<typename CellType, SubspaceAccess>
</span><span class="cx">     static IsoSubspace* subspaceFor(VM& vm)
</span><span class="cx">     {
</span><del>-        return &vm.structureChainSpace;
</del><ins>+        return &vm.structureChainSpace();
</ins><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     static StructureChain* create(VM&, JSObject*);
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeStructureRareDatah"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/StructureRareData.h (286346 => 286347)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/StructureRareData.h  2021-12-01 02:56:24 UTC (rev 286346)
+++ trunk/Source/JavaScriptCore/runtime/StructureRareData.h     2021-12-01 04:38:56 UTC (rev 286347)
</span><span class="lines">@@ -66,7 +66,7 @@
</span><span class="cx">     template<typename CellType, SubspaceAccess>
</span><span class="cx">     static IsoSubspace* subspaceFor(VM& vm)
</span><span class="cx">     {
</span><del>-        return &vm.structureRareDataSpace;
</del><ins>+        return &vm.structureRareDataSpace();
</ins><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     static StructureRareData* create(VM&, Structure*);
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeSymbolPrototypeh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/SymbolPrototype.h (286346 => 286347)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/SymbolPrototype.h    2021-12-01 02:56:24 UTC (rev 286346)
+++ trunk/Source/JavaScriptCore/runtime/SymbolPrototype.h       2021-12-01 04:38:56 UTC (rev 286347)
</span><span class="lines">@@ -41,7 +41,7 @@
</span><span class="cx">     static IsoSubspace* subspaceFor(VM& vm)
</span><span class="cx">     {
</span><span class="cx">         STATIC_ASSERT_ISO_SUBSPACE_SHARABLE(SymbolPrototype, Base);
</span><del>-        return &vm.plainObjectSpace;
</del><ins>+        return &vm.plainObjectSpace();
</ins><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     static SymbolPrototype* create(VM& vm, JSGlobalObject* globalObject, Structure* structure)
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeSymbolTableh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/SymbolTable.h (286346 => 286347)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/SymbolTable.h        2021-12-01 02:56:24 UTC (rev 286346)
+++ trunk/Source/JavaScriptCore/runtime/SymbolTable.h   2021-12-01 04:38:56 UTC (rev 286347)
</span><span class="lines">@@ -456,7 +456,7 @@
</span><span class="cx">     template<typename CellType, SubspaceAccess>
</span><span class="cx">     static IsoSubspace* subspaceFor(VM& vm)
</span><span class="cx">     {
</span><del>-        return &vm.symbolTableSpace;
</del><ins>+        return &vm.symbolTableSpace();
</ins><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     static SymbolTable* create(VM& vm)
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeTemporalCalendarPrototypeh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/TemporalCalendarPrototype.h (286346 => 286347)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/TemporalCalendarPrototype.h  2021-12-01 02:56:24 UTC (rev 286346)
+++ trunk/Source/JavaScriptCore/runtime/TemporalCalendarPrototype.h     2021-12-01 04:38:56 UTC (rev 286347)
</span><span class="lines">@@ -38,7 +38,7 @@
</span><span class="cx">     static IsoSubspace* subspaceFor(VM& vm)
</span><span class="cx">     {
</span><span class="cx">         STATIC_ASSERT_ISO_SUBSPACE_SHARABLE(TemporalCalendarPrototype, Base);
</span><del>-        return &vm.plainObjectSpace;
</del><ins>+        return &vm.plainObjectSpace();
</ins><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     static TemporalCalendarPrototype* create(VM&, JSGlobalObject*, Structure*);
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeTemporalDurationPrototypeh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/TemporalDurationPrototype.h (286346 => 286347)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/TemporalDurationPrototype.h  2021-12-01 02:56:24 UTC (rev 286346)
+++ trunk/Source/JavaScriptCore/runtime/TemporalDurationPrototype.h     2021-12-01 04:38:56 UTC (rev 286347)
</span><span class="lines">@@ -1,5 +1,6 @@
</span><span class="cx"> /*
</span><span class="cx">  * Copyright (C) 2021 Sony Interactive Entertainment Inc.
</span><ins>+ * Copyright (C) 2021 Apple Inc. All rights reserved.
</ins><span class="cx">  *
</span><span class="cx">  * Redistribution and use in source and binary forms, with or without
</span><span class="cx">  * modification, are permitted provided that the following conditions
</span><span class="lines">@@ -38,7 +39,7 @@
</span><span class="cx">     static IsoSubspace* subspaceFor(VM& vm)
</span><span class="cx">     {
</span><span class="cx">         STATIC_ASSERT_ISO_SUBSPACE_SHARABLE(TemporalDurationPrototype, Base);
</span><del>-        return &vm.plainObjectSpace;
</del><ins>+        return &vm.plainObjectSpace();
</ins><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     static TemporalDurationPrototype* create(VM&, Structure*);
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeTemporalInstantPrototypeh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/TemporalInstantPrototype.h (286346 => 286347)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/TemporalInstantPrototype.h   2021-12-01 02:56:24 UTC (rev 286346)
+++ trunk/Source/JavaScriptCore/runtime/TemporalInstantPrototype.h      2021-12-01 04:38:56 UTC (rev 286347)
</span><span class="lines">@@ -1,5 +1,6 @@
</span><span class="cx"> /*
</span><span class="cx">  * Copyright (C) 2021 Igalia S.L.
</span><ins>+ * Copyright (C) 2021 Apple Inc. All rights reserved.
</ins><span class="cx">  *
</span><span class="cx">  * Redistribution and use in source and binary forms, with or without
</span><span class="cx">  * modification, are permitted provided that the following conditions
</span><span class="lines">@@ -38,7 +39,7 @@
</span><span class="cx">     static IsoSubspace* subspaceFor(VM& vm)
</span><span class="cx">     {
</span><span class="cx">         STATIC_ASSERT_ISO_SUBSPACE_SHARABLE(TemporalInstantPrototype, Base);
</span><del>-        return &vm.plainObjectSpace;
</del><ins>+        return &vm.plainObjectSpace();
</ins><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     static TemporalInstantPrototype* create(VM&, Structure*);
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeTemporalNowh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/TemporalNow.h (286346 => 286347)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/TemporalNow.h        2021-12-01 02:56:24 UTC (rev 286346)
+++ trunk/Source/JavaScriptCore/runtime/TemporalNow.h   2021-12-01 04:38:56 UTC (rev 286347)
</span><span class="lines">@@ -1,5 +1,6 @@
</span><span class="cx"> /*
</span><span class="cx">  *  Copyright (C) 2021 Igalia, S.L. All rights reserved.
</span><ins>+ *  Copyright (C) 2021 Apple Inc. All rights reserved.
</ins><span class="cx">  *
</span><span class="cx">  *  This library is free software; you can redistribute it and/or
</span><span class="cx">  *  modify it under the terms of the GNU Lesser General Public
</span><span class="lines">@@ -32,7 +33,7 @@
</span><span class="cx">     static IsoSubspace* subspaceFor(VM& vm)
</span><span class="cx">     {
</span><span class="cx">         STATIC_ASSERT_ISO_SUBSPACE_SHARABLE(TemporalNow, Base);
</span><del>-        return &vm.plainObjectSpace;
</del><ins>+        return &vm.plainObjectSpace();
</ins><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     static TemporalNow* create(VM&, Structure*);
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeTemporalObjecth"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/TemporalObject.h (286346 => 286347)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/TemporalObject.h     2021-12-01 02:56:24 UTC (rev 286346)
+++ trunk/Source/JavaScriptCore/runtime/TemporalObject.h        2021-12-01 04:38:56 UTC (rev 286347)
</span><span class="lines">@@ -1,6 +1,7 @@
</span><span class="cx"> /*
</span><span class="cx">  *  Copyright (C) 2021 Igalia, S.L. All rights reserved.
</span><span class="cx">  *  Copyright (C) 2021 Sony Interactive Entertainment Inc.
</span><ins>+ *  Copyright (C) 2021 Apple Inc. All rights reserved.
</ins><span class="cx">  *
</span><span class="cx">  *  This library is free software; you can redistribute it and/or
</span><span class="cx">  *  modify it under the terms of the GNU Lesser General Public
</span><span class="lines">@@ -64,7 +65,7 @@
</span><span class="cx">     static IsoSubspace* subspaceFor(VM& vm)
</span><span class="cx">     {
</span><span class="cx">         STATIC_ASSERT_ISO_SUBSPACE_SHARABLE(TemporalObject, Base);
</span><del>-        return &vm.plainObjectSpace;
</del><ins>+        return &vm.plainObjectSpace();
</ins><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     static TemporalObject* create(VM&, Structure*);
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeTemporalPlainTimePrototypeh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/TemporalPlainTimePrototype.h (286346 => 286347)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/TemporalPlainTimePrototype.h 2021-12-01 02:56:24 UTC (rev 286346)
+++ trunk/Source/JavaScriptCore/runtime/TemporalPlainTimePrototype.h    2021-12-01 04:38:56 UTC (rev 286347)
</span><span class="lines">@@ -1,5 +1,5 @@
</span><span class="cx"> /*
</span><del>- * Copyright (C) 2021 Apple Inc.
</del><ins>+ * Copyright (C) 2021 Apple Inc. All rights reserved.
</ins><span class="cx">  *
</span><span class="cx">  * Redistribution and use in source and binary forms, with or without
</span><span class="cx">  * modification, are permitted provided that the following conditions
</span><span class="lines">@@ -38,7 +38,7 @@
</span><span class="cx">     static IsoSubspace* subspaceFor(VM& vm)
</span><span class="cx">     {
</span><span class="cx">         STATIC_ASSERT_ISO_SUBSPACE_SHARABLE(TemporalPlainTimePrototype, Base);
</span><del>-        return &vm.plainObjectSpace;
</del><ins>+        return &vm.plainObjectSpace();
</ins><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     static TemporalPlainTimePrototype* create(VM&, JSGlobalObject*, Structure*);
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeTemporalTimeZonePrototypeh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/TemporalTimeZonePrototype.h (286346 => 286347)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/TemporalTimeZonePrototype.h  2021-12-01 02:56:24 UTC (rev 286346)
+++ trunk/Source/JavaScriptCore/runtime/TemporalTimeZonePrototype.h     2021-12-01 04:38:56 UTC (rev 286347)
</span><span class="lines">@@ -38,7 +38,7 @@
</span><span class="cx">     static IsoSubspace* subspaceFor(VM& vm)
</span><span class="cx">     {
</span><span class="cx">         STATIC_ASSERT_ISO_SUBSPACE_SHARABLE(TemporalTimeZonePrototype, Base);
</span><del>-        return &vm.plainObjectSpace;
</del><ins>+        return &vm.plainObjectSpace();
</ins><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     static TemporalTimeZonePrototype* create(VM&, JSGlobalObject*, Structure*);
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeThrowScopecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/ThrowScope.cpp (286346 => 286347)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/ThrowScope.cpp       2021-12-01 02:56:24 UTC (rev 286346)
+++ trunk/Source/JavaScriptCore/runtime/ThrowScope.cpp  2021-12-01 04:38:56 UTC (rev 286347)
</span><span class="lines">@@ -1,5 +1,5 @@
</span><span class="cx"> /*
</span><del>- * Copyright (C) 2016-2019 Apple Inc. All rights reserved.
</del><ins>+ * Copyright (C) 2016-2021 Apple Inc. All rights reserved.
</ins><span class="cx">  *
</span><span class="cx">  * Redistribution and use in source and binary forms, with or without
</span><span class="cx">  * modification, are permitted provided that the following conditions
</span><span class="lines">@@ -29,6 +29,7 @@
</span><span class="cx"> #include "Exception.h"
</span><span class="cx"> #include "JSCJSValueInlines.h"
</span><span class="cx"> #include "VM.h"
</span><ins>+#include <wtf/StackTrace.h>
</ins><span class="cx"> 
</span><span class="cx"> namespace JSC {
</span><span class="cx">     
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeVMcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/VM.cpp (286346 => 286347)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/VM.cpp       2021-12-01 02:56:24 UTC (rev 286346)
+++ trunk/Source/JavaScriptCore/runtime/VM.cpp  2021-12-01 04:38:56 UTC (rev 286347)
</span><span class="lines">@@ -32,13 +32,9 @@
</span><span class="cx"> #include "AccessCase.h"
</span><span class="cx"> #include "AggregateError.h"
</span><span class="cx"> #include "ArgList.h"
</span><del>-#include "BigIntObject.h"
-#include "BooleanObject.h"
-#include "BrandedStructure.h"
</del><span class="cx"> #include "BuiltinExecutables.h"
</span><span class="cx"> #include "BytecodeIntrinsicRegistry.h"
</span><span class="cx"> #include "CheckpointOSRExitSideState.h"
</span><del>-#include "ClonedArguments.h"
</del><span class="cx"> #include "CodeBlock.h"
</span><span class="cx"> #include "CodeCache.h"
</span><span class="cx"> #include "CommonIdentifiers.h"
</span><span class="lines">@@ -45,8 +41,6 @@
</span><span class="cx"> #include "ControlFlowProfiler.h"
</span><span class="cx"> #include "CustomGetterSetter.h"
</span><span class="cx"> #include "DOMAttributeGetterSetter.h"
</span><del>-#include "DateInstance.h"
-#include "DebuggerScope.h"
</del><span class="cx"> #include "DeferredWorkTimer.h"
</span><span class="cx"> #include "Disassembler.h"
</span><span class="cx"> #include "DoublePredictionFuzzerAgent.h"
</span><span class="lines">@@ -55,7 +49,6 @@
</span><span class="cx"> #include "Exception.h"
</span><span class="cx"> #include "ExecutableToCodeBlockEdge.h"
</span><span class="cx"> #include "FTLThunks.h"
</span><del>-#include "FastMallocAlignedMemoryAllocator.h"
</del><span class="cx"> #include "FileBasedFuzzerAgent.h"
</span><span class="cx"> #include "FunctionCodeBlock.h"
</span><span class="cx"> #include "FunctionExecutable.h"
</span><span class="lines">@@ -66,77 +59,25 @@
</span><span class="cx"> #include "HeapProfiler.h"
</span><span class="cx"> #include "Interpreter.h"
</span><span class="cx"> #include "IntlCache.h"
</span><del>-#include "IntlCollator.h"
-#include "IntlDateTimeFormat.h"
-#include "IntlDisplayNames.h"
-#include "IntlListFormat.h"
-#include "IntlLocale.h"
-#include "IntlNumberFormat.h"
-#include "IntlPluralRules.h"
-#include "IntlRelativeTimeFormat.h"
-#include "IntlSegmentIterator.h"
-#include "IntlSegmenter.h"
-#include "IntlSegments.h"
-#include "IsoHeapCellType.h"
-#include "IsoInlinedHeapCellType.h"
</del><span class="cx"> #include "JITCode.h"
</span><span class="cx"> #include "JITOperationList.h"
</span><span class="cx"> #include "JITSizeStatistics.h"
</span><span class="cx"> #include "JITThunks.h"
</span><span class="cx"> #include "JITWorklist.h"
</span><del>-#include "JSAPIGlobalObject.h"
</del><span class="cx"> #include "JSAPIValueWrapper.h"
</span><del>-#include "JSAPIWrapperObject.h"
-#include "JSArray.h"
-#include "JSArrayBuffer.h"
-#include "JSArrayIterator.h"
-#include "JSAsyncGenerator.h"
</del><span class="cx"> #include "JSBigInt.h"
</span><del>-#include "JSBoundFunction.h"
-#include "JSCallbackConstructor.h"
-#include "JSCallbackFunction.h"
-#include "JSCallbackObject.h"
-#include "JSCallee.h"
-#include "JSCustomGetterFunction.h"
-#include "JSCustomSetterFunction.h"
-#include "JSDestructibleObjectHeapCellType.h"
-#include "JSFinalizationRegistry.h"
-#include "JSFunction.h"
-#include "JSGlobalLexicalEnvironment.h"
</del><span class="cx"> #include "JSGlobalObject.h"
</span><span class="cx"> #include "JSImmutableButterfly.h"
</span><del>-#include "JSInjectedScriptHost.h"
-#include "JSJavaScriptCallFrame.h"
</del><span class="cx"> #include "JSLock.h"
</span><span class="cx"> #include "JSMap.h"
</span><del>-#include "JSMapIterator.h"
-#include "JSModuleNamespaceObject.h"
-#include "JSModuleRecord.h"
-#include "JSNativeStdFunction.h"
</del><span class="cx"> #include "JSPromise.h"
</span><span class="cx"> #include "JSPropertyNameEnumerator.h"
</span><del>-#include "JSProxy.h"
</del><span class="cx"> #include "JSScriptFetchParameters.h"
</span><span class="cx"> #include "JSScriptFetcher.h"
</span><span class="cx"> #include "JSSet.h"
</span><del>-#include "JSSetIterator.h"
</del><span class="cx"> #include "JSSourceCode.h"
</span><del>-#include "JSStringIterator.h"
</del><span class="cx"> #include "JSTemplateObjectDescriptor.h"
</span><del>-#include "JSToWasmICCallee.h"
-#include "JSTypedArrays.h"
-#include "JSWeakMap.h"
-#include "JSWeakObjectRef.h"
-#include "JSWeakSet.h"
</del><span class="cx"> #include "JSWebAssemblyCodeBlock.h"
</span><del>-#include "JSWebAssemblyException.h"
-#include "JSWebAssemblyGlobal.h"
-#include "JSWebAssemblyInstance.h"
-#include "JSWebAssemblyMemory.h"
-#include "JSWebAssemblyModule.h"
-#include "JSWebAssemblyTable.h"
-#include "JSWebAssemblyTag.h"
-#include "JSWithScope.h"
</del><span class="cx"> #include "LLIntData.h"
</span><span class="cx"> #include "LLIntExceptions.h"
</span><span class="cx"> #include "MarkedBlockInlines.h"
</span><span class="lines">@@ -151,28 +92,16 @@
</span><span class="cx"> #include "ProgramCodeBlock.h"
</span><span class="cx"> #include "ProgramExecutable.h"
</span><span class="cx"> #include "PropertyTable.h"
</span><del>-#include "ProxyRevoke.h"
</del><span class="cx"> #include "RandomizingFuzzerAgent.h"
</span><span class="cx"> #include "RegExpCache.h"
</span><del>-#include "RegExpObject.h"
</del><span class="cx"> #include "SamplingProfiler.h"
</span><span class="cx"> #include "ScopedArguments.h"
</span><span class="cx"> #include "ShadowChicken.h"
</span><del>-#include "ShadowRealmObject.h"
</del><span class="cx"> #include "SimpleTypedArrayController.h"
</span><span class="cx"> #include "SourceProviderCache.h"
</span><del>-#include "StrictEvalActivation.h"
-#include "StringObject.h"
</del><span class="cx"> #include "StrongInlines.h"
</span><del>-#include "StructureAlignedMemoryAllocator.h"
</del><span class="cx"> #include "StructureChain.h"
</span><span class="cx"> #include "StructureInlines.h"
</span><del>-#include "SymbolObject.h"
-#include "TemporalCalendar.h"
-#include "TemporalDuration.h"
-#include "TemporalInstant.h"
-#include "TemporalPlainTime.h"
-#include "TemporalTimeZone.h"
</del><span class="cx"> #include "TestRunnerUtils.h"
</span><span class="cx"> #include "ThunkGenerators.h"
</span><span class="cx"> #include "TypeProfiler.h"
</span><span class="lines">@@ -184,19 +113,16 @@
</span><span class="cx"> #include "WasmWorklist.h"
</span><span class="cx"> #include "Watchdog.h"
</span><span class="cx"> #include "WeakGCMapInlines.h"
</span><del>-#include "WebAssemblyFunction.h"
-#include "WebAssemblyModuleRecord.h"
-#include "WebAssemblyWrapperFunction.h"
</del><span class="cx"> #include "WideningNumberPredictionFuzzerAgent.h"
</span><span class="cx"> #include <wtf/ProcessID.h>
</span><span class="cx"> #include <wtf/ReadWriteLock.h>
</span><span class="cx"> #include <wtf/SimpleStats.h>
</span><ins>+#include <wtf/StackTrace.h>
</ins><span class="cx"> #include <wtf/StringPrintStream.h>
</span><span class="cx"> #include <wtf/Threading.h>
</span><span class="cx"> #include <wtf/text/AtomStringTable.h>
</span><span class="cx"> 
</span><span class="cx"> #if ENABLE(C_LOOP)
</span><del>-#include "CLoopStack.h"
</del><span class="cx"> #include "CLoopStackInlines.h"
</span><span class="cx"> #endif
</span><span class="cx"> 
</span><span class="lines">@@ -208,15 +134,6 @@
</span><span class="cx"> #include "RegExp.h"
</span><span class="cx"> #endif
</span><span class="cx"> 
</span><del>-#if JSC_OBJC_API_ENABLED
-#include "ObjCCallbackFunction.h"
-#endif
-
-#ifdef JSC_GLIB_API_ENABLED
-#include "JSAPIWrapperGlobalObject.h"
-#include "JSCCallbackFunction.h"
-#endif
-
</del><span class="cx"> namespace JSC {
</span><span class="cx"> 
</span><span class="cx"> Atomic<unsigned> VM::s_numberOfIDs;
</span><span class="lines">@@ -292,109 +209,6 @@
</span><span class="cx">     , m_random(Options::seedOfVMRandomForFuzzer() ? Options::seedOfVMRandomForFuzzer() : cryptographicallyRandomNumber())
</span><span class="cx">     , m_integrityRandom(*this)
</span><span class="cx">     , heap(*this, heapType)
</span><del>-    , fastMallocAllocator(makeUnique<FastMallocAlignedMemoryAllocator>())
-    , primitiveGigacageAllocator(makeUnique<GigacageAlignedMemoryAllocator>(Gigacage::Primitive))
-    , jsValueGigacageAllocator(makeUnique<GigacageAlignedMemoryAllocator>(Gigacage::JSValue))
-    , auxiliaryHeapCellType(makeUnique<HeapCellType>(CellAttributes(DoesNotNeedDestruction, HeapCell::Auxiliary)))
-    , immutableButterflyHeapCellType(makeUnique<HeapCellType>(CellAttributes(DoesNotNeedDestruction, HeapCell::JSCellWithIndexingHeader)))
-    , cellHeapCellType(makeUnique<HeapCellType>(CellAttributes(DoesNotNeedDestruction, HeapCell::JSCell)))
-    , destructibleCellHeapCellType(makeUnique<HeapCellType>(CellAttributes(NeedsDestruction, HeapCell::JSCell)))
-    , apiGlobalObjectHeapCellType(IsoHeapCellType::create<JSAPIGlobalObject>())
-    , callbackConstructorHeapCellType(IsoHeapCellType::create<JSCallbackConstructor>())
-    , callbackGlobalObjectHeapCellType(IsoHeapCellType::create<JSCallbackObject<JSGlobalObject>>())
-    , callbackObjectHeapCellType(IsoHeapCellType::create<JSCallbackObject<JSNonFinalObject>>())
-    , customGetterFunctionHeapCellType(IsoHeapCellType::create<JSCustomGetterFunction>())
-    , customSetterFunctionHeapCellType(IsoHeapCellType::create<JSCustomSetterFunction>())
-    , dateInstanceHeapCellType(IsoHeapCellType::create<DateInstance>())
-    , errorInstanceHeapCellType(IsoHeapCellType::create<ErrorInstance>())
-    , finalizationRegistryCellType(IsoHeapCellType::create<JSFinalizationRegistry>())
-    , globalLexicalEnvironmentHeapCellType(IsoHeapCellType::create<JSGlobalLexicalEnvironment>())
-    , globalObjectHeapCellType(IsoHeapCellType::create<JSGlobalObject>())
-    , injectedScriptHostSpaceHeapCellType(IsoHeapCellType::create<Inspector::JSInjectedScriptHost>())
-    , javaScriptCallFrameHeapCellType(IsoHeapCellType::create<Inspector::JSJavaScriptCallFrame>())
-    , jsModuleRecordHeapCellType(IsoHeapCellType::create<JSModuleRecord>())
-    , moduleNamespaceObjectHeapCellType(IsoHeapCellType::create<JSModuleNamespaceObject>())
-    , nativeStdFunctionHeapCellType(IsoHeapCellType::create<JSNativeStdFunction>())
-    , stringHeapCellType(makeUnique<IsoInlinedHeapCellType<JSString>>())
-    , weakMapHeapCellType(IsoHeapCellType::create<JSWeakMap>())
-    , weakSetHeapCellType(IsoHeapCellType::create<JSWeakSet>())
-    , destructibleObjectHeapCellType(makeUnique<JSDestructibleObjectHeapCellType>())
-#if JSC_OBJC_API_ENABLED
-    , apiWrapperObjectHeapCellType(IsoHeapCellType::create<JSCallbackObject<JSAPIWrapperObject>>())
-    , objCCallbackFunctionHeapCellType(IsoHeapCellType::create<ObjCCallbackFunction>())
-#endif
-#ifdef JSC_GLIB_API_ENABLED
-    , apiWrapperObjectHeapCellType(IsoHeapCellType::create<JSCallbackObject<JSAPIWrapperObject>>())
-    , callbackAPIWrapperGlobalObjectHeapCellType(IsoHeapCellType::create<JSCallbackObject<JSAPIWrapperGlobalObject>>())
-    , jscCallbackFunctionHeapCellType(IsoHeapCellType::create<JSCCallbackFunction>())
-#endif
-    , intlCollatorHeapCellType(IsoHeapCellType::create<IntlCollator>())
-    , intlDateTimeFormatHeapCellType(IsoHeapCellType::create<IntlDateTimeFormat>())
-    , intlDisplayNamesHeapCellType(IsoHeapCellType::create<IntlDisplayNames>())
-    , intlListFormatHeapCellType(IsoHeapCellType::create<IntlListFormat>())
-    , intlLocaleHeapCellType(IsoHeapCellType::create<IntlLocale>())
-    , intlNumberFormatHeapCellType(IsoHeapCellType::create<IntlNumberFormat>())
-    , intlPluralRulesHeapCellType(IsoHeapCellType::create<IntlPluralRules>())
-    , intlRelativeTimeFormatHeapCellType(IsoHeapCellType::create<IntlRelativeTimeFormat>())
-    , intlSegmentIteratorHeapCellType(IsoHeapCellType::create<IntlSegmentIterator>())
-    , intlSegmenterHeapCellType(IsoHeapCellType::create<IntlSegmenter>())
-    , intlSegmentsHeapCellType(IsoHeapCellType::create<IntlSegments>())
-#if ENABLE(WEBASSEMBLY)
-    , webAssemblyCodeBlockHeapCellType(IsoHeapCellType::create<JSWebAssemblyCodeBlock>())
-    , webAssemblyExceptionHeapCellType(IsoHeapCellType::create<JSWebAssemblyException>())
-    , webAssemblyFunctionHeapCellType(IsoHeapCellType::create<WebAssemblyFunction>())
-    , webAssemblyGlobalHeapCellType(IsoHeapCellType::create<JSWebAssemblyGlobal>())
-    , webAssemblyInstanceHeapCellType(IsoHeapCellType::create<JSWebAssemblyInstance>())
-    , webAssemblyMemoryHeapCellType(IsoHeapCellType::create<JSWebAssemblyMemory>())
-    , webAssemblyModuleHeapCellType(IsoHeapCellType::create<JSWebAssemblyModule>())
-    , webAssemblyModuleRecordHeapCellType(IsoHeapCellType::create<WebAssemblyModuleRecord>())
-    , webAssemblyTableHeapCellType(IsoHeapCellType::create<JSWebAssemblyTable>())
-    , webAssemblyTagHeapCellType(IsoHeapCellType::create<JSWebAssemblyTag>())
-#endif
-    , primitiveGigacageAuxiliarySpace("Primitive Gigacage Auxiliary", heap, *auxiliaryHeapCellType, primitiveGigacageAllocator.get()) // Hash:0x3e7cd762
-    , jsValueGigacageAuxiliarySpace("JSValue Gigacage Auxiliary", heap, *auxiliaryHeapCellType, jsValueGigacageAllocator.get()) // Hash:0x241e946
-    , immutableButterflyJSValueGigacageAuxiliarySpace("ImmutableButterfly Gigacage JSCellWithIndexingHeader", heap, *immutableButterflyHeapCellType, jsValueGigacageAllocator.get()) // Hash:0x7a945300
-    , cellSpace("JSCell", heap, *cellHeapCellType, fastMallocAllocator.get()) // Hash:0xadfb5a79
-    , variableSizedCellSpace("Variable Sized JSCell", heap, *cellHeapCellType, fastMallocAllocator.get()) // Hash:0xbcd769cc
-    , destructibleObjectSpace("JSDestructibleObject", heap, *destructibleObjectHeapCellType, fastMallocAllocator.get()) // Hash:0x4f5ed7a9
-    , arraySpace ISO_SUBSPACE_INIT(heap, *cellHeapCellType, JSArray)
-    , bigIntSpace ISO_SUBSPACE_INIT(heap, *cellHeapCellType, JSBigInt)
-    , calleeSpace ISO_SUBSPACE_INIT(heap, *cellHeapCellType, JSCallee)
-    , clonedArgumentsSpace ISO_SUBSPACE_INIT(heap, *cellHeapCellType, ClonedArguments)
-    , customGetterSetterSpace ISO_SUBSPACE_INIT(heap, *cellHeapCellType, CustomGetterSetter)
-    , dateInstanceSpace ISO_SUBSPACE_INIT(heap, *dateInstanceHeapCellType, DateInstance)
-    , domAttributeGetterSetterSpace ISO_SUBSPACE_INIT(heap, *cellHeapCellType, DOMAttributeGetterSetter)
-    , exceptionSpace ISO_SUBSPACE_INIT(heap, *destructibleCellHeapCellType, Exception)
-    , executableToCodeBlockEdgeSpace ISO_SUBSPACE_INIT(heap, *cellHeapCellType, ExecutableToCodeBlockEdge) // Hash:0x7b730b20
-    , functionSpace ISO_SUBSPACE_INIT(heap, *cellHeapCellType, JSFunction) // Hash:0x800fca72
-    , getterSetterSpace ISO_SUBSPACE_INIT(heap, *cellHeapCellType, GetterSetter)
-    , globalLexicalEnvironmentSpace ISO_SUBSPACE_INIT(heap, *globalLexicalEnvironmentHeapCellType, JSGlobalLexicalEnvironment)
-    , internalFunctionSpace ISO_SUBSPACE_INIT(heap, *cellHeapCellType, InternalFunction) // Hash:0xf845c464
-    , jsProxySpace ISO_SUBSPACE_INIT(heap, *cellHeapCellType, JSProxy)
-    , nativeExecutableSpace ISO_SUBSPACE_INIT(heap, *destructibleCellHeapCellType, NativeExecutable) // Hash:0x67567f95
-    , numberObjectSpace ISO_SUBSPACE_INIT(heap, *cellHeapCellType, NumberObject)
-    , plainObjectSpace ISO_SUBSPACE_INIT(heap, *cellHeapCellType, JSNonFinalObject) // Mainly used for prototypes.
-    , promiseSpace ISO_SUBSPACE_INIT(heap, *cellHeapCellType, JSPromise)
-    , propertyNameEnumeratorSpace ISO_SUBSPACE_INIT(heap, *cellHeapCellType, JSPropertyNameEnumerator)
-    , propertyTableSpace ISO_SUBSPACE_INIT(heap, *destructibleCellHeapCellType, PropertyTable) // Hash:0xc6bc9f12
-    , regExpSpace ISO_SUBSPACE_INIT(heap, *destructibleCellHeapCellType, RegExp)
-    , regExpObjectSpace ISO_SUBSPACE_INIT(heap, *cellHeapCellType, RegExpObject)
-    , ropeStringSpace ISO_SUBSPACE_INIT(heap, *stringHeapCellType, JSRopeString)
-    , scopedArgumentsSpace ISO_SUBSPACE_INIT(heap, *cellHeapCellType, ScopedArguments)
-    , sparseArrayValueMapSpace ISO_SUBSPACE_INIT(heap, *destructibleCellHeapCellType, SparseArrayValueMap)
-    , stringSpace ISO_SUBSPACE_INIT(heap, *stringHeapCellType, JSString) // Hash:0x90cf758f
-    , stringObjectSpace ISO_SUBSPACE_INIT(heap, *cellHeapCellType, StringObject)
-    , structureChainSpace ISO_SUBSPACE_INIT(heap, *cellHeapCellType, StructureChain)
-    , structureRareDataSpace ISO_SUBSPACE_INIT(heap, *destructibleCellHeapCellType, StructureRareData) // Hash:0xaca4e62d
-    , structureSpace("IsolatedStructureSpace", heap, *destructibleCellHeapCellType, sizeof(Structure), Structure::numberOfLowerTierCells, makeUnique<StructureAlignedMemoryAllocator>("Structure"))
-    , brandedStructureSpace("IsolatedBrandedStructureSpace", heap, *destructibleCellHeapCellType, sizeof(BrandedStructure), BrandedStructure::numberOfLowerTierCells, makeUnique<StructureAlignedMemoryAllocator>("Structure"))
-    , symbolTableSpace ISO_SUBSPACE_INIT(heap, *destructibleCellHeapCellType, SymbolTable) // Hash:0xc5215afd
-    , executableToCodeBlockEdgesWithConstraints(executableToCodeBlockEdgeSpace)
-    , executableToCodeBlockEdgesWithFinalizers(executableToCodeBlockEdgeSpace)
-    , codeBlockSpace ISO_SUBSPACE_INIT(heap, *destructibleCellHeapCellType, CodeBlock) // Hash:0x77e66ec9
-    , functionExecutableSpace ISO_SUBSPACE_INIT(heap, *destructibleCellHeapCellType, FunctionExecutable) // Hash:0x5d158f3
-    , programExecutableSpace ISO_SUBSPACE_INIT(heap, *destructibleCellHeapCellType, ProgramExecutable) // Hash:0x527c77e7
-    , unlinkedFunctionExecutableSpace ISO_SUBSPACE_INIT(heap, *destructibleCellHeapCellType, UnlinkedFunctionExecutable) // Hash:0xf6b828d9
</del><span class="cx">     , vmType(vmType)
</span><span class="cx">     , clientData(nullptr)
</span><span class="cx">     , topEntryFrame(nullptr)
</span><span class="lines">@@ -1573,137 +1387,6 @@
</span><span class="cx">     m_shadowChicken = makeUnique<ShadowChicken>();
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-#define DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(name, heapCellType, type) \
-    IsoSubspace* VM::name##Slow() \
-    { \
-        ASSERT(!m_##name); \
-        auto space = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(heap, heapCellType, type); \
-        WTF::storeStoreFence(); \
-        m_##name = WTFMove(space); \
-        return m_##name.get(); \
-    }
-
-
-DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(apiGlobalObjectSpace, *apiGlobalObjectHeapCellType, JSAPIGlobalObject)
-DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(apiValueWrapperSpace, *cellHeapCellType, JSAPIValueWrapper)
-DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(arrayBufferSpace, *cellHeapCellType, JSArrayBuffer)
-DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(arrayIteratorSpace, *cellHeapCellType, JSArrayIterator)
-DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(asyncGeneratorSpace, *cellHeapCellType, JSAsyncGenerator)
-DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(bigInt64ArraySpace, *cellHeapCellType, JSBigInt64Array)
-DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(bigIntObjectSpace, *cellHeapCellType, BigIntObject)
-DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(bigUint64ArraySpace, *cellHeapCellType, JSBigUint64Array)
-DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(booleanObjectSpace, *cellHeapCellType, BooleanObject)
-DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(boundFunctionSpace, *cellHeapCellType, JSBoundFunction) // Hash:0xd7916d41
-DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(callbackConstructorSpace, *callbackConstructorHeapCellType, JSCallbackConstructor)
-DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(callbackGlobalObjectSpace, *callbackGlobalObjectHeapCellType, JSCallbackObject<JSGlobalObject>)
-DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(callbackFunctionSpace, *cellHeapCellType, JSCallbackFunction) // Hash:0xe7648ebc
-DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(callbackObjectSpace, *callbackObjectHeapCellType, JSCallbackObject<JSNonFinalObject>)
-DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(customGetterFunctionSpace, *customGetterFunctionHeapCellType, JSCustomGetterFunction)
-DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(customSetterFunctionSpace, *customSetterFunctionHeapCellType, JSCustomSetterFunction)
-DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(dataViewSpace, *cellHeapCellType, JSDataView)
-DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(debuggerScopeSpace, *cellHeapCellType, DebuggerScope)
-DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(errorInstanceSpace, *errorInstanceHeapCellType, ErrorInstance) // Hash:0x3f40d4a
-DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(float32ArraySpace, *cellHeapCellType, JSFloat32Array)
-DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(float64ArraySpace, *cellHeapCellType, JSFloat64Array)
-DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(functionRareDataSpace, *destructibleCellHeapCellType, FunctionRareData)
-DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(generatorSpace, *cellHeapCellType, JSGenerator)
-DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(globalObjectSpace, *globalObjectHeapCellType, JSGlobalObject)
-DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(injectedScriptHostSpace, *injectedScriptHostSpaceHeapCellType, Inspector::JSInjectedScriptHost)
-DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(int8ArraySpace, *cellHeapCellType, JSInt8Array)
-DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(int16ArraySpace, *cellHeapCellType, JSInt16Array)
-DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(int32ArraySpace, *cellHeapCellType, JSInt32Array)
-DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(javaScriptCallFrameSpace, *javaScriptCallFrameHeapCellType, Inspector::JSJavaScriptCallFrame)
-DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(jsModuleRecordSpace, *jsModuleRecordHeapCellType, JSModuleRecord)
-DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(mapBucketSpace, *cellHeapCellType, JSMap::BucketType)
-DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(mapIteratorSpace, *cellHeapCellType, JSMapIterator)
-DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(mapSpace, *cellHeapCellType, JSMap)
-DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(moduleNamespaceObjectSpace, *moduleNamespaceObjectHeapCellType, JSModuleNamespaceObject)
-DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(nativeStdFunctionSpace, *nativeStdFunctionHeapCellType, JSNativeStdFunction) // Hash:0x70ed61e4
-DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(proxyObjectSpace, *cellHeapCellType, ProxyObject)
-DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(proxyRevokeSpace, *cellHeapCellType, ProxyRevoke) // Hash:0xb506a939
-DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(scopedArgumentsTableSpace, *destructibleCellHeapCellType, ScopedArgumentsTable)
-DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(scriptFetchParametersSpace, *destructibleCellHeapCellType, JSScriptFetchParameters)
-DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(scriptFetcherSpace, *destructibleCellHeapCellType, JSScriptFetcher)
-DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(setBucketSpace, *cellHeapCellType, JSSet::BucketType)
-DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(setIteratorSpace, *cellHeapCellType, JSSetIterator)
-DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(setSpace, *cellHeapCellType, JSSet)
-DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(shadowRealmSpace, *cellHeapCellType, ShadowRealmObject)
-DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(strictEvalActivationSpace, *cellHeapCellType, StrictEvalActivation)
-DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(stringIteratorSpace, *cellHeapCellType, JSStringIterator)
-DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(sourceCodeSpace, *destructibleCellHeapCellType, JSSourceCode)
-DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(symbolSpace, *destructibleCellHeapCellType, Symbol)
-DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(symbolObjectSpace, *cellHeapCellType, SymbolObject)
-DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(templateObjectDescriptorSpace, *destructibleCellHeapCellType, JSTemplateObjectDescriptor)
-DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(temporalCalendarSpace, *cellHeapCellType, TemporalCalendar)
-DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(temporalDurationSpace, *cellHeapCellType, TemporalDuration)
-DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(temporalInstantSpace, *cellHeapCellType, TemporalInstant)
-DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(temporalPlainTimeSpace, *cellHeapCellType, TemporalPlainTime)
-DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(temporalTimeZoneSpace, *cellHeapCellType, TemporalTimeZone)
-DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(uint8ArraySpace, *cellHeapCellType, JSUint8Array)
-DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(uint8ClampedArraySpace, *cellHeapCellType, JSUint8ClampedArray)
-DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(uint16ArraySpace, *cellHeapCellType, JSUint16Array)
-DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(uint32ArraySpace, *cellHeapCellType, JSUint32Array)
-DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(unlinkedEvalCodeBlockSpace, *destructibleCellHeapCellType, UnlinkedEvalCodeBlock)
-DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(unlinkedFunctionCodeBlockSpace, *destructibleCellHeapCellType, UnlinkedFunctionCodeBlock)
-DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(unlinkedModuleProgramCodeBlockSpace, *destructibleCellHeapCellType, UnlinkedModuleProgramCodeBlock)
-DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(unlinkedProgramCodeBlockSpace, *destructibleCellHeapCellType, UnlinkedProgramCodeBlock)
-DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(weakMapSpace, *weakMapHeapCellType, JSWeakMap) // Hash:0x662b12a3
-DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(weakSetSpace, *weakSetHeapCellType, JSWeakSet) // Hash:0x4c781b30
-DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(weakObjectRefSpace, *cellHeapCellType, JSWeakObjectRef) // Hash:0x8ec68f1f
-DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(withScopeSpace, *cellHeapCellType, JSWithScope)
-DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(finalizationRegistrySpace, *finalizationRegistryCellType, JSFinalizationRegistry)
-#if JSC_OBJC_API_ENABLED
-DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(apiWrapperObjectSpace, *apiWrapperObjectHeapCellType, JSCallbackObject<JSAPIWrapperObject>)
-DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(objCCallbackFunctionSpace, *objCCallbackFunctionHeapCellType, ObjCCallbackFunction) // Hash:0x10f610b8
-#endif
-#ifdef JSC_GLIB_API_ENABLED
-DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(apiWrapperObjectSpace, *apiWrapperObjectHeapCellType, JSCallbackObject<JSAPIWrapperObject>)
-DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(jscCallbackFunctionSpace, *jscCallbackFunctionHeapCellType, JSCCallbackFunction)
-DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(callbackAPIWrapperGlobalObjectSpace, *callbackAPIWrapperGlobalObjectHeapCellType, JSCallbackObject<JSAPIWrapperGlobalObject>)
-#endif
-DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(intlCollatorSpace, *intlCollatorHeapCellType, IntlCollator)
-DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(intlDateTimeFormatSpace, *intlDateTimeFormatHeapCellType, IntlDateTimeFormat)
-DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(intlDisplayNamesSpace, *intlDisplayNamesHeapCellType, IntlDisplayNames)
-DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(intlListFormatSpace, *intlListFormatHeapCellType, IntlListFormat)
-DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(intlLocaleSpace, *intlLocaleHeapCellType, IntlLocale)
-DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(intlNumberFormatSpace, *intlNumberFormatHeapCellType, IntlNumberFormat)
-DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(intlPluralRulesSpace, *intlPluralRulesHeapCellType, IntlPluralRules)
-DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(intlRelativeTimeFormatSpace, *intlRelativeTimeFormatHeapCellType, IntlRelativeTimeFormat)
-DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(intlSegmentIteratorSpace, *intlSegmentIteratorHeapCellType, IntlSegmentIterator)
-DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(intlSegmenterSpace, *intlSegmenterHeapCellType, IntlSegmenter)
-DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(intlSegmentsSpace, *intlSegmentsHeapCellType, IntlSegments)
-#if ENABLE(WEBASSEMBLY)
-DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(jsToWasmICCalleeSpace, *cellHeapCellType, JSToWasmICCallee)
-DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(webAssemblyCodeBlockSpace, *webAssemblyCodeBlockHeapCellType, JSWebAssemblyCodeBlock) // Hash:0x9ad995cd
-DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(webAssemblyExceptionSpace, *webAssemblyExceptionHeapCellType, JSWebAssemblyException)
-DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(webAssemblyFunctionSpace, *webAssemblyFunctionHeapCellType, WebAssemblyFunction) // Hash:0x8b7c32db
-DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(webAssemblyGlobalSpace, *webAssemblyGlobalHeapCellType, JSWebAssemblyGlobal)
-DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(webAssemblyInstanceSpace, *webAssemblyInstanceHeapCellType, JSWebAssemblyInstance)
-DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(webAssemblyMemorySpace, *webAssemblyMemoryHeapCellType, JSWebAssemblyMemory)
-DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(webAssemblyModuleSpace, *webAssemblyModuleHeapCellType, JSWebAssemblyModule)
-DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(webAssemblyModuleRecordSpace, *webAssemblyModuleRecordHeapCellType, WebAssemblyModuleRecord)
-DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(webAssemblyTableSpace, *webAssemblyTableHeapCellType, JSWebAssemblyTable)
-DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(webAssemblyTagSpace, *webAssemblyTagHeapCellType, JSWebAssemblyTag)
-DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(webAssemblyWrapperFunctionSpace, *cellHeapCellType, WebAssemblyWrapperFunction) // Hash:0xd4a5ff01
-#endif
-
-#undef DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW
-
-#define DYNAMIC_SPACE_AND_SET_DEFINE_MEMBER_SLOW(name, heapCellType, type) \
-    IsoSubspace* VM::name##Slow() \
-    { \
-        ASSERT(!m_##name); \
-        auto space = makeUnique<SpaceAndSet> ISO_SUBSPACE_INIT(heap, heapCellType, type); \
-        WTF::storeStoreFence(); \
-        m_##name = WTFMove(space); \
-        return &m_##name->space; \
-    }
-
-DYNAMIC_SPACE_AND_SET_DEFINE_MEMBER_SLOW(evalExecutableSpace, *destructibleCellHeapCellType, EvalExecutable) // Hash:0x958e3e9d
-DYNAMIC_SPACE_AND_SET_DEFINE_MEMBER_SLOW(moduleProgramExecutableSpace, *destructibleCellHeapCellType, ModuleProgramExecutable) // Hash:0x6506fa3c
-
-#undef DYNAMIC_SPACE_AND_SET_DEFINE_MEMBER_SLOW
-
</del><span class="cx"> JSCell* VM::sentinelSetBucketSlow()
</span><span class="cx"> {
</span><span class="cx">     ASSERT(!m_sentinelSetBucket);
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeVMh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/VM.h (286346 => 286347)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/VM.h 2021-12-01 02:56:24 UTC (rev 286346)
+++ trunk/Source/JavaScriptCore/runtime/VM.h    2021-12-01 04:38:56 UTC (rev 286347)
</span><span class="lines">@@ -28,22 +28,16 @@
</span><span class="cx"> 
</span><span class="cx"> #pragma once
</span><span class="cx"> 
</span><del>-#include "CallData.h"
</del><span class="cx"> #include "CalleeBits.h"
</span><span class="cx"> #include "CodeSpecializationKind.h"
</span><del>-#include "CompleteSubspace.h"
</del><span class="cx"> #include "ConcurrentJSLock.h"
</span><span class="cx"> #include "DFGDoesGCCheck.h"
</span><span class="cx"> #include "DeleteAllCodeEffort.h"
</span><del>-#include "DisallowVMEntry.h"
</del><span class="cx"> #include "ExceptionEventLocation.h"
</span><span class="cx"> #include "FunctionHasExecutedCache.h"
</span><del>-#include "FuzzerAgent.h"
</del><span class="cx"> #include "Heap.h"
</span><span class="cx"> #include "Integrity.h"
</span><span class="cx"> #include "Intrinsic.h"
</span><del>-#include "IsoCellSet.h"
-#include "IsoSubspace.h"
</del><span class="cx"> #include "JSCJSValue.h"
</span><span class="cx"> #include "JSDateMath.h"
</span><span class="cx"> #include "JSLock.h"
</span><span class="lines">@@ -50,6 +44,7 @@
</span><span class="cx"> #include "JSONAtomStringCache.h"
</span><span class="cx"> #include "MacroAssemblerCodeRef.h"
</span><span class="cx"> #include "Microtask.h"
</span><ins>+#include "NativeFunction.h"
</ins><span class="cx"> #include "NumericStrings.h"
</span><span class="cx"> #include "SmallStrings.h"
</span><span class="cx"> #include "Strong.h"
</span><span class="lines">@@ -58,10 +53,8 @@
</span><span class="cx"> #include "ThunkGenerator.h"
</span><span class="cx"> #include "VMTraps.h"
</span><span class="cx"> #include "WasmContext.h"
</span><del>-#include "Watchpoint.h"
</del><span class="cx"> #include <wtf/BumpPointerAllocator.h>
</span><span class="cx"> #include <wtf/CheckedArithmetic.h>
</span><del>-#include <wtf/DateMath.h>
</del><span class="cx"> #include <wtf/Deque.h>
</span><span class="cx"> #include <wtf/DoublyLinkedList.h>
</span><span class="cx"> #include <wtf/Forward.h>
</span><span class="lines">@@ -69,11 +62,9 @@
</span><span class="cx"> #include <wtf/HashMap.h>
</span><span class="cx"> #include <wtf/HashSet.h>
</span><span class="cx"> #include <wtf/SetForScope.h>
</span><del>-#include <wtf/StackBounds.h>
</del><span class="cx"> #include <wtf/StackPointer.h>
</span><span class="cx"> #include <wtf/Stopwatch.h>
</span><span class="cx"> #include <wtf/ThreadSafeRefCounted.h>
</span><del>-#include <wtf/ThreadSpecific.h>
</del><span class="cx"> #include <wtf/UniqueArray.h>
</span><span class="cx"> #include <wtf/text/SymbolRegistry.h>
</span><span class="cx"> #include <wtf/text/WTFString.h>
</span><span class="lines">@@ -81,10 +72,6 @@
</span><span class="cx"> #include <wtf/ListHashSet.h>
</span><span class="cx"> #endif
</span><span class="cx"> 
</span><del>-#if ENABLE(EXCEPTION_SCOPE_VERIFICATION)
-#include <wtf/StackTrace.h>
-#endif
-
</del><span class="cx"> // Enable the Objective-C API for platforms with a modern runtime. This has to match exactly what we
</span><span class="cx"> // have in JSBase.h.
</span><span class="cx"> #if !defined(JSC_OBJC_API_ENABLED)
</span><span class="lines">@@ -98,16 +85,17 @@
</span><span class="cx"> namespace WTF {
</span><span class="cx"> class RunLoop;
</span><span class="cx"> class SimpleStats;
</span><ins>+class StackTrace;
</ins><span class="cx"> } // namespace WTF
</span><span class="cx"> using WTF::SimpleStats;
</span><ins>+using WTF::StackTrace;
</ins><span class="cx"> 
</span><span class="cx"> namespace JSC {
</span><span class="cx"> 
</span><del>-class BasicBlockLocation;
</del><ins>+class ArgList;
</ins><span class="cx"> class BuiltinExecutables;
</span><span class="cx"> class BytecodeIntrinsicRegistry;
</span><span class="cx"> class CallFrame;
</span><del>-class CallLinkInfo;
</del><span class="cx"> enum class CallMode;
</span><span class="cx"> struct CheckpointOSRExitSideState;
</span><span class="cx"> class CodeBlock;
</span><span class="lines">@@ -116,101 +104,41 @@
</span><span class="cx"> class CompactTDZEnvironmentMap;
</span><span class="cx"> class ConservativeRoots;
</span><span class="cx"> class ControlFlowProfiler;
</span><del>-class CustomGetterSetter;
-class DOMAttributeGetterSetter;
-class DateInstance;
-class ErrorInstance;
</del><span class="cx"> class Exception;
</span><span class="cx"> class ExceptionScope;
</span><del>-class FastMallocAlignedMemoryAllocator;
-class GigacageAlignedMemoryAllocator;
-class HandleStack;
</del><ins>+class FuzzerAgent;
</ins><span class="cx"> class HasOwnPropertyCache;
</span><span class="cx"> class HeapAnalyzer;
</span><span class="cx"> class HeapProfiler;
</span><del>-class Identifier;
</del><span class="cx"> class Interpreter;
</span><span class="cx"> class IntlCache;
</span><del>-class IntlCollator;
-class IntlDateTimeFormat;
-class IntlDisplayNames;
-class IntlListFormat;
-class IntlLocale;
-class IntlNumberFormat;
-class IntlPluralRules;
-class IntlRelativeTimeFormat;
-class IntlSegmentIterator;
-class IntlSegmenter;
-class IntlSegments;
-class JSAPIGlobalObject;
-class JSAPIWrapperGlobalObject;
-class JSAPIWrapperObject;
-class JSCCallbackFunction;
-class JSCallbackConstructor;
</del><span class="cx"> class JSDestructibleObjectHeapCellType;
</span><span class="cx"> class JSGlobalObject;
</span><del>-class JSGlobalLexicalEnvironment;
-class JSModuleNamespaceObject;
-class JSModuleRecord;
-class JSNativeStdFunction;
-class JSNonFinalObject;
</del><span class="cx"> class JSObject;
</span><span class="cx"> class JSPromise;
</span><span class="cx"> class JSPropertyNameEnumerator;
</span><del>-class JSRunLoopTimer;
-class JSWeakMap;
-class JSWeakSet;
-class JSWebAssemblyCodeBlock;
-class JSWebAssemblyGlobal;
-class JSWebAssemblyInstance;
-class JSWebAssemblyMemory;
-class JSWebAssemblyModule;
-class JSWebAssemblyTable;
</del><span class="cx"> class JITSizeStatistics;
</span><span class="cx"> class JITThunks;
</span><del>-class LLIntOffsetsExtractor;
</del><span class="cx"> class NativeExecutable;
</span><del>-class ObjCCallbackFunction;
</del><span class="cx"> class DeferredWorkTimer;
</span><span class="cx"> class RegExp;
</span><span class="cx"> class RegExpCache;
</span><span class="cx"> class Register;
</span><del>-class RegisterAtOffsetList;
</del><span class="cx"> #if ENABLE(SAMPLING_PROFILER)
</span><span class="cx"> class SamplingProfiler;
</span><span class="cx"> #endif
</span><span class="cx"> class ShadowChicken;
</span><span class="cx"> class SharedJITStubSet;
</span><del>-class ScriptExecutable;
</del><span class="cx"> class SourceProvider;
</span><span class="cx"> class SourceProviderCache;
</span><del>-class StackFrame;
</del><span class="cx"> class Structure;
</span><del>-#if ENABLE(REGEXP_TRACING)
-class RegExp;
-#endif
</del><span class="cx"> class Symbol;
</span><del>-class TemporalDuration;
-class TemporalInstant;
</del><span class="cx"> class TypedArrayController;
</span><del>-class UnlinkedCodeBlock;
-class UnlinkedEvalCodeBlock;
-class UnlinkedFunctionExecutable;
-class UnlinkedProgramCodeBlock;
-class UnlinkedModuleProgramCodeBlock;
-class VirtualRegister;
</del><span class="cx"> class VMEntryScope;
</span><del>-class TemporalCalendar;
-class TemporalPlainTime;
-class TemporalTimeZone;
-class TopLevelGlobalObjectScope;
</del><span class="cx"> class TypeProfiler;
</span><span class="cx"> class TypeProfilerLog;
</span><span class="cx"> class Watchdog;
</span><del>-class Watchpoint;
</del><span class="cx"> class WatchpointSet;
</span><del>-class WebAssemblyFunction;
-class WebAssemblyModuleRecord;
</del><span class="cx"> 
</span><span class="cx"> #if ENABLE(DFG_JIT) && ASSERT_ENABLED
</span><span class="cx"> #define ENABLE_DFG_DOES_GC_VALIDATION 1
</span><span class="lines">@@ -220,10 +148,6 @@
</span><span class="cx"> 
</span><span class="cx"> constexpr bool validateDFGDoesGC = ENABLE_DFG_DOES_GC_VALIDATION;
</span><span class="cx"> 
</span><del>-class IsoHeapCellType;
-template<typename CellType> class IsoInlinedHeapCellType;
-template<typename Parent> class JSCallbackObject;
-
</del><span class="cx"> #if ENABLE(FTL_JIT)
</span><span class="cx"> namespace FTL {
</span><span class="cx"> class Thunks;
</span><span class="lines">@@ -235,14 +159,9 @@
</span><span class="cx"> namespace DOMJIT {
</span><span class="cx"> class Signature;
</span><span class="cx"> }
</span><del>-namespace Yarr {
-class MatchingContextHolder;
-}
</del><span class="cx"> 
</span><span class="cx"> struct EntryFrame;
</span><del>-struct HashTable;
</del><span class="cx"> struct Instruction;
</span><del>-struct ValueProfile;
</del><span class="cx"> 
</span><span class="cx"> class QueuedTask {
</span><span class="cx">     WTF_MAKE_NONCOPYABLE(QueuedTask);
</span><span class="lines">@@ -261,8 +180,6 @@
</span><span class="cx">     Ref<Microtask> m_microtask;
</span><span class="cx"> };
</span><span class="cx"> 
</span><del>-class ConservativeRoots;
-
</del><span class="cx"> DECLARE_ALLOCATOR_WITH_HEAP_IDENTIFIER(VM);
</span><span class="cx"> 
</span><span class="cx"> #if COMPILER(MSVC)
</span><span class="lines">@@ -357,11 +274,7 @@
</span><span class="cx"> #endif
</span><span class="cx"> 
</span><span class="cx">     FuzzerAgent* fuzzerAgent() const { return m_fuzzerAgent.get(); }
</span><del>-    void setFuzzerAgent(std::unique_ptr<FuzzerAgent>&& fuzzerAgent)
-    {
-        RELEASE_ASSERT_WITH_MESSAGE(!m_fuzzerAgent, "Only one FuzzerAgent can be specified at a time.");
-        m_fuzzerAgent = WTFMove(fuzzerAgent);
-    }
</del><ins>+    void setFuzzerAgent(std::unique_ptr<FuzzerAgent>&&);
</ins><span class="cx"> 
</span><span class="cx">     static unsigned numberOfIDs() { return s_numberOfIDs.load(); }
</span><span class="cx">     unsigned id() const { return m_id; }
</span><span class="lines">@@ -413,146 +326,59 @@
</span><span class="cx"> 
</span><span class="cx"> public:
</span><span class="cx">     Heap heap;
</span><del>-    
-    std::unique_ptr<FastMallocAlignedMemoryAllocator> fastMallocAllocator;
-    std::unique_ptr<GigacageAlignedMemoryAllocator> primitiveGigacageAllocator;
-    std::unique_ptr<GigacageAlignedMemoryAllocator> jsValueGigacageAllocator;
</del><span class="cx"> 
</span><del>-    std::unique_ptr<HeapCellType> auxiliaryHeapCellType;
-    std::unique_ptr<HeapCellType> immutableButterflyHeapCellType;
-    std::unique_ptr<HeapCellType> cellHeapCellType;
-    std::unique_ptr<HeapCellType> destructibleCellHeapCellType;
-    std::unique_ptr<IsoHeapCellType> apiGlobalObjectHeapCellType;
-    std::unique_ptr<IsoHeapCellType> callbackConstructorHeapCellType;
-    std::unique_ptr<IsoHeapCellType> callbackGlobalObjectHeapCellType;
-    std::unique_ptr<IsoHeapCellType> callbackObjectHeapCellType;
-    std::unique_ptr<IsoHeapCellType> customGetterFunctionHeapCellType;
-    std::unique_ptr<IsoHeapCellType> customSetterFunctionHeapCellType;
-    std::unique_ptr<IsoHeapCellType> dateInstanceHeapCellType;
-    std::unique_ptr<IsoHeapCellType> errorInstanceHeapCellType;
-    std::unique_ptr<IsoHeapCellType> finalizationRegistryCellType;
-    std::unique_ptr<IsoHeapCellType> globalLexicalEnvironmentHeapCellType;
-    std::unique_ptr<IsoHeapCellType> globalObjectHeapCellType;
-    std::unique_ptr<IsoHeapCellType> injectedScriptHostSpaceHeapCellType;
-    std::unique_ptr<IsoHeapCellType> javaScriptCallFrameHeapCellType;
-    std::unique_ptr<IsoHeapCellType> jsModuleRecordHeapCellType;
-    std::unique_ptr<IsoHeapCellType> moduleNamespaceObjectHeapCellType;
-    std::unique_ptr<IsoHeapCellType> nativeStdFunctionHeapCellType;
-    std::unique_ptr<IsoInlinedHeapCellType<JSString>> stringHeapCellType;
-    std::unique_ptr<IsoHeapCellType> weakMapHeapCellType;
-    std::unique_ptr<IsoHeapCellType> weakSetHeapCellType;
-    std::unique_ptr<JSDestructibleObjectHeapCellType> destructibleObjectHeapCellType;
-#if JSC_OBJC_API_ENABLED
-    std::unique_ptr<IsoHeapCellType> apiWrapperObjectHeapCellType;
-    std::unique_ptr<IsoHeapCellType> objCCallbackFunctionHeapCellType;
-#endif
-#ifdef JSC_GLIB_API_ENABLED
-    std::unique_ptr<IsoHeapCellType> apiWrapperObjectHeapCellType;
-    std::unique_ptr<IsoHeapCellType> callbackAPIWrapperGlobalObjectHeapCellType;
-    std::unique_ptr<IsoHeapCellType> jscCallbackFunctionHeapCellType;
-#endif
-    std::unique_ptr<IsoHeapCellType> intlCollatorHeapCellType;
-    std::unique_ptr<IsoHeapCellType> intlDateTimeFormatHeapCellType;
-    std::unique_ptr<IsoHeapCellType> intlDisplayNamesHeapCellType;
-    std::unique_ptr<IsoHeapCellType> intlListFormatHeapCellType;
-    std::unique_ptr<IsoHeapCellType> intlLocaleHeapCellType;
-    std::unique_ptr<IsoHeapCellType> intlNumberFormatHeapCellType;
-    std::unique_ptr<IsoHeapCellType> intlPluralRulesHeapCellType;
-    std::unique_ptr<IsoHeapCellType> intlRelativeTimeFormatHeapCellType;
-    std::unique_ptr<IsoHeapCellType> intlSegmentIteratorHeapCellType;
-    std::unique_ptr<IsoHeapCellType> intlSegmenterHeapCellType;
-    std::unique_ptr<IsoHeapCellType> intlSegmentsHeapCellType;
-#if ENABLE(WEBASSEMBLY)
-    std::unique_ptr<IsoHeapCellType> webAssemblyCodeBlockHeapCellType;
-    std::unique_ptr<IsoHeapCellType> webAssemblyExceptionHeapCellType;
-    std::unique_ptr<IsoHeapCellType> webAssemblyFunctionHeapCellType;
-    std::unique_ptr<IsoHeapCellType> webAssemblyGlobalHeapCellType;
-    std::unique_ptr<IsoHeapCellType> webAssemblyInstanceHeapCellType;
-    std::unique_ptr<IsoHeapCellType> webAssemblyMemoryHeapCellType;
-    std::unique_ptr<IsoHeapCellType> webAssemblyModuleHeapCellType;
-    std::unique_ptr<IsoHeapCellType> webAssemblyModuleRecordHeapCellType;
-    std::unique_ptr<IsoHeapCellType> webAssemblyTableHeapCellType;
-    std::unique_ptr<IsoHeapCellType> webAssemblyTagHeapCellType;
-#endif
</del><ins>+    const HeapCellType& cellHeapCellType() { return heap.cellHeapCellType; }
+    const JSDestructibleObjectHeapCellType& destructibleObjectHeapCellType() { return heap.destructibleObjectHeapCellType; };
</ins><span class="cx"> 
</span><span class="cx"> #if ENABLE(JIT)
</span><span class="cx">     std::unique_ptr<JITSizeStatistics> jitSizeStatistics;
</span><span class="cx"> #endif
</span><span class="cx">     
</span><del>-    CompleteSubspace primitiveGigacageAuxiliarySpace; // Typed arrays, strings, bitvectors, etc go here.
-    CompleteSubspace jsValueGigacageAuxiliarySpace; // Butterflies, arrays of JSValues, etc go here.
-    CompleteSubspace immutableButterflyJSValueGigacageAuxiliarySpace; // JSImmutableButterfly goes here.
</del><ins>+    ALWAYS_INLINE CompleteSubspace& primitiveGigacageAuxiliarySpace() { return heap.primitiveGigacageAuxiliarySpace; }
+    ALWAYS_INLINE CompleteSubspace& jsValueGigacageAuxiliarySpace() { return heap.jsValueGigacageAuxiliarySpace; }
+    ALWAYS_INLINE CompleteSubspace& immutableButterflyJSValueGigacageAuxiliarySpace() { return heap.immutableButterflyJSValueGigacageAuxiliarySpace; }
+    ALWAYS_INLINE CompleteSubspace& gigacageAuxiliarySpace(Gigacage::Kind kind) { return heap.gigacageAuxiliarySpace(kind); }
+    ALWAYS_INLINE CompleteSubspace& cellSpace() { return heap.cellSpace; }
+    ALWAYS_INLINE CompleteSubspace& variableSizedCellSpace() { return heap.variableSizedCellSpace; }
+    ALWAYS_INLINE CompleteSubspace& destructibleObjectSpace() { return heap.destructibleObjectSpace; }
</ins><span class="cx"> 
</span><del>-    // We make cross-cutting assumptions about typed arrays being in the primitive Gigacage and butterflies
-    // being in the JSValue gigacage. For some types, it's super obvious where they should go, and so we
-    // can hardcode that fact. But sometimes it's not clear, so we abstract it by having a Gigacage::Kind
-    // constant somewhere.
-    // FIXME: Maybe it would be better if everyone abstracted this?
-    // https://bugs.webkit.org/show_bug.cgi?id=175248
-    ALWAYS_INLINE CompleteSubspace& gigacageAuxiliarySpace(Gigacage::Kind kind)
-    {
-        switch (kind) {
-        case Gigacage::Primitive:
-            return primitiveGigacageAuxiliarySpace;
-        case Gigacage::JSValue:
-            return jsValueGigacageAuxiliarySpace;
-        case Gigacage::NumberOfKinds:
-            break;
-        }
-        RELEASE_ASSERT_NOT_REACHED();
-        return primitiveGigacageAuxiliarySpace;
-    }
-    
-    // Whenever possible, use subspaceFor<CellType>(vm) to get one of these subspaces.
-    CompleteSubspace cellSpace;
-    CompleteSubspace variableSizedCellSpace; // FIXME: This space is problematic because we have things in here like DirectArguments and ScopedArguments; those should be split into JSValueOOB cells and JSValueStrict auxiliaries. https://bugs.webkit.org/show_bug.cgi?id=182858
-    CompleteSubspace destructibleObjectSpace;
-    
-    IsoSubspace arraySpace;
-    IsoSubspace bigIntSpace;
-    IsoSubspace calleeSpace;
-    IsoSubspace clonedArgumentsSpace;
-    IsoSubspace customGetterSetterSpace;
-    IsoSubspace dateInstanceSpace;
-    IsoSubspace domAttributeGetterSetterSpace;
-    IsoSubspace exceptionSpace;
-    IsoSubspace executableToCodeBlockEdgeSpace;
-    IsoSubspace functionSpace;
-    IsoSubspace getterSetterSpace;
-    IsoSubspace globalLexicalEnvironmentSpace;
-    IsoSubspace internalFunctionSpace;
-    IsoSubspace jsProxySpace;
-    IsoSubspace nativeExecutableSpace;
-    IsoSubspace numberObjectSpace;
-    IsoSubspace plainObjectSpace;
-    IsoSubspace promiseSpace;
-    IsoSubspace propertyNameEnumeratorSpace;
-    IsoSubspace propertyTableSpace;
-    IsoSubspace regExpSpace;
-    IsoSubspace regExpObjectSpace;
-    IsoSubspace ropeStringSpace;
-    IsoSubspace scopedArgumentsSpace;
-    IsoSubspace sparseArrayValueMapSpace;
-    IsoSubspace stringSpace;
-    IsoSubspace stringObjectSpace;
-    IsoSubspace structureChainSpace;
-    IsoSubspace structureRareDataSpace;
-    IsoSubspace structureSpace;
-    IsoSubspace brandedStructureSpace;
-    IsoSubspace symbolTableSpace;
</del><ins>+    ALWAYS_INLINE IsoSubspace& arraySpace() { return heap.arraySpace; }
+    ALWAYS_INLINE IsoSubspace& bigIntSpace() { return heap.bigIntSpace; }
+    ALWAYS_INLINE IsoSubspace& calleeSpace() { return heap.calleeSpace; }
+    ALWAYS_INLINE IsoSubspace& clonedArgumentsSpace() { return heap.clonedArgumentsSpace; }
+    ALWAYS_INLINE IsoSubspace& customGetterSetterSpace() { return heap.customGetterSetterSpace; }
+    ALWAYS_INLINE IsoSubspace& dateInstanceSpace() { return heap.dateInstanceSpace; }
+    ALWAYS_INLINE IsoSubspace& domAttributeGetterSetterSpace() { return heap.domAttributeGetterSetterSpace; }
+    ALWAYS_INLINE IsoSubspace& exceptionSpace() { return heap.exceptionSpace; }
+    ALWAYS_INLINE IsoSubspace& executableToCodeBlockEdgeSpace() { return heap.executableToCodeBlockEdgeSpace; }
+    ALWAYS_INLINE IsoSubspace& functionSpace() { return heap.functionSpace; }
+    ALWAYS_INLINE IsoSubspace& getterSetterSpace() { return heap.getterSetterSpace; }
+    ALWAYS_INLINE IsoSubspace& globalLexicalEnvironmentSpace() { return heap.globalLexicalEnvironmentSpace; }
+    ALWAYS_INLINE IsoSubspace& internalFunctionSpace() { return heap.internalFunctionSpace; }
+    ALWAYS_INLINE IsoSubspace& jsProxySpace() { return heap.jsProxySpace; }
+    ALWAYS_INLINE IsoSubspace& nativeExecutableSpace() { return heap.nativeExecutableSpace; }
+    ALWAYS_INLINE IsoSubspace& numberObjectSpace() { return heap.numberObjectSpace; }
+    ALWAYS_INLINE IsoSubspace& plainObjectSpace() { return heap.plainObjectSpace; }
+    ALWAYS_INLINE IsoSubspace& promiseSpace() { return heap.promiseSpace; }
+    ALWAYS_INLINE IsoSubspace& propertyNameEnumeratorSpace() { return heap.propertyNameEnumeratorSpace; }
+    ALWAYS_INLINE IsoSubspace& propertyTableSpace() { return heap.propertyTableSpace; }
+    ALWAYS_INLINE IsoSubspace& regExpSpace() { return heap.regExpSpace; }
+    ALWAYS_INLINE IsoSubspace& regExpObjectSpace() { return heap.regExpObjectSpace; }
+    ALWAYS_INLINE IsoSubspace& ropeStringSpace() { return heap.ropeStringSpace; }
+    ALWAYS_INLINE IsoSubspace& scopedArgumentsSpace() { return heap.scopedArgumentsSpace; }
+    ALWAYS_INLINE IsoSubspace& sparseArrayValueMapSpace() { return heap.sparseArrayValueMapSpace; }
+    ALWAYS_INLINE IsoSubspace& stringSpace() { return heap.stringSpace; }
+    ALWAYS_INLINE IsoSubspace& stringObjectSpace() { return heap.stringObjectSpace; }
+    ALWAYS_INLINE IsoSubspace& structureChainSpace() { return heap.structureChainSpace; }
+    ALWAYS_INLINE IsoSubspace& structureRareDataSpace() { return heap.structureRareDataSpace; }
+    ALWAYS_INLINE IsoSubspace& structureSpace() { return heap.structureSpace; }
+    ALWAYS_INLINE IsoSubspace& brandedStructureSpace() { return heap.brandedStructureSpace; }
+    ALWAYS_INLINE IsoSubspace& symbolTableSpace() { return heap.symbolTableSpace; }
</ins><span class="cx"> 
</span><span class="cx"> #define DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER(name) \
</span><span class="cx">     template<SubspaceAccess mode> \
</span><del>-    IsoSubspace* name() \
-    { \
-        if (m_##name || mode == SubspaceAccess::Concurrently) \
-            return m_##name.get(); \
-        return name##Slow(); \
-    } \
-    JS_EXPORT_PRIVATE IsoSubspace* name##Slow(); \
-    std::unique_ptr<IsoSubspace> m_##name;
</del><ins>+    ALWAYS_INLINE IsoSubspace* name() { return heap.name<mode>(); }
</ins><span class="cx"> 
</span><del>-
</del><span class="cx"> #if JSC_OBJC_API_ENABLED
</span><span class="cx">     DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER(apiWrapperObjectSpace)
</span><span class="cx">     DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER(objCCallbackFunctionSpace)
</span><span class="lines">@@ -657,75 +483,24 @@
</span><span class="cx"> #endif
</span><span class="cx"> 
</span><span class="cx"> #undef DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER
</span><del>-    
-    IsoCellSet executableToCodeBlockEdgesWithConstraints;
-    IsoCellSet executableToCodeBlockEdgesWithFinalizers;
</del><span class="cx"> 
</span><ins>+    ALWAYS_INLINE IsoCellSet& executableToCodeBlockEdgesWithConstraints() { return heap.executableToCodeBlockEdgesWithConstraints; }
+    ALWAYS_INLINE IsoCellSet& executableToCodeBlockEdgesWithFinalizers() { return heap.executableToCodeBlockEdgesWithFinalizers; }
+
</ins><span class="cx"> #define DYNAMIC_SPACE_AND_SET_DEFINE_MEMBER(name) \
</span><span class="cx">     template<SubspaceAccess mode> \
</span><del>-    IsoSubspace* name() \
-    { \
-        if (auto* spaceAndSet = m_##name.get()) \
-            return &spaceAndSet->space; \
-        if (mode == SubspaceAccess::Concurrently) \
-            return nullptr; \
-        return name##Slow(); \
-    } \
-    IsoSubspace* name##Slow(); \
-    std::unique_ptr<SpaceAndSet> m_##name;
-    
-    struct SpaceAndSet {
-        WTF_MAKE_STRUCT_FAST_ALLOCATED;
</del><ins>+    ALWAYS_INLINE IsoSubspace* name() { return heap.name<mode>(); }
</ins><span class="cx"> 
</span><del>-        IsoSubspace space;
-        IsoCellSet set;
-        
-        template<typename... Arguments>
-        SpaceAndSet(Arguments&&... arguments)
-            : space(std::forward<Arguments>(arguments)...)
-            , set(space)
-        {
-        }
-        
-        static IsoCellSet& setFor(Subspace& space)
-        {
-            return *bitwise_cast<IsoCellSet*>(
-                bitwise_cast<char*>(&space) -
-                OBJECT_OFFSETOF(SpaceAndSet, space) +
-                OBJECT_OFFSETOF(SpaceAndSet, set));
-        }
-    };
-    
-    SpaceAndSet codeBlockSpace;
</del><ins>+    using SpaceAndSet = Heap::SpaceAndSet;
+    ALWAYS_INLINE SpaceAndSet& codeBlockSpace() { return heap.codeBlockSpace; }
</ins><span class="cx"> 
</span><del>-    template<typename Func>
-    void forEachCodeBlockSpace(const Func& func)
-    {
-        // This should not include webAssemblyCodeBlockSpace because this is about subsclasses of
-        // JSC::CodeBlock.
-        func(codeBlockSpace);
-    }
-
</del><span class="cx">     DYNAMIC_SPACE_AND_SET_DEFINE_MEMBER(evalExecutableSpace)
</span><span class="cx">     DYNAMIC_SPACE_AND_SET_DEFINE_MEMBER(moduleProgramExecutableSpace)
</span><del>-    SpaceAndSet functionExecutableSpace;
-    SpaceAndSet programExecutableSpace;
</del><span class="cx"> 
</span><del>-    template<typename Func>
-    void forEachScriptExecutableSpace(const Func& func)
-    {
-        if (m_evalExecutableSpace)
-            func(*m_evalExecutableSpace);
-        func(functionExecutableSpace);
-        if (m_moduleProgramExecutableSpace)
-            func(*m_moduleProgramExecutableSpace);
-        func(programExecutableSpace);
-    }
</del><ins>+    ALWAYS_INLINE SpaceAndSet& functionExecutableSpace() { return heap.functionExecutableSpace; }
+    ALWAYS_INLINE SpaceAndSet& programExecutableSpace() { return heap.programExecutableSpace; }
+    ALWAYS_INLINE SpaceAndSet& unlinkedFunctionExecutableSpace() { return heap.unlinkedFunctionExecutableSpace; }
</ins><span class="cx"> 
</span><del>-    SpaceAndSet unlinkedFunctionExecutableSpace;
-
-#undef DYNAMIC_SPACE_AND_SET_DEFINE_MEMBER
-
</del><span class="cx">     VMType vmType;
</span><span class="cx">     ClientData* clientData;
</span><span class="cx">     EntryFrame* topEntryFrame { nullptr };
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeVMInlinesh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/VMInlines.h (286346 => 286347)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/VMInlines.h  2021-12-01 02:56:24 UTC (rev 286346)
+++ trunk/Source/JavaScriptCore/runtime/VMInlines.h     2021-12-01 04:38:56 UTC (rev 286347)
</span><span class="lines">@@ -26,6 +26,7 @@
</span><span class="cx"> #pragma once
</span><span class="cx"> 
</span><span class="cx"> #include "EntryFrame.h"
</span><ins>+#include "FuzzerAgent.h"
</ins><span class="cx"> #include "ProfilerDatabase.h"
</span><span class="cx"> #include "VM.h"
</span><span class="cx"> #include "Watchdog.h"
</span><span class="lines">@@ -90,4 +91,10 @@
</span><span class="cx">     return frame;
</span><span class="cx"> }
</span><span class="cx"> 
</span><ins>+inline void VM::setFuzzerAgent(std::unique_ptr<FuzzerAgent>&& fuzzerAgent)
+{
+    RELEASE_ASSERT_WITH_MESSAGE(!m_fuzzerAgent, "Only one FuzzerAgent can be specified at a time.");
+    m_fuzzerAgent = WTFMove(fuzzerAgent);
+}
+
</ins><span class="cx"> } // namespace JSC
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeWeakMapPrototypeh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/WeakMapPrototype.h (286346 => 286347)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/WeakMapPrototype.h   2021-12-01 02:56:24 UTC (rev 286346)
+++ trunk/Source/JavaScriptCore/runtime/WeakMapPrototype.h      2021-12-01 04:38:56 UTC (rev 286347)
</span><span class="lines">@@ -41,7 +41,7 @@
</span><span class="cx">     static IsoSubspace* subspaceFor(VM& vm)
</span><span class="cx">     {
</span><span class="cx">         STATIC_ASSERT_ISO_SUBSPACE_SHARABLE(WeakMapPrototype, Base);
</span><del>-        return &vm.plainObjectSpace;
</del><ins>+        return &vm.plainObjectSpace();
</ins><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     static WeakMapPrototype* create(VM& vm, JSGlobalObject* globalObject, Structure* structure)
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeWeakObjectRefPrototypeh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/WeakObjectRefPrototype.h (286346 => 286347)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/WeakObjectRefPrototype.h     2021-12-01 02:56:24 UTC (rev 286346)
+++ trunk/Source/JavaScriptCore/runtime/WeakObjectRefPrototype.h        2021-12-01 04:38:56 UTC (rev 286347)
</span><span class="lines">@@ -37,7 +37,7 @@
</span><span class="cx">     static IsoSubspace* subspaceFor(VM& vm)
</span><span class="cx">     {
</span><span class="cx">         STATIC_ASSERT_ISO_SUBSPACE_SHARABLE(WeakObjectRefPrototype, Base);
</span><del>-        return &vm.plainObjectSpace;
</del><ins>+        return &vm.plainObjectSpace();
</ins><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     static WeakObjectRefPrototype* create(VM& vm, JSGlobalObject* globalObject, Structure* structure)
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeWeakSetPrototypeh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/WeakSetPrototype.h (286346 => 286347)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/WeakSetPrototype.h   2021-12-01 02:56:24 UTC (rev 286346)
+++ trunk/Source/JavaScriptCore/runtime/WeakSetPrototype.h      2021-12-01 04:38:56 UTC (rev 286347)
</span><span class="lines">@@ -41,7 +41,7 @@
</span><span class="cx">     static IsoSubspace* subspaceFor(VM& vm)
</span><span class="cx">     {
</span><span class="cx">         STATIC_ASSERT_ISO_SUBSPACE_SHARABLE(WeakSetPrototype, Base);
</span><del>-        return &vm.plainObjectSpace;
</del><ins>+        return &vm.plainObjectSpace();
</ins><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     static WeakSetPrototype* create(VM& vm, JSGlobalObject* globalObject, Structure* structure)
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoretoolsJSDollarVMcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/tools/JSDollarVM.cpp (286346 => 286347)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/tools/JSDollarVM.cpp 2021-12-01 02:56:24 UTC (rev 286346)
+++ trunk/Source/JavaScriptCore/tools/JSDollarVM.cpp    2021-12-01 04:38:56 UTC (rev 286347)
</span><span class="lines">@@ -133,7 +133,7 @@
</span><span class="cx">     template<typename CellType, SubspaceAccess>
</span><span class="cx">     static CompleteSubspace* subspaceFor(VM& vm)
</span><span class="cx">     {
</span><del>-        return &vm.cellSpace;
</del><ins>+        return &vm.cellSpace();
</ins><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     JSDollarVMCallFrame(VM& vm, Structure* structure)
</span><span class="lines">@@ -223,7 +223,7 @@
</span><span class="cx">     template<typename CellType, SubspaceAccess>
</span><span class="cx">     static CompleteSubspace* subspaceFor(VM& vm)
</span><span class="cx">     {
</span><del>-        return &vm.cellSpace;
</del><ins>+        return &vm.cellSpace();
</ins><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     Root* root() const { return m_root.get(); }
</span><span class="lines">@@ -287,7 +287,7 @@
</span><span class="cx">     template<typename CellType, SubspaceAccess>
</span><span class="cx">     static CompleteSubspace* subspaceFor(VM& vm)
</span><span class="cx">     {
</span><del>-        return &vm.destructibleObjectSpace;
</del><ins>+        return &vm.destructibleObjectSpace();
</ins><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     Root(VM& vm, Structure* structure)
</span><span class="lines">@@ -354,7 +354,7 @@
</span><span class="cx">     template<typename CellType, SubspaceAccess>
</span><span class="cx">     static CompleteSubspace* subspaceFor(VM& vm)
</span><span class="cx">     {
</span><del>-        return &vm.cellSpace;
</del><ins>+        return &vm.cellSpace();
</ins><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     static SimpleObject* create(VM& vm, JSGlobalObject* globalObject)
</span><span class="lines">@@ -426,7 +426,7 @@
</span><span class="cx">     template<typename CellType, SubspaceAccess>
</span><span class="cx">     static CompleteSubspace* subspaceFor(VM& vm)
</span><span class="cx">     {
</span><del>-        return &vm.cellSpace;
</del><ins>+        return &vm.cellSpace();
</ins><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     static Structure* createStructure(VM& vm, JSGlobalObject* globalObject, JSValue prototype)
</span><span class="lines">@@ -508,7 +508,7 @@
</span><span class="cx">     template<typename CellType, SubspaceAccess>
</span><span class="cx">     static CompleteSubspace* subspaceFor(VM& vm)
</span><span class="cx">     {
</span><del>-        return &vm.cellSpace;
</del><ins>+        return &vm.cellSpace();
</ins><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     static Structure* createStructure(VM& vm, JSGlobalObject* globalObject, JSValue prototype)
</span><span class="lines">@@ -590,7 +590,7 @@
</span><span class="cx">     template<typename CellType, SubspaceAccess>
</span><span class="cx">     static CompleteSubspace* subspaceFor(VM& vm)
</span><span class="cx">     {
</span><del>-        return &vm.cellSpace;
</del><ins>+        return &vm.cellSpace();
</ins><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     static RuntimeArray* create(JSGlobalObject* globalObject, CallFrame* callFrame)
</span><span class="lines">@@ -772,7 +772,7 @@
</span><span class="cx">     template<typename CellType, SubspaceAccess>
</span><span class="cx">     static CompleteSubspace* subspaceFor(VM& vm)
</span><span class="cx">     {
</span><del>-        return &vm.cellSpace;
</del><ins>+        return &vm.cellSpace();
</ins><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     static Structure* createStructure(VM& vm, JSGlobalObject* globalObject, JSValue prototype)
</span><span class="lines">@@ -872,7 +872,7 @@
</span><span class="cx">     template<typename CellType, SubspaceAccess>
</span><span class="cx">     static CompleteSubspace* subspaceFor(VM& vm)
</span><span class="cx">     {
</span><del>-        return &vm.cellSpace;
</del><ins>+        return &vm.cellSpace();
</ins><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     static Structure* createStructure(VM& vm, JSGlobalObject* globalObject, JSValue prototype)
</span><span class="lines">@@ -897,7 +897,7 @@
</span><span class="cx">     template<typename CellType, SubspaceAccess>
</span><span class="cx">     static CompleteSubspace* subspaceFor(VM& vm)
</span><span class="cx">     {
</span><del>-        return &vm.cellSpace;
</del><ins>+        return &vm.cellSpace();
</ins><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     ObjectDoingSideEffectPutWithoutCorrectSlotStatus(VM& vm, Structure* structure)
</span><span class="lines">@@ -948,7 +948,7 @@
</span><span class="cx">     template<typename CellType, SubspaceAccess>
</span><span class="cx">     static CompleteSubspace* subspaceFor(VM& vm)
</span><span class="cx">     {
</span><del>-        return &vm.cellSpace;
</del><ins>+        return &vm.cellSpace();
</ins><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     static Structure* createStructure(VM& vm, JSGlobalObject* globalObject, JSValue prototype)
</span><span class="lines">@@ -1585,7 +1585,7 @@
</span><span class="cx">     template<typename CellType, SubspaceAccess>
</span><span class="cx">     static CompleteSubspace* subspaceFor(VM& vm)
</span><span class="cx">     {
</span><del>-        return &vm.cellSpace;
</del><ins>+        return &vm.cellSpace();
</ins><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     JSTestCustomGetterSetter(VM& vm, Structure* structure)
</span><span class="lines">@@ -1838,7 +1838,7 @@
</span><span class="cx">     template<typename CellType, SubspaceAccess>
</span><span class="cx">     static CompleteSubspace* subspaceFor(VM& vm)
</span><span class="cx">     {
</span><del>-        return &vm.destructibleObjectSpace;
</del><ins>+        return &vm.destructibleObjectSpace();
</ins><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     class Client final : public Wasm::StreamingParserClient {
</span><span class="lines">@@ -1933,7 +1933,7 @@
</span><span class="cx">     template<typename CellType, SubspaceAccess>
</span><span class="cx">     static CompleteSubspace* subspaceFor(VM& vm)
</span><span class="cx">     {
</span><del>-        return &vm.destructibleObjectSpace;
</del><ins>+        return &vm.destructibleObjectSpace();
</ins><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     WasmStreamingCompiler(VM& vm, Structure* structure, Wasm::CompilerMode compilerMode, JSGlobalObject* globalObject, JSPromise* promise, JSObject* importObject)
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoretoolsJSDollarVMh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/tools/JSDollarVM.h (286346 => 286347)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/tools/JSDollarVM.h   2021-12-01 02:56:24 UTC (rev 286346)
+++ trunk/Source/JavaScriptCore/tools/JSDollarVM.h      2021-12-01 04:38:56 UTC (rev 286347)
</span><span class="lines">@@ -42,7 +42,7 @@
</span><span class="cx">     template<typename CellType, SubspaceAccess>
</span><span class="cx">     static CompleteSubspace* subspaceFor(VM& vm)
</span><span class="cx">     {
</span><del>-        return &vm.cellSpace;
</del><ins>+        return &vm.cellSpace();
</ins><span class="cx">     }
</span><span class="cx">     
</span><span class="cx">     DECLARE_EXPORT_INFO;
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorewasmjsJSWebAssemblyh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/wasm/js/JSWebAssembly.h (286346 => 286347)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/wasm/js/JSWebAssembly.h      2021-12-01 02:56:24 UTC (rev 286346)
+++ trunk/Source/JavaScriptCore/wasm/js/JSWebAssembly.h 2021-12-01 04:38:56 UTC (rev 286347)
</span><span class="lines">@@ -1,5 +1,5 @@
</span><span class="cx"> /*
</span><del>- * Copyright (C) 2016-2019 Apple Inc. All rights reserved.
</del><ins>+ * Copyright (C) 2016-2021 Apple Inc. All rights reserved.
</ins><span class="cx">  *
</span><span class="cx">  * Redistribution and use in source and binary forms, with or without
</span><span class="cx">  * modification, are permitted provided that the following conditions
</span><span class="lines">@@ -41,7 +41,7 @@
</span><span class="cx">     static IsoSubspace* subspaceFor(VM& vm)
</span><span class="cx">     {
</span><span class="cx">         STATIC_ASSERT_ISO_SUBSPACE_SHARABLE(JSWebAssembly, Base);
</span><del>-        return &vm.plainObjectSpace;
</del><ins>+        return &vm.plainObjectSpace();
</ins><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     static JSWebAssembly* create(VM&, JSGlobalObject*, Structure*);
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorewasmjsWebAssemblyCompileErrorPrototypeh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/wasm/js/WebAssemblyCompileErrorPrototype.h (286346 => 286347)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/wasm/js/WebAssemblyCompileErrorPrototype.h   2021-12-01 02:56:24 UTC (rev 286346)
+++ trunk/Source/JavaScriptCore/wasm/js/WebAssemblyCompileErrorPrototype.h      2021-12-01 04:38:56 UTC (rev 286347)
</span><span class="lines">@@ -1,5 +1,5 @@
</span><span class="cx"> /*
</span><del>- * Copyright (C) 2016-2019 Apple Inc. All rights reserved.
</del><ins>+ * Copyright (C) 2016-2021 Apple Inc. All rights reserved.
</ins><span class="cx">  *
</span><span class="cx">  * Redistribution and use in source and binary forms, with or without
</span><span class="cx">  * modification, are permitted provided that the following conditions
</span><span class="lines">@@ -41,7 +41,7 @@
</span><span class="cx">     static IsoSubspace* subspaceFor(VM& vm)
</span><span class="cx">     {
</span><span class="cx">         STATIC_ASSERT_ISO_SUBSPACE_SHARABLE(WebAssemblyCompileErrorPrototype, Base);
</span><del>-        return &vm.plainObjectSpace;
</del><ins>+        return &vm.plainObjectSpace();
</ins><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     static WebAssemblyCompileErrorPrototype* create(VM&, JSGlobalObject*, Structure*);
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorewasmjsWebAssemblyExceptionPrototypeh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/wasm/js/WebAssemblyExceptionPrototype.h (286346 => 286347)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/wasm/js/WebAssemblyExceptionPrototype.h      2021-12-01 02:56:24 UTC (rev 286346)
+++ trunk/Source/JavaScriptCore/wasm/js/WebAssemblyExceptionPrototype.h 2021-12-01 04:38:56 UTC (rev 286347)
</span><span class="lines">@@ -41,7 +41,7 @@
</span><span class="cx">     static IsoSubspace* subspaceFor(VM& vm)
</span><span class="cx">     {
</span><span class="cx">         STATIC_ASSERT_ISO_SUBSPACE_SHARABLE(WebAssemblyExceptionPrototype, Base);
</span><del>-        return &vm.plainObjectSpace;
</del><ins>+        return &vm.plainObjectSpace();
</ins><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     static WebAssemblyExceptionPrototype* create(VM&, JSGlobalObject*, Structure*);
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorewasmjsWebAssemblyGlobalPrototypeh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/wasm/js/WebAssemblyGlobalPrototype.h (286346 => 286347)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/wasm/js/WebAssemblyGlobalPrototype.h 2021-12-01 02:56:24 UTC (rev 286346)
+++ trunk/Source/JavaScriptCore/wasm/js/WebAssemblyGlobalPrototype.h    2021-12-01 04:38:56 UTC (rev 286347)
</span><span class="lines">@@ -1,5 +1,5 @@
</span><span class="cx"> /*
</span><del>- * Copyright (C) 2019 Apple Inc. All rights reserved.
</del><ins>+ * Copyright (C) 2019-2021 Apple Inc. All rights reserved.
</ins><span class="cx">  *
</span><span class="cx">  * Redistribution and use in source and binary forms, with or without
</span><span class="cx">  * modification, are permitted provided that the following conditions
</span><span class="lines">@@ -40,7 +40,7 @@
</span><span class="cx">     static IsoSubspace* subspaceFor(VM& vm)
</span><span class="cx">     {
</span><span class="cx">         STATIC_ASSERT_ISO_SUBSPACE_SHARABLE(WebAssemblyGlobalPrototype, Base);
</span><del>-        return &vm.plainObjectSpace;
</del><ins>+        return &vm.plainObjectSpace();
</ins><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     static WebAssemblyGlobalPrototype* create(VM&, JSGlobalObject*, Structure*);
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorewasmjsWebAssemblyInstancePrototypeh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/wasm/js/WebAssemblyInstancePrototype.h (286346 => 286347)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/wasm/js/WebAssemblyInstancePrototype.h       2021-12-01 02:56:24 UTC (rev 286346)
+++ trunk/Source/JavaScriptCore/wasm/js/WebAssemblyInstancePrototype.h  2021-12-01 04:38:56 UTC (rev 286347)
</span><span class="lines">@@ -1,5 +1,5 @@
</span><span class="cx"> /*
</span><del>- * Copyright (C) 2016-2019 Apple Inc. All rights reserved.
</del><ins>+ * Copyright (C) 2016-2021 Apple Inc. All rights reserved.
</ins><span class="cx">  *
</span><span class="cx">  * Redistribution and use in source and binary forms, with or without
</span><span class="cx">  * modification, are permitted provided that the following conditions
</span><span class="lines">@@ -41,7 +41,7 @@
</span><span class="cx">     static IsoSubspace* subspaceFor(VM& vm)
</span><span class="cx">     {
</span><span class="cx">         STATIC_ASSERT_ISO_SUBSPACE_SHARABLE(WebAssemblyInstancePrototype, Base);
</span><del>-        return &vm.plainObjectSpace;
</del><ins>+        return &vm.plainObjectSpace();
</ins><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     static WebAssemblyInstancePrototype* create(VM&, JSGlobalObject*, Structure*);
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorewasmjsWebAssemblyLinkErrorPrototypeh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/wasm/js/WebAssemblyLinkErrorPrototype.h (286346 => 286347)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/wasm/js/WebAssemblyLinkErrorPrototype.h      2021-12-01 02:56:24 UTC (rev 286346)
+++ trunk/Source/JavaScriptCore/wasm/js/WebAssemblyLinkErrorPrototype.h 2021-12-01 04:38:56 UTC (rev 286347)
</span><span class="lines">@@ -1,5 +1,5 @@
</span><span class="cx"> /*
</span><del>- * Copyright (C) 2016-2019 Apple Inc. All rights reserved.
</del><ins>+ * Copyright (C) 2016-2021 Apple Inc. All rights reserved.
</ins><span class="cx">  *
</span><span class="cx">  * Redistribution and use in source and binary forms, with or without
</span><span class="cx">  * modification, are permitted provided that the following conditions
</span><span class="lines">@@ -41,7 +41,7 @@
</span><span class="cx">     static IsoSubspace* subspaceFor(VM& vm)
</span><span class="cx">     {
</span><span class="cx">         STATIC_ASSERT_ISO_SUBSPACE_SHARABLE(WebAssemblyLinkErrorPrototype, Base);
</span><del>-        return &vm.plainObjectSpace;
</del><ins>+        return &vm.plainObjectSpace();
</ins><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     static WebAssemblyLinkErrorPrototype* create(VM&, JSGlobalObject*, Structure*);
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorewasmjsWebAssemblyMemoryPrototypeh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/wasm/js/WebAssemblyMemoryPrototype.h (286346 => 286347)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/wasm/js/WebAssemblyMemoryPrototype.h 2021-12-01 02:56:24 UTC (rev 286346)
+++ trunk/Source/JavaScriptCore/wasm/js/WebAssemblyMemoryPrototype.h    2021-12-01 04:38:56 UTC (rev 286347)
</span><span class="lines">@@ -1,5 +1,5 @@
</span><span class="cx"> /*
</span><del>- * Copyright (C) 2016-2019 Apple Inc. All rights reserved.
</del><ins>+ * Copyright (C) 2016-2021 Apple Inc. All rights reserved.
</ins><span class="cx">  *
</span><span class="cx">  * Redistribution and use in source and binary forms, with or without
</span><span class="cx">  * modification, are permitted provided that the following conditions
</span><span class="lines">@@ -41,7 +41,7 @@
</span><span class="cx">     static IsoSubspace* subspaceFor(VM& vm)
</span><span class="cx">     {
</span><span class="cx">         STATIC_ASSERT_ISO_SUBSPACE_SHARABLE(WebAssemblyMemoryPrototype, Base);
</span><del>-        return &vm.plainObjectSpace;
</del><ins>+        return &vm.plainObjectSpace();
</ins><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     static WebAssemblyMemoryPrototype* create(VM&, JSGlobalObject*, Structure*);
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorewasmjsWebAssemblyModulePrototypeh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/wasm/js/WebAssemblyModulePrototype.h (286346 => 286347)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/wasm/js/WebAssemblyModulePrototype.h 2021-12-01 02:56:24 UTC (rev 286346)
+++ trunk/Source/JavaScriptCore/wasm/js/WebAssemblyModulePrototype.h    2021-12-01 04:38:56 UTC (rev 286347)
</span><span class="lines">@@ -1,5 +1,5 @@
</span><span class="cx"> /*
</span><del>- * Copyright (C) 2016-2019 Apple Inc. All rights reserved.
</del><ins>+ * Copyright (C) 2016-2021 Apple Inc. All rights reserved.
</ins><span class="cx">  *
</span><span class="cx">  * Redistribution and use in source and binary forms, with or without
</span><span class="cx">  * modification, are permitted provided that the following conditions
</span><span class="lines">@@ -41,7 +41,7 @@
</span><span class="cx">     static IsoSubspace* subspaceFor(VM& vm)
</span><span class="cx">     {
</span><span class="cx">         STATIC_ASSERT_ISO_SUBSPACE_SHARABLE(WebAssemblyModulePrototype, Base);
</span><del>-        return &vm.plainObjectSpace;
</del><ins>+        return &vm.plainObjectSpace();
</ins><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     static WebAssemblyModulePrototype* create(VM&, JSGlobalObject*, Structure*);
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorewasmjsWebAssemblyRuntimeErrorPrototypeh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/wasm/js/WebAssemblyRuntimeErrorPrototype.h (286346 => 286347)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/wasm/js/WebAssemblyRuntimeErrorPrototype.h   2021-12-01 02:56:24 UTC (rev 286346)
+++ trunk/Source/JavaScriptCore/wasm/js/WebAssemblyRuntimeErrorPrototype.h      2021-12-01 04:38:56 UTC (rev 286347)
</span><span class="lines">@@ -1,5 +1,5 @@
</span><span class="cx"> /*
</span><del>- * Copyright (C) 2016-2019 Apple Inc. All rights reserved.
</del><ins>+ * Copyright (C) 2016-2021 Apple Inc. All rights reserved.
</ins><span class="cx">  *
</span><span class="cx">  * Redistribution and use in source and binary forms, with or without
</span><span class="cx">  * modification, are permitted provided that the following conditions
</span><span class="lines">@@ -41,7 +41,7 @@
</span><span class="cx">     static IsoSubspace* subspaceFor(VM& vm)
</span><span class="cx">     {
</span><span class="cx">         STATIC_ASSERT_ISO_SUBSPACE_SHARABLE(WebAssemblyRuntimeErrorPrototype, Base);
</span><del>-        return &vm.plainObjectSpace;
</del><ins>+        return &vm.plainObjectSpace();
</ins><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     static WebAssemblyRuntimeErrorPrototype* create(VM&, JSGlobalObject*, Structure*);
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorewasmjsWebAssemblyTablePrototypeh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/wasm/js/WebAssemblyTablePrototype.h (286346 => 286347)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/wasm/js/WebAssemblyTablePrototype.h  2021-12-01 02:56:24 UTC (rev 286346)
+++ trunk/Source/JavaScriptCore/wasm/js/WebAssemblyTablePrototype.h     2021-12-01 04:38:56 UTC (rev 286347)
</span><span class="lines">@@ -1,5 +1,5 @@
</span><span class="cx"> /*
</span><del>- * Copyright (C) 2016-2019 Apple Inc. All rights reserved.
</del><ins>+ * Copyright (C) 2016-2021 Apple Inc. All rights reserved.
</ins><span class="cx">  *
</span><span class="cx">  * Redistribution and use in source and binary forms, with or without
</span><span class="cx">  * modification, are permitted provided that the following conditions
</span><span class="lines">@@ -41,7 +41,7 @@
</span><span class="cx">     static IsoSubspace* subspaceFor(VM& vm)
</span><span class="cx">     {
</span><span class="cx">         STATIC_ASSERT_ISO_SUBSPACE_SHARABLE(WebAssemblyTablePrototype, Base);
</span><del>-        return &vm.plainObjectSpace;
</del><ins>+        return &vm.plainObjectSpace();
</ins><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     static WebAssemblyTablePrototype* create(VM&, JSGlobalObject*, Structure*);
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorewasmjsWebAssemblyTagPrototypeh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/wasm/js/WebAssemblyTagPrototype.h (286346 => 286347)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/wasm/js/WebAssemblyTagPrototype.h    2021-12-01 02:56:24 UTC (rev 286346)
+++ trunk/Source/JavaScriptCore/wasm/js/WebAssemblyTagPrototype.h       2021-12-01 04:38:56 UTC (rev 286347)
</span><span class="lines">@@ -40,7 +40,7 @@
</span><span class="cx">     static IsoSubspace* subspaceFor(VM& vm)
</span><span class="cx">     {
</span><span class="cx">         STATIC_ASSERT_ISO_SUBSPACE_SHARABLE(WebAssemblyTagPrototype, Base);
</span><del>-        return &vm.plainObjectSpace;
</del><ins>+        return &vm.plainObjectSpace();
</ins><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     static WebAssemblyTagPrototype* create(VM&, JSGlobalObject*, Structure*);
</span></span></pre></div>
<a id="trunkSourceWebCoreChangeLog"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/ChangeLog (286346 => 286347)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/ChangeLog   2021-12-01 02:56:24 UTC (rev 286346)
+++ trunk/Source/WebCore/ChangeLog      2021-12-01 04:38:56 UTC (rev 286347)
</span><span class="lines">@@ -1,3 +1,281 @@
</span><ins>+2021-11-30  Mark Lam  <mark.lam@apple.com>
+
+        Move Subspaces from VM to Heap.
+        https://bugs.webkit.org/show_bug.cgi?id=233648
+        rdar://85875751
+
+        Reviewed by Saam Barati.
+
+        1. Embed IsoHeapCellType instances in JSVMClientData directly instead of
+           malloc'ing them separately and referencing them via unique_ptrs.  These
+           instances are always instantiated unconditionally anyway.  This change
+           eliminates the unneeded busy work to allocate them separately.
+
+        2. Add missing initialization of JSVMClientData::m_heapCellTypeForJSSharedWorkerGlobalScope.
+           This hasn't been an issue so far because we don't currently allow shared workers.
+
+        3. Rebase bindings test results.
+
+        * bindings/js/JSDOMAsyncIterator.h:
+        * bindings/js/JSDOMIterator.h:
+        * bindings/js/JSFileSystemDirectoryHandleIterator.cpp:
+        (WebCore::JSFileSystemDirectoryHandleIterator::subspaceForImpl):
+        * bindings/js/WebCoreJSClientData.cpp:
+        (WebCore::JSVMClientData::JSVMClientData):
+        * bindings/js/WebCoreJSClientData.h:
+        * bindings/scripts/CodeGeneratorJS.pm:
+        (GenerateImplementation):
+        (GenerateIterableDefinition):
+        (GeneratePrototypeDeclaration):
+        * bindings/scripts/test/JS/JSDOMWindow.cpp:
+        (WebCore::JSDOMWindow::subspaceForImpl):
+        * bindings/scripts/test/JS/JSDOMWindow.h:
+        * bindings/scripts/test/JS/JSDedicatedWorkerGlobalScope.cpp:
+        (WebCore::JSDedicatedWorkerGlobalScope::subspaceForImpl):
+        * bindings/scripts/test/JS/JSDedicatedWorkerGlobalScope.h:
+        * bindings/scripts/test/JS/JSExposedStar.cpp:
+        (WebCore::JSExposedStarDOMConstructor::prototypeForStructure):
+        (WebCore::JSExposedStar::subspaceForImpl):
+        * bindings/scripts/test/JS/JSExposedToWorkerAndWindow.cpp:
+        (WebCore::JSExposedToWorkerAndWindow::subspaceForImpl):
+        * bindings/scripts/test/JS/JSPaintWorkletGlobalScope.cpp:
+        (WebCore::JSPaintWorkletGlobalScope::subspaceForImpl):
+        * bindings/scripts/test/JS/JSPaintWorkletGlobalScope.h:
+        * bindings/scripts/test/JS/JSServiceWorkerGlobalScope.cpp:
+        (WebCore::JSServiceWorkerGlobalScope::subspaceForImpl):
+        * bindings/scripts/test/JS/JSServiceWorkerGlobalScope.h:
+        * bindings/scripts/test/JS/JSSharedWorkerGlobalScope.cpp:
+        (WebCore::JSSharedWorkerGlobalScope::subspaceForImpl):
+        * bindings/scripts/test/JS/JSSharedWorkerGlobalScope.h:
+        * bindings/scripts/test/JS/JSTestCEReactions.cpp:
+        (WebCore::JSTestCEReactionsDOMConstructor::prototypeForStructure):
+        (WebCore::JSTestCEReactions::subspaceForImpl):
+        * bindings/scripts/test/JS/JSTestCEReactionsStringifier.cpp:
+        (WebCore::JSTestCEReactionsStringifierDOMConstructor::prototypeForStructure):
+        (WebCore::JSTestCEReactionsStringifier::subspaceForImpl):
+        * bindings/scripts/test/JS/JSTestCallTracer.cpp:
+        (WebCore::JSTestCallTracerDOMConstructor::prototypeForStructure):
+        (WebCore::JSTestCallTracer::subspaceForImpl):
+        * bindings/scripts/test/JS/JSTestClassWithJSBuiltinConstructor.cpp:
+        (WebCore::JSTestClassWithJSBuiltinConstructorDOMConstructor::prototypeForStructure):
+        (WebCore::JSTestClassWithJSBuiltinConstructor::subspaceForImpl):
+        * bindings/scripts/test/JS/JSTestConditionalIncludes.cpp:
+        (WebCore::JSTestConditionalIncludesDOMConstructor::prototypeForStructure):
+        (WebCore::JSTestConditionalIncludes::subspaceForImpl):
+        * bindings/scripts/test/JS/JSTestConditionallyReadWrite.cpp:
+        (WebCore::JSTestConditionallyReadWriteDOMConstructor::prototypeForStructure):
+        (WebCore::JSTestConditionallyReadWrite::subspaceForImpl):
+        * bindings/scripts/test/JS/JSTestDOMJIT.cpp:
+        (WebCore::JSTestDOMJITDOMConstructor::prototypeForStructure):
+        (WebCore::JSTestDOMJIT::subspaceForImpl):
+        * bindings/scripts/test/JS/JSTestDefaultToJSON.cpp:
+        (WebCore::JSTestDefaultToJSONDOMConstructor::prototypeForStructure):
+        (WebCore::JSTestDefaultToJSON::subspaceForImpl):
+        * bindings/scripts/test/JS/JSTestDefaultToJSONFilteredByExposed.cpp:
+        (WebCore::JSTestDefaultToJSONFilteredByExposedDOMConstructor::prototypeForStructure):
+        (WebCore::JSTestDefaultToJSONFilteredByExposed::subspaceForImpl):
+        * bindings/scripts/test/JS/JSTestDefaultToJSONIndirectInheritance.cpp:
+        (WebCore::JSTestDefaultToJSONIndirectInheritanceDOMConstructor::prototypeForStructure):
+        (WebCore::JSTestDefaultToJSONIndirectInheritance::subspaceForImpl):
+        * bindings/scripts/test/JS/JSTestDefaultToJSONInherit.cpp:
+        (WebCore::JSTestDefaultToJSONInheritDOMConstructor::prototypeForStructure):
+        (WebCore::JSTestDefaultToJSONInherit::subspaceForImpl):
+        * bindings/scripts/test/JS/JSTestDefaultToJSONInheritFinal.cpp:
+        (WebCore::JSTestDefaultToJSONInheritFinalDOMConstructor::prototypeForStructure):
+        (WebCore::JSTestDefaultToJSONInheritFinal::subspaceForImpl):
+        * bindings/scripts/test/JS/JSTestDelegateToSharedSyntheticAttribute.cpp:
+        (WebCore::JSTestDelegateToSharedSyntheticAttributeDOMConstructor::prototypeForStructure):
+        (WebCore::JSTestDelegateToSharedSyntheticAttribute::subspaceForImpl):
+        * bindings/scripts/test/JS/JSTestDomainSecurity.cpp:
+        (WebCore::JSTestDomainSecurityDOMConstructor::prototypeForStructure):
+        (WebCore::JSTestDomainSecurity::subspaceForImpl):
+        * bindings/scripts/test/JS/JSTestEnabledBySetting.cpp:
+        (WebCore::JSTestEnabledBySettingDOMConstructor::prototypeForStructure):
+        (WebCore::JSTestEnabledBySetting::subspaceForImpl):
+        * bindings/scripts/test/JS/JSTestEnabledForContext.cpp:
+        (WebCore::JSTestEnabledForContextDOMConstructor::prototypeForStructure):
+        (WebCore::JSTestEnabledForContext::subspaceForImpl):
+        * bindings/scripts/test/JS/JSTestEventConstructor.cpp:
+        (WebCore::JSTestEventConstructor::subspaceForImpl):
+        * bindings/scripts/test/JS/JSTestEventTarget.cpp:
+        (WebCore::JSTestEventTargetDOMConstructor::prototypeForStructure):
+        (WebCore::JSTestEventTarget::subspaceForImpl):
+        * bindings/scripts/test/JS/JSTestException.cpp:
+        (WebCore::JSTestExceptionDOMConstructor::prototypeForStructure):
+        (WebCore::JSTestException::subspaceForImpl):
+        * bindings/scripts/test/JS/JSTestGenerateAddOpaqueRoot.cpp:
+        (WebCore::JSTestGenerateAddOpaqueRootDOMConstructor::prototypeForStructure):
+        (WebCore::JSTestGenerateAddOpaqueRoot::subspaceForImpl):
+        * bindings/scripts/test/JS/JSTestGenerateIsReachable.cpp:
+        (WebCore::JSTestGenerateIsReachableDOMConstructor::prototypeForStructure):
+        (WebCore::JSTestGenerateIsReachable::subspaceForImpl):
+        * bindings/scripts/test/JS/JSTestGlobalObject.cpp:
+        (WebCore::JSTestGlobalObject::subspaceForImpl):
+        * bindings/scripts/test/JS/JSTestGlobalObject.h:
+        * bindings/scripts/test/JS/JSTestIndexedSetterNoIdentifier.cpp:
+        (WebCore::JSTestIndexedSetterNoIdentifierDOMConstructor::prototypeForStructure):
+        (WebCore::JSTestIndexedSetterNoIdentifier::subspaceForImpl):
+        * bindings/scripts/test/JS/JSTestIndexedSetterThrowingException.cpp:
+        (WebCore::JSTestIndexedSetterThrowingExceptionDOMConstructor::prototypeForStructure):
+        (WebCore::JSTestIndexedSetterThrowingException::subspaceForImpl):
+        * bindings/scripts/test/JS/JSTestIndexedSetterWithIdentifier.cpp:
+        (WebCore::JSTestIndexedSetterWithIdentifierDOMConstructor::prototypeForStructure):
+        (WebCore::JSTestIndexedSetterWithIdentifier::subspaceForImpl):
+        * bindings/scripts/test/JS/JSTestInterface.cpp:
+        (WebCore::JSTestInterfaceDOMConstructor::construct):
+        (WebCore::jsTestInterfacePrototypeFunction_entriesCaller):
+        (WebCore::JSTestInterface::subspaceForImpl):
+        * bindings/scripts/test/JS/JSTestInterfaceLeadingUnderscore.cpp:
+        (WebCore::JSTestInterfaceLeadingUnderscoreDOMConstructor::prototypeForStructure):
+        (WebCore::JSTestInterfaceLeadingUnderscore::subspaceForImpl):
+        * bindings/scripts/test/JS/JSTestIterable.cpp:
+        (WebCore::JSTestIterableDOMConstructor::prototypeForStructure):
+        (WebCore::jsTestIterablePrototypeFunction_entriesCaller):
+        (WebCore::JSTestIterable::subspaceForImpl):
+        * bindings/scripts/test/JS/JSTestJSBuiltinConstructor.cpp:
+        (WebCore::JSTestJSBuiltinConstructorDOMConstructor::prototypeForStructure):
+        (WebCore::JSTestJSBuiltinConstructor::subspaceForImpl):
+        * bindings/scripts/test/JS/JSTestLegacyFactoryFunction.cpp:
+        (WebCore::JSTestLegacyFactoryFunctionDOMConstructor::prototypeForStructure):
+        (WebCore::JSTestLegacyFactoryFunction::subspaceForImpl):
+        * bindings/scripts/test/JS/JSTestLegacyNoInterfaceObject.cpp:
+        (WebCore::JSTestLegacyNoInterfaceObjectPrototype::finishCreation):
+        (WebCore::JSTestLegacyNoInterfaceObject::subspaceForImpl):
+        * bindings/scripts/test/JS/JSTestLegacyOverrideBuiltIns.cpp:
+        (WebCore::JSTestLegacyOverrideBuiltInsDOMConstructor::prototypeForStructure):
+        (WebCore::JSTestLegacyOverrideBuiltIns::subspaceForImpl):
+        * bindings/scripts/test/JS/JSTestMapLike.cpp:
+        (WebCore::JSTestMapLikeDOMConstructor::prototypeForStructure):
+        (WebCore::JSTestMapLike::subspaceForImpl):
+        * bindings/scripts/test/JS/JSTestMapLikeWithOverriddenOperations.cpp:
+        (WebCore::JSTestMapLikeWithOverriddenOperationsDOMConstructor::prototypeForStructure):
+        (WebCore::JSTestMapLikeWithOverriddenOperations::subspaceForImpl):
+        * bindings/scripts/test/JS/JSTestNamedAndIndexedSetterNoIdentifier.cpp:
+        (WebCore::JSTestNamedAndIndexedSetterNoIdentifierDOMConstructor::prototypeForStructure):
+        (WebCore::JSTestNamedAndIndexedSetterNoIdentifier::subspaceForImpl):
+        * bindings/scripts/test/JS/JSTestNamedAndIndexedSetterThrowingException.cpp:
+        (WebCore::JSTestNamedAndIndexedSetterThrowingExceptionDOMConstructor::prototypeForStructure):
+        (WebCore::JSTestNamedAndIndexedSetterThrowingException::subspaceForImpl):
+        * bindings/scripts/test/JS/JSTestNamedAndIndexedSetterWithIdentifier.cpp:
+        (WebCore::JSTestNamedAndIndexedSetterWithIdentifierDOMConstructor::prototypeForStructure):
+        (WebCore::JSTestNamedAndIndexedSetterWithIdentifier::subspaceForImpl):
+        * bindings/scripts/test/JS/JSTestNamedDeleterNoIdentifier.cpp:
+        (WebCore::JSTestNamedDeleterNoIdentifierDOMConstructor::prototypeForStructure):
+        (WebCore::JSTestNamedDeleterNoIdentifier::subspaceForImpl):
+        * bindings/scripts/test/JS/JSTestNamedDeleterThrowingException.cpp:
+        (WebCore::JSTestNamedDeleterThrowingExceptionDOMConstructor::prototypeForStructure):
+        (WebCore::JSTestNamedDeleterThrowingException::subspaceForImpl):
+        * bindings/scripts/test/JS/JSTestNamedDeleterWithIdentifier.cpp:
+        (WebCore::JSTestNamedDeleterWithIdentifierDOMConstructor::prototypeForStructure):
+        (WebCore::JSTestNamedDeleterWithIdentifier::subspaceForImpl):
+        * bindings/scripts/test/JS/JSTestNamedDeleterWithIndexedGetter.cpp:
+        (WebCore::JSTestNamedDeleterWithIndexedGetterDOMConstructor::prototypeForStructure):
+        (WebCore::JSTestNamedDeleterWithIndexedGetter::subspaceForImpl):
+        * bindings/scripts/test/JS/JSTestNamedGetterCallWith.cpp:
+        (WebCore::JSTestNamedGetterCallWithDOMConstructor::prototypeForStructure):
+        (WebCore::JSTestNamedGetterCallWith::subspaceForImpl):
+        * bindings/scripts/test/JS/JSTestNamedGetterNoIdentifier.cpp:
+        (WebCore::JSTestNamedGetterNoIdentifierDOMConstructor::prototypeForStructure):
+        (WebCore::JSTestNamedGetterNoIdentifier::subspaceForImpl):
+        * bindings/scripts/test/JS/JSTestNamedGetterWithIdentifier.cpp:
+        (WebCore::JSTestNamedGetterWithIdentifierDOMConstructor::prototypeForStructure):
+        (WebCore::JSTestNamedGetterWithIdentifier::subspaceForImpl):
+        * bindings/scripts/test/JS/JSTestNamedSetterNoIdentifier.cpp:
+        (WebCore::JSTestNamedSetterNoIdentifierDOMConstructor::prototypeForStructure):
+        (WebCore::JSTestNamedSetterNoIdentifier::subspaceForImpl):
+        * bindings/scripts/test/JS/JSTestNamedSetterThrowingException.cpp:
+        (WebCore::JSTestNamedSetterThrowingExceptionDOMConstructor::prototypeForStructure):
+        (WebCore::JSTestNamedSetterThrowingException::subspaceForImpl):
+        * bindings/scripts/test/JS/JSTestNamedSetterWithIdentifier.cpp:
+        (WebCore::JSTestNamedSetterWithIdentifierDOMConstructor::prototypeForStructure):
+        (WebCore::JSTestNamedSetterWithIdentifier::subspaceForImpl):
+        * bindings/scripts/test/JS/JSTestNamedSetterWithIndexedGetter.cpp:
+        (WebCore::JSTestNamedSetterWithIndexedGetterDOMConstructor::prototypeForStructure):
+        (WebCore::JSTestNamedSetterWithIndexedGetter::subspaceForImpl):
+        * bindings/scripts/test/JS/JSTestNamedSetterWithIndexedGetterAndSetter.cpp:
+        (WebCore::JSTestNamedSetterWithIndexedGetterAndSetterDOMConstructor::prototypeForStructure):
+        (WebCore::JSTestNamedSetterWithIndexedGetterAndSetter::subspaceForImpl):
+        * bindings/scripts/test/JS/JSTestNamedSetterWithLegacyOverrideBuiltIns.cpp:
+        (WebCore::JSTestNamedSetterWithLegacyOverrideBuiltInsDOMConstructor::prototypeForStructure):
+        (WebCore::JSTestNamedSetterWithLegacyOverrideBuiltIns::subspaceForImpl):
+        * bindings/scripts/test/JS/JSTestNamedSetterWithLegacyUnforgeableProperties.cpp:
+        (WebCore::JSTestNamedSetterWithLegacyUnforgeablePropertiesDOMConstructor::prototypeForStructure):
+        (WebCore::JSTestNamedSetterWithLegacyUnforgeableProperties::subspaceForImpl):
+        * bindings/scripts/test/JS/JSTestNamedSetterWithLegacyUnforgeablePropertiesAndLegacyOverrideBuiltIns.cpp:
+        (WebCore::JSTestNamedSetterWithLegacyUnforgeablePropertiesAndLegacyOverrideBuiltInsDOMConstructor::prototypeForStructure):
+        (WebCore::JSTestNamedSetterWithLegacyUnforgeablePropertiesAndLegacyOverrideBuiltIns::subspaceForImpl):
+        * bindings/scripts/test/JS/JSTestNamespaceObject.cpp:
+        (WebCore::JSTestNamespaceObject::subspaceForImpl):
+        * bindings/scripts/test/JS/JSTestNode.cpp:
+        (WebCore::jsTestNodePrototypeFunction_entriesCaller):
+        (WebCore::JSTestNode::subspaceForImpl):
+        * bindings/scripts/test/JS/JSTestObj.cpp:
+        (WebCore::JSTestObjDOMConstructor::construct):
+        (WebCore::JSTestObj::subspaceForImpl):
+        * bindings/scripts/test/JS/JSTestOperationConditional.cpp:
+        (WebCore::JSTestOperationConditionalDOMConstructor::prototypeForStructure):
+        (WebCore::JSTestOperationConditional::subspaceForImpl):
+        * bindings/scripts/test/JS/JSTestOverloadedConstructors.cpp:
+        (WebCore::JSTestOverloadedConstructors::subspaceForImpl):
+        * bindings/scripts/test/JS/JSTestOverloadedConstructorsWithSequence.cpp:
+        (WebCore::JSTestOverloadedConstructorsWithSequence::subspaceForImpl):
+        * bindings/scripts/test/JS/JSTestPluginInterface.cpp:
+        (WebCore::JSTestPluginInterfaceDOMConstructor::prototypeForStructure):
+        (WebCore::JSTestPluginInterface::subspaceForImpl):
+        * bindings/scripts/test/JS/JSTestPromiseRejectionEvent.cpp:
+        (WebCore::JSTestPromiseRejectionEvent::subspaceForImpl):
+        * bindings/scripts/test/JS/JSTestReadOnlyMapLike.cpp:
+        (WebCore::JSTestReadOnlyMapLikeDOMConstructor::prototypeForStructure):
+        (WebCore::JSTestReadOnlyMapLike::subspaceForImpl):
+        * bindings/scripts/test/JS/JSTestReadOnlySetLike.cpp:
+        (WebCore::JSTestReadOnlySetLikeDOMConstructor::prototypeForStructure):
+        (WebCore::JSTestReadOnlySetLike::subspaceForImpl):
+        * bindings/scripts/test/JS/JSTestReportExtraMemoryCost.cpp:
+        (WebCore::JSTestReportExtraMemoryCostDOMConstructor::prototypeForStructure):
+        (WebCore::JSTestReportExtraMemoryCost::subspaceForImpl):
+        * bindings/scripts/test/JS/JSTestSerializedScriptValueInterface.cpp:
+        (WebCore::JSTestSerializedScriptValueInterfaceDOMConstructor::prototypeForStructure):
+        (WebCore::JSTestSerializedScriptValueInterface::subspaceForImpl):
+        * bindings/scripts/test/JS/JSTestSetLike.cpp:
+        (WebCore::JSTestSetLikeDOMConstructor::prototypeForStructure):
+        (WebCore::JSTestSetLike::subspaceForImpl):
+        * bindings/scripts/test/JS/JSTestSetLikeWithOverriddenOperations.cpp:
+        (WebCore::JSTestSetLikeWithOverriddenOperationsDOMConstructor::prototypeForStructure):
+        (WebCore::JSTestSetLikeWithOverriddenOperations::subspaceForImpl):
+        * bindings/scripts/test/JS/JSTestStringifier.cpp:
+        (WebCore::JSTestStringifierDOMConstructor::prototypeForStructure):
+        (WebCore::JSTestStringifier::subspaceForImpl):
+        * bindings/scripts/test/JS/JSTestStringifierAnonymousOperation.cpp:
+        (WebCore::JSTestStringifierAnonymousOperationDOMConstructor::prototypeForStructure):
+        (WebCore::JSTestStringifierAnonymousOperation::subspaceForImpl):
+        * bindings/scripts/test/JS/JSTestStringifierNamedOperation.cpp:
+        (WebCore::JSTestStringifierNamedOperationDOMConstructor::prototypeForStructure):
+        (WebCore::JSTestStringifierNamedOperation::subspaceForImpl):
+        * bindings/scripts/test/JS/JSTestStringifierOperationImplementedAs.cpp:
+        (WebCore::JSTestStringifierOperationImplementedAsDOMConstructor::prototypeForStructure):
+        (WebCore::JSTestStringifierOperationImplementedAs::subspaceForImpl):
+        * bindings/scripts/test/JS/JSTestStringifierOperationNamedToString.cpp:
+        (WebCore::JSTestStringifierOperationNamedToStringDOMConstructor::prototypeForStructure):
+        (WebCore::JSTestStringifierOperationNamedToString::subspaceForImpl):
+        * bindings/scripts/test/JS/JSTestStringifierReadOnlyAttribute.cpp:
+        (WebCore::JSTestStringifierReadOnlyAttributeDOMConstructor::prototypeForStructure):
+        (WebCore::JSTestStringifierReadOnlyAttribute::subspaceForImpl):
+        * bindings/scripts/test/JS/JSTestStringifierReadWriteAttribute.cpp:
+        (WebCore::JSTestStringifierReadWriteAttributeDOMConstructor::prototypeForStructure):
+        (WebCore::JSTestStringifierReadWriteAttribute::subspaceForImpl):
+        * bindings/scripts/test/JS/JSTestTypedefs.cpp:
+        (WebCore::JSTestTypedefsDOMConstructor::construct):
+        (WebCore::JSTestTypedefs::subspaceForImpl):
+        * bindings/scripts/test/JS/JSWorkerGlobalScope.cpp:
+        (WebCore::JSWorkerGlobalScope::subspaceForImpl):
+        * bindings/scripts/test/JS/JSWorkerGlobalScope.h:
+        * bindings/scripts/test/JS/JSWorkletGlobalScope.cpp:
+        (WebCore::JSWorkletGlobalScope::subspaceForImpl):
+        * bindings/scripts/test/JS/JSWorkletGlobalScope.h:
+        * bridge/objc/objc_runtime.mm:
+        (JSC::Bindings::ObjcFallbackObjectImp::subspaceForImpl):
+        * workers/WorkerOrWorkletScriptController.h:
+
</ins><span class="cx"> 2021-11-30  Devin Rousso  <drousso@apple.com>
</span><span class="cx"> 
</span><span class="cx">         [Apple Pay] use `#if` inside `ApplePayPaymentTiming` instead of guarding the entire `enum`
</span></span></pre></div>
<a id="trunkSourceWebCorebindingsjsJSDOMAsyncIteratorh"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/js/JSDOMAsyncIterator.h (286346 => 286347)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/bindings/js/JSDOMAsyncIterator.h    2021-12-01 02:56:24 UTC (rev 286346)
+++ trunk/Source/WebCore/bindings/js/JSDOMAsyncIterator.h       2021-12-01 04:38:56 UTC (rev 286347)
</span><span class="lines">@@ -48,7 +48,7 @@
</span><span class="cx">     static JSC::IsoSubspace* subspaceFor(JSC::VM& vm)
</span><span class="cx">     {
</span><span class="cx">         STATIC_ASSERT_ISO_SUBSPACE_SHARABLE(JSDOMAsyncIteratorPrototype, Base);
</span><del>-        return &vm.plainObjectSpace;
</del><ins>+        return &vm.plainObjectSpace();
</ins><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     static JSDOMAsyncIteratorPrototype* create(JSC::VM& vm, JSC::JSGlobalObject* globalObject, JSC::Structure* structure)
</span></span></pre></div>
<a id="trunkSourceWebCorebindingsjsJSDOMIteratorh"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/js/JSDOMIterator.h (286346 => 286347)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/bindings/js/JSDOMIterator.h 2021-12-01 02:56:24 UTC (rev 286346)
+++ trunk/Source/WebCore/bindings/js/JSDOMIterator.h    2021-12-01 04:38:56 UTC (rev 286347)
</span><span class="lines">@@ -55,7 +55,7 @@
</span><span class="cx">     static JSC::IsoSubspace* subspaceFor(JSC::VM& vm)
</span><span class="cx">     {
</span><span class="cx">         STATIC_ASSERT_ISO_SUBSPACE_SHARABLE(JSDOMIteratorPrototype, Base);
</span><del>-        return &vm.plainObjectSpace;
</del><ins>+        return &vm.plainObjectSpace();
</ins><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     static JSDOMIteratorPrototype* create(JSC::VM& vm, JSC::JSGlobalObject* globalObject, JSC::Structure* structure)
</span></span></pre></div>
<a id="trunkSourceWebCorebindingsjsJSFileSystemDirectoryHandleIteratorcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/js/JSFileSystemDirectoryHandleIterator.cpp (286346 => 286347)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/bindings/js/JSFileSystemDirectoryHandleIterator.cpp 2021-12-01 02:56:24 UTC (rev 286346)
+++ trunk/Source/WebCore/bindings/js/JSFileSystemDirectoryHandleIterator.cpp    2021-12-01 04:38:56 UTC (rev 286347)
</span><span class="lines">@@ -55,9 +55,9 @@
</span><span class="cx">         return space;
</span><span class="cx">     static_assert(std::is_base_of_v<JSC::JSDestructibleObject, JSFileSystemDirectoryHandleIterator> || !JSFileSystemDirectoryHandleIterator::needsDestruction);
</span><span class="cx">     if constexpr (std::is_base_of_v<JSC::JSDestructibleObject, JSFileSystemDirectoryHandleIterator>)
</span><del>-        clientData.setFileSystemDirectoryHandleIteratorSpace(makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, *vm.destructibleObjectHeapCellType, JSFileSystemDirectoryHandleIterator));
</del><ins>+        clientData.setFileSystemDirectoryHandleIteratorSpace(makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, vm.destructibleObjectHeapCellType(), JSFileSystemDirectoryHandleIterator));
</ins><span class="cx">     else
</span><del>-        clientData.setFileSystemDirectoryHandleIteratorSpace(makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, *vm.cellHeapCellType, JSFileSystemDirectoryHandleIterator));
</del><ins>+        clientData.setFileSystemDirectoryHandleIteratorSpace(makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, vm.cellHeapCellType(), JSFileSystemDirectoryHandleIterator));
</ins><span class="cx">     auto* space = clientData.fileSystemDirectoryHandleIteratorSpace();
</span><span class="cx"> IGNORE_WARNINGS_BEGIN("unreachable-code")
</span><span class="cx"> IGNORE_WARNINGS_BEGIN("tautological-compare")
</span></span></pre></div>
<a id="trunkSourceWebCorebindingsjsWebCoreJSClientDatacpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/js/WebCoreJSClientData.cpp (286346 => 286347)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/bindings/js/WebCoreJSClientData.cpp 2021-12-01 02:56:24 UTC (rev 286346)
+++ trunk/Source/WebCore/bindings/js/WebCoreJSClientData.cpp    2021-12-01 04:38:56 UTC (rev 286347)
</span><span class="lines">@@ -38,6 +38,7 @@
</span><span class="cx"> #include "JSPaintWorkletGlobalScope.h"
</span><span class="cx"> #include "JSRemoteDOMWindow.h"
</span><span class="cx"> #include "JSServiceWorkerGlobalScope.h"
</span><ins>+#include "JSSharedWorkerGlobalScope.h"
</ins><span class="cx"> #include "JSWindowProxy.h"
</span><span class="cx"> #include "JSWorkerGlobalScope.h"
</span><span class="cx"> #include "JSWorkletGlobalScope.h"
</span><span class="lines">@@ -59,33 +60,34 @@
</span><span class="cx"> JSVMClientData::JSVMClientData(VM& vm)
</span><span class="cx">     : m_builtinFunctions(vm)
</span><span class="cx">     , m_builtinNames(vm)
</span><del>-    , m_runtimeArrayHeapCellType(JSC::IsoHeapCellType::create<RuntimeArray>())
-    , m_runtimeObjectHeapCellType(JSC::IsoHeapCellType::create<JSC::Bindings::RuntimeObject>())
-    , m_windowProxyHeapCellType(JSC::IsoHeapCellType::create<JSWindowProxy>())
-    , m_heapCellTypeForJSDOMWindow(JSC::IsoHeapCellType::create<JSDOMWindow>())
-    , m_heapCellTypeForJSDedicatedWorkerGlobalScope(JSC::IsoHeapCellType::create<JSDedicatedWorkerGlobalScope>())
-    , m_heapCellTypeForJSRemoteDOMWindow(JSC::IsoHeapCellType::create<JSRemoteDOMWindow>())
-    , m_heapCellTypeForJSWorkerGlobalScope(JSC::IsoHeapCellType::create<JSWorkerGlobalScope>())
</del><ins>+    , m_runtimeArrayHeapCellType(JSC::IsoHeapCellType::Args<RuntimeArray>())
+    , m_runtimeObjectHeapCellType(JSC::IsoHeapCellType::Args<JSC::Bindings::RuntimeObject>())
+    , m_windowProxyHeapCellType(JSC::IsoHeapCellType::Args<JSWindowProxy>())
+    , m_heapCellTypeForJSDOMWindow(JSC::IsoHeapCellType::Args<JSDOMWindow>())
+    , m_heapCellTypeForJSDedicatedWorkerGlobalScope(JSC::IsoHeapCellType::Args<JSDedicatedWorkerGlobalScope>())
+    , m_heapCellTypeForJSRemoteDOMWindow(JSC::IsoHeapCellType::Args<JSRemoteDOMWindow>())
+    , m_heapCellTypeForJSWorkerGlobalScope(JSC::IsoHeapCellType::Args<JSWorkerGlobalScope>())
+    , m_heapCellTypeForJSSharedWorkerGlobalScope(JSC::IsoHeapCellType::Args<JSSharedWorkerGlobalScope>())
</ins><span class="cx"> #if ENABLE(SERVICE_WORKER)
</span><del>-    , m_heapCellTypeForJSServiceWorkerGlobalScope(JSC::IsoHeapCellType::create<JSServiceWorkerGlobalScope>())
</del><ins>+    , m_heapCellTypeForJSServiceWorkerGlobalScope(JSC::IsoHeapCellType::Args<JSServiceWorkerGlobalScope>())
</ins><span class="cx"> #endif
</span><del>-    , m_heapCellTypeForJSWorkletGlobalScope(JSC::IsoHeapCellType::create<JSWorkletGlobalScope>())
</del><ins>+    , m_heapCellTypeForJSWorkletGlobalScope(JSC::IsoHeapCellType::Args<JSWorkletGlobalScope>())
</ins><span class="cx"> #if ENABLE(CSS_PAINTING_API)
</span><del>-    , m_heapCellTypeForJSPaintWorkletGlobalScope(JSC::IsoHeapCellType::create<JSPaintWorkletGlobalScope>())
</del><ins>+    , m_heapCellTypeForJSPaintWorkletGlobalScope(JSC::IsoHeapCellType::Args<JSPaintWorkletGlobalScope>())
</ins><span class="cx"> #endif
</span><span class="cx"> #if ENABLE(WEB_AUDIO)
</span><del>-    , m_heapCellTypeForJSAudioWorkletGlobalScope(JSC::IsoHeapCellType::create<JSAudioWorkletGlobalScope>())
</del><ins>+    , m_heapCellTypeForJSAudioWorkletGlobalScope(JSC::IsoHeapCellType::Args<JSAudioWorkletGlobalScope>())
</ins><span class="cx"> #endif
</span><del>-    , m_heapCellTypeForJSIDBSerializationGlobalObject(JSC::IsoHeapCellType::create<JSIDBSerializationGlobalObject>())
-    , m_domBuiltinConstructorSpace ISO_SUBSPACE_INIT(vm.heap, *vm.cellHeapCellType, JSDOMBuiltinConstructorBase)
-    , m_domConstructorSpace ISO_SUBSPACE_INIT(vm.heap, *vm.cellHeapCellType, JSDOMConstructorBase)
-    , m_domNamespaceObjectSpace ISO_SUBSPACE_INIT(vm.heap, *vm.cellHeapCellType, JSDOMObject)
-    , m_domWindowPropertiesSpace ISO_SUBSPACE_INIT(vm.heap, *vm.cellHeapCellType, JSDOMWindowProperties)
-    , m_runtimeArraySpace ISO_SUBSPACE_INIT(vm.heap, *m_runtimeArrayHeapCellType, RuntimeArray)
-    , m_runtimeMethodSpace ISO_SUBSPACE_INIT(vm.heap, *vm.cellHeapCellType, RuntimeMethod) // Hash:0xf70c4a85
-    , m_runtimeObjectSpace ISO_SUBSPACE_INIT(vm.heap, *m_runtimeObjectHeapCellType, JSC::Bindings::RuntimeObject)
-    , m_windowProxySpace ISO_SUBSPACE_INIT(vm.heap, *m_windowProxyHeapCellType, JSWindowProxy)
-    , m_idbSerializationSpace ISO_SUBSPACE_INIT(vm.heap, *m_heapCellTypeForJSIDBSerializationGlobalObject, JSIDBSerializationGlobalObject)
</del><ins>+    , m_heapCellTypeForJSIDBSerializationGlobalObject(JSC::IsoHeapCellType::Args<JSIDBSerializationGlobalObject>())
+    , m_domBuiltinConstructorSpace ISO_SUBSPACE_INIT(vm.heap, vm.cellHeapCellType(), JSDOMBuiltinConstructorBase)
+    , m_domConstructorSpace ISO_SUBSPACE_INIT(vm.heap, vm.cellHeapCellType(), JSDOMConstructorBase)
+    , m_domNamespaceObjectSpace ISO_SUBSPACE_INIT(vm.heap, vm.cellHeapCellType(), JSDOMObject)
+    , m_domWindowPropertiesSpace ISO_SUBSPACE_INIT(vm.heap, vm.cellHeapCellType(), JSDOMWindowProperties)
+    , m_runtimeArraySpace ISO_SUBSPACE_INIT(vm.heap, m_runtimeArrayHeapCellType, RuntimeArray)
+    , m_runtimeMethodSpace ISO_SUBSPACE_INIT(vm.heap, vm.cellHeapCellType(), RuntimeMethod) // Hash:0xf70c4a85
+    , m_runtimeObjectSpace ISO_SUBSPACE_INIT(vm.heap, m_runtimeObjectHeapCellType, JSC::Bindings::RuntimeObject)
+    , m_windowProxySpace ISO_SUBSPACE_INIT(vm.heap, m_windowProxyHeapCellType, JSWindowProxy)
+    , m_idbSerializationSpace ISO_SUBSPACE_INIT(vm.heap, m_heapCellTypeForJSIDBSerializationGlobalObject, JSIDBSerializationGlobalObject)
</ins><span class="cx">     , m_subspaces(makeUnique<DOMIsoSubspaces>())
</span><span class="cx"> {
</span><span class="cx"> }
</span></span></pre></div>
<a id="trunkSourceWebCorebindingsjsWebCoreJSClientDatah"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/js/WebCoreJSClientData.h (286346 => 286347)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/bindings/js/WebCoreJSClientData.h   2021-12-01 02:56:24 UTC (rev 286346)
+++ trunk/Source/WebCore/bindings/js/WebCoreJSClientData.h      2021-12-01 04:38:56 UTC (rev 286347)
</span><span class="lines">@@ -1,6 +1,6 @@
</span><span class="cx"> /*
</span><span class="cx">  *  Copyright (C) 1999-2001 Harri Porten (porten@kde.org)
</span><del>- *  Copyright (C) 2003-2017 Apple Inc. All rights reserved.
</del><ins>+ *  Copyright (C) 2003-2021 Apple Inc. All rights reserved.
</ins><span class="cx">  *  Copyright (C) 2007 Samuel Weinig <sam@webkit.org>
</span><span class="cx">  *  Copyright (C) 2009 Google, Inc. All rights reserved.
</span><span class="cx">  *
</span><span class="lines">@@ -92,26 +92,26 @@
</span><span class="cx">     JSBuiltinFunctions m_builtinFunctions;
</span><span class="cx">     WebCoreBuiltinNames m_builtinNames;
</span><span class="cx"> 
</span><del>-    std::unique_ptr<JSC::HeapCellType> m_runtimeArrayHeapCellType;
-    std::unique_ptr<JSC::HeapCellType> m_runtimeObjectHeapCellType;
-    std::unique_ptr<JSC::HeapCellType> m_windowProxyHeapCellType;
</del><ins>+    JSC::IsoHeapCellType m_runtimeArrayHeapCellType;
+    JSC::IsoHeapCellType m_runtimeObjectHeapCellType;
+    JSC::IsoHeapCellType m_windowProxyHeapCellType;
</ins><span class="cx"> public:
</span><del>-    std::unique_ptr<JSC::HeapCellType> m_heapCellTypeForJSDOMWindow;
-    std::unique_ptr<JSC::HeapCellType> m_heapCellTypeForJSDedicatedWorkerGlobalScope;
-    std::unique_ptr<JSC::HeapCellType> m_heapCellTypeForJSRemoteDOMWindow;
-    std::unique_ptr<JSC::HeapCellType> m_heapCellTypeForJSWorkerGlobalScope;
-    std::unique_ptr<JSC::HeapCellType> m_heapCellTypeForJSSharedWorkerGlobalScope;
</del><ins>+    JSC::IsoHeapCellType m_heapCellTypeForJSDOMWindow;
+    JSC::IsoHeapCellType m_heapCellTypeForJSDedicatedWorkerGlobalScope;
+    JSC::IsoHeapCellType m_heapCellTypeForJSRemoteDOMWindow;
+    JSC::IsoHeapCellType m_heapCellTypeForJSWorkerGlobalScope;
+    JSC::IsoHeapCellType m_heapCellTypeForJSSharedWorkerGlobalScope;
</ins><span class="cx"> #if ENABLE(SERVICE_WORKER)
</span><del>-    std::unique_ptr<JSC::HeapCellType> m_heapCellTypeForJSServiceWorkerGlobalScope;
</del><ins>+    JSC::IsoHeapCellType m_heapCellTypeForJSServiceWorkerGlobalScope;
</ins><span class="cx"> #endif
</span><del>-    std::unique_ptr<JSC::HeapCellType> m_heapCellTypeForJSWorkletGlobalScope;
</del><ins>+    JSC::IsoHeapCellType m_heapCellTypeForJSWorkletGlobalScope;
</ins><span class="cx"> #if ENABLE(CSS_PAINTING_API)
</span><del>-    std::unique_ptr<JSC::HeapCellType> m_heapCellTypeForJSPaintWorkletGlobalScope;
</del><ins>+    JSC::IsoHeapCellType m_heapCellTypeForJSPaintWorkletGlobalScope;
</ins><span class="cx"> #endif
</span><span class="cx"> #if ENABLE(WEB_AUDIO)
</span><del>-    std::unique_ptr<JSC::HeapCellType> m_heapCellTypeForJSAudioWorkletGlobalScope;
</del><ins>+    JSC::IsoHeapCellType m_heapCellTypeForJSAudioWorkletGlobalScope;
</ins><span class="cx"> #endif
</span><del>-    std::unique_ptr<JSC::HeapCellType> m_heapCellTypeForJSIDBSerializationGlobalObject;
</del><ins>+    JSC::IsoHeapCellType m_heapCellTypeForJSIDBSerializationGlobalObject;
</ins><span class="cx"> 
</span><span class="cx"> private:
</span><span class="cx">     JSC::IsoSubspace m_domBuiltinConstructorSpace;
</span></span></pre></div>
<a id="trunkSourceWebCorebindingsscriptsCodeGeneratorJSpm"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/scripts/CodeGeneratorJS.pm (286346 => 286347)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/bindings/scripts/CodeGeneratorJS.pm 2021-12-01 02:56:24 UTC (rev 286346)
+++ trunk/Source/WebCore/bindings/scripts/CodeGeneratorJS.pm    2021-12-01 04:38:56 UTC (rev 286347)
</span><span class="lines">@@ -4852,13 +4852,13 @@
</span><span class="cx">     push(@implContent, "    if (auto* space = spaces.m_subspaceFor${interfaceName}.get())\n");
</span><span class="cx">     push(@implContent, "        return space;\n");
</span><span class="cx">     if (IsDOMGlobalObject($interface)) {
</span><del>-        push(@implContent, "    spaces.m_subspaceFor${interfaceName} = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, *clientData.m_heapCellTypeFor${className}, ${className});\n");
</del><ins>+        push(@implContent, "    spaces.m_subspaceFor${interfaceName} = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, clientData.m_heapCellTypeFor${className}, ${className});\n");
</ins><span class="cx">     } else {
</span><span class="cx">         push(@implContent, "    static_assert(std::is_base_of_v<JSC::JSDestructibleObject, ${className}> || !${className}::needsDestruction);\n");
</span><span class="cx">         push(@implContent, "    if constexpr (std::is_base_of_v<JSC::JSDestructibleObject, ${className}>)\n");
</span><del>-        push(@implContent, "        spaces.m_subspaceFor${interfaceName} = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, *vm.destructibleObjectHeapCellType, ${className});\n");
</del><ins>+        push(@implContent, "        spaces.m_subspaceFor${interfaceName} = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, vm.destructibleObjectHeapCellType(), ${className});\n");
</ins><span class="cx">         push(@implContent, "    else\n");
</span><del>-        push(@implContent, "        spaces.m_subspaceFor${interfaceName} = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, *vm.cellHeapCellType, ${className});\n");
</del><ins>+        push(@implContent, "        spaces.m_subspaceFor${interfaceName} = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, vm.cellHeapCellType(), ${className});\n");
</ins><span class="cx">     }
</span><span class="cx">     push(@implContent, "    auto* space = spaces.m_subspaceFor${interfaceName}.get();\n");
</span><span class="cx">     push(@implContent, "IGNORE_WARNINGS_BEGIN(\"unreachable-code\")\n");
</span><span class="lines">@@ -6731,9 +6731,9 @@
</span><span class="cx">             return space;
</span><span class="cx">         static_assert(std::is_base_of_v<JSC::JSDestructibleObject, ${iteratorName}> || !${iteratorName}::needsDestruction);
</span><span class="cx">         if constexpr (std::is_base_of_v<JSC::JSDestructibleObject, ${iteratorName}>)
</span><del>-            spaces.m_subspaceFor${iteratorName} = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, *vm.destructibleObjectHeapCellType.get(), ${iteratorName});
</del><ins>+            spaces.m_subspaceFor${iteratorName} = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, vm.destructibleObjectHeapCellType(), ${iteratorName});
</ins><span class="cx">         else
</span><del>-            spaces.m_subspaceFor${iteratorName} = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, *vm.cellHeapCellType, ${iteratorName});
</del><ins>+            spaces.m_subspaceFor${iteratorName} = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, vm.cellHeapCellType(), ${iteratorName});
</ins><span class="cx">         auto* space = spaces.m_subspaceFor${iteratorName}.get();
</span><span class="cx"> IGNORE_WARNINGS_BEGIN(\"unreachable-code\")
</span><span class="cx"> IGNORE_WARNINGS_BEGIN(\"tautological-compare\")
</span><span class="lines">@@ -7529,7 +7529,7 @@
</span><span class="cx">     push(@$outputArray, "    static JSC::IsoSubspace* subspaceFor(JSC::VM& vm)\n");
</span><span class="cx">     push(@$outputArray, "    {\n");
</span><span class="cx">     push(@$outputArray, "        STATIC_ASSERT_ISO_SUBSPACE_SHARABLE(${prototypeClassName}, Base);\n");
</span><del>-    push(@$outputArray, "        return &vm.plainObjectSpace;\n");
</del><ins>+    push(@$outputArray, "        return &vm.plainObjectSpace();\n");
</ins><span class="cx">     push(@$outputArray, "    }\n");
</span><span class="cx"> 
</span><span class="cx">     push(@$outputArray, "    static JSC::Structure* createStructure(JSC::VM& vm, JSC::JSGlobalObject* globalObject, JSC::JSValue prototype)\n");
</span></span></pre></div>
<a id="trunkSourceWebCorebindingsscriptstestJSJSDOMWindowcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/scripts/test/JS/JSDOMWindow.cpp (286346 => 286347)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/bindings/scripts/test/JS/JSDOMWindow.cpp    2021-12-01 02:56:24 UTC (rev 286346)
+++ trunk/Source/WebCore/bindings/scripts/test/JS/JSDOMWindow.cpp       2021-12-01 04:38:56 UTC (rev 286347)
</span><span class="lines">@@ -369,7 +369,7 @@
</span><span class="cx">     auto& spaces = clientData.subspaces();
</span><span class="cx">     if (auto* space = spaces.m_subspaceForDOMWindow.get())
</span><span class="cx">         return space;
</span><del>-    spaces.m_subspaceForDOMWindow = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, *clientData.m_heapCellTypeForJSDOMWindow, JSDOMWindow);
</del><ins>+    spaces.m_subspaceForDOMWindow = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, clientData.m_heapCellTypeForJSDOMWindow, JSDOMWindow);
</ins><span class="cx">     auto* space = spaces.m_subspaceForDOMWindow.get();
</span><span class="cx"> IGNORE_WARNINGS_BEGIN("unreachable-code")
</span><span class="cx"> IGNORE_WARNINGS_BEGIN("tautological-compare")
</span></span></pre></div>
<a id="trunkSourceWebCorebindingsscriptstestJSJSDOMWindowh"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/scripts/test/JS/JSDOMWindow.h (286346 => 286347)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/bindings/scripts/test/JS/JSDOMWindow.h      2021-12-01 02:56:24 UTC (rev 286346)
+++ trunk/Source/WebCore/bindings/scripts/test/JS/JSDOMWindow.h 2021-12-01 04:38:56 UTC (rev 286347)
</span><span class="lines">@@ -85,7 +85,7 @@
</span><span class="cx">     static JSC::IsoSubspace* subspaceFor(JSC::VM& vm)
</span><span class="cx">     {
</span><span class="cx">         STATIC_ASSERT_ISO_SUBSPACE_SHARABLE(JSDOMWindowPrototype, Base);
</span><del>-        return &vm.plainObjectSpace;
</del><ins>+        return &vm.plainObjectSpace();
</ins><span class="cx">     }
</span><span class="cx">     static JSC::Structure* createStructure(JSC::VM& vm, JSC::JSGlobalObject* globalObject, JSC::JSValue prototype)
</span><span class="cx">     {
</span></span></pre></div>
<a id="trunkSourceWebCorebindingsscriptstestJSJSDedicatedWorkerGlobalScopecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/scripts/test/JS/JSDedicatedWorkerGlobalScope.cpp (286346 => 286347)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/bindings/scripts/test/JS/JSDedicatedWorkerGlobalScope.cpp   2021-12-01 02:56:24 UTC (rev 286346)
+++ trunk/Source/WebCore/bindings/scripts/test/JS/JSDedicatedWorkerGlobalScope.cpp      2021-12-01 04:38:56 UTC (rev 286347)
</span><span class="lines">@@ -170,7 +170,7 @@
</span><span class="cx">     auto& spaces = clientData.subspaces();
</span><span class="cx">     if (auto* space = spaces.m_subspaceForDedicatedWorkerGlobalScope.get())
</span><span class="cx">         return space;
</span><del>-    spaces.m_subspaceForDedicatedWorkerGlobalScope = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, *clientData.m_heapCellTypeForJSDedicatedWorkerGlobalScope, JSDedicatedWorkerGlobalScope);
</del><ins>+    spaces.m_subspaceForDedicatedWorkerGlobalScope = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, clientData.m_heapCellTypeForJSDedicatedWorkerGlobalScope, JSDedicatedWorkerGlobalScope);
</ins><span class="cx">     auto* space = spaces.m_subspaceForDedicatedWorkerGlobalScope.get();
</span><span class="cx"> IGNORE_WARNINGS_BEGIN("unreachable-code")
</span><span class="cx"> IGNORE_WARNINGS_BEGIN("tautological-compare")
</span></span></pre></div>
<a id="trunkSourceWebCorebindingsscriptstestJSJSDedicatedWorkerGlobalScopeh"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/scripts/test/JS/JSDedicatedWorkerGlobalScope.h (286346 => 286347)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/bindings/scripts/test/JS/JSDedicatedWorkerGlobalScope.h     2021-12-01 02:56:24 UTC (rev 286346)
+++ trunk/Source/WebCore/bindings/scripts/test/JS/JSDedicatedWorkerGlobalScope.h        2021-12-01 04:38:56 UTC (rev 286347)
</span><span class="lines">@@ -82,7 +82,7 @@
</span><span class="cx">     static JSC::IsoSubspace* subspaceFor(JSC::VM& vm)
</span><span class="cx">     {
</span><span class="cx">         STATIC_ASSERT_ISO_SUBSPACE_SHARABLE(JSDedicatedWorkerGlobalScopePrototype, Base);
</span><del>-        return &vm.plainObjectSpace;
</del><ins>+        return &vm.plainObjectSpace();
</ins><span class="cx">     }
</span><span class="cx">     static JSC::Structure* createStructure(JSC::VM& vm, JSC::JSGlobalObject* globalObject, JSC::JSValue prototype)
</span><span class="cx">     {
</span></span></pre></div>
<a id="trunkSourceWebCorebindingsscriptstestJSJSExposedStarcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/scripts/test/JS/JSExposedStar.cpp (286346 => 286347)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/bindings/scripts/test/JS/JSExposedStar.cpp  2021-12-01 02:56:24 UTC (rev 286346)
+++ trunk/Source/WebCore/bindings/scripts/test/JS/JSExposedStar.cpp     2021-12-01 04:38:56 UTC (rev 286347)
</span><span class="lines">@@ -71,7 +71,7 @@
</span><span class="cx">     static JSC::IsoSubspace* subspaceFor(JSC::VM& vm)
</span><span class="cx">     {
</span><span class="cx">         STATIC_ASSERT_ISO_SUBSPACE_SHARABLE(JSExposedStarPrototype, Base);
</span><del>-        return &vm.plainObjectSpace;
</del><ins>+        return &vm.plainObjectSpace();
</ins><span class="cx">     }
</span><span class="cx">     static JSC::Structure* createStructure(JSC::VM& vm, JSC::JSGlobalObject* globalObject, JSC::JSValue prototype)
</span><span class="cx">     {
</span><span class="lines">@@ -236,9 +236,9 @@
</span><span class="cx">         return space;
</span><span class="cx">     static_assert(std::is_base_of_v<JSC::JSDestructibleObject, JSExposedStar> || !JSExposedStar::needsDestruction);
</span><span class="cx">     if constexpr (std::is_base_of_v<JSC::JSDestructibleObject, JSExposedStar>)
</span><del>-        spaces.m_subspaceForExposedStar = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, *vm.destructibleObjectHeapCellType, JSExposedStar);
</del><ins>+        spaces.m_subspaceForExposedStar = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, vm.destructibleObjectHeapCellType(), JSExposedStar);
</ins><span class="cx">     else
</span><del>-        spaces.m_subspaceForExposedStar = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, *vm.cellHeapCellType, JSExposedStar);
</del><ins>+        spaces.m_subspaceForExposedStar = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, vm.cellHeapCellType(), JSExposedStar);
</ins><span class="cx">     auto* space = spaces.m_subspaceForExposedStar.get();
</span><span class="cx"> IGNORE_WARNINGS_BEGIN("unreachable-code")
</span><span class="cx"> IGNORE_WARNINGS_BEGIN("tautological-compare")
</span></span></pre></div>
<a id="trunkSourceWebCorebindingsscriptstestJSJSExposedToWorkerAndWindowcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/scripts/test/JS/JSExposedToWorkerAndWindow.cpp (286346 => 286347)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/bindings/scripts/test/JS/JSExposedToWorkerAndWindow.cpp     2021-12-01 02:56:24 UTC (rev 286346)
+++ trunk/Source/WebCore/bindings/scripts/test/JS/JSExposedToWorkerAndWindow.cpp        2021-12-01 04:38:56 UTC (rev 286347)
</span><span class="lines">@@ -112,7 +112,7 @@
</span><span class="cx">     static JSC::IsoSubspace* subspaceFor(JSC::VM& vm)
</span><span class="cx">     {
</span><span class="cx">         STATIC_ASSERT_ISO_SUBSPACE_SHARABLE(JSExposedToWorkerAndWindowPrototype, Base);
</span><del>-        return &vm.plainObjectSpace;
</del><ins>+        return &vm.plainObjectSpace();
</ins><span class="cx">     }
</span><span class="cx">     static JSC::Structure* createStructure(JSC::VM& vm, JSC::JSGlobalObject* globalObject, JSC::JSValue prototype)
</span><span class="cx">     {
</span><span class="lines">@@ -252,9 +252,9 @@
</span><span class="cx">         return space;
</span><span class="cx">     static_assert(std::is_base_of_v<JSC::JSDestructibleObject, JSExposedToWorkerAndWindow> || !JSExposedToWorkerAndWindow::needsDestruction);
</span><span class="cx">     if constexpr (std::is_base_of_v<JSC::JSDestructibleObject, JSExposedToWorkerAndWindow>)
</span><del>-        spaces.m_subspaceForExposedToWorkerAndWindow = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, *vm.destructibleObjectHeapCellType, JSExposedToWorkerAndWindow);
</del><ins>+        spaces.m_subspaceForExposedToWorkerAndWindow = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, vm.destructibleObjectHeapCellType(), JSExposedToWorkerAndWindow);
</ins><span class="cx">     else
</span><del>-        spaces.m_subspaceForExposedToWorkerAndWindow = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, *vm.cellHeapCellType, JSExposedToWorkerAndWindow);
</del><ins>+        spaces.m_subspaceForExposedToWorkerAndWindow = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, vm.cellHeapCellType(), JSExposedToWorkerAndWindow);
</ins><span class="cx">     auto* space = spaces.m_subspaceForExposedToWorkerAndWindow.get();
</span><span class="cx"> IGNORE_WARNINGS_BEGIN("unreachable-code")
</span><span class="cx"> IGNORE_WARNINGS_BEGIN("tautological-compare")
</span></span></pre></div>
<a id="trunkSourceWebCorebindingsscriptstestJSJSPaintWorkletGlobalScopecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/scripts/test/JS/JSPaintWorkletGlobalScope.cpp (286346 => 286347)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/bindings/scripts/test/JS/JSPaintWorkletGlobalScope.cpp      2021-12-01 02:56:24 UTC (rev 286346)
+++ trunk/Source/WebCore/bindings/scripts/test/JS/JSPaintWorkletGlobalScope.cpp 2021-12-01 04:38:56 UTC (rev 286347)
</span><span class="lines">@@ -169,7 +169,7 @@
</span><span class="cx">     auto& spaces = clientData.subspaces();
</span><span class="cx">     if (auto* space = spaces.m_subspaceForPaintWorkletGlobalScope.get())
</span><span class="cx">         return space;
</span><del>-    spaces.m_subspaceForPaintWorkletGlobalScope = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, *clientData.m_heapCellTypeForJSPaintWorkletGlobalScope, JSPaintWorkletGlobalScope);
</del><ins>+    spaces.m_subspaceForPaintWorkletGlobalScope = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, clientData.m_heapCellTypeForJSPaintWorkletGlobalScope, JSPaintWorkletGlobalScope);
</ins><span class="cx">     auto* space = spaces.m_subspaceForPaintWorkletGlobalScope.get();
</span><span class="cx"> IGNORE_WARNINGS_BEGIN("unreachable-code")
</span><span class="cx"> IGNORE_WARNINGS_BEGIN("tautological-compare")
</span></span></pre></div>
<a id="trunkSourceWebCorebindingsscriptstestJSJSPaintWorkletGlobalScopeh"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/scripts/test/JS/JSPaintWorkletGlobalScope.h (286346 => 286347)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/bindings/scripts/test/JS/JSPaintWorkletGlobalScope.h        2021-12-01 02:56:24 UTC (rev 286346)
+++ trunk/Source/WebCore/bindings/scripts/test/JS/JSPaintWorkletGlobalScope.h   2021-12-01 04:38:56 UTC (rev 286347)
</span><span class="lines">@@ -82,7 +82,7 @@
</span><span class="cx">     static JSC::IsoSubspace* subspaceFor(JSC::VM& vm)
</span><span class="cx">     {
</span><span class="cx">         STATIC_ASSERT_ISO_SUBSPACE_SHARABLE(JSPaintWorkletGlobalScopePrototype, Base);
</span><del>-        return &vm.plainObjectSpace;
</del><ins>+        return &vm.plainObjectSpace();
</ins><span class="cx">     }
</span><span class="cx">     static JSC::Structure* createStructure(JSC::VM& vm, JSC::JSGlobalObject* globalObject, JSC::JSValue prototype)
</span><span class="cx">     {
</span></span></pre></div>
<a id="trunkSourceWebCorebindingsscriptstestJSJSServiceWorkerGlobalScopecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/scripts/test/JS/JSServiceWorkerGlobalScope.cpp (286346 => 286347)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/bindings/scripts/test/JS/JSServiceWorkerGlobalScope.cpp     2021-12-01 02:56:24 UTC (rev 286346)
+++ trunk/Source/WebCore/bindings/scripts/test/JS/JSServiceWorkerGlobalScope.cpp        2021-12-01 04:38:56 UTC (rev 286347)
</span><span class="lines">@@ -169,7 +169,7 @@
</span><span class="cx">     auto& spaces = clientData.subspaces();
</span><span class="cx">     if (auto* space = spaces.m_subspaceForServiceWorkerGlobalScope.get())
</span><span class="cx">         return space;
</span><del>-    spaces.m_subspaceForServiceWorkerGlobalScope = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, *clientData.m_heapCellTypeForJSServiceWorkerGlobalScope, JSServiceWorkerGlobalScope);
</del><ins>+    spaces.m_subspaceForServiceWorkerGlobalScope = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, clientData.m_heapCellTypeForJSServiceWorkerGlobalScope, JSServiceWorkerGlobalScope);
</ins><span class="cx">     auto* space = spaces.m_subspaceForServiceWorkerGlobalScope.get();
</span><span class="cx"> IGNORE_WARNINGS_BEGIN("unreachable-code")
</span><span class="cx"> IGNORE_WARNINGS_BEGIN("tautological-compare")
</span></span></pre></div>
<a id="trunkSourceWebCorebindingsscriptstestJSJSServiceWorkerGlobalScopeh"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/scripts/test/JS/JSServiceWorkerGlobalScope.h (286346 => 286347)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/bindings/scripts/test/JS/JSServiceWorkerGlobalScope.h       2021-12-01 02:56:24 UTC (rev 286346)
+++ trunk/Source/WebCore/bindings/scripts/test/JS/JSServiceWorkerGlobalScope.h  2021-12-01 04:38:56 UTC (rev 286347)
</span><span class="lines">@@ -82,7 +82,7 @@
</span><span class="cx">     static JSC::IsoSubspace* subspaceFor(JSC::VM& vm)
</span><span class="cx">     {
</span><span class="cx">         STATIC_ASSERT_ISO_SUBSPACE_SHARABLE(JSServiceWorkerGlobalScopePrototype, Base);
</span><del>-        return &vm.plainObjectSpace;
</del><ins>+        return &vm.plainObjectSpace();
</ins><span class="cx">     }
</span><span class="cx">     static JSC::Structure* createStructure(JSC::VM& vm, JSC::JSGlobalObject* globalObject, JSC::JSValue prototype)
</span><span class="cx">     {
</span></span></pre></div>
<a id="trunkSourceWebCorebindingsscriptstestJSJSSharedWorkerGlobalScopecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/scripts/test/JS/JSSharedWorkerGlobalScope.cpp (286346 => 286347)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/bindings/scripts/test/JS/JSSharedWorkerGlobalScope.cpp      2021-12-01 02:56:24 UTC (rev 286346)
+++ trunk/Source/WebCore/bindings/scripts/test/JS/JSSharedWorkerGlobalScope.cpp 2021-12-01 04:38:56 UTC (rev 286347)
</span><span class="lines">@@ -153,7 +153,7 @@
</span><span class="cx">     auto& spaces = clientData.subspaces();
</span><span class="cx">     if (auto* space = spaces.m_subspaceForSharedWorkerGlobalScope.get())
</span><span class="cx">         return space;
</span><del>-    spaces.m_subspaceForSharedWorkerGlobalScope = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, *clientData.m_heapCellTypeForJSSharedWorkerGlobalScope, JSSharedWorkerGlobalScope);
</del><ins>+    spaces.m_subspaceForSharedWorkerGlobalScope = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, clientData.m_heapCellTypeForJSSharedWorkerGlobalScope, JSSharedWorkerGlobalScope);
</ins><span class="cx">     auto* space = spaces.m_subspaceForSharedWorkerGlobalScope.get();
</span><span class="cx"> IGNORE_WARNINGS_BEGIN("unreachable-code")
</span><span class="cx"> IGNORE_WARNINGS_BEGIN("tautological-compare")
</span></span></pre></div>
<a id="trunkSourceWebCorebindingsscriptstestJSJSSharedWorkerGlobalScopeh"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/scripts/test/JS/JSSharedWorkerGlobalScope.h (286346 => 286347)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/bindings/scripts/test/JS/JSSharedWorkerGlobalScope.h        2021-12-01 02:56:24 UTC (rev 286346)
+++ trunk/Source/WebCore/bindings/scripts/test/JS/JSSharedWorkerGlobalScope.h   2021-12-01 04:38:56 UTC (rev 286347)
</span><span class="lines">@@ -82,7 +82,7 @@
</span><span class="cx">     static JSC::IsoSubspace* subspaceFor(JSC::VM& vm)
</span><span class="cx">     {
</span><span class="cx">         STATIC_ASSERT_ISO_SUBSPACE_SHARABLE(JSSharedWorkerGlobalScopePrototype, Base);
</span><del>-        return &vm.plainObjectSpace;
</del><ins>+        return &vm.plainObjectSpace();
</ins><span class="cx">     }
</span><span class="cx">     static JSC::Structure* createStructure(JSC::VM& vm, JSC::JSGlobalObject* globalObject, JSC::JSValue prototype)
</span><span class="cx">     {
</span></span></pre></div>
<a id="trunkSourceWebCorebindingsscriptstestJSJSTestCEReactionscpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/scripts/test/JS/JSTestCEReactions.cpp (286346 => 286347)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/bindings/scripts/test/JS/JSTestCEReactions.cpp      2021-12-01 02:56:24 UTC (rev 286346)
+++ trunk/Source/WebCore/bindings/scripts/test/JS/JSTestCEReactions.cpp 2021-12-01 04:38:56 UTC (rev 286347)
</span><span class="lines">@@ -91,7 +91,7 @@
</span><span class="cx">     static JSC::IsoSubspace* subspaceFor(JSC::VM& vm)
</span><span class="cx">     {
</span><span class="cx">         STATIC_ASSERT_ISO_SUBSPACE_SHARABLE(JSTestCEReactionsPrototype, Base);
</span><del>-        return &vm.plainObjectSpace;
</del><ins>+        return &vm.plainObjectSpace();
</ins><span class="cx">     }
</span><span class="cx">     static JSC::Structure* createStructure(JSC::VM& vm, JSC::JSGlobalObject* globalObject, JSC::JSValue prototype)
</span><span class="cx">     {
</span><span class="lines">@@ -438,9 +438,9 @@
</span><span class="cx">         return space;
</span><span class="cx">     static_assert(std::is_base_of_v<JSC::JSDestructibleObject, JSTestCEReactions> || !JSTestCEReactions::needsDestruction);
</span><span class="cx">     if constexpr (std::is_base_of_v<JSC::JSDestructibleObject, JSTestCEReactions>)
</span><del>-        spaces.m_subspaceForTestCEReactions = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, *vm.destructibleObjectHeapCellType, JSTestCEReactions);
</del><ins>+        spaces.m_subspaceForTestCEReactions = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, vm.destructibleObjectHeapCellType(), JSTestCEReactions);
</ins><span class="cx">     else
</span><del>-        spaces.m_subspaceForTestCEReactions = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, *vm.cellHeapCellType, JSTestCEReactions);
</del><ins>+        spaces.m_subspaceForTestCEReactions = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, vm.cellHeapCellType(), JSTestCEReactions);
</ins><span class="cx">     auto* space = spaces.m_subspaceForTestCEReactions.get();
</span><span class="cx"> IGNORE_WARNINGS_BEGIN("unreachable-code")
</span><span class="cx"> IGNORE_WARNINGS_BEGIN("tautological-compare")
</span></span></pre></div>
<a id="trunkSourceWebCorebindingsscriptstestJSJSTestCEReactionsStringifiercpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/scripts/test/JS/JSTestCEReactionsStringifier.cpp (286346 => 286347)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/bindings/scripts/test/JS/JSTestCEReactionsStringifier.cpp   2021-12-01 02:56:24 UTC (rev 286346)
+++ trunk/Source/WebCore/bindings/scripts/test/JS/JSTestCEReactionsStringifier.cpp      2021-12-01 04:38:56 UTC (rev 286347)
</span><span class="lines">@@ -75,7 +75,7 @@
</span><span class="cx">     static JSC::IsoSubspace* subspaceFor(JSC::VM& vm)
</span><span class="cx">     {
</span><span class="cx">         STATIC_ASSERT_ISO_SUBSPACE_SHARABLE(JSTestCEReactionsStringifierPrototype, Base);
</span><del>-        return &vm.plainObjectSpace;
</del><ins>+        return &vm.plainObjectSpace();
</ins><span class="cx">     }
</span><span class="cx">     static JSC::Structure* createStructure(JSC::VM& vm, JSC::JSGlobalObject* globalObject, JSC::JSValue prototype)
</span><span class="cx">     {
</span><span class="lines">@@ -264,9 +264,9 @@
</span><span class="cx">         return space;
</span><span class="cx">     static_assert(std::is_base_of_v<JSC::JSDestructibleObject, JSTestCEReactionsStringifier> || !JSTestCEReactionsStringifier::needsDestruction);
</span><span class="cx">     if constexpr (std::is_base_of_v<JSC::JSDestructibleObject, JSTestCEReactionsStringifier>)
</span><del>-        spaces.m_subspaceForTestCEReactionsStringifier = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, *vm.destructibleObjectHeapCellType, JSTestCEReactionsStringifier);
</del><ins>+        spaces.m_subspaceForTestCEReactionsStringifier = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, vm.destructibleObjectHeapCellType(), JSTestCEReactionsStringifier);
</ins><span class="cx">     else
</span><del>-        spaces.m_subspaceForTestCEReactionsStringifier = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, *vm.cellHeapCellType, JSTestCEReactionsStringifier);
</del><ins>+        spaces.m_subspaceForTestCEReactionsStringifier = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, vm.cellHeapCellType(), JSTestCEReactionsStringifier);
</ins><span class="cx">     auto* space = spaces.m_subspaceForTestCEReactionsStringifier.get();
</span><span class="cx"> IGNORE_WARNINGS_BEGIN("unreachable-code")
</span><span class="cx"> IGNORE_WARNINGS_BEGIN("tautological-compare")
</span></span></pre></div>
<a id="trunkSourceWebCorebindingsscriptstestJSJSTestCallTracercpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/scripts/test/JS/JSTestCallTracer.cpp (286346 => 286347)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/bindings/scripts/test/JS/JSTestCallTracer.cpp       2021-12-01 02:56:24 UTC (rev 286346)
+++ trunk/Source/WebCore/bindings/scripts/test/JS/JSTestCallTracer.cpp  2021-12-01 04:38:56 UTC (rev 286347)
</span><span class="lines">@@ -97,7 +97,7 @@
</span><span class="cx">     static JSC::IsoSubspace* subspaceFor(JSC::VM& vm)
</span><span class="cx">     {
</span><span class="cx">         STATIC_ASSERT_ISO_SUBSPACE_SHARABLE(JSTestCallTracerPrototype, Base);
</span><del>-        return &vm.plainObjectSpace;
</del><ins>+        return &vm.plainObjectSpace();
</ins><span class="cx">     }
</span><span class="cx">     static JSC::Structure* createStructure(JSC::VM& vm, JSC::JSGlobalObject* globalObject, JSC::JSValue prototype)
</span><span class="cx">     {
</span><span class="lines">@@ -513,9 +513,9 @@
</span><span class="cx">         return space;
</span><span class="cx">     static_assert(std::is_base_of_v<JSC::JSDestructibleObject, JSTestCallTracer> || !JSTestCallTracer::needsDestruction);
</span><span class="cx">     if constexpr (std::is_base_of_v<JSC::JSDestructibleObject, JSTestCallTracer>)
</span><del>-        spaces.m_subspaceForTestCallTracer = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, *vm.destructibleObjectHeapCellType, JSTestCallTracer);
</del><ins>+        spaces.m_subspaceForTestCallTracer = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, vm.destructibleObjectHeapCellType(), JSTestCallTracer);
</ins><span class="cx">     else
</span><del>-        spaces.m_subspaceForTestCallTracer = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, *vm.cellHeapCellType, JSTestCallTracer);
</del><ins>+        spaces.m_subspaceForTestCallTracer = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, vm.cellHeapCellType(), JSTestCallTracer);
</ins><span class="cx">     auto* space = spaces.m_subspaceForTestCallTracer.get();
</span><span class="cx"> IGNORE_WARNINGS_BEGIN("unreachable-code")
</span><span class="cx"> IGNORE_WARNINGS_BEGIN("tautological-compare")
</span></span></pre></div>
<a id="trunkSourceWebCorebindingsscriptstestJSJSTestClassWithJSBuiltinConstructorcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/scripts/test/JS/JSTestClassWithJSBuiltinConstructor.cpp (286346 => 286347)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/bindings/scripts/test/JS/JSTestClassWithJSBuiltinConstructor.cpp    2021-12-01 02:56:24 UTC (rev 286346)
+++ trunk/Source/WebCore/bindings/scripts/test/JS/JSTestClassWithJSBuiltinConstructor.cpp       2021-12-01 04:38:56 UTC (rev 286347)
</span><span class="lines">@@ -64,7 +64,7 @@
</span><span class="cx">     static JSC::IsoSubspace* subspaceFor(JSC::VM& vm)
</span><span class="cx">     {
</span><span class="cx">         STATIC_ASSERT_ISO_SUBSPACE_SHARABLE(JSTestClassWithJSBuiltinConstructorPrototype, Base);
</span><del>-        return &vm.plainObjectSpace;
</del><ins>+        return &vm.plainObjectSpace();
</ins><span class="cx">     }
</span><span class="cx">     static JSC::Structure* createStructure(JSC::VM& vm, JSC::JSGlobalObject* globalObject, JSC::JSValue prototype)
</span><span class="cx">     {
</span><span class="lines">@@ -176,9 +176,9 @@
</span><span class="cx">         return space;
</span><span class="cx">     static_assert(std::is_base_of_v<JSC::JSDestructibleObject, JSTestClassWithJSBuiltinConstructor> || !JSTestClassWithJSBuiltinConstructor::needsDestruction);
</span><span class="cx">     if constexpr (std::is_base_of_v<JSC::JSDestructibleObject, JSTestClassWithJSBuiltinConstructor>)
</span><del>-        spaces.m_subspaceForTestClassWithJSBuiltinConstructor = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, *vm.destructibleObjectHeapCellType, JSTestClassWithJSBuiltinConstructor);
</del><ins>+        spaces.m_subspaceForTestClassWithJSBuiltinConstructor = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, vm.destructibleObjectHeapCellType(), JSTestClassWithJSBuiltinConstructor);
</ins><span class="cx">     else
</span><del>-        spaces.m_subspaceForTestClassWithJSBuiltinConstructor = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, *vm.cellHeapCellType, JSTestClassWithJSBuiltinConstructor);
</del><ins>+        spaces.m_subspaceForTestClassWithJSBuiltinConstructor = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, vm.cellHeapCellType(), JSTestClassWithJSBuiltinConstructor);
</ins><span class="cx">     auto* space = spaces.m_subspaceForTestClassWithJSBuiltinConstructor.get();
</span><span class="cx"> IGNORE_WARNINGS_BEGIN("unreachable-code")
</span><span class="cx"> IGNORE_WARNINGS_BEGIN("tautological-compare")
</span></span></pre></div>
<a id="trunkSourceWebCorebindingsscriptstestJSJSTestConditionalIncludescpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/scripts/test/JS/JSTestConditionalIncludes.cpp (286346 => 286347)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/bindings/scripts/test/JS/JSTestConditionalIncludes.cpp      2021-12-01 02:56:24 UTC (rev 286346)
+++ trunk/Source/WebCore/bindings/scripts/test/JS/JSTestConditionalIncludes.cpp 2021-12-01 04:38:56 UTC (rev 286347)
</span><span class="lines">@@ -127,7 +127,7 @@
</span><span class="cx">     static JSC::IsoSubspace* subspaceFor(JSC::VM& vm)
</span><span class="cx">     {
</span><span class="cx">         STATIC_ASSERT_ISO_SUBSPACE_SHARABLE(JSTestConditionalIncludesPrototype, Base);
</span><del>-        return &vm.plainObjectSpace;
</del><ins>+        return &vm.plainObjectSpace();
</ins><span class="cx">     }
</span><span class="cx">     static JSC::Structure* createStructure(JSC::VM& vm, JSC::JSGlobalObject* globalObject, JSC::JSValue prototype)
</span><span class="cx">     {
</span><span class="lines">@@ -789,9 +789,9 @@
</span><span class="cx">         return space;
</span><span class="cx">     static_assert(std::is_base_of_v<JSC::JSDestructibleObject, JSTestConditionalIncludes> || !JSTestConditionalIncludes::needsDestruction);
</span><span class="cx">     if constexpr (std::is_base_of_v<JSC::JSDestructibleObject, JSTestConditionalIncludes>)
</span><del>-        spaces.m_subspaceForTestConditionalIncludes = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, *vm.destructibleObjectHeapCellType, JSTestConditionalIncludes);
</del><ins>+        spaces.m_subspaceForTestConditionalIncludes = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, vm.destructibleObjectHeapCellType(), JSTestConditionalIncludes);
</ins><span class="cx">     else
</span><del>-        spaces.m_subspaceForTestConditionalIncludes = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, *vm.cellHeapCellType, JSTestConditionalIncludes);
</del><ins>+        spaces.m_subspaceForTestConditionalIncludes = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, vm.cellHeapCellType(), JSTestConditionalIncludes);
</ins><span class="cx">     auto* space = spaces.m_subspaceForTestConditionalIncludes.get();
</span><span class="cx"> IGNORE_WARNINGS_BEGIN("unreachable-code")
</span><span class="cx"> IGNORE_WARNINGS_BEGIN("tautological-compare")
</span></span></pre></div>
<a id="trunkSourceWebCorebindingsscriptstestJSJSTestConditionallyReadWritecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/scripts/test/JS/JSTestConditionallyReadWrite.cpp (286346 => 286347)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/bindings/scripts/test/JS/JSTestConditionallyReadWrite.cpp   2021-12-01 02:56:24 UTC (rev 286346)
+++ trunk/Source/WebCore/bindings/scripts/test/JS/JSTestConditionallyReadWrite.cpp      2021-12-01 04:38:56 UTC (rev 286347)
</span><span class="lines">@@ -98,7 +98,7 @@
</span><span class="cx">     static JSC::IsoSubspace* subspaceFor(JSC::VM& vm)
</span><span class="cx">     {
</span><span class="cx">         STATIC_ASSERT_ISO_SUBSPACE_SHARABLE(JSTestConditionallyReadWritePrototype, Base);
</span><del>-        return &vm.plainObjectSpace;
</del><ins>+        return &vm.plainObjectSpace();
</ins><span class="cx">     }
</span><span class="cx">     static JSC::Structure* createStructure(JSC::VM& vm, JSC::JSGlobalObject* globalObject, JSC::JSValue prototype)
</span><span class="cx">     {
</span><span class="lines">@@ -611,9 +611,9 @@
</span><span class="cx">         return space;
</span><span class="cx">     static_assert(std::is_base_of_v<JSC::JSDestructibleObject, JSTestConditionallyReadWrite> || !JSTestConditionallyReadWrite::needsDestruction);
</span><span class="cx">     if constexpr (std::is_base_of_v<JSC::JSDestructibleObject, JSTestConditionallyReadWrite>)
</span><del>-        spaces.m_subspaceForTestConditionallyReadWrite = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, *vm.destructibleObjectHeapCellType, JSTestConditionallyReadWrite);
</del><ins>+        spaces.m_subspaceForTestConditionallyReadWrite = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, vm.destructibleObjectHeapCellType(), JSTestConditionallyReadWrite);
</ins><span class="cx">     else
</span><del>-        spaces.m_subspaceForTestConditionallyReadWrite = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, *vm.cellHeapCellType, JSTestConditionallyReadWrite);
</del><ins>+        spaces.m_subspaceForTestConditionallyReadWrite = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, vm.cellHeapCellType(), JSTestConditionallyReadWrite);
</ins><span class="cx">     auto* space = spaces.m_subspaceForTestConditionallyReadWrite.get();
</span><span class="cx"> IGNORE_WARNINGS_BEGIN("unreachable-code")
</span><span class="cx"> IGNORE_WARNINGS_BEGIN("tautological-compare")
</span></span></pre></div>
<a id="trunkSourceWebCorebindingsscriptstestJSJSTestDOMJITcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/scripts/test/JS/JSTestDOMJIT.cpp (286346 => 286347)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/bindings/scripts/test/JS/JSTestDOMJIT.cpp   2021-12-01 02:56:24 UTC (rev 286346)
+++ trunk/Source/WebCore/bindings/scripts/test/JS/JSTestDOMJIT.cpp      2021-12-01 04:38:56 UTC (rev 286347)
</span><span class="lines">@@ -481,7 +481,7 @@
</span><span class="cx">     static JSC::IsoSubspace* subspaceFor(JSC::VM& vm)
</span><span class="cx">     {
</span><span class="cx">         STATIC_ASSERT_ISO_SUBSPACE_SHARABLE(JSTestDOMJITPrototype, Base);
</span><del>-        return &vm.plainObjectSpace;
</del><ins>+        return &vm.plainObjectSpace();
</ins><span class="cx">     }
</span><span class="cx">     static JSC::Structure* createStructure(JSC::VM& vm, JSC::JSGlobalObject* globalObject, JSC::JSValue prototype)
</span><span class="cx">     {
</span><span class="lines">@@ -1252,9 +1252,9 @@
</span><span class="cx">         return space;
</span><span class="cx">     static_assert(std::is_base_of_v<JSC::JSDestructibleObject, JSTestDOMJIT> || !JSTestDOMJIT::needsDestruction);
</span><span class="cx">     if constexpr (std::is_base_of_v<JSC::JSDestructibleObject, JSTestDOMJIT>)
</span><del>-        spaces.m_subspaceForTestDOMJIT = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, *vm.destructibleObjectHeapCellType, JSTestDOMJIT);
</del><ins>+        spaces.m_subspaceForTestDOMJIT = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, vm.destructibleObjectHeapCellType(), JSTestDOMJIT);
</ins><span class="cx">     else
</span><del>-        spaces.m_subspaceForTestDOMJIT = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, *vm.cellHeapCellType, JSTestDOMJIT);
</del><ins>+        spaces.m_subspaceForTestDOMJIT = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, vm.cellHeapCellType(), JSTestDOMJIT);
</ins><span class="cx">     auto* space = spaces.m_subspaceForTestDOMJIT.get();
</span><span class="cx"> IGNORE_WARNINGS_BEGIN("unreachable-code")
</span><span class="cx"> IGNORE_WARNINGS_BEGIN("tautological-compare")
</span></span></pre></div>
<a id="trunkSourceWebCorebindingsscriptstestJSJSTestDefaultToJSONcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/scripts/test/JS/JSTestDefaultToJSON.cpp (286346 => 286347)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/bindings/scripts/test/JS/JSTestDefaultToJSON.cpp    2021-12-01 02:56:24 UTC (rev 286346)
+++ trunk/Source/WebCore/bindings/scripts/test/JS/JSTestDefaultToJSON.cpp       2021-12-01 04:38:56 UTC (rev 286347)
</span><span class="lines">@@ -124,7 +124,7 @@
</span><span class="cx">     static JSC::IsoSubspace* subspaceFor(JSC::VM& vm)
</span><span class="cx">     {
</span><span class="cx">         STATIC_ASSERT_ISO_SUBSPACE_SHARABLE(JSTestDefaultToJSONPrototype, Base);
</span><del>-        return &vm.plainObjectSpace;
</del><ins>+        return &vm.plainObjectSpace();
</ins><span class="cx">     }
</span><span class="cx">     static JSC::Structure* createStructure(JSC::VM& vm, JSC::JSGlobalObject* globalObject, JSC::JSValue prototype)
</span><span class="cx">     {
</span><span class="lines">@@ -808,9 +808,9 @@
</span><span class="cx">         return space;
</span><span class="cx">     static_assert(std::is_base_of_v<JSC::JSDestructibleObject, JSTestDefaultToJSON> || !JSTestDefaultToJSON::needsDestruction);
</span><span class="cx">     if constexpr (std::is_base_of_v<JSC::JSDestructibleObject, JSTestDefaultToJSON>)
</span><del>-        spaces.m_subspaceForTestDefaultToJSON = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, *vm.destructibleObjectHeapCellType, JSTestDefaultToJSON);
</del><ins>+        spaces.m_subspaceForTestDefaultToJSON = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, vm.destructibleObjectHeapCellType(), JSTestDefaultToJSON);
</ins><span class="cx">     else
</span><del>-        spaces.m_subspaceForTestDefaultToJSON = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, *vm.cellHeapCellType, JSTestDefaultToJSON);
</del><ins>+        spaces.m_subspaceForTestDefaultToJSON = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, vm.cellHeapCellType(), JSTestDefaultToJSON);
</ins><span class="cx">     auto* space = spaces.m_subspaceForTestDefaultToJSON.get();
</span><span class="cx"> IGNORE_WARNINGS_BEGIN("unreachable-code")
</span><span class="cx"> IGNORE_WARNINGS_BEGIN("tautological-compare")
</span></span></pre></div>
<a id="trunkSourceWebCorebindingsscriptstestJSJSTestDefaultToJSONFilteredByExposedcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/scripts/test/JS/JSTestDefaultToJSONFilteredByExposed.cpp (286346 => 286347)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/bindings/scripts/test/JS/JSTestDefaultToJSONFilteredByExposed.cpp   2021-12-01 02:56:24 UTC (rev 286346)
+++ trunk/Source/WebCore/bindings/scripts/test/JS/JSTestDefaultToJSONFilteredByExposed.cpp      2021-12-01 04:38:56 UTC (rev 286347)
</span><span class="lines">@@ -75,7 +75,7 @@
</span><span class="cx">     static JSC::IsoSubspace* subspaceFor(JSC::VM& vm)
</span><span class="cx">     {
</span><span class="cx">         STATIC_ASSERT_ISO_SUBSPACE_SHARABLE(JSTestDefaultToJSONFilteredByExposedPrototype, Base);
</span><del>-        return &vm.plainObjectSpace;
</del><ins>+        return &vm.plainObjectSpace();
</ins><span class="cx">     }
</span><span class="cx">     static JSC::Structure* createStructure(JSC::VM& vm, JSC::JSGlobalObject* globalObject, JSC::JSValue prototype)
</span><span class="cx">     {
</span><span class="lines">@@ -270,9 +270,9 @@
</span><span class="cx">         return space;
</span><span class="cx">     static_assert(std::is_base_of_v<JSC::JSDestructibleObject, JSTestDefaultToJSONFilteredByExposed> || !JSTestDefaultToJSONFilteredByExposed::needsDestruction);
</span><span class="cx">     if constexpr (std::is_base_of_v<JSC::JSDestructibleObject, JSTestDefaultToJSONFilteredByExposed>)
</span><del>-        spaces.m_subspaceForTestDefaultToJSONFilteredByExposed = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, *vm.destructibleObjectHeapCellType, JSTestDefaultToJSONFilteredByExposed);
</del><ins>+        spaces.m_subspaceForTestDefaultToJSONFilteredByExposed = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, vm.destructibleObjectHeapCellType(), JSTestDefaultToJSONFilteredByExposed);
</ins><span class="cx">     else
</span><del>-        spaces.m_subspaceForTestDefaultToJSONFilteredByExposed = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, *vm.cellHeapCellType, JSTestDefaultToJSONFilteredByExposed);
</del><ins>+        spaces.m_subspaceForTestDefaultToJSONFilteredByExposed = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, vm.cellHeapCellType(), JSTestDefaultToJSONFilteredByExposed);
</ins><span class="cx">     auto* space = spaces.m_subspaceForTestDefaultToJSONFilteredByExposed.get();
</span><span class="cx"> IGNORE_WARNINGS_BEGIN("unreachable-code")
</span><span class="cx"> IGNORE_WARNINGS_BEGIN("tautological-compare")
</span></span></pre></div>
<a id="trunkSourceWebCorebindingsscriptstestJSJSTestDefaultToJSONIndirectInheritancecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/scripts/test/JS/JSTestDefaultToJSONIndirectInheritance.cpp (286346 => 286347)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/bindings/scripts/test/JS/JSTestDefaultToJSONIndirectInheritance.cpp 2021-12-01 02:56:24 UTC (rev 286346)
+++ trunk/Source/WebCore/bindings/scripts/test/JS/JSTestDefaultToJSONIndirectInheritance.cpp    2021-12-01 04:38:56 UTC (rev 286347)
</span><span class="lines">@@ -62,7 +62,7 @@
</span><span class="cx">     static JSC::IsoSubspace* subspaceFor(JSC::VM& vm)
</span><span class="cx">     {
</span><span class="cx">         STATIC_ASSERT_ISO_SUBSPACE_SHARABLE(JSTestDefaultToJSONIndirectInheritancePrototype, Base);
</span><del>-        return &vm.plainObjectSpace;
</del><ins>+        return &vm.plainObjectSpace();
</ins><span class="cx">     }
</span><span class="cx">     static JSC::Structure* createStructure(JSC::VM& vm, JSC::JSGlobalObject* globalObject, JSC::JSValue prototype)
</span><span class="cx">     {
</span><span class="lines">@@ -162,9 +162,9 @@
</span><span class="cx">         return space;
</span><span class="cx">     static_assert(std::is_base_of_v<JSC::JSDestructibleObject, JSTestDefaultToJSONIndirectInheritance> || !JSTestDefaultToJSONIndirectInheritance::needsDestruction);
</span><span class="cx">     if constexpr (std::is_base_of_v<JSC::JSDestructibleObject, JSTestDefaultToJSONIndirectInheritance>)
</span><del>-        spaces.m_subspaceForTestDefaultToJSONIndirectInheritance = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, *vm.destructibleObjectHeapCellType, JSTestDefaultToJSONIndirectInheritance);
</del><ins>+        spaces.m_subspaceForTestDefaultToJSONIndirectInheritance = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, vm.destructibleObjectHeapCellType(), JSTestDefaultToJSONIndirectInheritance);
</ins><span class="cx">     else
</span><del>-        spaces.m_subspaceForTestDefaultToJSONIndirectInheritance = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, *vm.cellHeapCellType, JSTestDefaultToJSONIndirectInheritance);
</del><ins>+        spaces.m_subspaceForTestDefaultToJSONIndirectInheritance = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, vm.cellHeapCellType(), JSTestDefaultToJSONIndirectInheritance);
</ins><span class="cx">     auto* space = spaces.m_subspaceForTestDefaultToJSONIndirectInheritance.get();
</span><span class="cx"> IGNORE_WARNINGS_BEGIN("unreachable-code")
</span><span class="cx"> IGNORE_WARNINGS_BEGIN("tautological-compare")
</span></span></pre></div>
<a id="trunkSourceWebCorebindingsscriptstestJSJSTestDefaultToJSONInheritcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/scripts/test/JS/JSTestDefaultToJSONInherit.cpp (286346 => 286347)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/bindings/scripts/test/JS/JSTestDefaultToJSONInherit.cpp     2021-12-01 02:56:24 UTC (rev 286346)
+++ trunk/Source/WebCore/bindings/scripts/test/JS/JSTestDefaultToJSONInherit.cpp        2021-12-01 04:38:56 UTC (rev 286347)
</span><span class="lines">@@ -89,7 +89,7 @@
</span><span class="cx">     static JSC::IsoSubspace* subspaceFor(JSC::VM& vm)
</span><span class="cx">     {
</span><span class="cx">         STATIC_ASSERT_ISO_SUBSPACE_SHARABLE(JSTestDefaultToJSONInheritPrototype, Base);
</span><del>-        return &vm.plainObjectSpace;
</del><ins>+        return &vm.plainObjectSpace();
</ins><span class="cx">     }
</span><span class="cx">     static JSC::Structure* createStructure(JSC::VM& vm, JSC::JSGlobalObject* globalObject, JSC::JSValue prototype)
</span><span class="cx">     {
</span><span class="lines">@@ -292,9 +292,9 @@
</span><span class="cx">         return space;
</span><span class="cx">     static_assert(std::is_base_of_v<JSC::JSDestructibleObject, JSTestDefaultToJSONInherit> || !JSTestDefaultToJSONInherit::needsDestruction);
</span><span class="cx">     if constexpr (std::is_base_of_v<JSC::JSDestructibleObject, JSTestDefaultToJSONInherit>)
</span><del>-        spaces.m_subspaceForTestDefaultToJSONInherit = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, *vm.destructibleObjectHeapCellType, JSTestDefaultToJSONInherit);
</del><ins>+        spaces.m_subspaceForTestDefaultToJSONInherit = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, vm.destructibleObjectHeapCellType(), JSTestDefaultToJSONInherit);
</ins><span class="cx">     else
</span><del>-        spaces.m_subspaceForTestDefaultToJSONInherit = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, *vm.cellHeapCellType, JSTestDefaultToJSONInherit);
</del><ins>+        spaces.m_subspaceForTestDefaultToJSONInherit = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, vm.cellHeapCellType(), JSTestDefaultToJSONInherit);
</ins><span class="cx">     auto* space = spaces.m_subspaceForTestDefaultToJSONInherit.get();
</span><span class="cx"> IGNORE_WARNINGS_BEGIN("unreachable-code")
</span><span class="cx"> IGNORE_WARNINGS_BEGIN("tautological-compare")
</span></span></pre></div>
<a id="trunkSourceWebCorebindingsscriptstestJSJSTestDefaultToJSONInheritFinalcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/scripts/test/JS/JSTestDefaultToJSONInheritFinal.cpp (286346 => 286347)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/bindings/scripts/test/JS/JSTestDefaultToJSONInheritFinal.cpp        2021-12-01 02:56:24 UTC (rev 286346)
+++ trunk/Source/WebCore/bindings/scripts/test/JS/JSTestDefaultToJSONInheritFinal.cpp   2021-12-01 04:38:56 UTC (rev 286347)
</span><span class="lines">@@ -91,7 +91,7 @@
</span><span class="cx">     static JSC::IsoSubspace* subspaceFor(JSC::VM& vm)
</span><span class="cx">     {
</span><span class="cx">         STATIC_ASSERT_ISO_SUBSPACE_SHARABLE(JSTestDefaultToJSONInheritFinalPrototype, Base);
</span><del>-        return &vm.plainObjectSpace;
</del><ins>+        return &vm.plainObjectSpace();
</ins><span class="cx">     }
</span><span class="cx">     static JSC::Structure* createStructure(JSC::VM& vm, JSC::JSGlobalObject* globalObject, JSC::JSValue prototype)
</span><span class="cx">     {
</span><span class="lines">@@ -332,9 +332,9 @@
</span><span class="cx">         return space;
</span><span class="cx">     static_assert(std::is_base_of_v<JSC::JSDestructibleObject, JSTestDefaultToJSONInheritFinal> || !JSTestDefaultToJSONInheritFinal::needsDestruction);
</span><span class="cx">     if constexpr (std::is_base_of_v<JSC::JSDestructibleObject, JSTestDefaultToJSONInheritFinal>)
</span><del>-        spaces.m_subspaceForTestDefaultToJSONInheritFinal = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, *vm.destructibleObjectHeapCellType, JSTestDefaultToJSONInheritFinal);
</del><ins>+        spaces.m_subspaceForTestDefaultToJSONInheritFinal = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, vm.destructibleObjectHeapCellType(), JSTestDefaultToJSONInheritFinal);
</ins><span class="cx">     else
</span><del>-        spaces.m_subspaceForTestDefaultToJSONInheritFinal = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, *vm.cellHeapCellType, JSTestDefaultToJSONInheritFinal);
</del><ins>+        spaces.m_subspaceForTestDefaultToJSONInheritFinal = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, vm.cellHeapCellType(), JSTestDefaultToJSONInheritFinal);
</ins><span class="cx">     auto* space = spaces.m_subspaceForTestDefaultToJSONInheritFinal.get();
</span><span class="cx"> IGNORE_WARNINGS_BEGIN("unreachable-code")
</span><span class="cx"> IGNORE_WARNINGS_BEGIN("tautological-compare")
</span></span></pre></div>
<a id="trunkSourceWebCorebindingsscriptstestJSJSTestDelegateToSharedSyntheticAttributecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/scripts/test/JS/JSTestDelegateToSharedSyntheticAttribute.cpp (286346 => 286347)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/bindings/scripts/test/JS/JSTestDelegateToSharedSyntheticAttribute.cpp       2021-12-01 02:56:24 UTC (rev 286346)
+++ trunk/Source/WebCore/bindings/scripts/test/JS/JSTestDelegateToSharedSyntheticAttribute.cpp  2021-12-01 04:38:56 UTC (rev 286347)
</span><span class="lines">@@ -70,7 +70,7 @@
</span><span class="cx">     static JSC::IsoSubspace* subspaceFor(JSC::VM& vm)
</span><span class="cx">     {
</span><span class="cx">         STATIC_ASSERT_ISO_SUBSPACE_SHARABLE(JSTestDelegateToSharedSyntheticAttributePrototype, Base);
</span><del>-        return &vm.plainObjectSpace;
</del><ins>+        return &vm.plainObjectSpace();
</ins><span class="cx">     }
</span><span class="cx">     static JSC::Structure* createStructure(JSC::VM& vm, JSC::JSGlobalObject* globalObject, JSC::JSValue prototype)
</span><span class="cx">     {
</span><span class="lines">@@ -246,9 +246,9 @@
</span><span class="cx">         return space;
</span><span class="cx">     static_assert(std::is_base_of_v<JSC::JSDestructibleObject, JSTestDelegateToSharedSyntheticAttribute> || !JSTestDelegateToSharedSyntheticAttribute::needsDestruction);
</span><span class="cx">     if constexpr (std::is_base_of_v<JSC::JSDestructibleObject, JSTestDelegateToSharedSyntheticAttribute>)
</span><del>-        spaces.m_subspaceForTestDelegateToSharedSyntheticAttribute = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, *vm.destructibleObjectHeapCellType, JSTestDelegateToSharedSyntheticAttribute);
</del><ins>+        spaces.m_subspaceForTestDelegateToSharedSyntheticAttribute = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, vm.destructibleObjectHeapCellType(), JSTestDelegateToSharedSyntheticAttribute);
</ins><span class="cx">     else
</span><del>-        spaces.m_subspaceForTestDelegateToSharedSyntheticAttribute = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, *vm.cellHeapCellType, JSTestDelegateToSharedSyntheticAttribute);
</del><ins>+        spaces.m_subspaceForTestDelegateToSharedSyntheticAttribute = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, vm.cellHeapCellType(), JSTestDelegateToSharedSyntheticAttribute);
</ins><span class="cx">     auto* space = spaces.m_subspaceForTestDelegateToSharedSyntheticAttribute.get();
</span><span class="cx"> IGNORE_WARNINGS_BEGIN("unreachable-code")
</span><span class="cx"> IGNORE_WARNINGS_BEGIN("tautological-compare")
</span></span></pre></div>
<a id="trunkSourceWebCorebindingsscriptstestJSJSTestDomainSecuritycpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/scripts/test/JS/JSTestDomainSecurity.cpp (286346 => 286347)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/bindings/scripts/test/JS/JSTestDomainSecurity.cpp   2021-12-01 02:56:24 UTC (rev 286346)
+++ trunk/Source/WebCore/bindings/scripts/test/JS/JSTestDomainSecurity.cpp      2021-12-01 04:38:56 UTC (rev 286347)
</span><span class="lines">@@ -80,7 +80,7 @@
</span><span class="cx">     static JSC::IsoSubspace* subspaceFor(JSC::VM& vm)
</span><span class="cx">     {
</span><span class="cx">         STATIC_ASSERT_ISO_SUBSPACE_SHARABLE(JSTestDomainSecurityPrototype, Base);
</span><del>-        return &vm.plainObjectSpace;
</del><ins>+        return &vm.plainObjectSpace();
</ins><span class="cx">     }
</span><span class="cx">     static JSC::Structure* createStructure(JSC::VM& vm, JSC::JSGlobalObject* globalObject, JSC::JSValue prototype)
</span><span class="cx">     {
</span><span class="lines">@@ -320,9 +320,9 @@
</span><span class="cx">         return space;
</span><span class="cx">     static_assert(std::is_base_of_v<JSC::JSDestructibleObject, JSTestDomainSecurity> || !JSTestDomainSecurity::needsDestruction);
</span><span class="cx">     if constexpr (std::is_base_of_v<JSC::JSDestructibleObject, JSTestDomainSecurity>)
</span><del>-        spaces.m_subspaceForTestDomainSecurity = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, *vm.destructibleObjectHeapCellType, JSTestDomainSecurity);
</del><ins>+        spaces.m_subspaceForTestDomainSecurity = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, vm.destructibleObjectHeapCellType(), JSTestDomainSecurity);
</ins><span class="cx">     else
</span><del>-        spaces.m_subspaceForTestDomainSecurity = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, *vm.cellHeapCellType, JSTestDomainSecurity);
</del><ins>+        spaces.m_subspaceForTestDomainSecurity = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, vm.cellHeapCellType(), JSTestDomainSecurity);
</ins><span class="cx">     auto* space = spaces.m_subspaceForTestDomainSecurity.get();
</span><span class="cx"> IGNORE_WARNINGS_BEGIN("unreachable-code")
</span><span class="cx"> IGNORE_WARNINGS_BEGIN("tautological-compare")
</span></span></pre></div>
<a id="trunkSourceWebCorebindingsscriptstestJSJSTestEnabledBySettingcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/scripts/test/JS/JSTestEnabledBySetting.cpp (286346 => 286347)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/bindings/scripts/test/JS/JSTestEnabledBySetting.cpp 2021-12-01 02:56:24 UTC (rev 286346)
+++ trunk/Source/WebCore/bindings/scripts/test/JS/JSTestEnabledBySetting.cpp    2021-12-01 04:38:56 UTC (rev 286347)
</span><span class="lines">@@ -92,7 +92,7 @@
</span><span class="cx">     static JSC::IsoSubspace* subspaceFor(JSC::VM& vm)
</span><span class="cx">     {
</span><span class="cx">         STATIC_ASSERT_ISO_SUBSPACE_SHARABLE(JSTestEnabledBySettingPrototype, Base);
</span><del>-        return &vm.plainObjectSpace;
</del><ins>+        return &vm.plainObjectSpace();
</ins><span class="cx">     }
</span><span class="cx">     static JSC::Structure* createStructure(JSC::VM& vm, JSC::JSGlobalObject* globalObject, JSC::JSValue prototype)
</span><span class="cx">     {
</span><span class="lines">@@ -459,9 +459,9 @@
</span><span class="cx">         return space;
</span><span class="cx">     static_assert(std::is_base_of_v<JSC::JSDestructibleObject, JSTestEnabledBySetting> || !JSTestEnabledBySetting::needsDestruction);
</span><span class="cx">     if constexpr (std::is_base_of_v<JSC::JSDestructibleObject, JSTestEnabledBySetting>)
</span><del>-        spaces.m_subspaceForTestEnabledBySetting = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, *vm.destructibleObjectHeapCellType, JSTestEnabledBySetting);
</del><ins>+        spaces.m_subspaceForTestEnabledBySetting = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, vm.destructibleObjectHeapCellType(), JSTestEnabledBySetting);
</ins><span class="cx">     else
</span><del>-        spaces.m_subspaceForTestEnabledBySetting = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, *vm.cellHeapCellType, JSTestEnabledBySetting);
</del><ins>+        spaces.m_subspaceForTestEnabledBySetting = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, vm.cellHeapCellType(), JSTestEnabledBySetting);
</ins><span class="cx">     auto* space = spaces.m_subspaceForTestEnabledBySetting.get();
</span><span class="cx"> IGNORE_WARNINGS_BEGIN("unreachable-code")
</span><span class="cx"> IGNORE_WARNINGS_BEGIN("tautological-compare")
</span></span></pre></div>
<a id="trunkSourceWebCorebindingsscriptstestJSJSTestEnabledForContextcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/scripts/test/JS/JSTestEnabledForContext.cpp (286346 => 286347)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/bindings/scripts/test/JS/JSTestEnabledForContext.cpp        2021-12-01 02:56:24 UTC (rev 286346)
+++ trunk/Source/WebCore/bindings/scripts/test/JS/JSTestEnabledForContext.cpp   2021-12-01 04:38:56 UTC (rev 286347)
</span><span class="lines">@@ -66,7 +66,7 @@
</span><span class="cx">     static JSC::IsoSubspace* subspaceFor(JSC::VM& vm)
</span><span class="cx">     {
</span><span class="cx">         STATIC_ASSERT_ISO_SUBSPACE_SHARABLE(JSTestEnabledForContextPrototype, Base);
</span><del>-        return &vm.plainObjectSpace;
</del><ins>+        return &vm.plainObjectSpace();
</ins><span class="cx">     }
</span><span class="cx">     static JSC::Structure* createStructure(JSC::VM& vm, JSC::JSGlobalObject* globalObject, JSC::JSValue prototype)
</span><span class="cx">     {
</span><span class="lines">@@ -186,9 +186,9 @@
</span><span class="cx">         return space;
</span><span class="cx">     static_assert(std::is_base_of_v<JSC::JSDestructibleObject, JSTestEnabledForContext> || !JSTestEnabledForContext::needsDestruction);
</span><span class="cx">     if constexpr (std::is_base_of_v<JSC::JSDestructibleObject, JSTestEnabledForContext>)
</span><del>-        spaces.m_subspaceForTestEnabledForContext = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, *vm.destructibleObjectHeapCellType, JSTestEnabledForContext);
</del><ins>+        spaces.m_subspaceForTestEnabledForContext = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, vm.destructibleObjectHeapCellType(), JSTestEnabledForContext);
</ins><span class="cx">     else
</span><del>-        spaces.m_subspaceForTestEnabledForContext = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, *vm.cellHeapCellType, JSTestEnabledForContext);
</del><ins>+        spaces.m_subspaceForTestEnabledForContext = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, vm.cellHeapCellType(), JSTestEnabledForContext);
</ins><span class="cx">     auto* space = spaces.m_subspaceForTestEnabledForContext.get();
</span><span class="cx"> IGNORE_WARNINGS_BEGIN("unreachable-code")
</span><span class="cx"> IGNORE_WARNINGS_BEGIN("tautological-compare")
</span></span></pre></div>
<a id="trunkSourceWebCorebindingsscriptstestJSJSTestEventConstructorcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/scripts/test/JS/JSTestEventConstructor.cpp (286346 => 286347)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/bindings/scripts/test/JS/JSTestEventConstructor.cpp 2021-12-01 02:56:24 UTC (rev 286346)
+++ trunk/Source/WebCore/bindings/scripts/test/JS/JSTestEventConstructor.cpp    2021-12-01 04:38:56 UTC (rev 286347)
</span><span class="lines">@@ -147,7 +147,7 @@
</span><span class="cx">     static JSC::IsoSubspace* subspaceFor(JSC::VM& vm)
</span><span class="cx">     {
</span><span class="cx">         STATIC_ASSERT_ISO_SUBSPACE_SHARABLE(JSTestEventConstructorPrototype, Base);
</span><del>-        return &vm.plainObjectSpace;
</del><ins>+        return &vm.plainObjectSpace();
</ins><span class="cx">     }
</span><span class="cx">     static JSC::Structure* createStructure(JSC::VM& vm, JSC::JSGlobalObject* globalObject, JSC::JSValue prototype)
</span><span class="cx">     {
</span><span class="lines">@@ -321,9 +321,9 @@
</span><span class="cx">         return space;
</span><span class="cx">     static_assert(std::is_base_of_v<JSC::JSDestructibleObject, JSTestEventConstructor> || !JSTestEventConstructor::needsDestruction);
</span><span class="cx">     if constexpr (std::is_base_of_v<JSC::JSDestructibleObject, JSTestEventConstructor>)
</span><del>-        spaces.m_subspaceForTestEventConstructor = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, *vm.destructibleObjectHeapCellType, JSTestEventConstructor);
</del><ins>+        spaces.m_subspaceForTestEventConstructor = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, vm.destructibleObjectHeapCellType(), JSTestEventConstructor);
</ins><span class="cx">     else
</span><del>-        spaces.m_subspaceForTestEventConstructor = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, *vm.cellHeapCellType, JSTestEventConstructor);
</del><ins>+        spaces.m_subspaceForTestEventConstructor = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, vm.cellHeapCellType(), JSTestEventConstructor);
</ins><span class="cx">     auto* space = spaces.m_subspaceForTestEventConstructor.get();
</span><span class="cx"> IGNORE_WARNINGS_BEGIN("unreachable-code")
</span><span class="cx"> IGNORE_WARNINGS_BEGIN("tautological-compare")
</span></span></pre></div>
<a id="trunkSourceWebCorebindingsscriptstestJSJSTestEventTargetcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/scripts/test/JS/JSTestEventTarget.cpp (286346 => 286347)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/bindings/scripts/test/JS/JSTestEventTarget.cpp      2021-12-01 02:56:24 UTC (rev 286346)
+++ trunk/Source/WebCore/bindings/scripts/test/JS/JSTestEventTarget.cpp 2021-12-01 04:38:56 UTC (rev 286347)
</span><span class="lines">@@ -73,7 +73,7 @@
</span><span class="cx">     static JSC::IsoSubspace* subspaceFor(JSC::VM& vm)
</span><span class="cx">     {
</span><span class="cx">         STATIC_ASSERT_ISO_SUBSPACE_SHARABLE(JSTestEventTargetPrototype, Base);
</span><del>-        return &vm.plainObjectSpace;
</del><ins>+        return &vm.plainObjectSpace();
</ins><span class="cx">     }
</span><span class="cx">     static JSC::Structure* createStructure(JSC::VM& vm, JSC::JSGlobalObject* globalObject, JSC::JSValue prototype)
</span><span class="cx">     {
</span><span class="lines">@@ -262,9 +262,9 @@
</span><span class="cx">         return space;
</span><span class="cx">     static_assert(std::is_base_of_v<JSC::JSDestructibleObject, JSTestEventTarget> || !JSTestEventTarget::needsDestruction);
</span><span class="cx">     if constexpr (std::is_base_of_v<JSC::JSDestructibleObject, JSTestEventTarget>)
</span><del>-        spaces.m_subspaceForTestEventTarget = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, *vm.destructibleObjectHeapCellType, JSTestEventTarget);
</del><ins>+        spaces.m_subspaceForTestEventTarget = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, vm.destructibleObjectHeapCellType(), JSTestEventTarget);
</ins><span class="cx">     else
</span><del>-        spaces.m_subspaceForTestEventTarget = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, *vm.cellHeapCellType, JSTestEventTarget);
</del><ins>+        spaces.m_subspaceForTestEventTarget = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, vm.cellHeapCellType(), JSTestEventTarget);
</ins><span class="cx">     auto* space = spaces.m_subspaceForTestEventTarget.get();
</span><span class="cx"> IGNORE_WARNINGS_BEGIN("unreachable-code")
</span><span class="cx"> IGNORE_WARNINGS_BEGIN("tautological-compare")
</span></span></pre></div>
<a id="trunkSourceWebCorebindingsscriptstestJSJSTestExceptioncpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/scripts/test/JS/JSTestException.cpp (286346 => 286347)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/bindings/scripts/test/JS/JSTestException.cpp        2021-12-01 02:56:24 UTC (rev 286346)
+++ trunk/Source/WebCore/bindings/scripts/test/JS/JSTestException.cpp   2021-12-01 04:38:56 UTC (rev 286347)
</span><span class="lines">@@ -66,7 +66,7 @@
</span><span class="cx">     static JSC::IsoSubspace* subspaceFor(JSC::VM& vm)
</span><span class="cx">     {
</span><span class="cx">         STATIC_ASSERT_ISO_SUBSPACE_SHARABLE(JSTestExceptionPrototype, Base);
</span><del>-        return &vm.plainObjectSpace;
</del><ins>+        return &vm.plainObjectSpace();
</ins><span class="cx">     }
</span><span class="cx">     static JSC::Structure* createStructure(JSC::VM& vm, JSC::JSGlobalObject* globalObject, JSC::JSValue prototype)
</span><span class="cx">     {
</span><span class="lines">@@ -187,9 +187,9 @@
</span><span class="cx">         return space;
</span><span class="cx">     static_assert(std::is_base_of_v<JSC::JSDestructibleObject, JSTestException> || !JSTestException::needsDestruction);
</span><span class="cx">     if constexpr (std::is_base_of_v<JSC::JSDestructibleObject, JSTestException>)
</span><del>-        spaces.m_subspaceForTestException = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, *vm.destructibleObjectHeapCellType, JSTestException);
</del><ins>+        spaces.m_subspaceForTestException = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, vm.destructibleObjectHeapCellType(), JSTestException);
</ins><span class="cx">     else
</span><del>-        spaces.m_subspaceForTestException = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, *vm.cellHeapCellType, JSTestException);
</del><ins>+        spaces.m_subspaceForTestException = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, vm.cellHeapCellType(), JSTestException);
</ins><span class="cx">     auto* space = spaces.m_subspaceForTestException.get();
</span><span class="cx"> IGNORE_WARNINGS_BEGIN("unreachable-code")
</span><span class="cx"> IGNORE_WARNINGS_BEGIN("tautological-compare")
</span></span></pre></div>
<a id="trunkSourceWebCorebindingsscriptstestJSJSTestGenerateAddOpaqueRootcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/scripts/test/JS/JSTestGenerateAddOpaqueRoot.cpp (286346 => 286347)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/bindings/scripts/test/JS/JSTestGenerateAddOpaqueRoot.cpp    2021-12-01 02:56:24 UTC (rev 286346)
+++ trunk/Source/WebCore/bindings/scripts/test/JS/JSTestGenerateAddOpaqueRoot.cpp       2021-12-01 04:38:56 UTC (rev 286347)
</span><span class="lines">@@ -66,7 +66,7 @@
</span><span class="cx">     static JSC::IsoSubspace* subspaceFor(JSC::VM& vm)
</span><span class="cx">     {
</span><span class="cx">         STATIC_ASSERT_ISO_SUBSPACE_SHARABLE(JSTestGenerateAddOpaqueRootPrototype, Base);
</span><del>-        return &vm.plainObjectSpace;
</del><ins>+        return &vm.plainObjectSpace();
</ins><span class="cx">     }
</span><span class="cx">     static JSC::Structure* createStructure(JSC::VM& vm, JSC::JSGlobalObject* globalObject, JSC::JSValue prototype)
</span><span class="cx">     {
</span><span class="lines">@@ -187,9 +187,9 @@
</span><span class="cx">         return space;
</span><span class="cx">     static_assert(std::is_base_of_v<JSC::JSDestructibleObject, JSTestGenerateAddOpaqueRoot> || !JSTestGenerateAddOpaqueRoot::needsDestruction);
</span><span class="cx">     if constexpr (std::is_base_of_v<JSC::JSDestructibleObject, JSTestGenerateAddOpaqueRoot>)
</span><del>-        spaces.m_subspaceForTestGenerateAddOpaqueRoot = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, *vm.destructibleObjectHeapCellType, JSTestGenerateAddOpaqueRoot);
</del><ins>+        spaces.m_subspaceForTestGenerateAddOpaqueRoot = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, vm.destructibleObjectHeapCellType(), JSTestGenerateAddOpaqueRoot);
</ins><span class="cx">     else
</span><del>-        spaces.m_subspaceForTestGenerateAddOpaqueRoot = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, *vm.cellHeapCellType, JSTestGenerateAddOpaqueRoot);
</del><ins>+        spaces.m_subspaceForTestGenerateAddOpaqueRoot = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, vm.cellHeapCellType(), JSTestGenerateAddOpaqueRoot);
</ins><span class="cx">     auto* space = spaces.m_subspaceForTestGenerateAddOpaqueRoot.get();
</span><span class="cx"> IGNORE_WARNINGS_BEGIN("unreachable-code")
</span><span class="cx"> IGNORE_WARNINGS_BEGIN("tautological-compare")
</span></span></pre></div>
<a id="trunkSourceWebCorebindingsscriptstestJSJSTestGenerateIsReachablecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/scripts/test/JS/JSTestGenerateIsReachable.cpp (286346 => 286347)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/bindings/scripts/test/JS/JSTestGenerateIsReachable.cpp      2021-12-01 02:56:24 UTC (rev 286346)
+++ trunk/Source/WebCore/bindings/scripts/test/JS/JSTestGenerateIsReachable.cpp 2021-12-01 04:38:56 UTC (rev 286347)
</span><span class="lines">@@ -66,7 +66,7 @@
</span><span class="cx">     static JSC::IsoSubspace* subspaceFor(JSC::VM& vm)
</span><span class="cx">     {
</span><span class="cx">         STATIC_ASSERT_ISO_SUBSPACE_SHARABLE(JSTestGenerateIsReachablePrototype, Base);
</span><del>-        return &vm.plainObjectSpace;
</del><ins>+        return &vm.plainObjectSpace();
</ins><span class="cx">     }
</span><span class="cx">     static JSC::Structure* createStructure(JSC::VM& vm, JSC::JSGlobalObject* globalObject, JSC::JSValue prototype)
</span><span class="cx">     {
</span><span class="lines">@@ -197,9 +197,9 @@
</span><span class="cx">         return space;
</span><span class="cx">     static_assert(std::is_base_of_v<JSC::JSDestructibleObject, JSTestGenerateIsReachable> || !JSTestGenerateIsReachable::needsDestruction);
</span><span class="cx">     if constexpr (std::is_base_of_v<JSC::JSDestructibleObject, JSTestGenerateIsReachable>)
</span><del>-        spaces.m_subspaceForTestGenerateIsReachable = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, *vm.destructibleObjectHeapCellType, JSTestGenerateIsReachable);
</del><ins>+        spaces.m_subspaceForTestGenerateIsReachable = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, vm.destructibleObjectHeapCellType(), JSTestGenerateIsReachable);
</ins><span class="cx">     else
</span><del>-        spaces.m_subspaceForTestGenerateIsReachable = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, *vm.cellHeapCellType, JSTestGenerateIsReachable);
</del><ins>+        spaces.m_subspaceForTestGenerateIsReachable = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, vm.cellHeapCellType(), JSTestGenerateIsReachable);
</ins><span class="cx">     auto* space = spaces.m_subspaceForTestGenerateIsReachable.get();
</span><span class="cx"> IGNORE_WARNINGS_BEGIN("unreachable-code")
</span><span class="cx"> IGNORE_WARNINGS_BEGIN("tautological-compare")
</span></span></pre></div>
<a id="trunkSourceWebCorebindingsscriptstestJSJSTestGlobalObjectcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/scripts/test/JS/JSTestGlobalObject.cpp (286346 => 286347)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/bindings/scripts/test/JS/JSTestGlobalObject.cpp     2021-12-01 02:56:24 UTC (rev 286346)
+++ trunk/Source/WebCore/bindings/scripts/test/JS/JSTestGlobalObject.cpp        2021-12-01 04:38:56 UTC (rev 286347)
</span><span class="lines">@@ -1814,7 +1814,7 @@
</span><span class="cx">     auto& spaces = clientData.subspaces();
</span><span class="cx">     if (auto* space = spaces.m_subspaceForTestGlobalObject.get())
</span><span class="cx">         return space;
</span><del>-    spaces.m_subspaceForTestGlobalObject = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, *clientData.m_heapCellTypeForJSTestGlobalObject, JSTestGlobalObject);
</del><ins>+    spaces.m_subspaceForTestGlobalObject = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, clientData.m_heapCellTypeForJSTestGlobalObject, JSTestGlobalObject);
</ins><span class="cx">     auto* space = spaces.m_subspaceForTestGlobalObject.get();
</span><span class="cx"> IGNORE_WARNINGS_BEGIN("unreachable-code")
</span><span class="cx"> IGNORE_WARNINGS_BEGIN("tautological-compare")
</span></span></pre></div>
<a id="trunkSourceWebCorebindingsscriptstestJSJSTestGlobalObjecth"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/scripts/test/JS/JSTestGlobalObject.h (286346 => 286347)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/bindings/scripts/test/JS/JSTestGlobalObject.h       2021-12-01 02:56:24 UTC (rev 286346)
+++ trunk/Source/WebCore/bindings/scripts/test/JS/JSTestGlobalObject.h  2021-12-01 04:38:56 UTC (rev 286347)
</span><span class="lines">@@ -98,7 +98,7 @@
</span><span class="cx">     static JSC::IsoSubspace* subspaceFor(JSC::VM& vm)
</span><span class="cx">     {
</span><span class="cx">         STATIC_ASSERT_ISO_SUBSPACE_SHARABLE(JSTestGlobalObjectPrototype, Base);
</span><del>-        return &vm.plainObjectSpace;
</del><ins>+        return &vm.plainObjectSpace();
</ins><span class="cx">     }
</span><span class="cx">     static JSC::Structure* createStructure(JSC::VM& vm, JSC::JSGlobalObject* globalObject, JSC::JSValue prototype)
</span><span class="cx">     {
</span></span></pre></div>
<a id="trunkSourceWebCorebindingsscriptstestJSJSTestIndexedSetterNoIdentifiercpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/scripts/test/JS/JSTestIndexedSetterNoIdentifier.cpp (286346 => 286347)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/bindings/scripts/test/JS/JSTestIndexedSetterNoIdentifier.cpp        2021-12-01 02:56:24 UTC (rev 286346)
+++ trunk/Source/WebCore/bindings/scripts/test/JS/JSTestIndexedSetterNoIdentifier.cpp   2021-12-01 04:38:56 UTC (rev 286347)
</span><span class="lines">@@ -65,7 +65,7 @@
</span><span class="cx">     static JSC::IsoSubspace* subspaceFor(JSC::VM& vm)
</span><span class="cx">     {
</span><span class="cx">         STATIC_ASSERT_ISO_SUBSPACE_SHARABLE(JSTestIndexedSetterNoIdentifierPrototype, Base);
</span><del>-        return &vm.plainObjectSpace;
</del><ins>+        return &vm.plainObjectSpace();
</ins><span class="cx">     }
</span><span class="cx">     static JSC::Structure* createStructure(JSC::VM& vm, JSC::JSGlobalObject* globalObject, JSC::JSValue prototype)
</span><span class="cx">     {
</span><span class="lines">@@ -276,9 +276,9 @@
</span><span class="cx">         return space;
</span><span class="cx">     static_assert(std::is_base_of_v<JSC::JSDestructibleObject, JSTestIndexedSetterNoIdentifier> || !JSTestIndexedSetterNoIdentifier::needsDestruction);
</span><span class="cx">     if constexpr (std::is_base_of_v<JSC::JSDestructibleObject, JSTestIndexedSetterNoIdentifier>)
</span><del>-        spaces.m_subspaceForTestIndexedSetterNoIdentifier = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, *vm.destructibleObjectHeapCellType, JSTestIndexedSetterNoIdentifier);
</del><ins>+        spaces.m_subspaceForTestIndexedSetterNoIdentifier = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, vm.destructibleObjectHeapCellType(), JSTestIndexedSetterNoIdentifier);
</ins><span class="cx">     else
</span><del>-        spaces.m_subspaceForTestIndexedSetterNoIdentifier = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, *vm.cellHeapCellType, JSTestIndexedSetterNoIdentifier);
</del><ins>+        spaces.m_subspaceForTestIndexedSetterNoIdentifier = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, vm.cellHeapCellType(), JSTestIndexedSetterNoIdentifier);
</ins><span class="cx">     auto* space = spaces.m_subspaceForTestIndexedSetterNoIdentifier.get();
</span><span class="cx"> IGNORE_WARNINGS_BEGIN("unreachable-code")
</span><span class="cx"> IGNORE_WARNINGS_BEGIN("tautological-compare")
</span></span></pre></div>
<a id="trunkSourceWebCorebindingsscriptstestJSJSTestIndexedSetterThrowingExceptioncpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/scripts/test/JS/JSTestIndexedSetterThrowingException.cpp (286346 => 286347)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/bindings/scripts/test/JS/JSTestIndexedSetterThrowingException.cpp   2021-12-01 02:56:24 UTC (rev 286346)
+++ trunk/Source/WebCore/bindings/scripts/test/JS/JSTestIndexedSetterThrowingException.cpp      2021-12-01 04:38:56 UTC (rev 286347)
</span><span class="lines">@@ -65,7 +65,7 @@
</span><span class="cx">     static JSC::IsoSubspace* subspaceFor(JSC::VM& vm)
</span><span class="cx">     {
</span><span class="cx">         STATIC_ASSERT_ISO_SUBSPACE_SHARABLE(JSTestIndexedSetterThrowingExceptionPrototype, Base);
</span><del>-        return &vm.plainObjectSpace;
</del><ins>+        return &vm.plainObjectSpace();
</ins><span class="cx">     }
</span><span class="cx">     static JSC::Structure* createStructure(JSC::VM& vm, JSC::JSGlobalObject* globalObject, JSC::JSValue prototype)
</span><span class="cx">     {
</span><span class="lines">@@ -276,9 +276,9 @@
</span><span class="cx">         return space;
</span><span class="cx">     static_assert(std::is_base_of_v<JSC::JSDestructibleObject, JSTestIndexedSetterThrowingException> || !JSTestIndexedSetterThrowingException::needsDestruction);
</span><span class="cx">     if constexpr (std::is_base_of_v<JSC::JSDestructibleObject, JSTestIndexedSetterThrowingException>)
</span><del>-        spaces.m_subspaceForTestIndexedSetterThrowingException = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, *vm.destructibleObjectHeapCellType, JSTestIndexedSetterThrowingException);
</del><ins>+        spaces.m_subspaceForTestIndexedSetterThrowingException = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, vm.destructibleObjectHeapCellType(), JSTestIndexedSetterThrowingException);
</ins><span class="cx">     else
</span><del>-        spaces.m_subspaceForTestIndexedSetterThrowingException = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, *vm.cellHeapCellType, JSTestIndexedSetterThrowingException);
</del><ins>+        spaces.m_subspaceForTestIndexedSetterThrowingException = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, vm.cellHeapCellType(), JSTestIndexedSetterThrowingException);
</ins><span class="cx">     auto* space = spaces.m_subspaceForTestIndexedSetterThrowingException.get();
</span><span class="cx"> IGNORE_WARNINGS_BEGIN("unreachable-code")
</span><span class="cx"> IGNORE_WARNINGS_BEGIN("tautological-compare")
</span></span></pre></div>
<a id="trunkSourceWebCorebindingsscriptstestJSJSTestIndexedSetterWithIdentifiercpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/scripts/test/JS/JSTestIndexedSetterWithIdentifier.cpp (286346 => 286347)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/bindings/scripts/test/JS/JSTestIndexedSetterWithIdentifier.cpp      2021-12-01 02:56:24 UTC (rev 286346)
+++ trunk/Source/WebCore/bindings/scripts/test/JS/JSTestIndexedSetterWithIdentifier.cpp 2021-12-01 04:38:56 UTC (rev 286347)
</span><span class="lines">@@ -73,7 +73,7 @@
</span><span class="cx">     static JSC::IsoSubspace* subspaceFor(JSC::VM& vm)
</span><span class="cx">     {
</span><span class="cx">         STATIC_ASSERT_ISO_SUBSPACE_SHARABLE(JSTestIndexedSetterWithIdentifierPrototype, Base);
</span><del>-        return &vm.plainObjectSpace;
</del><ins>+        return &vm.plainObjectSpace();
</ins><span class="cx">     }
</span><span class="cx">     static JSC::Structure* createStructure(JSC::VM& vm, JSC::JSGlobalObject* globalObject, JSC::JSValue prototype)
</span><span class="cx">     {
</span><span class="lines">@@ -308,9 +308,9 @@
</span><span class="cx">         return space;
</span><span class="cx">     static_assert(std::is_base_of_v<JSC::JSDestructibleObject, JSTestIndexedSetterWithIdentifier> || !JSTestIndexedSetterWithIdentifier::needsDestruction);
</span><span class="cx">     if constexpr (std::is_base_of_v<JSC::JSDestructibleObject, JSTestIndexedSetterWithIdentifier>)
</span><del>-        spaces.m_subspaceForTestIndexedSetterWithIdentifier = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, *vm.destructibleObjectHeapCellType, JSTestIndexedSetterWithIdentifier);
</del><ins>+        spaces.m_subspaceForTestIndexedSetterWithIdentifier = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, vm.destructibleObjectHeapCellType(), JSTestIndexedSetterWithIdentifier);
</ins><span class="cx">     else
</span><del>-        spaces.m_subspaceForTestIndexedSetterWithIdentifier = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, *vm.cellHeapCellType, JSTestIndexedSetterWithIdentifier);
</del><ins>+        spaces.m_subspaceForTestIndexedSetterWithIdentifier = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, vm.cellHeapCellType(), JSTestIndexedSetterWithIdentifier);
</ins><span class="cx">     auto* space = spaces.m_subspaceForTestIndexedSetterWithIdentifier.get();
</span><span class="cx"> IGNORE_WARNINGS_BEGIN("unreachable-code")
</span><span class="cx"> IGNORE_WARNINGS_BEGIN("tautological-compare")
</span></span></pre></div>
<a id="trunkSourceWebCorebindingsscriptstestJSJSTestInterfacecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/scripts/test/JS/JSTestInterface.cpp (286346 => 286347)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/bindings/scripts/test/JS/JSTestInterface.cpp        2021-12-01 02:56:24 UTC (rev 286346)
+++ trunk/Source/WebCore/bindings/scripts/test/JS/JSTestInterface.cpp   2021-12-01 04:38:56 UTC (rev 286347)
</span><span class="lines">@@ -181,7 +181,7 @@
</span><span class="cx">     static JSC::IsoSubspace* subspaceFor(JSC::VM& vm)
</span><span class="cx">     {
</span><span class="cx">         STATIC_ASSERT_ISO_SUBSPACE_SHARABLE(JSTestInterfacePrototype, Base);
</span><del>-        return &vm.plainObjectSpace;
</del><ins>+        return &vm.plainObjectSpace();
</ins><span class="cx">     }
</span><span class="cx">     static JSC::Structure* createStructure(JSC::VM& vm, JSC::JSGlobalObject* globalObject, JSC::JSValue prototype)
</span><span class="cx">     {
</span><span class="lines">@@ -1104,9 +1104,9 @@
</span><span class="cx">             return space;
</span><span class="cx">         static_assert(std::is_base_of_v<JSC::JSDestructibleObject, TestInterfaceIterator> || !TestInterfaceIterator::needsDestruction);
</span><span class="cx">         if constexpr (std::is_base_of_v<JSC::JSDestructibleObject, TestInterfaceIterator>)
</span><del>-            spaces.m_subspaceForTestInterfaceIterator = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, *vm.destructibleObjectHeapCellType.get(), TestInterfaceIterator);
</del><ins>+            spaces.m_subspaceForTestInterfaceIterator = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, vm.destructibleObjectHeapCellType(), TestInterfaceIterator);
</ins><span class="cx">         else
</span><del>-            spaces.m_subspaceForTestInterfaceIterator = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, *vm.cellHeapCellType, TestInterfaceIterator);
</del><ins>+            spaces.m_subspaceForTestInterfaceIterator = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, vm.cellHeapCellType(), TestInterfaceIterator);
</ins><span class="cx">         auto* space = spaces.m_subspaceForTestInterfaceIterator.get();
</span><span class="cx"> IGNORE_WARNINGS_BEGIN("unreachable-code")
</span><span class="cx"> IGNORE_WARNINGS_BEGIN("tautological-compare")
</span><span class="lines">@@ -1196,9 +1196,9 @@
</span><span class="cx">         return space;
</span><span class="cx">     static_assert(std::is_base_of_v<JSC::JSDestructibleObject, JSTestInterface> || !JSTestInterface::needsDestruction);
</span><span class="cx">     if constexpr (std::is_base_of_v<JSC::JSDestructibleObject, JSTestInterface>)
</span><del>-        spaces.m_subspaceForTestInterface = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, *vm.destructibleObjectHeapCellType, JSTestInterface);
</del><ins>+        spaces.m_subspaceForTestInterface = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, vm.destructibleObjectHeapCellType(), JSTestInterface);
</ins><span class="cx">     else
</span><del>-        spaces.m_subspaceForTestInterface = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, *vm.cellHeapCellType, JSTestInterface);
</del><ins>+        spaces.m_subspaceForTestInterface = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, vm.cellHeapCellType(), JSTestInterface);
</ins><span class="cx">     auto* space = spaces.m_subspaceForTestInterface.get();
</span><span class="cx"> IGNORE_WARNINGS_BEGIN("unreachable-code")
</span><span class="cx"> IGNORE_WARNINGS_BEGIN("tautological-compare")
</span></span></pre></div>
<a id="trunkSourceWebCorebindingsscriptstestJSJSTestInterfaceLeadingUnderscorecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/scripts/test/JS/JSTestInterfaceLeadingUnderscore.cpp (286346 => 286347)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/bindings/scripts/test/JS/JSTestInterfaceLeadingUnderscore.cpp       2021-12-01 02:56:24 UTC (rev 286346)
+++ trunk/Source/WebCore/bindings/scripts/test/JS/JSTestInterfaceLeadingUnderscore.cpp  2021-12-01 04:38:56 UTC (rev 286347)
</span><span class="lines">@@ -66,7 +66,7 @@
</span><span class="cx">     static JSC::IsoSubspace* subspaceFor(JSC::VM& vm)
</span><span class="cx">     {
</span><span class="cx">         STATIC_ASSERT_ISO_SUBSPACE_SHARABLE(JSTestInterfaceLeadingUnderscorePrototype, Base);
</span><del>-        return &vm.plainObjectSpace;
</del><ins>+        return &vm.plainObjectSpace();
</ins><span class="cx">     }
</span><span class="cx">     static JSC::Structure* createStructure(JSC::VM& vm, JSC::JSGlobalObject* globalObject, JSC::JSValue prototype)
</span><span class="cx">     {
</span><span class="lines">@@ -187,9 +187,9 @@
</span><span class="cx">         return space;
</span><span class="cx">     static_assert(std::is_base_of_v<JSC::JSDestructibleObject, JSTestInterfaceLeadingUnderscore> || !JSTestInterfaceLeadingUnderscore::needsDestruction);
</span><span class="cx">     if constexpr (std::is_base_of_v<JSC::JSDestructibleObject, JSTestInterfaceLeadingUnderscore>)
</span><del>-        spaces.m_subspaceForTestInterfaceLeadingUnderscore = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, *vm.destructibleObjectHeapCellType, JSTestInterfaceLeadingUnderscore);
</del><ins>+        spaces.m_subspaceForTestInterfaceLeadingUnderscore = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, vm.destructibleObjectHeapCellType(), JSTestInterfaceLeadingUnderscore);
</ins><span class="cx">     else
</span><del>-        spaces.m_subspaceForTestInterfaceLeadingUnderscore = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, *vm.cellHeapCellType, JSTestInterfaceLeadingUnderscore);
</del><ins>+        spaces.m_subspaceForTestInterfaceLeadingUnderscore = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, vm.cellHeapCellType(), JSTestInterfaceLeadingUnderscore);
</ins><span class="cx">     auto* space = spaces.m_subspaceForTestInterfaceLeadingUnderscore.get();
</span><span class="cx"> IGNORE_WARNINGS_BEGIN("unreachable-code")
</span><span class="cx"> IGNORE_WARNINGS_BEGIN("tautological-compare")
</span></span></pre></div>
<a id="trunkSourceWebCorebindingsscriptstestJSJSTestIterablecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/scripts/test/JS/JSTestIterable.cpp (286346 => 286347)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/bindings/scripts/test/JS/JSTestIterable.cpp 2021-12-01 02:56:24 UTC (rev 286346)
+++ trunk/Source/WebCore/bindings/scripts/test/JS/JSTestIterable.cpp    2021-12-01 04:38:56 UTC (rev 286347)
</span><span class="lines">@@ -75,7 +75,7 @@
</span><span class="cx">     static JSC::IsoSubspace* subspaceFor(JSC::VM& vm)
</span><span class="cx">     {
</span><span class="cx">         STATIC_ASSERT_ISO_SUBSPACE_SHARABLE(JSTestIterablePrototype, Base);
</span><del>-        return &vm.plainObjectSpace;
</del><ins>+        return &vm.plainObjectSpace();
</ins><span class="cx">     }
</span><span class="cx">     static JSC::Structure* createStructure(JSC::VM& vm, JSC::JSGlobalObject* globalObject, JSC::JSValue prototype)
</span><span class="cx">     {
</span><span class="lines">@@ -201,9 +201,9 @@
</span><span class="cx">             return space;
</span><span class="cx">         static_assert(std::is_base_of_v<JSC::JSDestructibleObject, TestIterableIterator> || !TestIterableIterator::needsDestruction);
</span><span class="cx">         if constexpr (std::is_base_of_v<JSC::JSDestructibleObject, TestIterableIterator>)
</span><del>-            spaces.m_subspaceForTestIterableIterator = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, *vm.destructibleObjectHeapCellType.get(), TestIterableIterator);
</del><ins>+            spaces.m_subspaceForTestIterableIterator = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, vm.destructibleObjectHeapCellType(), TestIterableIterator);
</ins><span class="cx">         else
</span><del>-            spaces.m_subspaceForTestIterableIterator = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, *vm.cellHeapCellType, TestIterableIterator);
</del><ins>+            spaces.m_subspaceForTestIterableIterator = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, vm.cellHeapCellType(), TestIterableIterator);
</ins><span class="cx">         auto* space = spaces.m_subspaceForTestIterableIterator.get();
</span><span class="cx"> IGNORE_WARNINGS_BEGIN("unreachable-code")
</span><span class="cx"> IGNORE_WARNINGS_BEGIN("tautological-compare")
</span><span class="lines">@@ -293,9 +293,9 @@
</span><span class="cx">         return space;
</span><span class="cx">     static_assert(std::is_base_of_v<JSC::JSDestructibleObject, JSTestIterable> || !JSTestIterable::needsDestruction);
</span><span class="cx">     if constexpr (std::is_base_of_v<JSC::JSDestructibleObject, JSTestIterable>)
</span><del>-        spaces.m_subspaceForTestIterable = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, *vm.destructibleObjectHeapCellType, JSTestIterable);
</del><ins>+        spaces.m_subspaceForTestIterable = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, vm.destructibleObjectHeapCellType(), JSTestIterable);
</ins><span class="cx">     else
</span><del>-        spaces.m_subspaceForTestIterable = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, *vm.cellHeapCellType, JSTestIterable);
</del><ins>+        spaces.m_subspaceForTestIterable = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, vm.cellHeapCellType(), JSTestIterable);
</ins><span class="cx">     auto* space = spaces.m_subspaceForTestIterable.get();
</span><span class="cx"> IGNORE_WARNINGS_BEGIN("unreachable-code")
</span><span class="cx"> IGNORE_WARNINGS_BEGIN("tautological-compare")
</span></span></pre></div>
<a id="trunkSourceWebCorebindingsscriptstestJSJSTestJSBuiltinConstructorcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/scripts/test/JS/JSTestJSBuiltinConstructor.cpp (286346 => 286347)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/bindings/scripts/test/JS/JSTestJSBuiltinConstructor.cpp     2021-12-01 02:56:24 UTC (rev 286346)
+++ trunk/Source/WebCore/bindings/scripts/test/JS/JSTestJSBuiltinConstructor.cpp        2021-12-01 04:38:56 UTC (rev 286347)
</span><span class="lines">@@ -69,7 +69,7 @@
</span><span class="cx">     static JSC::IsoSubspace* subspaceFor(JSC::VM& vm)
</span><span class="cx">     {
</span><span class="cx">         STATIC_ASSERT_ISO_SUBSPACE_SHARABLE(JSTestJSBuiltinConstructorPrototype, Base);
</span><del>-        return &vm.plainObjectSpace;
</del><ins>+        return &vm.plainObjectSpace();
</ins><span class="cx">     }
</span><span class="cx">     static JSC::Structure* createStructure(JSC::VM& vm, JSC::JSGlobalObject* globalObject, JSC::JSValue prototype)
</span><span class="cx">     {
</span><span class="lines">@@ -230,9 +230,9 @@
</span><span class="cx">         return space;
</span><span class="cx">     static_assert(std::is_base_of_v<JSC::JSDestructibleObject, JSTestJSBuiltinConstructor> || !JSTestJSBuiltinConstructor::needsDestruction);
</span><span class="cx">     if constexpr (std::is_base_of_v<JSC::JSDestructibleObject, JSTestJSBuiltinConstructor>)
</span><del>-        spaces.m_subspaceForTestJSBuiltinConstructor = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, *vm.destructibleObjectHeapCellType, JSTestJSBuiltinConstructor);
</del><ins>+        spaces.m_subspaceForTestJSBuiltinConstructor = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, vm.destructibleObjectHeapCellType(), JSTestJSBuiltinConstructor);
</ins><span class="cx">     else
</span><del>-        spaces.m_subspaceForTestJSBuiltinConstructor = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, *vm.cellHeapCellType, JSTestJSBuiltinConstructor);
</del><ins>+        spaces.m_subspaceForTestJSBuiltinConstructor = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, vm.cellHeapCellType(), JSTestJSBuiltinConstructor);
</ins><span class="cx">     auto* space = spaces.m_subspaceForTestJSBuiltinConstructor.get();
</span><span class="cx"> IGNORE_WARNINGS_BEGIN("unreachable-code")
</span><span class="cx"> IGNORE_WARNINGS_BEGIN("tautological-compare")
</span></span></pre></div>
<a id="trunkSourceWebCorebindingsscriptstestJSJSTestLegacyFactoryFunctioncpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/scripts/test/JS/JSTestLegacyFactoryFunction.cpp (286346 => 286347)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/bindings/scripts/test/JS/JSTestLegacyFactoryFunction.cpp    2021-12-01 02:56:24 UTC (rev 286346)
+++ trunk/Source/WebCore/bindings/scripts/test/JS/JSTestLegacyFactoryFunction.cpp       2021-12-01 04:38:56 UTC (rev 286347)
</span><span class="lines">@@ -67,7 +67,7 @@
</span><span class="cx">     static JSC::IsoSubspace* subspaceFor(JSC::VM& vm)
</span><span class="cx">     {
</span><span class="cx">         STATIC_ASSERT_ISO_SUBSPACE_SHARABLE(JSTestLegacyFactoryFunctionPrototype, Base);
</span><del>-        return &vm.plainObjectSpace;
</del><ins>+        return &vm.plainObjectSpace();
</ins><span class="cx">     }
</span><span class="cx">     static JSC::Structure* createStructure(JSC::VM& vm, JSC::JSGlobalObject* globalObject, JSC::JSValue prototype)
</span><span class="cx">     {
</span><span class="lines">@@ -230,9 +230,9 @@
</span><span class="cx">         return space;
</span><span class="cx">     static_assert(std::is_base_of_v<JSC::JSDestructibleObject, JSTestLegacyFactoryFunction> || !JSTestLegacyFactoryFunction::needsDestruction);
</span><span class="cx">     if constexpr (std::is_base_of_v<JSC::JSDestructibleObject, JSTestLegacyFactoryFunction>)
</span><del>-        spaces.m_subspaceForTestLegacyFactoryFunction = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, *vm.destructibleObjectHeapCellType, JSTestLegacyFactoryFunction);
</del><ins>+        spaces.m_subspaceForTestLegacyFactoryFunction = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, vm.destructibleObjectHeapCellType(), JSTestLegacyFactoryFunction);
</ins><span class="cx">     else
</span><del>-        spaces.m_subspaceForTestLegacyFactoryFunction = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, *vm.cellHeapCellType, JSTestLegacyFactoryFunction);
</del><ins>+        spaces.m_subspaceForTestLegacyFactoryFunction = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, vm.cellHeapCellType(), JSTestLegacyFactoryFunction);
</ins><span class="cx">     auto* space = spaces.m_subspaceForTestLegacyFactoryFunction.get();
</span><span class="cx"> IGNORE_WARNINGS_BEGIN("unreachable-code")
</span><span class="cx"> IGNORE_WARNINGS_BEGIN("tautological-compare")
</span></span></pre></div>
<a id="trunkSourceWebCorebindingsscriptstestJSJSTestLegacyNoInterfaceObjectcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/scripts/test/JS/JSTestLegacyNoInterfaceObject.cpp (286346 => 286347)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/bindings/scripts/test/JS/JSTestLegacyNoInterfaceObject.cpp  2021-12-01 02:56:24 UTC (rev 286346)
+++ trunk/Source/WebCore/bindings/scripts/test/JS/JSTestLegacyNoInterfaceObject.cpp     2021-12-01 04:38:56 UTC (rev 286347)
</span><span class="lines">@@ -85,7 +85,7 @@
</span><span class="cx">     static JSC::IsoSubspace* subspaceFor(JSC::VM& vm)
</span><span class="cx">     {
</span><span class="cx">         STATIC_ASSERT_ISO_SUBSPACE_SHARABLE(JSTestLegacyNoInterfaceObjectPrototype, Base);
</span><del>-        return &vm.plainObjectSpace;
</del><ins>+        return &vm.plainObjectSpace();
</ins><span class="cx">     }
</span><span class="cx">     static JSC::Structure* createStructure(JSC::VM& vm, JSC::JSGlobalObject* globalObject, JSC::JSValue prototype)
</span><span class="cx">     {
</span><span class="lines">@@ -335,9 +335,9 @@
</span><span class="cx">         return space;
</span><span class="cx">     static_assert(std::is_base_of_v<JSC::JSDestructibleObject, JSTestLegacyNoInterfaceObject> || !JSTestLegacyNoInterfaceObject::needsDestruction);
</span><span class="cx">     if constexpr (std::is_base_of_v<JSC::JSDestructibleObject, JSTestLegacyNoInterfaceObject>)
</span><del>-        spaces.m_subspaceForTestLegacyNoInterfaceObject = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, *vm.destructibleObjectHeapCellType, JSTestLegacyNoInterfaceObject);
</del><ins>+        spaces.m_subspaceForTestLegacyNoInterfaceObject = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, vm.destructibleObjectHeapCellType(), JSTestLegacyNoInterfaceObject);
</ins><span class="cx">     else
</span><del>-        spaces.m_subspaceForTestLegacyNoInterfaceObject = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, *vm.cellHeapCellType, JSTestLegacyNoInterfaceObject);
</del><ins>+        spaces.m_subspaceForTestLegacyNoInterfaceObject = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, vm.cellHeapCellType(), JSTestLegacyNoInterfaceObject);
</ins><span class="cx">     auto* space = spaces.m_subspaceForTestLegacyNoInterfaceObject.get();
</span><span class="cx"> IGNORE_WARNINGS_BEGIN("unreachable-code")
</span><span class="cx"> IGNORE_WARNINGS_BEGIN("tautological-compare")
</span></span></pre></div>
<a id="trunkSourceWebCorebindingsscriptstestJSJSTestLegacyOverrideBuiltInscpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/scripts/test/JS/JSTestLegacyOverrideBuiltIns.cpp (286346 => 286347)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/bindings/scripts/test/JS/JSTestLegacyOverrideBuiltIns.cpp   2021-12-01 02:56:24 UTC (rev 286346)
+++ trunk/Source/WebCore/bindings/scripts/test/JS/JSTestLegacyOverrideBuiltIns.cpp      2021-12-01 04:38:56 UTC (rev 286347)
</span><span class="lines">@@ -73,7 +73,7 @@
</span><span class="cx">     static JSC::IsoSubspace* subspaceFor(JSC::VM& vm)
</span><span class="cx">     {
</span><span class="cx">         STATIC_ASSERT_ISO_SUBSPACE_SHARABLE(JSTestLegacyOverrideBuiltInsPrototype, Base);
</span><del>-        return &vm.plainObjectSpace;
</del><ins>+        return &vm.plainObjectSpace();
</ins><span class="cx">     }
</span><span class="cx">     static JSC::Structure* createStructure(JSC::VM& vm, JSC::JSGlobalObject* globalObject, JSC::JSValue prototype)
</span><span class="cx">     {
</span><span class="lines">@@ -249,9 +249,9 @@
</span><span class="cx">         return space;
</span><span class="cx">     static_assert(std::is_base_of_v<JSC::JSDestructibleObject, JSTestLegacyOverrideBuiltIns> || !JSTestLegacyOverrideBuiltIns::needsDestruction);
</span><span class="cx">     if constexpr (std::is_base_of_v<JSC::JSDestructibleObject, JSTestLegacyOverrideBuiltIns>)
</span><del>-        spaces.m_subspaceForTestLegacyOverrideBuiltIns = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, *vm.destructibleObjectHeapCellType, JSTestLegacyOverrideBuiltIns);
</del><ins>+        spaces.m_subspaceForTestLegacyOverrideBuiltIns = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, vm.destructibleObjectHeapCellType(), JSTestLegacyOverrideBuiltIns);
</ins><span class="cx">     else
</span><del>-        spaces.m_subspaceForTestLegacyOverrideBuiltIns = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, *vm.cellHeapCellType, JSTestLegacyOverrideBuiltIns);
</del><ins>+        spaces.m_subspaceForTestLegacyOverrideBuiltIns = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, vm.cellHeapCellType(), JSTestLegacyOverrideBuiltIns);
</ins><span class="cx">     auto* space = spaces.m_subspaceForTestLegacyOverrideBuiltIns.get();
</span><span class="cx"> IGNORE_WARNINGS_BEGIN("unreachable-code")
</span><span class="cx"> IGNORE_WARNINGS_BEGIN("tautological-compare")
</span></span></pre></div>
<a id="trunkSourceWebCorebindingsscriptstestJSJSTestMapLikecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/scripts/test/JS/JSTestMapLike.cpp (286346 => 286347)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/bindings/scripts/test/JS/JSTestMapLike.cpp  2021-12-01 02:56:24 UTC (rev 286346)
+++ trunk/Source/WebCore/bindings/scripts/test/JS/JSTestMapLike.cpp     2021-12-01 04:38:56 UTC (rev 286347)
</span><span class="lines">@@ -82,7 +82,7 @@
</span><span class="cx">     static JSC::IsoSubspace* subspaceFor(JSC::VM& vm)
</span><span class="cx">     {
</span><span class="cx">         STATIC_ASSERT_ISO_SUBSPACE_SHARABLE(JSTestMapLikePrototype, Base);
</span><del>-        return &vm.plainObjectSpace;
</del><ins>+        return &vm.plainObjectSpace();
</ins><span class="cx">     }
</span><span class="cx">     static JSC::Structure* createStructure(JSC::VM& vm, JSC::JSGlobalObject* globalObject, JSC::JSValue prototype)
</span><span class="cx">     {
</span><span class="lines">@@ -366,9 +366,9 @@
</span><span class="cx">         return space;
</span><span class="cx">     static_assert(std::is_base_of_v<JSC::JSDestructibleObject, JSTestMapLike> || !JSTestMapLike::needsDestruction);
</span><span class="cx">     if constexpr (std::is_base_of_v<JSC::JSDestructibleObject, JSTestMapLike>)
</span><del>-        spaces.m_subspaceForTestMapLike = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, *vm.destructibleObjectHeapCellType, JSTestMapLike);
</del><ins>+        spaces.m_subspaceForTestMapLike = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, vm.destructibleObjectHeapCellType(), JSTestMapLike);
</ins><span class="cx">     else
</span><del>-        spaces.m_subspaceForTestMapLike = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, *vm.cellHeapCellType, JSTestMapLike);
</del><ins>+        spaces.m_subspaceForTestMapLike = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, vm.cellHeapCellType(), JSTestMapLike);
</ins><span class="cx">     auto* space = spaces.m_subspaceForTestMapLike.get();
</span><span class="cx"> IGNORE_WARNINGS_BEGIN("unreachable-code")
</span><span class="cx"> IGNORE_WARNINGS_BEGIN("tautological-compare")
</span></span></pre></div>
<a id="trunkSourceWebCorebindingsscriptstestJSJSTestMapLikeWithOverriddenOperationscpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/scripts/test/JS/JSTestMapLikeWithOverriddenOperations.cpp (286346 => 286347)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/bindings/scripts/test/JS/JSTestMapLikeWithOverriddenOperations.cpp  2021-12-01 02:56:24 UTC (rev 286346)
+++ trunk/Source/WebCore/bindings/scripts/test/JS/JSTestMapLikeWithOverriddenOperations.cpp     2021-12-01 04:38:56 UTC (rev 286347)
</span><span class="lines">@@ -86,7 +86,7 @@
</span><span class="cx">     static JSC::IsoSubspace* subspaceFor(JSC::VM& vm)
</span><span class="cx">     {
</span><span class="cx">         STATIC_ASSERT_ISO_SUBSPACE_SHARABLE(JSTestMapLikeWithOverriddenOperationsPrototype, Base);
</span><del>-        return &vm.plainObjectSpace;
</del><ins>+        return &vm.plainObjectSpace();
</ins><span class="cx">     }
</span><span class="cx">     static JSC::Structure* createStructure(JSC::VM& vm, JSC::JSGlobalObject* globalObject, JSC::JSValue prototype)
</span><span class="cx">     {
</span><span class="lines">@@ -380,9 +380,9 @@
</span><span class="cx">         return space;
</span><span class="cx">     static_assert(std::is_base_of_v<JSC::JSDestructibleObject, JSTestMapLikeWithOverriddenOperations> || !JSTestMapLikeWithOverriddenOperations::needsDestruction);
</span><span class="cx">     if constexpr (std::is_base_of_v<JSC::JSDestructibleObject, JSTestMapLikeWithOverriddenOperations>)
</span><del>-        spaces.m_subspaceForTestMapLikeWithOverriddenOperations = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, *vm.destructibleObjectHeapCellType, JSTestMapLikeWithOverriddenOperations);
</del><ins>+        spaces.m_subspaceForTestMapLikeWithOverriddenOperations = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, vm.destructibleObjectHeapCellType(), JSTestMapLikeWithOverriddenOperations);
</ins><span class="cx">     else
</span><del>-        spaces.m_subspaceForTestMapLikeWithOverriddenOperations = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, *vm.cellHeapCellType, JSTestMapLikeWithOverriddenOperations);
</del><ins>+        spaces.m_subspaceForTestMapLikeWithOverriddenOperations = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, vm.cellHeapCellType(), JSTestMapLikeWithOverriddenOperations);
</ins><span class="cx">     auto* space = spaces.m_subspaceForTestMapLikeWithOverriddenOperations.get();
</span><span class="cx"> IGNORE_WARNINGS_BEGIN("unreachable-code")
</span><span class="cx"> IGNORE_WARNINGS_BEGIN("tautological-compare")
</span></span></pre></div>
<a id="trunkSourceWebCorebindingsscriptstestJSJSTestNamedAndIndexedSetterNoIdentifiercpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/scripts/test/JS/JSTestNamedAndIndexedSetterNoIdentifier.cpp (286346 => 286347)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/bindings/scripts/test/JS/JSTestNamedAndIndexedSetterNoIdentifier.cpp        2021-12-01 02:56:24 UTC (rev 286346)
+++ trunk/Source/WebCore/bindings/scripts/test/JS/JSTestNamedAndIndexedSetterNoIdentifier.cpp   2021-12-01 04:38:56 UTC (rev 286347)
</span><span class="lines">@@ -66,7 +66,7 @@
</span><span class="cx">     static JSC::IsoSubspace* subspaceFor(JSC::VM& vm)
</span><span class="cx">     {
</span><span class="cx">         STATIC_ASSERT_ISO_SUBSPACE_SHARABLE(JSTestNamedAndIndexedSetterNoIdentifierPrototype, Base);
</span><del>-        return &vm.plainObjectSpace;
</del><ins>+        return &vm.plainObjectSpace();
</ins><span class="cx">     }
</span><span class="cx">     static JSC::Structure* createStructure(JSC::VM& vm, JSC::JSGlobalObject* globalObject, JSC::JSValue prototype)
</span><span class="cx">     {
</span><span class="lines">@@ -344,9 +344,9 @@
</span><span class="cx">         return space;
</span><span class="cx">     static_assert(std::is_base_of_v<JSC::JSDestructibleObject, JSTestNamedAndIndexedSetterNoIdentifier> || !JSTestNamedAndIndexedSetterNoIdentifier::needsDestruction);
</span><span class="cx">     if constexpr (std::is_base_of_v<JSC::JSDestructibleObject, JSTestNamedAndIndexedSetterNoIdentifier>)
</span><del>-        spaces.m_subspaceForTestNamedAndIndexedSetterNoIdentifier = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, *vm.destructibleObjectHeapCellType, JSTestNamedAndIndexedSetterNoIdentifier);
</del><ins>+        spaces.m_subspaceForTestNamedAndIndexedSetterNoIdentifier = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, vm.destructibleObjectHeapCellType(), JSTestNamedAndIndexedSetterNoIdentifier);
</ins><span class="cx">     else
</span><del>-        spaces.m_subspaceForTestNamedAndIndexedSetterNoIdentifier = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, *vm.cellHeapCellType, JSTestNamedAndIndexedSetterNoIdentifier);
</del><ins>+        spaces.m_subspaceForTestNamedAndIndexedSetterNoIdentifier = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, vm.cellHeapCellType(), JSTestNamedAndIndexedSetterNoIdentifier);
</ins><span class="cx">     auto* space = spaces.m_subspaceForTestNamedAndIndexedSetterNoIdentifier.get();
</span><span class="cx"> IGNORE_WARNINGS_BEGIN("unreachable-code")
</span><span class="cx"> IGNORE_WARNINGS_BEGIN("tautological-compare")
</span></span></pre></div>
<a id="trunkSourceWebCorebindingsscriptstestJSJSTestNamedAndIndexedSetterThrowingExceptioncpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/scripts/test/JS/JSTestNamedAndIndexedSetterThrowingException.cpp (286346 => 286347)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/bindings/scripts/test/JS/JSTestNamedAndIndexedSetterThrowingException.cpp   2021-12-01 02:56:24 UTC (rev 286346)
+++ trunk/Source/WebCore/bindings/scripts/test/JS/JSTestNamedAndIndexedSetterThrowingException.cpp      2021-12-01 04:38:56 UTC (rev 286347)
</span><span class="lines">@@ -66,7 +66,7 @@
</span><span class="cx">     static JSC::IsoSubspace* subspaceFor(JSC::VM& vm)
</span><span class="cx">     {
</span><span class="cx">         STATIC_ASSERT_ISO_SUBSPACE_SHARABLE(JSTestNamedAndIndexedSetterThrowingExceptionPrototype, Base);
</span><del>-        return &vm.plainObjectSpace;
</del><ins>+        return &vm.plainObjectSpace();
</ins><span class="cx">     }
</span><span class="cx">     static JSC::Structure* createStructure(JSC::VM& vm, JSC::JSGlobalObject* globalObject, JSC::JSValue prototype)
</span><span class="cx">     {
</span><span class="lines">@@ -344,9 +344,9 @@
</span><span class="cx">         return space;
</span><span class="cx">     static_assert(std::is_base_of_v<JSC::JSDestructibleObject, JSTestNamedAndIndexedSetterThrowingException> || !JSTestNamedAndIndexedSetterThrowingException::needsDestruction);
</span><span class="cx">     if constexpr (std::is_base_of_v<JSC::JSDestructibleObject, JSTestNamedAndIndexedSetterThrowingException>)
</span><del>-        spaces.m_subspaceForTestNamedAndIndexedSetterThrowingException = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, *vm.destructibleObjectHeapCellType, JSTestNamedAndIndexedSetterThrowingException);
</del><ins>+        spaces.m_subspaceForTestNamedAndIndexedSetterThrowingException = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, vm.destructibleObjectHeapCellType(), JSTestNamedAndIndexedSetterThrowingException);
</ins><span class="cx">     else
</span><del>-        spaces.m_subspaceForTestNamedAndIndexedSetterThrowingException = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, *vm.cellHeapCellType, JSTestNamedAndIndexedSetterThrowingException);
</del><ins>+        spaces.m_subspaceForTestNamedAndIndexedSetterThrowingException = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, vm.cellHeapCellType(), JSTestNamedAndIndexedSetterThrowingException);
</ins><span class="cx">     auto* space = spaces.m_subspaceForTestNamedAndIndexedSetterThrowingException.get();
</span><span class="cx"> IGNORE_WARNINGS_BEGIN("unreachable-code")
</span><span class="cx"> IGNORE_WARNINGS_BEGIN("tautological-compare")
</span></span></pre></div>
<a id="trunkSourceWebCorebindingsscriptstestJSJSTestNamedAndIndexedSetterWithIdentifiercpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/scripts/test/JS/JSTestNamedAndIndexedSetterWithIdentifier.cpp (286346 => 286347)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/bindings/scripts/test/JS/JSTestNamedAndIndexedSetterWithIdentifier.cpp      2021-12-01 02:56:24 UTC (rev 286346)
+++ trunk/Source/WebCore/bindings/scripts/test/JS/JSTestNamedAndIndexedSetterWithIdentifier.cpp 2021-12-01 04:38:56 UTC (rev 286347)
</span><span class="lines">@@ -75,7 +75,7 @@
</span><span class="cx">     static JSC::IsoSubspace* subspaceFor(JSC::VM& vm)
</span><span class="cx">     {
</span><span class="cx">         STATIC_ASSERT_ISO_SUBSPACE_SHARABLE(JSTestNamedAndIndexedSetterWithIdentifierPrototype, Base);
</span><del>-        return &vm.plainObjectSpace;
</del><ins>+        return &vm.plainObjectSpace();
</ins><span class="cx">     }
</span><span class="cx">     static JSC::Structure* createStructure(JSC::VM& vm, JSC::JSGlobalObject* globalObject, JSC::JSValue prototype)
</span><span class="cx">     {
</span><span class="lines">@@ -401,9 +401,9 @@
</span><span class="cx">         return space;
</span><span class="cx">     static_assert(std::is_base_of_v<JSC::JSDestructibleObject, JSTestNamedAndIndexedSetterWithIdentifier> || !JSTestNamedAndIndexedSetterWithIdentifier::needsDestruction);
</span><span class="cx">     if constexpr (std::is_base_of_v<JSC::JSDestructibleObject, JSTestNamedAndIndexedSetterWithIdentifier>)
</span><del>-        spaces.m_subspaceForTestNamedAndIndexedSetterWithIdentifier = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, *vm.destructibleObjectHeapCellType, JSTestNamedAndIndexedSetterWithIdentifier);
</del><ins>+        spaces.m_subspaceForTestNamedAndIndexedSetterWithIdentifier = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, vm.destructibleObjectHeapCellType(), JSTestNamedAndIndexedSetterWithIdentifier);
</ins><span class="cx">     else
</span><del>-        spaces.m_subspaceForTestNamedAndIndexedSetterWithIdentifier = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, *vm.cellHeapCellType, JSTestNamedAndIndexedSetterWithIdentifier);
</del><ins>+        spaces.m_subspaceForTestNamedAndIndexedSetterWithIdentifier = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, vm.cellHeapCellType(), JSTestNamedAndIndexedSetterWithIdentifier);
</ins><span class="cx">     auto* space = spaces.m_subspaceForTestNamedAndIndexedSetterWithIdentifier.get();
</span><span class="cx"> IGNORE_WARNINGS_BEGIN("unreachable-code")
</span><span class="cx"> IGNORE_WARNINGS_BEGIN("tautological-compare")
</span></span></pre></div>
<a id="trunkSourceWebCorebindingsscriptstestJSJSTestNamedDeleterNoIdentifiercpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/scripts/test/JS/JSTestNamedDeleterNoIdentifier.cpp (286346 => 286347)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/bindings/scripts/test/JS/JSTestNamedDeleterNoIdentifier.cpp 2021-12-01 02:56:24 UTC (rev 286346)
+++ trunk/Source/WebCore/bindings/scripts/test/JS/JSTestNamedDeleterNoIdentifier.cpp    2021-12-01 04:38:56 UTC (rev 286347)
</span><span class="lines">@@ -65,7 +65,7 @@
</span><span class="cx">     static JSC::IsoSubspace* subspaceFor(JSC::VM& vm)
</span><span class="cx">     {
</span><span class="cx">         STATIC_ASSERT_ISO_SUBSPACE_SHARABLE(JSTestNamedDeleterNoIdentifierPrototype, Base);
</span><del>-        return &vm.plainObjectSpace;
</del><ins>+        return &vm.plainObjectSpace();
</ins><span class="cx">     }
</span><span class="cx">     static JSC::Structure* createStructure(JSC::VM& vm, JSC::JSGlobalObject* globalObject, JSC::JSValue prototype)
</span><span class="cx">     {
</span><span class="lines">@@ -246,9 +246,9 @@
</span><span class="cx">         return space;
</span><span class="cx">     static_assert(std::is_base_of_v<JSC::JSDestructibleObject, JSTestNamedDeleterNoIdentifier> || !JSTestNamedDeleterNoIdentifier::needsDestruction);
</span><span class="cx">     if constexpr (std::is_base_of_v<JSC::JSDestructibleObject, JSTestNamedDeleterNoIdentifier>)
</span><del>-        spaces.m_subspaceForTestNamedDeleterNoIdentifier = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, *vm.destructibleObjectHeapCellType, JSTestNamedDeleterNoIdentifier);
</del><ins>+        spaces.m_subspaceForTestNamedDeleterNoIdentifier = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, vm.destructibleObjectHeapCellType(), JSTestNamedDeleterNoIdentifier);
</ins><span class="cx">     else
</span><del>-        spaces.m_subspaceForTestNamedDeleterNoIdentifier = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, *vm.cellHeapCellType, JSTestNamedDeleterNoIdentifier);
</del><ins>+        spaces.m_subspaceForTestNamedDeleterNoIdentifier = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, vm.cellHeapCellType(), JSTestNamedDeleterNoIdentifier);
</ins><span class="cx">     auto* space = spaces.m_subspaceForTestNamedDeleterNoIdentifier.get();
</span><span class="cx"> IGNORE_WARNINGS_BEGIN("unreachable-code")
</span><span class="cx"> IGNORE_WARNINGS_BEGIN("tautological-compare")
</span></span></pre></div>
<a id="trunkSourceWebCorebindingsscriptstestJSJSTestNamedDeleterThrowingExceptioncpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/scripts/test/JS/JSTestNamedDeleterThrowingException.cpp (286346 => 286347)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/bindings/scripts/test/JS/JSTestNamedDeleterThrowingException.cpp    2021-12-01 02:56:24 UTC (rev 286346)
+++ trunk/Source/WebCore/bindings/scripts/test/JS/JSTestNamedDeleterThrowingException.cpp       2021-12-01 04:38:56 UTC (rev 286347)
</span><span class="lines">@@ -65,7 +65,7 @@
</span><span class="cx">     static JSC::IsoSubspace* subspaceFor(JSC::VM& vm)
</span><span class="cx">     {
</span><span class="cx">         STATIC_ASSERT_ISO_SUBSPACE_SHARABLE(JSTestNamedDeleterThrowingExceptionPrototype, Base);
</span><del>-        return &vm.plainObjectSpace;
</del><ins>+        return &vm.plainObjectSpace();
</ins><span class="cx">     }
</span><span class="cx">     static JSC::Structure* createStructure(JSC::VM& vm, JSC::JSGlobalObject* globalObject, JSC::JSValue prototype)
</span><span class="cx">     {
</span><span class="lines">@@ -246,9 +246,9 @@
</span><span class="cx">         return space;
</span><span class="cx">     static_assert(std::is_base_of_v<JSC::JSDestructibleObject, JSTestNamedDeleterThrowingException> || !JSTestNamedDeleterThrowingException::needsDestruction);
</span><span class="cx">     if constexpr (std::is_base_of_v<JSC::JSDestructibleObject, JSTestNamedDeleterThrowingException>)
</span><del>-        spaces.m_subspaceForTestNamedDeleterThrowingException = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, *vm.destructibleObjectHeapCellType, JSTestNamedDeleterThrowingException);
</del><ins>+        spaces.m_subspaceForTestNamedDeleterThrowingException = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, vm.destructibleObjectHeapCellType(), JSTestNamedDeleterThrowingException);
</ins><span class="cx">     else
</span><del>-        spaces.m_subspaceForTestNamedDeleterThrowingException = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, *vm.cellHeapCellType, JSTestNamedDeleterThrowingException);
</del><ins>+        spaces.m_subspaceForTestNamedDeleterThrowingException = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, vm.cellHeapCellType(), JSTestNamedDeleterThrowingException);
</ins><span class="cx">     auto* space = spaces.m_subspaceForTestNamedDeleterThrowingException.get();
</span><span class="cx"> IGNORE_WARNINGS_BEGIN("unreachable-code")
</span><span class="cx"> IGNORE_WARNINGS_BEGIN("tautological-compare")
</span></span></pre></div>
<a id="trunkSourceWebCorebindingsscriptstestJSJSTestNamedDeleterWithIdentifiercpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/scripts/test/JS/JSTestNamedDeleterWithIdentifier.cpp (286346 => 286347)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/bindings/scripts/test/JS/JSTestNamedDeleterWithIdentifier.cpp       2021-12-01 02:56:24 UTC (rev 286346)
+++ trunk/Source/WebCore/bindings/scripts/test/JS/JSTestNamedDeleterWithIdentifier.cpp  2021-12-01 04:38:56 UTC (rev 286347)
</span><span class="lines">@@ -72,7 +72,7 @@
</span><span class="cx">     static JSC::IsoSubspace* subspaceFor(JSC::VM& vm)
</span><span class="cx">     {
</span><span class="cx">         STATIC_ASSERT_ISO_SUBSPACE_SHARABLE(JSTestNamedDeleterWithIdentifierPrototype, Base);
</span><del>-        return &vm.plainObjectSpace;
</del><ins>+        return &vm.plainObjectSpace();
</ins><span class="cx">     }
</span><span class="cx">     static JSC::Structure* createStructure(JSC::VM& vm, JSC::JSGlobalObject* globalObject, JSC::JSValue prototype)
</span><span class="cx">     {
</span><span class="lines">@@ -270,9 +270,9 @@
</span><span class="cx">         return space;
</span><span class="cx">     static_assert(std::is_base_of_v<JSC::JSDestructibleObject, JSTestNamedDeleterWithIdentifier> || !JSTestNamedDeleterWithIdentifier::needsDestruction);
</span><span class="cx">     if constexpr (std::is_base_of_v<JSC::JSDestructibleObject, JSTestNamedDeleterWithIdentifier>)
</span><del>-        spaces.m_subspaceForTestNamedDeleterWithIdentifier = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, *vm.destructibleObjectHeapCellType, JSTestNamedDeleterWithIdentifier);
</del><ins>+        spaces.m_subspaceForTestNamedDeleterWithIdentifier = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, vm.destructibleObjectHeapCellType(), JSTestNamedDeleterWithIdentifier);
</ins><span class="cx">     else
</span><del>-        spaces.m_subspaceForTestNamedDeleterWithIdentifier = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, *vm.cellHeapCellType, JSTestNamedDeleterWithIdentifier);
</del><ins>+        spaces.m_subspaceForTestNamedDeleterWithIdentifier = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, vm.cellHeapCellType(), JSTestNamedDeleterWithIdentifier);
</ins><span class="cx">     auto* space = spaces.m_subspaceForTestNamedDeleterWithIdentifier.get();
</span><span class="cx"> IGNORE_WARNINGS_BEGIN("unreachable-code")
</span><span class="cx"> IGNORE_WARNINGS_BEGIN("tautological-compare")
</span></span></pre></div>
<a id="trunkSourceWebCorebindingsscriptstestJSJSTestNamedDeleterWithIndexedGettercpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/scripts/test/JS/JSTestNamedDeleterWithIndexedGetter.cpp (286346 => 286347)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/bindings/scripts/test/JS/JSTestNamedDeleterWithIndexedGetter.cpp    2021-12-01 02:56:24 UTC (rev 286346)
+++ trunk/Source/WebCore/bindings/scripts/test/JS/JSTestNamedDeleterWithIndexedGetter.cpp       2021-12-01 04:38:56 UTC (rev 286347)
</span><span class="lines">@@ -66,7 +66,7 @@
</span><span class="cx">     static JSC::IsoSubspace* subspaceFor(JSC::VM& vm)
</span><span class="cx">     {
</span><span class="cx">         STATIC_ASSERT_ISO_SUBSPACE_SHARABLE(JSTestNamedDeleterWithIndexedGetterPrototype, Base);
</span><del>-        return &vm.plainObjectSpace;
</del><ins>+        return &vm.plainObjectSpace();
</ins><span class="cx">     }
</span><span class="cx">     static JSC::Structure* createStructure(JSC::VM& vm, JSC::JSGlobalObject* globalObject, JSC::JSValue prototype)
</span><span class="cx">     {
</span><span class="lines">@@ -262,9 +262,9 @@
</span><span class="cx">         return space;
</span><span class="cx">     static_assert(std::is_base_of_v<JSC::JSDestructibleObject, JSTestNamedDeleterWithIndexedGetter> || !JSTestNamedDeleterWithIndexedGetter::needsDestruction);
</span><span class="cx">     if constexpr (std::is_base_of_v<JSC::JSDestructibleObject, JSTestNamedDeleterWithIndexedGetter>)
</span><del>-        spaces.m_subspaceForTestNamedDeleterWithIndexedGetter = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, *vm.destructibleObjectHeapCellType, JSTestNamedDeleterWithIndexedGetter);
</del><ins>+        spaces.m_subspaceForTestNamedDeleterWithIndexedGetter = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, vm.destructibleObjectHeapCellType(), JSTestNamedDeleterWithIndexedGetter);
</ins><span class="cx">     else
</span><del>-        spaces.m_subspaceForTestNamedDeleterWithIndexedGetter = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, *vm.cellHeapCellType, JSTestNamedDeleterWithIndexedGetter);
</del><ins>+        spaces.m_subspaceForTestNamedDeleterWithIndexedGetter = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, vm.cellHeapCellType(), JSTestNamedDeleterWithIndexedGetter);
</ins><span class="cx">     auto* space = spaces.m_subspaceForTestNamedDeleterWithIndexedGetter.get();
</span><span class="cx"> IGNORE_WARNINGS_BEGIN("unreachable-code")
</span><span class="cx"> IGNORE_WARNINGS_BEGIN("tautological-compare")
</span></span></pre></div>
<a id="trunkSourceWebCorebindingsscriptstestJSJSTestNamedGetterCallWithcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/scripts/test/JS/JSTestNamedGetterCallWith.cpp (286346 => 286347)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/bindings/scripts/test/JS/JSTestNamedGetterCallWith.cpp      2021-12-01 02:56:24 UTC (rev 286346)
+++ trunk/Source/WebCore/bindings/scripts/test/JS/JSTestNamedGetterCallWith.cpp 2021-12-01 04:38:56 UTC (rev 286347)
</span><span class="lines">@@ -65,7 +65,7 @@
</span><span class="cx">     static JSC::IsoSubspace* subspaceFor(JSC::VM& vm)
</span><span class="cx">     {
</span><span class="cx">         STATIC_ASSERT_ISO_SUBSPACE_SHARABLE(JSTestNamedGetterCallWithPrototype, Base);
</span><del>-        return &vm.plainObjectSpace;
</del><ins>+        return &vm.plainObjectSpace();
</ins><span class="cx">     }
</span><span class="cx">     static JSC::Structure* createStructure(JSC::VM& vm, JSC::JSGlobalObject* globalObject, JSC::JSValue prototype)
</span><span class="cx">     {
</span><span class="lines">@@ -220,9 +220,9 @@
</span><span class="cx">         return space;
</span><span class="cx">     static_assert(std::is_base_of_v<JSC::JSDestructibleObject, JSTestNamedGetterCallWith> || !JSTestNamedGetterCallWith::needsDestruction);
</span><span class="cx">     if constexpr (std::is_base_of_v<JSC::JSDestructibleObject, JSTestNamedGetterCallWith>)
</span><del>-        spaces.m_subspaceForTestNamedGetterCallWith = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, *vm.destructibleObjectHeapCellType, JSTestNamedGetterCallWith);
</del><ins>+        spaces.m_subspaceForTestNamedGetterCallWith = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, vm.destructibleObjectHeapCellType(), JSTestNamedGetterCallWith);
</ins><span class="cx">     else
</span><del>-        spaces.m_subspaceForTestNamedGetterCallWith = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, *vm.cellHeapCellType, JSTestNamedGetterCallWith);
</del><ins>+        spaces.m_subspaceForTestNamedGetterCallWith = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, vm.cellHeapCellType(), JSTestNamedGetterCallWith);
</ins><span class="cx">     auto* space = spaces.m_subspaceForTestNamedGetterCallWith.get();
</span><span class="cx"> IGNORE_WARNINGS_BEGIN("unreachable-code")
</span><span class="cx"> IGNORE_WARNINGS_BEGIN("tautological-compare")
</span></span></pre></div>
<a id="trunkSourceWebCorebindingsscriptstestJSJSTestNamedGetterNoIdentifiercpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/scripts/test/JS/JSTestNamedGetterNoIdentifier.cpp (286346 => 286347)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/bindings/scripts/test/JS/JSTestNamedGetterNoIdentifier.cpp  2021-12-01 02:56:24 UTC (rev 286346)
+++ trunk/Source/WebCore/bindings/scripts/test/JS/JSTestNamedGetterNoIdentifier.cpp     2021-12-01 04:38:56 UTC (rev 286347)
</span><span class="lines">@@ -65,7 +65,7 @@
</span><span class="cx">     static JSC::IsoSubspace* subspaceFor(JSC::VM& vm)
</span><span class="cx">     {
</span><span class="cx">         STATIC_ASSERT_ISO_SUBSPACE_SHARABLE(JSTestNamedGetterNoIdentifierPrototype, Base);
</span><del>-        return &vm.plainObjectSpace;
</del><ins>+        return &vm.plainObjectSpace();
</ins><span class="cx">     }
</span><span class="cx">     static JSC::Structure* createStructure(JSC::VM& vm, JSC::JSGlobalObject* globalObject, JSC::JSValue prototype)
</span><span class="cx">     {
</span><span class="lines">@@ -220,9 +220,9 @@
</span><span class="cx">         return space;
</span><span class="cx">     static_assert(std::is_base_of_v<JSC::JSDestructibleObject, JSTestNamedGetterNoIdentifier> || !JSTestNamedGetterNoIdentifier::needsDestruction);
</span><span class="cx">     if constexpr (std::is_base_of_v<JSC::JSDestructibleObject, JSTestNamedGetterNoIdentifier>)
</span><del>-        spaces.m_subspaceForTestNamedGetterNoIdentifier = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, *vm.destructibleObjectHeapCellType, JSTestNamedGetterNoIdentifier);
</del><ins>+        spaces.m_subspaceForTestNamedGetterNoIdentifier = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, vm.destructibleObjectHeapCellType(), JSTestNamedGetterNoIdentifier);
</ins><span class="cx">     else
</span><del>-        spaces.m_subspaceForTestNamedGetterNoIdentifier = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, *vm.cellHeapCellType, JSTestNamedGetterNoIdentifier);
</del><ins>+        spaces.m_subspaceForTestNamedGetterNoIdentifier = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, vm.cellHeapCellType(), JSTestNamedGetterNoIdentifier);
</ins><span class="cx">     auto* space = spaces.m_subspaceForTestNamedGetterNoIdentifier.get();
</span><span class="cx"> IGNORE_WARNINGS_BEGIN("unreachable-code")
</span><span class="cx"> IGNORE_WARNINGS_BEGIN("tautological-compare")
</span></span></pre></div>
<a id="trunkSourceWebCorebindingsscriptstestJSJSTestNamedGetterWithIdentifiercpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/scripts/test/JS/JSTestNamedGetterWithIdentifier.cpp (286346 => 286347)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/bindings/scripts/test/JS/JSTestNamedGetterWithIdentifier.cpp        2021-12-01 02:56:24 UTC (rev 286346)
+++ trunk/Source/WebCore/bindings/scripts/test/JS/JSTestNamedGetterWithIdentifier.cpp   2021-12-01 04:38:56 UTC (rev 286347)
</span><span class="lines">@@ -70,7 +70,7 @@
</span><span class="cx">     static JSC::IsoSubspace* subspaceFor(JSC::VM& vm)
</span><span class="cx">     {
</span><span class="cx">         STATIC_ASSERT_ISO_SUBSPACE_SHARABLE(JSTestNamedGetterWithIdentifierPrototype, Base);
</span><del>-        return &vm.plainObjectSpace;
</del><ins>+        return &vm.plainObjectSpace();
</ins><span class="cx">     }
</span><span class="cx">     static JSC::Structure* createStructure(JSC::VM& vm, JSC::JSGlobalObject* globalObject, JSC::JSValue prototype)
</span><span class="cx">     {
</span><span class="lines">@@ -246,9 +246,9 @@
</span><span class="cx">         return space;
</span><span class="cx">     static_assert(std::is_base_of_v<JSC::JSDestructibleObject, JSTestNamedGetterWithIdentifier> || !JSTestNamedGetterWithIdentifier::needsDestruction);
</span><span class="cx">     if constexpr (std::is_base_of_v<JSC::JSDestructibleObject, JSTestNamedGetterWithIdentifier>)
</span><del>-        spaces.m_subspaceForTestNamedGetterWithIdentifier = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, *vm.destructibleObjectHeapCellType, JSTestNamedGetterWithIdentifier);
</del><ins>+        spaces.m_subspaceForTestNamedGetterWithIdentifier = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, vm.destructibleObjectHeapCellType(), JSTestNamedGetterWithIdentifier);
</ins><span class="cx">     else
</span><del>-        spaces.m_subspaceForTestNamedGetterWithIdentifier = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, *vm.cellHeapCellType, JSTestNamedGetterWithIdentifier);
</del><ins>+        spaces.m_subspaceForTestNamedGetterWithIdentifier = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, vm.cellHeapCellType(), JSTestNamedGetterWithIdentifier);
</ins><span class="cx">     auto* space = spaces.m_subspaceForTestNamedGetterWithIdentifier.get();
</span><span class="cx"> IGNORE_WARNINGS_BEGIN("unreachable-code")
</span><span class="cx"> IGNORE_WARNINGS_BEGIN("tautological-compare")
</span></span></pre></div>
<a id="trunkSourceWebCorebindingsscriptstestJSJSTestNamedSetterNoIdentifiercpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/scripts/test/JS/JSTestNamedSetterNoIdentifier.cpp (286346 => 286347)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/bindings/scripts/test/JS/JSTestNamedSetterNoIdentifier.cpp  2021-12-01 02:56:24 UTC (rev 286346)
+++ trunk/Source/WebCore/bindings/scripts/test/JS/JSTestNamedSetterNoIdentifier.cpp     2021-12-01 04:38:56 UTC (rev 286347)
</span><span class="lines">@@ -65,7 +65,7 @@
</span><span class="cx">     static JSC::IsoSubspace* subspaceFor(JSC::VM& vm)
</span><span class="cx">     {
</span><span class="cx">         STATIC_ASSERT_ISO_SUBSPACE_SHARABLE(JSTestNamedSetterNoIdentifierPrototype, Base);
</span><del>-        return &vm.plainObjectSpace;
</del><ins>+        return &vm.plainObjectSpace();
</ins><span class="cx">     }
</span><span class="cx">     static JSC::Structure* createStructure(JSC::VM& vm, JSC::JSGlobalObject* globalObject, JSC::JSValue prototype)
</span><span class="cx">     {
</span><span class="lines">@@ -300,9 +300,9 @@
</span><span class="cx">         return space;
</span><span class="cx">     static_assert(std::is_base_of_v<JSC::JSDestructibleObject, JSTestNamedSetterNoIdentifier> || !JSTestNamedSetterNoIdentifier::needsDestruction);
</span><span class="cx">     if constexpr (std::is_base_of_v<JSC::JSDestructibleObject, JSTestNamedSetterNoIdentifier>)
</span><del>-        spaces.m_subspaceForTestNamedSetterNoIdentifier = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, *vm.destructibleObjectHeapCellType, JSTestNamedSetterNoIdentifier);
</del><ins>+        spaces.m_subspaceForTestNamedSetterNoIdentifier = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, vm.destructibleObjectHeapCellType(), JSTestNamedSetterNoIdentifier);
</ins><span class="cx">     else
</span><del>-        spaces.m_subspaceForTestNamedSetterNoIdentifier = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, *vm.cellHeapCellType, JSTestNamedSetterNoIdentifier);
</del><ins>+        spaces.m_subspaceForTestNamedSetterNoIdentifier = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, vm.cellHeapCellType(), JSTestNamedSetterNoIdentifier);
</ins><span class="cx">     auto* space = spaces.m_subspaceForTestNamedSetterNoIdentifier.get();
</span><span class="cx"> IGNORE_WARNINGS_BEGIN("unreachable-code")
</span><span class="cx"> IGNORE_WARNINGS_BEGIN("tautological-compare")
</span></span></pre></div>
<a id="trunkSourceWebCorebindingsscriptstestJSJSTestNamedSetterThrowingExceptioncpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/scripts/test/JS/JSTestNamedSetterThrowingException.cpp (286346 => 286347)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/bindings/scripts/test/JS/JSTestNamedSetterThrowingException.cpp     2021-12-01 02:56:24 UTC (rev 286346)
+++ trunk/Source/WebCore/bindings/scripts/test/JS/JSTestNamedSetterThrowingException.cpp        2021-12-01 04:38:56 UTC (rev 286347)
</span><span class="lines">@@ -65,7 +65,7 @@
</span><span class="cx">     static JSC::IsoSubspace* subspaceFor(JSC::VM& vm)
</span><span class="cx">     {
</span><span class="cx">         STATIC_ASSERT_ISO_SUBSPACE_SHARABLE(JSTestNamedSetterThrowingExceptionPrototype, Base);
</span><del>-        return &vm.plainObjectSpace;
</del><ins>+        return &vm.plainObjectSpace();
</ins><span class="cx">     }
</span><span class="cx">     static JSC::Structure* createStructure(JSC::VM& vm, JSC::JSGlobalObject* globalObject, JSC::JSValue prototype)
</span><span class="cx">     {
</span><span class="lines">@@ -300,9 +300,9 @@
</span><span class="cx">         return space;
</span><span class="cx">     static_assert(std::is_base_of_v<JSC::JSDestructibleObject, JSTestNamedSetterThrowingException> || !JSTestNamedSetterThrowingException::needsDestruction);
</span><span class="cx">     if constexpr (std::is_base_of_v<JSC::JSDestructibleObject, JSTestNamedSetterThrowingException>)
</span><del>-        spaces.m_subspaceForTestNamedSetterThrowingException = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, *vm.destructibleObjectHeapCellType, JSTestNamedSetterThrowingException);
</del><ins>+        spaces.m_subspaceForTestNamedSetterThrowingException = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, vm.destructibleObjectHeapCellType(), JSTestNamedSetterThrowingException);
</ins><span class="cx">     else
</span><del>-        spaces.m_subspaceForTestNamedSetterThrowingException = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, *vm.cellHeapCellType, JSTestNamedSetterThrowingException);
</del><ins>+        spaces.m_subspaceForTestNamedSetterThrowingException = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, vm.cellHeapCellType(), JSTestNamedSetterThrowingException);
</ins><span class="cx">     auto* space = spaces.m_subspaceForTestNamedSetterThrowingException.get();
</span><span class="cx"> IGNORE_WARNINGS_BEGIN("unreachable-code")
</span><span class="cx"> IGNORE_WARNINGS_BEGIN("tautological-compare")
</span></span></pre></div>
<a id="trunkSourceWebCorebindingsscriptstestJSJSTestNamedSetterWithIdentifiercpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/scripts/test/JS/JSTestNamedSetterWithIdentifier.cpp (286346 => 286347)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/bindings/scripts/test/JS/JSTestNamedSetterWithIdentifier.cpp        2021-12-01 02:56:24 UTC (rev 286346)
+++ trunk/Source/WebCore/bindings/scripts/test/JS/JSTestNamedSetterWithIdentifier.cpp   2021-12-01 04:38:56 UTC (rev 286347)
</span><span class="lines">@@ -72,7 +72,7 @@
</span><span class="cx">     static JSC::IsoSubspace* subspaceFor(JSC::VM& vm)
</span><span class="cx">     {
</span><span class="cx">         STATIC_ASSERT_ISO_SUBSPACE_SHARABLE(JSTestNamedSetterWithIdentifierPrototype, Base);
</span><del>-        return &vm.plainObjectSpace;
</del><ins>+        return &vm.plainObjectSpace();
</ins><span class="cx">     }
</span><span class="cx">     static JSC::Structure* createStructure(JSC::VM& vm, JSC::JSGlobalObject* globalObject, JSC::JSValue prototype)
</span><span class="cx">     {
</span><span class="lines">@@ -331,9 +331,9 @@
</span><span class="cx">         return space;
</span><span class="cx">     static_assert(std::is_base_of_v<JSC::JSDestructibleObject, JSTestNamedSetterWithIdentifier> || !JSTestNamedSetterWithIdentifier::needsDestruction);
</span><span class="cx">     if constexpr (std::is_base_of_v<JSC::JSDestructibleObject, JSTestNamedSetterWithIdentifier>)
</span><del>-        spaces.m_subspaceForTestNamedSetterWithIdentifier = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, *vm.destructibleObjectHeapCellType, JSTestNamedSetterWithIdentifier);
</del><ins>+        spaces.m_subspaceForTestNamedSetterWithIdentifier = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, vm.destructibleObjectHeapCellType(), JSTestNamedSetterWithIdentifier);
</ins><span class="cx">     else
</span><del>-        spaces.m_subspaceForTestNamedSetterWithIdentifier = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, *vm.cellHeapCellType, JSTestNamedSetterWithIdentifier);
</del><ins>+        spaces.m_subspaceForTestNamedSetterWithIdentifier = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, vm.cellHeapCellType(), JSTestNamedSetterWithIdentifier);
</ins><span class="cx">     auto* space = spaces.m_subspaceForTestNamedSetterWithIdentifier.get();
</span><span class="cx"> IGNORE_WARNINGS_BEGIN("unreachable-code")
</span><span class="cx"> IGNORE_WARNINGS_BEGIN("tautological-compare")
</span></span></pre></div>
<a id="trunkSourceWebCorebindingsscriptstestJSJSTestNamedSetterWithIndexedGettercpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/scripts/test/JS/JSTestNamedSetterWithIndexedGetter.cpp (286346 => 286347)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/bindings/scripts/test/JS/JSTestNamedSetterWithIndexedGetter.cpp     2021-12-01 02:56:24 UTC (rev 286346)
+++ trunk/Source/WebCore/bindings/scripts/test/JS/JSTestNamedSetterWithIndexedGetter.cpp        2021-12-01 04:38:56 UTC (rev 286347)
</span><span class="lines">@@ -75,7 +75,7 @@
</span><span class="cx">     static JSC::IsoSubspace* subspaceFor(JSC::VM& vm)
</span><span class="cx">     {
</span><span class="cx">         STATIC_ASSERT_ISO_SUBSPACE_SHARABLE(JSTestNamedSetterWithIndexedGetterPrototype, Base);
</span><del>-        return &vm.plainObjectSpace;
</del><ins>+        return &vm.plainObjectSpace();
</ins><span class="cx">     }
</span><span class="cx">     static JSC::Structure* createStructure(JSC::VM& vm, JSC::JSGlobalObject* globalObject, JSC::JSValue prototype)
</span><span class="cx">     {
</span><span class="lines">@@ -378,9 +378,9 @@
</span><span class="cx">         return space;
</span><span class="cx">     static_assert(std::is_base_of_v<JSC::JSDestructibleObject, JSTestNamedSetterWithIndexedGetter> || !JSTestNamedSetterWithIndexedGetter::needsDestruction);
</span><span class="cx">     if constexpr (std::is_base_of_v<JSC::JSDestructibleObject, JSTestNamedSetterWithIndexedGetter>)
</span><del>-        spaces.m_subspaceForTestNamedSetterWithIndexedGetter = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, *vm.destructibleObjectHeapCellType, JSTestNamedSetterWithIndexedGetter);
</del><ins>+        spaces.m_subspaceForTestNamedSetterWithIndexedGetter = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, vm.destructibleObjectHeapCellType(), JSTestNamedSetterWithIndexedGetter);
</ins><span class="cx">     else
</span><del>-        spaces.m_subspaceForTestNamedSetterWithIndexedGetter = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, *vm.cellHeapCellType, JSTestNamedSetterWithIndexedGetter);
</del><ins>+        spaces.m_subspaceForTestNamedSetterWithIndexedGetter = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, vm.cellHeapCellType(), JSTestNamedSetterWithIndexedGetter);
</ins><span class="cx">     auto* space = spaces.m_subspaceForTestNamedSetterWithIndexedGetter.get();
</span><span class="cx"> IGNORE_WARNINGS_BEGIN("unreachable-code")
</span><span class="cx"> IGNORE_WARNINGS_BEGIN("tautological-compare")
</span></span></pre></div>
<a id="trunkSourceWebCorebindingsscriptstestJSJSTestNamedSetterWithIndexedGetterAndSettercpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/scripts/test/JS/JSTestNamedSetterWithIndexedGetterAndSetter.cpp (286346 => 286347)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/bindings/scripts/test/JS/JSTestNamedSetterWithIndexedGetterAndSetter.cpp    2021-12-01 02:56:24 UTC (rev 286346)
+++ trunk/Source/WebCore/bindings/scripts/test/JS/JSTestNamedSetterWithIndexedGetterAndSetter.cpp       2021-12-01 04:38:56 UTC (rev 286347)
</span><span class="lines">@@ -75,7 +75,7 @@
</span><span class="cx">     static JSC::IsoSubspace* subspaceFor(JSC::VM& vm)
</span><span class="cx">     {
</span><span class="cx">         STATIC_ASSERT_ISO_SUBSPACE_SHARABLE(JSTestNamedSetterWithIndexedGetterAndSetterPrototype, Base);
</span><del>-        return &vm.plainObjectSpace;
</del><ins>+        return &vm.plainObjectSpace();
</ins><span class="cx">     }
</span><span class="cx">     static JSC::Structure* createStructure(JSC::VM& vm, JSC::JSGlobalObject* globalObject, JSC::JSValue prototype)
</span><span class="cx">     {
</span><span class="lines">@@ -428,9 +428,9 @@
</span><span class="cx">         return space;
</span><span class="cx">     static_assert(std::is_base_of_v<JSC::JSDestructibleObject, JSTestNamedSetterWithIndexedGetterAndSetter> || !JSTestNamedSetterWithIndexedGetterAndSetter::needsDestruction);
</span><span class="cx">     if constexpr (std::is_base_of_v<JSC::JSDestructibleObject, JSTestNamedSetterWithIndexedGetterAndSetter>)
</span><del>-        spaces.m_subspaceForTestNamedSetterWithIndexedGetterAndSetter = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, *vm.destructibleObjectHeapCellType, JSTestNamedSetterWithIndexedGetterAndSetter);
</del><ins>+        spaces.m_subspaceForTestNamedSetterWithIndexedGetterAndSetter = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, vm.destructibleObjectHeapCellType(), JSTestNamedSetterWithIndexedGetterAndSetter);
</ins><span class="cx">     else
</span><del>-        spaces.m_subspaceForTestNamedSetterWithIndexedGetterAndSetter = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, *vm.cellHeapCellType, JSTestNamedSetterWithIndexedGetterAndSetter);
</del><ins>+        spaces.m_subspaceForTestNamedSetterWithIndexedGetterAndSetter = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, vm.cellHeapCellType(), JSTestNamedSetterWithIndexedGetterAndSetter);
</ins><span class="cx">     auto* space = spaces.m_subspaceForTestNamedSetterWithIndexedGetterAndSetter.get();
</span><span class="cx"> IGNORE_WARNINGS_BEGIN("unreachable-code")
</span><span class="cx"> IGNORE_WARNINGS_BEGIN("tautological-compare")
</span></span></pre></div>
<a id="trunkSourceWebCorebindingsscriptstestJSJSTestNamedSetterWithLegacyOverrideBuiltInscpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/scripts/test/JS/JSTestNamedSetterWithLegacyOverrideBuiltIns.cpp (286346 => 286347)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/bindings/scripts/test/JS/JSTestNamedSetterWithLegacyOverrideBuiltIns.cpp    2021-12-01 02:56:24 UTC (rev 286346)
+++ trunk/Source/WebCore/bindings/scripts/test/JS/JSTestNamedSetterWithLegacyOverrideBuiltIns.cpp       2021-12-01 04:38:56 UTC (rev 286347)
</span><span class="lines">@@ -65,7 +65,7 @@
</span><span class="cx">     static JSC::IsoSubspace* subspaceFor(JSC::VM& vm)
</span><span class="cx">     {
</span><span class="cx">         STATIC_ASSERT_ISO_SUBSPACE_SHARABLE(JSTestNamedSetterWithLegacyOverrideBuiltInsPrototype, Base);
</span><del>-        return &vm.plainObjectSpace;
</del><ins>+        return &vm.plainObjectSpace();
</ins><span class="cx">     }
</span><span class="cx">     static JSC::Structure* createStructure(JSC::VM& vm, JSC::JSGlobalObject* globalObject, JSC::JSValue prototype)
</span><span class="cx">     {
</span><span class="lines">@@ -277,9 +277,9 @@
</span><span class="cx">         return space;
</span><span class="cx">     static_assert(std::is_base_of_v<JSC::JSDestructibleObject, JSTestNamedSetterWithLegacyOverrideBuiltIns> || !JSTestNamedSetterWithLegacyOverrideBuiltIns::needsDestruction);
</span><span class="cx">     if constexpr (std::is_base_of_v<JSC::JSDestructibleObject, JSTestNamedSetterWithLegacyOverrideBuiltIns>)
</span><del>-        spaces.m_subspaceForTestNamedSetterWithLegacyOverrideBuiltIns = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, *vm.destructibleObjectHeapCellType, JSTestNamedSetterWithLegacyOverrideBuiltIns);
</del><ins>+        spaces.m_subspaceForTestNamedSetterWithLegacyOverrideBuiltIns = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, vm.destructibleObjectHeapCellType(), JSTestNamedSetterWithLegacyOverrideBuiltIns);
</ins><span class="cx">     else
</span><del>-        spaces.m_subspaceForTestNamedSetterWithLegacyOverrideBuiltIns = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, *vm.cellHeapCellType, JSTestNamedSetterWithLegacyOverrideBuiltIns);
</del><ins>+        spaces.m_subspaceForTestNamedSetterWithLegacyOverrideBuiltIns = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, vm.cellHeapCellType(), JSTestNamedSetterWithLegacyOverrideBuiltIns);
</ins><span class="cx">     auto* space = spaces.m_subspaceForTestNamedSetterWithLegacyOverrideBuiltIns.get();
</span><span class="cx"> IGNORE_WARNINGS_BEGIN("unreachable-code")
</span><span class="cx"> IGNORE_WARNINGS_BEGIN("tautological-compare")
</span></span></pre></div>
<a id="trunkSourceWebCorebindingsscriptstestJSJSTestNamedSetterWithLegacyUnforgeablePropertiescpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/scripts/test/JS/JSTestNamedSetterWithLegacyUnforgeableProperties.cpp (286346 => 286347)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/bindings/scripts/test/JS/JSTestNamedSetterWithLegacyUnforgeableProperties.cpp       2021-12-01 02:56:24 UTC (rev 286346)
+++ trunk/Source/WebCore/bindings/scripts/test/JS/JSTestNamedSetterWithLegacyUnforgeableProperties.cpp  2021-12-01 04:38:56 UTC (rev 286347)
</span><span class="lines">@@ -74,7 +74,7 @@
</span><span class="cx">     static JSC::IsoSubspace* subspaceFor(JSC::VM& vm)
</span><span class="cx">     {
</span><span class="cx">         STATIC_ASSERT_ISO_SUBSPACE_SHARABLE(JSTestNamedSetterWithLegacyUnforgeablePropertiesPrototype, Base);
</span><del>-        return &vm.plainObjectSpace;
</del><ins>+        return &vm.plainObjectSpace();
</ins><span class="cx">     }
</span><span class="cx">     static JSC::Structure* createStructure(JSC::VM& vm, JSC::JSGlobalObject* globalObject, JSC::JSValue prototype)
</span><span class="cx">     {
</span><span class="lines">@@ -361,9 +361,9 @@
</span><span class="cx">         return space;
</span><span class="cx">     static_assert(std::is_base_of_v<JSC::JSDestructibleObject, JSTestNamedSetterWithLegacyUnforgeableProperties> || !JSTestNamedSetterWithLegacyUnforgeableProperties::needsDestruction);
</span><span class="cx">     if constexpr (std::is_base_of_v<JSC::JSDestructibleObject, JSTestNamedSetterWithLegacyUnforgeableProperties>)
</span><del>-        spaces.m_subspaceForTestNamedSetterWithLegacyUnforgeableProperties = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, *vm.destructibleObjectHeapCellType, JSTestNamedSetterWithLegacyUnforgeableProperties);
</del><ins>+        spaces.m_subspaceForTestNamedSetterWithLegacyUnforgeableProperties = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, vm.destructibleObjectHeapCellType(), JSTestNamedSetterWithLegacyUnforgeableProperties);
</ins><span class="cx">     else
</span><del>-        spaces.m_subspaceForTestNamedSetterWithLegacyUnforgeableProperties = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, *vm.cellHeapCellType, JSTestNamedSetterWithLegacyUnforgeableProperties);
</del><ins>+        spaces.m_subspaceForTestNamedSetterWithLegacyUnforgeableProperties = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, vm.cellHeapCellType(), JSTestNamedSetterWithLegacyUnforgeableProperties);
</ins><span class="cx">     auto* space = spaces.m_subspaceForTestNamedSetterWithLegacyUnforgeableProperties.get();
</span><span class="cx"> IGNORE_WARNINGS_BEGIN("unreachable-code")
</span><span class="cx"> IGNORE_WARNINGS_BEGIN("tautological-compare")
</span></span></pre></div>
<a id="trunkSourceWebCorebindingsscriptstestJSJSTestNamedSetterWithLegacyUnforgeablePropertiesAndLegacyOverrideBuiltInscpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/scripts/test/JS/JSTestNamedSetterWithLegacyUnforgeablePropertiesAndLegacyOverrideBuiltIns.cpp (286346 => 286347)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/bindings/scripts/test/JS/JSTestNamedSetterWithLegacyUnforgeablePropertiesAndLegacyOverrideBuiltIns.cpp      2021-12-01 02:56:24 UTC (rev 286346)
+++ trunk/Source/WebCore/bindings/scripts/test/JS/JSTestNamedSetterWithLegacyUnforgeablePropertiesAndLegacyOverrideBuiltIns.cpp 2021-12-01 04:38:56 UTC (rev 286347)
</span><span class="lines">@@ -74,7 +74,7 @@
</span><span class="cx">     static JSC::IsoSubspace* subspaceFor(JSC::VM& vm)
</span><span class="cx">     {
</span><span class="cx">         STATIC_ASSERT_ISO_SUBSPACE_SHARABLE(JSTestNamedSetterWithLegacyUnforgeablePropertiesAndLegacyOverrideBuiltInsPrototype, Base);
</span><del>-        return &vm.plainObjectSpace;
</del><ins>+        return &vm.plainObjectSpace();
</ins><span class="cx">     }
</span><span class="cx">     static JSC::Structure* createStructure(JSC::VM& vm, JSC::JSGlobalObject* globalObject, JSC::JSValue prototype)
</span><span class="cx">     {
</span><span class="lines">@@ -338,9 +338,9 @@
</span><span class="cx">         return space;
</span><span class="cx">     static_assert(std::is_base_of_v<JSC::JSDestructibleObject, JSTestNamedSetterWithLegacyUnforgeablePropertiesAndLegacyOverrideBuiltIns> || !JSTestNamedSetterWithLegacyUnforgeablePropertiesAndLegacyOverrideBuiltIns::needsDestruction);
</span><span class="cx">     if constexpr (std::is_base_of_v<JSC::JSDestructibleObject, JSTestNamedSetterWithLegacyUnforgeablePropertiesAndLegacyOverrideBuiltIns>)
</span><del>-        spaces.m_subspaceForTestNamedSetterWithLegacyUnforgeablePropertiesAndLegacyOverrideBuiltIns = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, *vm.destructibleObjectHeapCellType, JSTestNamedSetterWithLegacyUnforgeablePropertiesAndLegacyOverrideBuiltIns);
</del><ins>+        spaces.m_subspaceForTestNamedSetterWithLegacyUnforgeablePropertiesAndLegacyOverrideBuiltIns = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, vm.destructibleObjectHeapCellType(), JSTestNamedSetterWithLegacyUnforgeablePropertiesAndLegacyOverrideBuiltIns);
</ins><span class="cx">     else
</span><del>-        spaces.m_subspaceForTestNamedSetterWithLegacyUnforgeablePropertiesAndLegacyOverrideBuiltIns = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, *vm.cellHeapCellType, JSTestNamedSetterWithLegacyUnforgeablePropertiesAndLegacyOverrideBuiltIns);
</del><ins>+        spaces.m_subspaceForTestNamedSetterWithLegacyUnforgeablePropertiesAndLegacyOverrideBuiltIns = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, vm.cellHeapCellType(), JSTestNamedSetterWithLegacyUnforgeablePropertiesAndLegacyOverrideBuiltIns);
</ins><span class="cx">     auto* space = spaces.m_subspaceForTestNamedSetterWithLegacyUnforgeablePropertiesAndLegacyOverrideBuiltIns.get();
</span><span class="cx"> IGNORE_WARNINGS_BEGIN("unreachable-code")
</span><span class="cx"> IGNORE_WARNINGS_BEGIN("tautological-compare")
</span></span></pre></div>
<a id="trunkSourceWebCorebindingsscriptstestJSJSTestNamespaceObjectcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/scripts/test/JS/JSTestNamespaceObject.cpp (286346 => 286347)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/bindings/scripts/test/JS/JSTestNamespaceObject.cpp  2021-12-01 02:56:24 UTC (rev 286346)
+++ trunk/Source/WebCore/bindings/scripts/test/JS/JSTestNamespaceObject.cpp     2021-12-01 04:38:56 UTC (rev 286347)
</span><span class="lines">@@ -280,9 +280,9 @@
</span><span class="cx">         return space;
</span><span class="cx">     static_assert(std::is_base_of_v<JSC::JSDestructibleObject, JSTestNamespaceObject> || !JSTestNamespaceObject::needsDestruction);
</span><span class="cx">     if constexpr (std::is_base_of_v<JSC::JSDestructibleObject, JSTestNamespaceObject>)
</span><del>-        spaces.m_subspaceForTestNamespaceObject = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, *vm.destructibleObjectHeapCellType, JSTestNamespaceObject);
</del><ins>+        spaces.m_subspaceForTestNamespaceObject = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, vm.destructibleObjectHeapCellType(), JSTestNamespaceObject);
</ins><span class="cx">     else
</span><del>-        spaces.m_subspaceForTestNamespaceObject = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, *vm.cellHeapCellType, JSTestNamespaceObject);
</del><ins>+        spaces.m_subspaceForTestNamespaceObject = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, vm.cellHeapCellType(), JSTestNamespaceObject);
</ins><span class="cx">     auto* space = spaces.m_subspaceForTestNamespaceObject.get();
</span><span class="cx"> IGNORE_WARNINGS_BEGIN("unreachable-code")
</span><span class="cx"> IGNORE_WARNINGS_BEGIN("tautological-compare")
</span></span></pre></div>
<a id="trunkSourceWebCorebindingsscriptstestJSJSTestNodecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/scripts/test/JS/JSTestNode.cpp (286346 => 286347)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/bindings/scripts/test/JS/JSTestNode.cpp     2021-12-01 02:56:24 UTC (rev 286346)
+++ trunk/Source/WebCore/bindings/scripts/test/JS/JSTestNode.cpp        2021-12-01 04:38:56 UTC (rev 286347)
</span><span class="lines">@@ -95,7 +95,7 @@
</span><span class="cx">     static JSC::IsoSubspace* subspaceFor(JSC::VM& vm)
</span><span class="cx">     {
</span><span class="cx">         STATIC_ASSERT_ISO_SUBSPACE_SHARABLE(JSTestNodePrototype, Base);
</span><del>-        return &vm.plainObjectSpace;
</del><ins>+        return &vm.plainObjectSpace();
</ins><span class="cx">     }
</span><span class="cx">     static JSC::Structure* createStructure(JSC::VM& vm, JSC::JSGlobalObject* globalObject, JSC::JSValue prototype)
</span><span class="cx">     {
</span><span class="lines">@@ -405,9 +405,9 @@
</span><span class="cx">             return space;
</span><span class="cx">         static_assert(std::is_base_of_v<JSC::JSDestructibleObject, TestNodeIterator> || !TestNodeIterator::needsDestruction);
</span><span class="cx">         if constexpr (std::is_base_of_v<JSC::JSDestructibleObject, TestNodeIterator>)
</span><del>-            spaces.m_subspaceForTestNodeIterator = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, *vm.destructibleObjectHeapCellType.get(), TestNodeIterator);
</del><ins>+            spaces.m_subspaceForTestNodeIterator = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, vm.destructibleObjectHeapCellType(), TestNodeIterator);
</ins><span class="cx">         else
</span><del>-            spaces.m_subspaceForTestNodeIterator = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, *vm.cellHeapCellType, TestNodeIterator);
</del><ins>+            spaces.m_subspaceForTestNodeIterator = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, vm.cellHeapCellType(), TestNodeIterator);
</ins><span class="cx">         auto* space = spaces.m_subspaceForTestNodeIterator.get();
</span><span class="cx"> IGNORE_WARNINGS_BEGIN("unreachable-code")
</span><span class="cx"> IGNORE_WARNINGS_BEGIN("tautological-compare")
</span><span class="lines">@@ -497,9 +497,9 @@
</span><span class="cx">         return space;
</span><span class="cx">     static_assert(std::is_base_of_v<JSC::JSDestructibleObject, JSTestNode> || !JSTestNode::needsDestruction);
</span><span class="cx">     if constexpr (std::is_base_of_v<JSC::JSDestructibleObject, JSTestNode>)
</span><del>-        spaces.m_subspaceForTestNode = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, *vm.destructibleObjectHeapCellType, JSTestNode);
</del><ins>+        spaces.m_subspaceForTestNode = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, vm.destructibleObjectHeapCellType(), JSTestNode);
</ins><span class="cx">     else
</span><del>-        spaces.m_subspaceForTestNode = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, *vm.cellHeapCellType, JSTestNode);
</del><ins>+        spaces.m_subspaceForTestNode = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, vm.cellHeapCellType(), JSTestNode);
</ins><span class="cx">     auto* space = spaces.m_subspaceForTestNode.get();
</span><span class="cx"> IGNORE_WARNINGS_BEGIN("unreachable-code")
</span><span class="cx"> IGNORE_WARNINGS_BEGIN("tautological-compare")
</span></span></pre></div>
<a id="trunkSourceWebCorebindingsscriptstestJSJSTestObjcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/scripts/test/JS/JSTestObj.cpp (286346 => 286347)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/bindings/scripts/test/JS/JSTestObj.cpp      2021-12-01 02:56:24 UTC (rev 286346)
+++ trunk/Source/WebCore/bindings/scripts/test/JS/JSTestObj.cpp 2021-12-01 04:38:56 UTC (rev 286347)
</span><span class="lines">@@ -1866,7 +1866,7 @@
</span><span class="cx">     static JSC::IsoSubspace* subspaceFor(JSC::VM& vm)
</span><span class="cx">     {
</span><span class="cx">         STATIC_ASSERT_ISO_SUBSPACE_SHARABLE(JSTestObjPrototype, Base);
</span><del>-        return &vm.plainObjectSpace;
</del><ins>+        return &vm.plainObjectSpace();
</ins><span class="cx">     }
</span><span class="cx">     static JSC::Structure* createStructure(JSC::VM& vm, JSC::JSGlobalObject* globalObject, JSC::JSValue prototype)
</span><span class="cx">     {
</span><span class="lines">@@ -9006,9 +9006,9 @@
</span><span class="cx">         return space;
</span><span class="cx">     static_assert(std::is_base_of_v<JSC::JSDestructibleObject, JSTestObj> || !JSTestObj::needsDestruction);
</span><span class="cx">     if constexpr (std::is_base_of_v<JSC::JSDestructibleObject, JSTestObj>)
</span><del>-        spaces.m_subspaceForTestObj = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, *vm.destructibleObjectHeapCellType, JSTestObj);
</del><ins>+        spaces.m_subspaceForTestObj = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, vm.destructibleObjectHeapCellType(), JSTestObj);
</ins><span class="cx">     else
</span><del>-        spaces.m_subspaceForTestObj = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, *vm.cellHeapCellType, JSTestObj);
</del><ins>+        spaces.m_subspaceForTestObj = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, vm.cellHeapCellType(), JSTestObj);
</ins><span class="cx">     auto* space = spaces.m_subspaceForTestObj.get();
</span><span class="cx"> IGNORE_WARNINGS_BEGIN("unreachable-code")
</span><span class="cx"> IGNORE_WARNINGS_BEGIN("tautological-compare")
</span></span></pre></div>
<a id="trunkSourceWebCorebindingsscriptstestJSJSTestOperationConditionalcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/scripts/test/JS/JSTestOperationConditional.cpp (286346 => 286347)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/bindings/scripts/test/JS/JSTestOperationConditional.cpp     2021-12-01 02:56:24 UTC (rev 286346)
+++ trunk/Source/WebCore/bindings/scripts/test/JS/JSTestOperationConditional.cpp        2021-12-01 04:38:56 UTC (rev 286347)
</span><span class="lines">@@ -81,7 +81,7 @@
</span><span class="cx">     static JSC::IsoSubspace* subspaceFor(JSC::VM& vm)
</span><span class="cx">     {
</span><span class="cx">         STATIC_ASSERT_ISO_SUBSPACE_SHARABLE(JSTestOperationConditionalPrototype, Base);
</span><del>-        return &vm.plainObjectSpace;
</del><ins>+        return &vm.plainObjectSpace();
</ins><span class="cx">     }
</span><span class="cx">     static JSC::Structure* createStructure(JSC::VM& vm, JSC::JSGlobalObject* globalObject, JSC::JSValue prototype)
</span><span class="cx">     {
</span><span class="lines">@@ -234,9 +234,9 @@
</span><span class="cx">         return space;
</span><span class="cx">     static_assert(std::is_base_of_v<JSC::JSDestructibleObject, JSTestOperationConditional> || !JSTestOperationConditional::needsDestruction);
</span><span class="cx">     if constexpr (std::is_base_of_v<JSC::JSDestructibleObject, JSTestOperationConditional>)
</span><del>-        spaces.m_subspaceForTestOperationConditional = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, *vm.destructibleObjectHeapCellType, JSTestOperationConditional);
</del><ins>+        spaces.m_subspaceForTestOperationConditional = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, vm.destructibleObjectHeapCellType(), JSTestOperationConditional);
</ins><span class="cx">     else
</span><del>-        spaces.m_subspaceForTestOperationConditional = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, *vm.cellHeapCellType, JSTestOperationConditional);
</del><ins>+        spaces.m_subspaceForTestOperationConditional = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, vm.cellHeapCellType(), JSTestOperationConditional);
</ins><span class="cx">     auto* space = spaces.m_subspaceForTestOperationConditional.get();
</span><span class="cx"> IGNORE_WARNINGS_BEGIN("unreachable-code")
</span><span class="cx"> IGNORE_WARNINGS_BEGIN("tautological-compare")
</span></span></pre></div>
<a id="trunkSourceWebCorebindingsscriptstestJSJSTestOverloadedConstructorscpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/scripts/test/JS/JSTestOverloadedConstructors.cpp (286346 => 286347)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/bindings/scripts/test/JS/JSTestOverloadedConstructors.cpp   2021-12-01 02:56:24 UTC (rev 286346)
+++ trunk/Source/WebCore/bindings/scripts/test/JS/JSTestOverloadedConstructors.cpp      2021-12-01 04:38:56 UTC (rev 286347)
</span><span class="lines">@@ -69,7 +69,7 @@
</span><span class="cx">     static JSC::IsoSubspace* subspaceFor(JSC::VM& vm)
</span><span class="cx">     {
</span><span class="cx">         STATIC_ASSERT_ISO_SUBSPACE_SHARABLE(JSTestOverloadedConstructorsPrototype, Base);
</span><del>-        return &vm.plainObjectSpace;
</del><ins>+        return &vm.plainObjectSpace();
</ins><span class="cx">     }
</span><span class="cx">     static JSC::Structure* createStructure(JSC::VM& vm, JSC::JSGlobalObject* globalObject, JSC::JSValue prototype)
</span><span class="cx">     {
</span><span class="lines">@@ -295,9 +295,9 @@
</span><span class="cx">         return space;
</span><span class="cx">     static_assert(std::is_base_of_v<JSC::JSDestructibleObject, JSTestOverloadedConstructors> || !JSTestOverloadedConstructors::needsDestruction);
</span><span class="cx">     if constexpr (std::is_base_of_v<JSC::JSDestructibleObject, JSTestOverloadedConstructors>)
</span><del>-        spaces.m_subspaceForTestOverloadedConstructors = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, *vm.destructibleObjectHeapCellType, JSTestOverloadedConstructors);
</del><ins>+        spaces.m_subspaceForTestOverloadedConstructors = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, vm.destructibleObjectHeapCellType(), JSTestOverloadedConstructors);
</ins><span class="cx">     else
</span><del>-        spaces.m_subspaceForTestOverloadedConstructors = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, *vm.cellHeapCellType, JSTestOverloadedConstructors);
</del><ins>+        spaces.m_subspaceForTestOverloadedConstructors = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, vm.cellHeapCellType(), JSTestOverloadedConstructors);
</ins><span class="cx">     auto* space = spaces.m_subspaceForTestOverloadedConstructors.get();
</span><span class="cx"> IGNORE_WARNINGS_BEGIN("unreachable-code")
</span><span class="cx"> IGNORE_WARNINGS_BEGIN("tautological-compare")
</span></span></pre></div>
<a id="trunkSourceWebCorebindingsscriptstestJSJSTestOverloadedConstructorsWithSequencecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/scripts/test/JS/JSTestOverloadedConstructorsWithSequence.cpp (286346 => 286347)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/bindings/scripts/test/JS/JSTestOverloadedConstructorsWithSequence.cpp       2021-12-01 02:56:24 UTC (rev 286346)
+++ trunk/Source/WebCore/bindings/scripts/test/JS/JSTestOverloadedConstructorsWithSequence.cpp  2021-12-01 04:38:56 UTC (rev 286347)
</span><span class="lines">@@ -68,7 +68,7 @@
</span><span class="cx">     static JSC::IsoSubspace* subspaceFor(JSC::VM& vm)
</span><span class="cx">     {
</span><span class="cx">         STATIC_ASSERT_ISO_SUBSPACE_SHARABLE(JSTestOverloadedConstructorsWithSequencePrototype, Base);
</span><del>-        return &vm.plainObjectSpace;
</del><ins>+        return &vm.plainObjectSpace();
</ins><span class="cx">     }
</span><span class="cx">     static JSC::Structure* createStructure(JSC::VM& vm, JSC::JSGlobalObject* globalObject, JSC::JSValue prototype)
</span><span class="cx">     {
</span><span class="lines">@@ -238,9 +238,9 @@
</span><span class="cx">         return space;
</span><span class="cx">     static_assert(std::is_base_of_v<JSC::JSDestructibleObject, JSTestOverloadedConstructorsWithSequence> || !JSTestOverloadedConstructorsWithSequence::needsDestruction);
</span><span class="cx">     if constexpr (std::is_base_of_v<JSC::JSDestructibleObject, JSTestOverloadedConstructorsWithSequence>)
</span><del>-        spaces.m_subspaceForTestOverloadedConstructorsWithSequence = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, *vm.destructibleObjectHeapCellType, JSTestOverloadedConstructorsWithSequence);
</del><ins>+        spaces.m_subspaceForTestOverloadedConstructorsWithSequence = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, vm.destructibleObjectHeapCellType(), JSTestOverloadedConstructorsWithSequence);
</ins><span class="cx">     else
</span><del>-        spaces.m_subspaceForTestOverloadedConstructorsWithSequence = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, *vm.cellHeapCellType, JSTestOverloadedConstructorsWithSequence);
</del><ins>+        spaces.m_subspaceForTestOverloadedConstructorsWithSequence = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, vm.cellHeapCellType(), JSTestOverloadedConstructorsWithSequence);
</ins><span class="cx">     auto* space = spaces.m_subspaceForTestOverloadedConstructorsWithSequence.get();
</span><span class="cx"> IGNORE_WARNINGS_BEGIN("unreachable-code")
</span><span class="cx"> IGNORE_WARNINGS_BEGIN("tautological-compare")
</span></span></pre></div>
<a id="trunkSourceWebCorebindingsscriptstestJSJSTestPluginInterfacecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/scripts/test/JS/JSTestPluginInterface.cpp (286346 => 286347)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/bindings/scripts/test/JS/JSTestPluginInterface.cpp  2021-12-01 02:56:24 UTC (rev 286346)
+++ trunk/Source/WebCore/bindings/scripts/test/JS/JSTestPluginInterface.cpp     2021-12-01 04:38:56 UTC (rev 286347)
</span><span class="lines">@@ -64,7 +64,7 @@
</span><span class="cx">     static JSC::IsoSubspace* subspaceFor(JSC::VM& vm)
</span><span class="cx">     {
</span><span class="cx">         STATIC_ASSERT_ISO_SUBSPACE_SHARABLE(JSTestPluginInterfacePrototype, Base);
</span><del>-        return &vm.plainObjectSpace;
</del><ins>+        return &vm.plainObjectSpace();
</ins><span class="cx">     }
</span><span class="cx">     static JSC::Structure* createStructure(JSC::VM& vm, JSC::JSGlobalObject* globalObject, JSC::JSValue prototype)
</span><span class="cx">     {
</span><span class="lines">@@ -244,9 +244,9 @@
</span><span class="cx">         return space;
</span><span class="cx">     static_assert(std::is_base_of_v<JSC::JSDestructibleObject, JSTestPluginInterface> || !JSTestPluginInterface::needsDestruction);
</span><span class="cx">     if constexpr (std::is_base_of_v<JSC::JSDestructibleObject, JSTestPluginInterface>)
</span><del>-        spaces.m_subspaceForTestPluginInterface = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, *vm.destructibleObjectHeapCellType, JSTestPluginInterface);
</del><ins>+        spaces.m_subspaceForTestPluginInterface = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, vm.destructibleObjectHeapCellType(), JSTestPluginInterface);
</ins><span class="cx">     else
</span><del>-        spaces.m_subspaceForTestPluginInterface = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, *vm.cellHeapCellType, JSTestPluginInterface);
</del><ins>+        spaces.m_subspaceForTestPluginInterface = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, vm.cellHeapCellType(), JSTestPluginInterface);
</ins><span class="cx">     auto* space = spaces.m_subspaceForTestPluginInterface.get();
</span><span class="cx"> IGNORE_WARNINGS_BEGIN("unreachable-code")
</span><span class="cx"> IGNORE_WARNINGS_BEGIN("tautological-compare")
</span></span></pre></div>
<a id="trunkSourceWebCorebindingsscriptstestJSJSTestPromiseRejectionEventcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/scripts/test/JS/JSTestPromiseRejectionEvent.cpp (286346 => 286347)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/bindings/scripts/test/JS/JSTestPromiseRejectionEvent.cpp    2021-12-01 02:56:24 UTC (rev 286346)
+++ trunk/Source/WebCore/bindings/scripts/test/JS/JSTestPromiseRejectionEvent.cpp       2021-12-01 04:38:56 UTC (rev 286347)
</span><span class="lines">@@ -148,7 +148,7 @@
</span><span class="cx">     static JSC::IsoSubspace* subspaceFor(JSC::VM& vm)
</span><span class="cx">     {
</span><span class="cx">         STATIC_ASSERT_ISO_SUBSPACE_SHARABLE(JSTestPromiseRejectionEventPrototype, Base);
</span><del>-        return &vm.plainObjectSpace;
</del><ins>+        return &vm.plainObjectSpace();
</ins><span class="cx">     }
</span><span class="cx">     static JSC::Structure* createStructure(JSC::VM& vm, JSC::JSGlobalObject* globalObject, JSC::JSValue prototype)
</span><span class="cx">     {
</span><span class="lines">@@ -301,9 +301,9 @@
</span><span class="cx">         return space;
</span><span class="cx">     static_assert(std::is_base_of_v<JSC::JSDestructibleObject, JSTestPromiseRejectionEvent> || !JSTestPromiseRejectionEvent::needsDestruction);
</span><span class="cx">     if constexpr (std::is_base_of_v<JSC::JSDestructibleObject, JSTestPromiseRejectionEvent>)
</span><del>-        spaces.m_subspaceForTestPromiseRejectionEvent = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, *vm.destructibleObjectHeapCellType, JSTestPromiseRejectionEvent);
</del><ins>+        spaces.m_subspaceForTestPromiseRejectionEvent = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, vm.destructibleObjectHeapCellType(), JSTestPromiseRejectionEvent);
</ins><span class="cx">     else
</span><del>-        spaces.m_subspaceForTestPromiseRejectionEvent = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, *vm.cellHeapCellType, JSTestPromiseRejectionEvent);
</del><ins>+        spaces.m_subspaceForTestPromiseRejectionEvent = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, vm.cellHeapCellType(), JSTestPromiseRejectionEvent);
</ins><span class="cx">     auto* space = spaces.m_subspaceForTestPromiseRejectionEvent.get();
</span><span class="cx"> IGNORE_WARNINGS_BEGIN("unreachable-code")
</span><span class="cx"> IGNORE_WARNINGS_BEGIN("tautological-compare")
</span></span></pre></div>
<a id="trunkSourceWebCorebindingsscriptstestJSJSTestReadOnlyMapLikecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/scripts/test/JS/JSTestReadOnlyMapLike.cpp (286346 => 286347)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/bindings/scripts/test/JS/JSTestReadOnlyMapLike.cpp  2021-12-01 02:56:24 UTC (rev 286346)
+++ trunk/Source/WebCore/bindings/scripts/test/JS/JSTestReadOnlyMapLike.cpp     2021-12-01 04:38:56 UTC (rev 286347)
</span><span class="lines">@@ -79,7 +79,7 @@
</span><span class="cx">     static JSC::IsoSubspace* subspaceFor(JSC::VM& vm)
</span><span class="cx">     {
</span><span class="cx">         STATIC_ASSERT_ISO_SUBSPACE_SHARABLE(JSTestReadOnlyMapLikePrototype, Base);
</span><del>-        return &vm.plainObjectSpace;
</del><ins>+        return &vm.plainObjectSpace();
</ins><span class="cx">     }
</span><span class="cx">     static JSC::Structure* createStructure(JSC::VM& vm, JSC::JSGlobalObject* globalObject, JSC::JSValue prototype)
</span><span class="cx">     {
</span><span class="lines">@@ -305,9 +305,9 @@
</span><span class="cx">         return space;
</span><span class="cx">     static_assert(std::is_base_of_v<JSC::JSDestructibleObject, JSTestReadOnlyMapLike> || !JSTestReadOnlyMapLike::needsDestruction);
</span><span class="cx">     if constexpr (std::is_base_of_v<JSC::JSDestructibleObject, JSTestReadOnlyMapLike>)
</span><del>-        spaces.m_subspaceForTestReadOnlyMapLike = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, *vm.destructibleObjectHeapCellType, JSTestReadOnlyMapLike);
</del><ins>+        spaces.m_subspaceForTestReadOnlyMapLike = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, vm.destructibleObjectHeapCellType(), JSTestReadOnlyMapLike);
</ins><span class="cx">     else
</span><del>-        spaces.m_subspaceForTestReadOnlyMapLike = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, *vm.cellHeapCellType, JSTestReadOnlyMapLike);
</del><ins>+        spaces.m_subspaceForTestReadOnlyMapLike = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, vm.cellHeapCellType(), JSTestReadOnlyMapLike);
</ins><span class="cx">     auto* space = spaces.m_subspaceForTestReadOnlyMapLike.get();
</span><span class="cx"> IGNORE_WARNINGS_BEGIN("unreachable-code")
</span><span class="cx"> IGNORE_WARNINGS_BEGIN("tautological-compare")
</span></span></pre></div>
<a id="trunkSourceWebCorebindingsscriptstestJSJSTestReadOnlySetLikecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/scripts/test/JS/JSTestReadOnlySetLike.cpp (286346 => 286347)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/bindings/scripts/test/JS/JSTestReadOnlySetLike.cpp  2021-12-01 02:56:24 UTC (rev 286346)
+++ trunk/Source/WebCore/bindings/scripts/test/JS/JSTestReadOnlySetLike.cpp     2021-12-01 04:38:56 UTC (rev 286347)
</span><span class="lines">@@ -78,7 +78,7 @@
</span><span class="cx">     static JSC::IsoSubspace* subspaceFor(JSC::VM& vm)
</span><span class="cx">     {
</span><span class="cx">         STATIC_ASSERT_ISO_SUBSPACE_SHARABLE(JSTestReadOnlySetLikePrototype, Base);
</span><del>-        return &vm.plainObjectSpace;
</del><ins>+        return &vm.plainObjectSpace();
</ins><span class="cx">     }
</span><span class="cx">     static JSC::Structure* createStructure(JSC::VM& vm, JSC::JSGlobalObject* globalObject, JSC::JSValue prototype)
</span><span class="cx">     {
</span><span class="lines">@@ -284,9 +284,9 @@
</span><span class="cx">         return space;
</span><span class="cx">     static_assert(std::is_base_of_v<JSC::JSDestructibleObject, JSTestReadOnlySetLike> || !JSTestReadOnlySetLike::needsDestruction);
</span><span class="cx">     if constexpr (std::is_base_of_v<JSC::JSDestructibleObject, JSTestReadOnlySetLike>)
</span><del>-        spaces.m_subspaceForTestReadOnlySetLike = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, *vm.destructibleObjectHeapCellType, JSTestReadOnlySetLike);
</del><ins>+        spaces.m_subspaceForTestReadOnlySetLike = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, vm.destructibleObjectHeapCellType(), JSTestReadOnlySetLike);
</ins><span class="cx">     else
</span><del>-        spaces.m_subspaceForTestReadOnlySetLike = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, *vm.cellHeapCellType, JSTestReadOnlySetLike);
</del><ins>+        spaces.m_subspaceForTestReadOnlySetLike = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, vm.cellHeapCellType(), JSTestReadOnlySetLike);
</ins><span class="cx">     auto* space = spaces.m_subspaceForTestReadOnlySetLike.get();
</span><span class="cx"> IGNORE_WARNINGS_BEGIN("unreachable-code")
</span><span class="cx"> IGNORE_WARNINGS_BEGIN("tautological-compare")
</span></span></pre></div>
<a id="trunkSourceWebCorebindingsscriptstestJSJSTestReportExtraMemoryCostcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/scripts/test/JS/JSTestReportExtraMemoryCost.cpp (286346 => 286347)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/bindings/scripts/test/JS/JSTestReportExtraMemoryCost.cpp    2021-12-01 02:56:24 UTC (rev 286346)
+++ trunk/Source/WebCore/bindings/scripts/test/JS/JSTestReportExtraMemoryCost.cpp       2021-12-01 04:38:56 UTC (rev 286347)
</span><span class="lines">@@ -63,7 +63,7 @@
</span><span class="cx">     static JSC::IsoSubspace* subspaceFor(JSC::VM& vm)
</span><span class="cx">     {
</span><span class="cx">         STATIC_ASSERT_ISO_SUBSPACE_SHARABLE(JSTestReportExtraMemoryCostPrototype, Base);
</span><del>-        return &vm.plainObjectSpace;
</del><ins>+        return &vm.plainObjectSpace();
</ins><span class="cx">     }
</span><span class="cx">     static JSC::Structure* createStructure(JSC::VM& vm, JSC::JSGlobalObject* globalObject, JSC::JSValue prototype)
</span><span class="cx">     {
</span><span class="lines">@@ -171,9 +171,9 @@
</span><span class="cx">         return space;
</span><span class="cx">     static_assert(std::is_base_of_v<JSC::JSDestructibleObject, JSTestReportExtraMemoryCost> || !JSTestReportExtraMemoryCost::needsDestruction);
</span><span class="cx">     if constexpr (std::is_base_of_v<JSC::JSDestructibleObject, JSTestReportExtraMemoryCost>)
</span><del>-        spaces.m_subspaceForTestReportExtraMemoryCost = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, *vm.destructibleObjectHeapCellType, JSTestReportExtraMemoryCost);
</del><ins>+        spaces.m_subspaceForTestReportExtraMemoryCost = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, vm.destructibleObjectHeapCellType(), JSTestReportExtraMemoryCost);
</ins><span class="cx">     else
</span><del>-        spaces.m_subspaceForTestReportExtraMemoryCost = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, *vm.cellHeapCellType, JSTestReportExtraMemoryCost);
</del><ins>+        spaces.m_subspaceForTestReportExtraMemoryCost = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, vm.cellHeapCellType(), JSTestReportExtraMemoryCost);
</ins><span class="cx">     auto* space = spaces.m_subspaceForTestReportExtraMemoryCost.get();
</span><span class="cx"> IGNORE_WARNINGS_BEGIN("unreachable-code")
</span><span class="cx"> IGNORE_WARNINGS_BEGIN("tautological-compare")
</span></span></pre></div>
<a id="trunkSourceWebCorebindingsscriptstestJSJSTestSerializedScriptValueInterfacecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/scripts/test/JS/JSTestSerializedScriptValueInterface.cpp (286346 => 286347)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/bindings/scripts/test/JS/JSTestSerializedScriptValueInterface.cpp   2021-12-01 02:56:24 UTC (rev 286346)
+++ trunk/Source/WebCore/bindings/scripts/test/JS/JSTestSerializedScriptValueInterface.cpp      2021-12-01 04:38:56 UTC (rev 286347)
</span><span class="lines">@@ -89,7 +89,7 @@
</span><span class="cx">     static JSC::IsoSubspace* subspaceFor(JSC::VM& vm)
</span><span class="cx">     {
</span><span class="cx">         STATIC_ASSERT_ISO_SUBSPACE_SHARABLE(JSTestSerializedScriptValueInterfacePrototype, Base);
</span><del>-        return &vm.plainObjectSpace;
</del><ins>+        return &vm.plainObjectSpace();
</ins><span class="cx">     }
</span><span class="cx">     static JSC::Structure* createStructure(JSC::VM& vm, JSC::JSGlobalObject* globalObject, JSC::JSValue prototype)
</span><span class="cx">     {
</span><span class="lines">@@ -349,9 +349,9 @@
</span><span class="cx">         return space;
</span><span class="cx">     static_assert(std::is_base_of_v<JSC::JSDestructibleObject, JSTestSerializedScriptValueInterface> || !JSTestSerializedScriptValueInterface::needsDestruction);
</span><span class="cx">     if constexpr (std::is_base_of_v<JSC::JSDestructibleObject, JSTestSerializedScriptValueInterface>)
</span><del>-        spaces.m_subspaceForTestSerializedScriptValueInterface = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, *vm.destructibleObjectHeapCellType, JSTestSerializedScriptValueInterface);
</del><ins>+        spaces.m_subspaceForTestSerializedScriptValueInterface = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, vm.destructibleObjectHeapCellType(), JSTestSerializedScriptValueInterface);
</ins><span class="cx">     else
</span><del>-        spaces.m_subspaceForTestSerializedScriptValueInterface = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, *vm.cellHeapCellType, JSTestSerializedScriptValueInterface);
</del><ins>+        spaces.m_subspaceForTestSerializedScriptValueInterface = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, vm.cellHeapCellType(), JSTestSerializedScriptValueInterface);
</ins><span class="cx">     auto* space = spaces.m_subspaceForTestSerializedScriptValueInterface.get();
</span><span class="cx"> IGNORE_WARNINGS_BEGIN("unreachable-code")
</span><span class="cx"> IGNORE_WARNINGS_BEGIN("tautological-compare")
</span></span></pre></div>
<a id="trunkSourceWebCorebindingsscriptstestJSJSTestSetLikecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/scripts/test/JS/JSTestSetLike.cpp (286346 => 286347)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/bindings/scripts/test/JS/JSTestSetLike.cpp  2021-12-01 02:56:24 UTC (rev 286346)
+++ trunk/Source/WebCore/bindings/scripts/test/JS/JSTestSetLike.cpp     2021-12-01 04:38:56 UTC (rev 286347)
</span><span class="lines">@@ -81,7 +81,7 @@
</span><span class="cx">     static JSC::IsoSubspace* subspaceFor(JSC::VM& vm)
</span><span class="cx">     {
</span><span class="cx">         STATIC_ASSERT_ISO_SUBSPACE_SHARABLE(JSTestSetLikePrototype, Base);
</span><del>-        return &vm.plainObjectSpace;
</del><ins>+        return &vm.plainObjectSpace();
</ins><span class="cx">     }
</span><span class="cx">     static JSC::Structure* createStructure(JSC::VM& vm, JSC::JSGlobalObject* globalObject, JSC::JSValue prototype)
</span><span class="cx">     {
</span><span class="lines">@@ -342,9 +342,9 @@
</span><span class="cx">         return space;
</span><span class="cx">     static_assert(std::is_base_of_v<JSC::JSDestructibleObject, JSTestSetLike> || !JSTestSetLike::needsDestruction);
</span><span class="cx">     if constexpr (std::is_base_of_v<JSC::JSDestructibleObject, JSTestSetLike>)
</span><del>-        spaces.m_subspaceForTestSetLike = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, *vm.destructibleObjectHeapCellType, JSTestSetLike);
</del><ins>+        spaces.m_subspaceForTestSetLike = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, vm.destructibleObjectHeapCellType(), JSTestSetLike);
</ins><span class="cx">     else
</span><del>-        spaces.m_subspaceForTestSetLike = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, *vm.cellHeapCellType, JSTestSetLike);
</del><ins>+        spaces.m_subspaceForTestSetLike = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, vm.cellHeapCellType(), JSTestSetLike);
</ins><span class="cx">     auto* space = spaces.m_subspaceForTestSetLike.get();
</span><span class="cx"> IGNORE_WARNINGS_BEGIN("unreachable-code")
</span><span class="cx"> IGNORE_WARNINGS_BEGIN("tautological-compare")
</span></span></pre></div>
<a id="trunkSourceWebCorebindingsscriptstestJSJSTestSetLikeWithOverriddenOperationscpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/scripts/test/JS/JSTestSetLikeWithOverriddenOperations.cpp (286346 => 286347)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/bindings/scripts/test/JS/JSTestSetLikeWithOverriddenOperations.cpp  2021-12-01 02:56:24 UTC (rev 286346)
+++ trunk/Source/WebCore/bindings/scripts/test/JS/JSTestSetLikeWithOverriddenOperations.cpp     2021-12-01 04:38:56 UTC (rev 286347)
</span><span class="lines">@@ -85,7 +85,7 @@
</span><span class="cx">     static JSC::IsoSubspace* subspaceFor(JSC::VM& vm)
</span><span class="cx">     {
</span><span class="cx">         STATIC_ASSERT_ISO_SUBSPACE_SHARABLE(JSTestSetLikeWithOverriddenOperationsPrototype, Base);
</span><del>-        return &vm.plainObjectSpace;
</del><ins>+        return &vm.plainObjectSpace();
</ins><span class="cx">     }
</span><span class="cx">     static JSC::Structure* createStructure(JSC::VM& vm, JSC::JSGlobalObject* globalObject, JSC::JSValue prototype)
</span><span class="cx">     {
</span><span class="lines">@@ -354,9 +354,9 @@
</span><span class="cx">         return space;
</span><span class="cx">     static_assert(std::is_base_of_v<JSC::JSDestructibleObject, JSTestSetLikeWithOverriddenOperations> || !JSTestSetLikeWithOverriddenOperations::needsDestruction);
</span><span class="cx">     if constexpr (std::is_base_of_v<JSC::JSDestructibleObject, JSTestSetLikeWithOverriddenOperations>)
</span><del>-        spaces.m_subspaceForTestSetLikeWithOverriddenOperations = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, *vm.destructibleObjectHeapCellType, JSTestSetLikeWithOverriddenOperations);
</del><ins>+        spaces.m_subspaceForTestSetLikeWithOverriddenOperations = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, vm.destructibleObjectHeapCellType(), JSTestSetLikeWithOverriddenOperations);
</ins><span class="cx">     else
</span><del>-        spaces.m_subspaceForTestSetLikeWithOverriddenOperations = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, *vm.cellHeapCellType, JSTestSetLikeWithOverriddenOperations);
</del><ins>+        spaces.m_subspaceForTestSetLikeWithOverriddenOperations = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, vm.cellHeapCellType(), JSTestSetLikeWithOverriddenOperations);
</ins><span class="cx">     auto* space = spaces.m_subspaceForTestSetLikeWithOverriddenOperations.get();
</span><span class="cx"> IGNORE_WARNINGS_BEGIN("unreachable-code")
</span><span class="cx"> IGNORE_WARNINGS_BEGIN("tautological-compare")
</span></span></pre></div>
<a id="trunkSourceWebCorebindingsscriptstestJSJSTestStringifiercpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/scripts/test/JS/JSTestStringifier.cpp (286346 => 286347)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/bindings/scripts/test/JS/JSTestStringifier.cpp      2021-12-01 02:56:24 UTC (rev 286346)
+++ trunk/Source/WebCore/bindings/scripts/test/JS/JSTestStringifier.cpp 2021-12-01 04:38:56 UTC (rev 286347)
</span><span class="lines">@@ -69,7 +69,7 @@
</span><span class="cx">     static JSC::IsoSubspace* subspaceFor(JSC::VM& vm)
</span><span class="cx">     {
</span><span class="cx">         STATIC_ASSERT_ISO_SUBSPACE_SHARABLE(JSTestStringifierPrototype, Base);
</span><del>-        return &vm.plainObjectSpace;
</del><ins>+        return &vm.plainObjectSpace();
</ins><span class="cx">     }
</span><span class="cx">     static JSC::Structure* createStructure(JSC::VM& vm, JSC::JSGlobalObject* globalObject, JSC::JSValue prototype)
</span><span class="cx">     {
</span><span class="lines">@@ -192,9 +192,9 @@
</span><span class="cx">         return space;
</span><span class="cx">     static_assert(std::is_base_of_v<JSC::JSDestructibleObject, JSTestStringifier> || !JSTestStringifier::needsDestruction);
</span><span class="cx">     if constexpr (std::is_base_of_v<JSC::JSDestructibleObject, JSTestStringifier>)
</span><del>-        spaces.m_subspaceForTestStringifier = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, *vm.destructibleObjectHeapCellType, JSTestStringifier);
</del><ins>+        spaces.m_subspaceForTestStringifier = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, vm.destructibleObjectHeapCellType(), JSTestStringifier);
</ins><span class="cx">     else
</span><del>-        spaces.m_subspaceForTestStringifier = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, *vm.cellHeapCellType, JSTestStringifier);
</del><ins>+        spaces.m_subspaceForTestStringifier = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, vm.cellHeapCellType(), JSTestStringifier);
</ins><span class="cx">     auto* space = spaces.m_subspaceForTestStringifier.get();
</span><span class="cx"> IGNORE_WARNINGS_BEGIN("unreachable-code")
</span><span class="cx"> IGNORE_WARNINGS_BEGIN("tautological-compare")
</span></span></pre></div>
<a id="trunkSourceWebCorebindingsscriptstestJSJSTestStringifierAnonymousOperationcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/scripts/test/JS/JSTestStringifierAnonymousOperation.cpp (286346 => 286347)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/bindings/scripts/test/JS/JSTestStringifierAnonymousOperation.cpp    2021-12-01 02:56:24 UTC (rev 286346)
+++ trunk/Source/WebCore/bindings/scripts/test/JS/JSTestStringifierAnonymousOperation.cpp       2021-12-01 04:38:56 UTC (rev 286347)
</span><span class="lines">@@ -69,7 +69,7 @@
</span><span class="cx">     static JSC::IsoSubspace* subspaceFor(JSC::VM& vm)
</span><span class="cx">     {
</span><span class="cx">         STATIC_ASSERT_ISO_SUBSPACE_SHARABLE(JSTestStringifierAnonymousOperationPrototype, Base);
</span><del>-        return &vm.plainObjectSpace;
</del><ins>+        return &vm.plainObjectSpace();
</ins><span class="cx">     }
</span><span class="cx">     static JSC::Structure* createStructure(JSC::VM& vm, JSC::JSGlobalObject* globalObject, JSC::JSValue prototype)
</span><span class="cx">     {
</span><span class="lines">@@ -192,9 +192,9 @@
</span><span class="cx">         return space;
</span><span class="cx">     static_assert(std::is_base_of_v<JSC::JSDestructibleObject, JSTestStringifierAnonymousOperation> || !JSTestStringifierAnonymousOperation::needsDestruction);
</span><span class="cx">     if constexpr (std::is_base_of_v<JSC::JSDestructibleObject, JSTestStringifierAnonymousOperation>)
</span><del>-        spaces.m_subspaceForTestStringifierAnonymousOperation = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, *vm.destructibleObjectHeapCellType, JSTestStringifierAnonymousOperation);
</del><ins>+        spaces.m_subspaceForTestStringifierAnonymousOperation = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, vm.destructibleObjectHeapCellType(), JSTestStringifierAnonymousOperation);
</ins><span class="cx">     else
</span><del>-        spaces.m_subspaceForTestStringifierAnonymousOperation = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, *vm.cellHeapCellType, JSTestStringifierAnonymousOperation);
</del><ins>+        spaces.m_subspaceForTestStringifierAnonymousOperation = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, vm.cellHeapCellType(), JSTestStringifierAnonymousOperation);
</ins><span class="cx">     auto* space = spaces.m_subspaceForTestStringifierAnonymousOperation.get();
</span><span class="cx"> IGNORE_WARNINGS_BEGIN("unreachable-code")
</span><span class="cx"> IGNORE_WARNINGS_BEGIN("tautological-compare")
</span></span></pre></div>
<a id="trunkSourceWebCorebindingsscriptstestJSJSTestStringifierNamedOperationcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/scripts/test/JS/JSTestStringifierNamedOperation.cpp (286346 => 286347)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/bindings/scripts/test/JS/JSTestStringifierNamedOperation.cpp        2021-12-01 02:56:24 UTC (rev 286346)
+++ trunk/Source/WebCore/bindings/scripts/test/JS/JSTestStringifierNamedOperation.cpp   2021-12-01 04:38:56 UTC (rev 286347)
</span><span class="lines">@@ -70,7 +70,7 @@
</span><span class="cx">     static JSC::IsoSubspace* subspaceFor(JSC::VM& vm)
</span><span class="cx">     {
</span><span class="cx">         STATIC_ASSERT_ISO_SUBSPACE_SHARABLE(JSTestStringifierNamedOperationPrototype, Base);
</span><del>-        return &vm.plainObjectSpace;
</del><ins>+        return &vm.plainObjectSpace();
</ins><span class="cx">     }
</span><span class="cx">     static JSC::Structure* createStructure(JSC::VM& vm, JSC::JSGlobalObject* globalObject, JSC::JSValue prototype)
</span><span class="cx">     {
</span><span class="lines">@@ -209,9 +209,9 @@
</span><span class="cx">         return space;
</span><span class="cx">     static_assert(std::is_base_of_v<JSC::JSDestructibleObject, JSTestStringifierNamedOperation> || !JSTestStringifierNamedOperation::needsDestruction);
</span><span class="cx">     if constexpr (std::is_base_of_v<JSC::JSDestructibleObject, JSTestStringifierNamedOperation>)
</span><del>-        spaces.m_subspaceForTestStringifierNamedOperation = makeUnique<IsoSubspace> ISO_SUBSPACE_INIT(vm.heap, *vm.destructibleObjectHeapCellType, JSTestStringifierNamedOperation);
</